Tulio A M Mendes [Thu, 12 Feb 2026 07:32:51 +0000 (04:32 -0300)]
feat: /dev/kbd raw scancode device for game input (DOOM)
Added raw scancode ring buffer to the keyboard driver. The HAL
keyboard layer now fires a second callback with the unprocessed
scancode byte (both key-press and key-release events).
- hal/keyboard.h: added hal_keyboard_scan_cb_t and setter
- hal/x86/keyboard.c: fires g_scan_cb before ASCII translation
- drivers/keyboard.c: raw scancode buffer + /dev/kbd device node
registered via devfs (non-blocking read returns raw scancodes)
- init.c: calls keyboard_register_devfs() after devfs is mounted
DOOM can now open /dev/kbd and read raw PS/2 scancodes to detect
key press/release events without TTY line buffering.
Tulio A M Mendes [Thu, 12 Feb 2026 07:26:30 +0000 (04:26 -0300)]
feat: /dev/fb0 framebuffer device + fd-backed mmap support
Added /dev/fb0 device node registered via devfs by vbe.c:
- ioctl: FBIOGET_VSCREENINFO (resolution, bpp), FBIOGET_FSCREENINFO
(phys addr, pitch, size)
- mmap: maps physical framebuffer into userspace with NOCACHE flags
- read/write: direct pixel buffer access via offset
Extended syscall_mmap_impl to support fd-backed mmap: when
MAP_ANONYMOUS is not set, the file descriptor's node->mmap callback
is invoked. This enables userspace to mmap /dev/fb0 for direct
framebuffer access (required for DOOM).
Marked syscall_mmap_impl as noinline to prevent GCC from merging it
into syscall_handler (4KB kernel stack limit).
Tulio A M Mendes [Thu, 12 Feb 2026 07:11:59 +0000 (04:11 -0300)]
refactor: add ioctl/mmap callbacks to fs_node_t, decouple ioctl dispatch
Added ioctl and mmap function pointers to fs_node_t for generic
device dispatch. Refactored syscall_ioctl_impl to call node->ioctl
instead of hardcoding TTY/PTY dispatch by inode number.
- tty.c: added tty_devfs_ioctl wrapper, set on console/tty nodes
- pty.c: added pty_slave_ioctl_fn wrapper, set on all slave nodes
- syscall.c: ioctl now dispatches generically through node callback
This prepares the VFS for /dev/fb0 and other devices that need
ioctl and mmap support.
Tulio A M Mendes [Thu, 12 Feb 2026 07:04:21 +0000 (04:04 -0300)]
refactor: extract generic VMM wrappers from x86 implementation to src/mm/vmm.c
Moved vmm_protect_range(), vmm_as_activate(), and vmm_as_map_page()
from src/arch/x86/vmm.c to src/mm/vmm.c. These functions contain only
architecture-independent logic (looping over pages, delegating to HAL
for address space switching).
The x86-specific VMM code (PAE page table manipulation, recursive
mapping, CoW handling, address space create/destroy/clone) remains
in src/arch/x86/vmm.c where it belongs.
This ensures new architectures only need to implement the core
primitives (vmm_init, vmm_map_page, vmm_unmap_page, vmm_set_page_flags,
vmm_as_create_kernel_clone, vmm_as_destroy, vmm_as_clone_user,
vmm_as_clone_user_cow, vmm_handle_cow_fault) and get the wrapper
functions for free.
Tulio A M Mendes [Thu, 12 Feb 2026 07:01:14 +0000 (04:01 -0300)]
refactor: decouple DevFS from TTY/PTY drivers via device registration API
Added devfs_register_device() API so device drivers register their own
fs_node_t with DevFS. DevFS is now a generic device registry that
dispatches through function pointers — it no longer includes tty.h or
pty.h and has zero knowledge of TTY/PTY internals.
- tty.c: registers /dev/console and /dev/tty with VFS-compatible wrappers
- pty.c: registers /dev/ptmx and /dev/pts (with finddir/readdir moved
from devfs.c)
- devfs.c: only owns built-in devices (null, zero, random, urandom);
all other devices come from the registry
This enables any future driver to register device nodes without
modifying devfs.c.
Tulio A M Mendes [Thu, 12 Feb 2026 06:46:40 +0000 (03:46 -0300)]
refactor: move lwIP port headers from src/net/lwip_port/ to include/net/
Moved lwipopts.h and arch/cc.h to include/net/ where they belong
alongside other public headers. Updated Makefile include path from
-Isrc/net/lwip_port to -Iinclude/net.
Also fixed cc.h to use arch-conditional BYTE_ORDER instead of
hardcoding x86 little-endian, supporting ARM, RISC-V, and MIPS
targets.
Tulio A M Mendes [Thu, 12 Feb 2026 06:37:06 +0000 (03:37 -0300)]
refactor: extract x86 CMOS I/O from drivers/rtc.c to HAL layer
Created include/hal/rtc.h with generic HAL RTC interface and
src/hal/x86/rtc.c with x86 CMOS port I/O implementation.
src/drivers/rtc.c is now fully architecture-agnostic: it calls
hal_rtc_read_raw() for hardware access and keeps only the generic
BCD-to-binary conversion and UNIX timestamp calculation logic.
This follows the same HAL pattern used by timer, keyboard, uart,
and video drivers.
Tulio A M Mendes [Thu, 12 Feb 2026 06:25:39 +0000 (03:25 -0300)]
fix: add timeout to UART busy-wait in hal_uart_putc()
The UART transmit loop now gives up after ~100k iterations instead
of spinning forever. This prevents the kernel from hanging with
the console spinlock held if the UART hardware is unresponsive,
which would otherwise deadlock all CPUs attempting kprintf (including
panic and debug output paths).
PID 0 previously used the boot stack from assembly (_stack_top),
which is not heap-managed. This caused two issues:
- TSS esp0 was not updated when switching to PID 0 (kernel_stack
was NULL, so the guard in schedule() skipped the update)
- If PID 0 were ever reaped or its stack freed, it would corrupt
memory since the boot stack is not a kmalloc'd block
Now process_init() allocates a 4KB kernel stack via kmalloc and
sets TSS esp0 to its top, matching the pattern used by all other
processes.
Tulio A M Mendes [Thu, 12 Feb 2026 06:21:08 +0000 (03:21 -0300)]
fix: save/restore EFLAGS in context_switch instead of forcing sti after schedule()
context_switch now uses pushf/popf to properly save and restore the
EFLAGS register (including the IF bit) across context switches.
This replaces the unconditional hal_cpu_enable_interrupts() call
after context_switch in schedule(), which broke the interrupt-state
semantics for callers that needed atomicity.
All process creation functions (fork, clone, kernel thread) now push
EFLAGS=0x202 (IF=1) onto the initial stack so new processes start
with interrupts enabled via popf in context_switch.
Kernel socket subsystem over lwIP TCP/UDP PCBs with ring-buffer RX,
wait queues for blocking ops, and fd integration via sentinel file
structs (flags=0x534F434B).
Socket dispatch extracted to separate noinline function to prevent
syscall_handler stack overflow that caused heap corruption.
- include/waitqueue.h: reusable waitqueue_t with wq_init/push/pop/wake_one/wake_all
- src/kernel/tty.c: refactored to use waitqueue_t instead of ad-hoc arrays
- src/kernel/pty.c: refactored to use waitqueue_t instead of ad-hoc arrays
- Removed duplicate waitq_push/waitq_pop/waitq_empty/waitq_wake_one from both files
- cppcheck clean, 19/19 smoke tests pass
Tulio A M Mendes [Tue, 10 Feb 2026 12:55:26 +0000 (09:55 -0300)]
feat: multiple PTY pairs (up to 8 dynamic /dev/pts/N)
Refactored PTY subsystem from single global pair to array of up to 8 pairs:
- New pty_pair struct with per-pair buffers, waitqueues, session/pgrp
- pty_alloc_pair() allocates new pairs dynamically
- Inode encoding: masters=100+N, slaves=200+N
- pty_get_master_node()/pty_get_slave_node() return per-pair fs_node_t
- All _idx() variants for indexed pair access
- Old single-pair API preserved as wrappers around pair 0
- devfs /dev/pts/ now lists all active pairs dynamically
- syscall.c poll/nonblock/ioctl updated to use pty_is_master_ino/pty_is_slave_ino
- cppcheck clean, 19/19 smoke tests pass
Tulio A M Mendes [Tue, 10 Feb 2026 11:38:03 +0000 (08:38 -0300)]
fix: 5 HIGH severity bugs from audit
2.3: Slab allocator now uses kmalloc(PAGE_SIZE) instead of
pmm_alloc_page + hal_mm_phys_to_virt. The old approach could
map physical addresses above 16MB to VAs that collide with the
heap range (0xD0000000+), causing silent memory corruption.
3.3: execve now validates sp against stack base before each write.
Prevents writing below the user stack page if E2BIG pre-check
is somehow bypassed. Returns -E2BIG on underflow.
3.4: SMEP (Supervisor Mode Execution Prevention) enabled in CR4
if CPU supports it. Prevents kernel from executing user-mapped
pages, blocking a common exploit technique. SMAP detection added
but not enabled yet (requires STAC/CLAC in uaccess.c first).
CPUID leaf 7 detection added for SMEP (bit 7) and SMAP (bit 20).
4.1: Kernel heap now grows dynamically from 10MB up to 64MB max.
When kmalloc can't find a free block, kheap_grow maps new
physical pages at the end of the heap and creates a new free
block. Coalesces with tail if adjacent and free.
2.4: process_waitpid circular list traversal now checks for NULL
before comparing to start, preventing NULL deref if the list
is broken by concurrent reaping.
Tulio A M Mendes [Tue, 10 Feb 2026 11:29:36 +0000 (08:29 -0300)]
fix: 4 CRITICAL security/race bugs from audit
3.1: user_range_ok weak default now rejects kernel addresses (>= 0xC0000000)
Prevents privilege escalation via syscall arguments on non-x86 fallback.
3.2: sigreturn sanitizes eflags — clears IOPL bits, ensures IF set.
Prevents userspace from gaining port I/O access via crafted sigframe.
2.1: PMM bitmap/refcount now protected by spinlock_t pmm_lock.
Prevents SMP race where two CPUs could allocate the same physical frame.
All public PMM functions (alloc, free, mark_region, incref, decref,
get_refcount) now use spin_lock_irqsave/spin_unlock_irqrestore.
2.2: file->refcount now uses __sync_fetch_and_add / __sync_sub_and_fetch.
Prevents use-after-free in fork/dup/dup2/dup3/close when timer IRQ
fires and schedule() runs process_close_all_files_locked concurrently.
Tulio A M Mendes [Tue, 10 Feb 2026 11:07:09 +0000 (08:07 -0300)]
feat: deep code audit + testing infrastructure (sparse, expect, host unit tests)
Deep Code Audit (docs/AUDIT_REPORT.md):
- 18 findings across 4 categories: layer violations, logic/race
conditions, security vulnerabilities, memory management
- CRITICAL: user_range_ok weak default allows kernel addr access
- CRITICAL: sigreturn allows IOPL escalation via eflags
- CRITICAL: PMM bitmap has no locking (SMP race)
- CRITICAL: file refcount manipulation not atomic
- HIGH: slab allocator hal_mm_phys_to_virt can hit heap VA
- HIGH: execve writes to user stack bypassing copy_to_user
- Full summary table with severity, category, location
Testing Infrastructure:
- make check — cppcheck + sparse (kernel-oriented semantic checker)
- make analyzer — gcc -fanalyzer (interprocedural analysis)
- make test — QEMU + expect automated smoke test (19 checks)
- make test-1cpu — single-CPU regression (50s timeout)
- make test-host — 28 host-side unit tests for pure functions
(itoa, itoa_hex, atoi, path_normalize, align)
- make test-all — all of the above
Testing Plan (docs/TESTING_PLAN.md):
- Layer 1: Static analysis (cppcheck + sparse + gcc -fanalyzer)
- Layer 2: QEMU + expect automated regression
- Layer 3: QEMU + GDB scripted debugging (future)
- Layer 4: Host-side unit tests for pure functions
All tests passing: 19/19 smoke, 28/28 unit, cppcheck clean.
Tulio A M Mendes [Tue, 10 Feb 2026 10:37:38 +0000 (07:37 -0300)]
feat: Fase 9 — ATA Bus Master IDE DMA for read/write
Implement Bus Master IDE DMA as a transparent upgrade over PIO:
- New ata_dma.c: Bus Master IDE DMA driver for PIIX3 IDE controller
- Finds IDE controller via PCI class 0x01:0x01
- Reads BAR4 for Bus Master I/O base, enables PCI bus mastering
- Allocates PRDT and bounce buffer pages at dedicated VAs
(0xC0220000/0xC0221000) to avoid heap VA collisions
- Polling-based DMA completion (BSY clear + BM Active clear)
- IRQ 14 handler with dma_active flag to prevent race between
IRQ handler and polling loop on ATA status register
- spin_lock (not irqsave) for serialization — PIIX3 requires
interrupt delivery for DMA completion signaling
- Modified ata_pio.c: transparent DMA upgrade
- ata_pio_init_primary_master registers IRQ 14 handler early
(before IDENTIFY) to prevent INTRQ storm
- Calls ata_dma_init after IDENTIFY to probe for DMA capability
- ata_pio_read28/write28 delegate to DMA when available,
fall back to PIO if DMA init failed
- New include/ata_dma.h: public API header
Key bugs fixed during development:
- hal_mm_phys_to_virt can map PMM pages into heap VA range
(phys 0x10000000 -> virt 0xD0000000 = heap base) — use
dedicated VAs instead
- ATA INTRQ must be deasserted by reading status register;
without IRQ handler, unacknowledged INTRQ causes interrupt storm
- nIEN must be cleared before DMA so device asserts INTRQ
- DMA direction bit must be set before Start bit per ATA spec
Tested: 4-CPU (25s) and 1-CPU (45s) pass all init.elf tests
including diskfs getdents and /persist/counter.
Tulio A M Mendes [Tue, 10 Feb 2026 09:26:46 +0000 (06:26 -0300)]
feat: Fase 8a — Per-CPU data infrastructure with GS-segment access
New files:
- include/arch/x86/percpu.h — Per-CPU data structure and GS-based
accessors (percpu_get, percpu_cpu_index, percpu_current, etc.)
- src/arch/x86/percpu.c — Per-CPU init: creates GDT entries for each
CPU's GS segment pointing to its percpu_data instance
Changes:
- include/arch/x86/smp.h: Split smp_init into smp_enumerate() and
smp_start_aps() to allow percpu_init between enumeration and SIPI
- src/arch/x86/smp.c: Implement two-phase SMP init
- include/arch/x86/gdt.h: Export gdt_ptr struct, gp variable, and
gdt_set_gate_ext() for per-CPU GDT entry creation
- src/arch/x86/gdt.c: Expand GDT from 6 to 24 entries (6 base +
up to 16 per-CPU GS segments). Add gdt_set_gate_ext(). Make gp
non-static.
- src/arch/x86/arch_platform.c: Call smp_enumerate() -> percpu_init()
-> percpu_setup_gs(0) -> smp_start_aps() in correct order
Boot sequence for per-CPU setup:
1. smp_enumerate() — populate cpu_info from ACPI MADT
2. percpu_init() — create GDT entries for each CPU's GS segment
3. percpu_setup_gs(0) — BSP loads its own GS selector
4. smp_start_aps() — send INIT-SIPI-SIPI; each AP calls
percpu_setup_gs(i) during its init
Passes: make, cppcheck, QEMU smoke test (-smp 1 and -smp 4)
Tulio A M Mendes [Tue, 10 Feb 2026 09:16:11 +0000 (06:16 -0300)]
feat: Fase 7 — ACPI MADT parser + SMP AP bootstrap (INIT-SIPI-SIPI)
New files:
- include/arch/x86/acpi.h — ACPI RSDP/RSDT/MADT structures and API
- include/arch/x86/smp.h — SMP per-CPU info and bootstrap API
- src/arch/x86/acpi.c — ACPI table parser: find RSDP in EBDA/BIOS ROM,
parse RSDT, extract MADT entries (LAPIC, IOAPIC, ISO). Uses temporary
VMM mappings for tables above the 16MB identity-mapped range.
- src/arch/x86/smp.c — SMP bootstrap: copy 16-bit trampoline to 0x8000,
patch GDT/CR3/stack/entry, send INIT-SIPI-SIPI per AP, wait for ready.
- src/arch/x86/ap_trampoline.S — 16-bit real-mode AP entry point:
load GDT, enable protected mode, far-jump to 32-bit, load CR3,
enable paging, jump to C ap_entry().
Changes:
- include/arch/x86/lapic.h: Add lapic_send_ipi(), rdmsr(), wrmsr() decls
- src/arch/x86/lapic.c: Implement lapic_send_ipi() using ICR_HI/ICR_LO
with delivery-status polling. Make rdmsr/wrmsr non-static.
- include/arch/x86/gdt.h: Export struct gdt_ptr and gp variable
- src/arch/x86/gdt.c: Make gp non-static for AP trampoline access
- src/arch/x86/linker.ld: Include .ap_trampoline section in .rodata
- src/arch/x86/arch_platform.c: Call acpi_init() then smp_init() after
LAPIC/IOAPIC setup
- src/arch/x86/idt.c: Move IRQ EOI before handler callback (critical fix:
schedule() in timer handler context-switches away, blocking LAPIC if
EOI is deferred). Add IDT gate + ISR stub for spurious vector 255.
- src/arch/x86/interrupts.S: Add ISR_NOERRCODE 255 stub
Key design decisions:
- Trampoline at fixed phys 0x8000, data area at 0x8F00
- APs share BSP's page directory (same CR3)
- APs enable their own LAPIC and halt (idle loop for now)
- ACPI tables mapped via temporary VMM window at 0xC0202000
- Each AP gets a 4KB kernel stack from static array
Tested: -smp 1 (single CPU, all init tests OK)
-smp 4 (4 CPUs started, all init tests OK)
Passes: make, cppcheck, QEMU smoke test
New files:
- include/arch/x86/lapic.h — LAPIC register definitions and API
- include/arch/x86/ioapic.h — IOAPIC register definitions and API
- src/arch/x86/lapic.c — Local APIC driver: init, EOI, MMIO access,
timer calibration via PIT channel 2, pic_disable()
- src/arch/x86/ioapic.c — I/O APIC driver: init, IRQ routing,
mask/unmask per-IRQ line
Changes:
- vmm.h: Add VMM_FLAG_PWT, VMM_FLAG_PCD, VMM_FLAG_NOCACHE for MMIO
- vmm.c: Translate PWT/PCD flags to x86 PTE bits in vmm_flags_to_x86
- arch_platform.c: Init LAPIC+IOAPIC after syscall_init, route ISA
IRQs (timer=32, kbd=33, ATA=46) through IOAPIC, disable PIC only
after IOAPIC routes are live
- idt.c: Send EOI BEFORE handler callback (critical: schedule() in
timer handler context-switches away; deferred EOI blocks LAPIC).
Add IDT gate for spurious vector 255; skip EOI for spurious
interrupts per Intel spec.
- interrupts.S: Add ISR stub for vector 255 (LAPIC spurious)
- timer.c: Use LAPIC periodic timer when available, fallback to PIT
Key design decisions:
- LAPIC MMIO mapped at 0xC0200000 (above kernel _end, below heap)
- IOAPIC MMIO mapped at 0xC0201000
- Both mapped with PCD+PWT (cache-disable) to prevent MMIO caching
- PIC disabled only AFTER IOAPIC routes configured (avoids IRQ gap)
- EOI sent before handler to prevent LAPIC starvation on context switch
- Spurious vector 255 has IDT entry but no EOI (Intel requirement)
- LAPIC timer calibrated against PIT channel 2 (~10ms measurement)
Bugs fixed during development:
- VA 0xC0100000 overlapped kernel text — moved to 0xC0200000
- pic_disable() inside lapic_init() caused IRQ gap — moved to caller
- EOI after handler blocked LAPIC when schedule() context-switched
- Missing IDT entry for vector 255 caused triple fault on spurious IRQ
Passes: make, cppcheck, QEMU smoke test (all init tests OK).
Tulio A M Mendes [Tue, 10 Feb 2026 08:13:16 +0000 (05:13 -0300)]
fix: audit and correct bugs in Fases 1-4
Fase 1 (CPUID):
- cpuid.c: Replace strict-aliasing-violating uint32_t* casts for
vendor string with memcpy() to avoid UB
- cpuid.c: Increase itoa tmp buffer from 4 to 12 bytes to prevent
potential overflow with larger APIC IDs
Fase 2 (Spinlock): No bugs found — TTAS + cpu_relax + barriers OK
Fase 3 (SYSENTER):
- sysenter.S: Add 'cld' at entry to clear direction flag. Userspace
could leave DF=1 and SYSENTER doesn't reset EFLAGS, which would
corrupt any kernel string/memory operations using rep movsb/stosb
Fase 4 (ulibc):
- stdio.c: Fix PUTC macro underflow — use 'pos+1 < size' instead
of 'pos < size-1' which underflows to SIZE_MAX when size==0
- stdio.c: Fix vsnprintf(buf, 0, fmt) — was counting raw format
chars instead of returning 0; now returns 0 immediately
- stdlib.c: Use uintptr_t instead of unsigned int for brk() pointer
comparison to be correct on all architectures
- unistd.c: Replace 'hlt' with 'nop' in _exit() fallback loop —
hlt is privileged and causes #GP in ring 3
Bugs found and fixed during deep audit of the Fase 5 commit
(implemented during WSL2/GCC instability):
BUG 1 (CRITICAL): vmm_map_page args were inverted in shm_at().
Signature is vmm_map_page(phys, virt, flags) but code passed
(virt, phys, flags). Would map physical pages at wrong addresses
causing memory corruption. Fixed both code paths.
BUG 2 (CRITICAL): shm_dt() used broken heuristic to find segment.
Matched by npages count — if two segments had same page count,
wrong one got decremented. Added shmid field to mmap entry struct
for direct O(1) lookup. Removed dead code loop that computed
expected_va and discarded it.
BUG 3: shm_at() with shmaddr!=0 didn't register in mmaps[].
shm_dt() would never find the slot, returning -EINVAL.
Now always registers in mmap table regardless of shmaddr.
BUG 4: shm_destroy() only cleared 'used' flag, leaving stale
key/size/npages/nattch. Now memset()s entire struct to zero.
BUG 5: shm_ctl(IPC_STAT) wrote directly to userspace pointer
while holding spinlock. Page fault under spinlock = deadlock.
Now copies to local struct, releases lock, then copy_to_user().
Additional fixes:
- Added shmid field to process mmap entry (process.h)
- Initialize mmaps[].shmid = -1 in all 3 process creation paths
(process_init, process_create_kernel, process_fork_create)
- Set shmid = -1 in syscall_mmap_impl and syscall_munmap_impl
- Fork now copies parent's mmap table to child (with shmid)
Passes: make, cppcheck, QEMU smoke test (all init tests OK).
Add System V-style shared memory IPC subsystem:
- src/kernel/shm.c: kernel-side segment manager with up to 32
segments, each up to 16 pages (64KB). Physical pages allocated
via PMM, mapped into user address space via VMM.
- include/shm.h: API + constants (IPC_CREAT, IPC_EXCL, IPC_RMID,
IPC_PRIVATE)
- Syscalls 46-49: SHMGET, SHMAT, SHMDT, SHMCTL wired in syscall.c
- shm_init() called from kernel_main after kheap_init
- Deferred destruction: IPC_RMID with nattch>0 defers free until
last detach
Also fixes:
- tty.c: add utils.h include for memset (cross-compiler strictness)
- usermode.c: fix ebp clobber error with cross-compiler by using
ESI as scratch register instead
Tulio A M Mendes [Tue, 10 Feb 2026 07:07:14 +0000 (04:07 -0300)]
feat: implement SYSENTER/SYSEXIT fast syscall entry for x86-32
Add fast syscall support via SYSENTER/SYSEXIT (SEP), ~10x faster
than INT 0x80 (~30 cycles vs ~300 cycles overhead).
Components:
- src/arch/x86/sysenter.S: assembly entry point that builds a
struct registers frame compatible with existing syscall_handler()
- src/arch/x86/sysenter_init.c: MSR setup (0x174=CS, 0x175=ESP,
0x176=EIP), CPUID check for SEP support
- syscall_handler() made non-static so assembly can call it
- tss_set_kernel_stack() now also updates SYSENTER ESP MSR so
context switches keep the fast path working
HAL wrapper (include/hal/cpu_features.h):
- hal_cpu_detect_features() / hal_cpu_get_features() / hal_cpu_print_features()
- x86 impl in src/hal/x86/cpu_features.c
- Weak default stub in src/kernel/cpu_features.c
Called from kernel_main() right after console_init().
QEMU output: GenuineIntel, PAE APIC SEP SSE SSE2 FXSR HYPERVISOR.
Tulio A M Mendes [Tue, 10 Feb 2026 06:27:16 +0000 (03:27 -0300)]
refactor: remove dead shell.c, integrate commands into kconsole
shell.c became dead code after kconsole_enter() replaced shell_init()
as the fallback when init_start() fails. Nobody called shell_init().
- Integrate useful shell commands into kconsole: ls, cat, clear,
mem, sleep, ring3 (via arch_platform_usermode_test_start)
- Remove src/kernel/shell.c and include/shell.h
- Remove shell.h include from main.c
- kconsole is now the single kernel-mode interactive console
Tulio A M Mendes [Tue, 10 Feb 2026 06:19:36 +0000 (03:19 -0300)]
refactor: move x86 uaccess page table walking to src/arch/x86/uaccess.c
The uaccess implementation used x86-specific recursive page table
mapping (0xFFFFF000/0xFFC00000) for user_range_ok, copy_from_user,
copy_to_user, and uaccess_try_recover. This is 100% arch-dependent.
- Move full x86 implementation to src/arch/x86/uaccess.c (no guards)
- Replace src/kernel/uaccess.c with weak stubs (simple memcpy-based)
- The linker picks the arch-specific version when available
Tulio A M Mendes [Tue, 10 Feb 2026 06:13:16 +0000 (03:13 -0300)]
refactor: make pmm.c fully architecture-independent
Extract all Multiboot2 x86-specific code from src/mm/pmm.c into
src/arch/x86/pmm_boot.c as pmm_arch_init().
Design:
- pmm.h now exposes pmm_mark_region(), pmm_set_limits(), pmm_arch_init()
- pmm_init() calls pmm_arch_init() (arch-specific) which discovers
memory and calls pmm_set_limits() + pmm_mark_region()
- pmm.c provides a weak default pmm_arch_init() for archs without one
- Kernel protection uses hal_mm_virt_to_phys() (no #if MIPS/x86)
- x86 pmm_boot.c handles Multiboot2 parsing, module protection,
and boot info protection
- Zero #if guards remain in pmm.c
When VFS mount or init fails, AdrOS now enters a minimal kernel-mode
emergency console instead of the full shell. This is similar to
HelenOS's kconsole — it runs entirely in kernel mode and provides
basic diagnostic commands.
Design:
- kconsole_enter() runs a blocking read loop using kgetc()/kprintf()
- Commands: help, dmesg, reboot, halt
- Activated from kernel_main() when init_start() returns < 0
- Fully architecture-independent (uses only generic console API)
The normal shell remains available for userspace-initiated sessions.
Tulio A M Mendes [Tue, 10 Feb 2026 05:56:54 +0000 (02:56 -0300)]
feat: add kgetc() to console subsystem for kernel input
kgetc() reads a single character via keyboard_read_blocking(),
providing a symmetric API alongside kprintf() for output.
This enables the kernel console (and future kconsole) to have
a generic input mechanism independent of architecture.
Tulio A M Mendes [Tue, 10 Feb 2026 05:53:40 +0000 (02:53 -0300)]
refactor: remove #if x86 guard from scheduler fork_child_trampoline
Add hal_usermode_enter_regs() to the HAL usermode interface so
fork_child_trampoline() can call it generically without #if x86.
- Add declaration to include/hal/usermode.h
- Implement in src/hal/x86/usermode.c (calls x86_enter_usermode_regs)
- Add stubs in ARM, RISC-V, MIPS HAL usermode.c
- scheduler.c now uses hal_usermode_enter_regs() with no guards
Tulio A M Mendes [Tue, 10 Feb 2026 05:47:20 +0000 (02:47 -0300)]
refactor: remove all #if x86 guards from shell.c, migrate to kprintf + HAL
shell.c is generic kernel code and should not contain any
architecture-specific guards or inline assembly.
Changes:
- Replace all uart_print() calls with kprintf() so output goes
through the console subsystem and into the kernel log buffer
- Replace x86 'cli; ud2' panic asm with hal_cpu_disable_interrupts()
+ hal_cpu_idle() loop
- Replace #if x86 ring3 guard with arch_platform_usermode_test_start()
which is already a generic wrapper with per-arch implementations
- Use console_write() for echo/backspace (no log buffer pollution)
- Remove unnecessary uart_console.h and vga_console.h includes
Tulio A M Mendes [Tue, 10 Feb 2026 05:42:24 +0000 (02:42 -0300)]
refactor: move x86 ATA PIO driver from src/drivers/ata_pio.c to src/hal/x86/ata_pio.c
ATA PIO uses x86 I/O port instructions (inb/outb/inw/outw) for
disk access. The full implementation now lives in src/hal/x86/ata_pio.c
(no #if guards). src/drivers/ata_pio.c contains only weak stubs
returning -ENOSYS, overridden at link time for x86.
Tulio A M Mendes [Tue, 10 Feb 2026 05:37:31 +0000 (02:37 -0300)]
refactor: move x86 PCI driver from src/drivers/pci.c to src/hal/x86/pci.c
PCI config space access via I/O ports 0xCF8/0xCFC is x86-specific.
The full PCI enumeration implementation now lives in src/hal/x86/pci.c
(no #if guards). src/drivers/pci.c contains only weak stubs that are
overridden by the arch-specific version at link time.
Tulio A M Mendes [Tue, 10 Feb 2026 05:32:41 +0000 (02:32 -0300)]
refactor: move x86 ELF loader from src/kernel/elf.c to src/arch/x86/elf.c
The ELF loader uses x86-specific page table manipulation (recursive
mapping at 0xFFFFF000/0xFFC00000), EM_386 validation, and low-16MB
allocation. It is 100% architecture-dependent and should not live
in the generic kernel directory.
- Move full implementation to src/arch/x86/elf.c (no #if guards)
- Replace src/kernel/elf.c with a weak stub returning -1
- The linker picks the arch-specific version when available
Tulio A M Mendes [Tue, 10 Feb 2026 05:26:38 +0000 (02:26 -0300)]
refactor: remove include/multiboot2.h wrapper, use arch/x86/multiboot2.h directly
The generic wrapper include/multiboot2.h only forwarded to
arch/x86/multiboot2.h under #if x86. Since Multiboot2 is purely
x86/GRUB-specific, the wrapper should not exist in the generic
include/ directory. pmm.c now includes arch/x86/multiboot2.h
directly (already inside its own #if x86 guard).
Tulio A M Mendes [Tue, 10 Feb 2026 05:01:18 +0000 (02:01 -0300)]
refactor: replace hardcoded 0xC0000000 in elf.c and uaccess.c with hal_mm_kernel_virt_base()
Both elf.c and uaccess.c had X86_KERNEL_VIRT_BASE defined as
0xC0000000U inside #if x86 blocks. While technically correct
(only compiled on x86), this is inconsistent with the rest of the
codebase which now uses hal_mm_kernel_virt_base() everywhere.
Replace with the HAL abstraction for consistency and to ensure
the kernel virtual base is defined in exactly one place per arch.
Tulio A M Mendes [Tue, 10 Feb 2026 04:58:10 +0000 (01:58 -0300)]
fix: replace x86 'cli; hlt' asm in syscall.c with HAL calls
syscall.c used raw x86 inline assembly ('cli; hlt') in the exit
syscall idle loop. This would not compile on ARM/RISC-V/MIPS.
Add hal_cpu_disable_interrupts() to the HAL CPU interface with
implementations for x86 (cli) and stubs for other architectures.
Replace the raw asm with hal_cpu_disable_interrupts() + hal_cpu_idle().
Tulio A M Mendes [Tue, 10 Feb 2026 04:55:15 +0000 (01:55 -0300)]
feat: add dmesg command to kernel shell
Reads the kernel log ring buffer via klog_read() and prints it
to the UART console, allowing users to review boot messages and
earlier kprintf output — just like Linux's dmesg command.
Tulio A M Mendes [Tue, 10 Feb 2026 04:53:00 +0000 (01:53 -0300)]
feat: add kernel log ring buffer to kprintf (printk-style dmesg support)
Like Linux's printk, kprintf() now writes every formatted message
into a 16KB circular ring buffer (klog_buf) before dispatching to
console drivers (UART, VGA). This allows old messages to be
retrieved later via klog_read(), enabling dmesg functionality.
Design:
- 16KB static ring buffer (KLOG_BUF_SIZE)
- klog_head tracks next write position, klog_count tracks fill
- klog_append() writes into ring, capping at buffer size
- klog_read(out, size) copies oldest-to-newest into caller buffer
- Protected by dedicated klog_lock spinlock
Tulio A M Mendes [Tue, 10 Feb 2026 04:50:27 +0000 (01:50 -0300)]
fix: replace x86 bsf asm in scheduler with portable __builtin_ctz
bsf32() used x86-only 'bsf' inline assembly to find the lowest
set bit in the O(1) scheduler bitmap. This would not compile on
ARM/RISC-V/MIPS. Replace with __builtin_ctz() which GCC supports
on all target architectures.
Tulio A M Mendes [Tue, 10 Feb 2026 04:33:15 +0000 (01:33 -0300)]
refactor: x86 code uses arch-specific headers directly
arch_early_setup.c now includes arch/x86/multiboot2.h directly
instead of the generic wrapper, consistent with the pattern of
x86-only code using arch-specific headers.
Tulio A M Mendes [Tue, 10 Feb 2026 04:30:39 +0000 (01:30 -0300)]
refactor: guard multiboot2.h include in pmm.c with #if x86
multiboot2.h is an x86/GRUB boot protocol header. pmm.c (generic
mm/ code) included it unconditionally even though all Multiboot2
usage is already inside #if x86 blocks. Guard the include so it
is not pulled in on ARM/RISC-V/MIPS builds.
Tulio A M Mendes [Tue, 10 Feb 2026 04:27:48 +0000 (01:27 -0300)]
refactor: move gdt.h/idt.h out of generic include/ into arch-specific paths
gdt.h and idt.h are x86-only concepts (Global Descriptor Table,
Interrupt Descriptor Table) that do not exist on ARM/RISC-V/MIPS.
They should not live in the generic include/ directory.
Changes:
- Delete include/gdt.h wrapper; all 3 consumers (arch/x86/ and
hal/x86/) now include arch/x86/gdt.h directly.
- Delete include/idt.h wrapper; create include/interrupts.h as
the generic abstraction (provides struct registers + isr_handler_t
with arch-specific dispatch).
- Generic kernel code (syscall.c, uaccess.c, process.h) now
includes interrupts.h instead of idt.h.
- x86-only code (idt.c, timer HAL, keyboard HAL, usermode, etc.)
now includes arch/x86/idt.h directly.
- Remove unused idt.h and io.h includes from kernel/main.c.
Tulio A M Mendes [Tue, 10 Feb 2026 04:14:19 +0000 (01:14 -0300)]
fix: implement VGA text-mode scrolling instead of wrap-to-row-0
When the cursor reached the bottom of the 25-row VGA text buffer,
term_row was reset to 0, overwriting the top of the screen. This
made boot output unreadable once it exceeded 25 lines.
Add vga_scroll() that shifts all rows up by one and clears the
last row. Called from both vga_put_char and vga_print.
Tulio A M Mendes [Tue, 10 Feb 2026 04:12:07 +0000 (01:12 -0300)]
fix: implement real irq_save/irq_restore for ARM, RISC-V, MIPS
spinlock.h had no-op irq_save/irq_restore for non-x86 architectures,
meaning spin_lock_irqsave would not actually disable interrupts on
ARM, RISC-V, or MIPS — breaking all critical sections.
Add proper implementations:
- ARM: mrs/msr CPSR with cpsid i
- RISC-V: csrrci/csrsi mstatus MIE bit
- MIPS: mfc0/di/ei on CP0 Status IE bit
Tulio A M Mendes [Tue, 10 Feb 2026 04:09:56 +0000 (01:09 -0300)]
fix: replace hardcoded 0xC0000000 in pmm.c with hal_mm_kernel_virt_base()
pmm.c used raw 0xC0000000 to detect higher-half kernel and adjust
physical addresses. Replace with hal_mm_kernel_virt_base() so the
PMM works correctly on architectures with different kernel virtual
base addresses.
Tulio A M Mendes [Tue, 10 Feb 2026 04:08:02 +0000 (01:08 -0300)]
fix: replace hardcoded 0xC0000000 in syscall.c with hal_mm_kernel_virt_base()
sys_brk and mmap used hardcoded 0xC0000000U (x86 kernel virtual
base) for bounds checking. Replace with hal_mm_kernel_virt_base()
so the code is architecture-independent.
Tulio A M Mendes [Tue, 10 Feb 2026 04:05:52 +0000 (01:05 -0300)]
fix: wrap pci.c in #if x86 guard with stubs for other architectures
PCI config space I/O port access (0xCF8/0xCFC) using outl/inl is
x86-only. The driver had no architecture guard, so it would fail
to compile on ARM, RISC-V, and MIPS.
Wrap the full implementation in #if defined(__i386__) and provide
no-op stubs for non-x86 targets.
Tulio A M Mendes [Tue, 10 Feb 2026 04:04:05 +0000 (01:04 -0300)]
fix: replace hardcoded 0xC0000000 in slab.c with hal_mm_phys_to_virt()
slab.c used 'base + 0xC0000000U' to convert physical to virtual
addresses, which is x86 higher-half specific. This breaks on ARM,
RISC-V, and MIPS where the kernel virtual base differs.
Add hal_mm_phys_to_virt(), hal_mm_virt_to_phys(), and
hal_mm_kernel_virt_base() to the HAL mm interface with proper
implementations for x86 (0xC0000000 offset) and identity-mapped
stubs for ARM, RISC-V, MIPS.
Tulio A M Mendes [Tue, 10 Feb 2026 04:01:02 +0000 (01:01 -0300)]
fix: move VBE framebuffer VA from 0xD0000000 to 0xE0000000
The kernel heap starts at KHEAP_START=0xD0000000 and spans 10MB.
The VBE framebuffer was also mapped at 0xD0000000, causing a
virtual address collision that would corrupt the heap when a
framebuffer is present.
Move VBE mapping to 0xE0000000 which is safely above the heap.
Tulio A M Mendes [Tue, 10 Feb 2026 03:59:11 +0000 (00:59 -0300)]
fix: add rq_enqueue on wake in keyboard, tty, pty drivers
keyboard.c, tty.c, pty.c all transition processes from BLOCKED to
READY without enqueuing them into the O(1) scheduler runqueue.
This causes woken processes to be invisible to rq_pick_next(),
leading to starvation until the active/expired swap rescues them.
Add sched_enqueue_ready() public API in scheduler.c and call it
from all three wake sites.
Passes: make, cppcheck, QEMU smoke test (10s, all init tests OK).
projects / AdrOS.git / log