debugger: who owns this page, and who just wrote to it
docs/plan/debugger.md D3 and D4, which finish the plan apart from the
network transport.
D3 -- `whose <addr>`. The views each speak for one subsystem, which is what
keeps them cheap and current, and it is exactly why none of them can see
the bug that matters: a page on the DMA arena's free list looks fine from
dma.c, the same page on kalloc's free list looks fine from kalloc.c, and
that it is on both is a fact no single subsystem holds.
# schdbg whose 0x3e239000
phys 0x000000003e239000 kernel va 0xffff80003e239000
dma arena, handed out
pcidma slot 2, 0 KB into a 4000 KB block given to pid 4 (vgpud)
mapped pid 4 (vgpud) at 0x000000004000d000 rwu vma[5] no_free
consistent: 1 owner, 1 mapping(s)
Claimants register the way views do -- one line in the file that owns the
data -- so the kernel image, the log region, the arena, the page allocator,
the pciuser DMA blocks and every page table each answer for themselves.
`mapped` is the one no allocator can answer: there is no reverse map, so
vm_walk_user() goes forward over every mapped page of every live process.
Two verdicts are shouted and everything else is reported as fact. More than
one owner means the second allocator to hand the page out is handing out
memory the first is still using -- the H2 bug, which would have printed as
three lines. Free-but-still-mapped means a page will be given away from
under the page tables that point at it. Deliberately *not* a finding: no
owner at all, because kalloc keeps a free list and no record of what it has
handed out, so an ordinary allocated page has nobody to speak for it and
saying otherwise would be the query crying wolf.
D4 -- watchpoints, on the four debug registers that had been sitting unused
since this kernel was written. Armed against the same framebuffer page and
then killing the driver:
watch 0: 0xffff80003e239000 written, 8 byte(s), by stosq+0x1f, pid 12 vgpud
#0 memset+0xba
#1 dma_alloc+0x2e2
#2 do_dma+0x22a
#3 pciuser_ioctl+0x13b
#4 sys_ioctl+0x3c7
#5 syscall+0xf6
The chain is the answer, not the rip. It reports and continues -- a data
watchpoint is a trap, delivered after the store completes, so returning
carries on with the program none the wiser, which is what lets this be used
on a machine that is still running.
Debug registers are per-CPU and there is no general IPI here, so the table
carries a generation number and each CPU reloads from its timer interrupt
when it notices the number has moved: one comparison per tick, one tick of
latency at worst. `watch` prints which CPUs have caught up, because "this
watchpoint is watching" and "this watchpoint is watching one CPU" must not
look the same.
Also fixed while testing: watch_init() was called from mpmain(), which runs
on every processor, so the command appeared in the list once per CPU.
dbg_register() now refuses a duplicate name outright, so the next init that
runs per-CPU fails loudly in the list rather than quietly doubling it.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VQ7Qx8E1q1M1bbCq8QLHS2
This commit is contained in:
Nexoniarz
parent
1dd4ba0186
commit
113595f80b
17 changed files with 1067 additions and 19 deletions
170
kernel/dev/dbg.c
170
kernel/dev/dbg.c
|
|
@ -26,6 +26,8 @@
|
|||
#include "file.h"
|
||||
#include "errno.h"
|
||||
#include "sbuf.h"
|
||||
#include "memlayout.h"
|
||||
#include "mmu.h"
|
||||
#include "dbg.h"
|
||||
|
||||
#define NVIEW 24
|
||||
|
|
@ -40,6 +42,15 @@ struct view {
|
|||
static struct view views[NVIEW];
|
||||
static int nview;
|
||||
|
||||
struct claimant {
|
||||
const char *name;
|
||||
dbg_whose_fn fn;
|
||||
};
|
||||
static struct claimant claimants[NVIEW];
|
||||
static int nclaim;
|
||||
|
||||
static int streq(const char *a, const char *b);
|
||||
|
||||
// Static, and 16 KB of it. A view of every process on a 64-slot table is the
|
||||
// largest thing here and comes to a few kilobytes; the alternative -- kalloc
|
||||
// on every read -- would put an allocation on the path of the tool you reach
|
||||
|
|
@ -54,12 +65,31 @@ dbg_register(const char *name, dbg_view_fn fn, const char *what)
|
|||
{
|
||||
if (nview >= NVIEW || !name || !fn)
|
||||
return;
|
||||
// Registering the same name twice is a bug in the caller -- it means an init
|
||||
// that runs once per CPU, which is how `watch` first appeared in the list
|
||||
// twice. Refusing keeps the list honest whoever makes that mistake next.
|
||||
for (int i = 0; i < nview; i++)
|
||||
if (streq(views[i].name, name))
|
||||
return;
|
||||
views[nview].name = name;
|
||||
views[nview].fn = fn;
|
||||
views[nview].what = what ? what : "";
|
||||
nview++;
|
||||
}
|
||||
|
||||
void
|
||||
dbg_register_whose(const char *name, dbg_whose_fn fn)
|
||||
{
|
||||
if (nclaim >= NVIEW || !name || !fn)
|
||||
return;
|
||||
for (int i = 0; i < nclaim; i++)
|
||||
if (streq(claimants[i].name, name))
|
||||
return;
|
||||
claimants[nclaim].name = name;
|
||||
claimants[nclaim].fn = fn;
|
||||
nclaim++;
|
||||
}
|
||||
|
||||
static int
|
||||
streq(const char *a, const char *b)
|
||||
{
|
||||
|
|
@ -77,8 +107,140 @@ do_help(struct sbuf *out)
|
|||
sb_puts(out, views[i].what);
|
||||
sb_putc(out, '\n');
|
||||
}
|
||||
sb_puts(out, "\n all every view above\n");
|
||||
sb_puts(out, " help this\n");
|
||||
sb_puts(out, "\n whose <addr> every subsystem's claim on one page\n");
|
||||
sb_puts(out, " all every view above\n");
|
||||
sb_puts(out, " help this\n");
|
||||
}
|
||||
|
||||
// "0x3eceb000", or "3eceb000", or a decimal. Returns 0 if there was no number.
|
||||
static int
|
||||
parse_addr(const char *s, uint64 *out)
|
||||
{
|
||||
uint64 v = 0;
|
||||
int any = 0, hex = 0;
|
||||
|
||||
while (*s == ' ')
|
||||
s++;
|
||||
if (s[0] == '0' && (s[1] == 'x' || s[1] == 'X')) { hex = 1; s += 2; }
|
||||
|
||||
// A bare string of hex digits is taken as hex: every address in this
|
||||
// kernel's own output is printed without the 0x, and retyping one and
|
||||
// getting a decimal reading of it would be a trap.
|
||||
if (!hex) {
|
||||
const char *p = s;
|
||||
while (*p) {
|
||||
if ((*p >= 'a' && *p <= 'f') || (*p >= 'A' && *p <= 'F')) { hex = 1; break; }
|
||||
if (!(*p >= '0' && *p <= '9')) break;
|
||||
p++;
|
||||
}
|
||||
if (!hex) {
|
||||
// All decimal digits, but an address that long is hex in practice.
|
||||
int n = 0;
|
||||
const char *q = s;
|
||||
while (*q >= '0' && *q <= '9') { n++; q++; }
|
||||
if (n > 10) hex = 1;
|
||||
}
|
||||
}
|
||||
|
||||
while (*s) {
|
||||
int d;
|
||||
if (*s >= '0' && *s <= '9') d = *s - '0';
|
||||
else if (*s >= 'a' && *s <= 'f') d = *s - 'a' + 10;
|
||||
else if (*s >= 'A' && *s <= 'F') d = *s - 'A' + 10;
|
||||
else break;
|
||||
if (!hex && d > 9)
|
||||
break;
|
||||
v = hex ? (v << 4) + d : v * 10 + d;
|
||||
any = 1;
|
||||
s++;
|
||||
}
|
||||
|
||||
*out = v;
|
||||
return any;
|
||||
}
|
||||
|
||||
static void
|
||||
do_whose(struct sbuf *out, const char *arg)
|
||||
{
|
||||
struct whose w;
|
||||
uint64 addr, kva;
|
||||
|
||||
if (!parse_addr(arg, &addr)) {
|
||||
sb_puts(out, "whose <addr> -- a physical address, or a kernel virtual one\n");
|
||||
return;
|
||||
}
|
||||
|
||||
// Which kind of address is it? Anything at or above KERNBASE is a kernel
|
||||
// virtual address and is translated; anything below is taken as physical.
|
||||
//
|
||||
// A *user* virtual address cannot be resolved here and is not guessed at:
|
||||
// it means nothing without saying which address space, and answering for
|
||||
// whichever one happens to be current would be wrong in a way that looks
|
||||
// right. `vma <pid>` is the view for that question.
|
||||
if (addr >= (uint64)KERNBASE) {
|
||||
kva = addr;
|
||||
addr = addr - (uint64)KERNBASE;
|
||||
} else {
|
||||
kva = addr + (uint64)KERNBASE;
|
||||
}
|
||||
|
||||
w.phys = addr & ~(uint64)(PGSIZE - 1);
|
||||
w.off = addr & (PGSIZE - 1);
|
||||
w.owners = 0;
|
||||
w.free_owners = 0;
|
||||
w.mappings = 0;
|
||||
|
||||
sb_puts(out, "phys 0x");
|
||||
sb_puthex(out, w.phys, 16);
|
||||
if (w.off) {
|
||||
sb_puts(out, " + 0x");
|
||||
sb_puthex(out, w.off, 3);
|
||||
}
|
||||
sb_puts(out, " kernel va 0x");
|
||||
sb_puthex(out, (kva & ~(uint64)(PGSIZE - 1)), 16);
|
||||
sb_putc(out, '\n');
|
||||
|
||||
if (w.phys >= (uint64)PHYSTOP)
|
||||
sb_puts(out, " (above PHYSTOP -- this is not RAM this kernel manages)\n");
|
||||
|
||||
for (int i = 0; i < nclaim; i++)
|
||||
claimants[i].fn(out, &w);
|
||||
|
||||
// The verdict. Two shapes of wrong are worth naming, because both are
|
||||
// silent everywhere else and both corrupt memory some distance away.
|
||||
sb_putc(out, '\n');
|
||||
if (w.owners == 0 && w.mappings == 0) {
|
||||
sb_puts(out, " nobody claims this page\n");
|
||||
} else if (w.owners > 1) {
|
||||
sb_puts(out, " *** ");
|
||||
sb_putu(out, w.owners);
|
||||
sb_puts(out, " owners -- this page is claimed more than once, and whichever\n"
|
||||
" allocator hands it out second will be handing out memory\n"
|
||||
" the first one is still using\n");
|
||||
} else if (w.free_owners > 0 && w.mappings > 0) {
|
||||
sb_puts(out, " *** its allocator believes this page is free, and ");
|
||||
sb_putu(out, w.mappings);
|
||||
sb_puts(out, " page table(s)\n"
|
||||
" still map it -- it will be handed out from under them\n");
|
||||
} else if (w.owners == 0) {
|
||||
// Not a finding. kalloc keeps a free list and no record of what it has
|
||||
// handed out, so a page in use by the kernel and a page genuinely lost
|
||||
// look the same from here -- and saying "nobody owns this" about an
|
||||
// ordinary allocated page would be the query crying wolf.
|
||||
sb_puts(out, " no allocator has a record of this page, which is what an\n"
|
||||
" allocated one looks like: kalloc tracks only what is free.\n");
|
||||
if (w.mappings) {
|
||||
sb_puts(out, " ");
|
||||
sb_putu(out, w.mappings);
|
||||
sb_puts(out, " page table(s) map it, so it is in use.\n");
|
||||
}
|
||||
} else {
|
||||
sb_puts(out, " consistent: ");
|
||||
sb_putu(out, w.owners);
|
||||
sb_puts(out, " owner, ");
|
||||
sb_putu(out, w.mappings);
|
||||
sb_puts(out, " mapping(s)\n");
|
||||
}
|
||||
}
|
||||
|
||||
static void
|
||||
|
|
@ -122,6 +284,10 @@ dbg_command(const char *line, struct sbuf *out)
|
|||
do_all(out);
|
||||
return out->len;
|
||||
}
|
||||
if (streq(word, "whose")) {
|
||||
do_whose(out, arg);
|
||||
return out->len;
|
||||
}
|
||||
|
||||
for (int i = 0; i < nview; i++) {
|
||||
if (streq(word, views[i].name)) {
|
||||
|
|
|
|||
|
|
@ -107,6 +107,37 @@ pciuser_owner_pid(int idx)
|
|||
return pid;
|
||||
}
|
||||
|
||||
// A DMA block handed to a userspace driver.
|
||||
//
|
||||
// Informational rather than an ownership claim: the arena is the owner and
|
||||
// says so separately. What this adds is *which driver was given it*, which is
|
||||
// the question you actually have when a page turns up somewhere unexpected.
|
||||
static void
|
||||
pciuser_whose(struct sbuf *out, struct whose *w)
|
||||
{
|
||||
acquire(&pciuser_lock);
|
||||
for (int i = 0; i < PCIUSER_MAXDMA; i++) {
|
||||
addr_t base;
|
||||
if (!dmablk[i].proc)
|
||||
continue;
|
||||
base = dma_phys(dmablk[i].kva);
|
||||
if (w->phys < base || w->phys >= base + dmablk[i].size)
|
||||
continue;
|
||||
sb_puts(out, " pcidma slot ");
|
||||
sb_putu(out, i);
|
||||
sb_puts(out, ", ");
|
||||
sb_putu(out, (w->phys - base) / 1024);
|
||||
sb_puts(out, " KB into a ");
|
||||
sb_putu(out, dmablk[i].size / 1024);
|
||||
sb_puts(out, " KB block given to pid ");
|
||||
sb_putu(out, dmablk[i].proc->pid);
|
||||
sb_puts(out, " (");
|
||||
sb_puts(out, dmablk[i].proc->name);
|
||||
sb_puts(out, ")\n");
|
||||
}
|
||||
release(&pciuser_lock);
|
||||
}
|
||||
|
||||
// Who is holding what, and what memory they were given for it.
|
||||
//
|
||||
// The three things that go wrong with a userspace driver are all here: a
|
||||
|
|
@ -207,6 +238,7 @@ pciuser_init(void)
|
|||
initlock(&pciuser_lock, "pciuser");
|
||||
dbg_register("claims", pciuser_dump,
|
||||
"devices, DMA and interrupts held by userspace drivers");
|
||||
dbg_register_whose("pcidma", pciuser_whose);
|
||||
}
|
||||
|
||||
// Does `phys` fall inside a memory BAR of a device this process has claimed?
|
||||
|
|
|
|||
Loading…
Reference in a new issue