/* * DF-5488 KLD harness -- verbatim-production demonstration of the * uvisor_attach() -> uvisor_init() synchronous-EP0 explore-thread stall. * Same evidence class as the proven family findings DF-5407 (uplcom, * 14 x 5 s = ~70 s) and DF-5359 (uipaq, ~12.8 s): the production * uvisor_init() is awk/sed-extracted VERBATIM from the guest's clean * /usr/src/sys/bus/u4b/serial/uvisor.c (see build.sh, sha256-recorded) * and only the two EP0 entry points it calls are re-targeted to an * evil-device model. * * WHAT IT PROVES: * * uvisor_attach() (uvisor.c:302-354) runs on the per-bus USB explore * thread and calls uvisor_init() (uvisor.c:326 -> 370-517) which issues * synchronous control requests at the USB_DEFAULT_TIMEOUT of 5000 ms * (usbdi.h:87): * * UVISOR_FLAG_VISOR (HANDSPRING VISOR 082d:0100, uvisor.c:254): * 1 x UVISOR_GET_CONNECTION_INFORMATION vendor control-IN * (uvisor.c:382-389) => ~5 s * UVISOR_FLAG_PALM4 (Treo, Palm m-series, Clie, Zire; uvisor.c:250-277): * 1 x UVISOR_GET_PALM_INFORMATION vendor control-IN * (uvisor.c:434-442) => ~5 s * UVISOR_FLAG_PALM35 (SONY CLIE_35, uvisor.c:272): * 2 x standard requests (UR_GET_CONFIG + UR_GET_INTERFACE) * (uvisor.c:476-485, 488-496) => ~10 s * * USB permits a device to NAK a control data stage for the whole 5 s * timeout; an evil adapter answering each request just-under-timeout * (or never answering) pins the explore thread -- which serializes all * device enumeration on the bus -- for the full chain, while every * request additionally holds the per-device enum lock * (usb_request.c:467). * * PHASE A (evil, in-spec slow answers): each request "succeeds" after * ~4.9 s of NAK, so the chain marches on: VISOR ~4.9 s, PALM4 ~4.9 s, * PALM35 ~9.8 s. * PHASE B (fix mechanism from fix.diff: bound the attach-path control * timeout to 250 ms): the still-NAKing device times out at 250 ms and * uvisor_init() aborts on the first error (uvisor.c:391-393/444-446/ * 483-485/494-496): all variants ~0.25 s. */ #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include /* struct usb_process (sc_tq) */ #include /* struct ucom_* inside softc */ /* production uvisor.c does this before usb_debug.h (DPRINTF no-op in a * non-USB_DEBUG build, exactly like the shipped kernel module) */ #define USB_DEBUG_VAR hx_uvisor_debug #include #ifndef UVISOR_INIT_TIMEOUT #define UVISOR_INIT_TIMEOUT 250 /* ms (fix.diff) */ #endif #include "uv_defs.h" /* VERBATIM uvisor.c:85-182 (defines/structs) */ #include "uv_init.h" /* VERBATIM uvisor_init(), uvisor.c:370-517 */ #include "uv_init_fixed.h" /* fix.diff'd uvisor_init() (renamed), phase B */ static int hx_evil_ms = 4900; /* evil device: NAK ~4.9 s, then answer */ static int hx_fixed; /* phase B: fix mechanism in effect */ static int64_t hx_ms(struct timeval *t0, struct timeval *t1) { return ((int64_t)(t1->tv_sec - t0->tv_sec) * 1000 + (t1->tv_usec - t0->tv_usec) / 1000); } /* * Evil-device model standing in for the kernel's real * usbd_do_request_flags() (usb_request.c:565+): the device NAKs the data * stage for ~4.9 s (USB-legal, under the 5 s timeout), then either * answers successfully (phase A: the chain continues, worst case) or is * cut off by the driver-side 250 ms bound (phase B: the request times * out, uvisor_init aborts). */ usb_error_t usbd_do_request_flags(struct usb_device *udev, struct lock *lock, struct usb_device_request *req, void *data, uint16_t flags, uint16_t *actlen, usb_timeout_t timeout) { uint16_t len = UGETW(req->wLength); int delay; usb_error_t err; delay = (int)timeout; if (delay > hx_evil_ms) delay = hx_evil_ms; kprintf("HX5488: EP0 bmRequestType=0x%02x bRequest=0x%02x " "wValue=%d wIndex=%d wLength=%d: device NAKs %d ms then %s\n", req->bmRequestType, req->bRequest, UGETW(req->wValue), UGETW(req->wIndex), len, delay, delay < (int)timeout ? "answers (success)" : "is cut off (driver timeout, chain aborts)"); /* the "WXFER" wait the real requester does (usb_request.c:642-644) */ if (delay > 0) tsleep(&hx_evil_ms, 0, "EVILNAK", USB_MS_TO_TICKS(delay)); if (delay < (int)timeout) { /* in-spec slow answer: benign bytes, full actlen */ if (data != NULL && len != 0) memset(data, 0x5A, len); if (actlen != NULL) *actlen = len; err = USB_ERR_NORMAL_COMPLETION; } else { /* fix mechanism: the bounded timeout fires first */ err = USB_ERR_TIMEOUT; } kprintf("HX5488: EP0 done -> %s\n", usbd_errstr(err)); return (err); } static void hx_run(const char *name, uint16_t flag) { struct uvisor_softc sc; struct usb_config cfg[UVISOR_N_TRANSFER]; struct timeval t0, t1; usb_error_t err; memset(&sc, 0, sizeof(sc)); memset(cfg, 0, sizeof(cfg)); sc.sc_flag = flag; kprintf("HX5488: %s (sc_flag=0x%04x): uvisor_init() chain START\n", name, flag); microtime(&t0); err = uvisor_init(&sc, NULL, cfg); microtime(&t1); kprintf("HX5488: %s: uvisor_init() DONE err=%s ELAPSED=%jd ms" " (cfg endpoints %d/%d)\n", name, usbd_errstr(err), (intmax_t)hx_ms(&t0, &t1), cfg[0].endpoint, cfg[1].endpoint); } static void hx_run_fixed(const char *name, uint16_t flag) { struct uvisor_softc sc; struct usb_config cfg[UVISOR_N_TRANSFER]; struct timeval t0, t1; usb_error_t err; memset(&sc, 0, sizeof(sc)); memset(cfg, 0, sizeof(cfg)); sc.sc_flag = flag; kprintf("HX5488: %s [fixed driver] (sc_flag=0x%04x): uvisor_init() " "chain START (bounded %d ms timeout, abort on error, hx_fixed=%d)\n", name, flag, UVISOR_INIT_TIMEOUT, hx_fixed); microtime(&t0); err = uvisor_init_fixed(&sc, NULL, cfg); microtime(&t1); kprintf("HX5488: %s [fixed driver]: uvisor_init() DONE err=%s " "ELAPSED=%jd ms\n", name, usbd_errstr(err), (intmax_t)hx_ms(&t0, &t1)); } static int hx_modevent(module_t mod, int type, void *data) { int error = 0; switch (type) { case MOD_LOAD: kprintf("HX5488: DF-5488 uvisor attach-chain stall harness " "(verbatim uvisor_init), hz=%d, evil NAK=%d ms, " "USB_DEFAULT_TIMEOUT=%d ms\n", hz, hx_evil_ms, USB_DEFAULT_TIMEOUT); /* PHASE A: production code, evil in-spec-slow device */ hx_fixed = 0; hx_run("VISOR (Handspring Visor)", UVISOR_FLAG_VISOR); hx_run("PALM4 (Treo/Palm/Clie)", UVISOR_FLAG_PALM4); hx_run("PALM35 (Sony Clie 3.5)", UVISOR_FLAG_PALM35); /* PHASE B: fix mechanism (250 ms bound, abort on error) */ hx_fixed = 1; hx_run_fixed("VISOR ", UVISOR_FLAG_VISOR); hx_run_fixed("PALM4 ", UVISOR_FLAG_PALM4); hx_run_fixed("PALM35", UVISOR_FLAG_PALM35); kprintf("HX5488: harness complete\n"); break; case MOD_UNLOAD: break; default: error = EOPNOTSUPP; break; } return (error); } static moduledata_t hx_mod = { "uvisorstall", hx_modevent, 0 }; DECLARE_MODULE(uvisorstall, hx_mod, SI_SUB_DRIVERS, SI_ORDER_MIDDLE); MODULE_DEPEND(uvisorstall, usb, 1, 1, 1);