Hi!
I'm trying to use gadgetfs to fuzz USB device drivers by simply
connecting random devices for now.
What I want to achieve right now is the following:
1. mount gadgetfs
2. emulate connection of a new USB device
3. wait for the device to finish initializing
4. unmount gadgetfs
5. goto 1
The question is how do I wait for the device to finish initializing
(the corresponding USB driver to finish probing?) before unmounting
gadgetfs? As I understand, when I write device description to
"/dev/gadget/dummy_udc" the initialization happens asynchronously
after writing is done.
To mount and unmount gadgetfs right now I do:
mount("none", "/dev/gadget", "gadgetfs", 0, NULL)
umount2("/dev/gadget", MNT_FORCE | MNT_DETACH)
Thanks!
On Tue, 13 Jun 2017, Andrey Konovalov wrote:
> Hi!
>
> I'm trying to use gadgetfs to fuzz USB device drivers by simply
> connecting random devices for now.
>
> What I want to achieve right now is the following:
>
> 1. mount gadgetfs
> 2. emulate connection of a new USB device
> 3. wait for the device to finish initializing
> 4. unmount gadgetfs
> 5. goto 1
>
> The question is how do I wait for the device to finish initializing
> (the corresponding USB driver to finish probing?) before unmounting
> gadgetfs? As I understand, when I write device description to
> "/dev/gadget/dummy_udc" the initialization happens asynchronously
> after writing is done.
The most generic approach is to monitor the system log and wait for the
appropriate messages to show up. If you know a little more about the
device (such as which driver it will bind to), you might be able to use
a udev library to do the monitoring.
Or since the gadget driver in this case is part of your program, you
could wait until your program sees all the USB requests that get sent
during the initialization and probing procedures.
For a really simple approach, just wait a fixed amount of time, like 10
seconds. Unless the system is highly loaded or probing takes a lot
longer than usual, that should be enough.
Alan Stern
> To mount and unmount gadgetfs right now I do:
> mount("none", "/dev/gadget", "gadgetfs", 0, NULL)
> umount2("/dev/gadget", MNT_FORCE | MNT_DETACH)
>
> Thanks!
On Tue, Jun 13, 2017 at 3:21 PM, Andrey Konovalov <[email protected]> wrote:
> Hi!
>
> I'm trying to use gadgetfs to fuzz USB device drivers by simply
> connecting random devices for now.
>
> What I want to achieve right now is the following:
>
> 1. mount gadgetfs
> 2. emulate connection of a new USB device
> 3. wait for the device to finish initializing
> 4. unmount gadgetfs
> 5. goto 1
>
> The question is how do I wait for the device to finish initializing
> (the corresponding USB driver to finish probing?) before unmounting
> gadgetfs? As I understand, when I write device description to
> "/dev/gadget/dummy_udc" the initialization happens asynchronously
> after writing is done.
>
You can use inotify on the state file inside a udc's sysfs directory.
It's awesome like that.
Here's a sample code that doesn't do any cleanups because I'm lazy:
https://gist.github.com/talshorer/61be1bc3472cc2a7b4866b9bd5a239ca
On Tue, Jun 13, 2017 at 7:02 PM, Tal Shorer <[email protected]> wrote:
> On Tue, Jun 13, 2017 at 3:21 PM, Andrey Konovalov <[email protected]> wrote:
>> Hi!
>>
>> I'm trying to use gadgetfs to fuzz USB device drivers by simply
>> connecting random devices for now.
>>
>> What I want to achieve right now is the following:
>>
>> 1. mount gadgetfs
>> 2. emulate connection of a new USB device
>> 3. wait for the device to finish initializing
>> 4. unmount gadgetfs
>> 5. goto 1
>>
>> The question is how do I wait for the device to finish initializing
>> (the corresponding USB driver to finish probing?) before unmounting
>> gadgetfs? As I understand, when I write device description to
>> "/dev/gadget/dummy_udc" the initialization happens asynchronously
>> after writing is done.
>>
>
> You can use inotify on the state file inside a udc's sysfs directory.
> It's awesome like that.
> Here's a sample code that doesn't do any cleanups because I'm lazy:
> https://gist.github.com/talshorer/61be1bc3472cc2a7b4866b9bd5a239ca
And I forgot usage >:
./wait_udc_configured /sys/devices/platform/dummy_udc.0/udc/dummy_udc.0/state
On Tue, Jun 13, 2017 at 6:22 PM, Tal Shorer <[email protected]> wrote:
> On Tue, Jun 13, 2017 at 7:02 PM, Tal Shorer <[email protected]> wrote:
>> On Tue, Jun 13, 2017 at 3:21 PM, Andrey Konovalov <[email protected]> wrote:
>>> Hi!
>>>
>>> I'm trying to use gadgetfs to fuzz USB device drivers by simply
>>> connecting random devices for now.
>>>
>>> What I want to achieve right now is the following:
>>>
>>> 1. mount gadgetfs
>>> 2. emulate connection of a new USB device
>>> 3. wait for the device to finish initializing
>>> 4. unmount gadgetfs
>>> 5. goto 1
>>>
>>> The question is how do I wait for the device to finish initializing
>>> (the corresponding USB driver to finish probing?) before unmounting
>>> gadgetfs? As I understand, when I write device description to
>>> "/dev/gadget/dummy_udc" the initialization happens asynchronously
>>> after writing is done.
>>>
>>
>> You can use inotify on the state file inside a udc's sysfs directory.
>> It's awesome like that.
>> Here's a sample code that doesn't do any cleanups because I'm lazy:
>> https://gist.github.com/talshorer/61be1bc3472cc2a7b4866b9bd5a239ca
> And I forgot usage >:
> ./wait_udc_configured /sys/devices/platform/dummy_udc.0/udc/dummy_udc.0/state
Hi Tal,
I will try this, thanks!