/* * DF-5044 / DF-5045 PoC trigger — drive the stock kernel's own sili OS glue * (sys/dev/disk/sili/sili_dragonfly.c, compiled into X86_64_GENERIC) to * demonstrate: * * DF-5044: sili_os_stop_port() waits for the per-port helper thread with NO * bound. We park a REAL helper thread (started by the REAL * sili_os_start_port via the REAL sili_port_alloc) with the port * lock held by us, so the thread blocks inside * sili_port_thread_core()->sili_os_lock_port(). A stopper thread * then calls the REAL sili_os_stop_port(), which signals STOP and * spins in "while (ap->ap_thread) sili_os_sleep(100)" FOREVER — * proven by a watchdog that observes >=3 x 5s of continuous * spinning. After the proof we release the wedge so the run * unwinds cleanly (the guest is left healthy; on real hardware / * real kldunload there is nobody to release the wedge, which is * the finding: unload/shutdown hangs permanently). * * DF-5045: sili_os_stop_port() unconditionally lockuninit()s ap->ap_lock * even when sili_os_start_port() never ran (the sili_port_alloc * error unwinds at sili.c:186/221 goto sili_port_free -> * sili_os_stop_port with ap_thread == NULL). lockuninit() on the * never-lockinit'd, M_ZERO-zeroed lock executes here (benign only * because lk_count == 0 satisfies the KKASSERT); also note * ap_sim_lock / ap_sig_lock / ap_ccb_lock are never uninited at * all on ANY path. * * Everything the helper thread does runs against a pmap_mapdev'd fake * SiI port-register window (same technique as the DF-4964 pack). */ #include #include #include #include #include #include #include #include #include #include #include #include #include #include "sili.h" #define FAKE_BAR_PHYS 0x60000000UL /* real RAM on this guest (4GB) */ #define MAP_SIZE 0x10000 /* 64KB real mapping (like DF-4964) */ static bus_space_handle_t mapbase; static struct sili_softc *sc; static int norelease; static struct sili_port bare_port; /* DF-5045: zeroed, never started */ static struct sili_port *ap_wedge; /* DF-5044: port 1 */ static volatile int stopper_done; static volatile int hold_forever; /* * norelease mode: a sacrificial kthread holds ap_lock forever (emulating a * port helper thread wedged behind a lock held by stuck code), so the * stopper's sili_os_stop_port() can never see ap_thread == NULL. On the * baseline kernel the stopper spins forever; with fix.diff (bounded wait) * it returns after the bound. */ static void wedge_holder_thread(void *arg) { struct sili_port *ap = arg; sili_os_lock_port(ap); kprintf("DF5044: WEDGE: ap_lock held forever (norelease mode)\n"); while (hold_forever) sili_os_sleep(1000); sili_os_unlock_port(ap); kthread_exit(); } static void stopper_thread(void *arg) { struct sili_port *ap = arg; kprintf("DF5044: STOPPER: calling real sili_os_stop_port(%p) with the " "helper thread wedged on ap_lock\n", ap); sili_os_stop_port(ap); /* code under test */ stopper_done = 1; kprintf("DF5044: STOPPER: sili_os_stop_port RETURNED\n"); kthread_exit(); } static void watchdog_thread(void *arg) { int i; for (i = 1; i <= 3; i++) { sili_os_sleep(5000); if (stopper_done) break; kprintf("DF5044: WATCHDOG %d/3: stopper STILL spinning in " "sili_os_stop_port wait loop after %d seconds " "(ap_thread=%p != NULL, no bound, no force-kill)\n", i, i * 5, ap_wedge->ap_thread); } kthread_exit(); } static void wait_init_clear(struct sili_port *ap) { int n = 0; while ((ap->ap_signal & AP_SIGF_INIT) && n++ < 600) sili_os_sleep(100); if (ap->ap_signal & AP_SIGF_INIT) kprintf("DF5044: WARN: port %d INIT never cleared\n", ap->ap_num); else kprintf("DF5044: port %d helper thread up and parked " "(thread=%p)\n", ap->ap_num, ap->ap_thread); } static int df5044_modevent(module_t mod, int type, void *arg) { device_t dev; int error; int n; switch (type) { case MOD_LOAD: hold_forever = 1; norelease = kgetenv("df5044.norelease") != NULL; if (norelease) { /* * Wedge-forever mode: build ONE port, park its helper * thread behind a permanently-held ap_lock, start the * stopper, and return from MOD_LOAD after proving the * spin (the stopper + wedge threads are intentionally * left running until reboot — that is the finding). */ int spin; mapbase = (bus_space_handle_t)pmap_mapdev_uncacheable( FAKE_BAR_PHYS, MAP_SIZE); dev = devclass_get_device(devclass_find("pci"), 0); sc = kmalloc(sizeof(*sc), M_DEVBUF, M_INTWAIT | M_ZERO); sc->sc_dev = dev; sc->sc_piot = (bus_space_tag_t)X86_64_BUS_SPACE_MEM; sc->sc_pioh = mapbase; sc->sc_iot = (bus_space_tag_t)X86_64_BUS_SPACE_MEM; sc->sc_ioh = (bus_space_handle_t)(mapbase + 0x8000); sc->sc_ncmds = SILI_MAX_CMDS; error = bus_dma_tag_create(NULL, 256, 65536, BUS_SPACE_MAXADDR, BUS_SPACE_MAXADDR, sizeof(struct sili_prb) * SILI_MAX_CMDS, 1, sizeof(struct sili_prb) * SILI_MAX_CMDS, 0, &sc->sc_tag_prbs); error += bus_dma_tag_create(NULL, 4, 0, BUS_SPACE_MAXADDR, BUS_SPACE_MAXADDR, 4096 * 1024, SILI_MAX_SGET, 65536, 0, &sc->sc_tag_data); if (error) return (ENOMEM); if (sili_port_alloc(sc, 1) != 0) return (EIO); wait_init_clear(sc->sc_ports[1]); ap_wedge = sc->sc_ports[1]; kthread_create(wedge_holder_thread, ap_wedge, NULL, "df5044wedge"); sili_os_sleep(200); /* let it take the lock */ sili_os_signal_port_thread(ap_wedge, AP_SIGF_TIMEOUT); sili_os_sleep(200); /* helper blocks on ap_lock */ kprintf("DF5044: NORELEASE: starting stopper against a " "permanently wedged helper thread (baseline kernel: " "expect spin-forever; fixed kernel: expect return " "after the bound)\n"); kthread_create(stopper_thread, ap_wedge, NULL, "df5044stop"); for (spin = 1; spin <= 18; spin++) { sili_os_sleep(5000); kprintf("DF5044: NORELEASE: %2d x 5s, stopper " "%s (ap_thread=%p)\n", spin, stopper_done ? "RETURNED" : "STILL " "SPINNING", ap_wedge->ap_thread); } kprintf("DF5044: NORELEASE: observation window closed " "after 90s; module unloads, wedge/stopper threads " "stay (leaked by design until reboot)\n"); return (0); } mapbase = (bus_space_handle_t)pmap_mapdev_uncacheable( FAKE_BAR_PHYS, MAP_SIZE); dev = devclass_get_device(devclass_find("pci"), 0); if (dev == NULL) dev = devclass_get_device(devclass_find("nexus"), 0); sc = kmalloc(sizeof(*sc), M_DEVBUF, M_INTWAIT | M_ZERO); sc->sc_dev = dev; sc->sc_piot = (bus_space_tag_t)X86_64_BUS_SPACE_MEM; sc->sc_pioh = mapbase; /* BAR(2) fake window */ sc->sc_iot = (bus_space_tag_t)X86_64_BUS_SPACE_MEM; sc->sc_ioh = (bus_space_handle_t)(mapbase + 0x8000); sc->sc_ncmds = SILI_MAX_CMDS; /* * Real-driver tag constraints (sili_attach.c:210-238): the * 4th arg is lowaddr and doubles as the contigmalloc upper * bound / kmalloc-eligibility check (must be >= ptoa(Maxmem)), * so use BUS_SPACE_MAXADDR like the driver, not 0. */ error = bus_dma_tag_create(NULL, 256, 65536, BUS_SPACE_MAXADDR, BUS_SPACE_MAXADDR, sizeof(struct sili_prb) * SILI_MAX_CMDS, 1, sizeof(struct sili_prb) * SILI_MAX_CMDS, 0, &sc->sc_tag_prbs); error += bus_dma_tag_create(NULL, 4, 0, BUS_SPACE_MAXADDR, BUS_SPACE_MAXADDR, 4096 * 1024, SILI_MAX_SGET, 65536, 0, &sc->sc_tag_data); if (error) return (ENOMEM); /* * Build two REAL ports (the same construction DF-4964 used; * ports 0/1 sit at offsets 0x0000/0x2000 of the window, so * nothing here is out of bounds). */ error = sili_port_alloc(sc, 0); error += sili_port_alloc(sc, 1); if (error) { kprintf("DF5044: sili_port_alloc error %d\n", error); return (EIO); } wait_init_clear(sc->sc_ports[0]); wait_init_clear(sc->sc_ports[1]); /* ---- E1: normal stop returns promptly (control) --------- */ kprintf("DF5044: E1: normal sili_os_stop_port(port0)...\n"); sili_os_stop_port(sc->sc_ports[0]); kprintf("DF5044: E1: returned (thread=%p)\n", sc->sc_ports[0]->ap_thread); /* ---- E2: wedged helper thread => unbounded stop wait ----- */ ap_wedge = sc->sc_ports[1]; kprintf("DF5044: E2: wedging helper thread: holding ap_lock, " "then signalling AP_SIGF_TIMEOUT so the thread blocks in " "sili_port_thread_core()->sili_os_lock_port()\n"); sili_os_lock_port(ap_wedge); sili_os_signal_port_thread(ap_wedge, AP_SIGF_TIMEOUT); sili_os_sleep(200); /* let the thread block */ stopper_done = 0; kthread_create(stopper_thread, ap_wedge, NULL, "df5044stop"); kthread_create(watchdog_thread, NULL, NULL, "df5044wd"); /* >=15s of watchdog proof while the wedge is held */ for (n = 0; n < 160 && !stopper_done; n++) sili_os_sleep(100); /* * Release the wedge: on a real kldunload/shutdown there is * nobody to do this — that is the finding (permanent hang). * Here we release it only so the run unwinds cleanly. */ kprintf("DF5044: E2: releasing the wedge after >= 15s of " "proven unbounded spinning\n"); sili_os_unlock_port(ap_wedge); for (n = 0; n < 600 && !stopper_done; n++) sili_os_sleep(100); if (!stopper_done) { kprintf("DF5044: ERROR: stopper never returned even " "after wedge release\n"); return (EIO); } kprintf("DF5044: E2: PROVEN: sili_os_stop_port spun >= 15s " "purely because the helper thread was blocked; on a real " "unload/shutdown nobody releases the wedge => permanent " "hang (DF-5044)\n"); /* ---- E3: lockuninit on a NEVER-lockinit'd lock ----------- */ bzero(&bare_port, sizeof(bare_port)); bare_port.ap_sc = sc; /* sili.c:165 sets this before */ /* any goto freeport path */ bare_port.ap_thread = NULL; /* thread never started */ ksnprintf(bare_port.ap_name, sizeof(bare_port.ap_name), "bare"); kprintf("DF5045: E3: calling sili_os_stop_port() on a port " "whose ap_lock was NEVER lockinit'ed (the sili_port_alloc " "error-unwind shape)\n"); sili_os_stop_port(&bare_port); kprintf("DF5045: E3: returned — lockuninit(&ap_lock) executed " "on the uninitialized zeroed lock (benign only because " "M_ZERO makes lk_count==0); ap_sim_lock/ap_sig_lock/" "ap_ccb_lock are never uninited on any path (DF-5045)\n"); /* ---- cleanup: leave the guest clean --------------------- */ sili_port_free(sc, 0); sili_port_free(sc, 1); bus_dma_tag_destroy(sc->sc_tag_prbs); bus_dma_tag_destroy(sc->sc_tag_data); sc->sc_tag_prbs = NULL; sc->sc_tag_data = NULL; kfree(sc, M_DEVBUF); sc = NULL; kprintf("DF5044: cleanup done, guest still healthy\n"); return (0); case MOD_UNLOAD: kprintf("DF5044: unloaded\n"); return (0); default: return (EOPNOTSUPP); } } static moduledata_t df5044_mod = { "df5044", df5044_modevent, NULL }; DECLARE_MODULE(df5044, df5044_mod, SI_SUB_DRIVERS, SI_ORDER_ANY); /* no MODULE_DEPEND: stock kernel has sili compiled into X86_64_GENERIC */