sunriseos/sunriseos

Horizon/NX kernel reimplementation

SunriseOS

A microkernel based on Horizon/NX. Go to switchbrew for more information.

• Syscalls: https://switchbrew.org/wiki/SVC
• IPC: https://switchbrew.org/wiki/IPC_Marshalling

Documentation

Documentation is hosted on our github pages.

License

SunriseOS is distributed under the terms of either the MIT license or the Apache License (Version 2.0), at the user's choice.

See LICENSE-APACHE and LICENSE-MIT.

GRUB2 is distributed under the terms of the GPL v3 license.

sunriseos's Issues

Create a "Pio registry" from which we get Pio objects

Right now, Pios can be created at will with utter disregard for ownership. This isn't great. It'd be nice if we could statically guaranatee that a given pin will only be used once (and panic on duplicate use).

The idea would be to have a PioRegistry that keeps track of who uses which pins. This PioRegistry would keep a Vec (or HashMap or whatever) of Pio registration entries, and only return a Pio if it isn't already registered.

Fix sm.rs indentation

Please, my eyes are bleeding.

Actual error

https://github.com/roblabla42/KFS/blob/363247baacff6d8f4230e9eb84634324d1798f11/libuser/src/ipc/mod.rs#L226-L236

---

This issue was generated by todo based on a TODO comment in 363247b when #41 was merged. cc @roblabla.

Extend MappingType to cover all MemoryTypes

https://github.com/roblabla42/KFS/blob/124d0b523b1e9d747ae28edcce472cf73416f8d4/kernel/src/paging/mapping.rs#L48-L58

---

This issue was generated by todo based on a TODO comment in 124d0b5 when #28 was merged. cc @roblabla.

Unmap should free empty tables

let's avoid leaking memory, shall we?

Use clippy on CI to get even more warnings

Because we clearly don't have enough warnings.

Clippy is a cool tool that's able to catch a lot of logic bugs, in addition to imposing some style choices (which helps keep the code uniform).

Can we unmap a subsection of a shared memory?

https://github.com/roblabla42/KFS/blob/6d5bc6a113d731582bfecf9280695b50ccefafc0/kernel/src/interrupts/syscalls.rs#L272-L282

---

This issue was generated by todo based on a TODO comment in 6d5bc6a when #30 was merged. cc @roblabla.

Re-enable log-impl tests

https://github.com/roblabla42/KFS/blob/84f52da4950ee96188e38618b55d975a53609284/kernel/src/log_impl/filter/mod.rs#L365-L369

---

This issue was generated by todo based on a TODO comment in 84f52da when #63 was merged. cc @Orycterope.

Setup dependabot to stay on top of dependency updates

Dependabot is a github bot that automatically submits a PR when a dependency gets updated. https://dependabot.com.

Don't panic here! Unpacking happens in the server, we should return an

https://github.com/roblabla42/KFS/blob/363247baacff6d8f4230e9eb84634324d1798f11/libuser/src/ipc/mod.rs#L461-L465

---

This issue was generated by todo based on a TODO comment in 363247b when #41 was merged. cc @roblabla.

Rust 2018 here we come!

Rust 2018 has so many awesome feature, it'd be a shame if we missed out on them. We should upgrade to rust 1.31, and upgrade all our crates to the 2018 edition.

Use upstream font-rs

Return to vanilla font-rs, now that we're in userspace and have a heap.

This might need a PR to font-rs to expose a font's max_ascent and max_descent

Better Display implementation for libuser::Error

Right now, the libuser::Error Display just shims back to the Debug implementation.

---

https://github.com/roblabla42/KFS/blob/72768fb215755c2afa528e9f5a7838dc5cc36cb0/libuser/src/error.rs#L40-L50

---

This issue was generated by todo based on a TODO comment in 72768fb when #48 was merged. cc @roblabla.

Re-enable test_threads

Test threads has been disabled when VBELoggers were removed, as they would need the ability to get the terminal via an argument somehow.

---

https://github.com/roblabla42/KFS/blob/42d48b20bf345d877937578d7845304141937c9e/shell/src/main.rs#L98-L104

---

This issue was generated by todo based on a TODO comment in 42d48b2 when #52 was merged. cc @roblabla.

Implement PIT

Remove the kernel logger interface from userspace font rendering

The Logger trait and color attributes were used to multiplex kernel logging. They got copied to userspace when shell and clock were evicted from the kernel, but they could be hugely simplified now.

Resolve all libuser compilation warnings

bzero pages

The kernel must bzero every page that it gives to userspace, to prevent leaking data from a process to another.

Unfortunately this implies a lot of overhead. We should find a way to be smart about it, and do it the less often possible.

First we need to decide if either:

• All allocated pages are bzero'd, no matter if it's for landing them to user, or for kernel internal use.
• Only userspace pages are bzero'd before use. This means that the kernel can re-use old dirty userspace pages for its own use, which could facilitate kernel exploits. However since the kernel is supposed to be so small, and all services reside in userspace, this might be acceptable.

Secondly, we need to find a strategy to keep track of dirty pages, and bzero them only once.
I imagine we can put to use the dirty flag in the page tables, but i don't really know when would be the best moment to do the clean. On allocation ? On clean ?

Also: Do we consider never-used pages as clean ? Are they guaranteed to be all zeros on boot ?

A lot of questions 😕

Handle MemoryAttributes and refcounts in query_memory

https://github.com/roblabla42/KFS/blob/124d0b523b1e9d747ae28edcce472cf73416f8d4/kernel/src/interrupts/syscalls.rs#L244-L254

---

This issue was generated by todo based on a TODO comment in 124d0b5 when #28 was merged. cc @roblabla.

Move gdt.rs to i386/

gdt is specific to i386 architecture, and should not be at the root level

a to do with no body, c style */

https://github.com/roblabla42/KFS/blob/1b59e39cf98abb47fefa80fea0936b2b4e564303/kernel/src/main.rs#L129-L132

---

This issue was generated by todo based on a TODO comment in 1b59e39 when #20 was merged. cc @Orycterope.

CR0 WriteProtect bit

Apparently, if CR0 WP bit is not set, then the kernel can write in RO pages. We might want to set it.

Terminal - Get window size from vi

Terminal defines a fullscreen size as 1280 * 800, but should really get it from vi instead.

---

https://github.com/roblabla42/KFS/blob/42d48b20bf345d877937578d7845304141937c9e/libuser/src/terminal.rs#L70-L80

---

This issue was generated by todo based on a TODO comment in 42d48b2 when #52 was merged. cc @roblabla.

Map kernel in high memory (> 0xC0000000)

We should map the kernel at the end of address space (> 0xC0000000).

This might be accomplished by a bootstrap stage whose main goal is to enable paging. It maps the rest of the kernel in high addresses, and jumps to it. That way the kernel starts with paging already on.

The bootstrap is also a good place to handle architecture specific things, like setting up a valid kernel stack, creating the gdt, etc.

Implement kernel access controls (beyond IOPB)

We should implement KACs like Horizon/NX does. We currently have an ad-hoc system for specifying IOPB restrictions, ideally we should merge it with the KAC system.

https://switchbrew.org/w/index.php?title=NPDM#Kernel_Access_Control

Figure out the testing story for KFS

Our kernel is currently completely untested. We need to fix this. We should have two layers of tests:

1. Unit tests, which would be ran using (more or less) cargo test, will check the core routines of our kernel (bookkeeping, IPC primitives, scheduling algorithm, etc...) to make sure they have the expected behavior.

2. Integration tests, which would be either userspace binaries or "kernel processes" which would run under qemu and write the output of the test to the serial console.

The first layer is very easy to implement. We just need to add a few #[cfg] here and there, and write the damn tests.

The second layer is more interesting though. It will require adding a test harness to the kernel. The test harness will be responsible with running the tests (which should each be a single "Process" - either userspace or kernel) and outputing the results of the tests on the serial console. Ideally, it should output it in a format understood by the TAP protocol (https://testanything.org/), so that we can then use TAP consumers (such as tappy) to read the output easily. There is a crate that allows easily writing TAP producers: https://docs.rs/testanything/0.1.1/testanything/

report #[cfg(not(test))] and #[global_allocator]

`#[cfg(not(test))]` still compiles this item with cargo test, but `#[cfg(target_os = "none")] does not. I think this is a bug, we should report it.

---

https://github.com/roblabla42/KFS/blob/84f52da4950ee96188e38618b55d975a53609284/libuser/src/lib.rs#L36-L43

---

This issue was generated by todo based on a TODO comment in 84f52da when #63 was merged. cc @Orycterope.

Actual error

https://github.com/roblabla42/KFS/blob/363247baacff6d8f4230e9eb84634324d1798f11/libuser/src/ipc/mod.rs#L219-L229

---

This issue was generated by todo based on a TODO comment in 363247b when #41 was merged. cc @roblabla.

Vi: Implement alpha blending

Vi currently does not do alpha blending at all. In the interest of pretty transparent window, this needs fixing!

---

https://github.com/roblabla42/KFS/blob/42d48b20bf345d877937578d7845304141937c9e/vi/src/main.rs#L126-L136

---

This issue was generated by todo based on a TODO comment in 42d48b2 when #52 was merged. cc @roblabla.

a to do with no body, c++ style

https://github.com/roblabla42/KFS/blob/1b59e39cf98abb47fefa80fea0936b2b4e564303/kernel/src/main.rs#L121-L131

---

This issue was generated by todo based on a TODO comment in 1b59e39 when #20 was merged. cc @Orycterope.

Frame Allocator should take lengths in bytes.

https://github.com/roblabla42/KFS/blob/6d5bc6a113d731582bfecf9280695b50ccefafc0/kernel/src/interrupts/syscalls.rs#L235-L245

---

This issue was generated by todo based on a TODO comment in 6d5bc6a when #30 was merged. cc @roblabla.

FrameAllocator fix overflow.

This will overflow on OOM.

---

https://github.com/roblabla42/KFS/blob/72c424a91bf525a913cdfb36fcfa4e7a3f2cc6e6/kernel/src/frame_allocator/i386.rs#L234-L238

---

This issue was generated by todo based on a TODO comment in 72c424a when #78 was merged. cc @Orycterope.

Port libstd

We have a userspace. Next step is porting the libstd. This would allow us to use many of the nice interfaces from std, such as std::io, HashMaps, etc...

Safet/Unsafety: Make all functions potentially invalidating pointers take a `fn() -> !` and return !

This should allow those function to be memory-safe, and make it harder to fuck up and reuse invalidated pointers.

Corruption of vbe

Our kernel displays corrupted lines at the top of the screen.

I suspect the frame allocator is to blame, giving us frames we shouldn't by writing to.

RE the switch: can we map a subsection of a shared memory?

https://github.com/roblabla42/KFS/blob/6d5bc6a113d731582bfecf9280695b50ccefafc0/kernel/src/interrupts/syscalls.rs#L254-L264

---

This issue was generated by todo based on a TODO comment in 6d5bc6a when #30 was merged. cc @roblabla.

Make CURRENT_PROCESS safe through the use of a cpu_local

report rustc panic

Having the FRAMES_BITMAP_SIZE set to this value on a 64 bit target causes rustc to panic in a really random assertion when creating the array (which would be too big).
I think we should report that.

---

https://github.com/roblabla42/KFS/blob/84f52da4950ee96188e38618b55d975a53609284/kernel/src/frame_allocator/i386.rs#L38-L48

---

This issue was generated by todo based on a TODO comment in 84f52da when #63 was merged. cc @Orycterope.

test to do tool

https://github.com/roblabla42/KFS/blob/1b59e39cf98abb47fefa80fea0936b2b4e564303/kernel/src/main.rs#L92-L100

---

This issue was generated by todo based on a TODO comment in 1b59e39 when #20 was merged. cc @Orycterope.

Safety of the vi::draw IPC method

When calling vi::draw, vi reads from the shared memory. There is no borrow-checking mechanism in place to ensure that the other process does not mutate it while this happens. Maybe we should have some kind of cross-process mutex? How to implement this properly?

---

https://github.com/roblabla42/KFS/blob/42d48b20bf345d877937578d7845304141937c9e/vi/src/main.rs#L109-L119

---

This issue was generated by todo based on a TODO comment in 42d48b2 when #52 was merged. cc @roblabla.

move syscall.rs to top level

It does not need to be related to interruptions, and should be the easiest module to find in all the kernel.

PageInfo Handling

https://github.com/roblabla42/KFS/blob/124d0b523b1e9d747ae28edcce472cf73416f8d4/kernel/src/interrupts/syscalls.rs#L253-L261

---

This issue was generated by todo based on a TODO comment in 124d0b5 when #28 was merged. cc @roblabla.

error types

Make kernel errors match the userspace errors.

device drivers should be compiled only for i386

https://github.com/roblabla42/KFS/blob/84f52da4950ee96188e38618b55d975a53609284/kernel/src/devices/rs232.rs#L21-L27

---

This issue was generated by todo based on a TODO comment in 84f52da when #63 was merged. cc @Orycterope.

Implement Serial Port

We lost the pretty CGA 😭 . We'll need an easy low-level debugger for all the dumb shit that'll happen in the VBE stuff, and serial seems easy enough. Right? 😅

Object Macro: Take Error type as $ty

We currently match the Error token exactly, which is overly restrictive.

---

https://github.com/roblabla42/KFS/blob/72768fb215755c2afa528e9f5a7838dc5cc36cb0/libuser/src/ipc/macros.rs#L98-L104

---

This issue was generated by todo based on a TODO comment in 72768fb when #48 was merged. cc @roblabla.

Bootstrap pagefault when clock and shell are both set and ModuleAlign is set

557ac04

Frame: Implement Drop

Reserve a bit in the PageEntry for DROPPABLE, add a bool in Frame for droppable. If droppable is true, free the frame from the allocator.

Safety/Unsafety: Make KernelStack::switch_to() safe if possible

It follows the scheme from #1, just need to make extra sure it's safe

Crash when IRQ triggers for a registered process who finished waiting

Currently, we never unregister our intents. This means that if we wait(), return from wait (so we're Scheduled/Running), and then get an IRQ for another event, we'll add the process to the schedule queue again, causing an assert.

I believe we should clean up registrations.