A protocol is reached by name now, not by a compile-time integer. Init is PID 1 and already knows which binary it started, so init serves /protocol as a vfs backend: bind claims a contract with the provider's endpoint attached, open answers with that endpoint as the reply's capability, and readdir lists what is bound with the task and binary behind it. The kernel reserves the prefix — nothing may mount over it, under it, or unmount it — and ServiceId, ipc_register and ipc_lookup are gone, their syscall numbers left vacant. A bind is authorized by who the caller *is*: the kernel-stamped binary together with the supervising task's identity, matched against /system/configuration/protocol.csv. Identity, not spelling — spawn is ungated, so an attacker can run any bundled binary, and a name-only rule would have let it launder grants through an init of its own making. A name a live process holds is refused to everyone else; a dead one's is released. Three review rounds against a hostile ring-3 process found what 108 green tests could not, because the suite contains no attacker. Publishing init's supervision endpoint as the registry put PID 1's mailbox in every process's hands, where two forged bytes reached the shutdown path: privileged traffic is now believed only from the task that holds the contract it speaks for. A capability arriving on a request outlived every path that ignored it, one handle per call until the table was full — in init, and in the harness ten services share — so the arriving capability is owned by the turn and released unless a handler says otherwise. And the kernel let anyone holding an endpoint handle aim signals, timers, exit notices and interrupts at it: binding now requires having created it. Suite 108/108. The new protocol-registry case asserts eleven properties, each one an attack that must fail.
167 lines
8.9 KiB
Zig
167 lines
8.9 KiB
Zig
//! USB class-driver client: the helper a keyboard, mouse, or mass-storage driver
|
|
//! uses to reach its device through the xHCI bus driver, so it never hand-rolls
|
|
//! the transfer-protocol IPC. Layered over `ipc` and the shared
|
|
//! `usb-transfer-protocol` wire format, the way `input.zig` layers over the input
|
|
//! service and `device.zig` over the raw device calls.
|
|
//!
|
|
//! A class driver, spawned with its interface's assigned device id as argv[1]:
|
|
//! if (device_manager.hello(.device, id) == null) return; // meet the spawn deadline
|
|
//! var device = usb.open(id) orelse return; // open + get its endpoints
|
|
//! _ = device.controlOut(usb_abi.setProtocol(...));// class requests, descriptors
|
|
//! _ = device.subscribeInterrupt(address, length); // reports arrive asynchronously
|
|
//! while (true) { ... ipc.replyWait(device.endpoint, ...) ... } // its own loop
|
|
//!
|
|
//! Reports are delivered to `device.endpoint` as asynchronous `InterruptReport`
|
|
//! messages (the class driver runs a bare `replyWait` loop to read them, because
|
|
//! the service harness drops buffered-message payloads — see service.zig).
|
|
|
|
const std = @import("std");
|
|
const channel = @import("channel");
|
|
const ipc = @import("ipc");
|
|
const time = @import("time");
|
|
const usb_transfer_protocol = @import("usb-transfer-protocol");
|
|
|
|
/// The USB chapter-9 wire ABI and the class taxonomy, re-exported so a class driver reaches
|
|
/// the whole USB domain through its one `usb` import (`usb.abi.getDescriptor`, `usb.ids.Class`).
|
|
pub const abi = @import("usb-abi");
|
|
pub const ids = @import("usb-ids");
|
|
|
|
pub const Endpoint = usb_transfer_protocol.Endpoint;
|
|
pub const InterruptReport = usb_transfer_protocol.InterruptReport;
|
|
pub const max_report_data = usb_transfer_protocol.max_report_data;
|
|
|
|
// Endpoint transfer types (EndpointDescriptor attributes), for `findEndpoint`.
|
|
pub const transfer_type_bulk: u8 = 2;
|
|
pub const transfer_type_interrupt: u8 = 3;
|
|
|
|
/// An opened USB device: the bus endpoint to send requests to, this driver's own
|
|
/// endpoint that reports arrive on, the device token, and the interface's
|
|
/// endpoints (so a driver need not re-read the configuration descriptor).
|
|
pub const Device = struct {
|
|
bus: ipc.Handle,
|
|
endpoint: ipc.Handle,
|
|
token: u64,
|
|
class: u8,
|
|
subclass: u8,
|
|
protocol_code: u8,
|
|
interface_number: u8,
|
|
endpoint_count: usize = 0,
|
|
endpoints: [usb_transfer_protocol.max_reported_endpoints]Endpoint = undefined,
|
|
|
|
/// The interface's first endpoint of the given transfer type and direction
|
|
/// (`transfer_type_bulk` / `transfer_type_interrupt`), or null.
|
|
pub fn findEndpoint(self: *const Device, transfer_type: u8, direction_in: bool) ?Endpoint {
|
|
for (self.endpoints[0..self.endpoint_count]) |endpoint| {
|
|
if (endpoint.transfer_type == transfer_type and (endpoint.address & 0x80 != 0) == direction_in) return endpoint;
|
|
}
|
|
return null;
|
|
}
|
|
|
|
fn controlTransfer(self: *Device, setup: [8]u8, direction_in: bool, data: []u8) ?usize {
|
|
var request = usb_transfer_protocol.ControlRequest{
|
|
.device_token = self.token,
|
|
.setup = setup,
|
|
.direction_in = @intFromBool(direction_in),
|
|
.data_length = @intCast(data.len),
|
|
};
|
|
if (!direction_in and data.len > 0) @memcpy(request.data[0..data.len], data);
|
|
var reply: [@sizeOf(usb_transfer_protocol.ControlReply)]u8 = undefined;
|
|
const length = ipc.call(self.bus, std.mem.asBytes(&request), &reply) catch return null;
|
|
if (length < @sizeOf(usb_transfer_protocol.ControlReply)) return null;
|
|
const control_reply = std.mem.bytesToValue(usb_transfer_protocol.ControlReply, reply[0..@sizeOf(usb_transfer_protocol.ControlReply)]);
|
|
if (control_reply.status != 0) return null;
|
|
const actual = @min(control_reply.actual_length, data.len);
|
|
if (direction_in and actual > 0) @memcpy(data[0..actual], control_reply.data[0..actual]);
|
|
return actual;
|
|
}
|
|
|
|
/// A control transfer with no data stage (SET_PROTOCOL, SET_IDLE, ...). The
|
|
/// `setup` is a bit-cast `usb_abi.Request`.
|
|
pub fn controlOut(self: *Device, setup: [8]u8) bool {
|
|
return self.controlTransfer(setup, false, &.{}) != null;
|
|
}
|
|
|
|
/// A device-to-host control transfer, returning the bytes read into `out`.
|
|
pub fn controlIn(self: *Device, setup: [8]u8, out: []u8) ?usize {
|
|
return self.controlTransfer(setup, true, out);
|
|
}
|
|
|
|
/// Begin periodic IN polling of an interrupt endpoint; reports flow back to
|
|
/// `self.endpoint` as asynchronous `InterruptReport` messages.
|
|
pub fn subscribeInterrupt(self: *Device, endpoint_address: u8, max_length: u16) bool {
|
|
var request = usb_transfer_protocol.InterruptSubscribeRequest{
|
|
.device_token = self.token,
|
|
.endpoint_address = endpoint_address,
|
|
.max_length = max_length,
|
|
};
|
|
var reply: [@sizeOf(usb_transfer_protocol.InterruptSubscribeReply)]u8 = undefined;
|
|
const length = ipc.call(self.bus, std.mem.asBytes(&request), &reply) catch return false;
|
|
if (length < @sizeOf(usb_transfer_protocol.InterruptSubscribeReply)) return false;
|
|
return std.mem.bytesToValue(usb_transfer_protocol.InterruptSubscribeReply, reply[0..@sizeOf(usb_transfer_protocol.InterruptSubscribeReply)]).status == 0;
|
|
}
|
|
|
|
/// Hand the controller a DMA-region capability (`handle` — from a `shareable`
|
|
/// dma_alloc, or forwarded from another process) so it binds that buffer into its
|
|
/// IOMMU domain. Must be called for every buffer whose physical address this device
|
|
/// will name in a `bulk` transfer, before the transfer. Harmless (and a no-op
|
|
/// success) when no IOMMU is enforcing. Returns false on failure.
|
|
pub fn attachDma(self: *Device, handle: ipc.Handle) bool {
|
|
var request = usb_transfer_protocol.DmaAttachRequest{ .device_token = self.token };
|
|
var reply: [@sizeOf(usb_transfer_protocol.DmaAttachReply)]u8 = undefined;
|
|
const result = ipc.callCap(self.bus, std.mem.asBytes(&request), &reply, handle) catch return false;
|
|
if (result.len < @sizeOf(usb_transfer_protocol.DmaAttachReply)) return false;
|
|
return std.mem.bytesToValue(usb_transfer_protocol.DmaAttachReply, reply[0..@sizeOf(usb_transfer_protocol.DmaAttachReply)]).status == 0;
|
|
}
|
|
|
|
/// One bulk transfer (IN or OUT per `endpoint_address`'s direction bit) to or
|
|
/// from the caller's own DMA buffer at `physical`. Returns the bytes moved.
|
|
pub fn bulk(self: *Device, endpoint_address: u8, physical: u64, length: u32) ?u32 {
|
|
var request = usb_transfer_protocol.BulkRequest{
|
|
.device_token = self.token,
|
|
.physical_address = physical,
|
|
.length = length,
|
|
.endpoint_address = endpoint_address,
|
|
};
|
|
var reply: [@sizeOf(usb_transfer_protocol.BulkReply)]u8 = undefined;
|
|
const replied = ipc.call(self.bus, std.mem.asBytes(&request), &reply) catch return null;
|
|
if (replied < @sizeOf(usb_transfer_protocol.BulkReply)) return null;
|
|
const bulk_reply = std.mem.bytesToValue(usb_transfer_protocol.BulkReply, reply[0..@sizeOf(usb_transfer_protocol.BulkReply)]);
|
|
if (bulk_reply.status != 0) return null;
|
|
return bulk_reply.actual_length;
|
|
}
|
|
};
|
|
|
|
/// Open `/protocol/usb-transfer` and, on that channel, open the device with the
|
|
/// assigned id, handing over a freshly created endpoint for asynchronous interrupt
|
|
/// reports. Retries while the bus is still coming up (a class driver races the bus
|
|
/// driver at boot). Two opens, deliberately: the first names the contract, the
|
|
/// second names an object within it.
|
|
pub fn open(device_id: u64) ?Device {
|
|
var attempts: usize = 0;
|
|
const bus = while (attempts < 100) : (attempts += 1) {
|
|
if (channel.openEndpoint("usb-transfer")) |handle| break handle;
|
|
time.sleepMillis(20);
|
|
} else return null;
|
|
|
|
const endpoint = ipc.createIpcEndpoint() orelse return null;
|
|
var request = usb_transfer_protocol.OpenRequest{ .device_id = device_id };
|
|
var reply: [@sizeOf(usb_transfer_protocol.OpenReply)]u8 = undefined;
|
|
const result = ipc.callCap(bus, std.mem.asBytes(&request), &reply, endpoint) catch return null;
|
|
if (result.len < @sizeOf(usb_transfer_protocol.OpenReply)) return null;
|
|
const open_reply = std.mem.bytesToValue(usb_transfer_protocol.OpenReply, reply[0..@sizeOf(usb_transfer_protocol.OpenReply)]);
|
|
if (open_reply.status != 0) return null;
|
|
|
|
var device = Device{
|
|
.bus = bus,
|
|
.endpoint = endpoint,
|
|
.token = open_reply.device_token,
|
|
.class = open_reply.interface_class,
|
|
.subclass = open_reply.interface_subclass,
|
|
.protocol_code = open_reply.interface_protocol,
|
|
.interface_number = open_reply.interface_number,
|
|
.endpoint_count = @min(open_reply.endpoint_count, usb_transfer_protocol.max_reported_endpoints),
|
|
};
|
|
for (0..device.endpoint_count) |index| device.endpoints[index] = open_reply.endpoints[index];
|
|
return device;
|
|
}
|