/* * umcs_harness.c -- verification harness for DF-2343 / DF-2344. * Audit target: sys/bus/u4b/serial/umcs.c (MCS7840 USB multiport * serial adapter driver), VERBATIM, TU-compiled into the kernel. * * VERBATIM-INTERPOSITION DESIGN (established pattern, cf. DF-2314 * pnp.c rig / DF-2300 fwohci rig): * - This TU #includes the UNMODIFIED sys/bus/u4b/serial/umcs.c, so * the audited code runs byte-identical to stock (sha256-gated by * prep.sh against the pristine audit-tree hash). Because its * statics (umcs7840_attach, umcs7840_calc_baudrate, * umcs7840_callback, ...) become callable, the rig can drive the * REAL driver code with a fabricated USB device. * - Interposed externals: ONLY the ones that cannot execute against * a hardware-less fabricated device -- the synchronous control * transfer (usbd_do_request_proc) is simulated (configurable * per-register values / failure), the bulk/interrupt transfer * plumbing (usbd_transfer_setup/start/stop/poll/unsetup, * usbd_xfer_set_stall) is stubbed (no real endpoints exist), and * the newbus device_t accessors (device_get_softc/get_ivars/ * printf, device_set_usb_desc, ucom_set_pnpinfo_usb) are shims. * EVERYTHING ELSE passes through to the stock in-kernel * implementation: the ucom framework (usb_serial.c: ucom_attach * creates the real /dev/ttyU* /dev/cuaU* nodes via the real * ttymalloc/make_dev and runs the real console-attach block at * usb_serial.c:511-535), the tty layer, lockmgr, usb core * helpers. * * DF-2343 (umcs.c:1053-1069): rate==0 falls through the bucket search * with i==8, evaluates umcs7840_baudrate_divisors[9] (1-element OOB * read of the 9-entry array) and divides by rate==0 -> #DE kernel * panic. Reached in production via * (a) first open of /dev/ttyU* / cuaU*: usb_serial.c:839-842 * ucom_param(tp, &t) with t = sc_it_in, which is never * initialized (zeroed) -> c_ospeed == 0 straight into * ucom_pre_param (usb_serial.c:1680); * (b) USB serial console: usb_serial.c:523-533 with * hw.usb.ucom.cons_baud=0 loader tunable; * while the TIOCSETA* ioctl route is blocked by * sys/kern/tty.c:1033-1041 + usb_serial.c:1670-1674 (verified * live, see tioc0.c). * * DF-2344 (umcs.c:301/324-325): umcs7840_attach() discards the return * of the GPIO register read; on control-transfer failure `data' * (never initialized) decides the 2-vs-4-port configuration. The * rig grooms the kernel stack below attach()'s frame with a chosen * byte and shows sc_numports follows the poison, not the device. * * Control device: /dev/umcsh0 (root-only, 0600). */ #include #include #include #include #include #include #include #include #include /* u4b headers first (in umcs.c's own order: condvar.h provides the * struct cv usb_process.h embeds), so the shim prototypes below have * complete types */ #include #include #include #include #include #include /* * Interposition of the u4b/usb externals that cannot run against a * fabricated (hardware-less) USB device. All headers are already * included above, so the object-like renames below only rewrite the * call sites inside the verbatim umcs.c body. */ #define usbd_do_request_proc umcsh_do_request_proc #define usbd_transfer_setup umcsh_transfer_setup #define usbd_transfer_unsetup umcsh_transfer_unsetup #define usbd_transfer_start umcsh_transfer_start #define usbd_transfer_stop umcsh_transfer_stop #define usbd_transfer_poll umcsh_transfer_poll #define usbd_xfer_set_stall umcsh_xfer_set_stall #define device_set_usb_desc umcsh_set_usb_desc #define ucom_set_pnpinfo_usb umcsh_set_pnpinfo #define device_printf umcsh_dev_printf #define device_get_ivars umcsh_dev_get_ivars #define device_get_softc umcsh_dev_get_softc /* forward prototypes for the shims (defined below the verbatim unit); * the renames above rewrite umcs.c's call sites to these */ static usb_error_t umcsh_do_request_proc(struct usb_device *, struct usb_process *, struct usb_device_request *, void *, uint16_t, uint16_t *, usb_timeout_t); static usb_error_t umcsh_transfer_setup(struct usb_device *, const uint8_t *, struct usb_xfer **, const struct usb_config *, uint16_t, void *, struct lock *); static void umcsh_transfer_unsetup(struct usb_xfer **, uint16_t); static void umcsh_transfer_start(struct usb_xfer *); static void umcsh_transfer_stop(struct usb_xfer *); static void umcsh_transfer_poll(struct usb_xfer **, uint16_t); static void umcsh_xfer_set_stall(struct usb_xfer *); static void umcsh_set_usb_desc(device_t); static void umcsh_set_pnpinfo(struct ucom_super_softc *, device_t); static int umcsh_dev_printf(device_t, const char *, ...); static void *umcsh_dev_get_ivars(device_t); static void *umcsh_dev_get_softc(device_t); /* * Codegen selector for the verbatim unit. * * 0 (default): stock kernel codegen (gcc80 -O2, exactly what the * shipping kernel does). IMPORTANT: at -O2 gcc80 exploits the * div-by-zero UB in umcs7840_calc_baudrate(rate==0) and compiles * the loop-exhausted path to "*divisor=0, *clk=0x80, ret 0" with * NEITHER the divisors[9] load NOR the division executed -- see * adjacency.txt disassembly, path at +0x33. * * 1 (-O0 semantics): translate the C source literally, so the * source-level defect executes: load umcs7840_baudrate_divisors[9] * (1-element OOB read), then divide by rate==0 -> #DE panic. * This demonstrates the C-level behavior under different codegen * (-O0, other compilers / versions); it is NOT the shipping * behavior. */ #define UMCSH_VERBATIM_CODEGEN_O0 0 #if UMCSH_VERBATIM_CODEGEN_O0 #pragma GCC push_options #pragma GCC optimize ("O0") #endif #include "umcs.c" /* VERBATIM, sha256-gated by prep.sh */ #if UMCSH_VERBATIM_CODEGEN_O0 #pragma GCC pop_options #endif #undef usbd_do_request_proc #undef usbd_transfer_setup #undef usbd_transfer_unsetup #undef usbd_transfer_start #undef usbd_transfer_stop #undef usbd_transfer_poll #undef usbd_xfer_set_stall #undef device_set_usb_desc #undef ucom_set_pnpinfo_usb #undef device_printf #undef device_get_ivars #undef device_get_softc #include "umcsh.h" /* ------------------------------------------------------------------ */ /* fabricated device state */ /* ------------------------------------------------------------------ */ static struct umcs7840_softc umcsh_sc; /* the REAL driver softc */ static int umcsh_attached; /* attach() returned 0 at least once */ static struct usb_attach_arg umcsh_uaa = { .info = { .idVendor = USB_VENDOR_MOSCHIP, .idProduct = USB_PRODUCT_MOSCHIP_MCS7840, .bIfaceIndex = MCS7840_IFACE_INDEX, .bConfigIndex = MCS7840_CONFIG_INDEX, }, .device = NULL, /* transfers are simulated */ .usb_mode = USB_MODE_HOST, }; /* opaque token standing in for the newbus device_t */ static device_t umcsh_fake_dev = (device_t)0xC0FFEE42UL; /* ------------------------------------------------------------------ */ /* simulated control transfers (the only functional seam) */ /* ------------------------------------------------------------------ */ static uint32_t sim_fail_mask; /* UMCSH_AT_* bits */ static uint8_t sim_gpio_val = 0x01; static uint8_t sim_mode_val = 0x40; /* EEPROMWR default-ish */ static uint8_t sim_reg_default = 0x00; static uint32_t sim_rd_cnt, sim_wr_cnt; static void sim_reset(void) { sim_fail_mask = 0; sim_gpio_val = 0x01; sim_mode_val = 0x40; sim_reg_default = 0x00; sim_rd_cnt = sim_wr_cnt = 0; } /* * The seam the real driver uses for every register access: * umcs7840_get_reg_sync / umcs7840_set_reg_sync / *_UART_reg_sync * (umcs.c:914-1001). Faithful failure semantics: on error NOTHING is * written to *data -- exactly like the real usbd_do_request_proc(), * which is what leaves `data' uninitialized in umcs7840_attach(). */ static usb_error_t umcsh_do_request_proc(struct usb_device *udev, struct usb_process *pp, struct usb_device_request *req, void *data, uint16_t flags, uint16_t *actlen, uint32_t timeout) { uint16_t index = UGETW(req->wIndex); uint16_t value = UGETW(req->wValue); uint8_t portno = (uint8_t)(value >> 8); if (req->bmRequestType == UT_READ_VENDOR_DEVICE && req->bRequest == MCS7840_RDREQ) { sim_rd_cnt++; if ((sim_fail_mask & UMCSH_AT_GPIOFAIL) && index == MCS7840_DEV_REG_GPIO && value == 0) { kprintf("UMCSH SIM: RD reg 0x%02x -> STALLED " "(no byte written to caller buffer!)\n", index); return (USB_ERR_STALLED); } if ((sim_fail_mask & UMCSH_AT_MODEFAIL) && index == MCS7840_DEV_REG_MODE && value == 0) { kprintf("UMCSH SIM: RD reg 0x%02x -> STALLED\n", index); return (USB_ERR_STALLED); } *(uint8_t *)data = (index == MCS7840_DEV_REG_GPIO) ? sim_gpio_val : (index == MCS7840_DEV_REG_MODE) ? sim_mode_val : sim_reg_default; if (actlen) *actlen = 1; kprintf("UMCSH SIM: RD reg 0x%02x port %u -> 0x%02x\n", index, portno, *(uint8_t *)data); return (USB_ERR_NORMAL_COMPLETION); } if (req->bmRequestType == UT_WRITE_VENDOR_DEVICE && req->bRequest == MCS7840_WRREQ) { sim_wr_cnt++; kprintf("UMCSH SIM: WR reg 0x%02x port %u <- 0x%02x\n", index, portno, (uint8_t)(value & 0xff)); return (USB_ERR_NORMAL_COMPLETION); } kprintf("UMCSH SIM: unexpected request type 0x%02x/%02x\n", req->bmRequestType, req->bRequest); return (USB_ERR_STALLED); } /* no real endpoints exist on the fabricated device */ static usb_error_t umcsh_transfer_setup(struct usb_device *udev, const uint8_t *ifaces, struct usb_xfer **pxfer, const struct usb_config *setup_start, uint16_t n_setup, void *priv_sc, struct lock *priv_lock) { uint16_t n; for (n = 0; n != n_setup; n++) pxfer[n] = NULL; kprintf("UMCSH SIM: transfer_setup ep 0x%02x n=%u -> OK (NULL)\n", setup_start[0].endpoint, n_setup); return (0); } static void umcsh_transfer_unsetup(struct usb_xfer **pxfer, uint16_t n) { } static void umcsh_transfer_start(struct usb_xfer *xfer) { } static void umcsh_transfer_stop(struct usb_xfer *xfer) { } static void umcsh_transfer_poll(struct usb_xfer **pxfer, uint16_t n) { } static void umcsh_xfer_set_stall(struct usb_xfer *xfer) { } static void umcsh_set_usb_desc(device_t dev) { } static void umcsh_set_pnpinfo(struct ucom_super_softc *ssc, device_t dev) { } static int umcsh_dev_printf(device_t dev, const char *fmt, ...) { __va_list ap; kprintf("umcs7840: "); /* same prefix as on real hardware */ __va_start(ap, fmt); kvprintf(fmt, ap); __va_end(ap); return (0); } static void * umcsh_dev_get_ivars(device_t dev) { return (&umcsh_uaa); } static void * umcsh_dev_get_softc(device_t dev) { return (&umcsh_sc); } /* ------------------------------------------------------------------ */ /* DF-2344: kernel-stack groom */ /* */ /* `data' in umcs7840_attach() has its address taken (umcs.c:324), so */ /* it lives in attach()'s stack frame. groom_stack() burns a pad of */ /* the chosen byte immediately before attach() is entered; the frame */ /* (and the uninitialized slot) lands inside the poisoned pad. */ /* ------------------------------------------------------------------ */ #define GROOM_SPAN 8192 static int umcsh_groom_sink; static __noinline void groom_stack(uint8_t fill) { volatile char pad[GROOM_SPAN]; int i; for (i = 0; i < GROOM_SPAN; i++) pad[i] = (char)fill; if (pad[GROOM_SPAN - 1] == (char)0xAB) /* keep pad materialized */ umcsh_groom_sink = 1; } /* ------------------------------------------------------------------ */ /* scenarios */ /* ------------------------------------------------------------------ */ static int umcsh_scenario(struct umcsh_req *r) { uint32_t sc = r->scenario; int rc = 0; switch (sc) { case UMCSH_SC_LAYOUT: { const uint32_t *arr = umcs7840_baudrate_divisors; const uint32_t *oob = arr + 9; /* what index 9 fetches */ int i; kprintf("UMCSH layout: umcs7840_baudrate_divisors=%p " "len=%u entries=%u bytes; UMCS7840_MAX_PORTS=%u; " "GPIO_4PORTS bit=0x%02x\n", arr, (unsigned)umcs7840_baudrate_divisors_len, (unsigned)(sizeof(umcs7840_baudrate_divisors)), (unsigned)UMCS7840_MAX_PORTS, (unsigned)MCS7840_DEV_GPIO_4PORTS); kprintf("UMCSH layout: entries:"); for (i = 0; i < (int)umcs7840_baudrate_divisors_len; i++) kprintf(" %u", arr[i]); kprintf("\n"); /* * Instrumentation (harness-only) read of divisors[9]: * the exact dword the faulting instruction at umcs.c:1066 * loads before dividing by rate==0. */ r->r_oob_dword = *oob; kprintf("UMCSH layout: divisors[9] (OOB, instrumentation) " "@%p = 0x%08x (%u)\n", oob, *oob, *oob); kprintf("UMCSH layout: spill context [9]=%08x " "[10]=%08x [11]=%08x [12]=%08x\n", arr[9], arr[10], arr[11], arr[12]); break; } case UMCSH_SC_CALC: { uint16_t divisor = 0xDEAD; uint8_t clk = 0xEE; uint32_t rate = r->arg; if (rate == 0 && !(r->arg2 & 1)) { ksnprintf(r->r_msg, sizeof(r->r_msg), "refusing rate=0 without arg2&1 (it panics on " "the stock kernel)"); return (EPERM); } kprintf("UMCSH calc: rate=%u divisor(before)=%u\n", rate, divisor); rc = umcs7840_calc_baudrate(rate, &divisor, &clk); r->r_divisor = divisor; r->r_clk = clk; kprintf("UMCSH calc: rate=%u -> rc=%d divisor=%u clk=0x%02x" "\n", rate, rc, divisor, clk); break; } case UMCSH_SC_PREPARAM: { struct termios t; bzero(&t, sizeof(t)); t.c_ospeed = r->arg; t.c_ispeed = r->arg; kprintf("UMCSH preparam: dispatching real " "umcs7840_pre_param(ucom, t.c_ospeed=%u) -- the exact " "call usb_serial.c:1680 makes\n", t.c_ospeed); kprintf("UMCSH preparam: ABOUT TO ENTER (stock kernel: " "expect Fatal trap 0 divide error)\n"); rc = umcs7840_callback.ucom_pre_param(&umcsh_sc.sc_ucom[0], &t); kprintf("UMCSH preparam: returned %d (%s panic on stock)\n", rc, rc ? "EINVAL, no" : "accepted, no"); break; } case UMCSH_SC_ATTACH: { uint8_t poison = (uint8_t)r->arg; if (umcsh_attached) { ksnprintf(r->r_msg, sizeof(r->r_msg), "already attached, run DETACH first"); return (EBUSY); } sim_reset(); sim_gpio_val = poison; /* used when not failing */ sim_fail_mask = r->arg2; bzero(&umcsh_sc, sizeof(umcsh_sc)); /* fresh softc, like newbus */ kprintf("UMCSH attach: gpio_fail=%u mode_fail=%u " "groom=%u poison=0x%02x gpio_ok_value=0x%02x\n", !!(r->arg2 & UMCSH_AT_GPIOFAIL), !!(r->arg2 & UMCSH_AT_MODEFAIL), !!(r->arg2 & UMCSH_AT_GROOM), poison, sim_gpio_val); kprintf("UMCSH attach: ABOUT TO enter real umcs7840_attach" "()\n"); /* groom LAST: any call between groom_stack() and attach() * would overwrite the poisoned pad with its own frame */ if (r->arg2 & UMCSH_AT_GROOM) groom_stack(poison); else groom_stack(0x5A); /* distinctive default residue */ rc = umcs7840_attach(umcsh_fake_dev); umcsh_attached = (rc == 0); r->r_numports = umcsh_sc.sc_numports; r->r_rd_cnt = sim_rd_cnt; r->r_wr_cnt = sim_wr_cnt; if (rc == 0) ksnprintf(r->r_msg, sizeof(r->r_msg), "attached, tty=%s", umcsh_sc.sc_super_ucom.sc_ttyname); kprintf("UMCSH attach: rc=%d numports=%u rd=%u wr=%u\n", rc, r->r_numports, sim_rd_cnt, sim_wr_cnt); break; } case UMCSH_SC_DETACH: if (!umcsh_attached) { ksnprintf(r->r_msg, sizeof(r->r_msg), "not attached"); return (ENXIO); } rc = umcs7840_detach(umcsh_fake_dev); umcsh_attached = 0; kprintf("UMCSH detach: rc=%d (numports was %u)\n", rc, umcsh_sc.sc_numports); break; case UMCSH_SC_SEED_ITIN: { struct termios tmpl; uint32_t speed = r->arg; if (!umcsh_attached) { ksnprintf(r->r_msg, sizeof(r->r_msg), "not attached (seed needs live sc_ucom)"); return (ENXIO); } bzero(&tmpl, sizeof(tmpl)); tmpl.c_cflag = TTYDEF_CFLAG; tmpl.c_ospeed = speed; tmpl.c_ispeed = speed; if (r->arg2 == UMCSH_SEED_IN || r->arg2 == UMCSH_SEED_BOTH) umcsh_sc.sc_ucom[0].sc_it_in = tmpl; if (r->arg2 == UMCSH_SEED_OUT || r->arg2 == UMCSH_SEED_BOTH) umcsh_sc.sc_ucom[0].sc_it_out = tmpl; kprintf("UMCSH seed: it_in.c_ospeed=%u it_out.c_ospeed=%u " "(simulating a driver that initializes its termios)\n", umcsh_sc.sc_ucom[0].sc_it_in.c_ospeed, umcsh_sc.sc_ucom[0].sc_it_out.c_ospeed); break; } case UMCSH_SC_STATUS: r->r_attached = umcsh_attached; r->r_numports = umcsh_sc.sc_numports; r->r_rd_cnt = sim_rd_cnt; r->r_wr_cnt = sim_wr_cnt; ksnprintf(r->r_msg, sizeof(r->r_msg), "attached=%d numports=%u", umcsh_attached, umcsh_sc.sc_numports); kprintf("UMCSH status: %s\n", r->r_msg); break; default: rc = EINVAL; break; } return (rc); } /* ------------------------------------------------------------------ */ /* control device */ /* ------------------------------------------------------------------ */ static int umcsh_ioctl(struct dev_ioctl_args *ap); static int umcsh_open(struct dev_open_args *ap); static int umcsh_open(struct dev_open_args *ap) { return (0); } static int umcsh_ioctl(struct dev_ioctl_args *ap) { struct umcsh_req r; if (ap->a_cmd != UMCSH_IOC) return (ENOTTY); bcopy(ap->a_data, &r, sizeof(r)); r.r_rc = (uint32_t)umcsh_scenario(&r); bcopy(&r, ap->a_data, sizeof(r)); /* * Always return 0 so the syscall layer copyouts r (and never sees * a raw negative rc: -1 is ERESTART on DragonFly, which would * restart the ioctl forever). Scenario results travel in r_rc. */ return (0); } static struct dev_ops umcsh_ops = { { "umcsh", 0, D_MEM }, .d_open = umcsh_open, .d_ioctl = umcsh_ioctl, }; static void umcsh_init(void *dummy) { make_dev(&umcsh_ops, 0, UID_ROOT, GID_WHEEL, 0600, "umcsh0"); kprintf("UMCSHARNESS-READY: umcs.c verbatim (TU-compiled) " "/dev/umcsh0 ready\n"); } SYSINIT(umcs_harness, SI_SUB_PSEUDO, SI_ORDER_MIDDLE, umcsh_init, NULL);