daniel/danos
1
0
Fork 0
Code Issues 4 Pull Requests Actions Packages Projects 1 Releases Wiki Activity

M4: /sbin/init as PID 1 — a heartbeat process

Browse Source 
init is now a real scheduled ring-3 process: it prints a heartbeat and
sleeps, forever. The kernel spawns it at boot via spawnProcess (its own
address space, preemption on) and the boot context drops to idle — the
system's steady state is "kernel idle, init alive in ring 3", beating
~1 Hz. Adds the sleep(ms) syscall. The init/process tests are reshaped
around the heartbeat (repeated syscalls, still-alive, two concurrent
processes on distinct address spaces). Pins init to LLD and folds the
.large code model's .ltext/.lrodata/.ldata into the linker script so its
code segment is R+X. Removes the now-dead borrowed-thread ELF loader
(runInitElf); spawnProcess is the one path. Docs updated. Suite 28/28.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
Daniel Samson
2026-07-09 00:19:46 +01:00
co-authored by Claude Fable 5
parent 37fb3cb0cf
commit b9d9e1e523
7 changed files with 126 additions and 157 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/kernel/main.zig
+10 -14
View File
@@ -256,28 +256,24 @@ fn kmain(boot_info: *const BootInfo) noreturn {
log.checkpoint(cp_running);
status("kernel initialised.\n");
// Hand over to user space: run /sbin/init (read off the boot volume by the
// loader) in ring 3. Preemption is off for the run — the M1 user-mode path
// publishes *this* core's TSS.rsp0 and must not migrate (the flag is
// global, so the system goes cooperative meanwhile; the other cores are
// idle). init becomes a real schedulable process in M3.
// Hand over to user space: load /sbin/init (read off the boot volume by the
// loader) and spawn it as a real ring-3 process, PID 1. It runs on its own
// address space, preemptively, alongside the kernel — no cooperative
// borrowing. This boot context then becomes the BSP's idle loop.
if (boot_info.init_len != 0) {
status("starting /sbin/init...\n");
const image = @as([*]const u8, @ptrFromInt(danos.physToVirt(boot_info.init_base)))[0..boot_info.init_len];
scheduler.setPreemption(false);
const code = usermode.runInitElf(image);
scheduler.setPreemption(true);
if (code) |c| {
statusPrint("/sbin/init exited with code {d}.\n", .{c});
} else |err| {
usermode.spawnProcess(image, 4) catch |err| {
statusPrint("/sbin/init failed to load: {s}\n", .{@errorName(err)});
}
};
} else {
status("no /sbin/init on the boot volume.\n");
}
status("\nnothing left to do; halting CPU.\n");
// Become the idle task: drop below every real task and halt until an
// interrupt. The timer keeps preempting into init and any other work.
scheduler.setPriority(0);
status("\nkernel idle; /sbin/init is running.\n");
arch.halt();
}
src/kernel/tests.zig
+46 -44
View File
@@ -746,11 +746,12 @@ fn procWorker() void {
sched.exit();
}
/// Real processes: load /sbin/init as a scheduled ring-3 process with its own
/// address space, twice in succession. The first run proves a process executes
/// on its own page tables (write from CPL 3) and coexists preemptively with a
/// kernel task; its exit frees the address space. The second run reuses those
/// reclaimed frames — succeeding proves create/exit/teardown/recreate is sound.
/// Real processes: load /sbin/init as TWO scheduled ring-3 processes, each with
/// its own address space at the same virtual addresses, running concurrently
/// with a kernel task. Both must make heartbeat syscalls from CPL 3 — which can
/// only happen if each runs on its own page tables (CR3 switched correctly per
/// process) and preemption interleaves them with the kernel worker. This is the
/// strongest cheap proof of address-space isolation.
fn processTest(boot_info: *const BootInfo) void {
log("DANOS-TEST-BEGIN: process\n", .{});
check("bootloader handed over sbin/init", boot_info.init_len != 0);
@@ -759,38 +760,30 @@ fn processTest(boot_info: *const BootInfo) void {
return;
}
const image = @as([*]const u8, @ptrFromInt(danos.physToVirt(boot_info.init_base)))[0..boot_info.init_len];
const expected = "init: hello from user space\n";
usermode.write_count = 0;
usermode.write_cs = 0;
proc_worker_run = true;
proc_worker_ran = false;
sched.spawn(procWorker, 4); // kernel task, same priority as the processes
sched.spawn(procWorker, 4); // kernel task at the processes' priority
var runs: u32 = 0;
var last_cs: u64 = 0;
var spawned: u32 = 0;
if (usermode.spawnProcess(image, 4)) spawned += 1 else |_| {}
if (usermode.spawnProcess(image, 4)) spawned += 1 else |_| {}
// Wait (real time) for several heartbeats across the two processes. Each
// process sleeps ~1 s between beats, so a few seconds yields several.
sched.setPriority(1); // drop below the workers so they get the cores
var round: u32 = 0;
while (round < 2) : (round += 1) {
usermode.write_len = 0;
usermode.write_cs = 0;
usermode.exit_code = 0xdead;
usermode.spawnProcess(image, 4) catch {
log("DANOS-PROC: spawn round {d} failed\n", .{round});
continue;
};
var spins: u64 = 0;
while (usermode.exit_code == 0xdead and spins < 5_000_000_000) : (spins += 1) sched.yield();
log("DANOS-PROC: round {d} write_len={d} exit_code=0x{x}\n", .{ round, usermode.write_len, usermode.exit_code });
if (eql(usermode.write_buf[0..usermode.write_len], expected)) {
runs += 1;
last_cs = usermode.write_cs;
}
}
const deadline = arch.millis() + 8000;
while (usermode.write_count < 4 and arch.millis() < deadline) sched.yield();
sched.setPriority(4);
proc_worker_run = false;
check("process ran twice on its own address space (create/exit/recreate)", runs == 2);
check("process wrote from CPL 3 (CS = user selector | RPL 3)", last_cs == 0x23);
check("a kernel task coexisted with the process (preemption)", proc_worker_ran);
log("DANOS-PROC: spawned {d} processes, {d} heartbeats\n", .{ spawned, usermode.write_count });
check("both init processes spawned on their own address spaces", spawned == 2);
check("processes made repeated heartbeat syscalls (>=4)", usermode.write_count >= 4);
check("heartbeats came from CPL 3 (CS = user selector | RPL 3)", usermode.write_cs == 0x23);
check("a kernel task coexisted with the processes (preemption)", proc_worker_ran);
result();
}
@@ -805,9 +798,11 @@ fn userPfTest() void {
log("DANOS-TEST-RESULT: FAIL (user read of kernel memory did not fault)\n", .{});
}
/// The full user-binary path: the bootloader read sbin/init off the boot
/// volume and handed it over; load it as a user ELF and run it in ring 3. The
/// same call the normal boot path makes — here with teeth.
/// The full PID-1 path: the bootloader read sbin/init off the boot volume and
/// handed it over; load it as a user ELF and spawn it as a real ring-3 process
/// — the same call the normal boot path makes — then confirm it beats. init
/// heartbeats forever, so this proves it reaches ring 3, makes repeated syscalls
/// (write + sleep), and stays alive rather than exiting.
fn initTest(boot_info: *const BootInfo) void {
log("DANOS-TEST-BEGIN: init\n", .{});
check("bootloader handed over sbin/init", boot_info.init_len != 0);
@@ -816,19 +811,26 @@ fn initTest(boot_info: *const BootInfo) void {
return;
}
const image = @as([*]const u8, @ptrFromInt(danos.physToVirt(boot_info.init_base)))[0..boot_info.init_len];
sched.setPreemption(false); // see userTest: pins the run to this core's rsp0
const code = usermode.runInitElf(image);
sched.setPreemption(true);
if (code) |c| {
check("init loaded, ran, and exited (user ELF path)", true);
check("init exited cleanly (code 0)", c == 0);
} else |err| {
usermode.write_count = 0;
const spawned = if (usermode.spawnProcess(image, 4)) true else |err| blk: {
log("DANOS-INIT-ERR: {s}\n", .{@errorName(err)});
check("init loaded, ran, and exited (user ELF path)", false);
}
check("init's write arrived intact", eql(usermode.write_buf[0..usermode.write_len], "init: hello from user space\n"));
check("write came from CPL 3 (CS = user selector | RPL 3)", usermode.write_cs == 0x23);
break :blk false;
};
check("init loaded and spawned as a process", spawned);
// Wait (real time) for at least two heartbeats — proving it runs, writes,
// and sleeps repeatedly (init sleeps ~1 s between beats).
sched.setPriority(1);
const deadline = arch.millis() + 8000;
while (usermode.write_count < 2 and arch.millis() < deadline) sched.yield();
sched.setPriority(4);
const prefix = "init: heartbeat";
const beat_ok = usermode.write_len >= prefix.len and eql(usermode.write_buf[0..prefix.len], prefix);
check("init produced repeated heartbeats (>=2)", usermode.write_count >= 2);
check("heartbeat text arrived intact", beat_ok);
check("heartbeats came from CPL 3 (CS = user selector | RPL 3)", usermode.write_cs == 0x23);
check("init is still alive (did not exit)", usermode.exit_code == 0);
result();
}
src/kernel/usermode.zig
+25 -79
View File
@@ -1,19 +1,19 @@
//! Ring-3 execution — the isolation track's first rung (M1). Two entry points:
//! `run` executes a raw code blob (the user/user-pf test programs), and
//! `runInitElf` loads and runs a real user ELF (`/sbin/init`, handed over by
//! the bootloader). Both run at CPL 3 in the current (global) page tables:
//! frames are mapped user-accessible with W^X (code RO+X, data RW+NX), the CPU
//! drops privilege via iretq, and the program talks to the kernel only through
//! the `int $0x80` syscall gate. No processes or per-task address spaces yet —
//! this proves the privilege mechanisms (user descriptors, TSS.rsp0, the U/S
//! page bit, ring transitions) that M3 builds on.
//! Ring-3 execution. Two entry points:
//! - `spawnProcess` loads a user ELF (`/sbin/init`) into a fresh address space
//! and schedules it as a real preemptive ring-3 process on its own page
//! tables. This is the production path.
//! - `run` executes a raw code blob (the user/user-pf test programs) on the
//! *current* kernel context via the borrowed-thread path — a minimal probe of
//! the ring-transition mechanisms, kept for the tests.
//! Both map frames user-accessible with W^X (code RO+X, data RW+NX); the program
//! talks to the kernel only through the syscall instruction (or the int 0x80
//! gate). The shared handler is installed once by `init`.
//!
//! Caller contract (M1 limitations):
//! - enter/exit publishes TSS.rsp0 on the *current* core only, so the caller
//! must prevent migration for the duration — disable preemption around the
//! call (rsp0-per-context-switch arrives with real user tasks in M3).
//! - The kernel-side saved context (`user_saved_rsp` in isr.s) is a single
//! global: at most one core may be inside user mode at a time.
//! Borrowed-path caveat (`run` only): it publishes TSS.rsp0 on the *current*
//! core and uses a single global unwind slot (`user_saved_rsp` in isr.s), so the
//! caller must disable preemption and only one core may be inside it at a time.
//! Real processes (`spawnProcess`) have none of these limits — the scheduler
//! maintains rsp0/CR3 per switch.
const std = @import("std");
const elf = std.elf;
@@ -58,6 +58,7 @@ pub var ping_count: usize = 0;
pub var write_buf: [256]u8 = undefined;
pub var write_len: usize = 0;
pub var write_cs: u64 = 0;
pub var write_count: u64 = 0; // total write syscalls served (for the heartbeat tests)
pub var exit_code: u64 = 0;
/// The M3 syscall surface, dispatched on the saved user rax:
@@ -108,10 +109,10 @@ fn syscall(state: *arch.CpuState) void {
const len = state.rsi;
if (len <= write_buf.len and ptr >= code_virt and ptr <= stack_virt + page_size - len) {
const src: [*]const u8 = @ptrFromInt(ptr);
const n = @min(len, write_buf.len - write_len);
@memcpy(write_buf[write_len..][0..n], src[0..n]);
write_len += n;
@memcpy(write_buf[0..len], src[0..len]); // keep the latest message
write_len = len;
write_cs = state.cs;
write_count += 1;
log.write("DANOS-INIT: ");
log.write(src[0..len]);
state.rax = len;
@@ -128,6 +129,7 @@ fn resetRecords() void {
ping_count = 0;
write_len = 0;
write_cs = 0;
write_count = 0;
exit_code = 0;
}
@@ -191,12 +193,6 @@ const Segment = struct {
}
};
/// Pages mapped for the running init image, for rollback if loading fails
/// midway. On success the mappings stay for the system's life — there's no
/// address-space teardown until real processes exist (M3).
var loaded = [_]struct { virt: u64, frame: u64 }{.{ .virt = 0, .frame = 0 }} ** (max_pages + 1);
var loaded_count: usize = 0;
/// Parse and validate every PT_LOAD before touching memory. Bounds are checked
/// against the image and the user region; segments must be page-aligned,
/// non-overlapping, and W^X (R-only is fine — linkers may emit a headers-only
@@ -261,32 +257,6 @@ fn parseSegments(image: []const u8, segs: *[max_segments]Segment) InitError!stru
return error.BadEntry;
}
/// Map one page of a segment: fresh frame, zero + copy through the identity
/// mapping (the user mapping may be read-only), then the user-visible mapping
/// with the segment's W^X permissions. Records the page for rollback.
fn loadPage(image: []const u8, seg: Segment, page_index: u64) InitError!void {
const frame = pmm.alloc() orelse return error.OutOfMemory;
const dst: [*]u8 = @ptrFromInt(danos.physToVirt(frame));
@memset(dst[0..page_size], 0);
const page_off = page_index * page_size;
if (page_off < seg.filesz) {
const n = @min(page_size, seg.filesz - page_off);
@memcpy(dst[0..n], image[seg.off + page_off ..][0..n]);
}
const virt = seg.vaddr + page_off;
arch.mapUserPage(virt, frame, seg.writable, seg.executable);
loaded[loaded_count] = .{ .virt = virt, .frame = frame };
loaded_count += 1;
}
fn unloadAll() void {
for (loaded[0..loaded_count]) |p| {
arch.unmapPage(p.virt);
pmm.free(p.frame);
}
loaded_count = 0;
}
/// Load one page of a segment into address space `pml4`: a fresh frame, zeroed
/// and filled through the physmap, mapped user-accessible with the segment's W^X.
/// On a later failure the whole address space is torn down, which frees every
@@ -304,11 +274,11 @@ fn loadPageInto(pml4: u64, image: []const u8, seg: Segment, page_index: u64) Ini
}
/// Load a user ELF image into a fresh address space and spawn it as a scheduled
/// ring-3 process at `priority`. Unlike `runInitElf` (the borrowed-thread test
/// path), this returns immediately — the process runs preemptively on its own
/// page tables alongside everything else, and its exit is handled by the syscall
/// layer. The whole build (address space + ELF load + task) runs under the
/// kernel lock so it appears atomically and can't race pmm/heap on another core.
/// ring-3 process at `priority`. Returns immediately — the process runs
/// preemptively on its own page tables alongside everything else, and its exit
/// is handled by the syscall layer. The whole build (address space + ELF load +
/// task) runs under the kernel lock so it appears atomically and can't race
/// pmm/heap on another core.
pub fn spawnProcess(image: []const u8, priority: u3) InitError!void {
var segs: [max_segments]Segment = undefined;
const parsed = try parseSegments(image, &segs);
@@ -328,27 +298,3 @@ pub fn spawnProcess(image: []const u8, priority: u3) InitError!void {
if (!sched.spawnUserLocked(pml4, parsed.entry, stack_virt + page_size, priority))
return error.OutOfMemory;
}
/// Load a user ELF image, run it in ring 3 from its entry point, and return its
/// exit code. Same caller contract as `run` (preemption off, one core). On
/// success the user mappings are left in place — teardown comes with real
/// processes (M3); on a loading error everything is rolled back.
pub fn runInitElf(image: []const u8) InitError!u64 {
var segs: [max_segments]Segment = undefined;
const parsed = try parseSegments(image, &segs);
loaded_count = 0;
errdefer unloadAll();
for (segs[0..parsed.count]) |seg| {
for (0..seg.pages()) |i| try loadPage(image, seg, i);
}
const stack_frame = pmm.alloc() orelse return error.OutOfMemory;
arch.mapUserPage(stack_virt, stack_frame, true, false); // RW + NX
loaded[loaded_count] = .{ .virt = stack_virt, .frame = stack_frame };
loaded_count += 1;
resetRecords();
arch.enterUser(sched.currentCpuIndex(), parsed.entry, stack_virt + page_size);
arch.enableInterrupts(); // the exit arrived through an interrupt gate
return exit_code;
}