From 68be07098f45b9b5df921ee06219f41607783bcd Mon Sep 17 00:00:00 2001
From: Daniil Tatianin <99danilt@gmail.com>
Date: Mon, 28 Sep 2026 23:13:11 +0300
Subject: [PATCH 1/9] scripts: update build_utils

Latest GCC & Binutils + a few nice fixes.

While at it, unhardcode the CI GCC version so it is fetched dynamically.

Signed-off-by: Daniil Tatianin <99danilt@gmail.com>
---
 .github/workflows/main.yml | 12 +++++++++---
 .gitignore                 |  2 ++
 scripts/build_utils        |  2 +-
 3 files changed, 12 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index b5a92b56..3b43a558 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -51,15 +51,21 @@ jobs:
         with:
           submodules: true
 
+      - if: ${{ matrix.toolchain == 'gcc' }}
+        id: toolchain-version
+        name: Get the toolchain version
+        run: |
+          python3 -c 'import scripts.build_utils.toolchain_builder as tb
+          print(f"key=gcc-{tb.GCC_VERSION}-binutils-{tb.BINUTILS_VERSION}")' \
+            >> "$GITHUB_OUTPUT"
+
       - if: ${{ matrix.toolchain == 'gcc' }}
         id: toolchain-cache
         name: Restore the toolchain cache
         uses: actions/cache/restore@v4.2.2
-        env:
-          gcc-version: 15.1.0
         with:
           path: "${{ github.workspace }}/toolchain/tools-${{ matrix.toolchain }}-${{ matrix.arch }}"
-          key: "${{ runner.os }}-${{ runner.arch }}-${{ matrix.arch }}-gcc-${{ env.gcc-version }}"
+          key: "${{ runner.os }}-${{ runner.arch }}-${{ matrix.arch }}-${{ steps.toolchain-version.outputs.key }}"
 
       - name: Build the platform toolchain
         run: "${{ github.workspace }}/build.py --arch ${{ matrix.arch }} --toolchain ${{ matrix.toolchain }} --no-tune-native --toolchain-only"
diff --git a/.gitignore b/.gitignore
index b45008ea..3fa34d93 100644
--- a/.gitignore
+++ b/.gitignore
@@ -11,4 +11,6 @@ kernel-source/
 bin/
 hyper-*
 toolchain/tools-*
+toolchain/*_sources
+toolchain/*.tar.gz*
 __pycache__
diff --git a/scripts/build_utils b/scripts/build_utils
index 1655098c..e4920dbc 160000
--- a/scripts/build_utils
+++ b/scripts/build_utils
@@ -1 +1 @@
-Subproject commit 1655098c202ff50ef23849b87e800fe12e9ff83b
+Subproject commit e4920dbcc2a847a28e78ac1c1c3e81c0c83ee150

From 108740b899ba255ace0481acdbe45b4600a93b46 Mon Sep 17 00:00:00 2001
From: Daniil Tatianin <99danilt@gmail.com>
Date: Sun, 27 Sep 2026 00:28:35 +0300
Subject: [PATCH 2/9] common/bit: don't let BIT_U8() and BIT_U16() promote to
 int

The shift in BIT_OF_TYPE() promotes any type narrower than int to int,
so BIT_U8() and BIT_U16() produced a signed int, which BIT_FIELD_READ()
then rejects as a field mask. Cast the result back to the requested
type.

Signed-off-by: Daniil Tatianin <99danilt@gmail.com>
---
 kernel/include/common/bit.h | 2 +-
 tests/test-cases/test_bit.c | 5 +++++
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/kernel/include/common/bit.h b/kernel/include/common/bit.h
index 6fc19d5d..2eaa82f0 100644
--- a/kernel/include/common/bit.h
+++ b/kernel/include/common/bit.h
@@ -7,7 +7,7 @@
 #define BITS_PER_BYTE CHAR_BIT
 #define BITS_PER_TYPE(type) (sizeof(type) * BITS_PER_BYTE)
 
-#define BIT_OF_TYPE(type, x) (((type)1) << (x))
+#define BIT_OF_TYPE(type, x) ((type)(((type)1) << (x)))
 #define BIT_U8(x) BIT_OF_TYPE(u8, (x))
 #define BIT_U16(x) BIT_OF_TYPE(u16, (x))
 #define BIT_U32(x) BIT_OF_TYPE(u32, (x))
diff --git a/tests/test-cases/test_bit.c b/tests/test-cases/test_bit.c
index f194a86c..2b5047e4 100644
--- a/tests/test-cases/test_bit.c
+++ b/tests/test-cases/test_bit.c
@@ -16,6 +16,11 @@ TEST_CASE(bit_constants_and_single_bit_macros)
     ASSERT_EQ(BIT_U16(9), (u16)0x0200);
     ASSERT_EQ(BIT_U32(31), 0x80000000u);
     ASSERT_EQ(BIT_U64(63), 0x8000000000000000ull);
+
+    ASSERT_EQ(sizeof(BIT_U8(0)), sizeof(u8));
+    ASSERT_EQ(sizeof(BIT_U16(0)), sizeof(u16));
+    ASSERT_EQ(sizeof(BIT_U32(0)), sizeof(u32));
+    ASSERT_EQ(sizeof(BIT_U64(0)), sizeof(u64));
 }
 
 TEST_CASE(bit_mask_helpers)

From 0081e9de5bf99cc98b9c2edb8d9a71ac7c1abadf Mon Sep 17 00:00:00 2001
From: Daniil Tatianin <99danilt@gmail.com>
Date: Sat, 26 Sep 2026 23:11:05 +0300
Subject: [PATCH 3/9] panic: introduce panic_in_progress()

Lets code that serializes itself against other callers, such as the
console flush, get out of the panic path's way.

Signed-off-by: Daniil Tatianin <99danilt@gmail.com>
---
 kernel/include/panic.h | 2 ++
 kernel/panic.c         | 5 +++++
 2 files changed, 7 insertions(+)

diff --git a/kernel/include/panic.h b/kernel/include/panic.h
index 13ad67fe..0d867ddd 100644
--- a/kernel/include/panic.h
+++ b/kernel/include/panic.h
@@ -5,6 +5,8 @@
 #include <common/attributes.h>
 #include <common/helpers.h>
 
+bool panic_in_progress(void);
+
 NORETURN
 PRINTF_DECL(1, 2)
 void panic(const char *reason, ...);
diff --git a/kernel/panic.c b/kernel/panic.c
index 68863563..315f12cc 100644
--- a/kernel/panic.c
+++ b/kernel/panic.c
@@ -10,6 +10,11 @@
 
 static bool s_in_panic;
 
+bool panic_in_progress(void)
+{
+    return atomic_load_acquire(&s_in_panic);
+}
+
 #undef panic
 void panic(const char *fmt, ...)
 {

From f1d3744ead68652cf492777cef126495d03fa574 Mon Sep 17 00:00:00 2001
From: Daniil Tatianin <99danilt@gmail.com>
Date: Sat, 26 Sep 2026 23:11:05 +0300
Subject: [PATCH 4/9] log: don't re-enter the console flush

A print from inside a flush, e.g. a WARN() in a console driver or an
interrupt that logs mid write, flushed again and clobbered the static
buffers the outer flush was still using. Registering a console flushed
the same way with no protection at all.

Let only one caller flush at a time. A nested caller leaves its record
in the ring and marks the flush pending for the owner to pick up. A
panic flushes regardless, since the flush it interrupted never resumes.

Signed-off-by: Daniil Tatianin <99danilt@gmail.com>
---
 kernel/console.c         |  2 +-
 kernel/include/log.h     |  7 ++--
 kernel/log.c             | 76 +++++++++++++++++++++++++++++++++++++---
 tests/kernel_helpers.cpp |  3 +-
 4 files changed, 75 insertions(+), 13 deletions(-)

diff --git a/kernel/console.c b/kernel/console.c
index a8d1306f..c207b4bf 100644
--- a/kernel/console.c
+++ b/kernel/console.c
@@ -23,7 +23,7 @@ error_t register_console(struct console *con)
     con->next = g_consoles;
     g_consoles = con;
 
-    log_flush_console(con);
+    log_flush_consoles();
     return EOK;
 }
 
diff --git a/kernel/include/log.h b/kernel/include/log.h
index 012f3070..b3fe204f 100644
--- a/kernel/include/log.h
+++ b/kernel/include/log.h
@@ -65,11 +65,8 @@ enum log_level {
 
 void vprint(const char *msg, va_list vlist);
 
-// Defined in console.h
-struct console;
-
-// Writes every record the console has not seen yet to it
-void log_flush_console(struct console *con);
+// Writes out every record to every console that hasn't yet been output by it
+void log_flush_consoles(void);
 
 PRINTF_DECL(1, 2)
 void print(const char *msg, ...);
diff --git a/kernel/log.c b/kernel/log.c
index d08fdfd4..e8af86ac 100644
--- a/kernel/log.c
+++ b/kernel/log.c
@@ -4,6 +4,8 @@
 #include <common/minmax.h>
 #include <common/string.h>
 #include <common/ctype.h>
+#include <common/atomic.h>
+#include <common/bit.h>
 
 #include <console.h>
 #include <log.h>
@@ -11,6 +13,7 @@
 #include <unwind.h>
 #include <log_ring.h>
 #include <param.h>
+#include <panic.h>
 
 #include <time/units.h>
 
@@ -200,7 +203,7 @@ static void format_record(
         out_buf_append(out, "\n", 1);
 }
 
-void log_flush_console(struct console *con)
+static void log_flush_console(struct console *con)
 {
     static char s_msg_buf[512], s_out_data[512 + 128];
 
@@ -242,12 +245,75 @@ void log_flush_console(struct console *con)
     }
 }
 
-static void print_flush(void)
+/*
+ * The whole flush state lives in one word, so every transition is a
+ * single compare-and-exchange. PENDING is only set when a writer context
+ * notices there's already an in-progress flush operation that is being
+ * performed by someone else (meaning it sees the OWNED bit was set). The
+ * context currently performing the flush operation then notices that later
+ * on and also flushes the new record left behind by the setter of PENDING.
+ *
+ * (There's one real downside with this scheme and it's that there's no flush
+ *  handover operation defined between writers, meaning the first writer to
+ *  acquire the OWNED bit, gets to flush every single newly inserted record by
+ *  other CPUs. This may lead to hard lockups if other CPUs do heavy-enough
+ *  logging. Fixing this is a TODO.)
+ */
+#define FLUSH_OWNED BIT_U32(0)
+#define FLUSH_PENDING BIT_U32(1)
+
+static u32 s_flush_state;
+
+static bool flush_try_acquire(void)
+{
+    u32 state, desired;
+
+    state = atomic_load_relaxed(&s_flush_state);
+
+    for (;;) {
+        desired = state ? state | FLUSH_PENDING : FLUSH_OWNED;
+
+        if (atomic_cmpxchg_acq_rel(&s_flush_state, &state, desired))
+            return state == 0;
+    }
+}
+
+static bool flush_release(void)
+{
+    u32 state = FLUSH_OWNED;
+
+    /*
+     * Fails when a record was left behind by another writer, which noticed
+     * there was already a flush in-progress that we owned.
+     */
+    if (atomic_cmpxchg_acq_rel(&s_flush_state, &state, 0))
+        return true;
+
+    /*
+     * Go back and take another pass so we flush the record(s) left behind by
+     * concurrent writers. Clear the pending bit so we notice if this happens
+     * again.
+     */
+    atomic_xchg(&s_flush_state, FLUSH_OWNED, MO_ACQ_REL);
+    return false;
+}
+
+void log_flush_consoles(void)
 {
     struct console *con;
 
-    for (con = g_consoles; con; con = con->next)
-        log_flush_console(con);
+    /*
+     * Always allow panic to take over flushing, we have no other way to make
+     * sure the interrupted context that was doing the flushing ever gets to
+     * run again.
+     */
+    if (!flush_try_acquire() && !panic_in_progress())
+        return;
+
+    do {
+        for (con = g_consoles; con; con = con->next)
+            log_flush_console(con);
+    } while (!flush_release());
 }
 
 static size_t extract_msg_level(const char *msg, enum log_level *out_level)
@@ -340,7 +406,7 @@ void vprint(const char *msg, va_list vlist)
     }
 
     log_ring_publish(&res);
-    print_flush();
+    log_flush_consoles();
 }
 
 void print(const char *msg, ...)
diff --git a/tests/kernel_helpers.cpp b/tests/kernel_helpers.cpp
index 88bc798a..b439f67f 100644
--- a/tests/kernel_helpers.cpp
+++ b/tests/kernel_helpers.cpp
@@ -43,9 +43,8 @@ void print(const char *msg, ...)
     va_end(vlist);
 }
 
-void log_flush_console(struct console *con)
+void log_flush_consoles(void)
 {
-    UNREFERENCED_PARAMETER(con);
 }
 
 #undef panic

From 1315aa61ce2b803db8c05f54412a5437e96e8eef Mon Sep 17 00:00:00 2001
From: Daniil Tatianin <99danilt@gmail.com>
Date: Mon, 28 Sep 2026 15:51:05 +0300
Subject: [PATCH 5/9] log_ring: allow reading past unpublished records

A reader that knows an unpublished record will never be finished, e.g.
one printing a panic, needs a way to get to the records after it. Add
log_ring_read_with_flags() and LOG_RING_READ_SKIP_UNPUBLISHED for that,
log_ring_read() stays the plain form. The newest record is never skipped
since its writer may still be running.

Signed-off-by: Daniil Tatianin <99danilt@gmail.com>
---
 kernel/include/log_ring.h        | 24 ++++++++++++++++++--
 kernel/log_ring.c                | 23 +++++++++++++------
 tests/test-cases/test_log_ring.c | 38 ++++++++++++++++++++++++++++++++
 3 files changed, 76 insertions(+), 9 deletions(-)

diff --git a/kernel/include/log_ring.h b/kernel/include/log_ring.h
index c94a560a..da74bed5 100644
--- a/kernel/include/log_ring.h
+++ b/kernel/include/log_ring.h
@@ -3,6 +3,7 @@
 
 #include <common/error.h>
 #include <common/attributes.h>
+#include <common/bit.h>
 #include <common/string_container.h>
 
 /*
@@ -137,6 +138,15 @@ BUILD_BUG_ON(
     offset_of_after(struct log_info_record, level)
 );
 
+enum log_ring_read_flags : u32 {
+    /*
+     * Skip a record that was reserved and never published, as long as
+     * newer records exist. Only for readers that know such a record will
+     * never be finished, e.g. during a panic.
+     */
+    LOG_RING_READ_SKIP_UNPUBLISHED = BIT_U32(0),
+};
+
 /*
  * Read a record from the log ring.
  *
@@ -148,11 +158,21 @@ BUILD_BUG_ON(
  * sequence number (if the requested record no longer exists
  * due to being overwritten by other log messages) is written to 'out_rec'.
  */
-error_t log_ring_read(
+error_t log_ring_read_with_flags(
     struct log_ring *ring, u64 seq_num, char *out_buf, size_t buf_size,
-    struct log_record *out_rec
+    enum log_ring_read_flags flags, struct log_record *out_rec
 );
 
+static inline error_t log_ring_read(
+    struct log_ring *ring, u64 seq_num, char *out_buf, size_t buf_size,
+    struct log_record *out_rec
+)
+{
+    return log_ring_read_with_flags(
+        ring, seq_num, out_buf, buf_size, 0, out_rec
+    );
+}
+
 /*
  * Check whether reading a record with 'seq_num' would succeed. Note that this
  * doesn't mean a record with this number actually exists, only that there is
diff --git a/kernel/log_ring.c b/kernel/log_ring.c
index 37ae467c..07a5dbcb 100644
--- a/kernel/log_ring.c
+++ b/kernel/log_ring.c
@@ -339,7 +339,8 @@ static error_t log_descriptor_read(
 }
 
 static error_t do_log_ring_read(
-    struct log_ring *ring, u64 *in_out_seq, struct log_record *out_rec
+    struct log_ring *ring, u64 *in_out_seq, enum log_ring_read_flags flags,
+    struct log_record *out_rec
 )
 {
     u64 tail_seq, seq = *in_out_seq;
@@ -372,7 +373,15 @@ static error_t do_log_ring_read(
          * we're done.
          */
         WARN_ON(ret != EINVAL);
-        break;
+
+        if (!(flags & LOG_RING_READ_SKIP_UNPUBLISHED))
+            break;
+
+        // The newest record is never skipped, its writer may still finish it
+        if (seq + 1 >= log_ring_next_assigned_sequence_number(ring))
+            break;
+
+        seq++;
     }
 
     *in_out_seq = seq;
@@ -393,7 +402,7 @@ static void update_last_published_sequence_number(struct log_ring *ring)
         for (;;) {
             new_id++;
 
-            ret = do_log_ring_read(ring, &new_id, nullptr);
+            ret = do_log_ring_read(ring, &new_id, 0, nullptr);
             if (ret != EOK)
                 break;
             cur_id = new_id;
@@ -670,9 +679,9 @@ void log_ring_reservation_set_facility(
     atomic_store_release(&info->facility, facility);
 }
 
-error_t log_ring_read(
+error_t log_ring_read_with_flags(
     struct log_ring *ring, u64 seq_num, char *out_buf, size_t buf_size,
-    struct log_record *out_rec
+    enum log_ring_read_flags flags, struct log_record *out_rec
 )
 {
     error_t ret;
@@ -680,7 +689,7 @@ error_t log_ring_read(
     if (out_rec != nullptr)
         out_rec->data = MAKE_STR(out_buf, buf_size);
 
-    ret = do_log_ring_read(ring, &seq_num, out_rec);
+    ret = do_log_ring_read(ring, &seq_num, flags, out_rec);
     if (ret == EOK && out_rec != nullptr)
         out_rec->data.size = MIN(buf_size, out_rec->length);
 
@@ -689,7 +698,7 @@ error_t log_ring_read(
 
 error_t log_ring_readable(struct log_ring *ring, u64 seq_num)
 {
-    return do_log_ring_read(ring, &seq_num, nullptr);
+    return do_log_ring_read(ring, &seq_num, 0, nullptr);
 }
 
 u64 log_ring_first_readable_sequence_number(struct log_ring *ring)
diff --git a/tests/test-cases/test_log_ring.c b/tests/test-cases/test_log_ring.c
index 8cd3c77c..029f4720 100644
--- a/tests/test-cases/test_log_ring.c
+++ b/tests/test-cases/test_log_ring.c
@@ -181,6 +181,44 @@ TEST_CASE(extend_record)
     READ_ONE_EXPECT_EINVAL();
 }
 
+TEST_CASE(skip_unpublished)
+{
+    TEST_RING(RING_4K, 5);
+    struct log_ring_reservation reservation;
+    struct log_record record;
+
+    WRITE_ONE_EXPECT_SUCCESS("first");
+
+    // Reserved and never finished, like a writer interrupted by a panic
+    ASSERT_EQ(log_ring_reserve(ring, 8, SYSLOG_CRIT, &reservation), EOK);
+
+    WRITE_ONE_EXPECT_SUCCESS("third");
+
+    READ_ONE_EXPECT("first");
+    READ_ONE_EXPECT_EINVAL();
+
+    ASSERT_EQ(
+        log_ring_read_with_flags(
+            ring, seq, read_buf, sizeof(read_buf),
+            LOG_RING_READ_SKIP_UNPUBLISHED, &record
+        ),
+        EOK
+    );
+    ASSERT_EQ(record.seq_num, 2);
+    ASSERT_EQ(record.length, strlen("third"));
+    ASSERT_EQ(memcmp(read_buf, "third", record.length), 0);
+
+    // The newest record is never skipped, its writer may still finish it
+    ASSERT_EQ(log_ring_reserve(ring, 8, SYSLOG_CRIT, &reservation), EOK);
+    ASSERT_EQ(
+        log_ring_read_with_flags(
+            ring, 3, read_buf, sizeof(read_buf),
+            LOG_RING_READ_SKIP_UNPUBLISHED, &record
+        ),
+        EINVAL
+    );
+}
+
 #define MSG0 "00000000"
 #define MSG1 "11111111"
 #define MSG2 "22222222"

From 55bf0e7d4b971e2ce839818bc4296069fe802177 Mon Sep 17 00:00:00 2001
From: Daniil Tatianin <99danilt@gmail.com>
Date: Mon, 28 Sep 2026 15:51:05 +0300
Subject: [PATCH 6/9] log: don't let an unfinished record hide a panic

A panic that interrupts a print between reserving its record and
publishing it, e.g. from an interrupt handler, leaves that record
unpublished forever. The flush stopped there, so none of the panic
output ever reached a console. Skip such records while a panic is in
progress.

Signed-off-by: Daniil Tatianin <99danilt@gmail.com>
---
 kernel/log.c | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/kernel/log.c b/kernel/log.c
index e8af86ac..84fdeaac 100644
--- a/kernel/log.c
+++ b/kernel/log.c
@@ -213,10 +213,19 @@ static void log_flush_console(struct console *con)
     u64 sec, usec;
     int stamp_len;
     char stamp[32];
+    enum log_ring_read_flags read_flags = 0;
+
+    /*
+     * A panic may have interrupted a writer between reserving and
+     * publishing its record, which would hide everything printed after it
+     */
+    if (panic_in_progress())
+        read_flags |= LOG_RING_READ_SKIP_UNPUBLISHED;
 
     for (;;) {
-        ret = log_ring_read(
-            &s_log_ring, con->log_seq_num, s_msg_buf, sizeof(s_msg_buf), &rec
+        ret = log_ring_read_with_flags(
+            &s_log_ring, con->log_seq_num, s_msg_buf, sizeof(s_msg_buf),
+            read_flags, &rec
         );
         if (ret != EOK)
             break;

From 2b1cca2cfe6322a64c8adcab1aa8e56fff350c9c Mon Sep 17 00:00:00 2001
From: Daniil Tatianin <99danilt@gmail.com>
Date: Sat, 26 Sep 2026 23:15:34 +0300
Subject: [PATCH 7/9] bug: make finish_warn_report() available to other
 reporters

Other reporters of non-fatal kernel problems should end their report
the same way a WARN() does, so panic_on_warn applies to them too.

Signed-off-by: Daniil Tatianin <99danilt@gmail.com>
---
 kernel/bug.c                 | 2 +-
 kernel/include/private/bug.h | 4 ++++
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/kernel/bug.c b/kernel/bug.c
index dd935937..4e100f90 100644
--- a/kernel/bug.c
+++ b/kernel/bug.c
@@ -17,7 +17,7 @@
 static bool s_panic_on_warn;
 parameter_with_flags(s_panic_on_warn, PARAM_RUNTIME_WRITABLE);
 
-static void finish_warn_report(struct registers *regs)
+void finish_warn_report(struct registers *regs)
 {
     if (s_panic_on_warn) {
         /*
diff --git a/kernel/include/private/bug.h b/kernel/include/private/bug.h
index 03b157c0..b06e6bcf 100644
--- a/kernel/include/private/bug.h
+++ b/kernel/include/private/bug.h
@@ -21,3 +21,7 @@
         ".short " TO_STR(trap_flags) "\n"                       \
         ".popsection\n"                                         \
     )
+
+struct registers;
+
+void finish_warn_report(struct registers *regs);

From bfffe6a55aac26d4fe1f9986cb14252b62a73242 Mon Sep 17 00:00:00 2001
From: Daniil Tatianin <99danilt@gmail.com>
Date: Sat, 26 Sep 2026 23:41:21 +0300
Subject: [PATCH 8/9] build: require CMake 3.18

It lets a helper called from any subdirectory set source file properties
on the kernel objects via set_property(SOURCE ... TARGET_DIRECTORY).

Signed-off-by: Daniil Tatianin <99danilt@gmail.com>
---
 CMakeLists.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/CMakeLists.txt b/CMakeLists.txt
index 8ae68a1a..56d661e8 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -1,4 +1,4 @@
-cmake_minimum_required(VERSION 3.16)
+cmake_minimum_required(VERSION 3.18)
 
 set(CMAKE_EXPORT_COMPILE_COMMANDS ON)
 

From 0aa604e0054f02c5c5cf70beace51fe56d2f0f37 Mon Sep 17 00:00:00 2001
From: Daniil Tatianin <99danilt@gmail.com>
Date: Mon, 28 Sep 2026 16:18:39 +0300
Subject: [PATCH 9/9] ubsan: introduce the undefined behavior sanitizer

UBSAN support for both the GCC and Clang toolchains, behind a config
option in the debug sub-menu, opt-in support per architecture.

The one quirk is that only Clang supports relative report locations via
"-fsanitize-undefined-strip-path-components=", while GCC has no such
option, so we just keep absolute paths there.

Enum checks are left out since neither compiler instruments them for C.
Division by zero is GCC only, clang treats the code after its handler
as unreachable, so a report that returns runs off the function.

Signed-off-by: Daniil Tatianin <99danilt@gmail.com>
---
 kernel/CMakeLists.txt           |   6 +
 kernel/Kconfig                  |  32 ++++
 kernel/arch/Kconfig             |   3 +
 kernel/arch/x86_64/Kconfig      |   1 +
 kernel/include/private/ubsan.h  |  70 ++++++++
 kernel/target_helpers.cmake     |  11 ++
 kernel/ubsan.c                  | 284 ++++++++++++++++++++++++++++++++
 kernel/ubsan.cmake              |  35 ++++
 toolchain/toolchain_clang.cmake |   1 +
 toolchain/toolchain_gcc.cmake   |   1 +
 10 files changed, 444 insertions(+)
 create mode 100644 kernel/include/private/ubsan.h
 create mode 100644 kernel/ubsan.c
 create mode 100644 kernel/ubsan.cmake

diff --git a/kernel/CMakeLists.txt b/kernel/CMakeLists.txt
index ed8cb85c..1ff2318a 100644
--- a/kernel/CMakeLists.txt
+++ b/kernel/CMakeLists.txt
@@ -4,6 +4,7 @@ include(build_stamp.cmake)
 include(target_helpers.cmake)
 include(module.cmake)
 include(ld_template.cmake)
+include(ubsan.cmake)
 
 # The base kernel executable that contains an empty stub symbol table
 set(
@@ -122,6 +123,11 @@ endif ()
 
 ultra_compile_options(-O${CONFIG_OPTIMIZATION_LEVEL})
 
+if (CONFIG_UBSAN)
+    setup_ubsan()
+    ultra_sources_no_ubsan(ubsan.c)
+endif ()
+
 ultra_link_options(
     -nostdlib
     -Wl,--no-pie
diff --git a/kernel/Kconfig b/kernel/Kconfig
index e6a6fa19..104f64f3 100644
--- a/kernel/Kconfig
+++ b/kernel/Kconfig
@@ -59,6 +59,38 @@ config VERBOSE_INIT_LEVELS
 config DEBUG_MM
     bool "Enable debug assertions for the memory management subsystem"
 
+menuconfig UBSAN
+    bool "Undefined behavior sanitizer"
+    depends on ARCH_HAS_UBSAN
+
+if UBSAN
+
+config UBSAN_BOUNDS
+    bool "Check array indices against their statically known bounds"
+    default y
+
+config UBSAN_SHIFT
+    bool "Check for shifts that are out of range"
+    default y
+
+config UBSAN_SIGNED_OVERFLOW
+    bool "Check for signed integer overflow"
+    default y
+
+config UBSAN_DIV_ZERO
+    bool "Check for integer division by zero"
+    depends on TOOLCHAIN_GCC
+
+config UBSAN_UNREACHABLE
+    bool "Check for control flow reaching __builtin_unreachable()"
+    default y
+
+config UBSAN_BOOL
+    bool "Check for loads of bool values that are neither 0 nor 1"
+    default y
+
+endif
+
 endmenu
 
 rsource "arch/Kconfig"
diff --git a/kernel/arch/Kconfig b/kernel/arch/Kconfig
index ab4613d0..870f819c 100644
--- a/kernel/arch/Kconfig
+++ b/kernel/arch/Kconfig
@@ -33,6 +33,9 @@ config ARCH_PHYS_ADDR_WIDTH
     default 8 if (ARCH_64BIT || ARCH_FORCE_64BIT_PHYS_ADDR_WIDTH)
     default 4 if ARCH_32BIT
 
+config ARCH_HAS_UBSAN
+    bool
+
 if ARCH_X86_64
 rsource "x86_64/Kconfig"
 endif
diff --git a/kernel/arch/x86_64/Kconfig b/kernel/arch/x86_64/Kconfig
index db6dc0b0..721018ea 100644
--- a/kernel/arch/x86_64/Kconfig
+++ b/kernel/arch/x86_64/Kconfig
@@ -14,6 +14,7 @@ config ARCH_X86_64_BASE
     bool
     select ARCH_LITTLE_ENDIAN
     select ARCH_64BIT
+    select ARCH_HAS_UBSAN
     select SMBIOS
     select ACPI
     select ACPI_PM
diff --git a/kernel/include/private/ubsan.h b/kernel/include/private/ubsan.h
new file mode 100644
index 00000000..32d59c83
--- /dev/null
+++ b/kernel/include/private/ubsan.h
@@ -0,0 +1,70 @@
+#pragma once
+
+#include <common/attributes.h>
+#include <common/bit.h>
+#include <common/types.h>
+
+#define UBSAN_TYPE_KIND_INT 0
+#define UBSAN_TYPE_INFO_SIGNED BIT_U16(0)
+#define UBSAN_TYPE_INFO_LOG2_WIDTH MAKE_BIT_MASK_U16(15, 1)
+
+struct ubsan_source_location {
+    const char *file;
+    u32 line;
+    u32 column;
+};
+
+struct ubsan_type {
+    u16 kind;
+    u16 info;
+    char name[];
+};
+
+struct ubsan_out_of_bounds_data {
+    struct ubsan_source_location loc;
+    const struct ubsan_type *array_type;
+    const struct ubsan_type *index_type;
+};
+
+struct ubsan_shift_data {
+    struct ubsan_source_location loc;
+    const struct ubsan_type *lhs_type;
+    const struct ubsan_type *rhs_type;
+};
+
+struct ubsan_value_data {
+    struct ubsan_source_location loc;
+    const struct ubsan_type *type;
+};
+
+struct ubsan_unreachable_data {
+    struct ubsan_source_location loc;
+};
+
+void __ubsan_handle_out_of_bounds(
+    struct ubsan_out_of_bounds_data *data, ptr_t index
+);
+void __ubsan_handle_shift_out_of_bounds(
+    struct ubsan_shift_data *data, ptr_t lhs, ptr_t rhs
+);
+void __ubsan_handle_add_overflow(
+    struct ubsan_value_data *data, ptr_t lhs, ptr_t rhs
+);
+void __ubsan_handle_sub_overflow(
+    struct ubsan_value_data *data, ptr_t lhs, ptr_t rhs
+);
+void __ubsan_handle_mul_overflow(
+    struct ubsan_value_data *data, ptr_t lhs, ptr_t rhs
+);
+void __ubsan_handle_negate_overflow(
+    struct ubsan_value_data *data, ptr_t value
+);
+void __ubsan_handle_divrem_overflow(
+    struct ubsan_value_data *data, ptr_t lhs, ptr_t rhs
+);
+void __ubsan_handle_load_invalid_value(
+    struct ubsan_value_data *data, ptr_t value
+);
+
+NORETURN
+void __ubsan_handle_builtin_unreachable(struct ubsan_unreachable_data *data);
diff --git a/kernel/target_helpers.cmake b/kernel/target_helpers.cmake
index c74c03ab..419f30a4 100644
--- a/kernel/target_helpers.cmake
+++ b/kernel/target_helpers.cmake
@@ -71,3 +71,14 @@ function(ultra_include_directories)
         ${ARGN}
     )
 endfunction()
+
+function(ultra_sources_no_ubsan)
+    ultra_sources(${ARGN})
+    set_property(
+        SOURCE ${ARGN}
+        TARGET_DIRECTORY ${ULTRA_KERNEL_OBJECTS}
+        APPEND
+        PROPERTY COMPILE_OPTIONS
+        -fno-sanitize=undefined
+    )
+endfunction()
diff --git a/kernel/ubsan.c b/kernel/ubsan.c
new file mode 100644
index 00000000..43fa85bd
--- /dev/null
+++ b/kernel/ubsan.c
@@ -0,0 +1,284 @@
+#define MSG_FMT(msg) "ubsan: " msg
+
+#include <common/atomic.h>
+#include <common/bit.h>
+#include <common/format.h>
+#include <common/types.h>
+
+#include <log.h>
+#include <panic.h>
+
+#include <private/bug.h>
+#include <private/ubsan.h>
+
+#define UBSAN_MAX_INT_WIDTH BITS_PER_TYPE(u128)
+#define UBSAN_COLUMN_REPORTED UINT32_MAX
+#define UBSAN_VALUE_STR_SIZE 48
+
+// TODO: move this into struct task once we have it
+static bool s_in_report;
+
+static u32 type_bit_width(const struct ubsan_type *type)
+{
+    return BIT_U32(BIT_FIELD_READ(type->info, UBSAN_TYPE_INFO_LOG2_WIDTH));
+}
+
+static bool type_is_int(const struct ubsan_type *type)
+{
+    return type->kind == UBSAN_TYPE_KIND_INT &&
+           type_bit_width(type) <= UBSAN_MAX_INT_WIDTH;
+}
+
+static bool type_is_signed(const struct ubsan_type *type)
+{
+    return type_is_int(type) && (type->info & UBSAN_TYPE_INFO_SIGNED);
+}
+
+// Values wider than a pointer are passed by reference
+static bool value_is_inline(const struct ubsan_type *type)
+{
+    return type_bit_width(type) <= BITS_PER_TYPE(ptr_t);
+}
+
+static u128 value_unsigned(const struct ubsan_type *type, ptr_t value)
+{
+    u32 extra_bits;
+
+    if (!type_is_int(type))
+        return 0;
+    if (!value_is_inline(type))
+        return *(const u128*)value;
+
+    extra_bits = UBSAN_MAX_INT_WIDTH - type_bit_width(type);
+    return ((u128)value << extra_bits) >> extra_bits;
+}
+
+static i128 value_signed(const struct ubsan_type *type, ptr_t value)
+{
+    u32 extra_bits;
+
+    if (!type_is_int(type))
+        return 0;
+    if (!value_is_inline(type))
+        return *(const i128*)value;
+
+    extra_bits = UBSAN_MAX_INT_WIDTH - type_bit_width(type);
+    return (i128)((u128)value << extra_bits) >> extra_bits;
+}
+
+static void format_value(
+    char *buf, size_t size, const struct ubsan_type *type, ptr_t value
+)
+{
+    i128 sval;
+    u128 uval;
+
+    if (!type_is_int(type)) {
+        snprintf(buf, size, "<unknown>");
+        return;
+    }
+
+    if (type_is_signed(type)) {
+        sval = value_signed(type, value);
+
+        if (sval >= INT64_MIN && sval <= INT64_MAX) {
+            snprintf(buf, size, "%lld", (i64)sval);
+            return;
+        }
+    }
+
+    uval = value_unsigned(type, value);
+
+    if (uval <= UINT64_MAX) {
+        snprintf(buf, size, "%llu", (u64)uval);
+        return;
+    }
+
+    snprintf(
+        buf, size, "0x%016llX%016llX", (u64)(uval >> BITS_PER_TYPE(u64)),
+        (u64)uval
+    );
+}
+
+static bool report_begin(struct ubsan_source_location *loc, const char *check)
+{
+    u32 column;
+
+    if (atomic_xchg(&s_in_report, true, MO_ACQ_REL))
+        return false;
+
+    /*
+     * The compiler emits the location as writable data, reuse the column
+     * field as the per-site "reported" flag.
+     */
+    column = atomic_xchg(&loc->column, UBSAN_COLUMN_REPORTED, MO_RELAXED);
+    if (column == UBSAN_COLUMN_REPORTED) {
+        atomic_store_release(&s_in_report, false);
+        return false;
+    }
+
+    pr_warn("%s in %s:%u:%u\n", check, loc->file, loc->line, column);
+    return true;
+}
+
+static void report_end(void)
+{
+    finish_warn_report(nullptr);
+    atomic_store_release(&s_in_report, false);
+}
+
+void __ubsan_handle_out_of_bounds(
+    struct ubsan_out_of_bounds_data *data, ptr_t index
+)
+{
+    char index_str[UBSAN_VALUE_STR_SIZE];
+
+    if (!report_begin(&data->loc, "array-index-out-of-bounds"))
+        return;
+
+    format_value(index_str, sizeof(index_str), data->index_type, index);
+    pr_warn(
+        "index %s is out of range for type %s\n", index_str,
+        data->array_type->name
+    );
+
+    report_end();
+}
+
+void __ubsan_handle_shift_out_of_bounds(
+    struct ubsan_shift_data *data, ptr_t lhs, ptr_t rhs
+)
+{
+    char lhs_str[UBSAN_VALUE_STR_SIZE], rhs_str[UBSAN_VALUE_STR_SIZE];
+    const struct ubsan_type *lhs_type = data->lhs_type;
+    const struct ubsan_type *rhs_type = data->rhs_type;
+
+    if (!report_begin(&data->loc, "shift-out-of-bounds"))
+        return;
+
+    format_value(lhs_str, sizeof(lhs_str), lhs_type, lhs);
+    format_value(rhs_str, sizeof(rhs_str), rhs_type, rhs);
+
+    if (type_is_signed(rhs_type) && value_signed(rhs_type, rhs) < 0)
+        pr_warn("shift exponent %s is negative\n", rhs_str);
+    else if (value_unsigned(rhs_type, rhs) >= type_bit_width(lhs_type))
+        pr_warn(
+            "shift exponent %s is too large for %u-bit type %s\n", rhs_str,
+            type_bit_width(lhs_type), lhs_type->name
+        );
+    else if (type_is_signed(lhs_type) && value_signed(lhs_type, lhs) < 0)
+        pr_warn("left shift of negative value %s\n", lhs_str);
+    else
+        pr_warn(
+            "left shift of %s by %s places cannot be represented in type %s\n",
+            lhs_str, rhs_str, lhs_type->name
+        );
+
+    report_end();
+}
+
+static void handle_overflow(
+    struct ubsan_value_data *data, ptr_t lhs, ptr_t rhs, char op
+)
+{
+    char lhs_str[UBSAN_VALUE_STR_SIZE], rhs_str[UBSAN_VALUE_STR_SIZE];
+
+    if (!report_begin(&data->loc, "integer-overflow"))
+        return;
+
+    format_value(lhs_str, sizeof(lhs_str), data->type, lhs);
+    format_value(rhs_str, sizeof(rhs_str), data->type, rhs);
+    pr_warn(
+        "%s %c %s cannot be represented in type %s\n", lhs_str, op, rhs_str,
+        data->type->name
+    );
+
+    report_end();
+}
+
+void __ubsan_handle_add_overflow(
+    struct ubsan_value_data *data, ptr_t lhs, ptr_t rhs
+)
+{
+    handle_overflow(data, lhs, rhs, '+');
+}
+
+void __ubsan_handle_sub_overflow(
+    struct ubsan_value_data *data, ptr_t lhs, ptr_t rhs
+)
+{
+    handle_overflow(data, lhs, rhs, '-');
+}
+
+void __ubsan_handle_mul_overflow(
+    struct ubsan_value_data *data, ptr_t lhs, ptr_t rhs
+)
+{
+    handle_overflow(data, lhs, rhs, '*');
+}
+
+void __ubsan_handle_negate_overflow(
+    struct ubsan_value_data *data, ptr_t value
+)
+{
+    char value_str[UBSAN_VALUE_STR_SIZE];
+
+    if (!report_begin(&data->loc, "integer-overflow"))
+        return;
+
+    format_value(value_str, sizeof(value_str), data->type, value);
+    pr_warn(
+        "negation of %s cannot be represented in type %s\n", value_str,
+        data->type->name
+    );
+
+    report_end();
+}
+
+void __ubsan_handle_divrem_overflow(
+    struct ubsan_value_data *data, ptr_t lhs, ptr_t rhs
+)
+{
+    char lhs_str[UBSAN_VALUE_STR_SIZE];
+
+    if (!report_begin(&data->loc, "division-overflow"))
+        return;
+
+    if (type_is_signed(data->type) && value_signed(data->type, rhs) == -1) {
+        format_value(lhs_str, sizeof(lhs_str), data->type, lhs);
+        pr_warn(
+            "division of %s by -1 cannot be represented in type %s\n",
+            lhs_str, data->type->name
+        );
+    } else {
+        pr_warn("division by zero\n");
+    }
+
+    report_end();
+}
+
+void __ubsan_handle_load_invalid_value(
+    struct ubsan_value_data *data, ptr_t value
+)
+{
+    char value_str[UBSAN_VALUE_STR_SIZE];
+
+    if (!report_begin(&data->loc, "invalid-load"))
+        return;
+
+    format_value(value_str, sizeof(value_str), data->type, value);
+    pr_warn(
+        "load of value %s is not a valid value for type %s\n", value_str,
+        data->type->name
+    );
+
+    report_end();
+}
+
+void __ubsan_handle_builtin_unreachable(struct ubsan_unreachable_data *data)
+{
+    panic(
+        "ubsan: reached unreachable code in %s:%u:%u", data->loc.file,
+        data->loc.line, data->loc.column
+    );
+}
diff --git a/kernel/ubsan.cmake b/kernel/ubsan.cmake
new file mode 100644
index 00000000..19ca737f
--- /dev/null
+++ b/kernel/ubsan.cmake
@@ -0,0 +1,35 @@
+function(setup_ubsan)
+    set(CHECKS "")
+
+    if (CONFIG_UBSAN_BOUNDS)
+        list(APPEND CHECKS ${ULTRA_TOOLCHAIN_UBSAN_BOUNDS})
+    endif ()
+    if (CONFIG_UBSAN_SHIFT)
+        list(APPEND CHECKS shift)
+    endif ()
+    if (CONFIG_UBSAN_SIGNED_OVERFLOW)
+        list(APPEND CHECKS signed-integer-overflow)
+    endif ()
+    if (CONFIG_UBSAN_DIV_ZERO)
+        list(APPEND CHECKS integer-divide-by-zero)
+    endif ()
+    if (CONFIG_UBSAN_UNREACHABLE)
+        list(APPEND CHECKS unreachable)
+    endif ()
+    if (CONFIG_UBSAN_BOOL)
+        list(APPEND CHECKS bool)
+    endif ()
+
+    if (CHECKS)
+        list(JOIN CHECKS "," CHECKS)
+        ultra_compile_options(-fsanitize=${CHECKS})
+    endif ()
+
+    if (CONFIG_TOOLCHAIN_CLANG)
+        string(REPLACE "/" ";" SOURCE_DIR_PARTS "${CMAKE_SOURCE_DIR}")
+        list(LENGTH SOURCE_DIR_PARTS SOURCE_DIR_DEPTH)
+        ultra_compile_options(
+            -fsanitize-undefined-strip-path-components=${SOURCE_DIR_DEPTH}
+        )
+    endif ()
+endfunction()
diff --git a/toolchain/toolchain_clang.cmake b/toolchain/toolchain_clang.cmake
index 5e815759..bfc1e333 100644
--- a/toolchain/toolchain_clang.cmake
+++ b/toolchain/toolchain_clang.cmake
@@ -33,3 +33,4 @@ set(CMAKE_C_COMPILER_TARGET "${ULTRA_TARGET_TRIPLE}")
 set(CMAKE_ASM_COMPILER_TARGET "${ULTRA_TARGET_TRIPLE}")
 
 set(ULTRA_TOOLCHAIN_LTO_FLAGS "-flto=full")
+set(ULTRA_TOOLCHAIN_UBSAN_BOUNDS "array-bounds")
diff --git a/toolchain/toolchain_gcc.cmake b/toolchain/toolchain_gcc.cmake
index 46143f2d..57488df2 100644
--- a/toolchain/toolchain_gcc.cmake
+++ b/toolchain/toolchain_gcc.cmake
@@ -12,3 +12,4 @@ set(CMAKE_RANLIB "${ULTRA_TOOLCHAIN_PREFIX}gcc-ranlib")
 set(CMAKE_NM "${ULTRA_TOOLCHAIN_PREFIX}gcc-nm")
 
 set(ULTRA_TOOLCHAIN_LTO_FLAGS "-flto;-flto-partition=none")
+set(ULTRA_TOOLCHAIN_UBSAN_BOUNDS "bounds")