SchOS/docs/architecture
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Nexoniarz 9e6d8dd4e3 sockets: a descriptor can cross between processes
sendmsg/recvmsg with SCM_RIGHTS. Item 1 of docs/plan/foundations.md and
mechanism 1 of docs/plan/hybrid.md, which are the same primitive seen from two
directions: Wayland's wl_shm_create_pool passes a file descriptor with no
integer-shaped alternative, and handing a driver process the device it is
allowed to touch is the same act. Both plans stopped here.

Linux's structures byte for byte -- msghdr, cmsghdr, the CMSG_ macros -- because
the programs that need this are not ours. libwayland and toybox both call
recvmsg with Linux's headers and would not notice a friendlier door.

The delivery rule is the whole design. A batch of descriptors is pinned to the
stream position of the first byte of the message that carried it, and that has
two halves: a reader arriving at that position is handed them, and a reader that
has not reached it is stopped SHORT of it. Leave out the second half and a
program asking for 4096 bytes swallows three messages and is handed one
message's descriptors, with nothing in the result saying which. socktest checks
exactly that: two one-byte messages, an eight-byte read, one byte back.

The kernel holds a reference to every descriptor in flight, so a sender may
close its own copy the moment sendmsg returns. Giving that reference back is the
part that leaks if it is not written down, and there are three ways a message
ends:

  - received with room            installed in the receiver's table
  - received without room, or by
    plain read(2)                 closed; MSG_CTRUNC for the first case
  - never received, socket closed closed by sockclose

The middle row looks like a choice and is not: holding kernel references for a
receiver that has proved it is not looking is a leak with extra steps.

No garbage collector. A socket descriptor sent over that same socket and never
received holds a reference to the socket that holds the reference to it, and
neither close reaches zero. Linux carries several hundred lines for this.
Nothing on either plan passes a socket over a socket -- Wayland passes memory,
the driver work passes devices -- so it is a bounded leak that is documented
rather than a silent one.

Fourteen checks in cmd/socktest, and every one moves data through the descriptor
rather than inspecting it. The descriptor passed is always a pipe end, because a
pipe announces its own lifetime: a read of a pipe whose writers are all gone
returns 0, which turns "was the kernel's reference released" -- otherwise
invisible from userspace -- into a value a test can compare.

Two bugs fell out, neither in the new code:

  - sockpair() never set the socket's domain, so every socketpair() socket
    claimed domain 0. Invisible while the data paths asked only whether a socket
    was AF_INET or AF_NETLINK, since zero answers "neither" correctly.
    SCM_RIGHTS asks "is this AF_UNIX", and zero is wrong for that one.

  - pipe_poll() reports POLLHUP but not POLLIN at end of file, so a non-blocking
    read of a pipe whose writers had all gone returned EAGAIN forever instead of
    0 -- a program that polls and reads spins waiting for an end that already
    happened. sockreadable() always had the equivalent condition; the pipe path
    did not. Found because the test helper for "is this descriptor closed" is a
    non-blocking read of a pipe.

projects/schcom/README.md said SCM_RIGHTS was done for a long time while nothing
in the kernel implemented it, and an entire GUI plan was drawn on that line.
It is true now, which is not the same as it having been right, and the README
says so.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VQ7Qx8E1q1M1bbCq8QLHS2
2026-09-13 19:49:37 +02:00
..
boot.md docs: four directories, and a rule for when a thing leaves the roadmap 2026-09-12 17:13:35 +02:00
devices.md docs: four directories, and a rule for when a thing leaves the roadmap 2026-09-12 17:13:35 +02:00
filesystem.md fs: devtmpfs, so /dev is generated rather than written to a disk 2026-09-12 20:18:30 +02:00
graphics.md console: a bare ESC[m is a reset, and OSC sequences are consumed 2026-09-12 19:38:00 +02:00
init.md docs: four directories, and a rule for when a thing leaves the roadmap 2026-09-12 17:13:35 +02:00
kernel.md sockets: a descriptor can cross between processes 2026-09-13 19:49:37 +02:00
networking.md sockets: a descriptor can cross between processes 2026-09-13 19:49:37 +02:00
README.md tty: AltGr+F1..F6 by default, and AltGr+-/+ to step 2026-09-13 13:22:01 +02:00
schfs.md schfs: records at arbitrary offsets are packed, and the compiler is told 2026-09-12 17:56:36 +02:00
syscalls.md sockets: a descriptor can cross between processes 2026-09-13 19:49:37 +02:00
terminals.md tty: AltGr+F1..F6 by default, and AltGr+-/+ to step 2026-09-13 13:22:01 +02:00
usb.md docs: four directories, and a rule for when a thing leaves the roadmap 2026-09-12 17:13:35 +02:00

The system, layer by layer

What SchOS is today. Everything in this directory is built and running; what is merely intended lives in ../plan/.


The names, and what each one covers

uname -s reports SchIFT, the way every Unix reports its kernel rather than its distribution.

Layer Name What it is
System SchOS The distribution — kernel, userland, tooling
Kernel SchIFT Multi-core x86-64 kernel with a modular VFS
Filesystem SchFS Transactional, copy-on-write, the root filesystem
API SchAPI The native programming interface — designed, not built
Compositor Schcom Owns the display; v0 runs

Six virtual terminals sit under all of it -- /dev/tty1..tty6, AltGr+F1..F6 or chvt N -- each with its own screen, line discipline and foreground process group. See terminals.md.


The stack, bottom to top

      ┌─────────────────────────────────────────────────┐
      │  toybox   mksh   musl        first-party cmd/   │   userland
      ├─────────────────────────────────────────────────┤
      │  schinit — PID 1, job manifests, supervision    │
      ├─────────────────────────────────────────────────┤
      │  syscall table — Linux numbering, one .inc file │   ← the ABI seam
      ╞═════════════════════════════════════════════════╡
      │  VFS │ sockets │ signals │ mmap │ poll │ procfs │
      ├──────┴─────────┴─────────┴──────┴──────┴────────┤
      │  SchFS  │  lwIP  │  text/gfx  │  buffer cache   │
      ├─────────┴────────┴────────────┴─────────────────┤
      │  device model — class vtables, bus binding      │
      ├─────────────────────────────────────────────────┤
      │  drivers: xHCI  e1000  virtio-gpu  VBE  IDE  PS/2│
      ├─────────────────────────────────────────────────┤
      │  scheduler │ paging │ traps │ IRQ │ SMP │ DMA   │   SchIFT core
      └─────────────────────────────────────────────────┘
                            ▲
                   UEFI loader (boot/uefi)

The two seams that matter are the syscall table and the device model. Above the first, software is ordinary and portable — musl and toybox are unmodified. Below the second, a driver never names its consumer and a consumer never names a driver.


Where it came from

SchOS began as xv6 and is now mostly something else. What survives from xv6 is the shape of the process table, the sleep/wakeup discipline, and the buffer cache. What has been replaced: the scheduler and trap path (rewritten for x86-64 and for more than one processor), the memory manager, the entire filesystem, the syscall layer, and every driver.

That inheritance is worth knowing when reading the code, because the parts that still look like xv6 follow xv6's conventions and the parts that do not, do not.


The documents

Read in this order if you are new:

boot.md Firmware to the first userspace process. The shortest path through the whole system.
kernel.md Memory, processes, scheduling, traps, signals, SMP.
syscalls.md The one table everything is generated from, and how a musl binary runs unmodified.
filesystem.md The VFS, the buffer cache, mounts, procfs.
schfs.md The copy-on-write root filesystem.
devices.md Buses, classes, binding, and the vtables consumers talk to.
usb.md xHCI, the USB core, and the three class drivers.
graphics.md Framebuffer, text rendering, the console, and PSOGM.
networking.md NIC drivers, lwIP, and both socket families.
init.md schinit and the job manifests.

Three rules that hold across all of it

The kernel and the host tools compile the same SchFS source. mkschfs cannot disagree with the kernel about the on-disk format, because there is only one implementation. Format bugs are found on the host, where a test takes a second instead of a boot.

Syscalls are declared in exactly one place. kernel/sys/table.inc. The constants, the dispatch table and the Linux translation map are all generated from it, so a syscall cannot be half-registered.

A list you can read beats a list assembled by side effects. Drivers are written out by hand in kernel/drivers/registry.c rather than collected by a linker section, and platform devices are registered in one function rather than inside each driver's init. The tradeoff is deliberate: self-registration is nicer to write, and it means the list of what is in your kernel is not written down anywhere you can read.