/* * df5642_rig.c -- DF-5642/5643 rig: instantiate the REAL in-kernel * smbus driver (sys/bus/smbus/smbus.c, unmodified production code) * under a fake SMBus-controller parent and drive the newbus * attach/detach lifecycle from userland. * * Targets (sys/bus/smbus/smbus.c): * DF-5642 smbus_attach() (smbus.c:94-97) creates the generic child * and the whole address-probe child set UNCONDITIONALLY on * every attach, while smbus_detach() (smbus.c:105-115) and * the module teardown path (devclass_delete_driver, * subr_bus.c:888-897) only DETACH children, never DELETE * them. Every detach+re-attach cycle of the smbus device * leaks the full child set and mints duplicate remapped * /dev/smbN[-XX] nodes (devclass_alloc_unit remap, * subr_bus.c:1072-1081), breaking the 0x0400 unit-encoding * contract (smb.c:134-141/229-231, cyapa.c:466-472). * DF-5643 smbus_detach() never checks struct smbus_softc.owner * (smbus.h:34): a bus owned by a client detaches "cleanly", * device_detach() then FREES the softc (device_set_driver, * subr_bus.c:1941-1946, called from subr_bus.c:2150) under * (a) the owner -- whose next smbus_release_bus() * (the smbioctl exit path, smb.c:356) derefs * device_get_softc(bus)==NULL -> Fatal trap 12, and * (b) parked SMB_WAIT requesters tsleep'ing ON the softc * (smbconf.c:89/93) which are never woken and keep looping * on freed memory. * * Rig structure (family standard, mirrors the DF-5559/5636 fakebb rigs): * * nexus -> fakesmbb0 (this module: SMBus controller emulator * + /dev/df5642 ioctl surface) * -> smbus0 (REAL in-kernel smbus driver, registered * on "fakesmbb" exactly like intpm.c:903 * registers it on "intsmb"; created via * device_add_child+device_probe_and_attach * exactly like intpm.c:331-337) * -> smb children (REAL smb.ko, kldload'ed after * this rig; mints /dev/smbN[-XX] nodes) * * /dev/df5642 ioctls: * STAT list smbus0's children (count + nameunit each) * CYCLE n n x (device_detach(smbus0) + device_probe_and_attach(smbus0)) * -- the exact production APIs the module handlers invoke * GRAB smbus_request_bus(smbus0, fakesmbb0, SMB_DONTWAIT) -> owner * VETO device_detach(smbus0) WHILE OWNED -- must return EBUSY * RELFREE smbus_release_bus(smbus0, owner) after VETO freed the * softc -- reproduces the smbioctl exit path (smb.c:356) * PARK kthread: smbus_request_bus(smbus0, nexus0, SMB_WAIT|NOINTR) * WAKUAF wakeup(freed softc) -- parked waiter resumes on freed mem */ #include #include #include #include #include #include #include #include #include #include #include #include #include /* struct smbus_softc (copied from sys/bus/smbus/smbus.h, family * standard: the header is tiny and private to the audit rig). */ struct smbus_softc { device_t owner; /* smbus owner device structure */ }; #include "smbus_if.h" /* df5642ctl.c <-> rig ioctl protocol */ #define DF5642_STAT _IOWR('d', 1, int) #define DF5642_CYCLE _IOWR('d', 2, int) /* arg = cycle count */ #define DF5642_GRAB _IOWR('d', 3, int) #define DF5642_VETO _IOWR('d', 4, int) #define DF5642_RELFREE _IOWR('d', 5, int) #define DF5642_PARK _IOWR('d', 6, int) #define DF5642_WAKUAF _IOWR('d', 7, int) static int df5642_open(struct dev_open_args *ap); static int df5642_close(struct dev_close_args *ap); static int df5642_ioctl(struct dev_ioctl_args *ap); static struct dev_ops df5642_ops = { { "df5642", 0, 0 }, .d_open = df5642_open, .d_close = df5642_close, .d_ioctl = df5642_ioctl, }; struct fakesmbb_softc { device_t self; /* fakesmbb0: owner token */ device_t smbus; /* smbus0: the bus under test */ cdev_t cdev; /* /dev/df5642 */ u_int respond; /* address mask the slave answers */ /* parked-waiter state (DF-5643 run C) */ volatile int park_started; volatile int park_done; int park_error; void *park_sc; /* softc the waiter sleeps on */ }; /* address masks the emulated slave answers (addr 0..63 / 64..127) */ static uint64_t df5642_respond = ((uint64_t)1 << 0x10); /* 0x10 */ static uint64_t df5642_respond_hi = (((uint64_t)1 << (0x50 - 64)) | ((uint64_t)1 << (0x67 - 64))); SYSCTL_NODE(_hw, OID_AUTO, df5642, CTLFLAG_RW, 0, "DF-5642 rig"); SYSCTL_ULONG(_hw_df5642, OID_AUTO, respond, CTLFLAG_RW, &df5642_respond, 0, "SMBus address mask lo (addr 0-63)"); SYSCTL_ULONG(_hw_df5642, OID_AUTO, respond_hi, CTLFLAG_RW, &df5642_respond_hi, 0, "SMBus address mask hi (addr 64-127)"); static int fakesmbb_answers(int slave) { if (slave < 0 || slave > 127) return (0); if (slave < 64) return ((df5642_respond >> slave) & 1); return ((df5642_respond_hi >> (slave - 64)) & 1); } /* ------------------------------------------------------------------ */ /* smbus_if methods: the emulated controller */ /* ------------------------------------------------------------------ */ static int fakesmbb_callback(device_t dev, int index, void *data) { (void)dev; (void)data; if (index == SMB_REQUEST_BUS || index == SMB_RELEASE_BUS) return (0); return (SMB_EINVAL); } static int fakesmbb_trans(device_t dev, int slave, char cmd, int op, char *wbuf, int wcount, char *rbuf, int rcount, int *actualp) { struct fakesmbb_softc *sc = (struct fakesmbb_softc *)device_get_softc(dev); (void)cmd; (void)op; (void)wbuf; (void)wcount; (void)sc; if (fakesmbb_answers(slave)) { if (rcount > 0 && rbuf != NULL) rbuf[0] = (char)0x5a; if (actualp != NULL) *actualp = (rcount > 0) ? 1 : 0; return (0); } return (SMB_ENOACK); } static void fakesmbb_intr(device_t dev, u_char devaddr, char low, char high, int error) { (void)dev; (void)devaddr; (void)low; (void)high; (void)error; } /* ------------------------------------------------------------------ */ /* helpers */ /* ------------------------------------------------------------------ */ static void stat_children(device_t bus, const char *tag) { device_t *list; int n = 0, i, error; error = device_get_children(bus, &list, &n); if (error) { kprintf("[df5642] %s: device_get_children error=%d\n", tag, error); return; } kprintf("[df5642] %s: nchildren=%d\n", tag, n); for (i = 0; i < n; i++) { const char *nu = device_get_nameunit(list[i]); kprintf("[df5642] %s: child[%d] = %s (unit=%d state=%d)\n", tag, i, nu ? nu : "(unnamed)", device_get_unit(list[i]), device_get_state(list[i])); } kfree(list, M_TEMP); } /* DF-5643 run C: kthread parking in smbus_request_bus(SMB_WAIT) */ static void park_thread(void *arg) { struct fakesmbb_softc *sc = arg; device_t bus = sc->smbus; device_t token = device_get_parent(sc->self); /* nexus0: non-owner */ sc->park_sc = device_get_softc(bus); kprintf("[df5642] PARK-T: calling request(nexus0, WAIT|NOINTR) " "softc=%p\n", sc->park_sc); sc->park_started = 1; wakeup(&sc->park_started); sc->park_error = smbus_request_bus(bus, token, SMB_WAIT | SMB_NOINTR); kprintf("[df5642] PARK-T: request RETURNED %d (post-free resume)\n", sc->park_error); sc->park_done = 1; wakeup(&sc->park_done); kthread_exit(); } /* ------------------------------------------------------------------ */ /* /dev/df5642 */ /* ------------------------------------------------------------------ */ static int df5642_open(struct dev_open_args *ap) { (void)ap; return (0); } static int df5642_close(struct dev_close_args *ap) { (void)ap; return (0); } static int df5642_ioctl(struct dev_ioctl_args *ap) { cdev_t cdev = ap->a_head.a_dev; struct fakesmbb_softc *sc = cdev->si_drv1; struct smbus_softc *ssc; u_long cmd = ap->a_cmd; int arg = *(int *)ap->a_data; int error, i; if (sc->smbus == NULL) { sc->smbus = devclass_get_device(devclass_find("smbus"), 0); if (sc->smbus == NULL) return (ENXIO); } ssc = (struct smbus_softc *)device_get_softc(sc->smbus); switch (cmd) { case DF5642_STAT: kprintf("[df5642] STAT: smbus0=%p softc=%p owner=%p\n", (void *)sc->smbus, (void *)ssc, ssc ? (void *)ssc->owner : NULL); stat_children(sc->smbus, "STAT"); *(int *)ap->a_data = 0; return (0); case DF5642_CYCLE: for (i = 0; i < arg; i++) { error = device_detach(sc->smbus); kprintf("[df5642] CYCLE %d.%d: device_detach(smbus0)=%d\n", i, 0, error); if (error) break; error = device_probe_and_attach(sc->smbus); kprintf("[df5642] CYCLE %d.%d: device_probe_and_attach=%d\n", i, 1, error); if (error) break; stat_children(sc->smbus, "after-cycle"); } *(int *)ap->a_data = error; return (0); case DF5642_GRAB: error = smbus_request_bus(sc->smbus, sc->self, SMB_DONTWAIT); ssc = (struct smbus_softc *)device_get_softc(sc->smbus); kprintf("[df5642] GRAB: request(fakesmbb0, DONTWAIT)=%d " "owner=%p (caller=%p)\n", error, ssc ? (void *)ssc->owner : NULL, (void *)sc->self); *(int *)ap->a_data = error; return (0); case DF5642_VETO: /* detach WHILE a client verifiably owns the bus */ ssc = (struct smbus_softc *)device_get_softc(sc->smbus); kprintf("[df5642] VETO: pre-detach owner=%p (must be " "non-NULL)\n", ssc ? (void *)ssc->owner : NULL); error = device_detach(sc->smbus); kprintf("[df5642] VETO: device_detach(smbus0)=%d " "%s\n", error, (error == 0) ? "<<< BUS DETACHED UNDER ITS OWNER " "(must be EBUSY=16)" : "(vetoed: GOOD)"); kprintf("[df5642] VETO: post-detach softc=%p " "(NULL = freed under the owner)\n", (void *)device_get_softc(sc->smbus)); *(int *)ap->a_data = error; return (0); case DF5642_RELFREE: /* the owner's release path = smbioctl exit (smb.c:356) */ kprintf("[df5642] RELFREE: calling smbus_release_bus(smbus0, " "fakesmbb0) with softc=%p ...\n", (void *)device_get_softc(sc->smbus)); error = smbus_release_bus(sc->smbus, sc->self); kprintf("[df5642] RELFREE: returned %d\n", error); *(int *)ap->a_data = error; return (0); case DF5642_PARK: sc->park_started = 0; sc->park_done = 0; error = kthread_create(park_thread, sc, NULL, "df5642_park"); if (error) { kprintf("[df5642] PARK: kthread_create=%d\n", error); *(int *)ap->a_data = error; return (0); } for (i = 0; i < 30 && !sc->park_started; i++) tsleep(&sc->park_started, 0, "df42s", hz / 10); kprintf("[df5642] PARK: waiter started=%d done=%d " "(parked on softc=%p)\n", sc->park_started, sc->park_done, sc->park_sc); *(int *)ap->a_data = sc->park_started; return (0); case DF5642_WAKUAF: kprintf("[df5642] WAKUAF: done=%d; wakeup(freed sc=%p)\n", sc->park_done, sc->park_sc); if (sc->park_sc != NULL) wakeup(sc->park_sc); for (i = 0; i < 20 && !sc->park_done; i++) tsleep(&sc->park_done, 0, "df42w", hz / 10); kprintf("[df5642] WAKUAF: after wakeup: done=%d error=%d " "(done=0 -> waiter re-parked on FREED softc)\n", sc->park_done, sc->park_error); *(int *)ap->a_data = sc->park_done; return (0); default: return (ENOTTY); } } /* ------------------------------------------------------------------ */ /* fakesmbb bus device plumbing */ /* ------------------------------------------------------------------ */ static void fakesmbb_identify(driver_t *driver, device_t parent) { if (device_find_child(parent, "fakesmbb", 0) == NULL) BUS_ADD_CHILD(parent, parent, 0, "fakesmbb", 0); } static int fakesmbb_probe(device_t dev) { device_set_desc(dev, "DF-5642 fake SMBus controller"); return (0); } static int fakesmbb_attach(device_t dev) { struct fakesmbb_softc *sc = (struct fakesmbb_softc *)device_get_softc(dev); sc->self = dev; /* mirror intpm.c:331-337 exactly */ sc->smbus = device_add_child(dev, "smbus", -1); if (sc->smbus == NULL) { kprintf("[df5642] failed to add smbus child\n"); return (ENXIO); } if (device_probe_and_attach(sc->smbus) != 0) kprintf("[df5642] smbus child failed to attach\n"); sc->cdev = make_dev(&df5642_ops, 0, UID_ROOT, GID_WHEEL, 0600, "df5642"); if (sc->cdev == NULL) kprintf("[df5642] make_dev failed\n"); else sc->cdev->si_drv1 = sc; kprintf("[df5642] attach done: smbus0=%p cdev=%p " "(now: kldload smb)\n", (void *)sc->smbus, (void *)sc->cdev); stat_children(sc->smbus, "attach"); return (0); } static int fakesmbb_detach(device_t dev) { struct fakesmbb_softc *sc = (struct fakesmbb_softc *)device_get_softc(dev); device_t child = sc->smbus; if (sc->cdev) { dev_ops_remove_minor(&df5642_ops, 0); sc->cdev = NULL; } bus_generic_detach(dev); if (child) device_delete_child(dev, child); return (0); } static device_method_t fakesmbb_methods[] = { /* device interface */ DEVMETHOD(device_identify, fakesmbb_identify), DEVMETHOD(device_probe, fakesmbb_probe), DEVMETHOD(device_attach, fakesmbb_attach), DEVMETHOD(device_detach, fakesmbb_detach), /* smbus interface (the emulated controller vtable) */ DEVMETHOD(smbus_callback, fakesmbb_callback), DEVMETHOD(smbus_trans, fakesmbb_trans), DEVMETHOD(smbus_intr, fakesmbb_intr), DEVMETHOD_END }; static driver_t fakesmbb_driver = { "fakesmbb", fakesmbb_methods, sizeof(struct fakesmbb_softc), }; static devclass_t fakesmbb_devclass; DRIVER_MODULE(fakesmbb, nexus, fakesmbb_driver, fakesmbb_devclass, NULL, NULL); /* register the REAL production smbus driver on the fake bus * (exactly what intpm.c:903 does for the PIIX4) */ DRIVER_MODULE(smbus, fakesmbb, smbus_driver, smbus_devclass, NULL, NULL); MODULE_DEPEND(fakesmbb, smbus, SMBUS_MINVER, SMBUS_PREFVER, SMBUS_MAXVER); MODULE_VERSION(fakesmbb, 1);