Sound through ALSA, a 2D game, and a stack walk that cannot panic

SDL 3 has no OSS backend and SchOS has no ALSA kernel side, so sound now
goes SDL -> alsa-lib -> alsa-plugins' OSS plugin -> /dev/dsp. That path
found two bugs underneath it:

- ac97: resetting the PCM-out box also clears the descriptor list address,
  and nothing set it again. Every stream after the first stop played a
  "list" at physical address 0 -- silence -- and ALSA resets before each
  stream. If the engine halts at the end of the queue, the run bit is set
  again.
- /dev/dsp: SETFRAGMENT, GETFMTS, GETCAPS, SETTRIGGER, GETOPTR and GETODELAY
  for the plugin's ring-and-pointer model, and poll(), writable once a whole
  fragment fits (ALSA spun at 76% CPU otherwise). speaker-test now plays in
  real time at 0% CPU, verified in a recording of QEMU's AC'97.
- /etc/asound.conf: the default device is a plug to the OSS device at 16-bit
  stereo 48 kHz, what every SchOS audio driver plays.

Also:

- getstackpcs: each frame link must go up the same stack by less than
  KSTACKSIZE. The chain ends at the syscall entry with the user's rbp,
  which lbreakouthd uses as a register (-1024); the walk dereferenced it
  under the syscall tracer and the kernel panicked inside acquire().
- fb: FBIOGET_VSCREENINFO reports nominal timings, as Linux's efifb does,
  instead of zeros, which Xorg's fbdev turned into a 0 Hz RandR mode.
- procdump (Ctrl-P) shows where runnable threads are in user space.
- World: lbreakouthd instead of lbreakout2 (its stk.c passes vsnprintf a
  size of 511 plus the prefix length, and Alpine's fortified headers trap on
  that), plus curl, alsa-lib and alsa-plugins.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01S1giNvrHTrPMPw7V6x1kQ4

kernel/core/spinlock.c

@@ -90,7 +90,19 @@ getstackpcs(addr_t *rbp, addr_t pcs[])
     if(((addr_t)rbp & 7) != 0)
       break;
     pcs[i] = rbp[1];
-    rbp = (addr_t*)rbp[0];
+    // The next frame is the caller's, further up the same stack: higher, and
+    // by less than a whole kernel stack. The chain ends at the system call or
+    // interrupt entry, and the rbp saved there is the user's -- which an
+    // optimised program uses as an ordinary register. lbreakouthd left -1024
+    // in it, 0xfffffffffffffc00, which passed every test above and faulted
+    // here under the syscall tracer, taking the kernel down from inside the
+    // lock it was recording.
+    addr_t *next = (addr_t*)rbp[0];
+    if(next <= rbp || (addr_t)next - (addr_t)rbp >= KSTACKSIZE){
+      i++;                      // keep the return address just read
+      break;
+    }
+    rbp = next;
   }
   for(; i < 10; i++)
     pcs[i] = 0;

kernel/dev/audio.c

@@ -26,6 +26,16 @@ static int             audio_lock_init;
 // to be told once and then have it stay told.
 static struct audio_format current_fmt = { 48000, 2, AUDIO_FMT_S16LE };
 
+// The OSS view of the stream, for clients that track a play pointer in a ring
+// rather than just writing: bytes accepted by the driver since boot, where the
+// last reset left the count, the ring geometry SETFRAGMENT asked for, and the
+// played count GETOPTR last reported (for its fragment count).
+static uint64 queued_total;
+static uint64 reset_base;
+static uint64 last_optr;
+static int    frag_size  = 4096;
+static int    frag_count = 16;
+
 static void
 lock_once(void)
 {
@@ -114,6 +124,10 @@ audio_write(const void *pcm, int bytes)
     }
 
     done += n;
+    lock_once();
+    acquire(&audio_lock);
+    queued_total += (uint64)n;
+    release(&audio_lock);
   }
 
   if (o->start)
@@ -211,6 +225,45 @@ dspclose(struct inode *ip)
   audio_stop();
 }
 
+// Bytes the speaker has played since boot: everything queued, less what is
+// still waiting. A reset discards the waiting part, which then counts as played
+// -- the count only goes forward, and GETOPTR measures from the reset.
+static uint64
+played_total(struct device *d, const struct audio_ops *o)
+{
+  uint64 q, p;
+  int pend = o->pending ? o->pending(d) : 0;
+
+  lock_once();
+  acquire(&audio_lock);
+  q = queued_total;
+  release(&audio_lock);
+  p = (pend > 0 && (uint64)pend <= q) ? q - (uint64)pend : q;
+  return p;
+}
+
+// Writable once a whole fragment fits, as OSS defines it. ALSA's plugin sets
+// the fragment to its period and waits in poll() for one to be free; reporting
+// writable at the first free byte had it wake, find less than a period of
+// room, and poll again -- 76% of a CPU to play a sine wave.
+int
+dsp_writable(void)
+{
+  struct device *d = audio_get();
+  const struct audio_ops *o = ops_of(d);
+  int want;
+
+  if (!o || !o->space)
+    return 0;
+  lock_once();
+  acquire(&audio_lock);
+  want = frag_size;
+  release(&audio_lock);
+  if (want > 65536)
+    want = 65536;     // never more than a driver's ring can free at once
+  return o->space(d) >= want;
+}
+
 int
 dsp_ioctl(int request, uint64 argp)
 {
@@ -262,18 +315,78 @@ dsp_ioctl(int request, uint64 argp)
     audio_drain();
     return 0;
 
-  case SNDCTL_DSP_RESET:
+  case SNDCTL_DSP_RESET: {
     audio_stop();
+    uint64 p = played_total(d, o);
+    acquire(&audio_lock);
+    reset_base = last_optr = p;
+    release(&audio_lock);
     return 0;
+  }
+
+  // The ring the client thinks in. The driver's own ring is whatever it is;
+  // these only shape the numbers GETOPTR and GETOSPACE report, which is all a
+  // client does with them. Fragments of 256 bytes to 64 KiB, 2 to 1024 of them.
+  case SNDCTL_DSP_SETFRAGMENT: {
+    if (copy_from_user(&val, argp, sizeof(val)) < 0)
+      return -EFAULT;
+    int shift = val & 0xffff, count = (val >> 16) & 0xffff;
+    if (shift < 8)  shift = 8;
+    if (shift > 16) shift = 16;
+    if (count < 2)  count = 2;
+    if (count > 1024 || count == 0x7fff) count = 1024;
+    acquire(&audio_lock);
+    frag_size = 1 << shift;
+    frag_count = count;
+    release(&audio_lock);
+    val = (count << 16) | shift;
+    return copy_to_user(argp, &val, sizeof(val)) < 0 ? -EFAULT : 0;
+  }
+
+  case SNDCTL_DSP_GETFMTS:
+    val = AFMT_S16_LE;
+    return copy_to_user(argp, &val, sizeof(val)) < 0 ? -EFAULT : 0;
+
+  case SNDCTL_DSP_GETCAPS:
+    val = DSP_CAP_TRIGGER;
+    return copy_to_user(argp, &val, sizeof(val)) < 0 ? -EFAULT : 0;
+
+  // Enabling output starts whatever is queued. Disabling is accepted and does
+  // nothing: the stream stops by itself when the queue runs dry, and stopping
+  // it here would throw away what is queued, which a pause must not.
+  case SNDCTL_DSP_SETTRIGGER:
+    if (copy_from_user(&val, argp, sizeof(val)) < 0)
+      return -EFAULT;
+    if ((val & PCM_ENABLE_OUTPUT) && o->start)
+      o->start(d);
+    return 0;
+
+  case SNDCTL_DSP_GETOPTR: {
+    struct count_info ci;
+    uint64 p = played_total(d, o);
+    acquire(&audio_lock);
+    uint64 since = p - reset_base;
+    uint64 ring = (uint64)frag_size * (uint64)frag_count;
+    ci.bytes  = (int)since;
+    ci.blocks = (int)((p - last_optr) / (uint64)frag_size);
+    ci.ptr    = (int)(since % ring);
+    last_optr = p;
+    release(&audio_lock);
+    return copy_to_user(argp, &ci, sizeof(ci)) < 0 ? -EFAULT : 0;
+  }
+
+  case SNDCTL_DSP_GETODELAY:
+    val = o->pending ? o->pending(d) : 0;
+    return copy_to_user(argp, &val, sizeof(val)) < 0 ? -EFAULT : 0;
 
   case SNDCTL_DSP_GETOSPACE: {
     struct audio_buf_info bi;
     int space = o->space ? o->space(d) : 0;
 
-    bi.fragsize   = 4096;
+    bi.fragsize   = frag_size;
     bi.bytes      = space;
     bi.fragments  = space / bi.fragsize;
-    bi.fragstotal = 0;
+    bi.fragstotal = frag_count;
     if (copy_to_user(argp, &bi, sizeof(bi)) < 0)
       return -EFAULT;
     return 0;

kernel/dev/fb.c

@@ -147,6 +147,23 @@ fbclose(struct inode *ip)
 // the largest struct here -- fb_fix_screeninfo is half the size of
 // fb_var_screeninfo, and a buffer sitting near the end of a mapping is a
 // legitimate place to put the smaller one.
+// Timings for a mode the firmware set and never described. GOP and VBE give a
+// size and a pixel format and nothing about the signal, so these are made up --
+// and made up the way Linux's efifb makes them up, which is what every program
+// that reads them was written against. They used to be zero, which is not "no
+// answer" but the answer "0 Hz": Xorg's fbdev driver built a RandR mode with a
+// dot clock of 0 from it, and SDL 3 sized a fullscreen window from that mode
+// as 1x1. Physical size stays zero; nothing reads it as a number.
+static void
+nominal_timings(struct fb_var_screeninfo *v)
+{
+  if (v->xres == 0 || v->yres == 0)
+    return;
+  v->pixclock    = 10000000 / v->xres * 1000 / v->yres;
+  v->left_margin = (v->xres / 8) & 0xf8;
+  v->hsync_len   = (v->xres / 8) & 0xf8;
+}
+
 int
 fb_ioctl(int request, addr_t arg)
 {
@@ -169,8 +186,7 @@ fb_ioctl(int request, addr_t arg)
     v->bits_per_pixel = gfx_fb_bpp();
     v->activate = FB_ACTIVATE_NOW;
     pixel_format(v, v->bits_per_pixel);
-    // height/width (physical millimetres) and every timing field stay zero:
-    // VBE does not report them and a guess would be worse than an admission.
+    nominal_timings(v);
     return 0;
   }
 
@@ -212,6 +228,7 @@ fb_ioctl(int request, addr_t arg)
     v->bits_per_pixel = gfx_fb_bpp();
     v->activate = act;
     pixel_format(v, v->bits_per_pixel);
+    nominal_timings(v);
     return 0;
   }
 

kernel/drivers/audio/ac97.c

@@ -234,6 +234,12 @@ ac97_queue(struct device *d, const void *pcm, int bytes)
   // just written is what makes this a queue rather than a one-shot.
   outb(a->nabm + PO_LVI, (uint8)idx);
 
+  // An engine that ran off the end of the queue halts. QEMU resumes it when
+  // LVI moves; the datasheet asks for the run bit again, so if it is still
+  // halted after the write above, give it that.
+  if (a->running && (inw(a->nabm + PO_SR) & SR_DCH))
+    outb(a->nabm + PO_CR, CR_RPBM | CR_IOCE);
+
   release(&a->lock);
   return take;
 }
@@ -263,6 +269,13 @@ ac97_stop(struct device *d)
   acquire(&a->lock);
   outb(a->nabm + PO_CR, 0);
   outb(a->nabm + PO_CR, CR_RR);       // reset the box: CIV, LVI, PICB to 0
+  for (int spin = 0; spin < 100000 && (inb(a->nabm + PO_CR) & CR_RR); spin++)
+    ;
+  // The reset clears the descriptor list's address too, and the engine then
+  // walks a "list" at physical address 0: every write after the first stop
+  // played zeros. ALSA resets the device before each stream, so that was all
+  // of them. Linux's intel8x0 rewrites it after every reset for this reason.
+  outl(a->nabm + PO_BDBAR, a->bdl_phys);
   for (int i = 0; i < NDESC; i++)
     a->filled[i] = 0;
   a->head = 0;

kernel/fs/file.c

@@ -427,6 +427,11 @@ file_poll(struct file *f, int events)
        (f->ip->major == PTM_MAJOR || f->ip->major == PTS_MAJOR))
       return pty_poll(f->ip, events, f->readable, f->writable);
 
+    // /dev/dsp is writable when the driver has room. ALSA's OSS plugin waits
+    // in poll() for exactly this between periods.
+    if(f->ip && f->ip->type == T_DEV && f->ip->major == AUDIO_MAJOR)
+      return (events & POLLOUT) && f->writable && dsp_writable() ? POLLOUT : 0;
+
     if(f->ip && f->ip->type == T_DEV && f->ip->major == CONSOLE){
       int rev = 0;
       if((events & POLLIN) && f->readable && console_input_ready(f->ip ? f->ip->minor : 1))

kernel/proc/proc.c

@@ -2794,6 +2794,10 @@ procdump(void)
       for(i=0; i<10 && pc[i] != 0; i++)
         cprintf(" %p", pc[i]);
     }
+    // Where a thread that is not asleep last was in user space: the question
+    // when a program spins without making a system call.
+    if((p->state == RUNNABLE || p->state == RUNNING) && p->tf && p->pgdir)
+      cprintf(" user rip %p rsp %p", p->tf->rip, p->tf->rsp);
     cprintf("\n");
   }
 }