[ultronstudio]

Summary

Implements pvKernel 0.0.9 — Processes + Address Spaces + Userspace Foundation.

Adds:

• generation-safe ProcessId and boot-monotonic PID;
• bounded process lifecycle with Creating, Alive, Exiting, Zombie and reap;
• per-process four-level address spaces and CR3 switching;
• audited upper-half kernel mappings and inactive-root construction;
• guarded userspace stacks and per-user-task kernel entry stacks;
• checked TSS.RSP0 switching;
• true PIT-driven CPL3 process preemption;
• checked static ELF64 ET_EXEC/PT_LOAD loading;
• experimental getpid and terminal exit syscalls;
• checked page-chunked user-memory copying;
• CPL3 process fault containment;
• process accounting and snapshots;
• deterministic process/isolation/fault QEMU scenarios.

Architecture

Implements the reviewed design in:

docs/architecture/processes.md

The implementation keeps the lower canonical half user-only. Bootloader dynamic mappings required by the live kernel are constrained to a dedicated upper-half arena and audited before process CR3 roots are activated.

Security / correctness review

A dedicated local pre-PR audit was completed at 490a62e16b7b8e55e2eb2d6b9c6f2bea30b16738.

Result:

• no unresolved P0 findings;
• no unresolved P1 findings;
• no unresolved P2 findings;
• architecture invariants re-reviewed independently;
• unsafe additions reviewed;
• hostile ELF and user-pointer paths reviewed;
• CR3/RSP0/context-switch ordering reviewed;
• process exit/fault handoff reviewed.

Follow-up commit 7c0956572aa61394abfea078b64b1b7aa9458cc5 fixes strict CI Clippy failures with style cleanups and test-only configuration boundaries. It does not change process execution, privilege, or address-space switching behavior. Strict Clippy passes for default, QEMU, process-smoke and user-copy configurations.

Validation

Local validation includes:

• formatting and diff checks;
• locked build and metadata;
• target-aware kernel Clippy;
• security-policy validation;
• cargo audit;
• cargo deny;
• actionlint;
• 14 legacy QEMU scenarios;
• 12 new pvKernel 0.0.9 process scenarios;
• native Windows graphical QEMU boot.

All QEMU scenarios completed with successful host exit status.

The known Windows-only hostile-filename Python fixture limitation is unchanged; the security-policy validator itself passes.

Scope

0.0.9 remains single-core and intentionally does not implement:

• VFS/initrd or /bin/init;
• file descriptors;
• fork/general exec;
• dynamic linking;
• user heap/mmap;
• signals;
• general IPC;
• frame reclamation;
• storage;
• networking;
• SMP;
• stable userspace ABI.

Release

This PR does not create an RC, tag, or stable release.

After implementation review and merge, the next step is an exact-main validation followed by a separate formal 0.0.9 pre-release audit.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None