⬢ DragonFlyBSD Kernel Audit
DF-5845 / fwharness.h
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
/*
 * fwharness.h -- shared ioctl definitions for the fwdev.c verification
 * harness (kernel fwharness.c + userland fwhctl(8) helper).
 * DF-5845 additions: PKTRCV / PEND / SPRAYADDR.
 */
#ifndef _FWHARNESS_H
#define _FWHARNESS_H

#include <sys/ioccom.h>
#include <sys/types.h>

#define FWHIOC_MAXREC	_IOW('H', 1, u_int32_t)
#define FWHIOC_INJECT	_IOW('H', 2, u_int32_t)

struct fwh_sprayreq {
	u_int32_t n;		/* number of chunks */
	u_int32_t size;		/* chunk size in bytes */
};
#define FWHIOC_SPRAY	_IOW('H', 3, struct fwh_sprayreq)
#define FWHIOC_UNSPRAY	_IOW('H', 4, u_int32_t)

struct fwh_respreq {
	u_int32_t paylen;	/* emulated peer response payload length */
	u_int32_t fill;		/* fill byte of emulated response */
};
#define FWHIOC_RESP	_IOW('H', 5, struct fwh_respreq)

struct fwh_chkreq {
	u_int32_t corrupt;	/* 1 if any canary chunk damaged */
	u_int32_t badwords;	/* count of damaged 16-byte records */
};
#define FWHIOC_SPRAYCHK _IOWR('H', 6, struct fwh_chkreq)

#define FWH_DUMP_CHUNKS 24	/* keep sizeof(fwh_dumpreq) under IOC max 8191 */
#define FWH_DUMP_HDR    160
struct fwh_dumpchunk {
	u_int32_t idx;
	u_int32_t size;
	u_int32_t data[FWH_DUMP_HDR / 4];
};
struct fwh_dumpreq {
	u_int32_t start;		/* first chunk index to dump */
	u_int32_t n;			/* in: capacity, out: dumped */
	struct fwh_dumpchunk chunk[FWH_DUMP_CHUNKS];
};
#define FWHIOC_SPRAYDUMP _IOWR('H', 7, struct fwh_dumpreq)
#define FWHIOC_SPRAYFREE	_IOW('H', 8, u_int32_t)
#define FWHIOC_SPRAYPOP		_IOW('H', 9, u_int32_t)

/*
 * DF-5845: deliver a received async packet through the STOCK fw_rcv()
 * (sys/bus/firewire/firewire.c:1731), exactly as the fwohci AR-DMA
 * receive interrupt would.  The emulated FireWire peer (root-only rig)
 * crafts the packet bytes; the stock kernel does all the parsing.
 */
#define FWH_PKT_MAX	4096
struct fwh_pktreq {
	u_int32_t len;			/* total packet length (hdr+payload) */
	u_int32_t pad;
	u_char data[FWH_PKT_MAX];	/* packet bytes */
};
#define FWHIOC_PKTRCV	_IOW('H', 10, struct fwh_pktreq)

/*
 * DF-5845: pending-AT table -- what the interposed TX start has
 * dequeued and marked FWXF_SENT (the wire view: dst + tlabel are both
 * observable on the FireWire bus by the peer).
 */
#define FWH_PEND_MAX	16
struct fwh_pendent {
	u_int64_t xfer;			/* kernel fw_xfer address */
	u_int32_t dst;			/* send.hdr dst (wire-visible) */
	u_int32_t tl;			/* tlabel (wire-visible) */
	u_int32_t seq;			/* dequeue order */
	u_int32_t flags;		/* unused */
};
struct fwh_pendreq {
	u_int32_t n;			/* out: number of entries */
	u_int32_t seq_after;		/* in: only report seq > this */
	struct fwh_pendent ent[FWH_PEND_MAX];
};
#define FWHIOC_PEND	_IOWR('H', 11, struct fwh_pendreq)

/* DF-5845: address of sprayed canary chunk idx (heap-shaping feedback) */
struct fwh_addrreq {
	u_int32_t idx;			/* in */
	u_int32_t pad;
	u_int64_t addr;			/* out */
};
#define FWHIOC_SPRAYADDR _IOWR('H', 12, struct fwh_addrreq)

#endif /* _FWHARNESS_H */