Kernel Structural Hardening

Define AddressSpace struct. Why it matters: The kernel currently has no address-space abstraction. A process's address space is a raw PhysAddr with no metadata, no refcount, and no per-CPU tracking. This makes targeted TLB shootdown, stale-mapping detection, and thread address-space sharing impossible. Focus on `AddressSpace` and `PhysAddr` in `kernel/src/mm/mod.rs` while you trace the snippet.

/// A process's virtual address space descriptor.
///
/// Wraps the PML4 physical address with metadata for TLB shootdown
/// optimization (generation counter) and multi-core tracking.
pub struct AddressSpace {
    pml4_phys: PhysAddr,
    generation: AtomicU64,
    active_on_cores: AtomicU64,
    page_table_lock: Mutex<()>,
}

View on GitHub

Update Process to use Arc<AddressSpace>. Why it matters: Replacing the raw Option<PhysAddr> with Arc<AddressSpace> enables shared address spaces for CLONE_VM threads and provides the foundation for all other Track A/B tasks. Focus on `Process::page_table_root` and `Process::addr_space` in `kernel/src/process/mod.rs` while you trace the snippet.

        let table = PROCESS_TABLE.lock();
        table.find(pid).and_then(|p| {
            p.addr_space
                .as_ref()
                .map(|addr_space| addr_space.as_ref() as *const AddressSpace)
        })
    }?;

    // Before per-core state exists the kernel is still effectively single-core,
    // so the current process entry cannot be concurrently reaped before callers
    // immediately dereference this pointer in a tightly-scoped unsafe block.
    NonNull::new(ptr as *mut AddressSpace)

View on GitHub

Add per-core `current_addrspace` tracking. Why it matters: Each CPU needs to know which address space is currently loaded so that TLB shootdowns can be targeted. This is the Redox PercpuBlock.current_addrsp equivalent. Focus on `current_addrspace` and `PerCoreData::current_addrspace` in `kernel/src/smp/mod.rs` while you trace the snippet.

/// Per-core state block.
///
/// Each core has one of these, initialized during BSP init or AP bootstrap.
/// The `gs_base` MSR points to this struct so that `per_core()` can retrieve
/// it in O(1) without MMIO.
#[repr(C)]
pub struct PerCoreData {
    /// Self-pointer at offset 0 — reserved for future `gs:[0]` access.
    /// Currently unused: `per_core()` reads `IA32_GS_BASE` via `rdmsr`.
    self_ptr: *const PerCoreData,
    /// Logical core index (0 = BSP, 1..n = APs in MADT order).
    pub core_id: u8,
    /// LAPIC ID from the MADT.
    pub apic_id: u8,
    /// Set to `true` once this core has completed initialization.
    pub is_online: AtomicBool,
    /// Pointer to this core's TSS (for runtime RSP0 updates).
    tss_ptr: *mut TaskStateSegment,
    /// Pointer to this core's GDT (pre-allocated on BSP, loaded on AP).
    gdt_ptr: *const GlobalDescriptorTable,
    /// Segment selectors for this core's GDT.
    gdt_code: SegmentSelector,
    gdt_data: SegmentSelector,
    gdt_tss: SegmentSelector,

View on GitHub