Kernel Reliability Fixes

Add `restore_caller_context` to IPC dispatch. Why it matters: All seven IPC blocking syscalls (recv, call, reply_recv, notify_wait, call_buf, recv_msg, reply_recv_msg) return with a stale per-core syscall_user_rsp after a context switch. This is the confirmed root cause of wrong user RSP on return from blocking IPC. Focus on `restore_caller_context` and `dispatch` in `kernel/src/ipc/mod.rs` while you trace the snippet.

/// IPC syscall dispatcher, called from `arch::x86_64::syscall::syscall_handler`.
///
/// Userspace syscall numbers `0x1100`–`0x110F` are translated to internal
/// dispatch numbers 1–16 by the flat dispatch table in `arch/x86_64/syscall/mod.rs`.
///
/// | Internal | Userspace | Operation | Args (SysV: rdi=arg0, rsi=arg1, rdx=arg2) |
/// |---|---|---|---|
/// | 1 | 0x1100 | `ipc_recv(ep_cap)` | `arg0 = ep_cap_handle` |
/// | 2 | 0x1101 | `ipc_send(ep_cap, label, data0)` | `arg0..2` |
/// | 3 | 0x1102 | `ipc_call(ep_cap, label, data0)` | `arg0..2` |
/// | 4 | 0x1103 | `ipc_reply(reply_cap, label, data0)` | `arg0..2` |
/// | 5 | 0x1104 | `ipc_reply_recv(reply_cap, label, ep_cap)` | `arg0..2` — ep_cap in arg2 |
/// | 6 | 0x1105 | `sys_cap_grant(source_handle, target_task_id)` | `arg0, arg1` |
/// | 7 | 0x1106 | `notify_wait(notif_cap)` | `arg0 = notif_cap_handle` |
/// | 8 | 0x1107 | `notify_signal(notif_cap, bits)` | `arg0, arg1` |
/// | 9 | 0x1108 | `ipc_register_service(ep_cap, name_ptr, name_len)` | `arg0..2` |
/// | 10 | 0x1109 | `ipc_lookup_service(name_ptr, name_len)` | `arg0, arg1` → new CapHandle |
/// | 11 | 0x110A | `create_irq_notification(irq)` | `arg0 = IRQ number` → new CapHandle |
/// | 12 | 0x110B | `create_endpoint()` | — → new CapHandle |
/// | 13 | 0x110C | `ipc_send_buf(ep_cap, label, data0, buf_ptr, buf_len)` | `arg0..4` |
/// | 14 | 0x110D | `ipc_call_buf(ep_cap, label, data0, buf_ptr, buf_len)` | `arg0..4` → label |
/// | 15 | 0x110E | `ipc_recv_msg(ep_cap, msg_ptr, buf_ptr, buf_len)` | `arg0..3` → label |
/// | 16 | 0x110F | `ipc_reply_recv_msg(reply_cap, label, ep_cap, msg_ptr, buf_ptr)` | `arg0..4` → label |
///

View on GitHub

Add futex WAIT restore (same pattern). Why it matters: The futex WAIT path has the same structural hole — it blocks via block_current_on_futex_unless_woken() and returns without an adjacent restore_caller_context(). This was identified in the copy_to_user investigation as a parallel defect. Focus on `sys_futex` and `block_current_on_futex_unless_woken` in `kernel/src/arch/x86_64/syscall/mod.rs` while you trace the snippet.

/// Futex wait/wake implementation for thread synchronization.
/// Supports WAIT, WAKE, WAIT_BITSET, WAKE_BITSET with real blocking queues.
///
/// Supports `FUTEX_WAIT`, `FUTEX_WAKE`, `FUTEX_WAIT_BITSET`, and
/// `FUTEX_WAKE_BITSET` operations with the `FUTEX_PRIVATE_FLAG`.
pub(super) fn sys_futex(uaddr: u64, op: u64, val: u64, val3: u64) -> u64 {
    const FUTEX_WAIT: u64 = 0;
    const FUTEX_WAKE: u64 = 1;
    const FUTEX_WAIT_BITSET: u64 = 9;
    const FUTEX_WAKE_BITSET: u64 = 10;
    const FUTEX_PRIVATE_FLAG: u64 = 128;

    use crate::process::futex::{FUTEX_BITSET_MATCH_ANY, FUTEX_TABLE, FutexWaiter};

    let is_private = (op & FUTEX_PRIVATE_FLAG) != 0;
    let cmd = op & !(FUTEX_PRIVATE_FLAG);

    // Build the futex key: (addr_space pml4_phys, uaddr).
    // Private futexes use 0 as root; shared futexes use the real CR3.
    let futex_root = if is_private {
        0u64
    } else {
        let pid = crate::process::current_pid();
        match crate::process::PROCESS_TABLE

View on GitHub

> **Note:** B.2 was already implemented. The should_wait block at line 874-880 checks pty_pending_len > 0 and registers set_channel_write_waker before sleeping. Why it matters: The relay task must register set_channel_write_waker() when pty_pending_len > 0. This was previously missing but may have been partially fixed. Verify the registration is correct and complete. Focus on `channel_relay_task` and `set_channel_write_waker` in `userspace/sshd/src/session.rs` while you trace the snippet.

async fn channel_relay_task(
    sock_fd: i32,
    pty_fd: i32,
    runner: SharedRunner,
    state: SharedState,
    chan: SharedChan,
    progress_notify: SharedNotify,
    session_notify: SharedNotify,
    output_lock: SharedOutputLock,
) {
    let mut chan_buf = [0u8; 4096];
    let mut pty_buf = [0u8; 4096];
    let mut pty_pending = [0u8; 4096];
    let mut pty_pending_len: usize = 0;
    // Pending data from channel -> PTY that couldn't be written (EAGAIN).
    let mut pty_write_pending = [0u8; 4096];
    let mut pty_write_pending_len: usize = 0;
    // The relay task wakes on:
    //   - PTY readable (shell produced output) — via reactor
    //   - Channel data available (client typed something) — via channel_read_waker
    //   - Channel write capacity returned (backpressure cleared) — via channel_write_waker

    loop {
        if state.borrow().session_done {

View on GitHub