Kernel threads were only ever switched cooperatively (sched_yield, task_exit);
a thread that never yielded held the CPU forever. The Weave scheduler now
preempts from the PIT tick, so CPU-bound threads are time-sliced.
Deferred switch, not mid-handler:
- sched_tick() no longer switches. It charges the running quantum and, when it
is spent, only raises weave_need_resched. The switch happens at IRQ return in
the new sched_preempt_on_return(), called from the x86_64 dispatcher after
the PIC EOI. That keeps the tick path re-entrancy-safe (the EOI is already
out, so the PIC keeps delivering) and lets the preempted thread unwind
through the normal iretq on its own kernel stack.
Interrupt-atomic scheduler state:
- The plain weave_lock is not IRQ-safe, so a tick landing mid-mutation would
deadlock. weave_lock sections now mask interrupts (arch_irq_save/restore,
added to arch.h for all three arches) so the timer can never fire inside
them, and weave_rotate holds them masked across the pick and the register
swap so the switch is one indivisible step.
Preemption-disable count:
- sched_preempt_disable/enable gate the tick and the return-path switch so a
preemptive switch cannot land while a plain (non-IRQ-safe) spinlock is held.
printk wraps its critical section with it, closing the most common hazard;
other locks are a documented follow-up.
Fresh threads opt into interrupts at entry so they are preemptible from birth
without changing the cooperative early-boot self-test, which still runs with
interrupts masked and is unchanged (20 switches, 3/3 workers).
Verified on x86_64 under QEMU: a new boot-time self-test arms preemption and
two threads that NEVER yield are forced to share the CPU -- 20 involuntary
switches, both advance and are woven down to the CPU-bound lanes -- then boot
proceeds cleanly to ring-3 /sbin/init and the shell with zero faults. aarch64
and armv8i still build; preemption is wired into the x86_64 IRQ path only, so
those stay cooperative for now (their switch asm already exists).
Co-Authored-By: Claude Opus 4.8 <[email protected]>
Claude-Session: https://claude.ai/code/session_0161Jh7uCEMLYEMNPsjC1LKf
Replace the state-relabel-only round-robin with the SUB-OS "Weave"
scheduler backed by a genuine callee-saved context switch. Threads now
actually run on their own kernel stacks instead of merely having their
state field rewritten.
What was implemented:
- sub_ctx_switch(): per-arch assembly (arch/x86_64/cpu/switch.asm,
arch/aarch64/cpu/switch.S, arch/armv8i/cpu/switch.S) that saves/restores
the callee-saved register set (+ flags on x86_64) on each thread's own
stack, plus a first-run trampoline (sub_thread_trampoline) that launches
a freshly forged thread frame with entry/arg in callee-saved registers.
- task_forge_frame(): builds the initial saved-context frame per arch so
the very first switch into a new thread lands on the trampoline; task_t
gains a pointer-sized ctx_sp so the same struct works on 64- and 32-bit.
- Weave policy (kernel/sched.c): WEAVE_NLANES priority lanes, always
dispatch the lowest non-empty lane round-robin; a task that yields
voluntarily is woven UP a lane (interactive), one preempted after
burning its quantum is woven DOWN (CPU-bound). Cooperative switching
(sched_yield / task_exit) is always live; timer-driven preemption is
gated behind sched_set_preempt() and left disarmed for now.
- task_exit() now switches to the next runnable thread via
sched_exit_current() instead of spinning/halting.
- Boot-time weave_selftest() (x86_64) and sched_dump() diagnostics.
How it was verified:
- Builds clean for all three targets: x86_64 (CROSS_COMPILE=x86_64-linux-gnu-,
RUSTC="rustc --target x86_64-unknown-none"), aarch64, armv8i. No new
warnings; the new x86_64 asm carries a .note.GNU-stack section.
- Booted x86_64 under QEMU (TCG): the self-test runs three cooperative
kernel threads to completion on separate stacks with the expected
1->2->3 round-robin interleave, reports "20 real context switches,
3/3 workers exited", returns cleanly to the boot thread, and boot
proceeds normally to ring-3 init and the shell. No fault/panic.
Left unverified:
- The aarch64/armv8i sub_ctx_switch frames build and link but are not yet
boot-tested on their QEMU targets (tracked in docs/AUTODEV_ROADMAP.md).
- Timer preemption path is implemented but disarmed; exited kernel threads
currently leak their stack (reaper is next in the backlog).
Co-Authored-By: Claude Opus 4.8 <[email protected]>
Claude-Session: https://claude.ai/code/session_01Jk6K69yGS7zYgvoWd6nJxQ
SUB-OS had a syscall table and user GDT descriptors but nothing that could
actually leave ring 0: lazybox and the shell run as kernel code, and
syscall_handler() was never reachable from a user program. This adds the
missing path end to end on x86_64.
Address spaces (arch/x86_64/mm/vmspace.c)
- The boot page tables identity-map the low 4 GB off PML4[0] and leave the
rest empty, so userland is given its own PML4 slot (512 GiB) rather than
holes punched in the kernel's 2 MB huge-page map. A process PML4 shares
entry 0 with the kernel and privately owns entry 1.
- Frames outside the identity map are refused rather than written through an
unmapped pointer; lifting that needs a recursive map or a higher-half
direct map, which is noted in the file.
ELF loader (kernel/elf.c)
- Validates ELF64/little-endian/ET_EXEC/machine, bounds-checks every program
header against both the image and the user address range, and lays PT_LOAD
segments into an address space. Frames arrive zeroed, so .bss is covered.
Ring transition (arch/x86_64/cpu/usermode.asm)
- user_enter() drops to ring 3 via iretq after scrubbing every GPR, and
user_return() unwinds back to it when the process exits, so exec looks like
a call that blocks until the program finishes.
Syscalls
- INT 0x80 installed at DPL 3 with the Linux x86_64 register convention.
The process gets its own kernel stack for the trap, because TSS.rsp0 must
not point at the stack user_enter() is standing on.
- Every user pointer is range-checked before use. The process page tables are
still live during a syscall, so without that check a program could pass a
kernel address and have write(2) dump kernel text to the console. The new
/sbin/init asserts both a wild pointer and a kernel pointer are rejected.
- write(2) to stdout/stderr routes through the new console_write(), which
reuses printk's routing so output reaches serial and the framebuffer
console rather than only the VGA text buffer.
Faults
- A ring 3 exception now kills that process and reports CR2 instead of
panicking the machine.
Userland (userland/init/)
- /sbin/init is a real freestanding static executable, linked at the user
base and embedded in the kernel image by scripts/mkblob.py. It reports its
pid, verifies .bss was zeroed and .data is writable, checks the two pointer
rejections, and exits.
aarch64 and armv8i keep building: the loader and exec path are portable, and
those ports get honest vmspace stubs that fail cleanly rather than pretending
to run a program with kernel privileges.
Verified under QEMU: init loads at 0x80004000a0, reports pid 1, .bss zeroed,
.data writable, both bad pointers rejected, and exits 0 back into the shell.
Co-Authored-By: Claude Opus 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_0161Jh7uCEMLYEMNPsjC1LKf
