nexoniarz/SchOS
nexoniarz/SchOS
Watch
1
0
Fork
You've already forked SchOS
 0
Code Issues Pull requests Projects Releases 1 Packages Wiki Activity Actions

hybrid: the driver is killed, and the driver comes back

Browse source 
H2 of docs/plan/hybrid.md -- the milestone the plan itself calls the one
that proves the whole idea, and the one that cannot be skipped.

    # cat /proc/schinit
    1 4 11 os.schos.vgpud
    # kill 4
    schinitd: restarting os.schos.vgpud
    vgpud: claimed
    vgpud: pid 8 drew a test pattern from userspace

The test pattern ends in a twelve-block tally of the drawing process's
pid, because a second run that redraws an identical picture is
indistinguishable from a first run that never stopped. Read off the
virtio-gpu scanout across four generations it says 4, 8, 10, 12, and the
DMA arena hands back the same physical address every time.

What it took:

* A halt the kernel can apply to a device it does not understand.
  Clearing PCI_CMD_BUS_MASTER is the only one there is, and it has to
  happen before the DMA goes back to the arena -- a dead driver's device
  keeps reading a framebuffer the kernel is about to give to somebody
  else. Claim sets the bit, release clears it; pcitest shows it in a bm
  column, with a third state so a failed read is never printed as off.

* A refusal. vgpu_release() asks vga_fb_restore() whether there is a
  framebuffer to put the console back on, and declines to hand over the
  device if there is not. The rule that the kernel keeps a minimal
  driver for everything on the path to a shell is worth writing down
  only if something enforces it.

* The DMA arena not being owned by two allocators at once. This is the
  bug that stopped H2: freevm() frees every mapped page below PHYSTOP
  and the arena is the top 16 MB of exactly that range, so a DMA block
  mapped into a driver went onto the page allocator's free list when the
  driver died, while pciuser_release_all() handed the same pages back to
  the arena. The restarted vgpud asked for its framebuffer, got pages
  kalloc() had already given out -- including its own page tables -- and
  dma_alloc()'s zeroing wiped them, so it died inside the ioctl on the
  return from a syscall whose stack had stopped existing. do_dma() now
  records a VMA with no_free set, the way shared memory does.

* One exit status. KeepAlive must restart a driver that crashed and must
  not restart one that has looked at the machine and found its device
  absent: on hardware with no virtio-gpu that was fifteen spawns in
  forty-five seconds, each printing a line to the console, for ever.
  SCHINIT_EXIT_NORESTART is 78, sysexits.h's EX_CONFIG. It is not a new
  manifest key -- the wait status has always travelled from PID 1 to the
  supervisor, and note_exit() simply stopped discarding it.

The milestone's third clause, "the compositor reattaches", is not done
and is not claimed: there is no compositor running. That is recorded in
the plan as a Schcom milestone rather than counted here.

Closes the register row "A released PCI device" in docs/plan/1.0.md.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VQ7Qx8E1q1M1bbCq8QLHS2
This commit is contained in:
Nexoniarz 2026-09-14 00:05:43 +02:00
commit d1f50c4da3
15 changed files with 442 additions and 40 deletions
Download patch file Download diff file Expand all files Collapse all files

22
cmd/pcitest/main.c
View file

@ -93,12 +93,31 @@ main(int argc, char *argv[])
}
if (argc == 1) {
puts(" # bdf vendor:device irq class driver\n");
puts(" # bdf vendor:device irq class bm driver\n");
for (int i = 0; i < count; i++) {
struct pciuser_info in;
in.index = (unsigned int)i;
if (ioctl(fd, PCIIOC_INFO, &in) < 0)
continue;
// Bus mastering, straight out of the command register.
//
// Worth a column of its own because it is the one bit that says
// whether a device can still touch memory, and the whole lifecycle
// turns on it: claiming a device sets it, releasing one clears it,
// and a driver that died leaves a device that must not be left
// reading buffers the kernel is about to hand to somebody else.
struct pciuser_cfg cfg;
cfg.index = (unsigned int)i;
cfg.offset = 0x04; // PCI_COMMAND
cfg.value = 0;
// Three states, not two. A read that failed is not the same as a
// bit that is clear, and printing them the same way is how a
// column stops being evidence -- which is exactly what happened
// the first time this was run.
const char *bm = "? ";
if (ioctl(fd, PCIIOC_CFG, &cfg) == 0)
bm = (cfg.value & 0x0004) ? "on " : "-- ";
puts(" "); putn(i); puts(" ");
puthex(in.bus, 2); puts(":"); puthex(in.slot, 2);
puts("."); puthex(in.func, 1); puts(" ");
@ -106,6 +125,7 @@ main(int argc, char *argv[])
if (in.irq == 0xFF) puts(" - "); else { putn(in.irq); puts(" "); }
puts(class_name(in.class));
puts(" ");
puts(bm);
puts(in.driver[0] ? in.driver : "-");
puts("\n");
}

11
cmd/schinitd/main.c
View file

@ -455,7 +455,6 @@ job_by_cookie(unsigned int cookie)
static void
note_exit(unsigned int cookie, int pid, int status)
{
(void)status;
struct job *j = job_by_cookie(cookie);
if (!j)
return; // not ours, or already noticed
@ -465,6 +464,16 @@ note_exit(unsigned int cookie, int pid, int status)
if (!j->keep_alive)
return;
// A job that says it cannot run on this machine is believed. The status is
// wait(2)-encoded: the low seven bits are the signal that killed it, so a
// job that was killed or faulted never matches this and is restarted the
// way KeepAlive promises. See SCHINIT_EXIT_NORESTART.
if ((status & 0x7f) == 0 && ((status >> 8) & 0xff) == SCHINIT_EXIT_NORESTART) {
out("schinitd: "); out(j->label);
out(" has nothing to do on this machine; not restarting\n");
return;
}
// Throttle. A job that exits immediately and forever would otherwise spin
// the machine; launchd's ThrottleInterval exists for exactly this.
int ticks = j->throttle * 100;

49
cmd/vgpud/main.c
View file

@ -26,6 +26,7 @@
#include "posix.h"
#include "pciuser.h"
#include "virtio.h"
#include "schinit.h"
// --- small output, since lib/ has no printf ---------------------------------
@ -64,6 +65,17 @@ die(const char *why)
exit();
}
// Not a failure: a report. There is no virtio-gpu here, or the kernel will not
// give it up, and neither of those changes by trying again -- so this tells the
// supervisor to stop, rather than being restarted every three seconds for the
// rest of the uptime. See SCHINIT_EXIT_NORESTART in include/schinit.h.
static void
nothing_to_do(const char *why)
{
puts("vgpud: "); puts(why); puts("\n");
exit_group(SCHINIT_EXIT_NORESTART);
}
// --- register access --------------------------------------------------------
static inline unsigned char r8 (volatile unsigned char *p, int o) { return p[o]; }
@ -453,6 +465,12 @@ draw_test_pattern(void)
{
volatile unsigned int *fb = (volatile unsigned int *)fb_uaddr;
// A tally of this instance's pid along the bottom edge, because the thing
// H2 has to show is that the driver *came back* -- and a second run that
// redraws an identical picture is indistinguishable from a first run that
// never stopped. One block per bit, low bit at the left.
int mypid = getpid();
for (int y = 0; y < height; y++) {
for (int x = 0; x < width; x++) {
unsigned int c;
@ -474,6 +492,14 @@ draw_test_pattern(void)
fb[y * width + x] = c;
}
}
for (int b = 0; b < 12; b++) {
unsigned int c = (mypid >> b) & 1 ? 0x4ADE80 : 0x12151C; /* SCH_OK */
for (int y = height - 24; y < height - 8; y++)
for (int x = 16 + b * 24; x < 16 + b * 24 + 16; x++)
if (y >= 0 && x < width)
fb[y * width + x] = c;
}
}
// --- main -------------------------------------------------------------------
@ -502,7 +528,7 @@ main(int argc, char *argv[])
}
}
if (index_ < 0)
die("no virtio-gpu on this machine");
nothing_to_do("no virtio-gpu on this machine");
puts("vgpud: virtio-gpu at "); puthex(info.bus, 2); puts(":");
puthex(info.slot, 2); puts("."); puthex(info.func, 1);
@ -513,7 +539,7 @@ main(int argc, char *argv[])
// back on screen before returning, so there is never a moment with no
// display -- see vgpu_release() and vga_fb_restore().
if (ioctl(pcifd, PCIIOC_CLAIM, &index_) < 0)
die("claim refused -- the kernel driver would not release it");
nothing_to_do("claim refused -- the kernel driver would not release it");
puts("vgpud: claimed\n");
// The info is re-read because claiming is what enables memory space and
@ -532,7 +558,9 @@ main(int argc, char *argv[])
draw_test_pattern();
present();
puts("vgpud: drew a test pattern from userspace\n");
puts("vgpud: pid ");
putn(getpid());
puts(" drew a test pattern from userspace\n");
if (argc > 1 && argv[1][0] == '-' && argv[1][1] == 'x') {
// Exit without releasing, to show what a crashed driver leaves behind:
@ -542,10 +570,17 @@ main(int argc, char *argv[])
exit();
}
// Nothing to serve yet -- the compositor is what will connect here, over
// mechanism 1, which does not exist. Holding the device is the honest
// thing to do until then: releasing it would put the console back and make
// it look like this never worked.
// Hold the device and wait.
//
// Mechanism 1 exists now, so what belongs here eventually is an AF_UNIX
// socket a compositor connects to. It is not built, and building it before
// there is a compositor to judge it is the mistake this plan spends a
// section warning about -- so this sleeps instead, and holding the device
// is the honest state: releasing it would put the console back and make it
// look like none of this ever worked.
//
// Being killed here is not an error path, it is the H2 path: schinit
// restarts this process, and the device has to come back with it.
for (;;)
sleep(100);
}