| Filename | Latest commit message | Latest commit date |
|---|---|---|
"it also doesn't show crash screen on virtio gpu or just other gpu than default
vga" -- true, and on the virtio-gpu it was worse than nothing. The head kept
showing the console from a second before the panic: one screen saying the
kernel is dead, the other showing a shell prompt.
panic() painted into the console framebuffer and stopped there. Two cases were
missing, and they are not the same problem.
**The kernel still drives it.** display_acquire() hands back a buffer; the
report is copied in and presented. Ordinary, and a no-op when the display
class's buffer *is* the console's, so a one-screen machine does not do the work
twice.
**A process drives it.** The hard one, and the one hybrid.md owed an answer
for. The kernel let go of the device deliberately, and the process holding it
will never run again -- there is no scheduling after a panic -- so there is
nobody left to ask. It is not a race that can be won by being careful.
So the userspace driver says where it is scanning out *in advance*:
PCIIOC_PANICFB, registered by vgpud after bring-up and after every modeset. On
a panic the kernel paints the report into that memory and asks the kernel
driver the device was taken from to put it on screen one last time --
`panic_present` in struct pci_driver, which virtio-gpu implements by resetting
the device out from under a driver that is still nominally running. That is
safe here and nowhere else, because nothing is going to run again.
The panic path allocates nothing. It cannot: a corrupted heap is one of the
ways a machine gets here, and an allocator that deadlocks takes the crash
screen *and* the serial log's last chance to be read. So the driver keeps its
BAR mappings across the handover, rebuilds one queue from 20 KB of static
memory, and bounds every spin -- including the reset acknowledge, which is an
unbounded `while` in probe() and correct there.
**The registration is checked like the promise it is.** The range must lie
inside a block that process got from PCIIOC_DMA on that device. Without that,
a claimed device would be a way to nominate any physical address in the machine
-- page tables, kernel text -- to be overwritten with four megabytes of crash
report at the one moment nothing is left to notice. That is a worse bug than
the one this fixes. It goes away with the claim and with the process.
What it buys is worth stating plainly: a device can be evicted to userspace
without the kernel losing its ability to tell you the machine died. The
alternative was a driver boundary that is also a blind spot.
Verified both ways under QEMU with two heads, `echo c > /proc/sysrq`, and a
screendump of each over QMP:
vgpud holding the device both heads byte-identical, serial says
"The report is on the virtio-gpu display too."
kernel holding it same, via display_acquire/display_present
(/proc/pci shows 1af4:1050 [virtio-gpu])
Both supported configurations: one boot each, no traps, no panics, socktest and
memfdtest green.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
|
||
| .. | ||
| boot.md | ||
| debugging.md | ||
| devices.md | ||
| filesystem.md | ||
| graphics.md | ||
| init.md | ||
| kernel.md | ||
| ldls.md | ||
| networking.md | ||
| README.md | ||
| schfs.md | ||
| syscalls.md | ||
| terminals.md | ||
| usb.md | ||
The system, layer by layer
What SchOS is today. Everything in this directory is built and running; what is merely intended lives in ../plan/.
The names, and what each one covers
uname -s reports SchIFT, the way every Unix reports its kernel rather than
its distribution.
| Layer | Name | What it is |
|---|---|---|
| System | SchOS | The distribution — kernel, userland, tooling |
| Kernel | SchIFT | Multi-core x86-64 kernel with a modular VFS |
| Filesystem | SchFS | Transactional, copy-on-write, the root filesystem |
| API | SchAPI | The native programming interface — designed, not built |
| Compositor | Schcom | Owns the display; v0 runs |
Six virtual terminals sit under all of it -- /dev/tty1..tty6, AltGr+F1..F6
or chvt N --
each with its own screen, line discipline and foreground process group. See
terminals.md.
The stack, bottom to top
┌─────────────────────────────────────────────────┐
│ toybox kilo mksh zsh musl first-party cmd/ │ userland
├─────────────────────────────────────────────────┤
│ vgpud — a driver that is an ordinary process │
├─────────────────────────────────────────────────┤
│ schinit — PID 1, job manifests, supervision │
├─────────────────────────────────────────────────┤
│ syscall table — Linux numbering, one .inc file │ ← the ABI seam
╞═════════════════════════════════════════════════╡
│ VFS │ sockets │ signals │ mmap │ poll │ procfs │
├──────┴─────────┴─────────┴──────┴──────┴────────┤
│ SchFS │ lwIP │ vt/gfx │ buffer cache │
├─────────┴────────┴──────────┴───────────────────┤
│ device model — class vtables, bus binding │ ← the driver seam
├─────────────────────────────────────────────────┤
│ /dev/pci — MMIO, DMA and IRQs to a process │ ← the eviction seam
├─────────────────────────────────────────────────┤
│ drivers: xHCI e1000 virtio-gpu VBE IDE PS/2│
├─────────────────────────────────────────────────┤
│ scheduler │ paging │ traps │ IRQ │ SMP │ DMA │ SchIFT core
└─────────────────────────────────────────────────┘
▲
UEFI loader (boot/uefi)
Three seams matter. Above the syscall table, software is ordinary and
portable — musl and toybox are unmodified. Below the device model, a driver
never names its consumer and a consumer never names a driver. And at
/dev/pci, a driver stops having to be in the kernel at all: a process is
handed a device's registers, DMA memory and interrupts, and the in-kernel driver
that held it releases it cleanly. vgpud is the virtio-gpu driver living out
there today. See ../plan/hybrid.md.
Where it came from
SchOS began as xv6 and is now mostly something else. What survives from xv6 is the shape of the process table, the sleep/wakeup discipline, and the buffer cache. What has been replaced: the scheduler and trap path (rewritten for x86-64 and for more than one processor), the memory manager, the entire filesystem, the syscall layer, and every driver.
That inheritance is worth knowing when reading the code, because the parts that still look like xv6 follow xv6's conventions and the parts that do not, do not.
The documents
Read in this order if you are new:
| boot.md | Firmware to the first userspace process. The shortest path through the whole system. |
| kernel.md | Memory, processes, scheduling, traps, signals, SMP. |
| syscalls.md | The one table everything is generated from, and how a musl binary runs unmodified. |
| filesystem.md | The VFS, the buffer cache, mounts, procfs. |
| schfs.md | The copy-on-write root filesystem. |
| devices.md | Buses, classes, binding, and the vtables consumers talk to. |
| usb.md | xHCI, the USB core, and the three class drivers. |
| graphics.md | Framebuffer, text rendering, the console, and PSOGM. |
| terminals.md | The six virtual terminals, and the chord that switches them. |
| networking.md | NIC drivers, lwIP, and both socket families. |
| init.md | schinit, PID 1 as a role, and the job manifests. |
| debugging.md | Symbols, a log that outlives the kernel, and asking the kernel a question. |
| ldls.md | Running somebody else's drivers: a Linux .ko, in a process, reaching hardware through /dev/pci. |
Three rules that hold across all of it
The kernel and the host tools compile the same SchFS source. mkschfs
cannot disagree with the kernel about the on-disk format, because there is only
one implementation. Format bugs are found on the host, where a test takes a
second instead of a boot.
Syscalls are declared in exactly one place. kernel/sys/table.inc.
The constants, the dispatch table and the Linux translation map are all
generated from it, so a syscall cannot be half-registered.
A list you can read beats a list assembled by side effects. Drivers are
written out by hand in kernel/drivers/registry.c rather than collected by a
linker section, and platform devices are registered in one function rather than
inside each driver's init. The tradeoff is deliberate: self-registration is
nicer to write, and it means the list of what is in your kernel is not written
down anywhere you can read.