/* * ppbbasehx — KLD harness for sys/bus/ppbus/ppb_base.c (DragonFly 6.5-DEVEL) * * Evidence class: "KLD-harness-with-production-code" (no parallel port in * the QEMU rig — family standard proven with DF-5418/5511/5573 this pass). * The module compiles the UNMODIFIED production source ppb_base.c out of * the guest's /usr/src/sys/bus/ppbus and drives it against a fake ppbus * controller ("fakeppc") on nexus. The poll/status/epp targets run on a * "ppbshim" child device whose softc is a real struct ppb_data, exactly * as the ppbus driver would provide. * * The fake controller mirrors the PRODUCTION ppc.c controller shapes: * - fakeppc_ecp_sync() is `static void ... (device_t)' == ppc.c:144 * - fakeppc_reset_epp() is `static void ... (device_t)' == ppc.c:1785 * against the interface declared in ppbus_if.m:57/:72 as `METHOD int' * — exactly the production interface/implementation mismatch. * - fakeppc_read_ivar() returns ENOENT WITHOUT writing *result, the * generic behavior of any controller that does not implement the * PPC ivars (ppc.c:2048 does implement PPC_IVAR_EPP_PROTO — the * only in-tree controller — so ppb_get_epp_protocol's ignored * BUS_READ_IVAR error never manifests in-tree today). * * Tests (output prefixed "PPBHX:", all execute at attach time): * * DF-5625 ppb_base.c:159-163/170-174 return PPBUS_RESET_EPP / * PPBUS_ECP_SYNC although the only implementations are void: * the DEVMETHOD dispatch calls a void function through an * int-returning prototype — the return value is whatever the * callee last left in %eax (indeterminate per C, tracked here * deterministically via a marker call to demonstrate the * mechanism). * * DF-5626 ppb_base.c:60-67: the PPB_POLL path busy-spins * max*10000*(port read + DELAY(1)) with no tsleep, no signal * checkpoint and no clamp on max. Proven by RSTR-read count * (exactly 10000 per max unit — a sleeping poll reads the * status once per 10 ms window) and wall time. max=100 is * do_peripheral_wait()'s in-tree argument (ppb_1284.c:64) => * >=1 s single uninterruptible busy window per call. * * DF-5627 ppb_base.c:100-108: BUS_READ_IVAR's return value is * discarded and `protocol' is returned uninitialized whenever * the parent fails / does not implement the ivar. Proven by * dirtying the stack with distinct byte patterns immediately * before each call: the "protocol" leaks those bytes. * * DF-5628 ppb_base.c:77/:83 sleep tick arithmetic `hz/100': with the * boot tunable kern.hz < 100 (HZ_DEFAULT=100, subr_param.c:54, * tunable subr_param.c:199) the quotient is 0 and tsleep() * arms NO timeout at all (kern_synch.c:691 `if (timo)'). * Demonstrated by a kernel thread parked on tsleep(...,0) * still being asleep many ticks later, waking only on the * explicit wakeup(). */ #include #include #include #include #include #include #include #include #include #include #include #include #include "ppbus_if.h" /* ------------------------------------------------------------------ */ /* scripted peer + counters */ /* ------------------------------------------------------------------ */ static char hx_default_status = (char)0xD0; /* nBUSY|nACK|SELECT set: */ /* SELECT never clears, so */ /* a SELECT==0 poll fails */ static int hx_rstr_calls; static int hx_setmode_calls; static void hx_reset_peer(void) { hx_rstr_calls = 0; hx_setmode_calls = 0; } /* ------------------------------------------------------------------ */ /* fake ppbus controller (parent) — mirrors production ppc.c shapes */ /* ------------------------------------------------------------------ */ static u_char fakeppc_io(device_t dev, int opcode, u_char *addr, int cnt, u_char byte) { switch (opcode) { case PPB_RSTR: hx_rstr_calls++; return ((u_char)hx_default_status); default: break; } return (0); } static int fakeppc_setmode(device_t dev, int mode) { hx_setmode_calls++; return (0); /* chipset accepts everything */ } /* * Production shape: ppc.c:144 `static void ppc_ecp_sync(device_t dev)' * and ppc.c:1785 `static void ppc_reset_epp(device_t dev)' — both void * while ppbus_if.m:57/:72 declare `METHOD int'. The marker's return * value is what the void epilogue leaves in %eax, i.e. what the int- * typed dispatch will hand to ppb_base.c's `return'. */ static int hx_marker_val = 0x66; static int hx_marker_hits; static int __noinline hx_marker(void) { hx_marker_hits++; /* side effect: cannot be elided */ return (hx_marker_val); } static void fakeppc_ecp_sync(device_t dev) /* void == ppc.c:144 */ { (void)hx_marker(); } static void fakeppc_reset_epp(device_t dev) /* void == ppc.c:1785 */ { (void)hx_marker(); } /* * Generic-controller behavior for ivars: fail without writing *result * (ppc.c:2048-2063's own default branch does exactly this for unknown * indexes; a non-ppc controller has no PPC ivars at all). */ static int fakeppc_read_ivar(device_t bus, device_t child, int index, uintptr_t *result) { return (ENOENT); /* *result deliberately NOT written */ } static void fakeppc_identify(driver_t *drv, device_t parent) { if (device_find_child(parent, "fakeppc", 0) == NULL) BUS_ADD_CHILD(parent, parent, 0, "fakeppc", 0); } static int fakeppc_probe(device_t dev) { device_set_desc(dev, "fake ppbus controller (ppb_base harness)"); return (0); } static int fakeppc_attach(device_t dev) { /* NB: plain device_add_child(), NOT BUS_ADD_CHILD() (DF-5418 lore) */ if (device_add_child(dev, "ppbshim", 0) == NULL) return (ENOMEM); return (bus_generic_attach(dev)); } static int fakeppc_detach(device_t dev) { bus_generic_detach(dev); device_delete_children(dev); return (0); } static device_method_t fakeppc_methods[] = { DEVMETHOD(device_identify, fakeppc_identify), DEVMETHOD(device_probe, fakeppc_probe), DEVMETHOD(device_attach, fakeppc_attach), DEVMETHOD(device_detach, fakeppc_detach), /* bus */ DEVMETHOD(bus_read_ivar, fakeppc_read_ivar), /* ppbus interface (shapes mirror production ppc.c) */ DEVMETHOD(ppbus_io, fakeppc_io), DEVMETHOD(ppbus_setmode, fakeppc_setmode), DEVMETHOD(ppbus_ecp_sync, fakeppc_ecp_sync), /* void impl */ DEVMETHOD(ppbus_reset_epp, fakeppc_reset_epp), /* void impl */ DEVMETHOD_END }; static driver_t fakeppc_driver = { "fakeppc", fakeppc_methods, 0, }; static devclass_t fakeppc_devclass; DRIVER_MODULE(fakeppc, nexus, fakeppc_driver, fakeppc_devclass, NULL, NULL); /* ------------------------------------------------------------------ */ /* ppbshim: child whose softc is a real struct ppb_data */ /* ------------------------------------------------------------------ */ static device_t hx_bus; static int ppbshim_probe(device_t dev) { device_set_desc(dev, "ppb_base.c target (harness)"); return (0); } static suseconds_t hx_dt_us(struct timeval *t0, struct timeval *t1) { return ((t1->tv_sec - t0->tv_sec) * 1000000 + (t1->tv_usec - t0->tv_usec)); } /* ---- DF-5626: PPB_POLL busy-spin vs sleeping poll ------------------ */ static void run_df5626_tests(void) { struct timeval t0, t1; int ret; kprintf("PPBHX: --- DF-5626 ppb_poll_bus PPB_POLL busy-spin (ppb_base.c:60-67) ---\n"); /* never-matching peer: SELECT bit always set, we require it clear */ hx_reset_peer(); getmicrouptime(&t0); ret = ppb_poll_bus(hx_bus, 5, SELECT, 0, PPB_NOINTR | PPB_POLL); getmicrouptime(&t1); kprintf("PPBHX: DF-5626 busy max=5 : ret=%d rstr_reads=%d " "(expect exactly 50000 = 5*10000 busy port reads) " "wall=%ldus (expect >=50000: pure DELAY, never sleeps)\n", ret, hx_rstr_calls, (long)hx_dt_us(&t0, &t1)); /* do_peripheral_wait()'s exact production argument (ppb_1284.c:64) */ hx_reset_peer(); getmicrouptime(&t0); ret = ppb_poll_bus(hx_bus, 100, SELECT, 0, PPB_NOINTR | PPB_POLL); getmicrouptime(&t1); kprintf("PPBHX: DF-5626 busy max=100: ret=%d rstr_reads=%d " "(expect exactly 1000000) wall=%ldus (>=1s single " "uninterruptible busy window = do_peripheral_wait arg)\n", ret, hx_rstr_calls, (long)hx_dt_us(&t0, &t1)); /* control: same wall order WITHOUT PPB_POLL -> the sleeping path: * 1x10000 busy (10ms) + (max-1)=2 status checks + 2x tsleep(10ms) */ hx_reset_peer(); getmicrouptime(&t0); ret = ppb_poll_bus(hx_bus, 3, SELECT, 0, PPB_NOINTR); getmicrouptime(&t1); kprintf("PPBHX: DF-5626 sleep ctrl max=3: ret=%d rstr_reads=%d " "(expect 10002 = 10000 busy + 2 checks) wall=%ldus " "(~30ms but only 10ms busy: PPB_POLL flag is what turns the " "wait into a full busy spin)\n", ret, hx_rstr_calls, (long)hx_dt_us(&t0, &t1)); } /* ---- DF-5625: int wrapper over void methods ------------------------ */ static void run_df5625_tests(void) { int r1, r2, r3; kprintf("PPBHX: --- DF-5625 ppb_ecp_sync/ppb_reset_epp_timeout return " "void methods (ppb_base.c:159-163,170-174 vs ppc.c:144,1785) ---\n"); hx_marker_val = 0x66; r1 = ppb_ecp_sync(hx_bus); hx_marker_val = 0x99; r2 = ppb_ecp_sync(hx_bus); hx_marker_val = 0x5A; r3 = ppb_reset_epp_timeout(hx_bus); kprintf("PPBHX: DF-5625 ppb_ecp_sync() -> 0x%x " "(void method left marker 0x66 in %%eax)\n", r1); kprintf("PPBHX: DF-5625 ppb_ecp_sync() -> 0x%x " "(void method left marker 0x99 in %%eax)\n", r2); kprintf("PPBHX: DF-5625 ppb_reset_epp_timeout() -> 0x%x " "(void method left marker 0x5a in %%eax; marker hits=%d)\n", r3, hx_marker_hits); kprintf("PPBHX: DF-5625 the 'int' returns track the void callee's " "last register state: not a defined value (C UB through the " "DEVMETHOD dispatch); callers that error-check get garbage\n"); } /* ---- DF-5627: uninitialized protocol on failed BUS_READ_IVAR ------- */ static int hx_sink; static void __noinline hx_dirty_stack(char c) { volatile char pad[512]; int i; for (i = 0; i < 512; i++) pad[i] = c; hx_sink = pad[0] + pad[511]; } static void run_df5627_tests(void) { int p1, p2, p3; kprintf("PPBHX: --- DF-5627 ppb_get_epp_protocol uninitialized on " "BUS_READ_IVAR failure (ppb_base.c:100-108) ---\n"); hx_dirty_stack(0x41); p1 = ppb_get_epp_protocol(hx_bus); hx_dirty_stack(0x42); p2 = ppb_get_epp_protocol(hx_bus); hx_dirty_stack(0x43); p3 = ppb_get_epp_protocol(hx_bus); kprintf("PPBHX: DF-5627 stack dirtied 0x41 -> protocol=0x%08x\n", p1); kprintf("PPBHX: DF-5627 stack dirtied 0x42 -> protocol=0x%08x\n", p2); kprintf("PPBHX: DF-5627 stack dirtied 0x43 -> protocol=0x%08x\n", p3); kprintf("PPBHX: DF-5627 fake controller read_ivar returned ENOENT " "without writing (ppb_base.c:105 discards it); the return " "value is stale stack content -> in-tree consumer " "mode2xfer (ppb_msq.c:85) would take the default PANIC " "branch (DF-5576) or silently pick the wrong EPP protocol\n"); } /* ---- DF-5628: hz/100 == 0 arms no tsleep timeout ------------------- */ static int hx_park_ident; static struct thread *hx_park_td; static int hx_done; static void hx_park(void *arg) { /* timo == 0: kern_synch.c:691 `if (timo)' -> NO callout armed */ tsleep((void *)&hx_park_ident, 0, "ppbhz0", 0); kprintf("PPBHX: DF-5628 park thread woke (explicit wakeup only, " "no timeout existed)\n"); kthread_exit(); } /* * DF-5628b: park through PRODUCTION ppb_poll_bus at hz=50 — its * tsleep(..., hz/100) computes 50/100 == 0, so the sleeping poll path * arms no timeout and the thread stays parked until the explicit * wakeup. Cleanup: make the scripted status match the poll condition * (SELECT clears -> (r & mask) == status) so the thread returns after * being woken. */ static struct thread *hx_hzpark_td; static void hx_hzpark(void *arg) { int ret; ret = ppb_poll_bus(hx_bus, 3, SELECT, 0, PPB_NOINTR); kprintf("PPBHX: DF-5628b hz=50 production ppb_poll_bus returned %d " "only after wakeup+match (with a working timeout it would " "have returned EWOULDBLOCK=%d on its own long ago)\n", ret, EWOULDBLOCK); kthread_exit(); } static void run_df5628_tests(void) { int error; kprintf("PPBHX: --- DF-5628 ppb_poll_bus hz/100 tick arithmetic " "(ppb_base.c:77,83) ---\n"); kprintf("PPBHX: DF-5628 hz=%d -> hz/100=%d tick(s) per poll sleep; " "kern.hz is a boot tunable (subr_param.c:199): hz<100 makes " "the quotient 0 and tsleep(...,0) arms NO timeout " "(kern_synch.c:691)\n", hz, hz / 100); error = kthread_create(hx_park, NULL, &hx_park_td, "ppbhz0"); if (error) { kprintf("PPBHX: DF-5628 kthread_create failed: %d\n", error); return; } /* wait 6 ticks (~60ms at hz=100) — 6x the alleged 10ms timeout */ tsleep(&hx_done, 0, "ppbhxw", 6); kprintf("PPBHX: DF-5628 after 6 ticks: park thread wchan==ident:%d " "wmesg=%s -> STILL ASLEEP: a 10ms timeout never fired " "because timo==0 means 'sleep forever' in DragonFly tsleep\n", hx_park_td->td_wchan == (const void *)&hx_park_ident, hx_park_td->td_wmesg ? hx_park_td->td_wmesg : "?"); wakeup((void *)&hx_park_ident); tsleep(&hx_done, 0, "ppbhxw", 3); /* let it exit before unload */ /* * DF-5628b: lower hz to 50 (the boot tunable's value space, * subr_param.c:199) and drive the PRODUCTION sleeping poll path. * ppb_base.c:77 computes hz/100 == 0 -> tsleep(...,0) -> park. */ { int save_hz = hz; hz = 50; kprintf("PPBHX: DF-5628b hz forced to %d (kern.hz tunable " "space): production ppb_poll_bus(max=3, PPB_NOINTR) " "on park thread, peer never matches\n", hz); if (kthread_create(hx_hzpark, NULL, &hx_hzpark_td, "ppbhz50") == 0) { /* * Wait past the 10ms-nominal busy prologue (measured * ~200ms in this guest: 10000 x (dispatch+DELAY(1))) * so the thread has certainly reached the sleeping * loop and parked on tsleep(...,0). */ tsleep(&hx_done, 0, "ppbhxw", 30); /* ~300ms */ kprintf("PPBHX: DF-5628b after ~300ms (busy prologue " "over): hz-park thread wchan==bus:%d " "wmesg=%s -> STILL PARKED IN PRODUCTION " "ppb_poll_bus: the 30ms timeout never fired " "(50/100==0 -> timo==0 -> no callout)\n", hx_hzpark_td->td_wchan == (const void *)hx_bus, hx_hzpark_td->td_wmesg ? hx_hzpark_td->td_wmesg : "?"); /* free it: let the next condition check match */ hx_default_status = 0; wakeup((caddr_t)hx_bus); tsleep(&hx_done, 0, "ppbhxw", 4); } hz = save_hz; hx_default_status = (char)0xD0; kprintf("PPBHX: DF-5628b hz restored to %d\n", hz); } } static int ppbshim_attach(device_t dev) { hx_bus = dev; kprintf("PPBHX: harness start (production ppb_base.c)\n"); run_df5626_tests(); run_df5625_tests(); run_df5627_tests(); run_df5628_tests(); kprintf("PPBHX: harness done\n"); return (0); } static int ppbshim_detach(device_t dev) { return (0); } static device_method_t ppbshim_methods[] = { DEVMETHOD(device_probe, ppbshim_probe), DEVMETHOD(device_attach, ppbshim_attach), DEVMETHOD(device_detach, ppbshim_detach), DEVMETHOD_END }; static driver_t ppbshim_driver = { "ppbshim", ppbshim_methods, sizeof(struct ppb_data), }; static devclass_t ppbshim_devclass; DRIVER_MODULE(ppbshim, fakeppc, ppbshim_driver, ppbshim_devclass, NULL, NULL);