Release v0.0.4

Builds on v0.0.3. New in this release:

- A sturdier architecture. The bulk of this release is a deep structural pass
  that follows through on the sealed-core groundwork from v0.0.3. The scheduler
  and process engine — historically a handful of enormous files that the rest of
  the kernel reached into freely — is now split into clearly separated layers
  with a small, explicit set of entry points between them, and the largest
  source files are broken into focused modules. A single result-and-error
  vocabulary runs across every subsystem boundary. Build-time checks enforce the
  rules: scheduling and process state can only change through the engine's own
  entry points, and lower layers can't reach up into higher ones. None of this
  changes what programs see — it makes the kernel far easier to reason about and
  much harder to break one part without the build catching it, which is what
  lets new work land cleanly from here.

- More faithful signals. Real-time signals now queue in order and respect the
  per-user limit on pending signals; a signal that interrupts an open-ended wait
  no longer wrongly restarts it; a memory fault arrives as a normal, catchable
  signal rather than an unconditional kill; and a debugger can reliably inject
  signals into a program it controls. Software that depends on precise signal
  behavior — shells, job control, language runtimes — behaves the way its
  authors expect.

- Per-process CPU timers. Programs can arm timers that fire based on the
  processor time they actually consume, not just elapsed wall-clock time.

- Real memory locking. Locking memory now genuinely pins it in RAM and faults it
  in immediately, and a program can ask that everything it maps from then on
  stays locked too. If the system runs out of memory while servicing a fault, it
  now stops just the offending program with a clean termination instead of
  putting the whole machine at risk.

- Durable, precise file writes. Flushing a file writes its pending pages through
  to storage, and a range flush writes back exactly the bytes requested, so data
  lands when a program asks for it. Pipe buffer capacity can be queried and
  resized.

- Correct directory-relative open permissions. Opening a file by a path relative
  to an open directory now runs the same permission check as opening it by full
  path, closing a gap where the relative form could skip the check.

- Truer introspection. Resource-usage accounting reports real minor and major
  page-fault counts; the per-process status view reports the real open-file
  ceiling; a per-process login identity is tracked and inherited across programs.
  The processor listing shows one entry per online core, and the load average
  excludes idle sleepers, so standard monitoring tools read the values they
  expect.

- Networking refinements. Non-blocking is honored per individual send and
  receive rather than only as a socket-wide mode, local socket pairs preserve
  message boundaries for datagram and packet types, and loopback delivery was
  corrected.

- Better device and process fidelity. Terminal window size can be set and read
  back so full-screen terminal programs lay themselves out correctly; the disk
  now appears in the system's device tree so enumeration tools find it; creating
  a device node routes it to the right driver; and a child carries its parent's
  resource limits across a fork or clone.

See README.md for what runs today, and docs/ for the architecture, the
verification recipe, and the clean-room policy.

Author: lgutschow

.github/workflows/sbom.yml

@@ -100,7 +100,8 @@ jobs:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           gh release upload "$REF_NAME" \
-            cyphera-kernel-*-sbom.*.json \
+            cyphera-kernel-*-sbom.cdx.json \
+            cyphera-kernel-*-sbom.spdx.json \
             cyphera-kernel-*-sbom.*.json.sigstore.json \
             cyphera-kernel-*.provenance.intoto.jsonl \
             --clobber

Cargo.lock

@@ -1,3 +1,4 @@
 fn main() {
     println!("cargo:rustc-check-cfg=cfg(coverage)");
+    println!("cargo:rustc-check-cfg=cfg(cow_fork_forced_window)");
 }

frame/build.rs

@@ -0,0 +1,69 @@
+# Per-vector fault trampolines: snapshot the 15 GP registers gs-relative (order
+# mirrored by per_cpu::fault_gprs), then jmp — never call (a return address would
+# shift the CPU exception frame) — to the typed handler. GS is the per-CPU base in
+# both rings (no swapgs), so the stores are valid for kernel faults too.
+
+.section .text
+
+.macro SNAPSHOT_FAULT_GPRS
+    mov %rax, %gs:0x20
+    mov %rbx, %gs:0x28
+    mov %rcx, %gs:0x30
+    mov %rdx, %gs:0x38
+    mov %rsi, %gs:0x40
+    mov %rdi, %gs:0x48
+    mov %rbp, %gs:0x50
+    mov %r8,  %gs:0x58
+    mov %r9,  %gs:0x60
+    mov %r10, %gs:0x68
+    mov %r11, %gs:0x70
+    mov %r12, %gs:0x78
+    mov %r13, %gs:0x80
+    mov %r14, %gs:0x88
+    mov %r15, %gs:0x90
+.endm
+
+.global de_trampoline
+de_trampoline:
+    SNAPSHOT_FAULT_GPRS
+    jmp handle_divide_error
+
+.global of_trampoline
+of_trampoline:
+    SNAPSHOT_FAULT_GPRS
+    jmp handle_overflow
+
+.global br_trampoline
+br_trampoline:
+    SNAPSHOT_FAULT_GPRS
+    jmp handle_bound
+
+.global ud_trampoline
+ud_trampoline:
+    SNAPSHOT_FAULT_GPRS
+    jmp handle_invalid_opcode
+
+.global gp_trampoline
+gp_trampoline:
+    SNAPSHOT_FAULT_GPRS
+    jmp handle_gpf
+
+.global pf_trampoline
+pf_trampoline:
+    SNAPSHOT_FAULT_GPRS
+    jmp handle_page_fault
+
+.global mf_trampoline
+mf_trampoline:
+    SNAPSHOT_FAULT_GPRS
+    jmp handle_x87
+
+.global ac_trampoline
+ac_trampoline:
+    SNAPSHOT_FAULT_GPRS
+    jmp handle_alignment
+
+.global xm_trampoline
+xm_trampoline:
+    SNAPSHOT_FAULT_GPRS
+    jmp handle_simd

frame/src/arch/x86_64/fault.s

@@ -3,21 +3,31 @@ use x86_64::structures::idt::{InterruptDescriptorTable, InterruptStackFrame, Pag
 
 use super::tss::DOUBLE_FAULT_IST_INDEX;
 
+core::arch::global_asm!(include_str!("fault.s"), options(att_syntax));
+
+extern "C" {
+    fn de_trampoline();
+    fn of_trampoline();
+    fn br_trampoline();
+    fn ud_trampoline();
+    fn gp_trampoline();
+    fn pf_trampoline();
+    fn mf_trampoline();
+    fn ac_trampoline();
+    fn xm_trampoline();
+}
+
 static IDT: Once<InterruptDescriptorTable> = Once::new();
 
 pub fn init() {
     let idt = IDT.call_once(|| {
         let mut idt = InterruptDescriptorTable::new();
 
-        idt.divide_error.set_handler_fn(handle_divide_error);
         idt.debug.set_handler_fn(handle_debug);
         idt.non_maskable_interrupt.set_handler_fn(handle_nmi);
         idt.breakpoint
             .set_handler_fn(handle_breakpoint)
             .set_privilege_level(x86_64::PrivilegeLevel::Ring3);
-        idt.overflow.set_handler_fn(handle_overflow);
-        idt.bound_range_exceeded.set_handler_fn(handle_bound);
-        idt.invalid_opcode.set_handler_fn(handle_invalid_opcode);
         idt.device_not_available.set_handler_fn(handle_device_na);
 
         // SAFETY: set_stack_index requires the IST index to name a
@@ -36,14 +46,36 @@ pub fn init() {
         idt.invalid_tss.set_handler_fn(handle_invalid_tss);
         idt.segment_not_present.set_handler_fn(handle_segment_np);
         idt.stack_segment_fault.set_handler_fn(handle_stack_seg);
-        idt.general_protection_fault.set_handler_fn(handle_gpf);
-        idt.page_fault.set_handler_fn(handle_page_fault);
-        idt.x87_floating_point.set_handler_fn(handle_x87);
-        idt.alignment_check.set_handler_fn(handle_alignment);
         idt.machine_check.set_handler_fn(handle_machine_check);
-        idt.simd_floating_point.set_handler_fn(handle_simd);
         idt.virtualization.set_handler_fn(handle_virt);
 
+        // SAFETY: each synchronous user-fault vector is installed by address to
+        // a register-snapshot trampoline (gs-relative stores + jmp to the typed
+        // handler, leaving the CPU exception frame intact, so the handler runs
+        // as a direct gate would). The symbols are crate-local `.text`, valid
+        // for the program's lifetime; set_handler_addr only stores the gate's
+        // target.
+        unsafe {
+            idt.divide_error
+                .set_handler_addr(x86_64::VirtAddr::new(de_trampoline as *const () as u64));
+            idt.overflow
+                .set_handler_addr(x86_64::VirtAddr::new(of_trampoline as *const () as u64));
+            idt.bound_range_exceeded
+                .set_handler_addr(x86_64::VirtAddr::new(br_trampoline as *const () as u64));
+            idt.invalid_opcode
+                .set_handler_addr(x86_64::VirtAddr::new(ud_trampoline as *const () as u64));
+            idt.general_protection_fault
+                .set_handler_addr(x86_64::VirtAddr::new(gp_trampoline as *const () as u64));
+            idt.page_fault
+                .set_handler_addr(x86_64::VirtAddr::new(pf_trampoline as *const () as u64));
+            idt.x87_floating_point
+                .set_handler_addr(x86_64::VirtAddr::new(mf_trampoline as *const () as u64));
+            idt.alignment_check
+                .set_handler_addr(x86_64::VirtAddr::new(ac_trampoline as *const () as u64));
+            idt.simd_floating_point
+                .set_handler_addr(x86_64::VirtAddr::new(xm_trampoline as *const () as u64));
+        }
+
         idt[crate::intr::lapic::TIMER_VECTOR].set_handler_fn(handle_timer);
         idt[crate::intr::lapic::RESCHED_IPI_VECTOR].set_handler_fn(handle_resched_ipi);
         idt[crate::intr::lapic::TLB_SHOOTDOWN_VECTOR].set_handler_fn(handle_tlb_shootdown);
@@ -54,7 +86,11 @@ pub fn init() {
     idt.load();
 }
 
+#[no_mangle]
 extern "x86-interrupt" fn handle_divide_error(frame: InterruptStackFrame) {
+    if from_user(&frame) {
+        try_deliver_user_fault(&frame, 0, 0, 0);
+    }
     panic_with_frame("#DE divide-by-zero", &frame, None);
 }
 
@@ -112,23 +148,26 @@ extern "x86-interrupt" fn handle_breakpoint(mut frame: InterruptStackFrame) {
     crate::println!("#BP breakpoint @ {:#x}", frame.instruction_pointer.as_u64());
 }
 
+#[no_mangle]
 extern "x86-interrupt" fn handle_overflow(frame: InterruptStackFrame) {
+    if from_user(&frame) {
+        try_deliver_user_fault(&frame, 4, 0, 0);
+    }
     panic_with_frame("#OF overflow", &frame, None);
 }
 
+#[no_mangle]
 extern "x86-interrupt" fn handle_bound(frame: InterruptStackFrame) {
+    if from_user(&frame) {
+        try_deliver_user_fault(&frame, 5, 0, 0);
+    }
     panic_with_frame("#BR bound range exceeded", &frame, None);
 }
 
+#[no_mangle]
 extern "x86-interrupt" fn handle_invalid_opcode(frame: InterruptStackFrame) {
     if from_user(&frame) {
-        if let Some(h) = crate::user::user_fault_handler() {
-            crate::println!(
-                "#UD from user @ rip={:#x}; killing process",
-                frame.instruction_pointer.as_u64()
-            );
-            h(0, 6, 0);
-        }
+        try_deliver_user_fault(&frame, 6, 0, 0);
     }
     panic_with_frame("#UD invalid opcode", &frame, None);
 }
@@ -153,19 +192,15 @@ extern "x86-interrupt" fn handle_stack_seg(frame: InterruptStackFrame, err: u64)
     panic_with_frame("#SS stack-segment fault", &frame, Some(err));
 }
 
+#[no_mangle]
 extern "x86-interrupt" fn handle_gpf(frame: InterruptStackFrame, err: u64) {
     if from_user(&frame) {
-        if let Some(h) = crate::user::user_fault_handler() {
-            crate::println!(
-                "#GP from user @ rip={:#x} err={err:#x}; killing process",
-                frame.instruction_pointer.as_u64()
-            );
-            h(0, 13, err);
-        }
+        try_deliver_user_fault(&frame, 13, err, 0);
     }
     panic_with_frame("#GP general protection fault", &frame, Some(err));
 }
 
+#[no_mangle]
 extern "x86-interrupt" fn handle_page_fault(
     mut frame: InterruptStackFrame,
     err: PageFaultErrorCode,
@@ -193,15 +228,7 @@ extern "x86-interrupt" fn handle_page_fault(
                 return;
             }
         }
-        if let Some(h) = crate::user::user_fault_handler() {
-            crate::println!(
-                "#PF from user @ rip={:#x} cr2={:#x} err={:?}; killing process",
-                frame.instruction_pointer.as_u64(),
-                cr2,
-                err
-            );
-            h(cr2, 14, err.bits());
-        }
+        try_deliver_user_fault(&frame, 14, err.bits(), cr2);
     }
     crate::println!(
         "#PF page fault @ rip={:#x} cr2={:#x} err={:?}",
@@ -216,19 +243,42 @@ fn from_user(frame: &InterruptStackFrame) -> bool {
     (frame.code_segment.0 & 3) == 3
 }
 
+fn try_deliver_user_fault(frame: &InterruptStackFrame, vector: u8, error: u64, addr: u64) {
+    if let Some(h) = crate::user::user_fault_signal() {
+        let mut tf = crate::user::fault_trapframe(
+            frame.instruction_pointer.as_u64(),
+            frame.cpu_flags.bits(),
+            frame.stack_pointer.as_u64(),
+        );
+        h(&mut tf, vector, error, addr);
+    }
+}
+
+#[no_mangle]
 extern "x86-interrupt" fn handle_x87(frame: InterruptStackFrame) {
+    if from_user(&frame) {
+        try_deliver_user_fault(&frame, 16, 0, 0);
+    }
     panic_with_frame("#MF x87 FPU error", &frame, None);
 }
 
+#[no_mangle]
 extern "x86-interrupt" fn handle_alignment(frame: InterruptStackFrame, err: u64) {
+    if from_user(&frame) {
+        try_deliver_user_fault(&frame, 17, err, 0);
+    }
     panic_with_frame("#AC alignment check", &frame, Some(err));
 }
 
 extern "x86-interrupt" fn handle_machine_check(frame: InterruptStackFrame) -> ! {
     panic_with_frame("#MC machine check", &frame, None);
 }
 
+#[no_mangle]
 extern "x86-interrupt" fn handle_simd(frame: InterruptStackFrame) {
+    if from_user(&frame) {
+        try_deliver_user_fault(&frame, 19, 0, 0);
+    }
     panic_with_frame("#XM SIMD floating-point", &frame, None);
 }
 

frame/src/arch/x86_64/idt.rs

@@ -4,6 +4,12 @@ syscall_entry:
     mov %rsp, %gs:0x8
     mov %gs:0x0, %rsp
 
+    # TrapFrame trailing rcx/r11 slots: SYSCALL overwrites the user rcx/r11
+    # (return rip/rflags), so there are no user values to record here; push
+    # zeroes to size the stack frame to the full TrapFrame. Discarded by the
+    # %gs:0x8 rsp reload on the return path.
+    pushq $0
+    pushq $0
     push %rax
     push %r15
     push %r14