bc39b73969
schdbgd bridges TCP to the debugger, which is the one way in that does not
need you to be sitting at the machine. It is a bridge and nothing else: a line
in becomes a line written to /dev/dbgro and the answer comes back, so `nc` is a
complete client and there is no clever client to be broken on the day you need
this.
# schdbgd &
schdbgd: debugger on port 4444, loopback only
$ nc 127.0.0.1 4444
dma
arena 0xffff80003da41000-0xffff80003ea41000 16384 KB total, ...
A kernel debugger plus a TCP socket is a remote root hole, so three things were
decided rather than discovered:
- It does not start by itself. schdbgd.job ships Disabled. SchOS has no
kernel command line, so the boot flag the plan asked for is the job
manifest, which is the same thing in this system's own idiom.
- It binds loopback; -a names an address and says so in a paragraph.
- It cannot reach a view that changes state, enforced in the kernel.
That last one is /dev/dbgro: /dev/dbg on minor 1. The minor is the one piece of
per-open state a character device already sees, so which node you opened is the
permission -- nothing to latch, nothing to remember between the write and the
read, no way across. Which views are refused comes from dbg_register_rw() on
the registration itself, because a central list of dangerous views goes stale
in the direction where a new view is quietly treated as safe. Today that is
`watch <addr>`; `watch` with no argument is still the listing and still
answered.
Also: socket() now accepts IPPROTO_TCP with SOCK_STREAM and IPPROTO_UDP with
SOCK_DGRAM. They name the default rather than departing from it, and toybox's
nc writes them out -- so TCP was "Protocol not supported" on a system whose
whole network is TCP.
docs/plan/debugger.md retires into docs/architecture/debugging.md; 16 files
repointed. Every plan in docs/plan/ that was open is now closed, so the next
thing is Gate 0 itself: the survey, with the instrument built.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VQ7Qx8E1q1M1bbCq8QLHS2
128 lines
4 KiB
C
128 lines
4 KiB
C
#include "types.h"
|
|
#include "defs.h"
|
|
#include "param.h"
|
|
#include "spinlock.h"
|
|
#include "sleeplock.h"
|
|
#include "fs.h"
|
|
#include "file.h"
|
|
#include "x86.h"
|
|
#include "errno.h"
|
|
|
|
extern int consoleread(struct inode*, uint64, char*, int);
|
|
extern int consolewrite(struct inode*, uint64, char*, int);
|
|
extern int mouseread(struct inode*, uint64, char*, int);
|
|
|
|
static uint64 rseed = 0x2A99554433221100ULL;
|
|
|
|
int
|
|
nullwrite(struct inode *ip, uint64 off, char *dst, int n)
|
|
{
|
|
return n;
|
|
}
|
|
|
|
int
|
|
nullread(struct inode *ip, uint64 off, char *dst, int n)
|
|
{
|
|
return 0;
|
|
}
|
|
|
|
int
|
|
zeroread(struct inode *ip, uint64 off, char *dst, int n)
|
|
{
|
|
memset(dst, 0, n);
|
|
return n;
|
|
}
|
|
|
|
int
|
|
randomread(struct inode *ip, uint64 off, char *dst, int n)
|
|
{
|
|
for(int i = 0; i < n; i++){
|
|
rseed = rseed * 6364136223846793005ULL + 1442695040888963407ULL;
|
|
dst[i] = (rseed >> 32) & 0xFF;
|
|
}
|
|
return n;
|
|
}
|
|
|
|
// /dev/full — reads as an endless run of zero bytes, every write fails with
|
|
// ENOSPC. Programs use it to exercise their out-of-disk-space paths.
|
|
int
|
|
fullwrite(struct inode *ip, uint64 off, char *dst, int n)
|
|
{
|
|
return -ENOSPC;
|
|
}
|
|
|
|
int
|
|
mousewrite(struct inode *ip, uint64 off, char *dst, int n)
|
|
{
|
|
return n;
|
|
}
|
|
|
|
int
|
|
memread(struct inode *ip, uint64 off, char *dst, int n)
|
|
{
|
|
switch(ip->minor) {
|
|
case 1: return consoleread(ip, off, dst, n);
|
|
case 2: return nullread(ip, off, dst, n);
|
|
case 3: return consoleread(ip, off, dst, n);
|
|
/* 10 = /dev/tty, 11..16 = /dev/tty1..tty6. consoleread resolves the
|
|
minor to a terminal; see vt_for_minor(). */
|
|
case 10: case 11: case 12: case 13: case 14: case 15: case 16:
|
|
return consoleread(ip, off, dst, n);
|
|
case 5: return zeroread(ip, off, dst, n);
|
|
case 7: return zeroread(ip, off, dst, n); // /dev/full reads as zeros
|
|
case 8:
|
|
case 9: return randomread(ip, off, dst, n);
|
|
default: return -1;
|
|
}
|
|
}
|
|
|
|
int
|
|
memwrite(struct inode *ip, uint64 off, char *dst, int n)
|
|
{
|
|
switch(ip->minor) {
|
|
case 1: return consolewrite(ip, off, dst, n);
|
|
case 10: case 11: case 12: case 13: case 14: case 15: case 16:
|
|
return consolewrite(ip, off, dst, n);
|
|
case 7: return fullwrite(ip, off, dst, n); // /dev/full: always ENOSPC
|
|
case 2:
|
|
case 5:
|
|
case 8:
|
|
case 9: return nullwrite(ip, off, dst, n);
|
|
default: return -1;
|
|
}
|
|
}
|
|
|
|
struct devsw devsw[] = {
|
|
[0] = { 0, 0 },
|
|
[1] = { memread, memwrite },
|
|
// /dev/fb0 (major 2) — the framebuffer, kernel/dev/fb.c. This used to be
|
|
// { nullread, nullwrite }, so writing pixels to it succeeded and did
|
|
// nothing.
|
|
// The close hook gives the text console its screen back when whatever was
|
|
// drawing on the framebuffer exits — see fbclose().
|
|
[2] = { fbread, fbwrite, 0, fbclose },
|
|
[3] = { mouseread, mousewrite },
|
|
[4] = { 0, 0 },
|
|
// /dev/tty (major 5) — alias for the console
|
|
[5] = { memread, memwrite },
|
|
// /proc status files (major 6) — see kernel/dev/procfs.c
|
|
[6] = { procread, procwrite },
|
|
// /dev/input/eventN (major 7) — raw evdev events, kernel/dev/input.c. The
|
|
// minor is the device index, so event0 is the keyboard and event1 the mouse.
|
|
[7] = { inputread, inputwrite, inputready, inputclose, inputopen },
|
|
// /dev/hdN (major 8) — raw disks, kernel/dev/disk.c. The minor is the IDE
|
|
// device number. No `ready` hook: a disk is always ready, which is what
|
|
// fileread assumes when one is absent.
|
|
[8] = { diskread, diskwrite },
|
|
// /dev/pci (major 9) -- PCI devices reachable from userspace, for drivers
|
|
// that do not live in the kernel. Registers arrive through mmap and
|
|
// everything else through ioctl; see include/pciuser.h.
|
|
[9] = { pciuser_read, pciuser_write },
|
|
// /dev/dbg (major 10) -- ask the kernel a question. Write a line, read the
|
|
// answer; see include/dbg.h and docs/architecture/debugging.md.
|
|
[10] = { dbg_read, dbg_write },
|
|
// /dev/netdev (major 11) -- a process, being a network interface. The
|
|
// reverse of major 9: that hands a device to a process, this lets a process
|
|
// be one. See include/netuser.h.
|
|
[11] = { netuser_read, netuser_write, netuser_ready },
|
|
};
|