d1f50c4da3
H2 of docs/plan/hybrid.md -- the milestone the plan itself calls the one
that proves the whole idea, and the one that cannot be skipped.
# cat /proc/schinit
1 4 11 os.schos.vgpud
# kill 4
schinitd: restarting os.schos.vgpud
vgpud: claimed
vgpud: pid 8 drew a test pattern from userspace
The test pattern ends in a twelve-block tally of the drawing process's
pid, because a second run that redraws an identical picture is
indistinguishable from a first run that never stopped. Read off the
virtio-gpu scanout across four generations it says 4, 8, 10, 12, and the
DMA arena hands back the same physical address every time.
What it took:
* A halt the kernel can apply to a device it does not understand.
Clearing PCI_CMD_BUS_MASTER is the only one there is, and it has to
happen before the DMA goes back to the arena -- a dead driver's device
keeps reading a framebuffer the kernel is about to give to somebody
else. Claim sets the bit, release clears it; pcitest shows it in a bm
column, with a third state so a failed read is never printed as off.
* A refusal. vgpu_release() asks vga_fb_restore() whether there is a
framebuffer to put the console back on, and declines to hand over the
device if there is not. The rule that the kernel keeps a minimal
driver for everything on the path to a shell is worth writing down
only if something enforces it.
* The DMA arena not being owned by two allocators at once. This is the
bug that stopped H2: freevm() frees every mapped page below PHYSTOP
and the arena is the top 16 MB of exactly that range, so a DMA block
mapped into a driver went onto the page allocator's free list when the
driver died, while pciuser_release_all() handed the same pages back to
the arena. The restarted vgpud asked for its framebuffer, got pages
kalloc() had already given out -- including its own page tables -- and
dma_alloc()'s zeroing wiped them, so it died inside the ioctl on the
return from a syscall whose stack had stopped existing. do_dma() now
records a VMA with no_free set, the way shared memory does.
* One exit status. KeepAlive must restart a driver that crashed and must
not restart one that has looked at the machine and found its device
absent: on hardware with no virtio-gpu that was fifteen spawns in
forty-five seconds, each printing a line to the console, for ever.
SCHINIT_EXIT_NORESTART is 78, sysexits.h's EX_CONFIG. It is not a new
manifest key -- the wait status has always travelled from PID 1 to the
supervisor, and note_exit() simply stopped discarding it.
The milestone's third clause, "the compositor reattaches", is not done
and is not claimed: there is no compositor running. That is recorded in
the plan as a Schcom milestone rather than counted here.
Closes the register row "A released PCI device" in docs/plan/1.0.md.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VQ7Qx8E1q1M1bbCq8QLHS2
31 lines
1.4 KiB
Text
31 lines
1.4 KiB
Text
# The virtio-gpu driver, as an ordinary process.
|
|
#
|
|
# docs/plan/hybrid.md milestone H2. This manifest is the "the driver restarts"
|
|
# half of it: KeepAlive means schinit brings vgpud back when it dies, and
|
|
# because PID 1 forks every job, a driver that crashes is reaped and replaced by
|
|
# the same machinery that looks after a shell. Nothing about driver recovery is
|
|
# special -- that is the point.
|
|
#
|
|
# Enabled unconditionally, and safe to be, on two machines it is not written
|
|
# for: one with no virtio-gpu at all, and one where the GPU is the only display
|
|
# and the kernel therefore refuses to hand it over (virtio_gpu.c's release
|
|
# hook). In both cases vgpud says so and exits SCHINIT_EXIT_NORESTART, which
|
|
# stops KeepAlive from starting it again -- the alternative, measured, is
|
|
# fifteen spawns in forty-five seconds, each printing a line to the console for
|
|
# the rest of the uptime. No per-machine configuration either way.
|
|
|
|
Label = os.schos.vgpud
|
|
Program = /bin/vgpud
|
|
Args = vgpud
|
|
RunAtLoad = yes
|
|
KeepAlive = yes
|
|
|
|
# Higher than a shell's second, because a driver that cannot claim its device
|
|
# will fail identically every time and there is no user waiting on it. Low
|
|
# enough that a kill is answered while you are still looking at the screen.
|
|
ThrottleInterval = 3
|
|
|
|
# It has no terminal and wants none: a driver that seized the console would be
|
|
# doing exactly what moving it out of the kernel was meant to stop.
|
|
StandardOut = /dev/tty1
|
|
StandardError = /dev/tty1
|