The cross toolchain now builds real hosted C++: std::string, vector,
unique_ptr, iostreams and exceptions all work in a plain
x86_64-montauk-g++ invocation with no special flags. This is the
library that native cc1plus will link against for the GCC self-host.
crt1 now runs .preinit_array/.init_array before main and hooks
.fini_array through atexit (main returns via exit(), so destructors
run on both exit paths). Global constructors and libgcc's eh_frame
registration both ride this. GCC is reconfigured with
--enable-initfini-array (modern arrays instead of .ctors),
--with-newlib (satisfies libstdc++'s crossconfig for unknown hosts),
--disable-wchar_t and --disable-libstdcxx-pch; the montauk gcc patch
grows a hunk keeping os/generic ctype under --with-newlib (the
Montauk libc is not newlib).
libc additions harvested by the libstdc++ build: mbtowc/wctomb,
strxfrm, strtok/strtok_r, a real vfscanf/fscanf/scanf (character-
driven with widths and l/ll; also unblocks gprof later), fgetpos/
fsetpos/setbuf/fpos_t, modf plus the C99 float math variants
(acosf..tanhf, hypot/hypotf as wrappers), FP_* classification macros,
the full POSIX errno vocabulary, complete DT_* dirent types, and
mbstate_t.
The SDK ships the real libstdc++.a (was an empty stand-in), the C++
headers at 0:/sdk/include/c++, and cxx-test.elf (global ctor, string,
vector+sort, unique_ptr, throw/catch; exits 0 on 5/5). Ramdisk sits
at 1571 files, within the 2048 table.
Co-Authored-By: Claude Fable 5 <[email protected]>
MontaukOS binaries could not use thread-local storage: the ELF loader
ignored PT_TLS and no FS base was ever programmed, so any %fs access
(initial-exec/local-exec TLS, e.g. libbfd's _Thread_local error state)
page faulted at address 0. This is the kernel prerequisite for
cc1plus/libstdc++ in the GCC port.
ELF loader: parse PT_TLS and build the main thread's TLS block above
the loaded image (x86-64 variant II ABI: block below the thread
pointer, TP = base + align_up(memsz, align), .tdata copied from the
template, .tbss zeroed, ABI self-pointer stored at [TP]). The
template description is kept on the process for thread spawns.
Scheduler: fsBase per thread, loaded into IA32_FS_BASE at every
dispatch site through a per-CPU cache - TLS-free processes cost one
MSR write per CPU ever, and userspace cannot desync the cache since
CR4.FSGSBASE stays off. SYS_THREAD_SPAWN gives each new thread its
own TLS block copied from the template (allocated from the process
heap; reclaimed at process teardown).
Ships tls-test.elf in the SDK (built by the devkit target): checks
.tdata values, .tbss zeroing, and the %fs:0 self-pointer, exiting
nonzero on failure. Boot-smoke verified; existing TLS-free programs
are unaffected.
Co-Authored-By: Claude Fable 5 <[email protected]>
Groundwork for the GCC driver: a compiler driver must spawn cc1/as/ld
and know whether each stage succeeded.
Kernel: the scheduler keeps an exit-code ledger (pid -> code; pids are
monotonic so entries never alias), published during teardown right
before waiters wake. SYS_EXIT records main()'s return value, SYS_KILL
records 256+SIGKILL, and the exception handler records 256+signal
mapped from the fault vector (#PF/#GP -> SIGSEGV, #DE/FP -> SIGFPE,
#UD -> SIGILL). SYS_WAITPID now returns the code: 0..255 for a normal
exit, 256+signal for a violent death. Process args grow from 256
bytes to 4 KiB (cc1 invocations do not fit in 256), with crt1 now
parsing up to 255 argv entries from a static buffer.
libc: new spawn.h with posix_spawn/posix_spawnp over SYS_SPAWN -
libiberty's pex layer has a posix_spawn backend, so GCC's driver works
without fork. argv is joined into the kernel args string (spaces in
arguments rejected; no kernel quoting), envp is not transferred, and
non-empty file actions fail loudly with ENOTSUP until the kernel can
redirect stdio on spawn. waitpid() now decodes real POSIX status and
the sys/wait.h macros distinguish exited from signaled children.
Shell: prints [exit code N] after nonzero exits and [terminated by
signal N] for killed or crashed children.
Verified on the OS: cat on a missing file reports exit code 1; a
window-close (clean exit 0) stays silent as it should.
Co-Authored-By: Claude Fable 5 <[email protected]>
0:/usr was a Unix transplant in an otherwise Montauk-native layout.
The SDK now lives at 0:/sdk/{bin,include,lib} (+ ldscripts under
0:/sdk/x86_64-montauk): Montauk-flavored, and a clean unit for a
future per-component installer tickbox. Native binutils is rebuilt
with --prefix=/sdk so ld's compiled-in search paths follow; future
ports configure with --prefix=/sdk.
Also add pathconf() with _PC_* names to the libc: now that realpath
exists, libiberty's lrealpath.c compiles its pathconf fallback path
unconditionally.
Shell command resolution and tab completion updated to 0:/sdk/bin.
Boot-verified in QEMU: setup, login, desktop on the new image with
zero usr/ remnants in the ramdisk.
Co-Authored-By: Claude Fable 5 <[email protected]>
The 0:/usr devkit pushed the base image to ~650 files, past the
ramdisk's MaxFiles = 512. The USTAR loader silently dropped the tail
of the archive and, worse, every runtime Create/Mkdir failed once the
table was full - so first-boot account creation could not write the
user database and every login failed with "invalid username or
password".
Raise MaxFiles to 2048 (256 KiB static table) and log loudly both
when archive entries are dropped at load and when Create/Mkdir hit
the cap, so a full table can never masquerade as an auth failure
again.
Verified in QEMU end to end: setup -> create account -> log in ->
desktop.
Co-Authored-By: Claude Fable 5 <[email protected]>
The devkit target in programs/GNUmakefile stages the native binutils
(as, ld, ar, nm, objcopy, objdump, readelf, ranlib, strip, size,
strings, addr2line, c++filt, elfedit as *.elf) into the image at
0:/usr/bin, plus a target-side sysroot: libc headers, montauk/ and
Api/ SDK headers and the freestanding C++ set at 0:/usr/include, and
libc.a + crt1/crti/crtn objects (with empty libm/libstdc++ stand-ins)
at 0:/usr/lib. ld's ldscripts ship under 0:/usr/x86_64-montauk.
The /usr prefix matches the binutils configure prefix, and the kernel
already resolves driveless absolute paths against the cwd drive, so
compiled-in /usr/lib search paths work natively on drive 0.
The shell resolves commands from 0:/usr/bin (after 0:/os) and tab
completion lists it. When toolchain/native/ has not been built, the
devkit step skips cleanly and the image builds as before.
Co-Authored-By: Claude Fable 5 <[email protected]>
Grow the Montauk libc enough to cross-build binutils 2.43.1 with
--host=x86_64-montauk. gas, ld, ar, nm, objcopy, objdump, readelf,
ranlib, strip and friends now link as native ET_EXEC Montauk binaries
(staged stripped in toolchain/native/, not yet shipped in the image).
New libc surface: full Linux errno and signal sets, O_* flags with
real O_EXCL/O_APPEND semantics, unlink/rmdir/dup/dup2/getpid/_exit,
kill (SYS_KILL), fcntl, fileno/fdopen, putc/getchar/rewind,
ctime/asctime, strtoll/strtoull/atoll, bsearch, mkstemp/mktemp,
realpath (lexical, drive-prefix aware), mbstowcs/mblen, chmod/fchmod/
umask/utime no-ops (VFS has no modes or settable times), full struct
stat with fake inodes, sscanf field widths (bounded conversions),
SCN*/PRI* completions, wait/waitpid over SYS_WAITPID, and new headers
sys/wait.h, sys/param.h, utime.h, wchar.h, memory.h.
fork/exec/pipe are declared but fail with ENOSYS: binutils never
spawns, and real process plumbing is the posix_spawn milestone, which
needs kernel support (exit status reporting, fd redirection).
TCC's montauk_compat.h shims (unlink, chmod, execvp, realpath, fdopen,
strtoll, strtoull) are retired in favor of the libc versions.
Co-Authored-By: Claude Fable 5 <[email protected]>
Switch all program and library Makefiles from host g++ (or the
bare-metal x86_64-elf compiler) to x86_64-montauk-g++/gcc and drop the
flags the target now owns: -nostdinc + kernel freestanding -isystem
paths, -m64/-march, -fno-PIC, -mno-red-zone, -mcmodel=small, -static,
-Wl,-m,elf_x86_64, -z max-page-size, --build-id=none. Deliberate
policy flags stay (-ffreestanding, per-app SSE, -nostdlib + link.ld).
Program builds now require the montauk toolchain and fail with a
pointer to build-montauk-toolchain.sh; lib/ and libs/ keep the host
fallback since the toolchain script bootstraps libc through it.
Userspace is also now pinned to the cross GCC instead of drifting
with the distro compiler.
Co-Authored-By: Claude Fable 5 <[email protected]>
Add tear-free scanout to the Intel GPU driver: a second kernel-allocated
scanout buffer, DSPASURF flips latched at vblank, and a vblank interrupt
delivered over MSI (Gen 11+ master/display/pipe IRQ chain) with a
monotonic vblank counter and WaitVblank().
Expose it as SYS_FBFLIP (150): index selects the front buffer, -1
queries support, flags bit0 waits for the flip to latch. fb_map() now
maps buffer 1 right after buffer 0 when flipping is available, and
gui::Framebuffer draws to the off-screen buffer and flips with vsync,
falling back to the direct copy when unsupported.
Scanout is restored to buffer 0 when the flip-owning process exits and
on panic, so the terminal and panic box never land on the invisible
buffer.
Co-Authored-By: Claude Fable 5 <[email protected]>
The A2DP output is a single unmixed PCM stream. A second process
opening audio while a stream was active would reconfigure the SBC
encoder and media clock under the owner and interleave both apps' PCM
into one ring, garbling playback (e.g. launching DOOM destabilized
Music). Add ClaimOutput/ReleaseOutput pid ownership: the first opener
gets the BT sink, later openers fall back to the HDA mixer, and only
the owner can tear the stream down. The scheduler releases ownership
on process exit so a killed app cannot leak the claim.
Co-Authored-By: Claude Fable 5 <[email protected]>
Deleting a big file froze the desktop for seconds: ext2 FreeBlock did 4
synchronous disk I/Os per data block (bitmap + BGDT read/write), and the
file manager deleted single files inline on the desktop main thread.
- Ext2: batch block frees per block group; keep the bitmap resident,
clear bits in memory, flush bitmap + BGDT once per group transition.
Also covers the truncate-on-overwrite path.
- Ext2: refuse to mount volumes with block size > 4096; temp buffers
throughout the driver are single 4 KiB pages, so larger blocks would
overflow them (our mkfs always uses 4K).
- Files: route single-file deletes past 4 MiB to the background worker
+ progress dialog; refuse (instead of stalling inline) when another
file operation already owns the worker.
Co-Authored-By: Claude Fable 5 <[email protected]>
Cut the 0.1.7 release (docs/tutorials, HTML man pages, updated man pages,
libc floating-point formatting, DOOM missing-WAD warning, ramdisk copy fix).
Archive the 0.1.7 ISO, publish it to the website, refresh release notes and
the downloads page, and open the 0.1.8 dev cycle (apiVersion 9, BuildNo reset).
Co-Authored-By: Claude Opus 4.8 <[email protected]>
Four fixes, each a root cause verified on hardware (AX211 + Bose QC Ultra):
1. Link Key Request Reply TRUNCATED: the pending-command queue's params
buffer was 16 bytes; the reply is 22 (addr 6 + key 16). The controller
got 10 key bytes -> every stored-key reconnection failed authentication
(status 5) since 2026-06-03 (0f16785). Fresh pairings never touch this
path, which kept the bug perfectly disguised as a headset quirk.
2. Secure Connections host support (0x0C7A) now enabled: bonds are minted
as P-256 (Type=7), interoperable with BlueZ's, and SC-bonded peers can
actually authenticate us.
3. Never write the BD_ADDR override (0xFC31) with the factory address:
it desyncs the firmware's crypto address from the on-air one and ALL
SSP pairing fails with status 5. (The spoofing feature itself was
already known-cosmetic: the baseband answers pages on the factory
address regardless.) import-bluez-bond.sh now removes the override.
4. A2DP channel setup: wait for Encryption Change before dialing L2CAP
(post-SSP sinks ignore unencrypted CONN_REQ), and LISTEN 2.5s first --
on reconnection the sink dials AVDTP itself and ignores our dials while
doing so. Ends the historical connRsp=FFFF retry-then-give-up failures.
Plus: queued security replies now log delivery + controller status.
Co-Authored-By: Claude Fable 5 <[email protected]>
- On Authentication Failure (Auth Complete status!=0 -- previously swallowed
silently -- or disconnect reason 0x05), drop the stale local link key so
the next connect falls back to fresh SSP pairing instead of failing
identically forever (BlueZ behavior). Log the link-key exchange.
- scripts/import-bluez-bond.sh: copy a BlueZ link key into the MontaukOS
key store on the installed root. Root cause: the AX211 BD_ADDR override
(0xFC31) is cosmetic -- the baseband answers pages on the FACTORY address,
so peers see Linux and MontaukOS as ONE device with ONE key slot, and each
OS's pairing clobbers the other's key. Sharing identity + key ends the
fight: both OSes reconnect (incl. autoconnect) without re-pairing.
Co-Authored-By: Claude Fable 5 <[email protected]>
The BT firmware download now runs from the idle loop after boot (zero boot
stall), completing the async goal. What made every earlier deferral attempt
fail was a months-latent HCI-layer bug, not the deferred environment:
WaitCommandComplete returned after the FIRST USB packet of an event, but
events larger than the 64-byte interrupt max-packet (like the AX211's
96-byte FC05 TLV version response) span several packets. Sending the next
command while the tail of the previous response was still in flight wedges
the AX211 bootloader into permanently ignoring commands. Boot-time flanterm
rendering added milliseconds between commands and accidentally paced the
protocol past the race -- which is why the synchronous bring-up always
worked and every log-suppressed (deferred) bring-up went mute at FC05 #2,
regardless of scheduling/MSI/xHCI fixes.
Fix: reassemble multi-packet Command Complete/Status events in the
transfer callback; the mailbox is marked ready only when the declared
event length has fully arrived. This inherently paces command flow and,
as a bonus, the TLV version read now sees the full response (sbe_type
present -> ECDSA/RSA selection is no longer a guess).
Also: per-slot EP0 completion tracking in the xHCI (a waiting ControlTransfer
can no longer be released early by another device's EP0 completion).
Verified on the AX211: instant boot, background download, real BD_ADDR.
Co-Authored-By: Claude Fable 5 <[email protected]>
Two fixes, verified on the AX211 (8087:0033), ibt-1040-0041.sfi, 720 KB:
1. TryHeader waited 1500+2000 ms for secure-send results after the CSS and
key/signature sends, but on success this controller stays SILENT until
the end of the whole download (traced) -- both timeouts always burned in
full. A rejection arrives within milliseconds, so 250 ms windows lose
nothing and save ~3 s per cold boot.
2. The payload now goes over the bulk OUT endpoint with up to 7 fragments
in flight (the btusb bootloader path for 0xFC09), replacing ~2900
synchronous 3-stage EP0 control transfers. Headers stay on EP0; the
ACL TX DMA ring is reused (no ACL header, no NOCP credit accounting).
DrainBulkTx() ensures all bytes reach the controller before waiting for
the download-complete result.
Also in this branch since main: IRQ-safe BT-TRACE ring (KernelLogStream in
TransferCallback deadlocked on the terminal Mutex from MSI context), xHCI
interrupt-IN ZLP length fix, always-re-arm of the BT event pipe,
InPollContext same-core owner check, TLV version read retry.
Co-Authored-By: Claude Fable 5 <[email protected]>
Deferring the Intel BT firmware download off the boot path made the AX211
bootloader stop answering after the first FC05; even the final synchronous
revert freezes boot, so one of the 'neutral' fixes kept in this diff breaks
the bring-up on its own (candidates: BT-TRACE logging inside TransferCallback,
unconditional interrupt-IN re-queue after error completions on a halted EP,
xHCI interrupt-IN ZLP len fix interacting with HID, InPollContext owner
check). Full history + next experiments in memory notes, 2026-07-05/06.
Co-Authored-By: Claude Fable 5 <[email protected]>
danielandClaude Fable 5