/* * DF-5042 / DF-5043 PoC wrapper — replay the stock adv_pci_attach() * (verbatim sys/dev/disk/advansys/adv_pci.c, #included below) against a * scripted AdvanSys PCI chip, and observe what the attach error unwinds * destroy / release. * * Two scenarios (kenv-selected): * * default : REAL adv_init() is used. The fake chip window has * the AdvanSys signature planted and CHIP_STATUS * (offset 0x0E) stays 0, so adv_init() deterministi- * cally fails at its first halt check * ("Unable to halt adapter", advansys.c:794-798) * -> adv_pci.c:260-264 unwind runs. * * kenv df5042.irqfail: fk_adv_init() scripts success so attach proceeds * to the IRQ stage; fk_bus_setup_intr() fails * -> adv_pci.c:289-294 unwind runs. * * Everything else is the unmodified driver code: the real adv_find_signature * reads the planted signature, the real bus_dma_tag_create/bus_dmamem_alloc/ * bus_dmamap_load build the real parent_dmat and the shared overrun buffer, * and the real adv_free() executes the init_level switch. * * Expected baseline output (the findings): * mode 1: bus_dma_tag_destroy calls for parent_dmat == 0 *** LEAK (DF-5042) * mode 2: parent_dmat destroy == 0 AND bus_release_resource for the IRQ * resource == 0 *** LEAKS (DF-5042+5043) * With fix.diff applied to adv_pci.c the same replay shows * parent_dmat destroy == 1 and IRQ release == 1. */ #include #include #include #include #include #include #include #include #include #include #include #include #include "fkdecl.h" /* * Pull in BEFORE the renames below: pcivar.h defines * pci_read_config()/pci_write_config() as static __inline wrappers, which * would collide with our shim definitions if first seen under the renames. */ #include #include #define FAKE_BAR_PHYS 0x60000000UL /* real RAM on this guest (4GB) */ #define WIN_SIZE 0x1000 static struct resource fake_iores; static struct resource fake_irqres; static struct adv_softc fake_softc; static bus_space_tag_t ftag; static bus_space_handle_t fwin; static bus_dma_tag_t t_parent; /* captured from fk tag_create #1 */ static bus_dma_tag_t t_overrun; /* captured from fk tag_create #2 */ static int cnt_create; static int cnt_destroy_parent; static int cnt_destroy_overrun; static int cnt_rel_io; static int cnt_rel_irq; static int cnt_pci_write; static int cnt_setup_intr; static int mode_irqfail; /* ---------------- observation shims (all forward to the real thing) ----- */ u_int32_t fk_pci_read_config(device_t dev, int reg, int width) { switch (reg) { case PCIR_DEVVENDOR: return (0x110010CD); /* PCI_DEVICE_ID_ADVANSYS_1200A */ case PCIR_COMMAND: return (0); /* force the PORTEN/BUSMASTEREN write */ default: return (0); } } void fk_pci_write_config(device_t dev, int reg, uint32_t val, int width) { cnt_pci_write++; } struct resource * fk_bus_alloc_resource(device_t dev, int type, int *rid, u_long start, u_long end, u_long count, u_int flags) { if (type == SYS_RES_IOPORT) { fake_iores.r_bustag = ftag; fake_iores.r_bushandle = fwin; kprintf("FK: bus_alloc_resource(IOPORT) -> fake io resource " "(tag=%p h=%p)\n", (void *)(uintptr_t)ftag, (void *)fwin); return (&fake_iores); } if (type == SYS_RES_IRQ) { kprintf("FK: bus_alloc_resource(IRQ) -> fake irq resource %p\n", &fake_irqres); return (&fake_irqres); } return (NULL); } int fk_bus_release_resource(device_t dev, int type, int rid, struct resource *res) { if (res == &fake_iores) { cnt_rel_io++; kprintf("FK: bus_release_resource(IOPORT)\n"); } else if (res == &fake_irqres) { cnt_rel_irq++; kprintf("FK: bus_release_resource(IRQ)\n"); } return (0); } int fk_bus_setup_intr(device_t dev, struct resource *r, int flags, driver_intr_t handler, void *arg, void **cookiep, lwkt_serialize_t serializer) { cnt_setup_intr++; kprintf("FK: bus_setup_intr -> scripted %s\n", mode_irqfail ? "FAILURE" : "success"); return (mode_irqfail ? 1 : 0); } struct adv_softc * fk_adv_alloc(device_t dev, bus_space_tag_t tag, bus_space_handle_t bsh) { /* * adv_alloc() verbatim except the softc is our storage instead of * device_get_softc(dev) (dev is the real pci0 device, whose softc * belongs to the PCI bridge). */ bzero(&fake_softc, sizeof(fake_softc)); LIST_INIT(&fake_softc.pending_ccbs); SLIST_INIT(&fake_softc.free_ccb_infos); fake_softc.dev = dev; fake_softc.unit = 0; fake_softc.tag = tag; fake_softc.bsh = bsh; kprintf("FK: adv_alloc(dev=%p, tag=%p, h=%p) -> softc %p\n", dev, (void *)(uintptr_t)tag, (void *)bsh, &fake_softc); return (&fake_softc); } int fk_adv_init(struct adv_softc *adv) { if (mode_irqfail) { kprintf("FK: adv_init -> scripted SUCCESS (reaching IRQ " "stage)\n"); return (0); } kprintf("FK: adv_init -> REAL adv_init() against scripted chip\n"); return (adv_init(adv)); /* the real thing, advansys.c */ } int fk_find_signature(bus_space_tag_t tag, bus_space_handle_t bsh) { /* * Forced pass. The real adv_find_signature() reads byte 0x01 * (== 0x25) AND word 0x00 (== 0x04C1/0x00C1) — two reads of the * same two bytes that cannot both be satisfied by a passive RAM * window; real silicon latches the signature registers differently. * The signature check is not what this PoC tests, so it is forced * here and the code under test (dma setup + failure unwinds) runs * exactly as on a real card. */ kprintf("FK: adv_find_signature -> forced pass (RAM window cannot " "emulate the dual-width signature latch)\n"); return (1); } int fk_bus_dma_tag_create(bus_dma_tag_t parent, bus_size_t alignment, bus_size_t boundary, bus_addr_t lowaddr, bus_addr_t highaddr, bus_size_t maxsize, int nsegments, bus_size_t maxsegsz, int flags, bus_dma_tag_t *dmat) { int error = bus_dma_tag_create(parent, alignment, boundary, lowaddr, highaddr, maxsize, nsegments, maxsegsz, flags, dmat); if (error == 0) { cnt_create++; if (t_parent == NULL) t_parent = *dmat; else if (t_overrun == NULL) t_overrun = *dmat; kprintf("FK: bus_dma_tag_create #%d -> tag %p\n", cnt_create, *dmat); } return (error); } int fk_bus_dma_tag_destroy(bus_dma_tag_t dmat) { if (dmat != NULL && dmat == t_parent) { cnt_destroy_parent++; kprintf("FK: bus_dma_tag_destroy(PARENT dmat %p) #%d\n", dmat, cnt_destroy_parent); } else if (dmat != NULL && dmat == t_overrun) { cnt_destroy_overrun++; kprintf("FK: bus_dma_tag_destroy(OVERRUN dmat %p) #%d\n", dmat, cnt_destroy_overrun); } return (bus_dma_tag_destroy(dmat)); /* the real thing */ } /* ---- the code under test ---------------------------------------------- */ /* * adv_pci.c is included VERBATIM. The renames below (the equivalent of -D * command-line flags) sit AFTER our shim definitions above, so the shims * themselves call the real kernel functions while every call adv_pci.c * makes to these externals lands in the observation shims. pcivar.h was * already included above, so its static __inline pci_* wrappers are not * re-parsed under the renames. DRIVER_MODULE is neutered (the running * kernel already contains an identical pci/adv module from `device adv0`, * so re-registering would collide); the driver-table statics at the bottom * of adv_pci.c are kept referenced by the global pointers below. */ #define pci_read_config fk_pci_read_config #define pci_write_config fk_pci_write_config #define bus_alloc_resource fk_bus_alloc_resource #define bus_release_resource fk_bus_release_resource #define bus_setup_intr fk_bus_setup_intr #define adv_alloc fk_adv_alloc #define adv_init fk_adv_init #define adv_find_signature fk_find_signature #define bus_dma_tag_create fk_bus_dma_tag_create #define bus_dma_tag_destroy fk_bus_dma_tag_destroy #undef DRIVER_MODULE #define DRIVER_MODULE(a, b, c, d, e, f) /* neutered: kernel has pci/adv */ #include "adv_pci.c" /* VERBATIM sys/dev/disk/advansys/adv_pci.c */ /* keep adv_pci.c's neutered statics referenced (no -Wunused-variable) */ driver_t *df_ref_driver = &adv_pci_driver; devclass_t *df_ref_devclass = &adv_pci_devclass; /* ------------------------------ driver --------------------------------- */ static int df5042_modevent(module_t mod, int type, void *arg) { device_t dev; int attach_ret; int leaked_parent, leaked_irq; switch (type) { case MOD_LOAD: mode_irqfail = kgetenv("df5042.irqfail") != NULL; fwin = (bus_space_handle_t)pmap_mapdev_uncacheable( FAKE_BAR_PHYS, WIN_SIZE); ftag = (bus_space_tag_t)X86_64_BUS_SPACE_MEM; /* * Plant the AdvanSys signature (adv_find_signature reads * byte 0x01 == 0x25 and word 0x00 == 0x04C1) and leave * CHIP_STATUS (0x0E) at 0 so the real adv_init() fails its * halt check deterministically. */ ((volatile u_int8_t *)fwin)[0] = 0xC1; ((volatile u_int8_t *)fwin)[1] = 0x25; dev = devclass_get_device(devclass_find("pci"), 0); if (dev == NULL) dev = devclass_get_device(devclass_find("nexus"), 0); kprintf("DF5042: mode=%s, chip window=%p, dev=%p\n", mode_irqfail ? "IRQFAIL" : "INITFAIL", (void *)fwin, dev); attach_ret = adv_pci_attach(dev); /* code under test */ kprintf("DF5042: adv_pci_attach returned %d\n", attach_ret); kprintf("DF5042: pci_write_config=%d dma tags created=%d " "(parent=%p overrun=%p)\n", cnt_pci_write, cnt_create, t_parent, t_overrun); kprintf("DF5042: bus_dma_tag_destroy: parent=%d overrun=%d\n", cnt_destroy_parent, cnt_destroy_overrun); kprintf("DF5042: bus_release_resource: IOPORT=%d IRQ=%d; " "bus_setup_intr calls=%d\n", cnt_rel_io, cnt_rel_irq, cnt_setup_intr); leaked_parent = (t_parent != NULL && cnt_destroy_parent == 0); leaked_irq = (mode_irqfail && cnt_rel_irq == 0); if (leaked_parent) kprintf("DF5042: *** parent_dmat NEVER DESTROYED on " "the failure unwind (adv_free case 1 tears down " "from the ccb_infos tier) -- DF-5042 LEAK " "PROVEN ***\n"); if (leaked_irq) kprintf("DF5042: *** IRQ resource NEVER RELEASED on " "the bus_setup_intr failure unwind -- DF-5043 " "LEAK PROVEN ***\n"); if (!leaked_parent && !leaked_irq) kprintf("DF5042: unwind clean (fix effective?)\n"); /* keep the guest clean: manually undo everything leaked */ if (leaked_parent) bus_dma_tag_destroy(t_parent); if (t_overrun != NULL && overrun_buf != NULL) { bus_dmamap_unload(t_overrun, overrun_dmamap); bus_dmamem_free(t_overrun, overrun_buf, overrun_dmamap); bus_dma_tag_destroy(t_overrun); overrun_buf = NULL; overrun_dmat = NULL; overrun_physbase = 0; } else if (t_overrun != NULL && cnt_destroy_overrun == 0) { bus_dma_tag_destroy(t_overrun); } kprintf("DF5042: cleanup done, guest still healthy\n"); return (0); case MOD_UNLOAD: kprintf("DF5042: unloaded\n"); return (0); default: return (EOPNOTSUPP); } } static moduledata_t df5042_mod = { "df5042", df5042_modevent, NULL }; DECLARE_MODULE(df5042, df5042_mod, SI_SUB_DRIVERS, SI_ORDER_ANY);