/* * dfrig_nat.c -- DF-2210 verification rig * (sys/dev/disk/nata/chipsets/ata-national.c:77-78) * * Finding under test: * * ata_national_setmode() unconditionally executes * * ch->dma->alignment = 16; <-- ata-national.c:77 * ch->dma->max_iosize = 64*DEV_BSIZE; <-- ata-national.c:78 * * with no NULL guard, while its own template (the Cyrix original, * chipsets/ata-cyrix.c:82-101) guards the identical derefs behind * `if (ctlr->r_res1)`. ch->dma is legitimately NULL in production: * ata-dma.c:153-154 frees ch->dma and sets it to NULL whenever DMA * allocation fails ("WARNING - DMA allocation failed, disabling DMA"), * after which the channel keeps operating in PIO -- and every later * setmode dispatch panics the kernel instead. * * Real dispatch chain that reaches the handler (all production cites): * * ioctl(IOCATASMODE) sys/dev/disk/nata/ata-all.c:523-526 * ATA_SETMODE(parent, dev) (newbus method, ata_if.m) * -> ata_pcichannel_setmode() sys/dev/disk/nata/ata-pci.c:855-866 * ctlr->setmode(dev, ATA_PIO_MAX); <-- extracted call site * if (mode >= ATA_DMA) ctlr->setmode(dev, mode); * (same funnel for boot reinit and acd_open -> atapi-cd.c:147/226, * atapi-tape.c:121/214, atapi-fd.c:107/180, ata-disk.c:436) * -> ata_national_setmode() chipsets/ata-national.c:60 * -> line 77 NULL deref: write 16 to absolute vaddr 0x58 * (offsetof(struct ata_dma, alignment) == 0x58 on amd64; * max_iosize sits at 0x5c) * * The hardware is gated (National Geode SC1100, PCI ID 0x0502100b), so * this rig follows the established production-handler dispatch class * (DF-252x trm, DF-249x nata): * * - the production file chipsets/ata-national.c is #included VERBATIM * from the guest /usr/src tree (build.sh verifies the file sha256 * against the audited sys/ tree). The ONLY textual intervention is * `#define ata_national_ident rig_unused_ata_national_ident`, which * renames the never-called ident() entry point to avoid a duplicate * global against the built-in kernel copy; ata_national_setmode * itself is compiled byte-for-byte as written, static, under its * production name (backtrace below reads `ata_national_setmode+..`). * * - the RUNNING KERNEL's OWN ata_national_setmode (local symbol, from * `nm /boot/kernel/kernel`, address injected via sysctl) is ALSO * dispatched -- the shipped binary, zero recompilation. * * - the channel/controller/ata-device state is exactly what the * machine presents when DMA is unavailable: ch->dma == NULL, disk * present on the channel (ch->devices = ATA_ATA_MASTER), PIO4/UDMA2 * capable identify data in atadev->param. The channel is in the * ATA_STALL_QUEUE state with a begin_transaction that reports the * drive accepting SETXFER, so the kernel's own production * ata_controlcmd()/ata_queue_request() (ata-queue.c:158-190, * synchronous CONTROL completion at ata-queue.c:100-115) run * unmodified. The PCI config timing writes at ata-national.c:88-100 * land on a fabricated kobj bus that records them (the production * code calls the pcivar.h static inlines PCI_WRITE_CONFIG / * PCI_READ_CONFIG; those dispatch through the kernel kobj machinery * on our fabricated ops table). * * Tests (sysctl kern.dfrig_nat.go=N): * * 1 THE FINDING, shipped kernel handler: ch->dma=NULL, direct call * of the kernel's own ata_national_setmode with mode=ATA_PIO_MAX * (exactly the first call of the extracted call site). * STOCK KERNEL: fatal trap 12 page fault, vad=0x58, stopped at * ata_national_setmode+0x..: movl $0x10,0x58(%rax) [line 77]. * 2 CONTROL, shipped kernel handler: same but ch->dma=&fake_dma -> * normal setmode: alignment 2->16, max_iosize 65536->32768, * PCI timing writes at 0x44/0x40 recorded, atadev->mode set. * 3 THE FINDING, verbatim rig copy: dispatch the #included * production source's own ata_national_setmode, ch->dma=NULL. * STOCK KERNEL: identical panic (byte-identity of the copy). * 4 CONTROL, verbatim rig copy, ch->dma=&fake_dma. * 5 FULL extracted call site (ata-pci.c:855-866): ctlr->setmode via * the controller softc, requested mode ATA_UDMA2 (a UDMA disk at * boot), ch->dma=NULL. STOCK KERNEL: panic on the first * ctlr->setmode call. FIXED KERNEL: both calls complete (PIO * timings for call 1, udmatiming[2] for call 2). * 6 CONTROL, full extracted call site, ch->dma=&fake_dma. */ #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include /* struct bsd_device layout */ #include #include #include "ata-all.h" #include "ata-pci.h" /* ------------------------------------------------------------------ */ /* CHECKER NOTE: the production file below is included VERBATIM. */ /* The single #define renames only the never-called ident() symbol so */ /* this KLD does not collide with the built-in kernel copy; the */ /* setmode function under test keeps its production name and body. */ /* build.sh pins the file by sha256 before compiling. */ /* ------------------------------------------------------------------ */ int rig_unused_ata_national_ident(device_t dev); /* kproto */ #define ata_national_ident rig_unused_ata_national_ident #include "chipsets/ata-national.c" /* <-- UNMODIFIED production code */ #undef ata_national_ident /* ------------------------------------------------------------------ */ /* channel HW completion fabrication: with ch->state == ATA_STALL_QUEUE */ /* the PRODUCTION ata_queue_request() (ata-queue.c:100-115) executes */ /* ATA_R_CONTROL requests synchronously via ch->hw.begin_transaction */ /* and returns immediately when it reports ATA_OP_FINISHED -- no */ /* queueing, no tsleep, no interrupt. This is the state a channel is */ /* in while reinit/setmode choreography runs. Our begin_transaction */ /* stands for the drive accepting SET FEATURES / SETXFER. With this */ /* in place even the RUNNING KERNEL's own ata_controlcmd() and */ /* ata_queue_request() (ata-queue.c:158-190/69-157) run unmodified. */ /* ------------------------------------------------------------------ */ static int rig_cmd_seen; /* begin_transaction dispatches */ static int rig_begin_transaction(struct ata_request *request) { rig_cmd_seen++; request->result = 0; /* drive accepted SETXFER */ request->flags |= ATA_R_COMPLETED; return ATA_OP_FINISHED; } /* ------------------------------------------------------------------ */ /* fabricated kobj bus: the PCI config timing writes of the production */ /* handler (ata-national.c:88-100) dispatch through the kernel kobj */ /* machinery on this ops table and get recorded */ /* ------------------------------------------------------------------ */ static int rig_pci_n; static struct { int reg; u_int32_t val; int width; } rig_pci_wr[16]; static int rig_pci_reads; static int rig_i; static u_int32_t rig_pci_read(device_t bus, device_t child, int reg, int width); static void rig_pci_write(device_t bus, device_t child, int reg, u_int32_t val, int width); static struct kobj_method rig_pci_methods[] = { { &pci_read_config_desc, (kobjop_t)rig_pci_read }, { &pci_write_config_desc, (kobjop_t)rig_pci_write }, { NULL, NULL } }; static struct kobj_class rig_bus_class = { "dfrig_nat_pcib", rig_pci_methods, 0, NULL, 0, NULL }; static struct kobj_ops rig_bus_ops; static struct kobj_method rig_dummy_method = { NULL, NULL }; static u_int32_t rig_pci_read(device_t bus, device_t child, int reg, int width) { rig_pci_reads++; return 0; /* config reads as zero (like a fresh chip) */ } static void rig_pci_write(device_t bus, device_t child, int reg, u_int32_t val, int width) { if (rig_pci_n < 16) { rig_pci_wr[rig_pci_n].reg = reg; rig_pci_wr[rig_pci_n].val = val; rig_pci_wr[rig_pci_n].width = width; } rig_pci_n++; } /* ------------------------------------------------------------------ */ /* fake device graph -- the exact graph nata hands the chipset driver */ /* when a disk sits on the channel of an SC1100 controller whose DMA */ /* could not be allocated: */ /* */ /* rig_bus (kobj ops) <- fake_pci_dev (gparent, ctlr softc) */ /* <- fake_ch_dev (struct ata_channel, dma==NULL) */ /* <- fake_ata_dev (struct ata_device, unit=ATA_MASTER) */ /* ------------------------------------------------------------------ */ static struct bsd_device fake_bus_dev, fake_pci_dev, fake_ch_dev; static struct bsd_device fake_ata_dev; static struct ata_channel fake_ch; static struct ata_device fake_atadev; static struct ata_dma fake_dma; static struct ata_pci_controller fake_ctlr; static unsigned long rig_kern_addr; /* kernel own handler, via nm */ static int rig_armed; static void rig_setup_graph(void) { int i; bzero(&fake_bus_dev, sizeof(fake_bus_dev)); bzero(&fake_pci_dev, sizeof(fake_pci_dev)); bzero(&fake_ch_dev, sizeof(fake_ch_dev)); bzero(&fake_ata_dev, sizeof(fake_ata_dev)); bzero(&fake_ch, sizeof(fake_ch)); bzero(&fake_atadev, sizeof(fake_atadev)); bzero(&fake_ctlr, sizeof(fake_ctlr)); /* kobj ops cache pre-filled so the kernel kobj lookup (slow path * through rig_bus_class.methods) can run without touching real hw */ for (i = 0; i < KOBJ_CACHE_SIZE; i++) rig_bus_ops.cache[i] = &rig_dummy_method; rig_bus_ops.cls = &rig_bus_class; fake_bus_dev.ops = (kobj_ops_t)&rig_bus_ops; /* pci <- channel <- ata device, exactly as GRANDPARENT walks it */ fake_pci_dev.parent = &fake_bus_dev; fake_pci_dev.softc = &fake_ctlr; fake_ch_dev.parent = &fake_pci_dev; fake_ch_dev.softc = &fake_ch; fake_ata_dev.parent = &fake_ch_dev; fake_ata_dev.softc = &fake_atadev; /* channel: DMA unavailable is the whole point (set by caller) */ fake_ch.dev = &fake_ch_dev; fake_ch.unit = 0; fake_ch.devices = ATA_ATA_MASTER; /* disk present */ fake_ch.state = ATA_STALL_QUEUE; /* sync CONTROL completion */ fake_ch.hw.begin_transaction = rig_begin_transaction; lockinit(&fake_ch.state_mtx, "dfrig_nat_st", 0, LK_CANRECURSE); lockinit(&fake_ch.queue_mtx, "dfrig_nat_q", 0, LK_CANRECURSE); /* ata device: master, PIO4/UDMA2 capable disk identify data */ fake_atadev.dev = &fake_ata_dev; fake_atadev.unit = ATA_MASTER; fake_atadev.mode = 0xff; fake_atadev.param.atavalid = ATA_FLAG_64_70; fake_atadev.param.apiomodes = 0x02; /* PIO4 (ata_pmode -> 0x0c) */ fake_atadev.param.atavalid |= ATA_FLAG_88; fake_atadev.param.udmamodes = 0x04; /* UDMA2 (ata_umode -> 0x42) */ } /* one dispatch of the handler under test */ static void rig_dispatch(int via_kernel, int dma_null, const char *tag) { /* production ata-dmainit defaults (ata-dma.c:75-83) so the control * run shows the chipset OVERRIDING them, as on real hardware */ bzero(&fake_dma, sizeof(fake_dma)); fake_dma.alignment = 2; fake_dma.max_iosize = 128 * DEV_BSIZE; fake_ch.dma = dma_null ? NULL : &fake_dma; fake_atadev.mode = 0xff; rig_pci_n = 0; rig_pci_reads = 0; rig_cmd_seen = 0; bzero(rig_pci_wr, sizeof(rig_pci_wr)); kprintf("dfrig_nat[%s]: BEFORE dispatch: ch=%p ch->dma=%p " "(NULL means DMA unavailable, ata-dma.c:153) atadev->unit=%d\n", tag, &fake_ch, fake_ch.dma, fake_atadev.unit); kprintf("dfrig_nat[%s]: dispatching production ata_national_setmode" "(dev, ATA_PIO_MAX) %s\n", tag, via_kernel ? "(RUNNING KERNEL own copy)" : "(verbatim #included copy)"); if (via_kernel) ((void (*)(device_t, int))rig_kern_addr)(&fake_ata_dev, ATA_PIO_MAX); else ata_national_setmode(&fake_ata_dev, ATA_PIO_MAX); kprintf("dfrig_nat[%s]: RETURNED (no panic): ch->dma=%p " "alignment=%u max_iosize=%u atadev->mode=0x%02x " "controlcmd_seen=%d pci_reads=%d\n", tag, fake_ch.dma, fake_dma.alignment, fake_dma.max_iosize, fake_atadev.mode, rig_cmd_seen, rig_pci_reads); for (rig_i = 0; rig_i < rig_pci_n && rig_i < 16; rig_i++) kprintf("dfrig_nat[%s]: pci_write_config(gparent, " "0x%02x, 0x%08x, %d)\n", tag, rig_pci_wr[rig_i].reg, rig_pci_wr[rig_i].val, rig_pci_wr[rig_i].width); } /* extracted call site: ata_pcichannel_setmode(), ata-pci.c:855-866, * verbatim extraction (static in the kernel, cannot be linked) */ static void rig_extracted_callsite(device_t dev, int mode) { struct ata_pci_controller *ctlr = device_get_softc(GRANDPARENT(dev)); ctlr->setmode(dev, ATA_PIO_MAX); if (mode >= ATA_DMA) ctlr->setmode(dev, mode); } static void rig_dispatch_full(int via_kernel, int dma_null, const char *tag) { bzero(&fake_dma, sizeof(fake_dma)); fake_dma.alignment = 2; fake_dma.max_iosize = 128 * DEV_BSIZE; fake_ch.dma = dma_null ? NULL : &fake_dma; fake_atadev.mode = ATA_UDMA2; /* requested mode, as at ioctl */ rig_pci_n = 0; rig_pci_reads = 0; rig_cmd_seen = 0; bzero(rig_pci_wr, sizeof(rig_pci_wr)); fake_ctlr.setmode = via_kernel ? (void (*)(device_t, int))rig_kern_addr : ata_national_setmode; kprintf("dfrig_nat[%s]: BEFORE: ch->dma=%p requested mode=ATA_UDMA2 " "-- full extracted call site ata-pci.c:855-866\n", tag, fake_ch.dma); rig_extracted_callsite(&fake_ata_dev, fake_atadev.mode); kprintf("dfrig_nat[%s]: RETURNED (no panic): alignment=%u " "max_iosize=%u atadev->mode=0x%02x controlcmd_seen=%d\n", tag, fake_dma.alignment, fake_dma.max_iosize, fake_atadev.mode, rig_cmd_seen); for (rig_i = 0; rig_i < rig_pci_n && rig_i < 16; rig_i++) kprintf("dfrig_nat[%s]: pci_write_config(gparent, " "0x%02x, 0x%08x, %d)\n", tag, rig_pci_wr[rig_i].reg, rig_pci_wr[rig_i].val, rig_pci_wr[rig_i].width); } /* ------------------------------------------------------------------ */ /* sysctl plumbing */ /* ------------------------------------------------------------------ */ static int rig_go_sysctl(SYSCTL_HANDLER_ARGS) { int val = 0, error; error = sysctl_handle_int(oidp, &val, 0, req); if (error || !req->newptr) return error; rig_armed = 1; switch (val) { case 1: rig_dispatch(1, 1, "go1"); break; /* never reached on stock kernel */ case 2: rig_dispatch(1, 0, "go2"); break; case 3: rig_dispatch(0, 1, "go3"); break; /* never reached on stock kernel */ case 4: rig_dispatch(0, 0, "go4"); break; case 5: rig_dispatch_full(1, 1, "go5"); break; /* never reached on stock kernel */ case 6: rig_dispatch_full(1, 0, "go6"); break; default: return EINVAL; } return 0; } static SYSCTL_NODE(_kern, OID_AUTO, dfrig_nat, CTLFLAG_RW, 0, "DF-2210 ata-national rig"); SYSCTL_ULONG(_kern_dfrig_nat, OID_AUTO, addr, CTLFLAG_RW, &rig_kern_addr, 0, "address of the kernel own ata_national_setmode (from nm)"); SYSCTL_PROC(_kern_dfrig_nat, OID_AUTO, go, CTLTYPE_INT | CTLFLAG_RW, 0, 0, rig_go_sysctl, "I", "fire a scenario"); /* ------------------------------------------------------------------ */ /* module */ /* ------------------------------------------------------------------ */ static int dfrig_nat_load(module_t mod, int what, void *arg) { switch (what) { case MOD_LOAD: rig_setup_graph(); kprintf("dfrig_nat: DF-2210 rig loaded " "(production chipsets/ata-national.c:77-78 included " "verbatim; kernel handler addr=0x%lx)\n", rig_kern_addr); return 0; case MOD_UNLOAD: if (rig_armed) return EBUSY; lockuninit(&fake_ch.state_mtx); lockuninit(&fake_ch.queue_mtx); return 0; default: return 0; } } static moduledata_t dfrig_nat_mod = { "dfrig_nat", dfrig_nat_load, 0 }; DECLARE_MODULE(dfrig_nat, dfrig_nat_mod, SI_SUB_DRIVERS, SI_ORDER_ANY);