nexoniarz/SchOS
nexoniarz/SchOS
Watch
1
0
Fork
You've already forked SchOS
 0
Code Issues Pull requests Projects Releases 1 Packages Wiki Activity Actions

schfs: the commit barrier, reflink, and attributes with an index over them

Browse source 
The last three phases of the filesystem, which were written together and
touch the same files throughout -- kmount.c, objw.c and vfs.c are each
rewritten by all three -- so they land as one commit rather than three
that could not be built separately.

Durability. A transaction that reaches the platter out of order is worse
than one that never reached it: the uberblock can name a tree whose
blocks are still in the drive's write cache. bdirty/bflush give the
buffer layer an explicit barrier, ideflush issues ATA FLUSH CACHE and
usb_storage_flush the SCSI SYNCHRONIZE CACHE that means the same thing,
and a commit now waits for the data before it writes the root that
points at it. The uberblock groups are read newest-first with fallback,
so a volume whose newest roots are torn mounts at an older one and says
which generations were lost.

Reflink. Extents carry a refcount, so two objects can name the same
blocks and neither frees them while the other holds them. Exposed as
FICLONE -- Linux's ioctl value, so `cp --reflink` works unmodified --
and as cmd/reflink for the case where there is no cp to hand.

Attributes, and the one genuinely new idea here. attr.c stores named
values on an object, reachable through setxattr/getxattr/removexattr at
Linux's syscall numbers. On top of that, schfs_index declares an index
over an attribute name and schfs_query answers "which objects carry this
value" from the B-tree rather than by walking. A query against an
unindexed attribute is refused with an error, never silently answered by
a full scan: a query that quietly becomes a scan is worse than one that
admits it cannot help. cmd/schattr drives both.

Three bugs fixed on the way, each found by the numbers being wrong
rather than by inspection:

  - statfs's f_fsid was declared int64[2]. Linux's fsid_t is two *ints*,
    so every field after it landed one slot late: userland read f_frsize
    out of f_namelen, got 255, and df reported a 32 MB root filesystem
    as 1992 KB. It hid for as long as it did because the fields used to
    be invented constants, so wrong numbers looked like the usual ones.
  - struct inode's nlink was a short against SchFS's uint32, so a file
    past 32767 names came back negative -- and iput frees an object
    whose count reaches zero. It is an int now, signed on purpose, so an
    underflow lands somewhere a check can see rather than wrapping.
  - filewrite split every write to fit v1's log. That limit belongs to
    the journal, not to writing, and SchFS makes one transaction of
    whatever it is handed: a 1 MB write was becoming 170 commits and
    170 flushes for nothing. fs_ops carries max_write now, and SchFS
    sets no limit.

Also here: a real mount table, so `mount -t schfs /dev/hdb /mnt` shows
up in /proc/mounts -- df looks a path up there before it calls statfs at
all, so a mount missing from that list was invisible to it -- several
volumes mounted at once, snapshots mounted by name, and /proc/fsstat
with an rdtsc-based counter, which is the only instrument fine enough to
see inside a single syscall.

Verified: `make schfs-check` passes in full, including the sweep that
crashes the volume at each of 119 points mid-transaction and requires
every one to mount with exactly its committed data, and the case where
both newest uberblocks are rubbish and the volume still comes back. The
headless boot check passes with 27 [ok] and no failures, on a SchFS root.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
Nexoniarz 2026-08-15 16:01:22 +02:00
commit 03cc316001
39 changed files with 3942 additions and 550 deletions
Download patch file Download diff file Expand all files Collapse all files

67
kernel/fs/fs.c
View file

@ -268,6 +268,10 @@ static const struct fs_ops v1_ops = {
.dirempty = v1_dirempty,
.ialloc = v1_ialloc,
.getdents = v1_getdents,
// A write has to fit in the on-disk log, with room for the inode block, the
// bitmap block and the log header. This is the constant filewrite used to
// apply to every filesystem, SchFS included.
.max_write = ((LOGSIZE-1-1-2) / 2) * 512,
};
// Defined in fs/schfs/vfs.c, which is only linked when SchFS is built in.
@ -290,10 +294,10 @@ fs_readonly(uint dev)
static const struct fs_ops *
ops_for(uint dev)
{
if (dev == SCHFS_DEV) return &schfs_ops;
// A mounted snapshot is the same filesystem seen through an older root, so it
// is the same operations; they dispatch on the device themselves.
if (SCHFS_IS_SNAP_DEV(dev)) return &schfs_ops;
// Every mounted SchFS volume, and every mounted snapshot. One table serves
// them all: the operations take an inode, an inode carries its device, and
// kmount.c turns that device into the right volume.
if (SCHFS_IS_ANY_DEV(dev)) return &schfs_ops;
if (dev == PROCFS_DEV) return &procfs_ops;
return &v1_ops;
}
@ -399,7 +403,10 @@ v1_istore(struct inode *ip)
dip->type = ip->type;
dip->major = ip->major;
dip->minor = ip->minor;
dip->nlink = ip->nlink;
// v1's on-disk field is a short and cannot be widened without changing the
// format, so the narrowing is the format's, not an accident of this line.
// The in-memory count is an int now because SchFS needs the range.
dip->nlink = (short)ip->nlink;
dip->size = ip->size;
dip->rwmode = ip->rwmode;
dip->supermode = ip->supermode;
@ -1529,9 +1536,27 @@ static struct {
uint64 inum; // the mount point directory itself
uint fsdev; // device of the filesystem mounted on it
uint64 root; // that filesystem's root inode
// What userland called it. Resolution never needs these -- it works in
// (dev, inum) -- but /proc/mounts does, and a path cannot be recovered from
// an inode without walking the whole tree backwards. So the strings are
// kept at mount time, when the caller still has them.
char path[MAXPATH];
char source[MAXPATH];
char type[16];
} m[NMOUNT];
} mtable;
// Copy a string into a fixed field, always NUL-terminating.
static void
mstrcpy(char *dst, const char *src, int cap)
{
int i = 0;
if (src)
for (; i < cap - 1 && src[i]; i++)
dst[i] = src[i];
dst[i] = '\0';
}
void
mountinit(void)
{
@ -1540,7 +1565,8 @@ mountinit(void)
// Attach `fsdev`:`root` over the directory `dev`:`inum`.
int
mount_add(uint dev, uint64 inum, uint fsdev, uint64 root)
mount_add(uint dev, uint64 inum, uint fsdev, uint64 root,
const char *path, const char *source, const char *type)
{
acquire(&mtable.lock);
for (int i = 0; i < NMOUNT; i++)
@ -1556,6 +1582,9 @@ mount_add(uint dev, uint64 inum, uint fsdev, uint64 root)
mtable.m[i].inum = inum;
mtable.m[i].fsdev = fsdev;
mtable.m[i].root = root;
mstrcpy(mtable.m[i].path, path, MAXPATH);
mstrcpy(mtable.m[i].source, source, MAXPATH);
mstrcpy(mtable.m[i].type, type, 16);
release(&mtable.lock);
return 0;
}
@ -1563,6 +1592,30 @@ mount_add(uint dev, uint64 inum, uint fsdev, uint64 root)
return -1; /* table full */
}
// Walk the mount table for /proc/mounts. Returns 0 and fills the caller's
// buffers for entry `i`, or -1 when there is no such entry.
//
// An index rather than a callback because the caller formats into a growing
// string buffer and must not hold this lock while doing it.
int
mount_get(int i, char *path, char *source, char *type, uint *fsdev)
{
if (i < 0 || i >= NMOUNT)
return -1;
acquire(&mtable.lock);
if (!mtable.m[i].used) {
release(&mtable.lock);
return -1;
}
mstrcpy(path, mtable.m[i].path, MAXPATH);
mstrcpy(source, mtable.m[i].source, MAXPATH);
mstrcpy(type, mtable.m[i].type, 16);
if (fsdev)
*fsdev = mtable.m[i].fsdev;
release(&mtable.lock);
return 0;
}
// Detach by naming the *mounted* filesystem's root, which is what a path to
// the mount point resolves to once the mount exists. Naming the covered
// directory instead is not possible from userland: the whole point of the
@ -1663,7 +1716,7 @@ namex_from(struct inode *start, char *path, int nameiparent, char *name)
// Root is a SchFS object, not a v1 inode. ops_for(SCHFS_DEV) then routes
// every operation on it through schfs_ops, which is the whole point: the v1
// format code in this file is no longer reachable from `/`.
ip = (*spath == '/') ? iget(SCHFS_DEV, schfs_kroot()) : idup(start);
ip = (*spath == '/') ? iget(SCHFS_DEV, schfs_kroot(SCHFS_DEV)) : idup(start);
// The root itself can be a mount point, and a relative walk can start on one.
ip = mount_cross(ip);