Problem and current evidence
The GenOS 0.49 baseline installs a bare iretq for most IDT vectors. Only #DF, #GP and #PF have explicit fault stubs. CPU-pushed error-code frames are therefore not uniformly handled, and recoverable user exceptions other than #GP/#PF are not deliberately contained. The quality-first roadmap in unmerged PR #4 identifies this as foundation gate F1.
Proposed contract
Install a vector-specific entry for all 256 vectors. Normalize vector/error words above the CPU return frame, save the 15 general-purpose registers, clear DF and align the SysV call stack. Use one reviewed exception-frame structure. Recoverable Ring 3 exceptions terminate only the current process through its existing lifecycle path. Kernel exceptions and machine-level exceptions emit a complete serial record and halt. Distinguish real and spurious PIC IRQ7/IRQ15 before EOI. Provide separate IST storage for double fault, NMI, machine check and debug entry.
Smallest vertical slice and dependencies
Build on docs/quality-first-roadmap without merging or changing PR #4. Preserve existing timer/syscall context layout and the full boot/storage/network proof suite. Add frame-layout/classification regression tests and deterministic exception probes. CPU-enforced IDT read-only protection remains dependent on the paging/protection work in F2 and must not be reported complete by this slice.
Ownership and failure behavior
IDT/TSS initialization remains BSP-owned with maskable interrupts disabled. Entry assembly owns the saved frame until return or the existing nonlocal userspace exit. Unknown non-PIC external interrupts halt rather than guessing a controller acknowledgement. No new process, file, socket or device authority is granted. No allocation occurs in exception entry.
Alternatives
Retaining the default stub leaves malformed-return and repeated-fault risks. Installing only #DE/#UD would leave other architectural vectors unclassified. A compiler interrupt ABI would also require reconciling the current custom preemption and nonlocal-return contract.
Migration and rollback
No userspace ABI or on-disk format change. Review as an unmerged branch based on PR #4. Reverting the entry implementation restores the previous experimental behavior; it is not a security-equivalent downgrade.
Acceptance
- Every installed default vector has a normalized, non-bare entry.
- Host tests lock the frame offsets, error-code vector set and fatal-versus-process-local policy.
- Existing QEMU page-fault isolation, timer preemption and full system matrix remain passing.
- New deterministic fault probes report the expected vector and frame, with explicit evidence and limitations.
- F1 stays open until every roadmap criterion, including CPU-enforced read-only IDT and required hardware proofs, is actually satisfied.
Problem and current evidence
The GenOS 0.49 baseline installs a bare
iretqfor most IDT vectors. Only #DF, #GP and #PF have explicit fault stubs. CPU-pushed error-code frames are therefore not uniformly handled, and recoverable user exceptions other than #GP/#PF are not deliberately contained. The quality-first roadmap in unmerged PR #4 identifies this as foundation gate F1.Proposed contract
Install a vector-specific entry for all 256 vectors. Normalize vector/error words above the CPU return frame, save the 15 general-purpose registers, clear DF and align the SysV call stack. Use one reviewed exception-frame structure. Recoverable Ring 3 exceptions terminate only the current process through its existing lifecycle path. Kernel exceptions and machine-level exceptions emit a complete serial record and halt. Distinguish real and spurious PIC IRQ7/IRQ15 before EOI. Provide separate IST storage for double fault, NMI, machine check and debug entry.
Smallest vertical slice and dependencies
Build on
docs/quality-first-roadmapwithout merging or changing PR #4. Preserve existing timer/syscall context layout and the full boot/storage/network proof suite. Add frame-layout/classification regression tests and deterministic exception probes. CPU-enforced IDT read-only protection remains dependent on the paging/protection work in F2 and must not be reported complete by this slice.Ownership and failure behavior
IDT/TSS initialization remains BSP-owned with maskable interrupts disabled. Entry assembly owns the saved frame until return or the existing nonlocal userspace exit. Unknown non-PIC external interrupts halt rather than guessing a controller acknowledgement. No new process, file, socket or device authority is granted. No allocation occurs in exception entry.
Alternatives
Retaining the default stub leaves malformed-return and repeated-fault risks. Installing only #DE/#UD would leave other architectural vectors unclassified. A compiler interrupt ABI would also require reconciling the current custom preemption and nonlocal-return contract.
Migration and rollback
No userspace ABI or on-disk format change. Review as an unmerged branch based on PR #4. Reverting the entry implementation restores the previous experimental behavior; it is not a security-equivalent downgrade.
Acceptance