The initial bootstrap init (started directly by the kernel via
usermode_bootstrap) had RSP = 0 from InterruptStack::init(), which
does NOT set RSP. This caused any push/call in the binary to fault
on address 0.
The Rust panic handler caught the resulting page fault and generated
ud2 — visible as 'Invalid opcode fault' at a low RIP before main()
ever runs. This was the root cause of the init crash.
Fix:
- Map 8 pages (32 KiB) of user stack just above the initfs image
- Set RSP to the top of the stack
- Add debug log showing the mapped region
The stack is intentionally small (32 KiB) — enough for Rust _start
to run but small enough to detect stack overflow immediately. Once
init calls fexec_impl to spawn the real init, the real init gets its
own full 8 MB stack via the redox-rt exec path.
- rmm/src/arch/emulate.rs: replace unimplemented!() with actual TLB
invalidation (remove the address from the map). Without this the
emulate arch silently fails to invalidate TLB entries during
context switches, which can cause stale mappings.
- src/syscall/futex.rs: remove completed TODO marker for FUTEX_REQUEUE
(work done in a prior commit).
The sys_mkns and sys_setns functions added in 48fc2f1c reference
UserSliceRo and FileHandle but the imports were not updated, causing
the build to fail with 'cannot find type' errors. This commit adds
the missing imports.
Adds proper kernel-level namespace syscall handling:
- SYS_MKNS: dups the current namespace fd with the caller-supplied
buffer (NsDup::ForkNs + scheme names). The dup is handled by the
bootstrap's userspace namespace manager (initnsmgr) which creates
the new namespace and returns the fd.
- SYS_SETNS: switches the calling context's ns_fd to the given fd.
This makes the new namespace the default for all subsequent scheme
lookups by this context.
- Context gains an ns_fd: Option<usize> field, initialized to None,
meaning "use the global namespace" (default).
- Both syscalls are wired into the dispatch table in syscall/mod.rs.
Per local/docs/LOCAL-FORK-SUPREMACY-POLICY.md: the kernel fork must
be complete. Previously SYS_SETNS was undefined and SYS_MKNS returned
ENOSYS; init's setrens() panicked on bare metal.
sys_read and sys_write passed u64::MAX as the offset for non-positioned
file descriptors. Many scheme handlers (AddrSpace, proc:Start, etc.)
check offset != 0 or offset % word_size != 0, causing EINVAL when
receiving u64::MAX. Passing 0 instead fixes all non-positioned read/write
operations across all scheme handlers uniformly.
This replaces the per-handler u64::MAX workarounds with a root-cause fix.
sys_write passes u64::MAX as offset for non-positioned file descriptors.
ContextHandle::Start used an inline 'offset != 0' check which rejected
u64::MAX, causing EINVAL when bootstrap called start_fd.write(&[0]) during
fork_inner(). Replaced with require_zero_offset() which accepts both 0 and
u64::MAX (fixed in the previous commit for the same class of bug).
sys_write passes u64::MAX as the offset sentinel for non-positioned file
descriptors. The proc scheme's require_zero_offset rejected this value,
causing bootstrap's tcb_activate to crash with EINVAL when writing
EnvRegisters (fsbase) back to the regs/env handle.
This was the root cause of the 'Invalid opcode fault' during bootstrap
(PID 0) that prevented redbear-mini from reaching a login prompt.
Previously: PfError::Oom during page fault recovery caused the
entire kernel to panic via todo!("oom"). This means a single
OOM allocation in a user process would crash the whole OS.
Now: OOM is logged as a warning, the faulting process receives
SIGSEGV (same path as other non-fatal page faults), and the
kernel continues. The process may be killed, but the system
stays up. This is consistent with how Linux handles OOM during
page fault handling: send SIGSEGV/SIGKILL, don't panic.
The page fault handler for user-mode faults had a separate
arms for Segv, RecursionLimitExceeded, and NonfatalInternalError from
try_correcting_page_tables. The first two fell through to return
Segv to the process; NonfatalInternalError called todo!() which
causes a kernel panic. This is a kernel-level crash triggered by
a userspace page table correction attempt that reports an internal
(non-fatal) error.
Fix: collapse NonfatalInternalError into the same fall-through arm
as Segv and RecursionLimitExceeded. The error name says 'nonfatal'
— it should not crash the kernel. The userspace process receives
a segmentation fault signal instead.
Added println! to the syscall dispatch catch-all to log the
unknown syscall number and arguments when returning ENOSYS.
Previously any unrecognized syscall number silently returned
ENOSYS with no diagnostic, making it impossible to discover
missing syscall implementations without application-level
debugging.
Found by comprehensive disguised-stub audit (47 patterns, 37
actionable). This is the most impactful remaining fix from
that audit.
Added sync() and syncfs() syscall handlers. Both are no-ops
since Red Bear filesystem I/O is synchronous (data is always
on disk). syncfs(fd) delegates to scheme.fsync() for the
filesystem containing the fd.
Cross-referenced with Linux 7.1 fs/sync.c ksys_sync() and
do_syncfs(). SYS_SYNC uses number 119, SYS_SYNCFS uses 120.
Extended /proc/self resolution to handle sub-paths like
/proc/self/fd/0, /proc/self/stat, /proc/self/status, etc.
Previously only /proc/self (the directory itself) was resolved.
Now /proc/self/fd, /proc/self/stat, /proc/self/maps, and all
other sub-paths are resolved by replacing 'self' with the
current PID and delegating to the standard proc_open() parser.
Cross-referenced with Linux 7.1 fs/proc/self.c proc_self_get_link()
which creates a symlink to the current PID directory. This
completes the /proc/self implementation for all sub-entries.
The FADT fields (PM1a_CNT, PM1a_STS, FIRMWARE_CTRL) are at fixed
offsets from the START of the SDT (including the 36-byte ACPI header),
not from the data area. Previously using sdt.data_address() caused
reads from the wrong offset, making shutdown/reboot fail on real
hardware.
Fixed by reading from the SDT base pointer instead of data_address().
Cross-referenced with Linux 7.1 drivers/acpi/acpica/tbfadt.c which
reads FADT fields from the table base, accounting for the header.
Added FUTEX_REQUEUE (opcode 2) to the futex syscall implementation.
Cross-referenced with Linux 7.1 kernel/futex/requeue.c futex_requeue().
Operation: wake up to waiters on the primary futex, and
requeue up to waiters to a secondary futex at addr2.
This avoids the thundering herd problem in pthread condition
variable broadcast: instead of waking all waiters and having
them immediately contend, most are moved to a private futex
where they wake one at a time.
Previously the futex syscall would return EINVAL for FUTEX_REQUEUE,
breaking pthread_cond_broadcast on contended condition variables.
Added /proc/self resolution in open_inner(). When /proc/self
is opened, it resolves to /proc/<current-pid> by reading
context::current().pid and returning a ProcDir handle.
Cross-referenced with Linux 7.1 fs/proc/self.c proc_self_get_link()
which creates a symlink inode pointing to the current PID.
This enables 'ls /proc/self', 'cat /proc/self/status', and all
other tools that use /proc/self to access their own process info.
Added ProcFilesystems ContextHandle that lists supported filesystems
in Linux /proc/filesystems format. Lists sysfs, proc, devtmpfs,
and redoxfs as supported types.
Cross-referenced with Linux 7.1 fs/filesystems.c filesystems_proc_show().
'nodev' prefix indicates filesystems not requiring a block device.
Also added to ProcRoot directory listing.
Added ProcVersion ContextHandle that outputs the kernel version
string using CARGO_PKG_VERSION, TARGET, and COOKBOOK_SOURCE_IDENT
environment variables from the build system.
Cross-referenced with Linux 7.1 fs/proc/version.c version_proc_show().
Format: 'Red Bear OS version X.Y.Z (arch) source_ident'
Also added to ProcRoot directory listing.
Added ProcLoadavg ContextHandle that counts runnable contexts
using context::contexts() iterator and Status::is_runnable().
Outputs Linux /proc/loadavg format:
0.00 0.00 0.00 nr_runnable/total 0
Cross-referenced with Linux 7.1 fs/proc/loadavg.c loadavg_proc_show().
Load averages are 0.00 (Red Bear does not track 1/5/15-min EMA).
Last PID is 0 (no PID tracking yet).
Also added to ProcRoot directory listing.
Added ProcUptime ContextHandle that reads monotonic() time
from the kernel and outputs it as uptime_seconds idle_seconds
in Linux /proc/uptime format (two floats with newline).
Cross-referenced with Linux 7.1 fs/proc/uptime.c uptime_proc_show().
Idle time is 0.0 since Red Bear does not track per-CPU idle time.
Also added to ProcRoot directory listing.
Added ProcMeminfo ContextHandle that reads total_frames/free_frames
from the kernel memory subsystem and outputs them in Linux
/proc/meminfo format (MemTotal, MemFree, MemAvailable, Buffers,
Cached, SwapTotal, etc. all in kB).
Cross-referenced with Linux 7.1 fs/proc/meminfo.c meminfo_proc_show().
Also added to ProcRoot directory listing alongside cpuinfo.
Added ProcCpuinfo ContextHandle that calls the arch-specific
cpu_info() function to output processor information (model,
features, cache, topology). Appears as a regular file in
/proc/cpuinfo and is listed in the ProcRoot directory.
Cross-referenced with Linux 7.1 arch/x86/kernel/cpu/proc.c
show_cpuinfo() which formats /proc/cpuinfo from cpu_data.
Added ProcFdDir ContextHandle that lists open file descriptors
as symlink directory entries. Reads from posix_fdtbl and outputs
fd numbers (0, 1, 2, ...) as directory entries.
Cross-referenced with Linux 7.1 fs/proc/fd.c proc_fd_link()
and tid_fd_revalidate(). Listed fds are open (non-None) entries
from the process's POSIX file descriptor table.
Each entry appears as /proc/[pid]/fd/[n] for use by tools
like ls, lsof, and ps.
SYS_READ2 and SYS_WRITE2 are the positioned read/write syscalls
(equivalent to pread/pwrite in POSIX). Previously only SYS_READ and
SYS_WRITE were counted. Now all four I/O paths are tracked.
This makes /proc/[pid]/io accurate for programs that use
pread/pwrite (common in random-access file I/O, memory-mapped
I/O bypass, and async I/O libraries).
Cross-referenced with Linux 7.1 mm/filemap.c:rw_verify_area
which tracks these accounting fields for all read/write variants.
sys_read increments io_rchar, io_syscr, io_read_bytes.
sys_write increments io_wchar, io_syscw, io_write_bytes.
This makes /proc/[pid]/io show actual I/O activity.
Cross-referenced with Linux 7.1 mm/filemap.c:filemap_get_pages
and include/linux/task_io_accounting.h. The fields are saturated
additions to avoid overflow on long-running processes.
Added 7 I/O accounting fields to Context (rchar, wchar, syscr, syscw,
read_bytes, write_bytes, cancelled_write_bytes) and new ProcIo
ContextHandle that outputs them in Linux key=value format:
rchar: 0
wchar: 0
syscr: 0
syscw: 0
read_bytes: 0
write_bytes: 0
cancelled_write_bytes: 0
Cross-referenced with Linux 7.1 fs/proc/base.c do_task_io_accounting().
All values start at 0 and will be incremented as the syscall
interface is extended to track I/O operations.
Added rlimits: [u64; 16] to Context (initialized to RLIM_INFINITY)
and new ProcLimits ContextHandle that outputs in Linux format:
Limit Soft Limit Hard Limit Units
Max cpu time unlimited unlimited seconds
Max file size unlimited unlimited bytes
...
Cross-referenced with Linux 7.1 fs/proc/array.c proc_pid_limits().
All 16 RLIMIT_* resource limits are listed with their units.
New ProcStatm ContextHandle that reports the 7-field memory summary
matching Linux /proc/[pid]/statm format:
size resident shared text lib data dt
All values in pages. Cross-referenced with Linux 7.1
fs/proc/array.c:proc_pid_statm().
Resident count is approximated as the total physical grants
(GRANT_PHYS), since Red Bear has no paging/swapping and all
memory is resident. Other fields (shared, lib, dt) are 0 since
Red Bear's memory model doesn't distinguish these.
New ProcMaps ContextHandle that iterates over addr_space.grants
and formats each grant in Linux /proc/[pid]/maps format:
address_start-address_end perms 00000000 00:00 0 path
Where perms is rwxp based on GrantFlags (GRANT_READ/WRITE/EXEC),
and path is [file]/[vdso]/[heap] based on whether the grant is
file-backed and its address range.
Cross-referenced with Linux 7.1 fs/proc/task_mmu.c proc_pid_maps_op
and show_vma_header_prefix/show_map_vma().
- Add SYS_OPENAT/SYS_DUP aliases in local syscall fork for upstream 0.9.0 renamed constants.
- Cast FADT_MIN_SIZE_ACPI_2_0 to u32 to match sdt.length() return type.
- Keep Cargo.lock based on upstream master with only redox_syscall sourced from local fork.
- Rebase all Red Bear kernel changes onto upstream master (4d5d36d4).
- Update version to 0.5.12+rb0.3.0 and add Red Bear author attribution.
- Switch redox_syscall direct dependency to local fork path (../syscall).
- Bump rust-toolchain.toml to nightly-2026-05-24.
- Regenerate Cargo.lock for +rb0.3.0 suffixes and path deps.
vasilito
R Aadarsh