feat: Add certs, init, io_uring, security, usr, virt subsystems, Nano editor & full LazyBox suite

include/arch/x86_64/cpuid.h

@@ -24,6 +24,12 @@ typedef struct {
     bool has_rdrand;
 } cpu_info_t;
 
+static inline void cpuid(uint32_t leaf, uint32_t* eax, uint32_t* ebx, uint32_t* ecx, uint32_t* edx) {
+    __asm__ volatile("cpuid"
+                     : "=a"(*eax), "=b"(*ebx), "=c"(*ecx), "=d"(*edx)
+                     : "a"(leaf), "c"(0));
+}
+
 void cpuid_detect(cpu_info_t* info);
 const cpu_info_t* cpuid_get_info(void);
 

include/certs/certs.h

@@ -0,0 +1,42 @@
+#ifndef _CERTS_CERTS_H
+#define _CERTS_CERTS_H
+
+#include <stdint.h>
+#include <stddef.h>
+#include <stdbool.h>
+
+#define MAX_CERT_SUBJECT 128
+#define MAX_CERT_ISSUER  128
+#define MAX_CERTS_STORE  16
+
+typedef enum {
+    KEY_ALGO_RSA = 1,
+    KEY_ALGO_ECDSA,
+    KEY_ALGO_ED25519
+} cert_key_algo_t;
+
+typedef struct {
+    char subject[MAX_CERT_SUBJECT];
+    char issuer[MAX_CERT_ISSUER];
+    uint32_t valid_from;
+    uint32_t valid_to;
+    cert_key_algo_t algo;
+    uint8_t public_key[256];
+    size_t key_len;
+    uint8_t fingerprint[32]; // SHA-256 fingerprint
+    bool trusted;
+} x509_cert_t;
+
+typedef struct {
+    x509_cert_t certs[MAX_CERTS_STORE];
+    size_t count;
+} kernel_keyring_t;
+
+void certs_init(void);
+int certs_add_trusted(const char* subject, const char* issuer, cert_key_algo_t algo, const uint8_t* pubkey, size_t key_len);
+bool certs_verify_signature(const uint8_t* data, size_t data_len, const uint8_t* sig, size_t sig_len, const x509_cert_t* cert);
+x509_cert_t* certs_find_by_subject(const char* subject);
+size_t certs_get_count(void);
+const x509_cert_t* certs_get_cert(size_t index);
+
+#endif // _CERTS_CERTS_H

include/crypto/crypto.h

@@ -31,7 +31,20 @@ typedef struct {
 void sha256_init(sha256_ctx_t* ctx);
 void sha256_update(sha256_ctx_t* ctx, const void* data, size_t len);
 void sha256_final(uint8_t hash[32], sha256_ctx_t* ctx);
-void sha256_string(const char* str, char output[65]);
+// One-shot hash helpers
+static inline void md5(const void* data, size_t len, uint8_t digest[16]) {
+    md5_ctx_t ctx;
+    md5_init(&ctx);
+    md5_update(&ctx, data, len);
+    md5_final(digest, &ctx);
+}
+
+static inline void sha256(const void* data, size_t len, uint8_t hash[32]) {
+    sha256_ctx_t ctx;
+    sha256_init(&ctx);
+    sha256_update(&ctx, data, len);
+    sha256_final(hash, &ctx);
+}
 
 // PRNG (Cryptographic Pseudo-Random Number Generator)
 void prng_seed(uint64_t seed1, uint64_t seed2);

include/init/init.h

@@ -0,0 +1,32 @@
+#ifndef _INIT_INIT_H
+#define _INIT_INIT_H
+
+#include <stdint.h>
+#include <stddef.h>
+#include <stdbool.h>
+
+#define MAX_CMDLINE_LEN 256
+#define MAX_BOOT_ARGS   16
+
+typedef enum {
+    RUNLEVEL_HALT = 0,
+    RUNLEVEL_SINGLE = 1,
+    RUNLEVEL_MULTIUSER = 3,
+    RUNLEVEL_GRAPHICAL = 5,
+    RUNLEVEL_REBOOT = 6
+} runlevel_t;
+
+typedef struct {
+    char key[32];
+    char value[64];
+} boot_param_t;
+
+void init_early(const char* boot_args);
+void init_parse_cmdline(const char* cmdline);
+const char* init_get_param(const char* key);
+bool init_has_param(const char* key);
+runlevel_t init_get_runlevel(void);
+void init_set_runlevel(runlevel_t rl);
+void init_system_banner(void);
+
+#endif // _INIT_INIT_H

include/init/version.h

@@ -0,0 +1,15 @@
+#ifndef _INIT_VERSION_H
+#define _INIT_VERSION_H
+
+#define SUBOS_VERSION_MAJOR 0
+#define SUBOS_VERSION_MINOR 2
+#define SUBOS_VERSION_PATCH 0
+#define SUBOS_VERSION_CODENAME "Titan"
+#define SUBOS_VERSION_STRING "0.2.0-lts (x86_64)"
+#define SUBOS_BUILD_TARGET "x86_64-elf-baremetal"
+#define SUBOS_COMPILER "x86_64-elf-gcc (Modular Monolithic)"
+
+const char* kernel_get_version(void);
+const char* kernel_get_build_banner(void);
+
+#endif // _INIT_VERSION_H

include/io_uring/io_uring.h

@@ -0,0 +1,60 @@
+#ifndef _IO_URING_IO_URING_H
+#define _IO_URING_IO_URING_H
+
+#include <stdint.h>
+#include <stddef.h>
+#include <stdbool.h>
+
+#define IORING_QUEUE_DEPTH 32
+
+/* io_uring opcodes */
+#define IORING_OP_NOP         0
+#define IORING_OP_READV       1
+#define IORING_OP_WRITEV      2
+#define IORING_OP_FSYNC       3
+#define IORING_OP_READ_FIXED  4
+#define IORING_OP_WRITE_FIXED 5
+#define IORING_OP_TIMEOUT     6
+#define IORING_OP_CLOSE       7
+
+/* io_uring Submission Queue Entry (SQE) */
+typedef struct io_uring_sqe {
+    uint8_t  opcode;
+    uint8_t  flags;
+    uint16_t ioprio;
+    int32_t  fd;
+    uint64_t off;
+    uint64_t addr;
+    uint32_t len;
+    uint32_t cancel_flags;
+    uint64_t user_data;
+} io_uring_sqe_t;
+
+/* io_uring Completion Queue Entry (CQE) */
+typedef struct io_uring_cqe {
+    uint64_t user_data;
+    int32_t  res;
+    uint32_t flags;
+} io_uring_cqe_t;
+
+typedef struct io_uring_ring {
+    io_uring_sqe_t sqes[IORING_QUEUE_DEPTH];
+    uint32_t sq_head;
+    uint32_t sq_tail;
+
+    io_uring_cqe_t cqes[IORING_QUEUE_DEPTH];
+    uint32_t cq_head;
+    uint32_t cq_tail;
+
+    uint32_t submitted;
+    uint32_t completed;
+} io_uring_ring_t;
+
+void io_uring_init(void);
+io_uring_ring_t* io_uring_get_default_ring(void);
+io_uring_sqe_t* io_uring_get_sqe(io_uring_ring_t* ring);
+int io_uring_submit(io_uring_ring_t* ring);
+io_uring_cqe_t* io_uring_peek_cqe(io_uring_ring_t* ring);
+void io_uring_cqe_seen(io_uring_ring_t* ring, io_uring_cqe_t* cqe);
+
+#endif // _IO_URING_IO_URING_H

include/kernel/printk.h

@@ -34,6 +34,10 @@
 #define ANSI_BRIGHT_MAGENTA "\033[95m"
 #define ANSI_BRIGHT_CYAN   "\033[96m"
 #define ANSI_BRIGHT_WHITE  "\033[97m"
+#define ANSI_INVERT        "\033[7m"
+#define ANSI_BG_BLACK      "\033[40m"
+#define ANSI_BG_BLUE       "\033[44m"
+#define ANSI_BG_WHITE      "\033[47m"
 
 // Printk API
 void printk_init(void);

include/security/capability.h

@@ -0,0 +1,40 @@
+#ifndef _SECURITY_CAPABILITY_H
+#define _SECURITY_CAPABILITY_H
+
+#include <stdint.h>
+#include <stdbool.h>
+
+/* Linux standard capability bit definitions */
+#define CAP_CHOWN            0
+#define CAP_DAC_OVERRIDE     1
+#define CAP_DAC_READ_SEARCH  2
+#define CAP_FOWNER           3
+#define CAP_FSETID           4
+#define CAP_KILL             5
+#define CAP_SETGID           6
+#define CAP_SETUID           7
+#define CAP_SETPCAP          8
+#define CAP_NET_BIND_SERVICE 10
+#define CAP_NET_BROADCAST    11
+#define CAP_NET_ADMIN        12
+#define CAP_NET_RAW          13
+#define CAP_SYS_MODULE       16
+#define CAP_SYS_RAWIO        17
+#define CAP_SYS_PTRACE       19
+#define CAP_SYS_PACCT        20
+#define CAP_SYS_ADMIN        21
+#define CAP_SYS_BOOT         22
+#define CAP_SYS_NICE         23
+#define CAP_SYS_RESOURCE     24
+#define CAP_SYS_TIME         25
+
+typedef uint64_t kernel_cap_t;
+
+#define CAP_FULL_SET         ((kernel_cap_t)0xFFFFFFFFFFFFFFFFULL)
+#define CAP_EMPTY_SET        ((kernel_cap_t)0)
+
+bool cap_capable(kernel_cap_t caps, int cap);
+void cap_raise(kernel_cap_t* caps, int cap);
+void cap_lower(kernel_cap_t* caps, int cap);
+
+#endif // _SECURITY_CAPABILITY_H

include/security/security.h

@@ -0,0 +1,28 @@
+#ifndef _SECURITY_SECURITY_H
+#define _SECURITY_SECURITY_H
+
+#include <security/capability.h>
+#include <kernel/types.h>
+#include <stdint.h>
+#include <stddef.h>
+#include <stdbool.h>
+
+struct vfs_node;
+
+typedef struct security_operations {
+    const char* name;
+    int (*task_create)(uint32_t clone_flags);
+    int (*file_permission)(struct vfs_node* node, int mask);
+    int (*file_open)(struct vfs_node* node, int flags);
+    int (*capable)(kernel_cap_t caps, int cap);
+    int (*socket_create)(int family, int type, int protocol);
+} security_ops_t;
+
+void security_init(void);
+int security_register_lsm(security_ops_t* ops);
+int security_file_permission(struct vfs_node* node, int mask);
+int security_file_open(struct vfs_node* node, int flags);
+int security_capable(int cap);
+const char* security_get_active_lsm_name(void);
+
+#endif // _SECURITY_SECURITY_H

include/userland/nano.h

@@ -0,0 +1,6 @@
+#ifndef _USERLAND_NANO_H
+#define _USERLAND_NANO_H
+
+int nano_main(int argc, char** argv);
+
+#endif // _USERLAND_NANO_H

include/usr/initramfs.h

@@ -0,0 +1,28 @@
+#ifndef _USR_INITRAMFS_H
+#define _USR_INITRAMFS_H
+
+#include <stddef.h>
+#include <stdint.h>
+
+/* CPIO newc archive header structure */
+struct cpio_newc_header {
+    char c_magic[6];
+    char c_ino[8];
+    char c_mode[8];
+    char c_uid[8];
+    char c_gid[8];
+    char c_nlink[8];
+    char c_mtime[8];
+    char c_filesize[8];
+    char c_maj[8];
+    char c_min[8];
+    char c_rmaj[8];
+    char c_rmin[8];
+    char c_namesize[8];
+    char c_chksum[8];
+};
+
+void initramfs_init(void);
+int initramfs_populate_system(void);
+
+#endif // _USR_INITRAMFS_H

include/virt/virt.h

@@ -0,0 +1,29 @@
+#ifndef _VIRT_VIRT_H
+#define _VIRT_VIRT_H
+
+#include <stdint.h>
+#include <stdbool.h>
+
+typedef enum {
+    HYPERVISOR_NONE = 0,
+    HYPERVISOR_KVM,
+    HYPERVISOR_QEMU,
+    HYPERVISOR_VMWARE,
+    HYPERVISOR_VBOX,
+    HYPERVISOR_XEN,
+    HYPERVISOR_HYPERV,
+    HYPERVISOR_UNKNOWN
+} hypervisor_type_t;
+
+typedef struct {
+    hypervisor_type_t type;
+    char name[32];
+    char signature[16];
+    bool nested_virt;
+} hypervisor_info_t;
+
+void virt_init(void);
+const hypervisor_info_t* virt_get_hypervisor_info(void);
+bool virt_is_virtualized(void);
+
+#endif // _VIRT_VIRT_H

include/virt/virtio.h

@@ -0,0 +1,37 @@
+#ifndef _VIRT_VIRTIO_H
+#define _VIRT_VIRTIO_H
+
+#include <stdint.h>
+#include <stddef.h>
+#include <stdbool.h>
+
+#define VIRTIO_PCI_VENDOR 0x1AF4
+
+/* VirtIO Device IDs */
+#define VIRTIO_ID_NET        1
+#define VIRTIO_ID_BLOCK      2
+#define VIRTIO_ID_CONSOLE    3
+#define VIRTIO_ID_ENTROPY    4
+#define VIRTIO_ID_BALLOON    5
+#define VIRTIO_ID_IOMEMORY   6
+#define VIRTIO_ID_RPMSG      7
+#define VIRTIO_ID_SCSI       8
+#define VIRTIO_ID_9P         9
+#define VIRTIO_ID_GPU        16
+#define VIRTIO_ID_INPUT      18
+
+typedef struct virtio_device {
+    uint16_t device_id;
+    uint32_t io_base;
+    uint8_t  irq;
+    uint8_t  status;
+    char name[32];
+    bool active;
+} virtio_device_t;
+
+void virtio_init(void);
+int virtio_register_device(uint16_t dev_id, uint32_t io_base, uint8_t irq);
+size_t virtio_get_device_count(void);
+const virtio_device_t* virtio_get_device(size_t index);
+
+#endif // _VIRT_VIRTIO_H