daniel/danos
1
0
Fork 0
Code Issues 4 Pull Requests Actions Packages Projects 1 Releases Wiki Activity

volume-manager: harden the probe and supervision from the V3 review

Browse Source 
Five confirmed defects from the boundary review:

1. (security) The VM never checked a partition fit inside the device, so a
   crafted MBR could hand the driver a range whose base+lba wraps past a u32
   — panicking usb-storage in a loop, and at multi-volume overlapping a
   neighbour. This is the exact invariant the clamp's overflow-safety rests
   on. partition.firstVolume now skips any entry that runs past the device
   (host-tested), establishing the invariant where the untrusted bytes are
   first read.
2. (leak) The probe re-acquired a fresh block channel on every 500 ms retry,
   leaking a handle each time on a medium-absent device. The channel is now
   acquired once and kept.
3. (wedge) A failed spawn or defineRange stranded the volume with no retry;
   both now arm a backoff restart.
4. (loop) fat respawn had no exit-reason gate, no backoff, no crash-loop cap
   — a faulting filesystem respawned in a zero-delay loop, and a clean exit
   was resurrected. Supervision now mirrors the device manager: a clean exit
   is not restarted, a fault backs off, three fast deaths give up.
5. (removable) A device that parsed to no volume was terminal; it now keeps
   polling so an inserted medium is picked up — the removal-lifecycle trigger.

Known limitation (noted, not fixed here): if the VM itself crashes and init
restarts it, the orphaned fat keeps serving vfs while the new VM spawns a
second fat whose bind is refused — the same "manager restart re-learns the
world" gap the device manager also defers. The old fat keeps storage working.

Neutral: partition unit tests + fat-mount, volume-probe, block-range, logger
all green.
This commit is contained in:
Daniel Samson
2026-08-09 18:50:01 +01:00
parent a67a7015bf
commit 7c6ed2ca09
2 changed files with 97 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
system/services/volume-manager/volume-manager.zig
+73 -14
View File
@@ -56,8 +56,25 @@ var bounce: memory.DmaRegion = undefined;
var bounce_ready = false;
var probed = false;
var volume: ?Volume = null;
/// The storage channel, acquired ONCE and kept — re-acquiring on every probe
/// retry would leak a handle per attempt on a medium-absent device.
var storage_device: ?block.Device = null;
var logged_no_volume = false;
const probe_retry_ms = 500;
// Filesystem supervision, mirroring the device manager's (device-manager.zig):
// a clean exit is not restarted, a fault restarts with backoff, and a fast
// crash loop gives up rather than spinning. Without this a faulting filesystem
// respawns in a zero-delay loop.
const fast_death_ns: u64 = 2_000_000_000;
const crash_loop_cap: u32 = 3;
const backoff_base_ms: u64 = 300;
var fs_restarts: u32 = 0;
var fs_spawn_ns: u64 = 0;
var fs_failed = false;
/// Set when a backoff timer is pending so its tick respawns rather than probes.
var restart_pending = false;
fn acquireStorage() ?block.Device {
const manager = manager_handle orelse opened: {
const handle = channel.openEndpoint("device-manager") orelse return null;
@@ -94,26 +111,45 @@ fn acquireStorage() ?block.Device {
/// runs, so its first read is already bounded; the volume manager is the
/// confinement controller (it defines the first range on the device).
fn spawnFilesystem(v: *Volume) void {
if (fs_failed) return;
const pid = process.spawnSupervised(filesystem_binary, &.{"1"}, service_endpoint) orelse {
_ = logging.write("volume-manager: could not spawn the filesystem\n");
_ = logging.write("volume-manager: could not spawn the filesystem; retrying\n");
armRestart();
return;
};
if (!v.storage.defineRange(pid, v.base_lba, v.block_count)) {
_ = logging.write("volume-manager: could not confine the filesystem to its volume\n");
_ = logging.write("volume-manager: could not confine the filesystem to its volume; retrying\n");
_ = process.kill(pid);
armRestart();
return;
}
v.filesystem_pid = pid;
fs_spawn_ns = time.clock();
std.log.info("volume 0x{x} -> {s} (pid {d}), lba {d}, {d} blocks", .{ v.identity, filesystem_binary, pid, v.base_lba, v.block_count });
}
/// Arm a one-shot timer to (re)spawn the filesystem after backoff — used both
/// when a spawn step fails and when a running filesystem faults. Distinguished
/// from the probe timer by `restart_pending`.
fn armRestart() void {
const delay = if (fs_restarts == 0) backoff_base_ms else backoff_base_ms << @intCast(@min(fs_restarts - 1, 5));
restart_pending = true;
_ = time.timerOnce(service_endpoint, delay);
}
fn tryProbe() void {
if (probed) return;
if (!bounce_ready) {
bounce = memory.dmaAlloc(512, memory.dma_coherent | memory.dma_shareable) orelse return;
bounce_ready = true;
}
const device = acquireStorage() orelse return;
// Acquire the storage channel once and keep it: a fresh consumer-hello per
// retry would leak a handle every 500 ms on a device whose medium is absent.
const device = storage_device orelse acquired: {
const d = acquireStorage() orelse return;
storage_device = d;
break :acquired d;
};
if (bounce.handle) |handle| {
if (!device.attach(handle)) return;
_ = ipc.close(handle);
@@ -123,8 +159,13 @@ fn tryProbe() void {
if (!device.read(0, 1, bounce.physical)) return;
const sector: [*]const u8 = @ptrFromInt(bounce.virtual);
const found = partition.firstVolume(sector[0..512], geometry.block_count) orelse {
_ = logging.write("volume-manager: no volume found on the storage device\n");
probed = true;
// No volume yet. On removable media this can mean no medium is present —
// keep polling so an inserted medium is picked up (the removal-lifecycle
// trigger). Log once, and do NOT terminate the probe.
if (!logged_no_volume) {
_ = logging.write("volume-manager: no volume on the storage device yet\n");
logged_no_volume = true;
}
return;
};
volume = .{ .storage = device, .base_lba = found.base_lba, .block_count = found.block_count, .identity = found.identity, .id = volume_id };
@@ -169,22 +210,40 @@ fn initialise(endpoint: ipc.Handle) bool {
fn onNotification(badge: u64) void {
const got = ipc.Received{ .len = 0, .badge = badge, .cap = null };
if (got.isTimer()) {
// One timer signal, two jobs, told apart by state: a pending backoff
// restart, otherwise the probe retry.
if (restart_pending) {
restart_pending = false;
if (volume) |*v| spawnFilesystem(v);
return;
}
tryProbe();
if (!probed) _ = time.timerOnce(service_endpoint, probe_retry_ms);
return;
}
// A filesystem died. Its old range is reclaimed by the driver on the same
// death; respawn it, confined afresh to the same volume (a fresh pid, a
// fresh range). The reap-and-rebuild the device manager proved, one layer up.
// A filesystem died. The exit reason drives the decision, exactly as the
// device manager supervises drivers: a clean exit meant to stop; a fault
// restarts with backoff until a fast crash loop gives up. The old range is
// reclaimed by the driver on the same death; the respawn confines afresh.
if (got.isChildExit()) {
const dead = got.childProcessId();
if (volume) |*v| {
if (v.filesystem_pid == dead) {
v.filesystem_pid = 0;
std.log.info("filesystem for volume {d} died; respawning", .{v.id});
spawnFilesystem(v);
}
const v = &(volume orelse return);
if (v.filesystem_pid != dead) return;
v.filesystem_pid = 0;
const reason = process.exitReason(dead) orelse .fault;
if (reason == .exited) {
std.log.info("filesystem for volume {d} exited cleanly; not restarting", .{v.id});
return;
}
const alive = time.clock() -| fs_spawn_ns;
fs_restarts = if (alive < fast_death_ns) fs_restarts + 1 else 1;
if (fs_restarts >= crash_loop_cap) {
fs_failed = true;
std.log.info("filesystem for volume {d} is failing repeatedly; giving up", .{v.id});
return;
}
std.log.info("filesystem for volume {d} died ({s}); restarting", .{ v.id, @tagName(reason) });
armRestart();
}
}