From owner-freebsd-current@FreeBSD.ORG  Wed Jul 18 21:27:44 2012
Return-Path: <owner-freebsd-current@FreeBSD.ORG>
Delivered-To: freebsd-current@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id 149A4106564A;
	Wed, 18 Jul 2012 21:27:44 +0000 (UTC)
	(envelope-from hselasky@c2i.net)
Received: from swip.net (mailfe09.c2i.net [212.247.155.2])
	by mx1.freebsd.org (Postfix) with ESMTP id 624D88FC08;
	Wed, 18 Jul 2012 21:27:43 +0000 (UTC)
X-T2-Spam-Status: No, hits=-0.2 required=5.0 tests=ALL_TRUSTED,
	BAYES_50
Received: from [84.49.175.101] (account mc467741@c2i.net HELO
	laptop015.hselasky.homeunix.org)
	by mailfe09.swip.net (CommuniGate Pro SMTP 5.4.4)
	with ESMTPA id 124478146; Wed, 18 Jul 2012 23:22:35 +0200
From: Hans Petter Selasky <hselasky@c2i.net>
To: freebsd-multimedia@freebsd.org
Date: Wed, 18 Jul 2012 23:22:50 +0200
User-Agent: KMail/1.13.7 (FreeBSD/9.0-STABLE; KDE/4.7.4; amd64; ; )
X-Face: 'mmZ:T{)),Oru^0c+/}w'`gU1$ubmG?lp!=R4Wy\ELYo2)@'UZ24N@d2+AyewRX}mAm; Yp
	|U[@, _z/([?1bCfM{_"B<.J>mICJCHAzzGHI{y7{%JVz%R~yJHIji`y>Y}k1C4TfysrsUI
	-%GU9V5]iUZF&nRn9mJ'?&>O
MIME-Version: 1.0
Content-Type: Text/Plain;
  charset="us-ascii"
Content-Transfer-Encoding: 7bit
Message-Id: <201207182322.50655.hselasky@c2i.net>
Cc: freebsd-current@freebsd.org
Subject: IPod crash seen with FreeBSD only
X-BeenThere: freebsd-current@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: Discussions about the use of FreeBSD-current
	<freebsd-current.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-current>, 
	<mailto:freebsd-current-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-current>
List-Post: <mailto:freebsd-current@freebsd.org>
List-Help: <mailto:freebsd-current-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-current>,
	<mailto:freebsd-current-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Wed, 18 Jul 2012 21:27:44 -0000

Hi,

I have one of those locked down silvery IPod's, and wanted to try out gnupod 
to get some MP3's transferred to the device. I made it once, but then my luck 
ended :-) Anyway I found what looks like a remote crash vulnerability in the 
IPod firmware. How to make it crash:

1) Plug USB cable and wait for /dev/daX device to appear.
2) mount -t msdosfs /dev/daX /mnt
3) rm -rf /mnt/*
4) umount /mnt
5) Now unplug the USB cable and wait for the device to boot into menu mode. 
Don't press any keys.
6) Then plug the USB cable again into the PC/Lapop running FreeBSD 8/9.

7) Observation: The device goes into an infinite reboot loop until the USB 
cable is unplugged.

8) How to recover your device:
9) Add this quirk:

usbconfig add_dev_quirk_vplh 0x05ac 0x1262 0 65535 UQ_MSC_NO_SYNC_CACHE
                             ^^ vendor ^^ product

Please write down the iProduct and iVendor before testing this, else you will 
have to plug your device into a Linux/Mac box to get it back. You can do this 
by running the following command before executing any of the steps above:

usbconfig -d X.Y dump_device_desc

10) Plug your device.
11) /dev/daX should appear again :-) Puuuuhhh :-)

This is the dmesg you see when the device is crashing.

usbd_req_re_enumerate: addr=3, set address failed! (USB_ERR_STALLED, ignored)
usbd_req_re_enumerate: addr=3, set address failed! (USB_ERR_STALLED, ignored)
usb_alloc_device: Failure selecting configuration index 0:USB_ERR_STALLED, 
port 2, addr 3 (ignored)
ugen7.3: <Apple Inc.> at usbus7
ugen7.3: <Apple Inc.> at usbus7 (disconnected)

If Apple could explain this, would be great! I believe some Apple people are 
hanging around on these lists :-)

--HPS

BTW: Does anyone have any howtos regarding using more recent ipod devices with 
FreeBSD ? Or Does anyone know how to get the old ones with more flash maybe, 
which can run rockbox ?