summaryrefslogtreecommitdiffstats
path: root/rsnix (follow)
Commit message (Collapse)AuthorAgeFilesLines
* vt → per-instance Terminal rendering into a pixel buffersalmonik2026-08-173-718/+591
| | | | | | | | | | | - Refactor vt.rs into a per-instance Terminal struct (owned cell/rendered grids, cursor, ANSI parser, scroll state), rendering glyphs into a caller-owned pixel buffer with dirty-region blitting - Add gop buffer primitives (buffer_glyph_px, buffer_shift_up) and keep the legacy vt:: API as thin wrappers around the home terminal - Remove the now-obsolete scroll hook and shadow scroll path - Home terminal renders into its own buffer; window_id stays None until the WM integration lands
* Terminal-app design (ADR 0005) + disk-write controllersalmonik2026-08-172-10/+44
| | | | | | | | | - ADR 0005: persistent home terminal (full-screen, chrome-less, bottom-pinned), F1 terminal windows, per-instance vt/tty/shell, queue-based input for all terminals, and the disk controller - Glossary: add the Terminal term; update Task/App for the new model - Add a re-entrant disk lock (DiskGuard over the preemption-depth counter) and wrap all fs/fat mutating operations per-call
* wm: keep windows in place when the console scrolls beneath themsalmonik2026-08-173-7/+37
| | | | | | | The console's batched scroll (gop::shift_up_n) shifts the whole shared shadow, which dragged any composited window pixels up with it. Add a scroll hook so the window manager re-composites every visible window after a console scroll, restoring them at their fixed positions.
* wm: title-bar drag-to-move; stop delivering title-bar gestures to appssalmonik2026-08-171-20/+106
| | | | | | | | | - Track the active mouse gesture (none / window-move / app-stroke) so a press on the title bar becomes a move drag instead of leaking Move events into the app's content - Add move_window (clamped to the canvas, repaint old + new regions) - Always deliver MouseKind::Release so a stroke that ends outside the window still terminates
* Windowed GUI: wm module, input routing, and the paint appsalmonik2026-08-178-34/+818
| | | | | | | | | | | | | | - Add the wm window-manager facility per ADR 0004: overlapping pixel-surface windows, damage-rectangle compositing, WM-drawn title bar, focus/minimize/close, and F1-F4 keybindings - Add gop shadow compositing primitives and vt::repaint_region so the console stays layer 0 beneath windows - Route mouse (absolute coords, press/release edges) and keyboard (focus-aware input pump) to the focused window - Add the rspaint drawing-program crate (pen, 8 colors, clear) and shell draw/windows/restore commands - Extend TaskMsg with AppMouse/Focus/Close and document the design in CONTEXT.md + ADR 0004
* USB2/1.1 (EHCI/UHCI) drivers + real-hardware bring-up hardeningsalmonik2026-08-1715-38/+3020
| | | | | | | | | | | | | - Add polled EHCI (USB2) and UHCI (USB1.1) host-controller drivers with HID boot mouse support, wired into cursor polling and the 'usb' shell cmd - Add USB Legacy ownership handoff (claim_usb_legacy) plus config_write_byte - Harden boot: verify the PIT/timer ticks before shell entry, EOI stray interrupts in the LAPIC to stop interrupt storms, bound PS/2 controller waits, and INTx-disable AHCI (polled driver) - Add boot stage markers, klog screen echo, and QR lock; scheduler mark_shell_running; NO_USB stopgap to keep BIOS USB-Legacy input alive - alloc_pages_above for DMA buffers that must avoid low conventional memory - Expand DEBUG_NOTES with EHCI/QEMU bring-up findings
* v0.5.10: USB HID mouse via polled xHCI (rsnix/src/usb.rs)salmonik2026-08-043-1/+979
| | | | | | | | | | | | | | | Polled xHCI driver (mouse-only): controller bring-up, port reset, enable-slot -> address-device -> config-descriptor walk -> HID boot mouse IN endpoint, one outstanding IN TRB drained on poll. Cursor task polls usb first, PS/2 second. New 'usb'/'usb rescan' shell cmds. Verified in QEMU (q35 + OVMF + qemu-xhci + usb-mouse): movement and all three buttons tracked exactly; heap stays clean. Fixes en route: MaxPorts=HCSPARAMS1[31:24]; operational regs CRCR=0x18 DCBAAP=0x30 CONFIG=0x38; pass input-context ptr in Address-Device; Input Control Context DW0=Drop DW1=Add; HID walker bInterfaceClass at +5; async discovery from cursor task.
* v0.5.9: fix OptiPlex heap crash — EBS retry must not rebuild the free listsalmonik2026-08-043-46/+181
| | | | | | | | | | | | | | | | | | | | | | | Root cause: on real hardware SetMode can invalidate the pre-captured ExitBootServices map key, so EBS fails and the retry refreshed the map via capture_memory_map -> init_heap, which REBUILT the free list from the raw map and wiped the allocation state of every pre-EBS live object (the display shadow and the vt grids). Their spans became free while still live, later allocations carved inside the shadow, and the display writes clobbered them — zeroed back-pointers (family A ptr=0x404443e0 block=0x0) and gray glyph pixels (family B 0xaaaaaa00aaaaaa = 0x00AAAAAA = PALETTE[7] fg-7 text colour, not a firmware scrub). Fix: refresh_and_exit now re-captures the map and returns a fresh EBS key without rebuilding the free list (refresh_map_key); the free list is the authoritative live-allocation state. Verified in QEMU under a forced EBS failure (SIMULATE_EBS_FAILURE test hook): verify ok, probe NOT free, flhead outside the shadow — identical to a clean boot, and the full shell sequence is crash-free. Also: removed the crash-family debug markers from the screen (boot-time heapdbg lines, vt verify marker, shadow marker) — the vt grid self-check stays serial-only. Version 0.5.8 -> 0.5.9.
* v0.5.8: heap-free QR encoder + crash-dump QR on framebuffersalmonik2026-08-034-1/+941
| | | | | | | | | | | | | | | | | | | | | | | Real hardware has no serial console, so a kernel crash only leaves a frozen screen. Every dump_lines() report now also renders the crash text as a scannable QR below the white-on-red band (photograph the screen instead of relaying text). - rsnix/src/qr.rs: from-scratch no_std/no_alloc byte-mode QR encoder (EC-L, v1..v40, .bss statics only — safe on the fault path): RS over GF(256), codeword interleave, zigzag placement, 8 masks with N1-N4 penalty auto-selection, format/version info. - gop.rs: dump_qr() joins dump lines into a static buffer, truncates with '...' at the v40-L capacity, encodes, and renders centered black-on-white with a 4-module quiet zone. - tools/qrcheck: host harness (embedds qr.rs) + qrcheck.py cross-check against segno's placement primitives. Verified bit-exact: 12 versions x 8 masks forced, plus auto-mask choice matches segno's penalty evaluation. Caught 3 encoder bugs (multi-block interleave offsets, transposed version info, mask eval ordering). - QEMU e2e: page-fault dump screendump decodes via zbarimg, content matches the serial log line-for-line. - test-msg.sh and test-fault.sh both PASS; debug+release 0 warnings.
* v0.5.7: fix vt verify content check — expect BLANK (0x70020), not zerosalmonik2026-08-032-36/+140
| | | | | | | | | | | | | | | | | | | | | | | The pre-verify 0x70020 'mystery' was a debug artifact, not corruption: BLANK = {ch:32, fg:7, bg:0} = raw 0x70020, and vec![BLANK; n] fills both grids with it at init. The old check compared cells against 0 and its probe loop break-ed on the first non-zero cell, so probes 1-3 stayed at their zero-initialized slots — c=[0x70020,0,0,0] was bogus on every healthy boot. A full-grid dump proves QEMU grids are 100% BLANK at shell entry (nz=3700 blank=3700). Fix: probes compare against blank_raw (0x70020), record all four values (no early break), probe both cells and rendered, and add a full-grid nz/blank summary line. The OptiPlex firmware 0x00AAAAAA scrub remains cleanly distinguishable (scrub != blank). Markers: the shell banner occupies grid rows 0-1 and the prompt row 2 (proven by screendump), and a stale crash.log replays at rows 2+, so the shadow and vt markers moved to the bottom of the screen via the new gop::text_rows()/bottom_row(off) helpers instead of rows 1-2. QEMU verified: verify: ok every boot; test-msg + test-fault PASS; debug and release builds 0 warnings.
* v0.5.7: guard report else-branch initializes all mem lines (fix broken build)salmonik2026-08-031-1/+4
|
* v0.5.7: fix unused-init warning in guard reportsalmonik2026-08-031-1/+1
|
* v0.5.7: guard dumps block-header math + 16-word window; vt content verify; ↵salmonik2026-08-033-43/+117
| | | | | | | | | | | | | | | | | | | shadow marker The klog -t 2 crash drops a 126-byte String (the vt verify klog line) whose data ptr 0x40444970 points into the first-heap-block region whose content is the firmware 0x00AAAAAA scrub — a stale pointer, not a real allocation (back-pointer slot never written). Upgrades so the next real-hardware crash shows the full picture: - guard: explicit candidate block bases (b=ptr-24 / b16=ptr-32) with their size/free fields, plus a 16-word window (mem..mem4) from ptr-0x30 instead of the old 8 words - vt::debug_verify: content probe of the cells grid (must be all-BLANK at shell entry) — catches a stale in-heap cells pointer that passes the range checks - gop: on-screen marker for shadow carved vs NO-SHADOW fallback (the scrub content at the crash ptr suggests the shadow was rejected and its block stayed free + firmware-scrubbed)
* v0.5.7: vt verify also as a boot marker (real hardware has no serial)salmonik2026-08-021-0/+12
|
* v0.5.7: drop test-poison hooks; vt heap-struct verify at shell entrysalmonik2026-08-021-0/+42
| | | | | | | | | | | The OptiPlex's first banner write #GPs when the vt cells VecData holds firmware 0xAA fill instead of a real buffer pointer. The poison/fill test hooks (stack + free-heap + free-page 0x00AAAAAA) were removed from the release image — they changed boot behavior and may walk a corrupt free list over live blocks. Added vt::debug_verify() (cells/rendered ptr/cap/len + in-heap check) at shell entry: the next real-hardware boot shows whether the corruption is present at shell entry or lands during the banner write.
* v0.5.7: guard reports the drop's size/align — identifies the clobbered structsalmonik2026-08-021-6/+85
| | | | | | | | The OptiPlex crashes free garbage (0xaaaaaa, 0xaaaaaa00aaaaaa) whose value is the firmware's 0x00AAAAAA scrub pattern left in stack/heap. The drop size/align (the dealloc layout) now prints on the band, so the next repro shows both the garbage ptr AND the size it was freed with — cap×elem_size pinpoints which struct's fields were clobbered.
* v0.5.7: guard report 4-words-per-line — 16 stack words survive band hand-copysalmonik2026-08-021-24/+60
| | | | | | | | The OptiPlex repro copies are truncated at the ~110-char band width, so the old single-line 'stk:' (12 words, >200 chars) lost the return chain after a few words. Split mem/stk dumps into 4-words-per-line blocks: mem+mem2 (8 words around the corruption) and stk..stk4 (16 words) — the drop caller chain now survives hand transcription.
* v0.5.7: allocator corruption guard + full register dump for real-hardware reprosalmonik2026-08-022-1/+185
| | | | | | | | | | | | | | | | | | | | The OptiPlex #GP (vec=13 in __rust_dealloc) frees a garbage pointer: the back-pointer at [ptr-8] is clobbered by the time the shell drops its Parsed struct. A blind store to the bogus block header was an opaque #GP — now it is a readable report: - dealloc validates the back-pointer (in-heap block, sane size, in-use) before trusting it; on failure it prints ptr/block/heap range, the memory around the block header, and the live stack chain, writes the crash band + crash.log, and halts (memory.rs: heap_guard_report). - fault dumps now carry the full register set (rax..rdi, rbx, r8..r15) so the next repro shows the exact freed ptr and clobbered value. - new 'corrupt' shell hook deliberately clobbers a live block's back-pointer to prove the guard fires (test-fault-style halt). Verified: test-msg/test-disk/test-fault pass; corrupt hook reports ptr=.. block=0xdeedbeef... with mem dump instead of #GP. rs-dos.img rebuilt with the release kernel.
* v0.5.6: fault dumps carry kernel image base + stack backtracesalmonik2026-08-022-5/+147
| | | | | | | | | | | - fault_dump prints img= (kernel image base) on the serial line and the on-screen band, so a real-hardware repro can be resolved against the PDB without serial - backtrace: rbp-chain walk then a raw scan of the stack above the interrupted rsp; both filter to the .text range (PE-header parse via memory::text_range) so only code addresses are collected - on-screen boot marker shows the kernel image range at every boot - crash.log now records img= + bt= lines alongside rip/rsp
* v0.5.5: crash reports go to a dedicated CRASHLOG USB sticksalmonik2026-08-028-59/+349
| | | | | | | | | | | | | | | | The fault handler now writes crash.log to the volume labeled CRASHLOG (label-selected via fat::crash_vol), falling back to slot 0. On real hardware the boot USB may be unwritable, so a second stick labeled CRASHLOG survives the write; the shell auto-prints the previous crash report from it at next boot (read_crash_log resolves /disk/<uid>/crash.log through the FAT path, since Disk nodes hold no cached children). - fat.rs: volume_label() + crash_vol() (no allocation) - fs.rs: write_crash_log targets crash_vol(); read_crash_log prefers the CRASHLOG disk node; drop now-unused first_disk() - mkdisk.sh: --label option - test-fault.sh: boots with a dedicated CRASHLOG stick (mkfs -F 32 -n CRASHLOG), verifies crash.log lands there and NOT on the ESP
* v0.5.5: fix real-hardware boot crash — shadow back in heap as first allocationsalmonik2026-08-022-113/+82
| | | | | | | | | | | | | | | | | | | | | | User's machine: boot reached 'rsnix: boot done — shell' then panicked 'len is 0, index 0' at the first cell write — CELLS (the vt grid) was valid at vt::init and empty at the first shell paint, i.e. something stomped the heap between vt::init and the shell banner. The only change in that window vs the working v0.5.3 was the v0.5.4 move of the 1.9 MB display shadow from the heap to the fb-aware page allocator: on this machine's memory layout the page-allocator shadow's fill loop (480K words) clobbered the heap's vt vectors. - Shadow is again the *first* heap allocation, in gop::init before vt::init builds its grids (the v0.5.3 layout that provably boots on the user's hardware) — nothing else in the heap can collide with it. - init_heap now splits the free list at the GOP framebuffer hole instead of subtracting its size from one block that still *spanned* the hole — no heap allocation of any size can land on the display. - Kept the panic-proof try_reserve + fb-overlap rejection + no-shadow warning band; dropped the late init_shadow() call in main.rs. - Verified on QEMU: shadow @ 0x1980020 origin=heap, allocated before vt::init, fb clean at 0x80000000; all 5 suites PASS; 0 warnings.
* v0.5.5: self-diagnosing boot — vt refuses 0x0 geometry, panic band shows ↵salmonik2026-08-022-0/+41
| | | | | | | | | | | | | | | | | | | | | last stage The user's real-hardware boot showed 'PANIC: index out of bounds (len 0, index 0) at vt.rs:146' — the vt grid was created empty because the framebuffer geometry was 0x0 at vt::init (GOP missing or the active mode reporting zero resolution). The v0.5.4 blank screen was the same panic, previously invisible (no screen dump in the panic handler). - vt::init: rows/cols == 0 now halts with a visible white-on-red 'FATAL: no framebuffer geometry — GOP missing or active mode is 0x0' band instead of building an empty grid that panics at the first cell write. - boot_marker records the last boot stage; the panic band appends it as a 4th line so a crash shows exactly how far boot got. - The gop+vt marker now carries the measured geometry ('rsnix: gop 800x600 vt 100x37 ok') so a good boot is self-confirming on the screen. - All 5 test suites pass; build/clippy clean.
* v0.5.5: visible boot progress + panic-on-screen for real hardwaresalmonik2026-08-021-16/+56
| | | | | | | | | | | | | | | | | | | | Real hardware has no serial console: a pre-shell panic was a silent blank screen (the panic handler only wrote to serial, then cli;hlt). v0.5.4's shadow change made this window reachable — if the fb-aware page allocation or the heap fallback failed on hardware, the kernel halted before the shell banner with zero screen output. - gop::boot_marker(): every boot stage now draws straight to the framebuffer (row 0, white-on-black). The last marker visible before a hang identifies where the kernel died. - Panic handler: pre-shell panics now draw a white-on-red '*** PANIC *** <msg> at file:line' band via gop::dump_lines. - init_shadow(): heap fallback is panic-proof (try_reserve_exact + resize instead of vec![0; words] which aborts on OOM); page-alloc result defensively re-checked against the fb region; any failure degrades to no-shadow mode with a visible warning band. - Verified: full chain (rsboot -> kernel) boots with markers, shell banner renders, all 5 test suites pass.
* gop: rustfmt collapse in init_shadow warning bandsalmonik2026-08-021-1/+2
|
* v0.5.4: shadow backbuffer can no longer alias the framebuffersalmonik2026-08-021-17/+122
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Real-hardware scroll freeze (no exception, QEMU-clean) — the per-word push (0.5.3) did not fix it, so the wedge is upstream of the push. A QEMU slow-display simulation (new DISPLAY_STALL knob + shell 'stall' command busy-waits per display store, mimicking an uncached real-GPU framebuffer) proved the per-word push and shadow memmove are slow but finite — the shell keeps ticking, scrolls eventually complete. The freeze mechanism QEMU cannot exhibit is the shadow *landing on the framebuffer*: the heap free list spans the fb hole, so the 1.9 MB heap shadow can alias the display on machines where firmware reports the fb as ConventionalMemory — every scroll then becomes an MMIO->MMIO memcpy on an uncached framebuffer, which wedges real hardware (a stall, no fault, hence no dump). Fix: - gop::init_shadow(): allocate the shadow from the fb-aware page allocator (init_page_allocator marks fb pages used per-page), so it can never overlap the display; heap allocation kept only as a fallback with an explicit overlap rejection. Boot log now prints 'gop: shadow @ <addr> ... origin=page-alloc|heap|none'. - Scroll shadow memmove converted to per-word stores (belt and suspenders — immune to any future fb-aliased shadow). - Verified on QEMU: shadow @ 0x100000 vs fb 0x80000000..0x801d5000, overlap=false; all 5 test suites pass; scroll completes even under the stalled-display simulation.
* rsnix v0.5.3: fix real-hardware scroll wedge — per-word display pushsalmonik2026-08-012-13/+31
| | | | | | | | | | | | | | | | | | | | The real-hardware crash (2 lines of white + freeze, no CPU exception even with the 0.5.2 fault dumps) pointed away from a fault and at a stall: the scroll's full-frame push used one 1.92 MB rep-movsb to the framebuffer. On QEMU the framebuffer is RAM, so it flies; on a real GPU the framebuffer is uncached MMIO and the CPU's fast-string burst path can stall forever — the shell wedges mid-instruction, the cursor task's own writes wedge too, no exception fires (MMIO writes don't fault), and the screen shows the torn partial push (the white bands). The boot-time clear() always worked on the same hardware and uses per-word volatile stores, so the scroll push now uses the identical pattern: shadow reads (cached RAM, cheap) + individually-posted display stores. Interruptible between stores, never a bulk burst, and functionally identical on QEMU (all 5 suites re-pass). Also converts the no-shadow fallback shift to the same per-word pattern. CONTEXT.md updated (scroll-cost note + versioning).
* rsnix v0.5.2: fault diagnostics + real-hardware scroll-crash hardeningsalmonik2026-08-014-15/+339
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The real-hardware scroll crash (white bands + instant freeze, QEMU-clean) was invisible because the only trace was a single serial line on machines with no serial console. This makes every crash self-identifying and hardens the real-hardware failure surfaces: - Every CPU exception vector 0-31 now has an IDT entry (macro-generated stubs; 8/14 keep their IST stacks). A fault in the shell prints a white-on-red band to the framebuffer via gop::dump_lines (raw fb writes bypassing the vt, fully clamped) plus a parseable serial line: '!!! <kind> vec=N err=… rip=… cr2=… rsp=… rflags=… task=N "name"', then halts — instead of converging to a cryptic double fault. Background-task faults abort the task as before. - Boot log now reports the authoritative post-SetMode geometry: 'gop: fb base=… size=… pitch=… WxH bpp=… bgr=…', so the next real machine's report identifies whether pitch*height exceeds the mapping. - Framebuffer writes (clear, push_rect, shift_up_n bulk push, cursor overlay) are clamped to the firmware's framebuffer_size: a pitch- padded mode degrades to a truncated view instead of faulting past the mapping. - The GOP framebuffer region is excluded from the page allocator (and subtracted from the heap's conventional-region pick) even when the firmware lists it as ConventionalMemory — kernel allocations can never overwrite the display again. The GOP protocol is located and peeked before the memory map is captured so the exclusion is known at heap-init time. - Shell gains a hidden 'fault' command (deliberate unmapped write) and 'make test-fault' verifies the dump: vec=14, cr2=0x400000000000, task=0, halt — no triple fault. All other suites re-pass. - CONTEXT.md: fault-dump format documented for real-hardware reports.
* rsnix v0.5.1: force the GUI canvas to 800x600 via GOP SetModesalmonik2026-08-012-4/+105
| | | | | | | | | | | | | | | | | | | The kernel used to inherit whatever GOP mode the firmware picked (QEMU/OVMF gave 1280x800). Now every surface derives from a fixed 800x600 canvas: - uefi: typed EfiGopQueryMode/SetMode/GetMode fn pointers in GraphicsOutputProtocol (were raw *mut c_void, never called). - gop::select_gop_mode: scan the mode list for an exact 800x600 (32-bit BGR/RGB only, the driver assumes 4 Bpp), SetMode it; fall back to the smallest mode that fits the canvas, then to the firmware's choice. SetMode may move both the mode info pointer and the framebuffer base, so both are re-read after the switch. Boot log: 'gop: mode 3 selected — 800x600 (was 1280x800)'. - tests: relative assertions are resolution-agnostic; test-gfx and test-mouse had a boot-log race (shell line prints before the cursor task line) — now wait for the cursor line instead of grepping once. All four suites pass at 800x600. 0 build warnings.
* rsnix v0.5.0: graphics layer + cursor compositorsalmonik2026-08-014-31/+346
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The first visible GUI surface: real rect primitives, a single shadow→display push path, and an on-screen mouse cursor that can never race the text surface. gop: - fill_rect + push_rect(x,y,w,h): every raster op rasterises into the RAM shadow, then push_rect copies the rect to the display (write-only, still never read) and composites the cursor on top. blit_glyph and scroll shifts now route through it. - cursor overlay: 12x16 pointer (const-fn built from column lists) drawn white with a black offset outline; position in one AtomicU64 (x:high 32, y:low 32) — unpack masks the low word (a bare 'as usize' cast is a no-op on 64-bit). The cursor never enters the shadow, so erasing is just a shadow push of the old rect. - cursor_redraw after scroll shifts and once at spawn (the vt diff never re-blits idle cells). cursor task (task 2, spawned at boot when a mouse is present): - owns the PS/2 ring; polls every 10 ms, moves the cursor (clamped), tracks buttons, and forwards every event to a task's queue when 'mouse <id>' armed it (the window-manager input path). - /dev/mouse is now a position device (x/y/buttons snapshot); 'mouse' watches the cursor live (prints on change); 'cursor' prints one-shot state; 'gfx' draws a status-bar demo; 'gfx check' is an in-kernel pixel self-test (shadow readback, display readback, cursor overlay purity) — PASS/FAIL per stage. Tests (headless QEMU + monitor injection): - make test-gfx (new): all four compositor checks PASS. - make test-mouse (rewritten): cursor tracks mouse_move deltas, buttons ride along, /dev/mouse snapshot, live watch, real-event queue routing. - make test-msg: task numbering shifted (cursor is task 2; msgrecv is task 3) — updated, still PASS. - make test-disk regression re-passes. 0 build warnings.
* rsnix v0.4.0: GUI input foundation — PS/2 mouse + scheduler message queuessalmonik2026-08-014-17/+471
| | | | | | | | | | | | | | Mouse (IRQ12, stream mode): ByteRing generalized for both PS/2 devices, ISR routes data-port bytes by the controller's aux bit; mouse_init with bounded-ACK handshake (boots without a mouse); packet decoder with bit-3 resync, screen-relative deltas, buttons. Exposed as /dev/mouse, the `mouse` stream command, and `make test-mouse`. Message queues (ADR 0003's GUI-era primitive): every task gets a static 16-slot TaskMsg ring; send/recv/recv_blocking with direct wake + tick scan safety net for the lost-wakeup race; `msgrecv`/`send` commands, `mouse <id>` routes real IRQ12 events into a task's queue, jobs shows q=. `make test-msg` + `make test-disk` regression pass.
* fix pi-lens warnings: unwraps, shell SC2046, dup code ↵salmonik2026-08-016-40/+76
| | | | | | | | | | | | | | | | | | (fmtbuf/scripts/hexdump/cat/ahci/pci) - memory.rs: self-test Layout::from_size_align no longer panics — the test fails cleanly on an invalid layout - fat.rs: v() no longer unwraps the active-volume slot — invariant violation logs + halts instead of panicking mid-disk-io - strbuf: shared FmtBuf replaces the duplicated PanicBuf/FmtBuf (main.rs + sched.rs) - test-disk.sh: SC2046 — conditional --fresh arg no longer relies on word splitting - scripts: boot.sh/boot-image.sh share lib-boot-args.sh (dup args loop) - shell: cat/hexdump stdin pairs unified with Option<&str> marker; hexdump format_row folded into format_partial - ahci: read/write_sectors unified behind dma_sectors - pci: config_read/write share config_addr
* klog/tty/pager: no more truncated lines — full lines flow, terminal wrapssalmonik2026-08-012-4/+11
| | | | | | | | | | | | - klog: MAX_LINE 128 -> 512 (lens widened u8 -> u16) — long serial_println lines (panics, boot messages) are no longer cut at 128 bytes; they print in full and the terminal wraps them at the screen edge - tty: LINE_BUF_SIZE 256 -> 1024 — typed command lines longer than 256 chars were silently dropped at the buffer limit; now they echo and submit in full (the terminal already wraps the echo mid-typing) - pager (-p): screenfuls now count wrapped rows, not lines — a line wider than the terminal occupies ceil(len/cols) rows, so the pause lands at a real screen boundary instead of overflowing it
* rsnix: preemptive kernel tasks (ADR 0003) — sched, IST fault stacks, ↵salmonik2026-08-016-47/+932
| | | | | | | | | | | | | | | | | | 176-byte frames - sched: 16-slot static table, shell=task 0, idle=task 1, spawn with guard page + 8 KiB stack, RR on the 100 Hz tick, int 0x60 yield, sleep_ms, lazy reap, jobs/bg/sleep/kill shell commands - gdt: own GDT mirroring UEFI selectors + TSS with IST1/IST2 (guard-page overflows die gracefully instead of triple-faulting) - interrupts: isr_dispatch returns next frame in rax; IntFrame grows rsp/ss fields — QEMU's 64-bit iretq always pops all five slots from a 176-byte frame, so synthetic task frames must carry rsp=top+ss (a 160-byte frame made the first iretq pop rsp/ss from the unmapped page beyond the frame) - panic handler: task panics abort the task, shell keeps running - main: sched::init moved after page allocator + adopted tables (the idle's stack+guard need both; it was silently not spawning)
* rsnix: formattingsalmonik2026-08-012-7/+19
|
* rsnix: runtime device detection — rescan for hotplugged/removed diskssalmonik2026-08-013-35/+250
| | | | | | | | | | | | | | | | | | | | | | | | Phase 1: make the boot discovery pipeline re-runnable and diff it against live hardware state. - ahci: store ABAR/NP/port bitmap; poll_dirty() (cheap PxSSTS.DET check per port) and rescan() which starts newly-present ports and tombstones the slots of removed ones. Slots never shift, so disk indices stay valid. select() now rejects tombstoned slots. - fat: Volume gets a mounted flag; rescan() unmounts volumes whose disk left and mounts every disk without a mounted volume (re-trying failed boot mounts). UID dedup ignores tombstones so a re-plugged disk keeps its /disk/<UID> name. - fs: init's mount loop factored into rescan_disks(), which lazily creates /disk, ensures a mount node per mounted volume and tombstones nodes of unmounted ones. - shell: 'rescan' command + automatic deep rescan before each prompt when ahci::poll_dirty() sees a port-presence change. Rescan events flow through serial_println so they land in klog too. Removal (PxSSTS) is a real-hardware path: QEMU q35 rejects disk hotplug on the ich9-ahci IDE buses, and PCIe device_del is a guest-cooperative protocol this kernel does not implement.
* klog: [ssss.mmm] millisecond timestamps from the PITsalmonik2026-08-013-17/+89
| | | | | | | | | | | | | | | | | | | | - interrupts::uptime_ms(): monotonic ms since boot — the 100 Hz PIT tick (10 ms) plus interpolation from the PIT's live 1.19 MHz down-counter (read twice around the tick load; a count jump means a tick fired between reads) for true sub-ms resolution. TICKS widened AtomicU16 -> AtomicU64 (u16 wrapped after ~11 min). - PIT_READY gates interpolation until interrupts::init configures the timer, so early-boot lines are deterministically [0000.000] instead of uninitialised-PIT noise; klog clamps timestamps monotonic. - The CMOS RTC cannot provide milliseconds (1 Hz BCD device, seconds only) — millis come from the PIT. - klog stores ms per line at append time; dump format is now '[0000.123] 000000 === rsnix boot ===' (user-specified format). Verified in QEMU: first line [0000.000], Phase-2 lines show real monotonic ms (fs: vfs ready at [0000.519], self-test [0000.524]), per-dump monotonicity, boot.log persists timestamps, test-disk round trip fsck-clean.
* klog: kernel log ring + /dev/klog + klog shell commandsalmonik2026-08-014-1/+149
| | | | | | | | | | | | | | | | | | | | | | | - rsnix/src/klog.rs: RAM ring of the last 128 serial log lines (128 chars each), fed by serial_println! so every boot/low-level message is captured for free. Sequence numbers per line, wrap/drop accounting; the ring never allocates (const-constructible static). - /dev/klog char device; shell 'klog' is a thin alias for cat /dev/klog with the same filters/redirection, so 'klog -t 5', 'klog -g fat' and 'klog WRITING /disk/.../boot.log' all work. klog rejects positional args (usage) and input keywords. - Shell user-facing output (banner, prompt, term_print/term_println, pipeline sink, halt/poweroff) now writes to serial directly instead of through serial_println!, keeping echo/cat output out of the boot log (a streaming cat /dev/mem would otherwise wrap the ring). - serial_println! macro hooks klog::append_fmt via format_args! (no alloc at call sites); klog::dump formats the log for the device. Verified in QEMU: 28 boot lines captured (seq 0..27), shell output absent from the ring, klog WRITING persists a boot log (mtype-checked), wrap verified with a temporary 140-line boot loop (128 kept / 40 dropped, seq 40..167, oldest-live correct; loop reverted); full test-disk round trip still fsck-clean.
* Bump workspace to edition 2024salmonik2026-08-018-27/+13
| | | | | | | | | | | | | | - edition = "2024" in the workspace manifest and rsdosedit - extern blocks must be unsafe: interrupts.rs ISR stubs -> unsafe extern "C" - #[no_mangle] -> #[unsafe(no_mangle)] (efi_main, isr_dispatch) - One missed static-mut read in free_list_insert wrapped in an explicit unsafe block (edition 2024 removed the implicit unsafe context inside unsafe fns) - rustfmt reflows for 2024: nested if-lets become let-chains, imports re-sorted, rsdosedit help-screen box rows wrapped No codegen-affecting changes. Validated: cargo check/clippy/fmt clean (host + uefi target), make test-disk PASS, editor round-trip PASS.
* Clean up warnings, fix FAT32 multi-cluster dirs, prep for edition 2024salmonik2026-08-0110-114/+161
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Warning cleanup (cargo check + clippy now 0 across the workspace): - Migrate all 21 static_mut_refs sites to &raw mut accessors (fat, gop, ps2, vt, ahci, interrupts, memory) so edition 2024 won't deny them - panic = "abort" profiles: bare cargo check/build now works without nightly/-Zbuild-std - Wire TICKS in the timer ISR (it was never incremented, so the vt scroll batching trigger was dead code) - Clippy: efi_main becomes unsafe extern "efiapi" with a # Safety doc, KeyBuf::new uses inline-const array repeat (no interior-mutable const), editor main loop is a while-let, PIT control byte regrouped - [workspace.lints.clippy] allows result_unit_err + needless_range_loop (deliberate kernel style); large_enum_variant allowed on LineInput - Drop now-stale static_mut_refs allow from the rsdos bin FAT32 correctness fixes (both pre-existing, exposed by the SFN fix): - Unique 8.3 short names: to_8_3() never disambiguated collisions, so files sharing a long-name prefix got identical SFNs and fsck reported duplicate directory entries. Add dir_short_names() + unique_short_name() (~N tails, Windows-style) and force LFN when the SFN changes. - Multi-cluster directories: scan_dir/dir_short_names stopped at the first 0x00 slot, hiding every entry written into a chained cluster (writes failed with 'cannot write', duplicate SFNs accumulated); add_dir_entry now packs the cluster (0xE5 deleted-markers) before extending so other FAT readers (mtools, Windows) see the continuation too. Other: delete dead fields (Disk.fis, Volume.fat_count), drop timer_irq/ keyboard_irq/rendered, refresh_and_exit is a documented unsafe fn, CONTEXT .md corrected (stable toolchain, IRQ input, 4-crate layout), .gitignore excludes .pi-subagents artifacts. Validated: cargo check/clippy/fmt clean, make test-disk PASS on fresh and reused images (incl. two directory-chain extensions and ~10 SFN tails), editor round-trip smoke test PASS.
* rustfmt: reflow fat.rs/fs.rs formattingsalmonik2026-08-012-12/+18
|
* fat: mount every FAT32 volume under /disk/<UID>/, fix multi-entry LFNsalmonik2026-08-012-89/+188
| | | | | | | | | | | | | | | | | | | | | | | | | - fat.rs: VOL: Option<Volume> → VOLS: Vec<Volume>; try_mount() returns a Volume per disk and init() mounts every valid FAT32 volume found. Volume UID = sanitized uppercase label + 8-hex volume serial (e.g. RSDOS-5BD1E55F): unique per format, stable across reboots, human-recognizable, machine-parseable (^[A-Z0-9_]+-[0-9A-F]{8}$); cloned volumes get a -N suffix. Public ops take a vol index and select it (select_vol also picks the backing AHCI disk), matching the ahci::select pattern - fs.rs: /disk is now a plain directory whose children are one Disk node per mounted volume, named by UID; DiskInfo carries vol - LFN fix: entries are stored last-first on disk — both the writer (head-entry first) and reader (append in disk order) were reversed and cancelled out for ≤13-char names; multi-entry names (>13 chars) read back mangled (e.g. 'from-kernel.txt' as 'xt'). Writer now places seq=1 closest to the SFN and seq=N|0x40 first; reader places chunks by sequence number and trims at the first NUL. Verified with a 25-char filename round trip: kernel ls/cat correct, mtools shows the full LFN, fsck clean on both volumes - test-disk.sh: test file renamed to disk-test-.txt (>13 chars, exercises multi-entry LFN); UID discovered from the boot log; QEMU stdio redirected to a log file + EXIT trap so an orphaned QEMU can never hang a piped caller (it previously did, 400s)
* scripts: automate the data-disk workflow (mkdisk / sendkeys / test-disk)salmonik2026-08-011-1/+4
| | | | | | | | | | | | | | | | | | | | | - scripts/mkdisk.sh: create the FAT32 disk with mkfs.fat -C (the flag that actually creates the file — plain mkfs.fat fails on a missing path), accept M/G/K sizes, seed seed/ files via mtools; --fresh re-formats, --no-seed skips seeding - scripts/sendkeys.py: type lines into the guest via the QEMU monitor (US layout). Punctuation must use QEMU's named keys (minus, slash, dot, ...) — bare '-', '.', '/' are not valid sendkey names, and '-' is the modifier separator, so they were silently dropped before - scripts/test-disk.sh: full automated round trip — build, deploy, ensure image, boot headless QEMU, drive the shell (ls /disk, mkdir, echo >, cat, poweroff), then verify with fsck.fat (must be clean) and mtype (file content must have survived poweroff) - Makefile: make disk / disk-fresh / inspect / test-disk; run, run-gui and debug now auto-create a missing DISK_IMG; fix the stale comment (mkfs.fat without -C) - scripts/boot.sh: auto-create a missing DISK_IMG via mkdisk.sh - seed/: motd.txt + lines.txt seeded onto fresh images - Verified end to end: ./scripts/test-disk.sh --fresh passes
* ahci: skip ATAPI ports and fast-fail on device abortsalmonik2026-08-011-5/+22
| | | | | | | | | | | | A CD-ROM (or any ATAPI device) on a scanned port previously made the driver spin the full 100M-iteration timeout on IDENTIFY, then log a scary 'timed out' (QEMU leaves ATAPI aborts pending in PxCI instead of completing the slot; tfd=0x441 = ABRT). - skip a port up-front when firmware set PxCMD.ATAPI (bit 24) - bail out of the completion poll as soon as PxTFD.ERR is set, clear the error bits and any wedged slot, and report the abort instead of timing out — the port scan stays fast with a CD attached
* ahci: scan all ports; fat: mount first valid FAT32 disksalmonik2026-07-312-64/+134
| | | | | | | | | | | | | | | | | The kernel previously started only AHCI port 0, so any launch where the firmware/QEMU put something else on port 0 (e.g. the ESP from an implicit -drive file=fat:rw:esp) left the real disk unnoticed: 'unsupported sector size 0' and no mount. - ahci.rs: enumerate CAP.NP/PI ports, start every port that links up (empty ports settle at DET=0 and are skipped quickly), keep up to 8 disks, and expose disk_count()/select() for the filesystem - fat.rs: try each disk in port order and mount the first valid FAT32 volume; non-FAT disks are logged and skipped - scripts/boot.sh: attach the data disk on ide.0 and the ESP on ide.1 (DISK_IMG env var, default /tmp/disk.img), matching the Makefile - Verified with the disk on port 0 (Makefile style), port 5 (old-style command line), and with the ESP on port 0; fsck.fat stays clean
* ahci: SATA driver + FAT32 persistent disk mounted at /disksalmonik2026-07-317-8/+1490
| | | | | | | | | | | | | | | | | | - ahci.rs: polling AHCI on PCI class 1/6/1, bus mastering + ABAR map, port 0 up, IDENTIFY + READ/WRITE DMA EXT through one 4KiB DMA buffer - fat.rs: BPB parse, whole-FAT RAM cache with write-back to both copies, LFN read/write, dirs, multi-cluster files, FSInfo free-count sync, space-padded dot entries ('..' = cluster 0 under root), fsck-clean - fs.rs: /disk mount node + 24-slot ephemeral node pool; ls/cat/hexdump/ echo/mkdir/touch/rm/edit all work on disk paths unchanged - QEMU: explicit bus assignment (disk=ide.0, ESP=ide.1); the implicit fat:rw:esp drive was stealing AHCI port 0 - Debugged against QEMU source: header DW0 is CFL in bits 4:0 / PRDTL in bits 31:16 (Linux libahci layout), FIS count at bytes 12-13, device at byte 7; QEMU rejects H2D FIS flags bits 6:4, so direction is the header W bit only - Verified: full shell round-trip on /disk, reboot persistence (poweroff then mdir/mtype and a fresh boot), fsck.fat clean
* vt: defer scrolls and batch framebuffer pushessalmonik2026-07-313-19/+89
| | | | | | | | | | | | | | | | | | | | | | | | Streaming output scrolled one framebuffer push per line (each a ~3-8 MB write-only copy). The vt now scrolls the logical grid instantly in RAM and defers the display shift: N pending scrolls are pushed together as one shift_up_n — one push regardless of batch size. - vt: PENDING_SCROLLS counter; scroll_up shifts CELLS only; flush renders nothing while pending (the diff would otherwise re-rasterise the whole screen per line); sync_scroll() does one gop::shift_up_n + RENDERED mirror + normal diff flush (which re-blits just the newly exposed rows and the cursor). - Sync triggers: batch of 16 rows, ~40 ms of stream pause (100 Hz TICKS), any CSI sequence (full-screen apps like the editor render immediately), clear_all/set_cursor_visible, interactive input (tty read_line/read_byte), and the shell before each prompt. - gop: shift_up → shift_up_n(n) (one shadow memcpy + one push). Verified in QEMU: mmap/hexdump streaming renders in coherent batches with the prompt syncing at the end; clear wipes clean; the editor scrolls and redraws immediately (45-line file, gutter + status bar intact, cursor correct); save/exit/cat round-trip unchanged. Release and dev builds pass.
* gop: RAM backbuffer — scrolling never reads the framebuffersalmonik2026-07-311-7/+64
| | | | | | | | | | | | | | | | | | | | | | Real-hardware GOP framebuffers are typically uncacheable or write-combining (firmware MTRR/PAT), so the scroll shift's full-screen memcpy *read* ~4-8 MB through uncached memory — a bus round-trip per cache line. That made scroll printing crawl on real hardware while plain printing (a few glyph writes) stayed instant. - gop keeps a RAM shadow copy of the whole framebuffer (same pitch layout), allocated at init. - Every raster write (glyph blits, clear) goes to both the display and the shadow. - shift_up becomes: cached shadow memcpy up one row + clear exposed bottom row in the shadow + one write-only push shadow→display via copy_nonoverlapping (64-byte bursts that coalesce on WC memory) — the display is never read. - Fallback to the old direct shift if the shadow allocation is null. Verified in QEMU: mmap output scrolls ~100 lines with coherent rows and a clean bottom row, clear wipes the screen, cursor tracks the prompt, editor paths untouched. Release + dev builds pass.
* vt: don't strand stale inverse cursor cells on scroll/clearsalmonik2026-07-313-9/+33
| | | | | | | | | | | | | | | | | | | | | | | | | | The cursor was blitted as an inverse-video cell directly onto the framebuffer, but that inversion was never recorded. RENDERED (the diff grid) only stored the logical cell, so when scrolling shifted the raw pixels up (gop::shift_up), the stale inverse block rode along while the grids said 'blank' — and blank-vs-blank never re-blits. Result: a cursor-shaped block at the end of every scrolled line, surviving even 'clear'. - flush() now mirrors the inverse colours into RENDERED when drawing the cursor (and restores RENDERED when erasing it), and the diff loop skips the visible cursor cell (owned by the cursor pass). Any scroll/clear then sees CELLS != RENDERED at a stale-inverse position and repaints it. - memory.rs heap self-test: snapshot heap state before its own allocations and assert the heap returns to that state, instead of asserting it coalesces to a single empty block. The vt cell grids (allocated earlier in boot) made the old 'free_blocks == 1' check fail; the new check is correct regardless of prior live allocations. Verified in QEMU: hexdump /dev/mem streams hundreds of lines, ^C, screendump shows exactly one inverse cell (the live cursor); 'clear' leaves exactly one (the fresh prompt cursor). heap self-test OK again.
* vt: decode UTF-8, render box-drawing/arrow glyphs procedurallysalmonik2026-07-313-25/+247
| | | | | | | | | | | | | | | | | The editor's gutter '│' (U+2502) appeared as '???' — write_bytes fed each UTF-8 byte to the state machine, which mapped every byte >= 0x80 to '?', and the Latin-1 font has no box-drawing glyphs anyway. - vt.write_bytes now decodes UTF-8 sequences; printable non-ASCII dispatches to the glyph path instead of the byte parser. - gop: unicode_glyph_bits() procedurally rasterises box-drawing (U+2500-257F light/heavy/double), arrows (U+2190-2193) and the em dash (U+2014) — pure geometry, no font data needed; blit_glyph falls back to it for ch >= 256. Verified via framebuffer dumps: editor gutter │ renders as a vertical line, help screen ═ separators and ←→↑↓ all render as lines (no '?'). Shell banner em dash renders too.
* tty + vt terminal split, rsdosedit editor (1:1 UNIX console)salmonik2026-07-316-103/+869
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Kernel now has the classic UNIX console split, so full-screen ANSI apps can run in ring 0: - vt.rs: terminal emulator owning the text screen — cell grid (char + fg/bg), logical cursor (inverse-video), scrolling, and a small ANSI CSI parser (cursor position H/f, erase J/K, moves A-D, SGR 16-colour with correct ANSI→VGA mapping, cursor show/hide ?25). Blits only changed cells; scroll shifts cell grids + pixels and re-rasterises only the exposed bottom row. gop_println!/clear_screen now render through the vt; gop.rs is the raw rasteriser (colored glyph blits, pixel shift). - tty.rs: line discipline — canonical read_line (echo, line buffer, ^C cancel, ^D EOF) moved out of the shell, and raw read_byte that translates KeyEvents to the terminal byte protocol (arrows → ESC[A-D, Backspace → 0x7f, ^X → 0x18, Ctrl+arrows → ESC[1;5A-D, Home/End/PgUp/ PgDn/Delete). interrupt_pressed() stays for streaming commands. - ps2: generic Ctrl(char) + CtrlArrow events (was: only CtrlC/CtrlD). - rsdosedit: no_std port of the RNG rsedit editor as the first real app — undo, syntax highlighting (verified green/gray/yellow on the framebuffer), search, word nav, smart indent, ^S save / ^X exit / ^X again to discard. termios → tty raw, stdout → vt, std::fs → VFS (ramfs), SIGWINCH → fixed geometry, force-exit window → key counter. - shell: 'edit <path>' command; read_line/strbuf moved to rsnix. - CONTEXT.md: layout + milestones + known-issue perf notes. Verified in QEMU: full edit → type → arrow-move → insert → save → exit round trip with byte-exact file content; ANSI colors via screendump.
generated by cgit v1.2.3 (git 2.46.0) at 2026-11-08 20:08:52 +0000