/* * DF-5515 KLD harness -- production-code demonstration of the ubser * (BWCT multi-port USB serial, ucom core) cfg-path synchronous-request * stall. Same rig family as DF-5496 umct / DF-5504 ucycom / DF-5487 * uvisor (cfg-stall family), strengthened with the DF-5447 * production-code-include technique: * * - the UNMODIFIED production sys/bus/u4b/serial/ubser.c is #included * into this translation unit (newbus registration neutered), so the * REAL static ubser_cfg_set_break() (ubser.c:462-487) runs; * - the REAL kernel usb_process machinery (usb_proc_create / * usb_proc_msignal / usb_proc_mwait / usb_proc_free -- the exact * taskqueue ucom's cfg callbacks execute on, usb_serial.c:322) * schedules and serializes the work; * - only the EP0 sink is modeled: ucom_cfg_do_request is a macro * (usb_serial.h:220-221) expanding to usbd_do_request_proc(), which * this harness defines (there is no prototype in any header, so the * harness pre-declares it). The model reproduces the production * requester exactly where it matters: it is called with the ucom * taskqueue's lock held (usb_process protocol), sleeps the full * caller-supplied timeout in the "WXFER" wait channel * (usb_request.c:643 style) on a UNIQUE per-request wchan, and for * the "silent evil adapter" returns USB_ERR_TIMEOUT -- which * production ubser DISCARDS (ubser.c:482-485: DPRINTFN only). * * PRODUCTION REQUEST ACCOUNTING (pass-2 precision -- this driver's * entire cfg surface is ONE request): * * ubser_callback (ubser.c:175-184) registers ucom_cfg_set_break, * ucom_cfg_get_status, ucom_pre_param, start/stop read/write, poll. * It registers NO ucom_cfg_param, NO ucom_cfg_open/close, NO * set_dtr/rts/ring. In ucom_cfg_line_state (usb_serial.c:1372-1381) * the callback mask is therefore UCOM_LS_BREAK ONLY: * - first open(2) (usb_serial.c:842-880): the queued line-state * task computes break-off, set_break(sc, 0) -- ubser.c:470 * `if (onoff)' gates it: 0 EP0 requests. cfg_open has no * callback -> no hz/10 pause (pause is inside the callback-if, * usb_serial.c:773-778). status task = fake bits (ubser.c: * 489-495), 0 requests. => first open costs ZERO requests. * - every tcsetattr: ubser has no ucom_cfg_param -> the param task * issues 0 requests. * - TIOCSBRK (usb_serial.c:1190-1193 -> ucom_break:1458-1466 -> * ucom_line_state:1423-1445): any_bits&BREAK -> set_break(sc,1) * -> 1 x 1000 ms synchronous EP0 vendor request (ubser.c:480-481). * - TIOCCBRK: set_break(sc,0) -> 0 requests (the `if (onoff)' * gate -- see DF-5517: the clear command is never sent at all). * - a paced TIOCSBRK+TIOCCBRK PAIR coalesces into ONE line-state * task: notch_bits=BREAK -> set_break(prev=0) [0 requests] + * any_bits=BREAK -> set_break(last=1) [1 request] -- the pair * still costs 1 x 1000 ms (usb_serial.c:1384-1420). * - close(2) HUPCL drops DTR only: mask excludes DTR -> 0 requests; * the closer's cost is purely usb_proc_mwait() behind the queue * (usb_serial.c:671-672, uninterruptible cv_wait). * - unplug: ucom_detach -> usb_proc_drain (usb_serial.c:394) waits * out the same queue on the USB hub event thread. * * => An evil BWCT adapter that NAKs the VENDOR_SET_BREAK data stage * pins the per-adapter ucom taskqueue 1 s per TIOCSBRK (or per * SBRK/CBRK pair); close(2) of any of the adapter's ttys blocks * uninterruptibly behind it; a sustained break loop extends the * occupancy without bound. The ttyU and cuaU device nodes are * 0600 root / 0660 dialer (usb_serial.c:477-488), so local * amplification needs root or group dialer; the evil device * itself needs nothing. * * PHASE A open + 1 x (TIOCSBRK, 100 ms, TIOCCBRK) + close: the set * issues 1 stalled request; the clear task computes * set_break(sc,0) and issues NOTHING (ubser.c:470 gate -- * the DF-5517 tie-in). EXPECT closer ELAPSED ~= 700-900 ms * behind the stalled set request, 1 request total. * PHASE B open + 5 pairs spaced 1.1 s (outpacing the 1 s request so * the double buffer cannot coalesce -- a sustained loop): * every set issues its own request. EXPECT 5 requests, * ~5.5 s of continuous per-adapter taskqueue occupancy, closer * ELAPSED ~= 900-1100 ms behind the last in-flight request. * The occupancy extends without bound while the abuser keeps * a >=1 s paced break loop running; only UNPACED bursts * coalesce in the double buffer. * PHASE B2 slow-answer evil variant: the request SUCCEEDS at * timeout-100 ms and no error is visible anywhere -- same * occupancy, fully invisible to the driver. * PHASE C (fixed build only, fix.diff: timeout 1000 -> 250 ms at * ubser.c:481): same single TIOCSBRK. EXPECT closer ELAPSED * ~= 200-300 ms. See run.fixed.log. */ #include #include #include #include #include #include #include #include /* NOTE: no usb_debug.h here on purpose: ubser.c must include its own * debug machinery itself (its USB_DEBUG_VAR-before-usb_debug.h include * order is required for DPRINTF/DPRINTFN). The prototype for * usbd_do_request_proc comes from usbdi_util.h (line 42), which * ubser.c itself includes at :88 -- visible at the production call * site inside ubser_cfg_set_break (ubser.c:480). */ MODULE_DEPEND(ub5515stall, usb, 1, 1, 1); MODULE_DEPEND(ub5515stall, ucom, 1, 1, 1); /* Neuter the newbus/module registration the production file would * otherwise perform. */ #undef DRIVER_MODULE #undef DRIVER_MODULE_ORDERED #undef MODULE_DEPEND #undef MODULE_VERSION #define DRIVER_MODULE(name, busname, driver, devclass, evh, arg) #define DRIVER_MODULE_ORDERED(name, busname, driver, devclass, evh, arg, order) #define MODULE_DEPEND(module, mdepend, vmin, vpref, vmax) #define MODULE_VERSION(module, version) /* THE PRODUCTION DRIVER, textually unmodified (md5-gated by build.sh). */ #include "../ubser.c" /* one adapter instance (the production driver's softc, allocated * zeroed by newbus at subr_bus.c:1953-1954 M_ZERO) */ static struct ubser_softc ub_sc; /* ------------------------------------------------------------------ */ /* Timing helpers / wait idents */ static int ub_tq_dummy; /* tsleep ident only */ static struct timeval ub_t0; static int64_t ub_ms(struct timeval *t0, struct timeval *t1) { return ((int64_t)(t1->tv_sec - t0->tv_sec) * 1000 + (t1->tv_usec - t0->tv_usec) / 1000); } static int64_t ub_abs_ms(void) { struct timeval now; microtime(&now); return (ub_ms(&ub_t0, &now)); } /* ------------------------------------------------------------------ */ /* Modeled EP0 sink: the silent / slow evil BWCT adapter */ static int ub_evil_mode; /* 0 = silent (timeout), 1 = slow-answer */ static int ub_req_count; /* requests issued this phase */ static char ub_req_wchan[16]; /* unique per-request wait channel */ usb_error_t usbd_do_request_proc(struct usb_device *udev, struct usb_process *pproc, struct usb_device_request *req, void *data, uint16_t flags, uint16_t *actlen, usb_timeout_t timeout) { int ms = (int)timeout; /* production gate, usb_request.c:771-774 */ if (usb_proc_is_gone(pproc)) return (USB_ERR_IOERROR); ub_req_count++; kprintf("UB5515[%dms]: EP0 bRequest=0x%02x wValue=0x%02x " "(%d ms timeout): device %s\n", (int)ub_abs_ms(), req->bRequest, req->wValue[0], ms, ub_evil_mode ? "answers at just-under-timeout" : "silent -- NAKs until timeout"); if (ub_evil_mode) { /* evil adapter answers successfully at timeout-100 ms */ lksleep(&ub_req_wchan, pproc->up_lock, 0, "WXFER", USB_MS_TO_TICKS(ms - 100)); if (req->wLength[0] != 0 && data != NULL) *(uint8_t *)data = 0; /* answer payload */ return (USB_ERR_NORMAL_COMPLETION); } /* silent adapter: full timeout, then error -- which production * ubser_cfg_set_break DISCARDS (ubser.c:482-485) */ lksleep(&ub_req_wchan, pproc->up_lock, 0, "WXFER", USB_MS_TO_TICKS(ms)); return (USB_ERR_TIMEOUT); } /* ------------------------------------------------------------------ */ /* The ucom cfg taskqueue: REAL usb_process machinery */ struct ub_msg { struct usb_proc_msg hdr; }; static struct ub_msg ub_open_msg[2]; /* ucom sc_open_task[2] */ static struct ub_msg ub_line_msg[2]; /* ucom sc_line_state_task[2] */ static struct ub_msg ub_close_msg[2]; /* ucom sc_close_task[2] */ /* modeled ucom_softc line-state bits (usb_serial.c:1384-1392 * arithmetic), BREAK-only mask as computed for ubser at * usb_serial.c:1378-1379 */ static int ub_ll_ready; /* UCOM_FLAG_LL_READY */ static int ub_pls_curr, ub_pls_set, ub_pls_clr; #define UB_LS_BREAK 0x04 /* UCOM_LS_BREAK, usb_serial.h:208 */ /* * ucom_cfg_open (usb_serial.c:756-780) for a driver with no * ucom_cfg_open callback: sets LL_READY; NO pause (the hz/10 pause at * :777 is inside the callback-if). */ static void ub_cfg_open_task(struct usb_proc_msg *pm) { kprintf("UB5515[%dms]: cfg-open task: no ucom_cfg_open callback in " "ubser -> set LL_READY only, 0 requests, no pause " "(usb_serial.c:771-778)\n", (int)ub_abs_ms()); ub_ll_ready = 1; } /* * ucom_cfg_line_state (usb_serial.c:1356-1421) with the BREAK-only * callback mask ubser earns (usb_serial.c:1378-1379), driving the REAL * production ubser_cfg_set_break(). */ static void ub_cfg_line_task(struct usb_proc_msg *pm) { uint8_t notch_bits, any_bits, prev_value, last_value; if (!ub_ll_ready) return; /* usb_serial.c:1368-1370 */ /* mask arithmetic, usb_serial.c:1384-1392 */ notch_bits = (uint8_t)((ub_pls_set & ub_pls_clr) & UB_LS_BREAK); any_bits = (uint8_t)((ub_pls_set | ub_pls_clr) & UB_LS_BREAK); prev_value = (uint8_t)(ub_pls_curr ^ notch_bits); last_value = (uint8_t)ub_pls_curr; ub_pls_curr = 0; ub_pls_set = 0; ub_pls_clr = 0; kprintf("UB5515[%dms]: line-state task: enter " "(notch=0x%x any=0x%x prev=0x%x last=0x%x)\n", (int)ub_abs_ms(), notch_bits, any_bits, prev_value, last_value); /* notch pass, usb_serial.c:1401-1403 */ if (notch_bits & UB_LS_BREAK) ubser_cfg_set_break(&ub_sc.sc_ucom[0], (prev_value & UB_LS_BREAK) ? 1 : 0); /* last-value pass, usb_serial.c:1415-1417 */ if (any_bits & UB_LS_BREAK) ubser_cfg_set_break(&ub_sc.sc_ucom[0], (last_value & UB_LS_BREAK) ? 1 : 0); kprintf("UB5515[%dms]: line-state task: leave\n", (int)ub_abs_ms()); } /* ucom_cfg_close (usb_serial.c:915-921) for a driver with no * ucom_cfg_close callback: issues nothing. */ static void ub_cfg_close_task(struct usb_proc_msg *pm) { kprintf("UB5515[%dms]: cfg-close task: no ucom_cfg_close callback " "in ubser -> 0 requests (usb_serial.c:915-921)\n", (int)ub_abs_ms()); } /* * The user thread: TIOCSBRK / TIOCCBRK as ucomioctl dispatches them * (usb_serial.c:1190-1197 -> ucom_break:1458-1466 -> ucom_line_state: * 1423-1445: update pls bits, queue the double-buffered line task). */ static void ub_user_break(int on) { if (on) { ub_pls_curr |= UB_LS_BREAK; ub_pls_set |= UB_LS_BREAK; } else { ub_pls_curr &= ~UB_LS_BREAK; ub_pls_clr |= UB_LS_BREAK; } lockmgr(&ub_sc.sc_lock, LK_EXCLUSIVE); if (!usb_proc_is_gone(&ub_sc.sc_super_ucom.sc_tq)) { struct ub_msg *m = usb_proc_msignal( &ub_sc.sc_super_ucom.sc_tq, &ub_line_msg[0], &ub_line_msg[1]); m->hdr.pm_callback = &ub_cfg_line_task; } lockmgr(&ub_sc.sc_lock, LK_RELEASE); } /* * The closer (or the USB hub event thread on unplug): exactly * ucom_close()'s synchronous tail -- queue cfg_close then * usb_proc_mwait() UNINTERRUPTIBLY behind whatever is already queued * (usb_serial.c:671-672 via ucom_queue_command). */ static int64_t ub_closer(void) { struct timeval t0, t1; microtime(&t0); kprintf("UB5515[%dms]: closer: close(2) queues cfg_close then " "usb_proc_mwait() uninterruptibly (usb_serial.c:671-672)\n", (int)ub_abs_ms()); lockmgr(&ub_sc.sc_lock, LK_EXCLUSIVE); if (!usb_proc_is_gone(&ub_sc.sc_super_ucom.sc_tq)) { struct ub_msg *m = usb_proc_msignal( &ub_sc.sc_super_ucom.sc_tq, &ub_close_msg[0], &ub_close_msg[1]); m->hdr.pm_callback = &ub_cfg_close_task; usb_proc_mwait(&ub_sc.sc_super_ucom.sc_tq, &ub_close_msg[0], &ub_close_msg[1]); } lockmgr(&ub_sc.sc_lock, LK_RELEASE); microtime(&t1); kprintf("UB5515[%dms]: closer: unblocked ELAPSED=%jd ms\n", (int)ub_abs_ms(), (intmax_t)ub_ms(&t0, &t1)); return (ub_ms(&t0, &t1)); } static int ub_phase(const char *name, char tag, int pairs, int pair_gap_ms, int evil_mode) { int i; /* fresh adapter instance, exactly as production creates them: * ubser_attach (ubser.c:233) + ucom_attach (usb_serial.c:322) */ memset(&ub_sc, 0, sizeof(ub_sc)); lockinit(&ub_sc.sc_lock, "ubser", 0, LK_CANRECURSE); ub_sc.sc_numser = 1; /* evil device claims 1 port */ ub_sc.sc_udev = (void *)&ub_tq_dummy; /* model sink ignores it */ ub_sc.sc_ucom[0].sc_parent = &ub_sc; ub_sc.sc_ucom[0].sc_portno = 0; ub_sc.sc_ucom[0].sc_super = &ub_sc.sc_super_ucom; ub_sc.sc_ucom[0].sc_lock = &ub_sc.sc_lock; ub_sc.sc_ucom[0].sc_flag = UCOM_FLAG_LL_READY | UCOM_FLAG_HL_READY; ub_ll_ready = 0; ub_pls_curr = ub_pls_set = ub_pls_clr = 0; ub_req_count = 0; ub_evil_mode = evil_mode; if (usb_proc_create(&ub_sc.sc_super_ucom.sc_tq, &ub_sc.sc_lock, "ucom", USB_PRI_MED) != 0) { kprintf("UB5515: usb_proc_create failed\n"); lockuninit(&ub_sc.sc_lock); return (ENXIO); } microtime(&ub_t0); kprintf("UB5515[%c]: --- phase %s: open + %d SBRK/CBRK pair(s) + " "close, device=%s --- (t=0)\n", tag, name, pairs, evil_mode ? "slow-answer" : "silent-NAK"); /* open(2): production queue order usb_serial.c:842-880; of the * whole open chain only cfg_open does anything here (param task * bails on !LL_READY, usb_serial.c:1626-1628; line-state computes * break-off -> set_break(0) -> gated off by ubser.c:470). */ lockmgr(&ub_sc.sc_lock, LK_EXCLUSIVE); { struct ub_msg *m = usb_proc_msignal( &ub_sc.sc_super_ucom.sc_tq, &ub_open_msg[0], &ub_open_msg[1]); m->hdr.pm_callback = &ub_cfg_open_task; } lockmgr(&ub_sc.sc_lock, LK_RELEASE); tsleep(&ub_tq_dummy, 0, "ubopen", hz / 5); /* open returns */ /* the user's break traffic. Within a pair SBRK and CBRK are * 100 ms apart; pairs are spaced pair_gap_ms so that when * pair_gap_ms exceeds the per-request stall every set gets its * own line-state task (a sustained >=1 s paced loop keeps the * taskqueue occupied without end); tighter pacing coalesces in * the double buffer, losing sets -- not gaining them. */ for (i = 0; i < pairs; i++) { ub_user_break(1); /* TIOCSBRK */ tsleep(&ub_tq_dummy, 0, "ubsbrk", hz / 10); ub_user_break(0); /* TIOCCBRK */ if (pair_gap_ms) tsleep(&ub_tq_dummy, 0, "ubcbrk", USB_MS_TO_TICKS(pair_gap_ms)); } /* close(2) behind whatever is stalled in the queue */ ub_closer(); kprintf("UB5515[%c]: phase done: %d EP0 request(s) issued\n", tag, ub_req_count); usb_proc_free(&ub_sc.sc_super_ucom.sc_tq); lockuninit(&ub_sc.sc_lock); return (0); } static void ub_touch_statics(void) { if (ubser_devclass != NULL) kprintf("UB5515: unexpected devclass %p\n", ubser_devclass); kprintf("UB5515: production driver \"%s\" compiled into harness " "(registration neutered)\n", ubser_driver.name); } static int ub_modevent(module_t mod, int type, void *data) { int error = 0; switch (type) { case MOD_LOAD: kprintf("UB5515: DF-5515 ubser cfg-stall harness, hz=%d; " "ubser cfg surface = 1 request (VENDOR_SET_BREAK, " "1000 ms, TIOCSBRK only; TIOCCBRK gated by " "ubser.c:470 -- see DF-5517)\n", hz); ub_touch_statics(); ub_phase("A open + 1 SBRK/CBRK pair + close (silent evil)", 'A', 1, 0, 0); ub_phase("B open + 5 pairs @1.1s + close (silent, sustained)", 'B', 5, 1100, 0); ub_phase("B2 open + 1 SBRK + close (slow-answer evil)", '2', 1, 0, 1); kprintf("UB5515: harness complete (phase C = fixed build " "rerun, see run.fixed.log)\n"); break; case MOD_UNLOAD: break; default: error = EOPNOTSUPP; break; } return (error); } static moduledata_t ub_mod = { "ub5515stall", ub_modevent, 0 }; DECLARE_MODULE(ub5515stall, ub_mod, SI_SUB_DRIVERS, SI_ORDER_MIDDLE);