Watch

History

Repository files (latest commit first)
Filename	Latest commit message	Latest commit date
Nexoniarz 9e6d8dd4e3 sockets: a descriptor can cross between processes sendmsg/recvmsg with SCM_RIGHTS. Item 1 of docs/plan/foundations.md and mechanism 1 of docs/plan/hybrid.md, which are the same primitive seen from two directions: Wayland's wl_shm_create_pool passes a file descriptor with no integer-shaped alternative, and handing a driver process the device it is allowed to touch is the same act. Both plans stopped here. Linux's structures byte for byte -- msghdr, cmsghdr, the CMSG_ macros -- because the programs that need this are not ours. libwayland and toybox both call recvmsg with Linux's headers and would not notice a friendlier door. The delivery rule is the whole design. A batch of descriptors is pinned to the stream position of the first byte of the message that carried it, and that has two halves: a reader arriving at that position is handed them, and a reader that has not reached it is stopped SHORT of it. Leave out the second half and a program asking for 4096 bytes swallows three messages and is handed one message's descriptors, with nothing in the result saying which. socktest checks exactly that: two one-byte messages, an eight-byte read, one byte back. The kernel holds a reference to every descriptor in flight, so a sender may close its own copy the moment sendmsg returns. Giving that reference back is the part that leaks if it is not written down, and there are three ways a message ends: - received with room installed in the receiver's table - received without room, or by plain read(2) closed; MSG_CTRUNC for the first case - never received, socket closed closed by sockclose The middle row looks like a choice and is not: holding kernel references for a receiver that has proved it is not looking is a leak with extra steps. No garbage collector. A socket descriptor sent over that same socket and never received holds a reference to the socket that holds the reference to it, and neither close reaches zero. Linux carries several hundred lines for this. Nothing on either plan passes a socket over a socket -- Wayland passes memory, the driver work passes devices -- so it is a bounded leak that is documented rather than a silent one. Fourteen checks in cmd/socktest, and every one moves data through the descriptor rather than inspecting it. The descriptor passed is always a pipe end, because a pipe announces its own lifetime: a read of a pipe whose writers are all gone returns 0, which turns "was the kernel's reference released" -- otherwise invisible from userspace -- into a value a test can compare. Two bugs fell out, neither in the new code: - sockpair() never set the socket's domain, so every socketpair() socket claimed domain 0. Invisible while the data paths asked only whether a socket was AF_INET or AF_NETLINK, since zero answers "neither" correctly. SCM_RIGHTS asks "is this AF_UNIX", and zero is wrong for that one. - pipe_poll() reports POLLHUP but not POLLIN at end of file, so a non-blocking read of a pipe whose writers had all gone returned EAGAIN forever instead of 0 -- a program that polls and reads spins waiting for an end that already happened. sockreadable() always had the equivalent condition; the pipe path did not. Found because the test helper for "is this descriptor closed" is a non-blocking read of a pipe. projects/schcom/README.md said SCM_RIGHTS was done for a long time while nothing in the kernel implemented it, and an entire GUI plan was drawn on that line. It is true now, which is not the same as it having been right, and the README says so. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01VQ7Qx8E1q1M1bbCq8QLHS2		2026-09-13 19:49:37 +02:00
..
architecture	sockets: a descriptor can cross between processes	2026-09-13 19:49:37 +02:00
branding	net: the DHCP lease goes to the log, not over the user's shell	2026-09-12 19:59:05 +02:00
guides	build: a nix shell, because the loader is the one thing gcc cannot build	2026-09-12 18:31:34 +02:00
history	kernel: processes have an environment now, and zsh is the shell	2026-09-12 23:26:50 +02:00
plan	sockets: a descriptor can cross between processes	2026-09-13 19:49:37 +02:00
Website	tty: six virtual terminals, and the plumbing that makes them terminals	2026-09-13 00:08:00 +02:00
licensing.md	docs: four directories, and a rule for when a thing leaves the roadmap	2026-09-12 17:13:35 +02:00
README.md	docs: a branding folder, and the three marks are not interchangeable	2026-09-12 18:19:09 +02:00

README.md

SchOS documentation

Four kinds of document, kept in four directories, because they answer four different questions and go stale at four different rates.


architecture/	What SchOS is	Present tense. Describes what is built and working.
plan/	What SchOS will be	Future tense. Everything here is unbuilt.
guides/	How to work on it	Imperative. Build it, test it, add to it.
history/	Why it is the way it is	Past tense. Bugs whose cause is not visible from the fix.

Plus two that belong to no category and apply to everything: licensing.md — read it before copying anyone else's code in — and branding/, which holds the marks and the rules for using them.

The rule that keeps this from rotting

When something is finished, it moves from plan/ to architecture/ and is rewritten as a description of the thing rather than a record of building it.

A completed item is not a ticked checkbox. A ticked checkbox says the work happened; it does not say what the work produced, and six months later the checkbox is the only thing left and it explains nothing.

So finishing a piece of work has three steps, and the third is not optional:

The code works and is tested.
The plan entry is deleted.
A description exists in architecture/ written for somebody who was not there — what it does, what shape it has, what it costs, and what it still does not do.

This is not bookkeeping. The tree has already proved it necessary: the network stack was finished, verified end to end, and for a month afterwards the only description of it anywhere was a checkbox in a roadmap, four levels of indentation deep, written in the past tense of somebody arguing for the work rather than explaining the result.

The "what it does not do" section is the one that pays. Every description in architecture/ ends with one. A document that only lists a subsystem's strengths is marketing, and the reader who most needs the document is the one about to trip over a limitation nobody wrote down.

Start here

New to the tree → architecture/README.md, the system layer by layer, then guides/layout.md for where the files are.

Trying to build it → guides/building.md.

Wondering what happens next → plan/1.0.md, which is the finish line, then plan/README.md for the order.

Something is broken and it feels familiar → history/. There is a good chance it is in there.

architecture/ — what SchOS is


README	The system, layer by layer. Read first.
boot.md	Firmware to the first userspace process.
kernel.md	SchIFT: memory, processes, scheduling, traps, signals, SMP.
syscalls.md	The call table, and the Linux personality that lets real software run.
filesystem.md	The VFS, the buffer cache, procfs, mounts.
schfs.md	SchFS: the copy-on-write root filesystem.
devices.md	The device model, driver binding, the class vtables.
usb.md	xHCI, the USB core, and the class drivers.
graphics.md	Framebuffer, text rendering, console, and the crash screen.
networking.md	Drivers, lwIP, sockets — Unix and INET.
init.md	`schinit`, PID 1, and the job manifests.

plan/ — what SchOS will be


README	The three current decisions and the order they happen in.
1.0.md	The finish line. What 1.0 contains, and what is explicitly deferred past it.
foundations.md	The kernel work everything else is blocked on.
init.md	PID 1 becomes a role rather than a process.
wayland.md	The GUI stack, and what gets deleted to make room.
hybrid.md	Moving drivers out of the kernel.
schapi.md	The long-term API layering, and the compatibility promise.
roadmap.md	Everything else still open.

guides/ — how to work on it


building.md	Prerequisites and the build, per host.
testing.md	The harnesses, and what each one actually proves.
layout.md	Repository map, and how to add a program or a port.
adding-a-driver.md	Writing one, binding it, publishing its class vtable.

branding/ — the marks


README	Shift the logo, Guru the icon, SchCotie the mascot: what each is for, the colour rule, and why a raster is committed next to its SVG.

history/ — why it is the way it is


README	What belongs in here and what does not.
kernel.md	Bugs whose cause was nowhere near their symptom.
moving-to-linux.md	The Windows-to-Fedora move, kept for the parts that recur.

Writing one of these

Four conventions, all of them observable in the existing files:

State the cost. Every design choice gave something up. A document that does not say what is a document that will be argued with later by somebody who only sees the downside.

Prefer the measured number to the remembered one. "500 of 3565 files carry the advertising clause" is worth more than "some do", and it was worth the minute it took to count.

Write down the bug that shaped it. Half the non-obvious code in this tree is non-obvious because something failed once. If a design is strange, the strangeness is load-bearing and the reader deserves to know why before changing it.

No dates in headings. A date in a heading turns a description into a changelog, and the description is the thing with a long life. Dates belong in history/, where they mean something.