Daniel Samson
5dc966838a
The V4 review's open edge: a storage driver that crashes while its device stays in the tree left fat wedged on a dead channel — device-presence polling (a device-manager enumerate) still reported the device present, so nothing reaped it. pollTick now also probes channelAlive(dev), a geometry() on the block channel that fails fast on the dead endpoint; a present device with a dead channel is reaped like a pull, and the adopt loop re-adopts it on the restarted driver's fresh channel — the rebuild. The manager's own liveness probe makes fat self-detection unnecessary: it rebuilds regardless of the wedged filesystem's state. The drill: the device manager gains a test-storage-restart mode that kills usb-storage once, ~2s after its hello (post-mount); a new volume-driver-restart kernel case boots a manual tree with it, and the QEMU case asserts a SECOND mount of the same id-path after the reap — the rebuild. A pre-S5 manager, checking only device presence, never reaps, so the second mount never appears. The manually-spawned volume manager needed kernel-supervisor protocol grants (bind its name, open the device manager), as the other manual-tree services already have. Full suite 133/133.
13 KiB
13 KiB
| 1 | # /system/configuration/protocol.csv — who may claim, and who may reach, a name |
|---|---|
| 2 | # under /protocol (docs/os-development/protocol-namespace.md). |
| 3 | # |
| 4 | # init is the registrar: it serves /protocol, and every bind AND every open is |
| 5 | # checked against this file. It is AUTHORITATIVE — a name no row grants cannot be |
| 6 | # bound or reached, and a missing file means nothing may be bound or reached at |
| 7 | # all. |
| 8 | # |
| 9 | # A refused open is answered exactly as a name nobody bound is: -ENOENT, and no |
| 10 | # capability. That is not politeness, it is the model — the namespace IS the |
| 11 | # restriction, so what a process may not open simply does not exist for it, and |
| 12 | # Which is why a missing row here shows up as a client retrying forever rather |
| 13 | # than as an error: check this file first, and `readdir /protocol` second. |
| 14 | # |
| 15 | # '#' starts a comment (whole-line or trailing); blank lines are ignored. |
| 16 | # Whitespace around a field is trimmed, so columns may be padded. Four |
| 17 | # comma-separated fields per row: |
| 18 | # |
| 19 | # binary the claimant's binary path, exactly as the kernel stamped it at |
| 20 | # spawn (argv[0]) — unforgeable, read from the process records |
| 21 | # supervisor the authorized supervising TASK, written as the binary it runs — |
| 22 | # the path init was started as for its own services, the device |
| 23 | # manager's path for the drivers it starts. The one word that is not |
| 24 | # a path is 'kernel', because a kernel task has no binary; that is |
| 25 | # what the test harness's direct spawns look like. |
| 26 | # Matched by IDENTITY, not by spelling. Name alone is not identity — |
| 27 | # spawn is ungated, so a hostile process can start a granted binary |
| 28 | # itself and inherit its grants; and it can equally start its own |
| 29 | # instance of the *supervisor's* binary and have that spawn the |
| 30 | # granted one, at which point both names read correctly (the |
| 31 | # laundering deputy). So init also asks which task the supervisor |
| 32 | # is: 'kernel' means supervisor id 0, which only the kernel can |
| 33 | # confer; init's own path means this init; any other path means a |
| 34 | # task init spawned itself or one the kernel spawned. Task ids are |
| 35 | # monotonic and never reused, so an id cannot be borrowed. |
| 36 | # permission bind (provide this contract) | open (speak to it) | |
| 37 | # supervise (stand in someone else's chain — see below) |
| 38 | # name the contract, relative to /protocol |
| 39 | # |
| 40 | # A trailing '*' on any field matches any tail — how a subtree is granted whole. |
| 41 | # |
| 42 | # 'supervise' exists because attestation is one hop deep and the driver tree is |
| 43 | # three: the device manager starts the PS/2 bus, and the bus starts the keyboard |
| 44 | # and mouse drivers. Init never met the bus, so it cannot vouch for it by |
| 45 | # acquaintance — and it must not vouch for it by name, or the laundering deputy |
| 46 | # walks straight in. A 'supervise' row is the manifest saying it: a task running |
| 47 | # this binary, under this supervisor, may be the supervising task an 'open' row |
| 48 | # names, for this contract and no other. It grants the delegate nothing itself, |
| 49 | # and it is deliberately open-only — a delegate may vouch for what its children |
| 50 | # REACH, never for what they CLAIM, so every bind refusal is untouched by it. |
| 51 | # |
| 52 | # binary supervisor permission name |
| 53 | # --- the services init spawns from init.csv --------------------------------- |
| 54 | /system/services/input, /system/services/init, bind, input |
| 55 | /system/services/device-manager, /system/services/init, bind, device-manager |
| 56 | /system/services/volume-manager, /system/services/init, bind, volume-manager |
| 57 | # fat is spawned and supervised by the volume manager now, not init — the volume |
| 58 | # manager confines it to its partition and hands it the block channel. |
| 59 | /system/services/fat, /system/services/volume-manager, bind, vfs |
| 60 | /system/services/display, /system/services/init, bind, display |
| 61 | # The discovery service ships under one neutral name per firmware (docs/discovery.md); |
| 62 | # on x86 it is the acpi service, and what it provides is the power contract. |
| 63 | /system/services/discovery, /system/services/device-manager, bind, power |
| 64 | # --- the drivers, which the device manager spawns --------------------------- |
| 65 | # usb-transfer and block have NO bind rows: several processes provide each (one |
| 66 | # per controller, one per volume), so neither is ever a registry name — |
| 67 | # consumers get their provider's channel from the device manager's hello, |
| 68 | /system/drivers/ps2-bus, /system/services/device-manager, bind, ps2-bus |
| 69 | /system/drivers/virtio-gpu, /system/services/device-manager, bind, scanout |
| 70 | # --- the same providers when the kernel test harness starts them directly --- |
| 71 | # A scenario boot spawns its own providers instead of letting init do it |
| 72 | # (docs/security-track-plan.md, decision 9), so the same binaries appear with |
| 73 | # 'kernel' as the supervisor. Nothing else changes: the binary must still match. |
| 74 | /system/services/input, kernel, bind, input |
| 75 | /system/services/device-manager, kernel, bind, device-manager |
| 76 | /system/services/volume-manager, kernel, bind, volume-manager |
| 77 | /system/services/fat, kernel, bind, vfs |
| 78 | /system/services/display, kernel, bind, display |
| 79 | /system/services/discovery, kernel, bind, power |
| 80 | # --- test fixtures ---------------------------------------------------------- |
| 81 | # The subtree rule, dogfooded: anything installed under /test may claim anything |
| 82 | # under /protocol/test, and nothing above it — whether the harness spawned it or |
| 83 | # another fixture did. |
| 84 | /test/*, kernel, bind, test/* |
| 85 | /test/*, /test/*, bind, test/* |
| 86 | # ============================================================================ |
| 87 | # open — who may REACH each contract. One row per client per contract; a client |
| 88 | # with no row here simply finds the name absent, forever. |
| 89 | # ============================================================================ |
| 90 | # --- init's own services ---------------------------------------------------- |
| 91 | # fat reaches the volume manager to be handed its volume's block channel |
| 92 | # (range-confined); the compositor reaches the scanout its driver announced, its |
| 93 | # own endpoint (the mouse-listener thread opens /protocol/display like any other |
| 94 | # client — threads share no handles), and the input stream that moves the cursor. |
| 95 | /system/services/fat, /system/services/volume-manager, open, volume-manager |
| 96 | # exfat reaches the volume manager the same way — the second engine, same lineage. |
| 97 | /system/services/exfat, /system/services/volume-manager, open, volume-manager |
| 98 | # The volume manager reaches the device manager to be routed to each storage |
| 99 | # provider's block channel, then confines a filesystem to each volume. |
| 100 | /system/services/volume-manager, /system/services/init, open, device-manager |
| 101 | # ...and again under the kernel supervisor for the manual-tree drills (S5's |
| 102 | # volume-driver-restart spawns the volume manager directly, not via init). |
| 103 | /system/services/volume-manager, kernel, open, device-manager |
| 104 | /system/services/display, /system/services/init, open, scanout |
| 105 | /system/services/display, /system/services/init, open, display |
| 106 | /system/services/display, /system/services/init, open, input |
| 107 | /system/services/display-demo, /system/services/init, open, display |
| 108 | # --- the same two when the kernel test harness starts them directly --------- |
| 109 | /system/services/display, kernel, open, scanout |
| 110 | /system/services/display, kernel, open, display |
| 111 | /system/services/display, kernel, open, input |
| 112 | /system/services/display-demo, kernel, open, display |
| 113 | # --- the drivers, and the discovery service --------------------------------- |
| 114 | # Every driver says hello to the manager that started it — one row for the whole |
| 115 | # subtree, because that handshake is what being a driver means. The rest are per |
| 116 | # driver: the storage and HID class drivers talk to their controller, the HID |
| 117 | # drivers publish into the input stream, and the GPU driver announces its scanout |
| 118 | # to the compositor. |
| 119 | /system/drivers/*, /system/services/device-manager, open, device-manager |
| 120 | /system/services/discovery, /system/services/device-manager, open, device-manager |
| 121 | /system/drivers/usb-hid-keyboard, /system/services/device-manager, open, input |
| 122 | /system/drivers/usb-hid-mouse, /system/services/device-manager, open, input |
| 123 | /system/drivers/virtio-gpu, /system/services/device-manager, open, display |
| 124 | # --- the PS/2 child drivers, one hop further down --------------------------- |
| 125 | # The keyboard and mouse drivers are started by the BUS driver, not by the |
| 126 | # device manager — the one three-deep chain in the tree. Init cannot vouch for |
| 127 | # the bus by acquaintance (it never started it), so the manifest authorizes it |
| 128 | # explicitly, and only for the two contracts its children need. |
| 129 | /system/drivers/ps2-bus, /system/services/device-manager, supervise, ps2-bus |
| 130 | /system/drivers/ps2-bus, /system/services/device-manager, supervise, input |
| 131 | /system/drivers/ps2-keyboard, /system/drivers/ps2-bus, open, ps2-bus |
| 132 | /system/drivers/ps2-keyboard, /system/drivers/ps2-bus, open, input |
| 133 | /system/drivers/ps2-mouse, /system/drivers/ps2-bus, open, ps2-bus |
| 134 | /system/drivers/ps2-mouse, /system/drivers/ps2-bus, open, input |
| 135 | # --- test fixtures ---------------------------------------------------------- |
| 136 | # The /protocol/test subtree is theirs whole, the way the bind rows give it to |
| 137 | # them. Everything ABOVE that subtree is named one fixture at a time, so a |
| 138 | # fixture reaches a system contract only where a scenario needs it — which is |
| 139 | # what leaves the rest genuinely absent for the rest of them (the protocol-denied |
| 140 | # case asks for one it was not given, and is told there is no such thing). |
| 141 | /test/*, kernel, open, test/* |
| 142 | /test/*, /test/*, open, test/* |
| 143 | /test/*, kernel, open, device-manager |
| 144 | /test/*, /system/services/device-manager, open, device-manager |
| 145 | /test/system/services/input-source, kernel, open, input |
| 146 | /test/system/services/input-test, kernel, open, input |
| 147 | # The guessable-id probe (test/system/services/badge-scope-test) runs as two |
| 148 | # processes of one binary: the owner, which the scenario spawns, and the intruder, |
| 149 | # which the owner spawns with the ids it holds. Both reach the compositor — the |
| 150 | # owner to create the layer, the intruder to be refused it — so the binary is |
| 151 | # named twice, once per supervisor. The second row needs no 'supervise' |
| 152 | # delegation: the owner was spawned by the KERNEL, which is a chain init can |
| 153 | # vouch for on its own. |
| 154 | /test/system/services/badge-scope-test, kernel, open, display |
| 155 | /test/system/services/badge-scope-test, /test/*, open, display |
| 156 | # The conformance probe (test/system/services/protocol-conformance-test) asks |
| 157 | # every provider its boot bound for the envelope's reserved verbs. It reaches |
| 158 | # ONLY the two contracts its own scenario boots a provider for, named one at a |
| 159 | # time exactly like the two rows above — no subtree, no wildcard. Everything else |
| 160 | # under /protocol stays absent for it, which is the point: the fixture walks the |
| 161 | # namespace listing and reports what it could not open rather than being handed |
| 162 | # the tree to make the test look broad. |
| 163 | /test/system/services/protocol-conformance-test, kernel, open, input |
| 164 | /test/system/services/protocol-conformance-test, kernel, open, display |
| 165 | # The laundering-deputy probe (test/system/services/protocol-registry-test) runs |
| 166 | # a grandchild whose supervisor is a fixture nobody authorized — that is the |
| 167 | # point of it, and its bind must stay refused. It still has to report the verdict |
| 168 | # it got, so its reporting channel, and nothing else, is delegated. |
| 169 | /test/*, /test/*, supervise, test/verdict |