Kernel threads were only ever switched cooperatively (sched_yield, task_exit);
a thread that never yielded held the CPU forever. The Weave scheduler now
preempts from the PIT tick, so CPU-bound threads are time-sliced.
Deferred switch, not mid-handler:
- sched_tick() no longer switches. It charges the running quantum and, when it
is spent, only raises weave_need_resched. The switch happens at IRQ return in
the new sched_preempt_on_return(), called from the x86_64 dispatcher after
the PIC EOI. That keeps the tick path re-entrancy-safe (the EOI is already
out, so the PIC keeps delivering) and lets the preempted thread unwind
through the normal iretq on its own kernel stack.
Interrupt-atomic scheduler state:
- The plain weave_lock is not IRQ-safe, so a tick landing mid-mutation would
deadlock. weave_lock sections now mask interrupts (arch_irq_save/restore,
added to arch.h for all three arches) so the timer can never fire inside
them, and weave_rotate holds them masked across the pick and the register
swap so the switch is one indivisible step.
Preemption-disable count:
- sched_preempt_disable/enable gate the tick and the return-path switch so a
preemptive switch cannot land while a plain (non-IRQ-safe) spinlock is held.
printk wraps its critical section with it, closing the most common hazard;
other locks are a documented follow-up.
Fresh threads opt into interrupts at entry so they are preemptible from birth
without changing the cooperative early-boot self-test, which still runs with
interrupts masked and is unchanged (20 switches, 3/3 workers).
Verified on x86_64 under QEMU: a new boot-time self-test arms preemption and
two threads that NEVER yield are forced to share the CPU -- 20 involuntary
switches, both advance and are woven down to the CPU-bound lanes -- then boot
proceeds cleanly to ring-3 /sbin/init and the shell with zero faults. aarch64
and armv8i still build; preemption is wired into the x86_64 IRQ path only, so
those stay cooperative for now (their switch asm already exists).
Co-Authored-By: Claude Opus 4.8 <[email protected]>
Claude-Session: https://claude.ai/code/session_0161Jh7uCEMLYEMNPsjC1LKf
SUB-OS had a syscall table and user GDT descriptors but nothing that could
actually leave ring 0: lazybox and the shell run as kernel code, and
syscall_handler() was never reachable from a user program. This adds the
missing path end to end on x86_64.
Address spaces (arch/x86_64/mm/vmspace.c)
- The boot page tables identity-map the low 4 GB off PML4[0] and leave the
rest empty, so userland is given its own PML4 slot (512 GiB) rather than
holes punched in the kernel's 2 MB huge-page map. A process PML4 shares
entry 0 with the kernel and privately owns entry 1.
- Frames outside the identity map are refused rather than written through an
unmapped pointer; lifting that needs a recursive map or a higher-half
direct map, which is noted in the file.
ELF loader (kernel/elf.c)
- Validates ELF64/little-endian/ET_EXEC/machine, bounds-checks every program
header against both the image and the user address range, and lays PT_LOAD
segments into an address space. Frames arrive zeroed, so .bss is covered.
Ring transition (arch/x86_64/cpu/usermode.asm)
- user_enter() drops to ring 3 via iretq after scrubbing every GPR, and
user_return() unwinds back to it when the process exits, so exec looks like
a call that blocks until the program finishes.
Syscalls
- INT 0x80 installed at DPL 3 with the Linux x86_64 register convention.
The process gets its own kernel stack for the trap, because TSS.rsp0 must
not point at the stack user_enter() is standing on.
- Every user pointer is range-checked before use. The process page tables are
still live during a syscall, so without that check a program could pass a
kernel address and have write(2) dump kernel text to the console. The new
/sbin/init asserts both a wild pointer and a kernel pointer are rejected.
- write(2) to stdout/stderr routes through the new console_write(), which
reuses printk's routing so output reaches serial and the framebuffer
console rather than only the VGA text buffer.
Faults
- A ring 3 exception now kills that process and reports CR2 instead of
panicking the machine.
Userland (userland/init/)
- /sbin/init is a real freestanding static executable, linked at the user
base and embedded in the kernel image by scripts/mkblob.py. It reports its
pid, verifies .bss was zeroed and .data is writable, checks the two pointer
rejections, and exits.
aarch64 and armv8i keep building: the loader and exec path are portable, and
those ports get honest vmspace stubs that fail cleanly rather than pretending
to run a program with kernel privileges.
Verified under QEMU: init loads at 0x80004000a0, reports pid 1, .bss zeroed,
.data writable, both bad pointers rejected, and exits 0 back into the shell.
Co-Authored-By: Claude Opus 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_0161Jh7uCEMLYEMNPsjC1LKf
