From ab7d87bcde31c1681ea09c30534dde840a58d6fa Mon Sep 17 00:00:00 2001 From: salmonik Date: Sat, 1 Aug 2026 22:28:34 +0200 Subject: rsnix v0.5.2: fault diagnostics + real-hardware scroll-crash hardening MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The real-hardware scroll crash (white bands + instant freeze, QEMU-clean) was invisible because the only trace was a single serial line on machines with no serial console. This makes every crash self-identifying and hardens the real-hardware failure surfaces: - Every CPU exception vector 0-31 now has an IDT entry (macro-generated stubs; 8/14 keep their IST stacks). A fault in the shell prints a white-on-red band to the framebuffer via gop::dump_lines (raw fb writes bypassing the vt, fully clamped) plus a parseable serial line: '!!! vec=N err=… rip=… cr2=… rsp=… rflags=… task=N "name"', then halts — instead of converging to a cryptic double fault. Background-task faults abort the task as before. - Boot log now reports the authoritative post-SetMode geometry: 'gop: fb base=… size=… pitch=… WxH bpp=… bgr=…', so the next real machine's report identifies whether pitch*height exceeds the mapping. - Framebuffer writes (clear, push_rect, shift_up_n bulk push, cursor overlay) are clamped to the firmware's framebuffer_size: a pitch- padded mode degrades to a truncated view instead of faulting past the mapping. - The GOP framebuffer region is excluded from the page allocator (and subtracted from the heap's conventional-region pick) even when the firmware lists it as ConventionalMemory — kernel allocations can never overwrite the display again. The GOP protocol is located and peeked before the memory map is captured so the exclusion is known at heap-init time. - Shell gains a hidden 'fault' command (deliberate unmapped write) and 'make test-fault' verifies the dump: vec=14, cr2=0x400000000000, task=0, halt — no triple fault. All other suites re-pass. - CONTEXT.md: fault-dump format documented for real-hardware reports. --- shell/src/lib.rs | 13 +++++++++++++ 1 file changed, 13 insertions(+) (limited to 'shell/src/lib.rs') diff --git a/shell/src/lib.rs b/shell/src/lib.rs index e1d54c8..3090776 100644 --- a/shell/src/lib.rs +++ b/shell/src/lib.rs @@ -721,6 +721,7 @@ write `{} TIL `", "sleep" => cmd_sleep(&parsed), "kill" => cmd_kill(&parsed), "demo" => cmd_demo(&parsed), + "fault" => cmd_fault(), _ => term_err(&alloc::format!("unknown command: {}", cmd)), } } @@ -806,6 +807,18 @@ fn cmd_hello(p: &Parsed) { pipe.end(); } +/// Deliberately fault on an unmapped address — test hook that verifies +/// the fault-dump path (screen + serial) halts cleanly instead of +/// triple-faulting. The system stops; the log must show the dump. +/// Canonical-but-unmapped address (below 2^47, above any RAM/MMIO): the +/// page walk terminates at a not-present entry → #PF with CR2 = address. +fn cmd_fault() { + term_println("fault: writing to 0x0000_4000_0000_0000..."); + unsafe { + core::ptr::write_volatile(0x0000_4000_0000_0000usize as *mut u32, 0x1234u32); + } +} + fn cmd_clear() { rsnix::gop::clear_screen(); } -- cgit v1.2.3