3b7d004285
feat(boot): gatekeeper gates boot (init→UI→gatekeeper→data); keystore disk + virtio-rng discovery; terminal READ_SECRET; storage SET_KEY; PageCount ≤8192, alloc cap gone; device window 0x01D0_0000; test-qemu types passcode over 2 boots
2026-10-27 23:44:05 +01:00
b7ef67ffd8
feat(gatekeeper): auth flow (setup, count-before-check, threshold/duress wipe, torn-write-safe resume) over Keystore/Random/Prompt ports; host tests
2026-10-27 23:17:18 +01:00
600140d518
feat(keystore): sealed real/duress slots (argon2id 16MiB/3, ChaCha20-Poly1305), torn-write-safe 2-copy record, wipe state; virtio-rng driver + Entropy port; RustCrypto deps
2026-10-27 23:06:25 +01:00
6b13bf8bbf
feat(kernel): 64 MiB user pool (frame table 16384)
2026-10-27 23:03:19 +01:00
90e11eb2e8
feat(apps): permission manager equips apps (manifest+consent+decisions in /system), launches via init w/ file grant; shell unprivileged (/home); install/apps/allow/revoke; revoke stops running app; app-image tool; counter app
2026-10-27 22:56:44 +01:00
9bc31a9bbe
feat(manifest): app manifest + decision crate (strict TOML subset, checked newtypes, capability catalog); docs/apps.md spec
2026-10-27 22:32:40 +01:00
ec3bc0d2a1
feat(snake): 8 steps/s on fixed-period clock (draw time no longer adds to step)
2026-10-27 22:14:35 +01:00
c8056ddac6
perf: fast display (row runs, bulk fills, pixel scroll), terminal draws changed cells only + scrolls pixels, print! batched (was IPC per fmt fragment), snake sleeps on timer
2026-10-27 22:09:33 +01:00
7b8258b231
refactor: ByteOffset newtype for window/register/ring offsets; named virtio-gpu cmd fields
2026-10-27 21:52:33 +01:00
842d14987c
refactor: unsafe only in adapter + libkos; forbid(unsafe_code) everywhere else; libkos Window (volatile, bounds-checked MMIO/DMA/shared mem), entry!, thread::spawn; MapRegion returns pages; kernel const-built (with_cores/install_platform); newtype addrs
2026-10-27 21:43:24 +01:00
83809bbe94
feat(userspace): programs in /bin w/o .elf; bin manifests (needs = display) so shell runs snake; Ctrl+C kills foreground via terminal interrupt notification; ctrl keys; sleep
2026-10-27 21:16:00 +01:00
1fc5a54f06
feat(storage): scoped grants (subtree, ro/rw), narrow-only, release revokes all holders; IPC KEEP_DELEGATE opt-in; shell cd/pwd, programs get ro cwd
2026-10-27 20:20:34 +01:00
c603a578c0
feat(userspace): shell runs programs (ls, cat) via spawn w/ terminal+storage+args page; ext4 holes read as zeros; storage re-attach same buffer
2026-10-27 17:22:08 +01:00
0fd568cdad
feat(storage): ext4-only disk via mkfs.ext4 -d; drop FAT16; feature-gated mount (ro on unknown ro_compat); ext4 read spans blocks, delete clears inode, mkdir counts dir; virtio-blk writes; test-qemu e2fsck gate
2026-10-27 17:09:35 +01:00
4030dd4315
feat(adapter): init+storage packed into kernel image; drop adapter FAT16 reader + virtio-blk
2026-10-27 16:58:11 +01:00
b80303f553
feat(userspace): terminal server + shell desktop; US keymap w/ shift; libkos allocator multi-page fix; panics print
2026-10-27 16:50:35 +01:00
2845d190f0
feat(display): input routed via display server to focused app; input Subscribe; uses caps badged + Delegate
2026-10-27 16:38:16 +01:00
64ec5df379
feat(display): DrawText with built-in Spleen 8x16 font (BSD-2)
2026-10-27 16:33:26 +01:00
8587661684
feat(init): spawn service over IPC with per-client allowance refunded on child death; up to 4 death watchers; spawntest on test image
2026-10-27 16:21:08 +01:00
817a38993b
feat(kernel): WatchDeath + SetTimer events as notification signals; adapter wakes at earliest deadline
2026-10-27 16:06:04 +01:00
a4f467f45d
feat(userspace): log server sole console holder; init boots from manifest; adapter loads only init+storage
2026-10-27 15:40:19 +01:00
4049ba5007
feat(kernel): per-process budgets (pages, endpoints, notifs, regions) carved from creator, returned on death; init owns pool
2026-10-27 15:08:58 +01:00
7415bab7f5
feat(kernel): console cap gates DebugPutchar, no uart fast path; spawn start arg in a0; delegate returns slot
2026-10-27 14:54:36 +01:00
33e1c849d1
feat(kernel): ipc cap transfer drops Delegate; one owner per irq line, freed when owner dies
2026-10-27 14:42:28 +01:00
37c482c36c
chore: fix build warnings (unused vars/imports, dead ext4 param/field/fn)
2026-10-27 14:12:50 +01:00
b4390b7b6d
refactor(userspace): split syscall/fat16/ext4 by concern; trim comments
2026-10-27 13:21:53 +01:00
99273db6d3
refactor(adapter): split trap/page_table/smp/entry by concern; trim comments
2026-10-27 13:21:53 +01:00
95dbe7b9d5
refactor(kernel): split ipc/memory/lib/thread by concern; trim comments
2026-10-27 13:21:53 +01:00
b814bd9570
test: on-hardware SMP self-test (revoke/kill must stop every hart) + make test-qemu
2026-10-27 12:54:42 +01:00
909b3f0503
feat(storage): full file protocol over per-client shared region (badged clients, owned handles, clamped lengths, ReadOnly on unwritable disk); init loads via libkos::fs; drop boot shared buffer
2026-10-27 12:42:37 +01:00
694c675a40
feat: devices via caps (BootInfo, init assigns devices, drivers map MMIO/DMA themselves, IRQ-driven input); drop boot device wiring and info pages; headless display fallback
2026-10-27 12:28:39 +01:00
8bc5402a29
fix(userspace): clip display rects, bounds-check session app ids and fat16 handles, reject bad fat16 geometry, session kills via process cap
2026-10-27 12:11:13 +01:00
e8a2963b24
feat(userspace): Call/ReplyRecv IPC, malformed-request replies, servers exit on dead endpoint; drop send/receive compat, select!, async_syscall
2026-10-27 12:06:10 +01:00
2a8a5b0c27
perf(kernel): linked cap tree, translate-based page lookup, next-fit frames/heap, targeted dequeue; host benches
2026-10-27 01:33:26 +01:00
19aeabd86d
feat: SMP stage 2, lock-free fast paths (GetTime, GetProcessId, DebugPutchar, no-op Yield), storm checks yield equivalence
2026-10-27 01:07:57 +01:00
2e665fd66e
feat: SMP stage 1 (4 harts, per-hart guarded stacks, home-core affinity, IPIs, TLB shootdown, one temporary kernel lock), 4-core storm
2026-10-27 00:56:15 +01:00
b87a62475f
feat(adapter): higher-half kernel (linked at PHYS_OFFSET, boot trampoline, no low mappings), fix SBI ecall clobbers
2026-10-27 00:25:20 +01:00
55758ae5b2
feat: kernel W^X (per-section perms, firmware unmapped, stack guard, boot check), halt on kernel faults, region W^X across processes
2026-10-27 00:13:00 +01:00
bafc18a5f8
feat(kernel): SystemControl cap for halt, board device table + boot caps to init, RegionAddress syscall, idle loop services irqs
2026-10-26 23:59:57 +01:00
130a82f50d
feat(kernel): shared ABI decoder+proofs, no-panic gate, syscall storm, kani on shrunk kernel
2026-10-26 23:44:09 +01:00
154599e3af
feat(kernel): derivation-tree revocation, region caps
...
- caps record parent (mint/delegate/ipc), CapRef w/ pid+slot gens
- Revoke = delete subtree, keep self; drop/death re-parents children
- CreateRegion/MapRegion; mapping lives only as long as its cap
- drop Permission::Revoke + object-wide revoke
- mint any cap (badge only ep/ntfn), process caps delegable
- kani: descendants == subtree; model-based fuzz vs spec
2026-10-26 20:41:03 +01:00
76f10ff1f1
feat(kernel): seL4-style IPC, notifications, status ABI
...
- badges + Mint, Call/Reply/ReplyRecv w/ gen-checked reply slot
- cap transfer (1/msg, copy, needs Delegate, rechecked at delivery)
- notifications: signal/wait/poll/bind, irq -> notification routing
- WaitAny/WaitForInterrupt removed; a0=status, ErrorCode
- libkos: single ecall primitive, compat wrappers + typed new api
- fix: trap return clobbered user t0 on every trap
- fix: wait queues FIFO, delegate keeps badge, fault cap checked
- docs/ipc.md spec, ipc tests, ipc fuzz, kani ntfn + waitqueue
2026-10-26 20:27:38 +01:00
d43421e33e
feat(kernel): object lifetimes via slot generations
...
- SlotGenerations per table, never wraps, retires exhausted slots
- caps to dead/reused process, endpoint, region rejected
- endpoints owned, die w/ owner, waiters woken w/ error
- DropCap syscall + libkos wrapper
- irq table bounds-checked, routes dropped w/ thread
- self-kill terminates caller, exit_thread full cleanup
- sched run_now: switch to named thread, not queue head
- lifetime tests, fuzz kills/recreates, kani gen proofs
2026-10-26 19:54:23 +01:00
8d2c40cb1e
feat(kernel): kernel-owned memory model
...
- FrameTable: per-frame owner/use, replaces PagePool + ProcessMemory
- Quota per process, page tables charged to owner
- Regions for shared mem + device MMIO, torn down w/ owner
- Platform: create/destroy AS, map/unmap, zero_frame; drop translate_va
- RequestPages/ReleasePages/MapPage(move) checked vs kernel records
- user window 0x1000..32MiB, private pts by construction
- boot loader + device setup go through kernel api
- kernel built in place, boot allocator bounded
- isolation tests, randomized invariant test, FrameTable kani proofs
- fixes: inflated release, unmapped release, dst va unchecked,
heap overflow, unbounded pt alloc, unzeroed frames, double free
2026-10-26 19:40:50 +01:00
e931485ca7
fix: sched round-robin, cap slot OOB panic, clippy, make ci
...
- RunList -> intrusive FIFO, no starvation, no silent drop
- cap table sized to CapSlot range (kani caught OOB panic)
- snake food color test uses const
- kani cfg lint, RUST_MIN_STACK for big kernel struct in tests
2026-10-26 19:08:30 +01:00
1c04ddf909
style: cargo fmt kernel crates
2026-10-26 19:07:54 +01:00
818eaecadd
refactor: replace manual debug_putchar with libkos::println!
...
Init, storage server, and hello app now use println!/print! macros
instead of manual byte-by-byte UART output.
2026-10-19 01:00:33 +02:00
052d7c4a64
refactor: remove old userspace and userspace-rt crates
2026-10-19 00:58:14 +02:00
9dd400656c
refactor: migrate all servers, apps, binaries to libkos
2026-10-19 00:57:27 +02:00
a4315d7665
refactor: migrate server-framework to depend on libkos
2026-10-19 00:55:54 +02:00
