Robert Allan JamesandClaude Opus 5.5
56da55aba9
sk_vm_switch_entry() stops being the Stage-2 placeholder bounce and becomes every switch participant's own idle loop: it drains one of its own kernel-Hermes messages per pass, on its own native stack (driven by the drain's return value, so a non-consuming drain cannot spin), and when nothing is drained it marks the VM parked_idle and yields back. It is entirely OS-driven, with no VM-side yield word. sk_hermes_drain_checkpoint() gains a per-VM hermes_draining guard so a payload's own in-word checkpoint cannot drain a second message inside the first. Still inert in normal operation: nothing marks work until Stage C. Finding fixed here: amd64 sk_vm_switch_prime built the first-entry frame at top-56, entering with rsp 16-aligned instead of the SysV-required 8 mod 16, so the first aligned SSE spill in a callee took #GP (logs/20260923-142526, kept). It had been latent since SXXVIII Stage 2 because the placeholder never called anything. The frame is now at top-64 with a zeroed pad slot. aarch64 and riscv64 were already correct. Evidence: a temporary kernel_main probe (reverted, not in this commit) queued two messages to Hestia, the first calling a colon word, and switched into her. It passed on all three ISAs: 0 pending, parked_idle, depth 0, context saved on her own stack, SB-SEQ=12 (drained one at a time, not nested), ledger and stadium_conserved restored. Formal acceptance without the probe on all three ISAs: dict_hash identical and unchanged, zero UNKNOWN WORD or faults, and the live WIREBIND mint -> USE -> 1 2 + . -> 3 relay. FABRIC-3.8.md also records Captain Bob's rulings that no VM-side word ever gives up control and that multitasking is a compudynamic hybrid, and opens SS3.12 (VM frames for per-VM execution state). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
180 lines
8.2 KiB
C
180 lines
8.2 KiB
C
/*
|
||
StarForth — Steady-State Virtual Machine Runtime
|
||
|
||
Copyright (c) 2023–2025 Robert A. James
|
||
All rights reserved.
|
||
|
||
This file is part of the StarForth project.
|
||
|
||
Licensed under the StarForth License, Version 1.0 (the "License");
|
||
you may not use this file except in compliance with the License.
|
||
|
||
You may obtain a copy of the License at:
|
||
https://github.com/star.4th@proton.me/StarForth/LICENSE.txt
|
||
|
||
This software is provided "AS IS", WITHOUT WARRANTY OF ANY KIND,
|
||
express or implied, including but not limited to the warranties of
|
||
merchantability, fitness for a particular purpose, and noninfringement.
|
||
|
||
See the License for the specific language governing permissions and
|
||
limitations under the License.
|
||
*/
|
||
|
||
/**
|
||
* switch.c - Cooperative VM context switch glue (FABRIC-3.md §XXVIII,
|
||
* Stage 2, 2026-09-13). See switch.h for the contract.
|
||
*/
|
||
|
||
#ifdef __STARKERNEL__
|
||
|
||
#include "starkernel/vm/switch.h"
|
||
#include "vm.h"
|
||
#include "starkernel/capsule_birth.h" /* capsule_vm_set_state */
|
||
#include "starkernel/vm/kernel_hermes.h" /* FABRIC-3.8.md §3.2 -- sk_hermes_drain_checkpoint() */
|
||
#include "starkernel/hal/hal.h" /* sk_hal_panic() */
|
||
#include <stdint.h>
|
||
|
||
/* Arch-specific (switch.S in each arch dir). sk_vm_switch_prime() builds
|
||
* the exact synthetic first-entry frame sk_vm_switch_to() expects -- kept
|
||
* in assembly, not duplicated here, so the layout can never drift out of
|
||
* sync between the two. */
|
||
extern void sk_vm_switch_to(uint64_t *save_sp_out, uint64_t new_sp);
|
||
extern uint64_t sk_vm_switch_prime(uint64_t stack_top, void *entry);
|
||
|
||
/* Single-writer-mainline global, safe under this stage's cooperative-only,
|
||
* one-VM-runs-at-a-time-on-one-hart discipline (same class of bookkeeping
|
||
* as vm_core.c's g_log_attrib_vm) -- identifies which VM a freshly-primed
|
||
* native stack belongs to. Read exactly once, synchronously, at the very
|
||
* top of sk_vm_switch_entry() before any other first-entry could occur.
|
||
* Safe to keep as a plain global (unlike the old g_switch_back_to this
|
||
* file used to also carry -- see native_switch_back_to's own doc comment
|
||
* in vm.h for why that one had to move to per-VM state): a VM's identity
|
||
* never changes across the lifetime of its own trampoline instance, only
|
||
* who most recently switched into it does. */
|
||
static VM *g_switch_entry_vm;
|
||
|
||
/* FABRIC-3.md §XXVIII Stage 3 follow-on (2026-09-14): which VM is
|
||
* currently running, from the switch mechanism's own point of view --
|
||
* independent of vm_log_attributed_vm() (vm_core.c), which is scoped to
|
||
* nested vm_interpret() calls for log-source attribution and has no way
|
||
* to know a VM is "running" while parked inside this file's own raw C
|
||
* trampoline (sk_vm_switch_entry()), never itself calling vm_interpret().
|
||
* sk_vm_switch_signal_tick() (capsule_vm_switch_signal.c) consults this
|
||
* instead of vm_log_attributed_vm() for exactly that reason -- see its
|
||
* own updated comment. Single-writer-mainline, same discipline as
|
||
* g_switch_entry_vm above: set unconditionally on every switch, by the
|
||
* only code path that can ever change who is physically running.
|
||
* Seeded once at boot via sk_vm_switch_set_current() for whichever VM is
|
||
* running before any switch has ever happened (Hera, at Stage 3
|
||
* registration time -- kernel_main.c). */
|
||
static VM *g_switch_current_vm;
|
||
|
||
VM *sk_vm_switch_current_vm(void) { return g_switch_current_vm; }
|
||
|
||
void sk_vm_switch_set_current(VM *vm) { g_switch_current_vm = vm; }
|
||
|
||
/**
|
||
* sk_vm_switch_entry - trampoline for a VM's first-ever entry.
|
||
*
|
||
* A freshly-entered VM has no production behavior defined yet -- what a
|
||
* switched-to VM should actually DO once running is later-stage work
|
||
* (message dispatch, an idle loop, whatever Stage 3+ needs). For now this
|
||
* is a minimal, permanent placeholder: immediately yield back to whoever
|
||
* most recently switched to it, forever. Reads self->native_switch_back_to
|
||
* fresh every iteration (not a value captured once) so a later switch-in
|
||
* from a different VM is honored, not silently bounced to whoever entered
|
||
* first. Must never fall off the end -- there is no legitimate return
|
||
* address below a synthetic first-entry frame, unlike an ordinary
|
||
* function.
|
||
*
|
||
* FABRIC-3.md §XXVIII Stage 3 follow-on (2026-09-14): an attempt to make
|
||
* this attributable by calling vm_interpret(self, "MSG-TICK") here was
|
||
* tried and reverted -- it introduced a second, distinct hang (a stall in
|
||
* sk_repl_headless_wait()'s WIREBIND-attachment wait, not root-caused) in
|
||
* place of the switch-storm it was meant to fix. The switch-storm's real
|
||
* cause (sk_vm_switch_signal_tick()'s "who is current" check via
|
||
* vm_log_attributed_vm() never seeing a VM that only ever runs this raw
|
||
* C trampoline) is instead fixed at the source in switch.c/
|
||
* capsule_vm_switch_signal.c: sk_vm_context_switch() now tracks "current"
|
||
* itself, independent of vm_interpret()'s own attribution bookkeeping.
|
||
* This placeholder's behavior is therefore unchanged from Stage 2.
|
||
*/
|
||
/*
|
||
* FABRIC-3.8.md §3.2 (Stage B, 2026-09-23): the placeholder above is
|
||
* superseded -- this trampoline is now every switch participant's own
|
||
* kernel-side idle loop, the base of its native stack. Entirely OS-driven:
|
||
* nothing a VM executes decides to give up control (Captain Bob: "no
|
||
* special words saying I'm giving up control... strictly all operating
|
||
* system and strictly all compudynamically driven"). Each pass:
|
||
*
|
||
* - Drain one of this VM's own kernel-Hermes messages, in its own
|
||
* context, on its own stack (sk_hermes_drain_checkpoint() at depth 0
|
||
* here, so the payload runs at this VM's depth 1 and its own word
|
||
* checkpoints pass the Stage A ownership gate).
|
||
* - If nothing was drained, this VM has no work: mark it parked-idle
|
||
* (§3.5 -- nothing borrowed on its stack, nothing in progress) and
|
||
* yield back to whoever switched in.
|
||
*
|
||
* Driven off the drain's return value, never a separate pending-count
|
||
* probe: any path where a drain returns without consuming a message would
|
||
* otherwise spin here forever with no word checkpoint to break it --
|
||
* indistinguishable from a switch storm. A failed yield is a kernel
|
||
* invariant violation, not something to retry, so it panics loudly.
|
||
*
|
||
* Deliberately NOT here yet (FABRIC-3.8.md §3.11, a Stage C design
|
||
* question): this point between messages is also a clean switch point
|
||
* (own stack, depth 0), and the compudynamic switch decision should be
|
||
* consulted here too, so a VM with a queue of checkpoint-free payloads
|
||
* cannot hold the CPU indefinitely.
|
||
*/
|
||
void sk_vm_switch_entry(void) {
|
||
VM *self = g_switch_entry_vm;
|
||
for (;;) {
|
||
if (sk_hermes_drain_checkpoint(self) != 0) {
|
||
continue; /* consumed one message (1 = ok, -1 = payload erred) */
|
||
}
|
||
self->parked_idle = 1;
|
||
if (!self->native_switch_back_to ||
|
||
sk_vm_context_switch(self, self->native_switch_back_to) != 0) {
|
||
sk_hal_panic("switch trampoline: idle yield failed");
|
||
}
|
||
self->parked_idle = 0; /* resumed: someone switched back in */
|
||
}
|
||
}
|
||
|
||
int sk_vm_context_switch(VM *from, VM *to) {
|
||
uint64_t new_sp;
|
||
|
||
if (!from || !to || to->native_stack_top == 0) {
|
||
return -1;
|
||
}
|
||
|
||
/* Recorded unconditionally (first-ever entry or a resume) so whoever
|
||
* is parked at `to`'s native stack -- most often this placeholder
|
||
* trampoline -- always knows who most recently switched into it. */
|
||
to->native_switch_back_to = from;
|
||
|
||
if (to->native_stack_saved_sp == 0) {
|
||
/* First-ever entry: synthesize the initial frame. */
|
||
g_switch_entry_vm = to;
|
||
new_sp = sk_vm_switch_prime(to->native_stack_top, (void *)&sk_vm_switch_entry);
|
||
} else {
|
||
new_sp = to->native_stack_saved_sp;
|
||
to->native_stack_saved_sp = 0; /* about to be running, not parked */
|
||
}
|
||
|
||
capsule_vm_set_state(to->stadium_vm_id, VM_STATE_LIVE);
|
||
capsule_vm_set_state(from->stadium_vm_id, VM_STATE_SWITCHED_OUT);
|
||
g_switch_current_vm = to;
|
||
|
||
sk_vm_switch_to(&from->native_stack_saved_sp, new_sp);
|
||
|
||
/* Resumes here only once something later switches back to `from` --
|
||
* from `from`'s own point of view, this call simply took a while. */
|
||
capsule_vm_set_state(from->stadium_vm_id, VM_STATE_LIVE);
|
||
g_switch_current_vm = from;
|
||
return 0;
|
||
}
|
||
|
||
#endif /* __STARKERNEL__ */
|