code wiki / _hdl_build / nx_scm_probe.nx
`nx_scm_probe.nx` source

↩ module page · 182 lines · 10257 B
1// nx_scm_probe.nx -- ISOLATE why sys_socketpair returns -14 (EFAULT) on this host.
2// Built BEFORE forming a hypothesis: five variants, each changing exactly one thing, plus two
3// CONTROLS that are known-good on this platform (pipe2 also has the kernel write two ints into a
4// caller buffer; socket() proves AF_UNIX itself is available). A verdict is not a diagnosis, so
5// this prints numbers and reaches no conclusion. license_tier: ORIGINAL
6import "nx_syscalls.nx"
7import "nx_unix_socket.nx"
8
9const SP_NUM_SCRATCH: i64 = 24
10const SP_ASCII_ZERO:  i64 = 48
11const SP_B10:         i64 = 10
12const SP_FDPAIR_BYTES: i64 = 8
13const SP_PAGE_BYTES:   i64 = 4096
14const SP_PIPEBOX_BYTES: i64 = 16
15const SP_NR_SOCKETPAIR: i64 = 53
16const SP_NR_SENDMSG: i64 = 46
17const SP_NR_RECVMSG: i64 = 47
18// sockaddr_un = [sa_family: u16][sun_path: 108], so the path starts at offset 2.
19const SP_SUN_PATH_OFF: i64 = 2
20const SP_SUN_BYTES:    i64 = 110
21const SP_BACKLOG:      i64 = 4
22
23func p_puts(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(1, s, n); return 0 }
24func p_num(v: i64) -> i64 {
  if v == 0 { sys_write(1, "0" as *u8, 1); return 0 }
  var m: i64 = v
  if m < 0 { sys_write(1, "-" as *u8, 1); m = 0 - m }
  let d: *u8 = sys_mmap(SP_NUM_SCRATCH); var k: i64 = 0
  while m > 0 { d[k] = ((SP_ASCII_ZERO + (m - (m / SP_B10) * SP_B10)) as u8); m = m / SP_B10; k = k + 1 }
  var j: i64 = k - 1
  while j >= 0 { sys_write(1, ((d as i64)+j) as *u8, 1); j = j - 1 }
  return 0
33}
34
35func main() -> i64 {
  // CONTROL 1: does AF_UNIX exist at all on this host?
  let s1: i64 = sys_socket(SCM_AF_UNIX, SOCK_STREAM, 0)
  p_puts("C1 socket(AF_UNIX,SOCK_STREAM) rc=" as *u8); p_num(s1); p_puts("\n" as *u8)
  if s1 >= 0 { sys_close(s1) }
40
  // CONTROL 2: can the kernel write two ints into a buffer we allocated? pipe2 is the incumbent
  // that already does exactly this, all over the tree.
  let f: *i64 = (sys_mmap(SP_PIPEBOX_BYTES)) as *i64
  f[0] = 0
  let pr: i64 = sys_pipe2(f, 0)
  p_puts("C2 pipe2 rc=" as *u8); p_num(pr); p_puts(" packed=" as *u8); p_num(f[0]); p_puts("\n" as *u8)
47
  // A: the shim wrapper with an 8-byte arena buffer -- the failing case.
  let a: *u8 = sys_mmap(SP_FDPAIR_BYTES)
  a[0] = 0
  p_puts("A addr=" as *u8); p_num(a as i64); p_puts("\n" as *u8)
  let ra: i64 = sys_socketpair(SCM_AF_UNIX, SOCK_STREAM, 0, a)
  p_puts("A sys_socketpair(8B arena) rc=" as *u8); p_num(ra); p_puts("\n" as *u8)
54
  // B: same wrapper, page-sized buffer -- isolates "is it the allocation size".
  let b: *u8 = sys_mmap(SP_PAGE_BYTES)
  b[0] = 0
  let rb: i64 = sys_socketpair(SCM_AF_UNIX, SOCK_STREAM, 0, b)
  p_puts("B sys_socketpair(page) rc=" as *u8); p_num(rb); p_puts("\n" as *u8)
60
  // C: raw __syscall, bypassing the wrapper -- isolates "is it the wrapper's declaration".
  let rc2: i64 = __syscall(SP_NR_SOCKETPAIR, SCM_AF_UNIX, SOCK_STREAM, 0, b, 0, 0)
  p_puts("C raw __syscall(53) rc=" as *u8); p_num(rc2); p_puts("\n" as *u8)
64
  // D: the *i64 buffer shape pipe2 uses, handed to the same wrapper -- isolates "is it the
  // pointer TYPE at the call site".
  let e: *i64 = (sys_mmap(SP_PIPEBOX_BYTES)) as *i64
  e[0] = 0
  let rd: i64 = sys_socketpair(SCM_AF_UNIX, SOCK_STREAM, 0, e as *u8)
  p_puts("D sys_socketpair(i64 buf) rc=" as *u8); p_num(rd); p_puts(" packed=" as *u8); p_num(e[0]); p_puts("\n" as *u8)
71
  // E: raw __syscall on a page from the SHARED mapper, no arena involvement.
  let g: *u8 = sys_mmap_shared(SP_PAGE_BYTES)
  g[0] = 0
  let re: i64 = __syscall(SP_NR_SOCKETPAIR, SCM_AF_UNIX, SOCK_STREAM, 0, g, 0, 0)
  p_puts("E raw on shared page rc=" as *u8); p_num(re); p_puts("\n" as *u8)
77
  // F: a POINTER IN THE SAME 4th SYSCALL SLOT that the kernel only READS. setsockopt puts optval
  // at arg 4 exactly as socketpair puts usockvec there. If this returns 0 the slot delivers a
  // usable address and the socketpair failure is not about argument marshalling; if it fails the
  // same way, the whole tree has been calling setsockopt into the void and nobody checked, because
  // sys_set_socket_timeout discards its return value.
  let s2: i64 = sys_socket(AF_INET, SOCK_STREAM, 0)
  let tv: *i64 = (sys_mmap(SP_PIPEBOX_BYTES)) as *i64
  tv[0] = 1
  tv[1] = 0
  let rf: i64 = sys_setsockopt(s2, SOL_SOCKET, SO_RCVTIMEO, tv as *u8, SP_PIPEBOX_BYTES)
  p_puts("F setsockopt(ptr in arg4, kernel READS) rc=" as *u8); p_num(rf); p_puts("\n" as *u8)
  if s2 >= 0 { sys_close(s2) }
90
  // G: the same call with the pointer cast to i64 FIRST -- isolates "does a pointer-typed
  // argument survive the call differently from an integer-typed one".
  let rg: i64 = __syscall(SP_NR_SOCKETPAIR, SCM_AF_UNIX, SOCK_STREAM, 0, (g as i64), 0, 0)
  p_puts("G raw with (ptr as i64) rc=" as *u8); p_num(rg); p_puts("\n" as *u8)
95
  // H: is the address itself intact? Print the low and high halves of a page pointer so a
  // 32-bit truncation somewhere in the call path would be visible as a plausible-but-wrong value
  // rather than having to be inferred.
  p_puts("H page addr=" as *u8); p_num(g as i64)
  p_puts(" high32=" as *u8); p_num((g as i64) / SYS_MAGIC_4294967296); p_puts("\n" as *u8)
101
  // I: THE DISCRIMINATOR. Does the kernel reach its DOMAIN check before touching our pointer?
  // AF_INET has no socketpair support, so a kernel that parses the arguments must answer
  // EOPNOTSUPP (-95). If this ALSO returns -14 the call is failing before the domain is even
  // looked at, which points at the argument path; if it returns -95 the arguments are arriving
  // intact and the EFAULT belongs to the copy back to userspace.
  let ri: i64 = __syscall(SP_NR_SOCKETPAIR, AF_INET, SOCK_STREAM, 0, g, 0, 0)
  p_puts("I socketpair(AF_INET) rc=" as *u8); p_num(ri); p_puts("\n" as *u8)
109
  // J: same family, datagram type -- separates "this socket TYPE" from "this call".
  let rj: i64 = __syscall(SP_NR_SOCKETPAIR, SCM_AF_UNIX, SOCK_DGRAM, 0, g, 0, 0)
  p_puts("J socketpair(AF_UNIX,SOCK_DGRAM) rc=" as *u8); p_num(rj); p_puts("\n" as *u8)
113
  // K: a deliberately NULL vector. A kernel that copies to userspace must answer EFAULT here.
  // If K and A give the SAME answer, EFAULT is what this call returns for every input and the
  // pointer we passed was never the variable.
  let rk: i64 = __syscall(SP_NR_SOCKETPAIR, SCM_AF_UNIX, SOCK_STREAM, 0, 0, 0, 0)
  p_puts("K socketpair(NULL vec) rc=" as *u8); p_num(rk); p_puts("\n" as *u8)
119
  // L: THE PIVOT'S PRECONDITION. A NAMED AF_UNIX rendezvous is what nginx, HAProxy and systemd
  // actually use to move a listener between processes; socketpair is only a convenience. Prove
  // bind+listen on a filesystem path works here before rebuilding the round trip on it.
  sys_mkdir("/tmp/nx_scm_probe" as *u8, MODE_0755)
  sys_unlinkat("/tmp/nx_scm_probe/rv.sock" as *u8)
  let ls: i64 = sys_socket(SCM_AF_UNIX, SOCK_STREAM, 0)
  let sa: *u8 = sys_mmap(SP_PAGE_BYTES)
  var z: i64 = 0
  while z < SP_SUN_BYTES { sa[z] = 0; z = z + 1 }
  sa[0] = SCM_AF_UNIX
  sa[1] = 0
  let pth: *u8 = "/tmp/nx_scm_probe/rv.sock" as *u8
  var q: i64 = 0
  while pth[q] != (0 as u8) { sa[SP_SUN_PATH_OFF + q] = pth[q]; q = q + 1 }
  let bl: i64 = sys_bind(ls, sa, SP_SUN_PATH_OFF + q + 1)
  p_puts("L bind(AF_UNIX path) rc=" as *u8); p_num(bl); p_puts("\n" as *u8)
  let li: i64 = sys_listen(ls, SP_BACKLOG)
  p_puts("L listen rc=" as *u8); p_num(li); p_puts("\n" as *u8)
  let cs: i64 = nx_unix_connect(pth)
  p_puts("L connect rc=" as *u8); p_num(cs); p_puts("\n" as *u8)
  let acc: i64 = sys_accept(ls)
  p_puts("L accept rc=" as *u8); p_num(acc); p_puts("\n" as *u8)
  // M/N/O: IS sendmsg AVAILABLE AT ALL ON THIS HOST? Measured on a REAL connected socket pair, so
  // no result can be blamed on a bad fd. sendto is the control: it is the same family, the same
  // socket and the same direction, so if sendto works and sendmsg does not, the difference is the
  // syscall itself and not the setup.
  if acc >= 0 { if cs >= 0 {
      let one: *u8 = sys_mmap(SP_PAGE_BYTES)
      one[0] = 65
      let nt: i64 = sys_sendto(cs, one, 1, 0, 0 as *u8, 0)
      p_puts("M sendto on a live AF_UNIX socket rc=" as *u8); p_num(nt); p_puts("\n" as *u8)
      // plain sendmsg, ONE iovec, NO ancillary data -- the simplest possible use of the call.
      let msg: *u8 = sys_mmap(SCM_MSGHDR_BYTES)
      let iov: *u8 = sys_mmap(SCM_IOVEC_BYTES)
      scm_zero(msg, SCM_MSGHDR_BYTES)
      scm_put_i64(iov, SCM_IOVEC_OFF_BASE, one as i64)
      scm_put_i64(iov, SCM_IOVEC_OFF_LEN, 1)
      scm_put_i64(msg, SCM_MSGHDR_OFF_IOV, iov as i64)
      scm_put_i64(msg, SCM_MSGHDR_OFF_IOVLEN, SCM_IOV_COUNT_ONE)
      // WHAT NUMBER IS THE SHIM ACTUALLY EMITTING? The syscall constants are behind target
      // guards, so "it is 46" is a claim about the macro processor, not an observation. Print
      // them, and call the SAME syscall twice -- once through the constant and once through the
      // literal -- so a guard that resolved the wrong branch is visible instead of inferred.
      p_puts("CONSTS SYS_SENDMSG=" as *u8); p_num(SYS_SENDMSG)
      p_puts(" SYS_RECVMSG=" as *u8); p_num(SYS_RECVMSG)
      p_puts(" SYS_SOCKETPAIR=" as *u8); p_num(SYS_SOCKETPAIR)
      p_puts(" SYS_WRITE=" as *u8); p_num(SYS_WRITE)
      p_puts("\n" as *u8)
      let sm: i64 = sys_sendmsg(cs, msg, 0)
      p_puts("N sendmsg PLAIN via the CONST rc=" as *u8); p_num(sm); p_puts("\n" as *u8)
      let sml: i64 = __syscall(SP_NR_SENDMSG, cs, msg, 0, 0, 0, 0)
      p_puts("N2 sendmsg PLAIN via the LITERAL 46 rc=" as *u8); p_num(sml); p_puts("\n" as *u8)
      let rm: i64 = sys_recvmsg(acc, msg, 0)
      p_puts("O recvmsg PLAIN via the CONST rc=" as *u8); p_num(rm); p_puts("\n" as *u8)
      let rml: i64 = __syscall(SP_NR_RECVMSG, acc, msg, 0, 0, 0, 0)
      p_puts("O2 recvmsg PLAIN via the LITERAL 47 rc=" as *u8); p_num(rml); p_puts("\n" as *u8)
  } }
  if acc >= 0 { sys_close(acc) }
  if cs >= 0 { sys_close(cs) }
  if ls >= 0 { sys_close(ls) }
  sys_unlinkat("/tmp/nx_scm_probe/rv.sock" as *u8)
  return 0
182}
nx_scm_probe.nx source

`nx_scm_probe.nx` source
