Split the system contract into boot-handoff / abi / device-abi

The `system` module (formerly `danos`) had become a grab-bag: it held the loader<->kernel handoff *and* the kernel<->user ABI *and* the device wire types, in one module three different audiences imported. Usage proved the seam — the bootloader never touched the syscall/device ABI, and user space never touched the boot handoff — so split it by audience, one module per contract: system/boot-handoff.zig loader <-> kernel: BootInformation, Framebuffer, MemoryMap, the VM layout + physicalToVirtual, kernel_abi system/abi.zig kernel <-> user, core: SystemCall, mmap prot flags, page_size, notify_badge_bit, ServiceId system/devices/device-abi.zig kernel <-> user, devices: DeviceDescriptor, DeviceClass, ResourceDescriptor, ResourceKind, ... device-abi is the devices sub-project's public interface, exposed as its own module the way vfs exposes vfs-protocol — importable by user space, unlike the kernel-internal device model it also feeds. That collapses a real duplication: DeviceClass and ResourceKind were defined twice (device-model.zig and the contract, kept "in sync by hand"); device-model now re-exports them from device-abi, so the enum a driver matches on and the one the kernel classifies with are one type. Each import now declares which contract it speaks: the bootloader imports only boot-handoff; a driver only abi + device-abi (via the runtime); the kernel all three. This also retires the `system` / `runtime.system` name overlap. page_size lands in abi (it's part of the mmap contract user space aligns to); the bootloader keeps its own local 4 KiB constant so it depends on nothing but the handoff. All 21 importers rewired, docs updated to keep /system mapping to source. Build, host tests, and the QEMU suite (36/36) all green.
2026-07-10 18:08:51 +01:00
parent 47610e8ee2
commit be81394be3
37 changed files with 395 additions and 337 deletions
@@ -9,7 +9,7 @@
 //! map). Every interrupt must be acknowledged with an end-of-interrupt write, or
 //! the LAPIC won't deliver the next one.

-const system = @import("system");
+const boot_handoff = @import("boot-handoff");
 const io = @import("io.zig");
 const paging = @import("paging.zig");

@@ -121,7 +121,7 @@ pub fn init() void {

    const msr = io.rdmsr(ia32_apic_base_msr);
    // Reach the LAPIC through the physmap (paging.init maps its page there).
-    base = @intCast(system.physicalToVirtual(msr & 0xFFFFF000)); // physical base is bits 12+
+    base = @intCast(boot_handoff.physicalToVirtual(msr & 0xFFFFF000)); // physical base is bits 12+
    io.wrmsr(ia32_apic_base_msr, msr | (1 << 11)); // global enable

    write(register_spurious, 0x100 | spurious_vector); // bit 8 = software enable
@@ -4,7 +4,7 @@
 //! build.zig — no change to the generic code. Keep everything CPU-specific here
 //! (halt, the descriptor tables, later paging), and nothing generic.

-const system = @import("system");
+const boot_handoff = @import("boot-handoff");
 const parameters = @import("parameters");
 const gdt = @import("gdt.zig");
 const tss = @import("tss.zig");
@@ -132,7 +132,7 @@ pub fn init() void {
 /// Build the kernel's own page tables (with real permissions) and switch onto
 /// them. Needs the frame allocator and the boot info (for the memory map and the
 /// kernel's segment layout). Call once the frame allocator is up.
-pub fn enablePaging(allocFrame: *const fn () ?u64, freeFrame: *const fn (u64) void, boot_information: *const system.BootInformation) void {
+pub fn enablePaging(allocFrame: *const fn () ?u64, freeFrame: *const fn (u64) void, boot_information: *const boot_handoff.BootInformation) void {
    paging.init(allocFrame, freeFrame, boot_information);
 }

@@ -10,10 +10,11 @@
 //! Everything is 4 KiB pages — precise and simple; the extra table memory is
 //! negligible against available RAM.

-const system = @import("system");
+const boot_handoff = @import("boot-handoff");
+const abi = @import("abi");
 const io = @import("io.zig");

-const page_size = system.page_size;
+const page_size = abi.page_size;

 // Page-table entry bits.
 const present: u64 = 1 << 0;
@@ -58,7 +59,7 @@ const bootstrap_physmap_limit: u64 = 4 << 30;
 /// both the loader's bootstrap tables and the kernel's own, which share the
 /// physmap base.
 fn tableAt(physical: u64) *[512]u64 {
-    return @ptrFromInt(system.physicalToVirtual(physical));
+    return @ptrFromInt(boot_handoff.physicalToVirtual(physical));
 }

 fn allocTable() u64 {
@@ -102,12 +103,12 @@ fn mapRangePhysmap(pml4: u64, physical_base: u64, len: u64, flags: u64) void {
    var address = physical_base & ~@as(u64, page_size - 1);
    const end = physical_base + len;
    while (address < end) : (address += page_size) {
-        mapPage(pml4, system.physicalToVirtual(address), address, flags);
+        mapPage(pml4, boot_handoff.physicalToVirtual(address), address, flags);
    }
 }

-fn regions(mm: system.MemoryMap) []const system.MemoryRegion {
-    return @as([*]const system.MemoryRegion, @ptrFromInt(system.physicalToVirtual(mm.regions)))[0..mm.len];
+fn regions(mm: boot_handoff.MemoryMap) []const boot_handoff.MemoryRegion {
+    return @as([*]const boot_handoff.MemoryRegion, @ptrFromInt(boot_handoff.physicalToVirtual(mm.regions)))[0..mm.len];
 }

 /// Enable the NX bit in the page-table format (EFER.NXE). Must happen before we
@@ -118,7 +119,7 @@ fn enableNx() void {
 }

 /// Build the address space and switch onto it.
-pub fn init(allocFrame: *const fn () ?u64, freeFrame: *const fn (u64) void, boot_information: *const system.BootInformation) void {
+pub fn init(allocFrame: *const fn () ?u64, freeFrame: *const fn (u64) void, boot_information: *const boot_handoff.BootInformation) void {
    alloc_frame = allocFrame;
    free_frame = freeFrame;
    enableNx();
@@ -136,7 +137,7 @@ pub fn init(allocFrame: *const fn () ?u64, freeFrame: *const fn (u64) void, boot
    //    the kernel touches directly), RW + NX.
    const fb = boot_information.framebuffer;
    mapRangePhysmap(pml4, fb.base, @as(u64, fb.height) * fb.pitch, present | writable | no_execute);
-    mapPage(pml4, system.physicalToVirtual(0xFEE00000), 0xFEE00000, present | writable | no_execute);
+    mapPage(pml4, boot_handoff.physicalToVirtual(0xFEE00000), 0xFEE00000, present | writable | no_execute);

    // 3. The kernel's own segments at their higher-half link addresses, mapped
    //    to their low physical load addresses with real ELF permissions: code
@@ -206,11 +207,11 @@ pub fn mapMmio(physical: u64, len: u64, writable_page: bool) u64 {
    const last = physical + (if (len == 0) 1 else len) - 1;
    var address = first;
    while (address <= (last & ~@as(u64, page_size - 1))) : (address += page_size) {
-        const virtual = system.physicalToVirtual(address);
+        const virtual = boot_handoff.physicalToVirtual(address);
        mapPage(kernel_pml4, virtual, address, flags);
        invalidate(virtual);
    }
-    return system.physicalToVirtual(physical);
+    return boot_handoff.physicalToVirtual(physical);
 }

 /// Like `descend`, but also sets the U/S bit on the intermediate entry (new or
@@ -13,7 +13,7 @@
 //! Once a core has its own descriptor tables, LAPIC, and timer, it calls the generic
 //! scheduler entry and joins the run loop — mechanism here, policy there.

-const system = @import("system");
+const boot_handoff = @import("boot-handoff");
 const io = @import("io.zig");
 const gdt = @import("gdt.zig");
 const tss = @import("tss.zig");
@@ -85,7 +85,7 @@ fn arm() void {
    const start = @extern([*]const u8, .{ .name = "ap_trampoline_start" });
    const end = @extern([*]const u8, .{ .name = "ap_trampoline_end" });
    const len = @intFromPtr(end) - @intFromPtr(start);
-    const destination: [*]u8 = @ptrFromInt(system.physicalToVirtual(tramp_physical));
+    const destination: [*]u8 = @ptrFromInt(boot_handoff.physicalToVirtual(tramp_physical));
    @memcpy(destination[0..len], start[0..len]);
 }

@@ -95,7 +95,7 @@ fn arm() void {
 /// reported in — it's long past the trampoline by then, in the kernel image; a
 /// core that never answered is dead and can't be mid-climb.
 fn disarm() void {
-    const destination: [*]u8 = @ptrFromInt(system.physicalToVirtual(tramp_physical));
+    const destination: [*]u8 = @ptrFromInt(boot_handoff.physicalToVirtual(tramp_physical));
    @memset(destination[0..page_size], 0);
    paging.unmap(tramp_physical); // drop the transient low identity mapping
 }
@@ -107,7 +107,7 @@ fn disarm() void {
 fn param(comptime name: []const u8) *align(1) volatile u64 {
    const start = @intFromPtr(@extern([*]const u8, .{ .name = "ap_trampoline_start" }));
    const sym = @intFromPtr(@extern([*]const u8, .{ .name = name }));
-    return @ptrFromInt(system.physicalToVirtual(tramp_physical + (sym - start)));
+    return @ptrFromInt(boot_handoff.physicalToVirtual(tramp_physical + (sym - start)));
 }

 /// Wake the core with Local APIC id `apic_id` as dense CPU `index`, hand it