Defects (127)

-     dd isr_stub_%[i]
  +     dd isr_stub_%+i

+ #include "string.h"

#include <stdint.h>

void *memcpy

void *c = kmalloc(HEAP_SIZE_FOR_TEST - 1024);

tinyfs_write(name, contents, (uint32_t)strlen_local(contents));

; Zero .bss: the raw disk-loaded kernel image has no zero-fill
    ; guarantee (objcopy -O binary drops NOBITS sections entirely).

Clean kernel build; fixing a minor comment-nesting warning in the host tool.

run_tests: FAIL - timed out waiting for 'SELFTEST PASS'

`eval_binop` never handles `TOK_PLUS` for two ints — only the string-concat path checks it, so int+int silently falls through to `default: return VAL_ZERO`

Found a real bug: `rng_range`'s modulo on a full-range `uint32_t` hits CC's known "signed-`idiv`-only" limitation

drawing in mode 13h clobbers it - text mode "restores" registers-wise but shows garbage glyphs. I need to reload the font into plane 2.

my font-access values had bits wrong (an extra bit set in SEQ[4], and GC[6] pointing at the wrong addressing mode)

vga_debug_dump_font showed that plane-2 reads/writes at 0xA0000 only land correctly when the CRTC is already in a text-mode-like state

Confirmed — brace initializers aren't supported for stack locals. Fixing both spots.

The player sprite is getting clipped by the message box. Let me redesign the battlefield proportions so the ground band ends above the box

That stray dot near the message-box border is likely the VGA hardware text cursor (still enabled per the reference CRTC table) bleeding through in graphics mode. Disabling it.

messages currently flash by too fast for a human to read before the next state overwrites them

return val_const((int64_t)(ps->ctx->org_valid_offset));

the `rep stosb` check reads the wrong operand slot.

`eval_primary` was resolving backward-referenced labels straight to their raw section offset, bypassing the org-adjustment / relocation logic in `stmt_encode` entirely.

for x86 ELF `REL` relocations (implicit addend), the addend must be baked into the actual bytes, not left as 0.

elf_writer.c:81:9: warning: variable ‘shidx_rel’ set but not used [-Wunused-but-set-variable]

as: undefined symbol ''

`resolve_pcrel`'s `next_ip` parameter wasn't org-adjusted for `-f bin` mode while the resolved target was, corrupting every relative jump/call offset in bin mode.

`CODE_SEG` (an `EQU`) is used in `jmp CODE_SEG:protected_mode_entry` at the *top* of the file, but not defined until later ... the far-jump's segment silently became 0.

`push dword 0` uses `dword` as an immediate-size hint, not before a memory operand — my parser only handled the `[...]` case.

warning: ‘__builtin_strncpy’ output may be truncated copying 63 bytes from a string of length 511 [-Wstringop-truncation]

__glibc_objsize (__s), __fmt, ... __va_arg_pack ());

as: /tmp/as_ext_test.S:14: expected ] ... `parse_mem` in `AS` only handles `[reg+disp]`, not `[reg-disp]`

`encode_rm32` had no case for a general register base (like `[ebx]`); it fell through to the "bare label, disp32-direct" branch, silently corrupting the address

symbol `st_shndx` was computed as `1 + section_kind_enum` ... Since this file has no `.data` section, `.bss` actually lands at ELF section index 2, not 3

`imul ecx, ecx, 4` (3-operand immediate form) is being mis-encoded as the 2-operand `imul ecx, ecx`, silently dropping the multiply-by-4 scale

call r/m32 (FF /2) - indirect call through a register, e.g. a function-pointer variable's loaded value

as: line 148: unsupported instruction form: lidt

the far-jump encoder always writes a 16-bit offset (`e16`), but in 32-bit mode the `EA` far-jump instruction needs a 32-bit offset — it's 2 bytes short

Let me add the 32-bit-mode `mov r16, m16` / `mov m16, r16` forms right after the register-to-register 16-bit form

`movzx eax, ax` (register-to-register form) incorrectly emits a `0x66` operand-size prefix, turning it into `movzx ax, ax` (a no-op)

`in ax, dx` is missing its `0x66` operand-size prefix — it's encoding a 32-bit `in eax, dx` instead, which reads **two words** from the ATA data port per call

as: too many statements
make: *** [Makefile:108: build/lang/script/eval.o] Error 1

cc: toolchain/ld/elf_format.h:106: undeclared identifier (near 'info')

cc: toolchain/ld/link_flat.c:105: expected expression (near '?')

Segmentation fault      (core dumped) ./build/toolchain/as -f elf32 -o /tmp/y.o build/stage2/toolchain_as_elf_writer.S

grep -n 'SEC_BSS.*NULL\|dst = (sec == SEC_BSS)' toolchain/as/encode.c
[OUT] ...(Bash completed with no output)

run_tests: FAIL - timed out waiting for 'SELFTEST PASS' ... boot.bin: DIFFERS ... 77   0   1 ... dq 1 ; starting LBA

the `#define` body-reading loop consumes the *next* line's first token to detect the boundary, then silently discards it

array bounds in this codebase include computed macro constants (e.g. `TINYFS_INODE_BLOCK` expands to `(1 + 1)`, not a single literal)

parser.c:176:14: warning: ‘/*’ within comment [-Wcomment]

cc: tests/toolchain/t01_basic.c:1: expected "file" after #include

ordering bug in compound-assign ... a register copy of it wouldn't survive an idiv/cdq

unnecessary `xchg` that AS doesn't support

broken extern-declaration loop, missing string-literal emission

`walk_collect` emits string-literal bytes immediately during the extern-collection pass, before any `section` directive exists, corrupting the output

fragile `for`-init handling ... Now the `ND_VAR_DECL` goto mess and `ND_FOR` init handling

the `_start` code for host target got placed after the `.rodata` section switch, so it would land in `.rodata` instead of `.text`

That `__builtin_outb`/`__builtin_gdt_flush` code is genuinely broken (dead scratch code, and a hardcoded label that would collide on repeated calls)

a hardcoded label that would collide on repeated calls

codegen.c:28:5: error: implicit declaration of function ‘va_start’

FAIL t05_structs: expected 17, got 15 ... struct member offsets are computed lazily inside `type_size()`, but nothing calls `type_size()` at struct-definition time

fix one known gap (static functions incorrectly emitted as `global`) ... (void)is_static;

Let me fix this warning the same way I handled the similar one in `AS` — manual bounded concatenation instead of `snprintf`.

`CC`'s `-I` parsing only supports the separated form (`-I dir`), but the actual Makefile uses the combined form (`-Ikernel`)

`CC`'s arg parser treats *any* unrecognized flag as the input filename

`paths[depth]` is a static buffer reused by *every* `#include` at the same nesting depth ... `token_t.file` stores a raw pointer into it

The actual failure is nested macro expansion only recursing one level deep.

`perr` reads `p->toks[p->pos]`, but by the time `resolve_ident` calls it, the parser has already advanced past the actual failing identifier

`_start: call main` doesn't set up `argc`/`argv` per the Linux process-entry ABI ... `argv` receives `argv[0]`'s string-pointer value instead of the array pointer

`long` isn't a recognized type keyword in CC's dialect at all — `mkfs_tinyfs.c` uses it

the first call already walks the entire rest of the top-level chain, and then the loop re-walks the tail again on every subsequent iteration

without this they'd be referenced (lea eax, [__static_N]) but never ac[tually allocated]

`_start`/`call main` gets emitted into *every* `--target=host` compilation unit, not just the one that actually defines `main`

a bare function name used as a value ... must decay to its address, not be dereferenced — it was reading 4 bytes of the function's own machine code

SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=0x400000}

self-referential structs ... the struct's own tag only gets registered into the symbol table *after* its body is parsed

`switch`/`case` isn't implemented in CC's parser at all — a real, substantial gap

FAIL kernel/lang/compiler/parser.c: cc: kernel/lang/compiler/parser.c:130: unexpected token (near '?')

`VAL_ZERO`'s designated initializer (`{ .i = 0 }`) is a real gap — CC's initializer parser has no support for designated initializers at all.

`ND_COMMA` was declared but never actually implemented anywhere — the comma operator (`pn->next, i++` in a for-loop increment) simply doesn't parse.

local (stack) variables ARE brace-initialized in this codebase (`exec_result_t r = { EXEC_NORMAL, VAL_ZERO };`), contrary to the existing assumption that only globals use brace-init

properly implement struct-initializer support for both the global `.data` path (which has a silent-corruption bug, not just a crash)

ld: duplicate symbol '__str_0' (from build/idt.o)

`extern` variable declarations get treated as real definitions, allocating their own `.bss`/`.data` storage instead of just referencing the symbol defined elsewhere

temporarily nulling `n->next` before recursing) corrupts `prog`'s chain *while it's being scanned* by `is_local`'s check

with indirect calls (my earlier fix), the callee can be a variable — it spuriously emits `extern block_read` even though `block_read` gets a real local definition later

`parse_global_var` unconditionally sets `n->is_global = 1` regardless of the `static` keyword — every file-scope `static` variable ... gets external linkage

`p[i] = inw(...)` where `p` is `uint16_t*` generates `mov [ecx], eax` (a 4-byte store) instead of a 2-byte store

Our parser never computes the actual length for `[]` (leaves `array_len = -1`), so `sizeof(lower_table)` evaluates to 0

these are `static` *local* array declarations with inferred size, a case my earlier fix (scoped to globals only) didn't cover

struct-by-value assignment/copy isn't supported at all — ... silently copying just 4 bytes of a ~90+ byte `parser_t` struct

This requires implementing struct-by-value function returns (the classic "hidden pointer" ABI pattern)

FAIL t14_struct_return: expected 44, got 145

`read_escape` doesn't handle `\b` (backspace) at all, so it falls through to the `default: return c;` case, returning the literal letter `'b'`

Not a function-like macro (CC's preprocessor only supports object-like #define

cc: toolchain/cc/codegen.c:655: unexpected token (near '?')

cc: internal error: not an lvalue (kind 17) name='line_peek' a_kind=-1 a_name='' g_cur_func='eval_primary'

Only the *outermost* dimension decays to a pointer - `T x[][M]` as a parameter is `T (*x)[M]`, not `T**`.

as: build/toolchain_tests/t01_basic.S:18263733: expected directive/instruction

DBG: reg_lookup entered name=ebp count=31
DBG: i=0 REGS[i].name_is_null=1

DBG: is_type_start entered
DBG: kws array built, kws[0]=void
DBG: i=0 kws[i]=void
exit=139

DBG: rel i=0 sym=g_inodes
DBG: found sym, computing symidx

Found it — `parse_struct_members` has its own unfixed multi-dimensional array parsing loop (the same bug I fixed earlier in `parse_declarator`, but never applied here).

as: relocation against unknown symbol 'Z' ... char default_label[MAX_NAME] = "";

I used `#if defined(__TINYC__)`, but CC's preprocessor explicitly doesn't support `#if`/`#ifdef`

entry.o built by NASM ... names its section `.text.entry`, not `.text`, and my `classify_section()` only matched the exact string, silently dropping `_start`

cc: toolchain/ld/main.c:4: cannot find include file 'stdio.h'

ld: build/stage2/toolchain_as_encode.o: too many symbols

build/stage2/ld: cannot open `build/stage2/ld' (No such file or directory)

toolchain/ld/main.c:128:            flat_base = (uint32_t)strtoul(argv[++i], NULL, 0);

--wxrw--wt 1 martin martin 305 Jul 19 05:24 /tmp/t11 ... decimal 755 = octal 1363

# host-path:fs-name pairs seeded into every disk image; the host paths
# alone are listed separately so they can be used as make prerequisites

updating the exact sizes (281/272 vs my placeholder 281/206)

Root cause: `make run` uses `-display none`, so there's no window at all — no window means no input surface for the emulated PS/2 keyboard.

Right, `BUILD` needs to be defined before it's referenced with `:=`.

Stale objects — Make doesn't track that `CC`'s own source changed. Let me force a clean rebuild.

The OS build used the old plain-gcc bootstrap rule, not the new 3-stage self-hosting script.

SKIP t02_types (no expected value registered)

It self-cancels in `t04_pointers` because both the write (`nums[i]=`) and read (`a[i]`) use the same broken formula

ld: cannot open /tmp/mkfs_build/tinyfs.o
LD: linked OK

Let me use the same pattern (serial to a log file, background QEMU) instead of `-serial stdio` under `timeout`.

My comment text contained a literal `*/` sequence, prematurely closing the C block comment.

ValueError: qemu_type: no key mapping for '('

ld: duplicate symbol 'tc_parser_init' (from /tmp/kbuild/parser.o)

/tmp/oldsrc/toolchain/ld/main.c:1:10: fatal error: ld.h: No such file or directory

fix the script to not depend on catching the boot banner (a `server,nowait` socket discards output written before a client connects)

pkill -9 -f qemu-system-i386 2>/dev/null
bash tools/run_tests.sh 2>&1 | tail -40
[OUT] ...Exit code 1

QEMU's screendump PPM is actually 640x400 (2x supersampled from the native 320x200), not 320x200 as I assumed. That dimension mismatch, not a file race, was silently corrupting every frame

my `pump()` checks for the stop pattern against the *entire* cumulative log, so once "4) Run" appears once, every later wait returns instantly

pkill -f 'qemu-system-i386' 2>/dev/null ... [OUT] ...Exit code 144

I hit a QEMU serial-socket quirk (a connection occasionally went quiet mid-session even though the guest stayed alive and responsive) and added reconnect-on-stall logic