From db368991526898148d0c85c65a8e56502e85949e Mon Sep 17 00:00:00 2001
From: xamidev <xamidev@riseup.net>
Date: Sat, 21 Mar 2026 10:36:54 +0100
Subject: [PATCH 01/17] Add kprintf for DEBUG(); differentiated from printf()

---
 include/arch/x86.h     |  2 ++
 include/io/term/term.h |  1 +
 include/kernel.h       |  5 +++-
 src/arch/x86/idt.c     |  3 ++
 src/arch/x86/syscall.c | 26 +++++++++++++++++
 src/io/term/term.c     | 64 ++++++++++++++++++++++++++++++++++++++++++
 src/kapps/kshell.c     | 20 +++++++++++++
 src/kmain.c            |  8 +-----
 8 files changed, 121 insertions(+), 8 deletions(-)
 create mode 100644 src/arch/x86/syscall.c
 create mode 100644 src/kapps/kshell.c

diff --git a/include/arch/x86.h b/include/arch/x86.h
index 1c677d8..2c04dcf 100644
--- a/include/arch/x86.h
+++ b/include/arch/x86.h
@@ -59,4 +59,6 @@ struct cpu_status_t {
     uint64_t iret_ss;
 };
 
+struct cpu_status_t* syscall_handler(struct cpu_status_t* regs);
+
 #endif
\ No newline at end of file
diff --git a/include/io/term/term.h b/include/io/term/term.h
index 4ce1a32..c4b8cfb 100644
--- a/include/io/term/term.h
+++ b/include/io/term/term.h
@@ -11,5 +11,6 @@ void kputs(const char* str);
 void term_init(void);
 int printf(const char* fmt, ...);
 void internal_putc(int c, void *_);
+int kprintf(const char* fmt, ...);
 
 #endif
diff --git a/include/kernel.h b/include/kernel.h
index 98b43ac..116ba09 100644
--- a/include/kernel.h
+++ b/include/kernel.h
@@ -21,7 +21,7 @@ enum ErrorCodes {
 #include <stdbool.h>
 
 extern volatile uint64_t ticks;
-#define DEBUG(log, ...) printf("[%8u] debug: <%s>: " log "\r\n", ticks, __func__, ##__VA_ARGS__)
+#define DEBUG(log, ...) kprintf("[%8u] debug: <%s>: " log "\r\n", ticks, __func__, ##__VA_ARGS__)
 
 /* #define DEBUG(log, ...) \
 	printf("debug: [%s]: " log "\r\n", __FILE__, ##__VA_ARGS__); \
@@ -38,6 +38,8 @@ void panic(struct cpu_status_t* ctx, const char* str);
 void hcf(void);
 void idle(void);
 
+void pedicel_main(void* arg);
+
 /* debug */
 void debug_stack_trace(unsigned int max_frames);
 const char* debug_find_symbol(uintptr_t rip, uintptr_t* offset);
@@ -58,6 +60,7 @@ struct init_status {
 	bool serial;
 	bool keyboard;
 	bool timer;
+	bool all;
 };
 
 #endif
diff --git a/src/arch/x86/idt.c b/src/arch/x86/idt.c
index 822033c..b698162 100644
--- a/src/arch/x86/idt.c
+++ b/src/arch/x86/idt.c
@@ -72,6 +72,9 @@ void idt_init()
         // Each vector handler is 16-byte aligned, so <vector_no>*16 = address of that handler
         idt_set_entry(i, vector_0_handler + (i*16), 0);
     }
+
+    idt_set_entry(0x80, syscall_handler, 0);
+
     idt_load(&idt);
     DEBUG("IDT initialized");
 }
diff --git a/src/arch/x86/syscall.c b/src/arch/x86/syscall.c
new file mode 100644
index 0000000..380c5fc
--- /dev/null
+++ b/src/arch/x86/syscall.c
@@ -0,0 +1,26 @@
+/*
+ * @author  xamidev <xamidev@riseup.net>
+ * @brief   System call handling
+ * @license GPL-3.0-only
+ */
+
+#include <arch/x86.h>
+#include <kernel.h>
+
+struct cpu_status_t* syscall_handler(struct cpu_status_t* regs)
+{
+    DEBUG("Syscall %lx with argument %lx", regs->rdi, regs->rsi);
+
+    switch (regs->rdi)
+    {
+        case 0:
+            break;
+        case 1:
+            break;
+        default:
+            regs->rsi = 0xdeadbeef;
+            break;
+    }
+
+    return regs;
+}
\ No newline at end of file
diff --git a/src/io/term/term.c b/src/io/term/term.c
index 65b11a1..e4f7546 100644
--- a/src/io/term/term.c
+++ b/src/io/term/term.c
@@ -65,6 +65,38 @@ void internal_putc(int c, void *_)
     }
 }
 
+/*
+ * debug_putc - Internal DEBUG putchar function
+ * @c: char to print
+ * @_: (unused, for nanoprintf)
+ *
+ * Prints a character to the terminal if it's ready and if 
+ * the kernel is still initializing, and also always to the
+ * serial interface if it's ready.
+ */
+void debug_putc(int c, void *_)
+{
+    (void)_;
+    char ch = (char)c;
+
+    if (init.terminal && (!init.all || panic_count > 0)) {
+        if (panic_count == 0) {
+            spinlock_acquire(&term_lock);
+            flanterm_write(ft_ctx, &ch, 1);
+            spinlock_release(&term_lock);
+        } else {
+            flanterm_write(ft_ctx, &ch, 1);
+        }
+    }
+
+    if (init.serial) {
+        if (ch == '\n') {
+            skputc('\r');
+        }
+        skputc(ch);
+    }
+}
+
 /*
  * printf - Fromatted printing
  * @fmt: format string
@@ -96,6 +128,38 @@ int printf(const char* fmt, ...)
     return -1;
 }
 
+/*
+ * kprintf - Fromatted DEBUG printing 
+ * @fmt: format string
+ * @...: variadic arguments
+ *
+ * Wrapper for nanoprintf; to be used only for
+ * kernel/debug messages.
+ *
+ * Return:
+ * <ret> - number of characters sent to the callback
+ * %-1   - error
+ */
+int kprintf(const char* fmt, ...)
+{
+    if (panic_count == 0) {
+        spinlock_acquire(&printf_lock);
+        va_list args;
+        va_start(args, fmt);
+        int ret = npf_vpprintf(debug_putc, NULL, fmt, args);
+        va_end(args);
+        spinlock_release(&printf_lock);
+        return ret;
+    } else {
+        va_list args;
+        va_start(args, fmt);
+        int ret = npf_vpprintf(debug_putc, NULL, fmt, args);
+        va_end(args);
+        return ret;
+    }
+    return -1;
+}
+
 /*
  * kputs - Kernel puts
  * @str: String to write
diff --git a/src/kapps/kshell.c b/src/kapps/kshell.c
new file mode 100644
index 0000000..b416d69
--- /dev/null
+++ b/src/kapps/kshell.c
@@ -0,0 +1,20 @@
+/*
+ * @author  xamidev <xamidev@riseup.net>
+ * @brief   PepperOS kernel shell
+ * @license GPL-3.0-only
+ */
+
+#include <io/term/term.h>
+
+/*
+ * pedicel_main - Kernel shell main function
+ * @arg: argument (optional)
+ *
+ * This is the entry point for the kernel shell process.
+ * It is used to start programs and to test different things
+ * on different real hardware easily.
+ */
+void pedicel_main(void* arg)
+{
+    printf("Entering the kernel shell...\r\n");
+}
\ No newline at end of file
diff --git a/src/kmain.c b/src/kmain.c
index 1a83b8f..d85ef7a 100644
--- a/src/kmain.c
+++ b/src/kmain.c
@@ -66,12 +66,6 @@ extern struct process_t* processes_list;
 extern struct process_t* current_process;
 struct process_t* idle_proc;
 
-// Never gets executed although pedicel is scheduled?
-void pedicel_main(void* arg)
-{
-	printf("\n\n\rWelcome to PepperOS! Pedicel speaking.\r\nNothing left to do, let's go idle!\r\n");
-}
-
 void idle_main(void* arg)
 {
 	for (;;) {
@@ -125,10 +119,10 @@ void kmain()
 	process_init();
 	idle_proc = process_create("idle", (void*)idle_main, 0);
 	process_create("pedicel", (void*)pedicel_main, 0);
-	process_create("thing", thing_main, NULL);
 
 	scheduler_init();
 
 	printf(PEPPEROS_SPLASH);
+	init.all = true;
 	idle();
 }

From 3ae56bbad549b70329a0428cf035f270c403d33c Mon Sep 17 00:00:00 2001
From: xamidev <xamidev@riseup.net>
Date: Sat, 21 Mar 2026 11:34:46 +0100
Subject: [PATCH 02/17] Kernel debug shell

---
 include/config.h        |  4 ++++
 include/string/string.h |  1 +
 src/arch/x86/idt.c      | 23 ++++++++++++++++-------
 src/kapps/kshell.c      | 38 +++++++++++++++++++++++++++++++++++++-
 src/string/string.c     | 29 +++++++++++++++++++++++++++++
 5 files changed, 87 insertions(+), 8 deletions(-)

diff --git a/include/config.h b/include/config.h
index 3a1e9e3..30a79f3 100644
--- a/include/config.h
+++ b/include/config.h
@@ -20,6 +20,10 @@
 "\x1b[38;5;196m/_/        /_/   /_/                             \r\n\x1b[0m"\
 "     --- version \x1b[38;5;220m"PEPPEROS_VERSION_MAJOR"."PEPPEROS_VERSION_MINOR"."PEPPEROS_VERSION_PATCH"\x1b[0m built on \x1b[38;5;40m"__DATE__" "__TIME__"\x1b[0m\r\n"
 
+/* pedicel */
+#define PEDICEL_PROMPT "pedicel$ "
+#define PEDICEL_INPUT_SIZE 128
+
 /* process */
 #define PROCESS_NAME_MAX 64
 #define PROCESS_STACK_SIZE 0x10000 // 64kb
diff --git a/include/string/string.h b/include/string/string.h
index dca35bc..78859ec 100644
--- a/include/string/string.h
+++ b/include/string/string.h
@@ -12,5 +12,6 @@
 char *strcpy(char *dest, const char *src);
 char *strcat(char *dest, const char *src);
 void strncpy(char* dst, const char* src, size_t n);
+int strncmp(const char* s1, const char* s2, size_t n);
 
 #endif
\ No newline at end of file
diff --git a/src/arch/x86/idt.c b/src/arch/x86/idt.c
index b698162..eb99a4a 100644
--- a/src/arch/x86/idt.c
+++ b/src/arch/x86/idt.c
@@ -24,6 +24,8 @@ extern char vector_0_handler[];
 // Timer ticks
 extern volatile uint64_t ticks;
 
+extern struct init_status init;
+
 /*
  * idt_set_entry - Sets an Interrupt Descriptor Table entry
  * @vector:  Vector number in the IDT
@@ -122,6 +124,19 @@ static void page_fault_handler(struct cpu_status_t* ctx)
     CHECK_BIT(ctx->error_code, 7) ? " SGX_VIOLATION" : "",
     cr2);
 
+    if (init.all) {
+        printf("\x1b[38;5;231mPage Fault at rip=0x%p, err=%u (%s%s%s%s%s%s%s%s) when accessing addr=0x%p\x1b[0m", ctx->iret_rip, ctx->error_code,
+        CHECK_BIT(ctx->error_code, 0) ? "PAGE_PROTECTION_VIOLATION " : "PAGE_NOT_PRESENT ",
+        CHECK_BIT(ctx->error_code, 1) ? "ON_WRITE " : "ON_READ ",
+        CHECK_BIT(ctx->error_code, 2) ? "IN_USER_MODE" : "IN_KERNEL_MODE",
+        CHECK_BIT(ctx->error_code, 3) ? " WAS_RESERVED" : "",
+        CHECK_BIT(ctx->error_code, 4) ? " ON_INSTRUCTION_FETCH" : "",
+        CHECK_BIT(ctx->error_code, 5) ? " PK_VIOLATION" : "",
+        CHECK_BIT(ctx->error_code, 6) ? " ON_SHADOWSTACK_ACCESS" : "",
+        CHECK_BIT(ctx->error_code, 7) ? " SGX_VIOLATION" : "",
+        cr2);
+    }
+
     panic(ctx, "page fault");
 }
 
@@ -157,12 +172,6 @@ static void gp_fault_handler(struct cpu_status_t* ctx)
     panic(ctx, "gp fault");
 }
 
-// DEBUG
-void kbdproc_main(void* arg)
-{
-    printf("Key pressed/released.\r\n");
-}
-
 /*
  * interrupt_dispatch - Interrupt dispatcher
  * @context: CPU context
@@ -261,7 +270,7 @@ struct cpu_status_t* interrupt_dispatch(struct cpu_status_t* context)
 
         case 33: // Keyboard Interrupt
             keyboard_handler();
-            process_create("keyboard-initiated", kbdproc_main, NULL); // DEBUG
+            //process_create("keyboard-initiated", kbdproc_main, NULL); // DEBUG
             outb(0x20, 0x20);
             break;
 
diff --git a/src/kapps/kshell.c b/src/kapps/kshell.c
index b416d69..7090e6e 100644
--- a/src/kapps/kshell.c
+++ b/src/kapps/kshell.c
@@ -5,6 +5,11 @@
  */
 
 #include <io/term/term.h>
+#include <config.h>
+#include <io/kbd/ps2.h>
+#include <string/string.h>
+#include <stdint.h>
+#include <kernel.h>
 
 /*
  * pedicel_main - Kernel shell main function
@@ -13,8 +18,39 @@
  * This is the entry point for the kernel shell process.
  * It is used to start programs and to test different things
  * on different real hardware easily.
+ *
+ * Named after the root part of the pepper.
  */
 void pedicel_main(void* arg)
 {
-    printf("Entering the kernel shell...\r\n");
+    printf("Welcome to the kernel shell!\r\nType 'help' for a list of commands.\r\n");
+
+    for (;;) {
+        char input_buf[PEDICEL_INPUT_SIZE] = {0};
+        printf(PEDICEL_PROMPT);
+        keyboard_getline(input_buf, PEDICEL_INPUT_SIZE);
+        
+        if (strncmp(input_buf, "help", 4) == 0) {
+            printf("\r\npanic   - trigger a test panic\r\n"
+                            "syscall - trigger int 0x80\r\n"
+                            "pf      - trigger a page fault\r\n");
+            continue;
+        }
+
+        if (strncmp(input_buf, "panic", 5) == 0) {
+            panic(NULL, "test panic");
+        }
+
+        if (strncmp(input_buf, "syscall", 7) == 0) {
+            __asm__ volatile("int $0x80");
+            continue;
+        }
+
+        if (strncmp(input_buf, "pf", 2) == 0) {
+            volatile uint64_t* fault = (uint64_t*)0xdeadbeef;
+            fault[0] = 1;
+        }
+
+        printf("%s: command not found\r\n", input_buf);
+    }
 }
\ No newline at end of file
diff --git a/src/string/string.c b/src/string/string.c
index 3c7c7af..6b51c58 100644
--- a/src/string/string.c
+++ b/src/string/string.c
@@ -69,4 +69,33 @@ void strncpy(char* dst, const char* src, size_t n)
 {
    size_t i = 0;
    while(i++ != n && (*dst++ = *src++));
+}
+
+
+/*
+ * strncmp - compare two strings up to n characters
+ * @s1: first string
+ * @s2: second string
+ * @n:  number of bytes to compare
+ *
+ * Taken from: https://github.com/DevSolar/pdclib/blob/master/functions/string/strncmp.c
+ *
+ * Return:
+ * $0  - @s1 and @s2 are equal
+ * $<0 - @s1 is less than @s2
+ * $>0 - @s1 is greater than @s2 
+ */
+int strncmp(const char* s1, const char* s2, size_t n)
+{
+    while ( n && *s1 && ( *s1 == *s2 ) ) {
+        ++s1;
+        ++s2;
+        --n;
+    }
+    if ( n == 0 ) {
+        return 0;
+    }
+    else {
+        return ( *(unsigned char *)s1 - *(unsigned char *)s2 );
+    }
 }
\ No newline at end of file

From ac788c55d3e2c7968bf32db41e6b0a6c542728a7 Mon Sep 17 00:00:00 2001
From: xamidev <xamidev@riseup.net>
Date: Sun, 22 Mar 2026 09:03:43 +0100
Subject: [PATCH 03/17] Upgrade VMM for processes

---
 include/config.h     |   3 +-
 include/mem/paging.h |   2 +
 include/mem/vmm.h    |  29 +++--
 src/arch/x86/idt.S   |   9 ++
 src/arch/x86/idt.c   |   8 +-
 src/kapps/kshell.c   |   1 +
 src/kmain.c          |   1 +
 src/mem/paging.c     |   4 +-
 src/mem/vmm.c        | 245 ++++++++++++++++++++++++++++++++++---------
 9 files changed, 233 insertions(+), 69 deletions(-)

diff --git a/include/config.h b/include/config.h
index 30a79f3..d553854 100644
--- a/include/config.h
+++ b/include/config.h
@@ -27,8 +27,7 @@
 /* process */
 #define PROCESS_NAME_MAX 64
 #define PROCESS_STACK_SIZE 0x10000 // 64kb
-#define PROCESS_BASE 0x400000
-#define PROCESS_STACK_BASE 0x1000000
+#define PROCESS_STACK_TOP 0x80000000
 
 /* sched */
 // 1 tick = 1 ms => quantum = 10ms
diff --git a/include/mem/paging.h b/include/mem/paging.h
index 91fc061..f5cf406 100644
--- a/include/mem/paging.h
+++ b/include/mem/paging.h
@@ -16,9 +16,11 @@
 
 void paging_init(struct boot_context boot_ctx);
 void paging_map_page(uint64_t* root_table, uint64_t virt, uint64_t phys, uint64_t flags);
+uint64_t* alloc_page_table();
 
 // To swap root page tables
 void load_cr3(uint64_t value);
+void invlpg(void *addr);
 
 extern uint64_t hhdm_off;
 
diff --git a/include/mem/vmm.h b/include/mem/vmm.h
index 3b60a84..64e1f0c 100644
--- a/include/mem/vmm.h
+++ b/include/mem/vmm.h
@@ -9,26 +9,21 @@
 
 #include <stdint.h>
 #include <stddef.h>
+#include <stdbool.h>
 
-/*
-This will be our linked list of virtual memory objects.
-Flags here aren't x86 flags, they are platform-agnostic
-kernel-defined flags.
-*/
-
-struct vm_object {
-    uintptr_t base;
-    size_t length;
-    size_t flags;
-    struct vm_object* next;
+struct vmm_context {
+    uint64_t* pml4;
 };
 
-// Flags bitfield
-#define VM_FLAG_NONE 0
-#define VM_FLAG_WRITE (1 << 0)
-#define VM_FLAG_EXEC (1 << 1)
-#define VM_FLAG_USER (1 << 2)
-
 void vmm_init(void);
+void* vmm_alloc_region(uint64_t* pml4, size_t pages, uint64_t flags);
+bool vmm_is_mapped(uint64_t* pml4, uint64_t virt);
+void vmm_unmap(uint64_t* pml4, uint64_t virt);
+void* vmm_map(uint64_t* pml4, uint64_t virt, uint64_t flags);
+uint64_t* vmm_create_address_space();
+uint64_t vmm_virt_to_phys(uint64_t* pml4, uint64_t virt);
+
+#define VMM_USER_SPACE_START 0x0000000000001000 
+#define VMM_USER_SPACE_END   0x00007FFFFFFFF000
 
 #endif
\ No newline at end of file
diff --git a/src/arch/x86/idt.S b/src/arch/x86/idt.S
index 52eb314..c4e863c 100644
--- a/src/arch/x86/idt.S
+++ b/src/arch/x86/idt.S
@@ -32,6 +32,8 @@ global vector_19_handler
 global vector_20_handler
 global vector_21_handler
 
+global vector_128_handler
+
 interrupt_stub:
     ; We'll push all general-purpose registers to the stack,
     ; so they're intact and don't bother the code that was
@@ -312,4 +314,11 @@ align 16
 vector_33_handler:
     push qword 0
     push qword 33
+    jmp interrupt_stub
+
+; Syscall Interrupt (0x80)
+align 16
+vector_128_handler:
+    push qword 0
+    push qword 128
     jmp interrupt_stub
\ No newline at end of file
diff --git a/src/arch/x86/idt.c b/src/arch/x86/idt.c
index eb99a4a..c4b17c2 100644
--- a/src/arch/x86/idt.c
+++ b/src/arch/x86/idt.c
@@ -21,6 +21,8 @@ struct idtr idt_reg;
 // Address to our first interrupt handler
 extern char vector_0_handler[];
 
+extern char vector_128_handler[];
+
 // Timer ticks
 extern volatile uint64_t ticks;
 
@@ -75,7 +77,7 @@ void idt_init()
         idt_set_entry(i, vector_0_handler + (i*16), 0);
     }
 
-    idt_set_entry(0x80, syscall_handler, 0);
+    idt_set_entry(0x80, vector_128_handler, 0);
 
     idt_load(&idt);
     DEBUG("IDT initialized");
@@ -273,6 +275,10 @@ struct cpu_status_t* interrupt_dispatch(struct cpu_status_t* context)
             //process_create("keyboard-initiated", kbdproc_main, NULL); // DEBUG
             outb(0x20, 0x20);
             break;
+        
+        case 128: // Syscall Interrupt (0x80)
+            syscall_handler(context);
+            break;
 
         default:
             DEBUG("Unexpected Interrupt");
diff --git a/src/kapps/kshell.c b/src/kapps/kshell.c
index 7090e6e..b1c77f1 100644
--- a/src/kapps/kshell.c
+++ b/src/kapps/kshell.c
@@ -42,6 +42,7 @@ void pedicel_main(void* arg)
         }
 
         if (strncmp(input_buf, "syscall", 7) == 0) {
+            __asm__ volatile("mov $0x00, %rdi");
             __asm__ volatile("int $0x80");
             continue;
         }
diff --git a/src/kmain.c b/src/kmain.c
index d85ef7a..4f57851 100644
--- a/src/kmain.c
+++ b/src/kmain.c
@@ -124,5 +124,6 @@ void kmain()
 
 	printf(PEPPEROS_SPLASH);
 	init.all = true;
+
 	idle();
 }
diff --git a/src/mem/paging.c b/src/mem/paging.c
index 44290ea..4b76536 100644
--- a/src/mem/paging.c
+++ b/src/mem/paging.c
@@ -43,7 +43,7 @@ void load_cr3(uint64_t value) {
  * This function is used to flush at least the TLB entrie(s)
  * for the page that contains the <addr> address.
  */
-static inline void invlpg(void *addr)
+void invlpg(void *addr)
 {
     asm volatile("invlpg (%0)" :: "r"(addr) : "memory");
 }
@@ -59,7 +59,7 @@ static inline void invlpg(void *addr)
  * Return:
  * <virt> - Pointer to allocated page table
  */
-static uint64_t* alloc_page_table()
+uint64_t* alloc_page_table()
 {
     uint64_t* virt = (uint64_t*)PHYS_TO_VIRT(pmm_alloc());
 
diff --git a/src/mem/vmm.c b/src/mem/vmm.c
index 647d49b..46de4fc 100644
--- a/src/mem/vmm.c
+++ b/src/mem/vmm.c
@@ -19,60 +19,211 @@ compared to the PMM which allocs/frees 4kb frames ("physical pages").
 #include <mem/pmm.h>
 #include <kernel.h>
 
-void* vmm_pt_root = 0;
-
-// Linked list head for virtual memory objects
-struct vm_object* vm_objs = NULL;
-
-/*
- * Will have to be rewritten and expanded,
- * to prepare for userspace.
- * The platform-agnostic flags will be removed
- * because as long as the kernel is x86 only,
- * we don't need over complication.
- * Plus I don't plan to port to other architectures
-*/
-
-uint64_t convert_x86_vm_flags(size_t flags)
-{
-    uint64_t value = 0;
-    if (flags & VM_FLAG_WRITE)
-    {
-        value |= PTE_WRITABLE;
-    }
-    if (flags & VM_FLAG_USER)
-    {
-        value |= PTE_USER;
-    }
-    if ((flags & VM_FLAG_EXEC) == 0)
-    {
-        value |= PTE_NOEXEC;
-    }
-    return value;
-}
-
 extern uint64_t *kernel_pml4;
 
-void vmm_setup_pt_root()
+/*
+ * vmm_switch_to - Switch to a different VMM context
+ * @ctx: VMM context to switch to
+ *
+ * This function makes the CPU switch to another
+ * virtual memory context, by using the PML4 address
+ * specified in the VMM context pointed to by @ctx.
+ */
+void vmm_switch_to(struct vmm_context* ctx)
 {
-    // We alloc a physical page (frame) for the pointer, then map it
-    // to virt (pointer)
-    uintptr_t phys = pmm_alloc();
-    vmm_pt_root = (void*)kernel_pml4;
-    paging_map_page(kernel_pml4, (uint64_t)vmm_pt_root, phys, convert_x86_vm_flags(VM_FLAG_WRITE | VM_FLAG_EXEC));
-    DEBUG("VMM setup: vmm_pt_root=0x%p (phys=0x%p)", vmm_pt_root, phys);
+    if (!ctx || !ctx->pml4) {
+        panic(NULL, "Attempted to switch to bad PML4!");
+    }
+    uint64_t pml4 = VIRT_TO_PHYS(ctx->pml4);
+    asm volatile ("mov %0, %%cr3" :: "r"(pml4) : "memory");
 }
 
-/* void* vmm_alloc(size_t length, size_t flags)
+/*
+ * vmm_virt_to_phys - Translate from virtual to physical address
+ * @pml4: virtual address of the Page Map Level 4 (root page table)
+ * @virt: virtual address to translate
+ *
+ * This function goes through page table structures, beginning at
+ * the root page table which lives at @pml4, and translates @virt
+ * to a physical address, if it's found in the tables.
+ *
+ * Return:
+ * <phys> - physical address
+ * %-1     - address is not present in page tables pointed to by @pml4
+ */
+uint64_t vmm_virt_to_phys(uint64_t* pml4, uint64_t virt)
 {
-    // We will try to allocate at least length bytes, which have to be rounded UP to
-    // the next page so its coherent with the PMM
-    size_t len = ALIGN_UP(length, PAGE_SIZE);
+    uint64_t pml4_i = PML4_INDEX(virt);
+    uint64_t pdpt_i = PDPT_INDEX(virt);
+    uint64_t pd_i = PD_INDEX(virt);
+    uint64_t pt_i = PT_INDEX(virt);
 
-    // Need to implement this (as linked list)
-    // but for now kernel heap is sufficient
-    // The VMM will prob be more useful when we have userspace
-} */
+    if (!(pml4[pml4_i] & PTE_PRESENT)) return -1;
+    uint64_t* pdpt = (uint64_t*)PHYS_TO_VIRT(pml4[pml4_i] & PTE_ADDR_MASK);
+
+    if (!(pdpt[pdpt_i] & PTE_PRESENT)) return -1;
+    uint64_t* pd = (uint64_t*)PHYS_TO_VIRT(pdpt[pdpt_i] & PTE_ADDR_MASK);
+
+    if (!(pd[pd_i] & PTE_PRESENT)) return -1;
+    uint64_t* pt = (uint64_t*)PHYS_TO_VIRT(pd[pd_i] & PTE_ADDR_MASK);
+
+    if (!(pt[pt_i] & PTE_PRESENT)) return -1;
+
+    uint64_t phys = (pt[pt_i] & PTE_ADDR_MASK) + (virt & 0xFFF);
+    return phys;
+}
+
+/*
+ * vmm_create_address_space - Create a new address space
+ *
+ * This function allocates a PML4, and then copies the kernel
+ * page tables into it.
+ *
+ * Return:
+ * <pml4>  - address of the new PML4
+ * NULL    - on error (couldn't allocate a page table)
+ */
+uint64_t* vmm_create_address_space()
+{
+    uint64_t* pml4 = alloc_page_table();
+    if (!pml4) return NULL;
+
+    for (size_t i=256; i<512; i++) {
+        pml4[i] = kernel_pml4[i];
+    }
+
+    return pml4;
+}
+
+/*
+ * vmm_map - Map & allocate a page
+ * @pml4:  Page Map Level 4 (root table)
+ * @virt:  Virtual address to map
+ * @flags: Flags to apply on page
+ *
+ * This function allocates a page frame with the PMM,
+ * and maps this page to the provided @virt address,
+ * with the corresponding @flags.
+ *
+ * Return:
+ * <virt> - virtual address
+ */
+void* vmm_map(uint64_t* pml4, uint64_t virt, uint64_t flags)
+{
+    uint64_t phys = pmm_alloc();
+    if (!phys) {
+        panic(NULL, "VMM/PMM out of memory!");
+    }
+
+    paging_map_page(pml4, virt, phys, flags | PTE_PRESENT);
+    return (void*)virt;
+}
+
+/*
+ * vmm_unmap - Unmap & free a page
+ * @pml4:  Page Map Level 4 (root table)
+ * @virt:  Virtual address to unmap
+ *
+ * This function frees a page frame with the PMM,
+ * and unmaps the virtual page at @virt.
+ */
+void vmm_unmap(uint64_t* pml4, uint64_t virt)
+{
+    uint64_t pml4_i = PML4_INDEX(virt);
+    uint64_t pdpt_i = PDPT_INDEX(virt);
+    uint64_t pd_i   = PD_INDEX(virt);
+    uint64_t pt_i   = PT_INDEX(virt);
+
+    if (!(pml4[pml4_i] & PTE_PRESENT)) return;
+    uint64_t* pdpt = (uint64_t*)PHYS_TO_VIRT(pml4[pml4_i] & PTE_ADDR_MASK);
+
+    if (!(pdpt[pdpt_i] & PTE_PRESENT)) return;
+    uint64_t* pd = (uint64_t*)PHYS_TO_VIRT(pdpt[pdpt_i] & PTE_ADDR_MASK);
+
+    if (!(pd[pd_i] & PTE_PRESENT)) return;
+    uint64_t* pt = (uint64_t*)PHYS_TO_VIRT(pd[pd_i] & PTE_ADDR_MASK);
+
+    if (!(pt[pt_i] & PTE_PRESENT)) return;
+
+    uint64_t phys = pt[pt_i] & PTE_ADDR_MASK;
+    pmm_free(phys);
+
+    pt[pt_i] = 0;
+
+    invlpg((void*)virt);
+}
+
+/*
+ * vmm_is_mapped - Check if an address is mapped
+ * @pml4:  Page Map Level 4 (root table)
+ * @virt:  Virtual address to check
+ *
+ * This function checks if the @virt address is
+ * mapped in the tables pointed to by @pml4.
+ *
+ * Return:
+ * true  - @virt is mapped in tables of @pml4
+ * false - @virt is not mapped there
+ */
+bool vmm_is_mapped(uint64_t* pml4, uint64_t virt)
+{
+    uint64_t pml4_i = PML4_INDEX(virt);
+    uint64_t pdpt_i = PDPT_INDEX(virt);
+    uint64_t pd_i   = PD_INDEX(virt);
+    uint64_t pt_i   = PT_INDEX(virt);
+
+    if (!(pml4[pml4_i] & PTE_PRESENT)) return false;
+    uint64_t* pdpt = (uint64_t*)PHYS_TO_VIRT(pml4[pml4_i] & PTE_ADDR_MASK);
+
+    if (!(pdpt[pdpt_i] & PTE_PRESENT)) return false;
+    uint64_t* pd = (uint64_t*)PHYS_TO_VIRT(pdpt[pdpt_i] & PTE_ADDR_MASK);
+
+    if (!(pd[pd_i] & PTE_PRESENT)) return false;
+    uint64_t* pt = (uint64_t*)PHYS_TO_VIRT(pd[pd_i] & PTE_ADDR_MASK);
+
+    return (pt[pt_i] & PTE_PRESENT);
+}
+
+/*
+ * vmm_alloc_range - Map and allocate a memory range
+ * @pml4:  Page Map Level 4 (root table)
+ * @pages: Amount of pages to allocate/map
+ * @flags: Flags to put on mapped pages
+ *
+ * This function looks for enough space in page tables
+ * to map @pages pages, then maps them into the provided
+ * @pml4 with the provided @flags and allocates them.
+ *
+ * Return:
+ * <start_virt> - the starting virtual address for the mapped range
+ */
+void* vmm_alloc_region(uint64_t* pml4, size_t pages, uint64_t flags)
+{
+    uint64_t found_pages = 0;
+    uint64_t start_virt = VMM_USER_SPACE_START;
+
+    for (uint64_t curr = VMM_USER_SPACE_START; curr < VMM_USER_SPACE_END; curr += PAGE_SIZE) {
+        if (!vmm_is_mapped(pml4, curr)) {
+            if (found_pages == 0) start_virt = curr;
+            found_pages++;
+        } else {
+            found_pages = 0;
+        }
+
+        if (found_pages == pages) {
+            for (size_t i = 0; i < pages; i++) {
+                uint64_t addr_to_map = start_virt + (i * PAGE_SIZE);
+                if (!vmm_map(pml4, addr_to_map, flags)) {
+                    panic(NULL, "VMM out of memory!");
+                }
+            }
+            return (void*)start_virt;
+        }
+    }
+
+    panic(NULL, "VMM out of memory!");
+    return NULL;
+}
 
 void vmm_init()
 {

From 532953da4d3bb2fb2e8bbd3ccbd2dc5eb5956351 Mon Sep 17 00:00:00 2001
From: xamidev <xamidev@riseup.net>
Date: Thu, 26 Mar 2026 16:53:39 +0100
Subject: [PATCH 04/17] CPU Name identification

---
 include/arch/x86.h   |  4 ++++
 src/arch/x86/cpuid.c | 27 +++++++++++++++++++++++++
 src/arch/x86/init.c  | 47 ++++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 78 insertions(+)

diff --git a/include/arch/x86.h b/include/arch/x86.h
index 2c04dcf..0e6ad58 100644
--- a/include/arch/x86.h
+++ b/include/arch/x86.h
@@ -10,6 +10,10 @@ void wrmsr(uint32_t msr, uint64_t value);
 bool x86_has_msr();
 void x86_arch_init();
 
+
+void x86_cpu_identification();
+int cpuid_get_vendor_string(char* str);
+
 /* Interrupt Descriptor Table */
 
 void idt_init(void);
diff --git a/src/arch/x86/cpuid.c b/src/arch/x86/cpuid.c
index b4a9a55..bbe31a4 100644
--- a/src/arch/x86/cpuid.c
+++ b/src/arch/x86/cpuid.c
@@ -6,6 +6,8 @@
 
 #include <stdint.h>
 #include <stddef.h>
+#include <kernel.h>
+#include <string/string.h>
 
 /*
  * cpuid - Wrapper for CPUID instruction
@@ -18,4 +20,29 @@
 void cpuid(uint32_t leaf, uint32_t* eax, uint32_t* ebx, uint32_t* ecx, uint32_t* edx)
 {
     __asm__ volatile("cpuid" : "=a"(*eax), "=b"(*ebx), "=c"(*ecx), "=d"(*edx) : "a"(leaf));
+}
+
+/*
+ * cpuid_get_vendor_string - Get the CPU vendor string
+ * @str: String at least 13 bytes long (for output)
+ *
+ * Return:
+ * %0 - on success
+ */
+int cpuid_get_vendor_string(char* str)
+{
+    uint32_t eax, ebx, ecx, edx;
+    
+    cpuid(0, &eax, &ebx, &ecx, &edx);
+    char output[13] = {0};
+
+    uint32_t regs[3] = {ebx, edx, ecx};
+    for (unsigned int j=0; j<3; j++) {
+        for (unsigned int i=0; i<4; i++) {
+            output[4*j+i] = (char)((regs[j] >> 8*i) & 0xff);
+        }   
+    }
+
+    strncpy(str, output, 13);
+    return 0;
 }
\ No newline at end of file
diff --git a/src/arch/x86/init.c b/src/arch/x86/init.c
index 9d74333..bc4b461 100644
--- a/src/arch/x86/init.c
+++ b/src/arch/x86/init.c
@@ -8,6 +8,7 @@
 #include <stdint.h>
 #include <arch/x86.h>
 #include <kernel.h>
+#include <mem/utils.h>
 
 /*
  * x86_overwrite_pat - Set PAT to WC
@@ -41,6 +42,52 @@ static void x86_overwrite_pat()
 void x86_arch_init()
 {
     x86_overwrite_pat();
+    x86_cpu_identification();
     idt_init();
     gdt_init();
+}
+
+/*
+ * cpu_supports_brandstring - Does the CPU support brand strings?
+ *
+ * Return:
+ * true  - if it does
+ * false - if it doesn't
+*/
+bool cpu_supports_brandstring() {
+    uint32_t eax, ebx, ecx, edx;
+    cpuid(0x80000000, &eax, &ebx, &ecx, &edx);
+
+    if (eax < 0x80000004) {
+        return false;
+    } else {
+        return true;
+    }
+}
+
+/*
+ * x86_cpu_idenfitication - get info about the CPU
+ *
+ * This function displays the CPU vendor name or the
+ * extended "brand string" if it's supported, on
+ * debug output.
+*/
+void x86_cpu_identification()
+{
+    if (cpu_supports_brandstring()) {
+        uint32_t regs[12];
+        // Some CPUs don't return null-terminated values so we do it as a failsafe default
+        char str[sizeof(regs)+1] = {0};
+        cpuid(0x80000002, &regs[0], &regs[1], &regs[2], &regs[3]);
+        cpuid(0x80000003, &regs[4], &regs[5], &regs[6], &regs[7]);
+        cpuid(0x80000004, &regs[8], &regs[9], &regs[10], &regs[11]);
+
+        memcpy(str, regs, sizeof(regs));
+        str[sizeof(regs)] = '\0';
+        DEBUG("CPU: %s", str);
+    } else {
+        char vendor_string[13] = {0};
+        cpuid_get_vendor_string(vendor_string);
+        DEBUG("CPU vendor is: %s", vendor_string);
+    }
 }
\ No newline at end of file

From 0fbaf6d26e3fcb59b536357f3e45b75c1c3d6434 Mon Sep 17 00:00:00 2001
From: xamidev <xamidev@riseup.net>
Date: Thu, 26 Mar 2026 17:59:02 +0100
Subject: [PATCH 05/17] Date functions (get current time)

---
 include/config.h    |  2 +-
 include/kernel.h    |  2 +
 include/mem/utils.h |  1 +
 include/time/date.h | 25 +++++++++++++
 src/boot/boot.c     |  6 +++
 src/kapps/kshell.c  | 16 +++++++-
 src/kmain.c         |  4 ++
 src/time/date.c     | 89 +++++++++++++++++++++++++++++++++++++++++++++
 8 files changed, 142 insertions(+), 3 deletions(-)
 create mode 100644 include/time/date.h
 create mode 100644 src/time/date.c

diff --git a/include/config.h b/include/config.h
index d553854..f557563 100644
--- a/include/config.h
+++ b/include/config.h
@@ -10,7 +10,7 @@
 /* version */
 #define PEPPEROS_VERSION_MAJOR "0"
 #define PEPPEROS_VERSION_MINOR "0"
-#define PEPPEROS_VERSION_PATCH "58"
+#define PEPPEROS_VERSION_PATCH "109"
 #define PEPPEROS_SPLASH \
 "\x1b[38;5;196m                                      \x1b[38;5;231m____  _____\r\n\x1b[0m"\
 "\x1b[38;5;196m    ____  ___  ____  ____  ___  _____\x1b[38;5;231m/ __ \\/ ___/\r\n\x1b[0m"\
diff --git a/include/kernel.h b/include/kernel.h
index 116ba09..04836ca 100644
--- a/include/kernel.h
+++ b/include/kernel.h
@@ -7,6 +7,7 @@
 #ifndef KERNEL_H
 #define KERNEL_H
 
+#include "limine.h"
 enum ErrorCodes {
 	ENOMEM,
 	EIO
@@ -52,6 +53,7 @@ struct boot_context {
 	struct limine_memmap_response* mmap;
 	struct limine_hhdm_response* hhdm;
 	struct limine_kernel_address_response* kaddr;
+	struct limine_boot_time_response* bootdate;
 };
 
 // Are these modules initialized yet?
diff --git a/include/mem/utils.h b/include/mem/utils.h
index 197bf12..e3162e4 100644
--- a/include/mem/utils.h
+++ b/include/mem/utils.h
@@ -8,6 +8,7 @@
 #define MEM_UTILS_H
 
 #include <stddef.h>
+#include <limine.h>
 
 void* memcpy(void* restrict dest, const void* restrict src, size_t n);
 void* memset(void* s, int c, size_t n);
diff --git a/include/time/date.h b/include/time/date.h
new file mode 100644
index 0000000..f3bf2a6
--- /dev/null
+++ b/include/time/date.h
@@ -0,0 +1,25 @@
+/*
+ * @author  xamidev <xamidev@riseup.net>
+ * @brief   Date helper functions
+ * @license GPL-3.0-only
+ */
+
+#ifndef DATE_H
+#define DATE_H
+
+#include <stdint.h>
+
+struct date {
+    uint64_t year;
+    uint8_t month;
+    uint8_t day;
+
+    uint8_t hour;
+    uint8_t minute;
+    uint8_t second;
+};
+
+struct date date_timestamp_to_date(uint64_t timestamp);
+struct date date_now();
+
+#endif
\ No newline at end of file
diff --git a/src/boot/boot.c b/src/boot/boot.c
index 966f202..73d1324 100644
--- a/src/boot/boot.c
+++ b/src/boot/boot.c
@@ -35,6 +35,12 @@ volatile struct limine_kernel_address_request kerneladdr_request = {
 	.revision = 0
 };
 
+__attribute__((used, section(".limine_requests")))
+volatile struct limine_boot_time_request date_request = {
+	.id = LIMINE_BOOT_TIME_REQUEST,
+	.revision = 0
+};
+
 __attribute__((used, section(".limine_requests_start")))
 volatile LIMINE_REQUESTS_START_MARKER;
 
diff --git a/src/kapps/kshell.c b/src/kapps/kshell.c
index b1c77f1..eaef7ed 100644
--- a/src/kapps/kshell.c
+++ b/src/kapps/kshell.c
@@ -10,6 +10,7 @@
 #include <string/string.h>
 #include <stdint.h>
 #include <kernel.h>
+#include <time/date.h>
 
 /*
  * pedicel_main - Kernel shell main function
@@ -31,9 +32,13 @@ void pedicel_main(void* arg)
         keyboard_getline(input_buf, PEDICEL_INPUT_SIZE);
         
         if (strncmp(input_buf, "help", 4) == 0) {
-            printf("\r\npanic   - trigger a test panic\r\n"
+            printf("\r\nYou are currently running the test kernel shell. This is not\r\n"
+                        "a fully-fledged shell like you'd find in a complete operating system,\r\n"
+                        "but rather a toy to play around in the meantime.\r\n\r\n"
+                            "panic   - trigger a test panic\r\n"
                             "syscall - trigger int 0x80\r\n"
-                            "pf      - trigger a page fault\r\n");
+                            "pf      - trigger a page fault\r\n"
+                            "now     - get current date\r\n");
             continue;
         }
 
@@ -52,6 +57,13 @@ void pedicel_main(void* arg)
             fault[0] = 1;
         }
 
+        if (strncmp(input_buf, "now", 3) == 0) {
+            struct date now = date_now();
+            printf("Now is %02u:%02u:%02u on %u/%u/%u\r\n", now.hour, now.minute,
+                now.second, now.day, now.month, now.year);
+            continue;
+        }
+
         printf("%s: command not found\r\n", input_buf);
     }
 }
\ No newline at end of file
diff --git a/src/kmain.c b/src/kmain.c
index 4f57851..2a75272 100644
--- a/src/kmain.c
+++ b/src/kmain.c
@@ -5,6 +5,7 @@
  */
 
 #include "arch/x86.h"
+#include "time/date.h"
 #include <stdbool.h>	
 #include <stddef.h>
 #include <limine.h>
@@ -61,6 +62,7 @@ extern volatile struct limine_framebuffer_request framebuffer_request;
 extern volatile struct limine_memmap_request memmap_request;
 extern volatile struct limine_hhdm_request hhdm_request;
 extern volatile struct limine_kernel_address_request kerneladdr_request;
+extern volatile struct limine_boot_time_request date_request;
 
 extern struct process_t* processes_list;
 extern struct process_t* current_process;
@@ -97,10 +99,12 @@ void kmain()
 	if (!LIMINE_BASE_REVISION_SUPPORTED) hcf();
 
 	// Populate boot context
+	// This stays valid only if the BOOTLOADER_RECLAIMABLE regions are preserved
  	boot_ctx.fb = framebuffer_request.response ? framebuffer_request.response->framebuffers[0] : NULL;
 	boot_ctx.mmap = memmap_request.response ? memmap_request.response : NULL;
 	boot_ctx.hhdm = hhdm_request.response ? hhdm_request.response : NULL;
 	boot_ctx.kaddr = kerneladdr_request.response ? kerneladdr_request.response : NULL;
+	boot_ctx.bootdate = date_request.response ? date_request.response : NULL;
 
 	term_init();
 	serial_init();
diff --git a/src/time/date.c b/src/time/date.c
new file mode 100644
index 0000000..b108c29
--- /dev/null
+++ b/src/time/date.c
@@ -0,0 +1,89 @@
+/*
+ * @author  xamidev <xamidev@riseup.net>
+ * @brief   Date helper functions
+ * @license GPL-3.0-only
+ */
+
+#include <stdint.h>
+#include <time/date.h>
+#include <mem/utils.h>
+#include <kernel.h>
+
+extern struct boot_context boot_ctx;
+
+// Unix epoch used as reference: Jan 1st 1970, 00:00:00 UTC
+struct date epoch = {
+    .year = 1970,
+    .month = 1,
+    .day = 1,
+    .hour = 0,
+    .minute = 0,
+    .second = 0
+};
+
+/*
+ * date_timestamp_to_date - Convert UNIX timestamp to a date structure
+ * @timestamp: UNIX timestamp
+ * 
+ * Return:
+ * <date> - date structure
+ */
+struct date date_timestamp_to_date(uint64_t timestamp)
+{
+    struct date result;
+    memcpy(&result, &epoch, sizeof(struct date));
+    uint64_t nr_days = timestamp / 86400;
+
+    while (nr_days > 0) {
+        unsigned int nr_month = 0;
+        int leap_year = 0;
+
+        if (result.year % 4 == 0 && (result.year % 100 != 0 || result.year % 400 == 0)) {
+            leap_year = 1;
+        } else {
+            leap_year = 0;
+        }
+
+        if (result.month == 2) {
+            if (leap_year != 0) {
+                nr_month = 29;
+            } else {
+                nr_month = 28;
+            }
+        } else {
+            nr_month = 31 - ((result.month -1) % 7 % 2);
+        }
+        
+        if (nr_days >= nr_month) {
+            nr_days -= nr_month;
+            result.month++;
+            if (result.month > 12) {
+                result.month = 1;
+                result.year++;
+            }
+        } else {
+            result.day += nr_days;
+            nr_days = 0;
+        }
+    }
+
+    result.second = timestamp % 60;
+    timestamp /= 60;
+    result.minute = timestamp % 60;
+    timestamp /= 60;
+    result.hour = timestamp % 24;
+
+    return result;
+}
+
+/*
+ * date_now - Get the current date (time at boot + timer ticks)
+ *
+ * Return:
+ * <date> - date structure
+ */
+struct date date_now()
+{
+    uint64_t timestamp_now = boot_ctx.bootdate->boot_time + (ticks/1000);
+    return date_timestamp_to_date(timestamp_now);
+}
\ No newline at end of file

From 89259ec9b23d830d1eabb59bf2629a7032f16e55 Mon Sep 17 00:00:00 2001
From: xamidev <xamidev@riseup.net>
Date: Thu, 26 Mar 2026 20:14:56 +0100
Subject: [PATCH 06/17] Stack Smashing Protection

---
 Makefile           |  2 +-
 include/config.h   |  3 +++
 src/kapps/kshell.c | 17 ++++++++++++++++-
 src/kmain.c        |  9 +++++++++
 4 files changed, 29 insertions(+), 2 deletions(-)

diff --git a/Makefile b/Makefile
index b2499c8..7e20f9c 100644
--- a/Makefile
+++ b/Makefile
@@ -6,7 +6,7 @@ SOURCES := $(shell find src -name '*.c')
 OBJFILES := $(patsubst $(SRC)/%.c, $(BUILDDIR)/%.o, $(SOURCES))
 
 CC := x86_64-elf-gcc
-CC_FLAGS=-Wall -Wextra -std=gnu99 -nostdlib -ffreestanding -fno-stack-protector -fno-omit-frame-pointer -fno-stack-check -fno-PIC -ffunction-sections -fdata-sections -mcmodel=kernel
+CC_FLAGS=-Wall -Wextra -std=gnu99 -nostdlib -ffreestanding -fstack-protector -fno-omit-frame-pointer -fno-stack-check -fno-PIC -ffunction-sections -fdata-sections -mcmodel=kernel
 CC_PROBLEMATIC_FLAGS=-Wno-unused-parameter -Wno-unused-variable
 
 LD := x86_64-elf-ld
diff --git a/include/config.h b/include/config.h
index f557563..2ec0d50 100644
--- a/include/config.h
+++ b/include/config.h
@@ -55,4 +55,7 @@
 /* time */
 #define TIMER_FREQUENCY 1000
 
+/* ssp */
+#define STACK_CHK_GUARD 0x7ABA5C007ABA5C00
+
 #endif
diff --git a/src/kapps/kshell.c b/src/kapps/kshell.c
index eaef7ed..ae30832 100644
--- a/src/kapps/kshell.c
+++ b/src/kapps/kshell.c
@@ -12,6 +12,15 @@
 #include <kernel.h>
 #include <time/date.h>
 
+__attribute__((noinline))
+void smash_it()
+{
+    char buf[16]; (void)buf;
+    for (size_t i=0; i<256; i++) {
+        buf[i] = (char)i;
+    }
+}
+
 /*
  * pedicel_main - Kernel shell main function
  * @arg: argument (optional)
@@ -38,7 +47,8 @@ void pedicel_main(void* arg)
                             "panic   - trigger a test panic\r\n"
                             "syscall - trigger int 0x80\r\n"
                             "pf      - trigger a page fault\r\n"
-                            "now     - get current date\r\n");
+                            "now     - get current date\r\n"
+                            "smash   - smash the stack\r\n");
             continue;
         }
 
@@ -64,6 +74,11 @@ void pedicel_main(void* arg)
             continue;
         }
 
+        if (strncmp(input_buf, "smash", 5) == 0) {
+            smash_it();
+            continue;
+        }
+
         printf("%s: command not found\r\n", input_buf);
     }
 }
\ No newline at end of file
diff --git a/src/kmain.c b/src/kmain.c
index 2a75272..0323562 100644
--- a/src/kmain.c
+++ b/src/kmain.c
@@ -85,6 +85,15 @@ void thing_main(void* arg)
 
 extern uintptr_t kheap_start;
 
+/* Stack Smashing Protection */
+
+uint64_t __stack_chk_guard = STACK_CHK_GUARD;
+
+void __stack_chk_fail(void)
+{
+	panic(NULL, "SSP: Stask Smashing Detected!!! (very spicy)");
+}
+
 /*
  * kmain - Kernel entry point
  *

From 3cd38f654c80d04f6649960c00df46463b8f48a5 Mon Sep 17 00:00:00 2001
From: xamidev <xamidev@riseup.net>
Date: Sat, 28 Mar 2026 21:09:08 +0100
Subject: [PATCH 07/17] Undefined Behavior Sanitization

---
 Makefile                 |   2 +-
 include/security/ubsan.h |  59 +++++++++++++++
 src/kmain.c              |   9 ---
 src/security/ssp.c       |  17 +++++
 src/security/ubsan.c     | 160 +++++++++++++++++++++++++++++++++++++++
 5 files changed, 237 insertions(+), 10 deletions(-)
 create mode 100644 include/security/ubsan.h
 create mode 100644 src/security/ssp.c
 create mode 100644 src/security/ubsan.c

diff --git a/Makefile b/Makefile
index 7e20f9c..aa7b486 100644
--- a/Makefile
+++ b/Makefile
@@ -7,7 +7,7 @@ OBJFILES := $(patsubst $(SRC)/%.c, $(BUILDDIR)/%.o, $(SOURCES))
 
 CC := x86_64-elf-gcc
 CC_FLAGS=-Wall -Wextra -std=gnu99 -nostdlib -ffreestanding -fstack-protector -fno-omit-frame-pointer -fno-stack-check -fno-PIC -ffunction-sections -fdata-sections -mcmodel=kernel
-CC_PROBLEMATIC_FLAGS=-Wno-unused-parameter -Wno-unused-variable
+CC_PROBLEMATIC_FLAGS=-Wno-unused-parameter -Wno-unused-variable -fsanitize=undefined
 
 LD := x86_64-elf-ld
 
diff --git a/include/security/ubsan.h b/include/security/ubsan.h
new file mode 100644
index 0000000..a7abc4a
--- /dev/null
+++ b/include/security/ubsan.h
@@ -0,0 +1,59 @@
+/*
+ * @author  xamidev <xamidev@riseup.net>
+ * @brief   Undefined behavior sanitization hooks
+ * @license GPL-3.0-only
+ */
+
+#ifndef UBSAN_H
+#define UBSAN_H
+
+#include <stdint.h>
+
+struct ubsan_source_location
+{
+	const char* filename;
+	uint32_t line;
+	uint32_t column;
+};
+
+struct ubsan_type_descriptor
+{
+	uint16_t type_kind;
+	uint16_t type_info;
+	char type_name[];
+};
+
+struct ubsan_type_mismatch_v1_data
+{
+	struct ubsan_source_location location;
+	struct ubsan_type_descriptor* type;
+	unsigned char log_alignment;
+	unsigned char type_check_kind;
+};
+
+struct ubsan_pointer_overflow_data
+{
+	struct ubsan_source_location location;
+};
+
+struct ubsan_shift_out_of_bounds_data
+{
+	struct ubsan_source_location location;
+	struct ubsan_type_descriptor* lhs_type;
+	struct ubsan_type_descriptor* rhs_type;
+};
+
+struct ubsan_invalid_value_data
+{
+	struct ubsan_source_location location;
+	struct ubsan_type_descriptor* type;
+};
+
+struct ubsan_out_of_bounds_data
+{
+	struct ubsan_source_location location;
+	struct ubsan_type_descriptor* array_type;
+	struct ubsan_type_descriptor* index_type;
+};
+
+#endif
\ No newline at end of file
diff --git a/src/kmain.c b/src/kmain.c
index 0323562..2a75272 100644
--- a/src/kmain.c
+++ b/src/kmain.c
@@ -85,15 +85,6 @@ void thing_main(void* arg)
 
 extern uintptr_t kheap_start;
 
-/* Stack Smashing Protection */
-
-uint64_t __stack_chk_guard = STACK_CHK_GUARD;
-
-void __stack_chk_fail(void)
-{
-	panic(NULL, "SSP: Stask Smashing Detected!!! (very spicy)");
-}
-
 /*
  * kmain - Kernel entry point
  *
diff --git a/src/security/ssp.c b/src/security/ssp.c
new file mode 100644
index 0000000..654df7a
--- /dev/null
+++ b/src/security/ssp.c
@@ -0,0 +1,17 @@
+/*
+ * @author  xamidev <xamidev@riseup.net>
+ * @brief   Stack Smashing Protection feature
+ * @license GPL-3.0-only
+ */
+
+#include <config.h>
+#include <stdint.h>
+#include <kernel.h>
+#include <stddef.h>
+
+uint64_t __stack_chk_guard = STACK_CHK_GUARD;
+
+void __stack_chk_fail(void)
+{
+	panic(NULL, "SSP: Stask Smashing Detected!!! (very spicy)");
+}
\ No newline at end of file
diff --git a/src/security/ubsan.c b/src/security/ubsan.c
new file mode 100644
index 0000000..cf0b6e4
--- /dev/null
+++ b/src/security/ubsan.c
@@ -0,0 +1,160 @@
+/*
+ * @author  xamidev <xamidev@riseup.net>
+ * @brief   Undefined behavior sanitization hooks
+ * @license GPL-3.0-only
+ */
+
+#include <stdint.h>
+#include <security/ubsan.h>
+#include <kernel.h>
+#include <stddef.h>
+
+/*
+ * Hooks were inspired from the Sortix implementation:
+ * https://gitlab.com/sortix/sortix/-/blob/main/libc/ubsan/ubsan.c
+ *
+ * Not all hooks are implemented here.
+ */
+
+extern struct init_status init;
+
+/*
+ * __ubsan_handle_type_mismatch_v1 - Hook for UBSan
+ * @data_raw:    pointer to error data
+ * @pointer_raw: faulty pointer
+ *
+ * This function is executed when the UBSan library detects
+ * following undefined behavior: type mismatch, null pointer
+ * access, and unaligned access. It halts the system and
+ * gives the location of the code that triggered it.
+ */
+void __ubsan_handle_type_mismatch_v1(void* data_raw, void* pointer_raw)
+{
+	struct ubsan_type_mismatch_v1_data* data = (struct ubsan_type_mismatch_v1_data*) data_raw;
+	uintptr_t pointer = (uintptr_t)pointer_raw;
+	uintptr_t alignment = (uintptr_t)1UL << data->log_alignment;
+	const char* violation = "type mismatch";
+	if ( !pointer ) {
+        violation = "null pointer access";
+    }
+	else if ( alignment && (pointer & (alignment - 1)) ) {
+        violation = "unaligned access";
+    }
+	
+    struct ubsan_source_location* loc = &data->location;
+
+    DEBUG("\x1b[38;5;231mUBSan: %s (ptr=%p) at %s:%u:%u\x1b[0m", violation, pointer, loc->filename, loc->line, loc->column);
+
+    if (init.all) {
+        printf("\x1b[38;5;231mUBSan: %s (ptr=%p) at %s:%u:%u\x1b[0m\r\n", violation, pointer, loc->filename, loc->line, loc->column);
+    }
+
+    panic(NULL, "Undefined Behavior Sanitization error");
+}
+
+/*
+ * __ubsan_handle_pointer_overflow - Hook for UBSan
+ * @data_raw:   pointer to error data
+ * @base_raw:   base pointer
+ * @result_raw: pointer after faulty operation
+ *
+ * This function is executed when the UBSan library detects
+ * following undefined behavior: pointer overflow.
+ * It halts the system and gives the location of the code
+ * that triggered it.
+ */
+void __ubsan_handle_pointer_overflow(void* data_raw, void* base_raw, void* result_raw)
+{
+	struct ubsan_pointer_overflow_data* data = (struct ubsan_pointer_overflow_data*) data_raw;
+	uintptr_t base = (uintptr_t)base_raw;
+	uintptr_t result = (uintptr_t)result_raw;
+    
+    struct ubsan_source_location* loc = &data->location;
+
+    DEBUG("\x1b[38;5;231mUBSan: pointer overflow (base=%p, result=%p) at %s:%u:%u\x1b[0m", base, result, loc->filename, loc->line, loc->column);
+
+    if (init.all) {
+        printf("\x1b[38;5;231mUBSan: pointer overflow (base=%p, result=%p) at %s:%u:%u\x1b[0m", base, result, loc->filename, loc->line, loc->column);
+    }
+
+    panic(NULL, "Undefined Behavior Sanitization error: pointer overflow");
+}
+
+/*
+ * __ubsan_handle_shift_out_of_bounds - Hook for UBSan
+ * @data_raw: pointer to error data
+ * @lhs_raw:  left hand side (value being shifted)
+ * @rhs_raw:  right hand side (shift amount)
+ *
+ * This function is executed when the UBSan library detects
+ * following undefined behavior: shift out of bounds.
+ * It halts the system and gives the location of the code
+ * that triggered it.
+ */
+void __ubsan_handle_shift_out_of_bounds(void* data_raw, void* lhs_raw, void* rhs_raw)
+{
+	struct ubsan_shift_out_of_bounds_data* data = (struct ubsan_shift_out_of_bounds_data*) data_raw;
+	uintptr_t lhs = (uintptr_t) lhs_raw;
+	uintptr_t rhs = (uintptr_t) rhs_raw;
+	
+    struct ubsan_source_location* loc = &data->location;
+
+    DEBUG("\x1b[38;5;231mUBSan: shift out of bounds (lhs=%p, rhs=%p) at %s:%u:%u\x1b[0m", lhs, rhs, loc->filename, loc->line, loc->column);
+
+    if (init.all) {
+        printf("\x1b[38;5;231mUBSan: shift out of bounds (lhs=%p, rhs=%p) at %s:%u:%u\x1b[0m", lhs, rhs, loc->filename, loc->line, loc->column);
+    }
+
+    panic(NULL, "Undefined Behavior Sanitization error: shift out of bounds");
+}
+
+/*
+ * __ubsan_handle_load_invalid_value - Hook for UBSan
+ * @data_raw:    pointer to error data
+ * @value_raw:   value loaded
+ *
+ * This function is executed when the UBSan library detects
+ * following undefined behavior: invalid value load.
+ * It halts the system and gives the location of the code
+ * that triggered it.
+ */
+void __ubsan_handle_load_invalid_value(void* data_raw, void* value_raw)
+{
+	struct ubsan_invalid_value_data* data = (struct ubsan_invalid_value_data*) data_raw;
+	uintptr_t value = (uintptr_t) value_raw;
+
+    struct ubsan_source_location* loc = &data->location;
+
+    DEBUG("\x1b[38;5;231mUBSan: invalid value load (value=%p) at %s:%u:%u\x1b[0m", value, loc->filename, loc->line, loc->column);
+
+    if (init.all) {
+        printf("\x1b[38;5;231mUBSan: invalid value load (value=%p) at %s:%u:%u\x1b[0m", value, loc->filename, loc->line, loc->column);
+    }
+
+    panic(NULL, "Undefined Behavior Sanitization error: invalid value load");
+}
+
+/*
+ * __ubsan_handle_out_of_bounds - Hook for UBSan
+ * @data_raw:    pointer to error data
+ * @index_raw:   out-of-bounds index in array
+ *
+ * This function is executed when the UBSan library detects
+ * following undefined behavior: access out of bounds.
+ * It halts the system and gives the location of the code
+ * that triggered it.
+ */
+void __ubsan_handle_out_of_bounds(void* data_raw, void* index_raw)
+{
+	struct ubsan_out_of_bounds_data* data = (struct ubsan_out_of_bounds_data*) data_raw;
+	uintptr_t index = (uintptr_t) index_raw;
+    struct ubsan_source_location* loc = &data->location;
+
+    DEBUG("\x1b[38;5;231mUBSan: out of bounds (index=%p) at %s:%u:%u\x1b[0m", index, loc->filename, loc->line, loc->column);
+
+    if (init.all) {
+        printf("\x1b[38;5;231mUBSan: out of bounds (index=%p) at %s:%u:%u\x1b[0m", index, loc->filename, loc->line, loc->column);
+    }
+
+    panic(NULL, "Undefined Behavior Sanitization error: out of bounds");
+}

From 65371077d9f0ebf3d5c42f272f3c24177638fae7 Mon Sep 17 00:00:00 2001
From: xamidev <xamidev@riseup.net>
Date: Sat, 28 Mar 2026 21:50:19 +0100
Subject: [PATCH 08/17] more UBsan

---
 README.md                |   4 +-
 include/boot/boot.h      |  14 +++++
 include/mem/gdt.h        |   2 +-
 include/security/ubsan.h |   7 +++
 src/boot/boot.c          |  15 ++++-
 src/kapps/kshell.c       |  10 +++
 src/kmain.c              |  11 +---
 src/security/ubsan.c     | 133 +++++++++++++++++++++++++++++++++++++++
 8 files changed, 184 insertions(+), 12 deletions(-)
 create mode 100644 include/boot/boot.h

diff --git a/README.md b/README.md
index 8ad2ad5..59ea9cb 100644
--- a/README.md
+++ b/README.md
@@ -73,4 +73,6 @@ PepperOS wouldn't be possible without the following freely-licensed software:
 - the [OSDev](https://osdev.org) wiki & forums
 - Intel 64 and IA-32 Architectures Software Developer's Manual
 - Documentation for the [GNU Compiler Collection](https://gcc.gnu.org/onlinedocs/gcc/)
-- dreamos82's [OSDev Notes](https://github.com/dreamportdev/Osdev-Notes/tree/master)
\ No newline at end of file
+- dreamos82's [OSDev Notes](https://github.com/dreamportdev/Osdev-Notes/tree/master)
+- the [Sortix UBsan hook implementations](https://gitlab.com/sortix/sortix/-/blob/main/libc/ubsan/ubsan.c)
+- the [CSC 395](https://curtsinger.cs.grinnell.edu/teaching/2022S/CSC395/kernel/) Kernel Development course from Grinnell College
\ No newline at end of file
diff --git a/include/boot/boot.h b/include/boot/boot.h
new file mode 100644
index 0000000..cc67dd8
--- /dev/null
+++ b/include/boot/boot.h
@@ -0,0 +1,14 @@
+/*
+ * @author  xamidev <xamidev@riseup.net>
+ * @brief   Boot routines
+ * @license GPL-3.0-only
+ */
+
+#ifndef BOOT_H
+#define BOOT_H
+
+#include <kernel.h>
+
+void populate_boot_context(struct boot_context* boot_ctx);
+
+#endif
\ No newline at end of file
diff --git a/include/mem/gdt.h b/include/mem/gdt.h
index abe3eba..af85dac 100644
--- a/include/mem/gdt.h
+++ b/include/mem/gdt.h
@@ -1,6 +1,6 @@
 /*
  * @author  xamidev <xamidev@riseup.net>
- * @brief   Global Descriptor Table (for legacy reasons)
+ * @brief   Global Descriptor Table
  * @license GPL-3.0-only
  */
 
diff --git a/include/security/ubsan.h b/include/security/ubsan.h
index a7abc4a..6f2609a 100644
--- a/include/security/ubsan.h
+++ b/include/security/ubsan.h
@@ -56,4 +56,11 @@ struct ubsan_out_of_bounds_data
 	struct ubsan_type_descriptor* index_type;
 };
 
+struct ubsan_overflow_data
+{
+	struct ubsan_source_location location;
+	struct ubsan_type_descriptor* type;
+};
+
+
 #endif
\ No newline at end of file
diff --git a/src/boot/boot.c b/src/boot/boot.c
index 73d1324..6fa8b9f 100644
--- a/src/boot/boot.c
+++ b/src/boot/boot.c
@@ -9,7 +9,9 @@
  * @license GPL-3.0-only
  */
 
+#include <kernel.h>
 #include <limine.h>
+#include <stddef.h>
 
 __attribute__((used, section(".limine_requests")))
 volatile struct limine_framebuffer_request framebuffer_request = {
@@ -45,4 +47,15 @@ __attribute__((used, section(".limine_requests_start")))
 volatile LIMINE_REQUESTS_START_MARKER;
 
 __attribute__((used, section(".limine_requests_end")))
-volatile LIMINE_REQUESTS_END_MARKER;
\ No newline at end of file
+volatile LIMINE_REQUESTS_END_MARKER;
+
+void populate_boot_context(struct boot_context* ctx)
+{
+	// Populate boot context
+	// This stays valid only if the BOOTLOADER_RECLAIMABLE regions are preserved
+ 	ctx->fb = framebuffer_request.response ? framebuffer_request.response->framebuffers[0] : NULL;
+	ctx->mmap = memmap_request.response ? memmap_request.response : NULL;
+	ctx->hhdm = hhdm_request.response ? hhdm_request.response : NULL;
+	ctx->kaddr = kerneladdr_request.response ? kerneladdr_request.response : NULL;
+	ctx->bootdate = date_request.response ? date_request.response : NULL;
+}
\ No newline at end of file
diff --git a/src/kapps/kshell.c b/src/kapps/kshell.c
index ae30832..e1ed05b 100644
--- a/src/kapps/kshell.c
+++ b/src/kapps/kshell.c
@@ -44,6 +44,7 @@ void pedicel_main(void* arg)
             printf("\r\nYou are currently running the test kernel shell. This is not\r\n"
                         "a fully-fledged shell like you'd find in a complete operating system,\r\n"
                         "but rather a toy to play around in the meantime.\r\n\r\n"
+                            "clear   - clear the screen\r\n"
                             "panic   - trigger a test panic\r\n"
                             "syscall - trigger int 0x80\r\n"
                             "pf      - trigger a page fault\r\n"
@@ -52,6 +53,15 @@ void pedicel_main(void* arg)
             continue;
         }
 
+        if (strncmp(input_buf, "", 1) == 0) {
+            continue;
+        } 
+
+        if (strncmp(input_buf, "clear", 5) == 0) {
+            printf("\x1b[2J\x1b[H");
+            continue;
+        }
+
         if (strncmp(input_buf, "panic", 5) == 0) {
             panic(NULL, "test panic");
         }
diff --git a/src/kmain.c b/src/kmain.c
index 2a75272..d9a4404 100644
--- a/src/kmain.c
+++ b/src/kmain.c
@@ -4,8 +4,6 @@
  * @license GPL-3.0-only
  */
 
-#include "arch/x86.h"
-#include "time/date.h"
 #include <stdbool.h>	
 #include <stddef.h>
 #include <limine.h>
@@ -26,6 +24,7 @@
 #include <io/term/flanterm.h>
 #include <io/term/flanterm_backends/fb.h>
 #include <arch/x86.h>
+#include <boot/boot.h>
 
 // Limine version used
 __attribute__((used, section(".limine_requests")))
@@ -98,13 +97,7 @@ void kmain()
 	CLEAR_INTERRUPTS;
 	if (!LIMINE_BASE_REVISION_SUPPORTED) hcf();
 
-	// Populate boot context
-	// This stays valid only if the BOOTLOADER_RECLAIMABLE regions are preserved
- 	boot_ctx.fb = framebuffer_request.response ? framebuffer_request.response->framebuffers[0] : NULL;
-	boot_ctx.mmap = memmap_request.response ? memmap_request.response : NULL;
-	boot_ctx.hhdm = hhdm_request.response ? hhdm_request.response : NULL;
-	boot_ctx.kaddr = kerneladdr_request.response ? kerneladdr_request.response : NULL;
-	boot_ctx.bootdate = date_request.response ? date_request.response : NULL;
+	populate_boot_context(&boot_ctx);
 
 	term_init();
 	serial_init();
diff --git a/src/security/ubsan.c b/src/security/ubsan.c
index cf0b6e4..04fbe8c 100644
--- a/src/security/ubsan.c
+++ b/src/security/ubsan.c
@@ -158,3 +158,136 @@ void __ubsan_handle_out_of_bounds(void* data_raw, void* index_raw)
 
     panic(NULL, "Undefined Behavior Sanitization error: out of bounds");
 }
+
+/*
+ * __ubsan_handle_divrem_overflow - Hook for UBSan
+ * @data_raw:    pointer to error data
+ * @lhs_raw:     left hand side operator
+ * @rhs_raw:     right hand side operator
+ *
+ * This function is executed when the UBSan library detects
+ * following undefined behavior: division remainder overflow.
+ * It halts the system and gives the location of the code
+ * that triggered it.
+ */
+void __ubsan_handle_divrem_overflow(void* data_raw, void* lhs_raw, void* rhs_raw)
+{
+	struct ubsan_overflow_data* data = (struct ubsan_overflow_data*) data_raw;
+	uintptr_t lhs = (uintptr_t) lhs_raw;
+	uintptr_t rhs = (uintptr_t) rhs_raw;
+    struct ubsan_source_location* loc = &data->location;
+
+	DEBUG("\x1b[38;5;231mUBSan: division remainder overflow (lhs=%p, rhs=%p) at %s:%u:%u\x1b[0m", lhs, rhs, loc->filename, loc->line, loc->column);
+
+    if (init.all) {
+        printf("\x1b[38;5;231mUBSan: division remainder overflow (lhs=%p, rhs=%p) at %s:%u:%u\x1b[0m", lhs, rhs, loc->filename, loc->line, loc->column);
+    }
+
+    panic(NULL, "Undefined Behavior Sanitization error: division remainder overflow");
+}
+
+/*
+ * __ubsan_handle_sub_overflow - Hook for UBSan
+ * @data_raw:    pointer to error data
+ * @lhs_raw:     left hand side operator
+ * @rhs_raw:     right hand side operator
+ *
+ * This function is executed when the UBSan library detects
+ * following undefined behavior: subtraction overflow.
+ * It halts the system and gives the location of the code
+ * that triggered it.
+ */
+void __ubsan_handle_sub_overflow(void* data_raw, void* lhs_raw, void* rhs_raw)
+{
+	struct ubsan_overflow_data* data = (struct ubsan_overflow_data*) data_raw;
+	uintptr_t lhs = (uintptr_t) lhs_raw;
+	uintptr_t rhs = (uintptr_t) rhs_raw;
+	struct ubsan_source_location* loc = &data->location;
+
+	DEBUG("\x1b[38;5;231mUBSan: subtraction overflow (lhs=%p, rhs=%p) at %s:%u:%u\x1b[0m", lhs, rhs, loc->filename, loc->line, loc->column);
+
+    if (init.all) {
+        printf("\x1b[38;5;231mUBSan: subtraction overflow (lhs=%p, rhs=%p) at %s:%u:%u\x1b[0m", lhs, rhs, loc->filename, loc->line, loc->column);
+    }
+
+    panic(NULL, "Undefined Behavior Sanitization error: subtraction overflow");
+}
+
+/*
+ * __ubsan_handle_add_overflow - Hook for UBSan
+ * @data_raw:    pointer to error data
+ * @lhs_raw:     left hand side operator
+ * @rhs_raw:     right hand side operator
+ *
+ * This function is executed when the UBSan library detects
+ * following undefined behavior: addition overflow.
+ * It halts the system and gives the location of the code
+ * that triggered it.
+ */
+void __ubsan_handle_add_overflow(void* data_raw, void* lhs_raw, void* rhs_raw)
+{
+	struct ubsan_overflow_data* data = (struct ubsan_overflow_data*) data_raw;
+	uintptr_t lhs = (uintptr_t) lhs_raw;
+	uintptr_t rhs = (uintptr_t) rhs_raw;
+    struct ubsan_source_location* loc = &data->location;
+
+	DEBUG("\x1b[38;5;231mUBSan: addition overflow (lhs=%p, rhs=%p) at %s:%u:%u\x1b[0m", lhs, rhs, loc->filename, loc->line, loc->column);
+
+    if (init.all) {
+        printf("\x1b[38;5;231mUBSan: addition overflow (lhs=%p, rhs=%p) at %s:%u:%u\x1b[0m", lhs, rhs, loc->filename, loc->line, loc->column);
+    }
+
+    panic(NULL, "Undefined Behavior Sanitization error: addition overflow");
+}
+
+/*
+ * __ubsan_handle_mul_overflow - Hook for UBSan
+ * @data_raw:    pointer to error data
+ * @lhs_raw:     left hand side operator
+ * @rhs_raw:     right hand side operator
+ *
+ * This function is executed when the UBSan library detects
+ * following undefined behavior: multiplication overflow.
+ * It halts the system and gives the location of the code
+ * that triggered it.
+ */
+void __ubsan_handle_mul_overflow(void* data_raw, void* lhs_raw, void* rhs_raw)
+{
+	struct ubsan_overflow_data* data = (struct ubsan_overflow_data*) data_raw;
+	uintptr_t lhs = (uintptr_t) lhs_raw;
+	uintptr_t rhs = (uintptr_t) rhs_raw;
+	struct ubsan_source_location* loc = &data->location;
+
+	DEBUG("\x1b[38;5;231mUBSan: multiplication overflow (lhs=%p, rhs=%p) at %s:%u:%u\x1b[0m", lhs, rhs, loc->filename, loc->line, loc->column);
+
+    if (init.all) {
+        printf("\x1b[38;5;231mUBSan: multiplication overflow (lhs=%p, rhs=%p) at %s:%u:%u\x1b[0m", lhs, rhs, loc->filename, loc->line, loc->column);
+    }
+
+    panic(NULL, "Undefined Behavior Sanitization error: multiplication overflow");
+}
+
+/*
+ * __ubsan_handle_negate_overflow - Hook for UBSan
+ * @data_raw:      pointer to error data
+ * @old_value_raw: value before overflow
+ *
+ * This function is executed when the UBSan library detects
+ * following undefined behavior: negation overflow.
+ * It halts the system and gives the location of the code
+ * that triggered it.
+ */
+void __ubsan_handle_negate_overflow(void* data_raw, void* old_value_raw)
+{
+	struct ubsan_overflow_data* data = (struct ubsan_overflow_data*) data_raw;
+	uintptr_t old_value = (uintptr_t) old_value_raw;
+    struct ubsan_source_location* loc = &data->location;
+
+	DEBUG("\x1b[38;5;231mUBSan: negation overflow (old_value=%p) at %s:%u:%u\x1b[0m", old_value, loc->filename, loc->line, loc->column);
+
+    if (init.all) {
+        printf("\x1b[38;5;231mUBSan: negation overflow (old_value=%p) at %s:%u:%u\x1b[0m", old_value, loc->filename, loc->line, loc->column);
+    }
+
+    panic(NULL, "Undefined Behavior Sanitization error: negation overflow");
+}

From 2f1eef9e15005d5f0106942bf31d176ae6a813d1 Mon Sep 17 00:00:00 2001
From: xamidev <xamidev@riseup.net>
Date: Sun, 29 Mar 2026 09:38:24 +0200
Subject: [PATCH 09/17] UBSan conditional compilation

---
 Makefile  | 11 ++++++++++-
 README.md | 14 ++++++++++++++
 2 files changed, 24 insertions(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index aa7b486..07bf3e1 100644
--- a/Makefile
+++ b/Makefile
@@ -2,12 +2,21 @@
 BUILDDIR := build
 ELFFILE := pepperk
 SRC := src
+
+CC_PROBLEMATIC_FLAGS:=-Wno-unused-parameter -Wno-unused-variable
+
+ifeq ($(UBSAN),true)
 SOURCES := $(shell find src -name '*.c')
+CC_PROBLEMATIC_FLAGS:= -fsanitize=undefined
+else
+SOURCES := $(shell find src -name '*.c')
+SOURCES := $(filter-out src/security/ubsan.c, $(SOURCES))
+endif
+
 OBJFILES := $(patsubst $(SRC)/%.c, $(BUILDDIR)/%.o, $(SOURCES))
 
 CC := x86_64-elf-gcc
 CC_FLAGS=-Wall -Wextra -std=gnu99 -nostdlib -ffreestanding -fstack-protector -fno-omit-frame-pointer -fno-stack-check -fno-PIC -ffunction-sections -fdata-sections -mcmodel=kernel
-CC_PROBLEMATIC_FLAGS=-Wno-unused-parameter -Wno-unused-variable -fsanitize=undefined
 
 LD := x86_64-elf-ld
 
diff --git a/README.md b/README.md
index 59ea9cb..33254bb 100644
--- a/README.md
+++ b/README.md
@@ -34,6 +34,20 @@ Compile the kernel and generate an ISO image like described above, then burn the
 sudo dd if=pepper.iso of=/dev/sdX
 ```
 
+## Compilation options
+
+By default, PepperOS is compiled without the following features:
+
+```
+UBSAN - undefined behavior sanitization
+```
+
+These features can be activated by setting them to "true" at the end of the make command, for example:
+
+```
+make UBSAN=true
+```
+
 ## TODO
 
 The basics that I'm targeting are:

From 1fc5225fd2e6b1c577ad1a59017239ccead80c32 Mon Sep 17 00:00:00 2001
From: xamidev <xamidev@riseup.net>
Date: Tue, 31 Mar 2026 17:48:11 +0200
Subject: [PATCH 10/17] kheap info

---
 include/{mem => arch}/gdt.h |  0
 include/mem/kheap.h         |  1 +
 include/sched/spinlock.h    |  2 +-
 include/security/ubsan.h    |  1 -
 src/{mem => arch/x86}/gdt.c |  2 +-
 src/arch/x86/init.c         |  2 +-
 src/io/kbd/ps2.c            | 20 +++++++++++++-------
 src/kapps/kshell.c          |  9 ++++++++-
 src/kmain.c                 |  2 +-
 src/mem/kheap.c             | 29 +++++++++++++++++++++++++++++
 src/sched/process.c         |  4 ++--
 11 files changed, 57 insertions(+), 15 deletions(-)
 rename include/{mem => arch}/gdt.h (100%)
 rename src/{mem => arch/x86}/gdt.c (99%)

diff --git a/include/mem/gdt.h b/include/arch/gdt.h
similarity index 100%
rename from include/mem/gdt.h
rename to include/arch/gdt.h
diff --git a/include/mem/kheap.h b/include/mem/kheap.h
index ee4672d..52a9fb7 100644
--- a/include/mem/kheap.h
+++ b/include/mem/kheap.h
@@ -28,5 +28,6 @@ void* kmalloc(size_t size);
 void kfree(void* ptr);
 void* kalloc_stack(void);
 void kheap_map_page(void);
+void kheap_info();
 
 #endif
\ No newline at end of file
diff --git a/include/sched/spinlock.h b/include/sched/spinlock.h
index 849d99d..fabf089 100644
--- a/include/sched/spinlock.h
+++ b/include/sched/spinlock.h
@@ -1,4 +1,4 @@
-/*
+        /*
  * @author  xamidev <xamidev@riseup.net>
  * @brief   Spinlock implementation
  * @license GPL-3.0-only
diff --git a/include/security/ubsan.h b/include/security/ubsan.h
index 6f2609a..0282a02 100644
--- a/include/security/ubsan.h
+++ b/include/security/ubsan.h
@@ -62,5 +62,4 @@ struct ubsan_overflow_data
 	struct ubsan_type_descriptor* type;
 };
 
-
 #endif
\ No newline at end of file
diff --git a/src/mem/gdt.c b/src/arch/x86/gdt.c
similarity index 99%
rename from src/mem/gdt.c
rename to src/arch/x86/gdt.c
index 3fe0c06..54dd6fc 100644
--- a/src/mem/gdt.c
+++ b/src/arch/x86/gdt.c
@@ -4,7 +4,7 @@
  * @license GPL-3.0-only
  */
 
-#include <mem/gdt.h>
+#include <arch/gdt.h>
 #include <stdint.h>
 #include <io/serial/serial.h>
 #include <kernel.h>
diff --git a/src/arch/x86/init.c b/src/arch/x86/init.c
index bc4b461..040ddf1 100644
--- a/src/arch/x86/init.c
+++ b/src/arch/x86/init.c
@@ -4,7 +4,7 @@
  * @license GPL-3.0-only
  */
 
-#include <mem/gdt.h>
+#include <arch/gdt.h>
 #include <stdint.h>
 #include <arch/x86.h>
 #include <kernel.h>
diff --git a/src/io/kbd/ps2.c b/src/io/kbd/ps2.c
index aea8c13..b9029d8 100644
--- a/src/io/kbd/ps2.c
+++ b/src/io/kbd/ps2.c
@@ -289,15 +289,21 @@ int keyboard_getline(char* output, size_t size)
     
     // Read until Enter is pressed
     while ((c = keyboard_getchar()) != 0x0A) {
-        if (index == size-1) {
-            output[index] = c;
-            output[index+1] = '\0';
-            return index;
+        if (c == '\b') {
+            if (index > 0) {
+                index--;
+                output[index] = '\0';
+                printf(" \b");
+            }
+            continue;
         }
-        output[index] = c;
-        index++;
+
+        if (index >= size-1) {
+            continue;
+        }
+        output[index++] = c;
     }
-    output[index+1] = '\0';
+    output[index] = '\0';
     return index;
 }
 
diff --git a/src/kapps/kshell.c b/src/kapps/kshell.c
index e1ed05b..f4a6852 100644
--- a/src/kapps/kshell.c
+++ b/src/kapps/kshell.c
@@ -11,6 +11,7 @@
 #include <stdint.h>
 #include <kernel.h>
 #include <time/date.h>
+#include <mem/kheap.h>
 
 __attribute__((noinline))
 void smash_it()
@@ -49,7 +50,8 @@ void pedicel_main(void* arg)
                             "syscall - trigger int 0x80\r\n"
                             "pf      - trigger a page fault\r\n"
                             "now     - get current date\r\n"
-                            "smash   - smash the stack\r\n");
+                            "smash   - smash the stack\r\n"
+                            "mem     - get used heap info\r\n");
             continue;
         }
 
@@ -89,6 +91,11 @@ void pedicel_main(void* arg)
             continue;
         }
 
+        if (strncmp(input_buf, "mem", 3) == 0) {
+            kheap_info();
+            continue;
+        }
+
         printf("%s: command not found\r\n", input_buf);
     }
 }
\ No newline at end of file
diff --git a/src/kmain.c b/src/kmain.c
index d9a4404..813e761 100644
--- a/src/kmain.c
+++ b/src/kmain.c
@@ -9,7 +9,7 @@
 #include <limine.h>
 #include <io/term/term.h>
 #include <io/serial/serial.h>
-#include <mem/gdt.h>
+#include <arch/gdt.h>
 #include <mem/utils.h>
 #include <kernel.h>
 #include <time/timer.h>
diff --git a/src/mem/kheap.c b/src/mem/kheap.c
index 20f302c..2359c36 100644
--- a/src/mem/kheap.c
+++ b/src/mem/kheap.c
@@ -157,4 +157,33 @@ void* kalloc_stack()
 {
     uint8_t* ptr = kmalloc(PROCESS_STACK_SIZE); // As it's out of kmalloc, stack is already mapped into kernel space
     return ptr ? ptr+PROCESS_STACK_SIZE : NULL;
+}
+
+/*
+ * kheap_info - Display heap info
+ *
+ * This function writes the size of the heap (total),
+ * the number of allocated bytes, and the number of
+ * free bytes to the standard output.
+ */
+void kheap_info()
+{
+    uint64_t free_bytes = 0;
+    struct heap_block_t* curr = (struct heap_block_t*)kheap_start;
+
+    while (curr) {
+        if (curr->free == true) {
+            free_bytes += curr->size;
+        }
+        curr = curr->next;
+    }
+
+    uint64_t total = end-kheap_start;
+
+    printf("total=% 8u bytes (%u kB)\r\n"
+                "alloc=% 8u bytes (%u kB)\r\n"
+                " free=% 8u bytes (%u kB)\r\n",
+                total, (total)/1000,
+                total-free_bytes, (total-free_bytes)/1000,
+                free_bytes, free_bytes/1000);
 }
\ No newline at end of file
diff --git a/src/sched/process.c b/src/sched/process.c
index 5c2f600..9a20c42 100644
--- a/src/sched/process.c
+++ b/src/sched/process.c
@@ -9,11 +9,11 @@
 #include <mem/kheap.h>
 #include <kernel.h>
 #include <string/string.h>
-#include <mem/gdt.h>
+#include <arch/gdt.h>
 #include <config.h>
 #include <io/serial/serial.h>
-
 #include <io/term/flanterm.h>
+
 extern struct flanterm_context* ft_ctx;
 
 struct process_t* processes_list;

From e8a0a36889d9593c4301c328c088cb66ef5d881a Mon Sep 17 00:00:00 2001
From: xamidev <xamidev@riseup.net>
Date: Tue, 31 Mar 2026 21:04:44 +0200
Subject: [PATCH 11/17] Enable FPU

---
 src/arch/x86/init.c | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/src/arch/x86/init.c b/src/arch/x86/init.c
index 040ddf1..e1736c3 100644
--- a/src/arch/x86/init.c
+++ b/src/arch/x86/init.c
@@ -29,6 +29,26 @@ static void x86_overwrite_pat()
     wrmsr(0x277, pat);
 }
 
+/*
+ * x86_enable_fpu - Enable Floating Point Unit
+ *
+ * This function enables the Floating Point Unit,
+ * which allows the CPU to do floating point
+ * operations.
+ *
+ * Here we do not check for FPU support but we
+ * should. However most processors support it.
+ */
+static void x86_enable_fpu()
+{
+    size_t cr4;
+	__asm__ volatile("mov %%cr4, %0" : "=r"(cr4));
+	cr4 |= 0x200;
+	__asm__ volatile("mov %0, %%cr4" :: "r"(cr4));
+    uint16_t cw = 0x37F;
+    asm volatile("fldcw %0" :: "m"(cw));
+}
+
 /*
  * x86_arch_init - Initialize x86 CPU structures
  *
@@ -42,6 +62,7 @@ static void x86_overwrite_pat()
 void x86_arch_init()
 {
     x86_overwrite_pat();
+    x86_enable_fpu();
     x86_cpu_identification();
     idt_init();
     gdt_init();

From e9b57f70b1e6b1bece21c75d7375d21fa6bfb1e3 Mon Sep 17 00:00:00 2001
From: xamidev <xamidev@riseup.net>
Date: Wed, 1 Apr 2026 09:15:59 +0200
Subject: [PATCH 12/17] End the _t nonsense

---
 include/arch/x86.h        |  4 ++--
 include/kernel.h          |  2 +-
 include/mem/kheap.h       |  4 ++--
 include/mem/paging.h      |  2 +-
 include/sched/process.h   | 16 ++++++++--------
 include/sched/scheduler.h |  2 +-
 include/sched/spinlock.h  |  6 +++---
 src/arch/x86/idt.c        |  6 +++---
 src/arch/x86/syscall.c    |  2 +-
 src/debug/panic.c         |  2 +-
 src/io/serial/serial.c    |  2 +-
 src/io/term/term.c        |  4 ++--
 src/kmain.c               |  6 +++---
 src/mem/kheap.c           | 22 +++++++++++-----------
 src/sched/process.c       | 24 ++++++++++++------------
 src/sched/scheduler.c     | 10 +++++-----
 src/sched/spinlock.c      |  4 ++--
 17 files changed, 59 insertions(+), 59 deletions(-)

diff --git a/include/arch/x86.h b/include/arch/x86.h
index 0e6ad58..d6900e3 100644
--- a/include/arch/x86.h
+++ b/include/arch/x86.h
@@ -36,7 +36,7 @@ struct idtr {
 // All general-purpose registers (except rsp) as stored on the stack,
 // plus the values we pushed (vector number, error code) and the iret frame
 // In reverse order because the stack grows downwards.
-struct cpu_status_t {
+struct cpu_status {
     uint64_t r15;
     uint64_t r14;
     uint64_t r13;
@@ -63,6 +63,6 @@ struct cpu_status_t {
     uint64_t iret_ss;
 };
 
-struct cpu_status_t* syscall_handler(struct cpu_status_t* regs);
+struct cpu_status* syscall_handler(struct cpu_status* regs);
 
 #endif
\ No newline at end of file
diff --git a/include/kernel.h b/include/kernel.h
index 04836ca..d77ca98 100644
--- a/include/kernel.h
+++ b/include/kernel.h
@@ -35,7 +35,7 @@ extern volatile uint64_t ticks;
 
 // printf("debug: [%s]: " log "\n", __FILE__, ##__VA_ARGS__);
 
-void panic(struct cpu_status_t* ctx, const char* str);
+void panic(struct cpu_status* ctx, const char* str);
 void hcf(void);
 void idle(void);
 
diff --git a/include/mem/kheap.h b/include/mem/kheap.h
index 52a9fb7..08c7766 100644
--- a/include/mem/kheap.h
+++ b/include/mem/kheap.h
@@ -16,11 +16,11 @@
 #include <stddef.h>
 #include <stdint.h>
 
-struct heap_block_t {
+struct heap_block {
     size_t size;
     bool free; // 1byte
     uint8_t reserved[7]; // (7+1 = 8 bytes)
-    struct heap_block_t* next;
+    struct heap_block* next;
 } __attribute__((aligned(16)));
 
 void kheap_init(void);
diff --git a/include/mem/paging.h b/include/mem/paging.h
index f5cf406..e7b38fe 100644
--- a/include/mem/paging.h
+++ b/include/mem/paging.h
@@ -34,7 +34,7 @@ extern uint64_t hhdm_off;
 #define PAGE_ALIGN_DOWN(x) ((x) & PTE_ADDR_MASK)
 
 #define ALIGN(size) ALIGN_UP(size, 16)
-#define BLOCK_MIN_SIZE (sizeof(struct heap_block_t) + 16)
+#define BLOCK_MIN_SIZE (sizeof(struct heap_block) + 16)
 
 #define PML4_INDEX(x) (((x) >> 39) & 0x1FF)
 #define PDPT_INDEX(x) (((x) >> 30) & 0x1FF)
diff --git a/include/sched/process.h b/include/sched/process.h
index 02a313a..22548f6 100644
--- a/include/sched/process.h
+++ b/include/sched/process.h
@@ -17,23 +17,23 @@ typedef enum {
     DEAD
 } status_t;
 
-struct process_t {
+struct process {
     size_t pid;
     char name[PROCESS_NAME_MAX];
 
     status_t status;
-    struct cpu_status_t* context;
+    struct cpu_status* context;
 	void* root_page_table; // Process PML4 (should contain kernel PML4 in higher half [256-511]
-    struct process_t* next;
+    struct process* next;
 };
 
 void process_init(void);
-struct process_t* process_create(char* name, void(*function)(void*), void* arg);
-void process_add(struct process_t** processes_list, struct process_t* process);
-void process_delete(struct process_t** processes_list, struct process_t* process);
-struct process_t* process_get_next(struct process_t* process);
+struct process* process_create(char* name, void(*function)(void*), void* arg);
+void process_add(struct process** processes_list, struct process* process);
+void process_delete(struct process** processes_list, struct process* process);
+struct process* process_get_next(struct process* process);
 void process_exit(void);
 
-void process_display_list(struct process_t* processes_list);
+void process_display_list(struct process* processes_list);
 
 #endif
diff --git a/include/sched/scheduler.h b/include/sched/scheduler.h
index 071321e..89251e6 100644
--- a/include/sched/scheduler.h
+++ b/include/sched/scheduler.h
@@ -7,7 +7,7 @@
 #ifndef SCHEDULER_H
 #define SCHEDULER_H
 
-struct cpu_status_t* scheduler_schedule(struct cpu_status_t* context);
+struct cpu_status* scheduler_schedule(struct cpu_status* context);
 void scheduler_init(void);
 
 #endif
\ No newline at end of file
diff --git a/include/sched/spinlock.h b/include/sched/spinlock.h
index fabf089..ea4d9dd 100644
--- a/include/sched/spinlock.h
+++ b/include/sched/spinlock.h
@@ -10,13 +10,13 @@
 #include <stdbool.h>
 #include <stdint.h>
 
-struct spinlock_t
+struct spinlock
 {
     bool locked;
     uint64_t rflags;
 };
 
-void spinlock_acquire(struct spinlock_t* lock);
-void spinlock_release(struct spinlock_t* lock);
+void spinlock_acquire(struct spinlock* lock);
+void spinlock_release(struct spinlock* lock);
 
 #endif
\ No newline at end of file
diff --git a/src/arch/x86/idt.c b/src/arch/x86/idt.c
index c4b17c2..75d5514 100644
--- a/src/arch/x86/idt.c
+++ b/src/arch/x86/idt.c
@@ -108,7 +108,7 @@ static inline uint64_t read_cr2(void)
  * Also displays an interpretation of the thrown error code.
  * Then halts the system. We could implement demand paging later.
  */
-static void page_fault_handler(struct cpu_status_t* ctx)
+static void page_fault_handler(struct cpu_status* ctx)
 {
     // It could be used to remap pages etc. to fix the fault, but right now what I'm more
     // interested in is getting more info out of those numbers cause i'm lost each time i have 
@@ -149,7 +149,7 @@ static void page_fault_handler(struct cpu_status_t* ctx)
  * Shows detail about a General Protection Fault,
  * and what may have caused it. Halts the system.
  */
-static void gp_fault_handler(struct cpu_status_t* ctx)
+static void gp_fault_handler(struct cpu_status* ctx)
 {
     DEBUG("\x1b[38;5;231mGeneral Protection Fault at rip=0x%p, err=%u (%s)\x1b[0m",
     ctx->iret_rip,
@@ -185,7 +185,7 @@ static void gp_fault_handler(struct cpu_status_t* ctx)
  * Return:
  * <context> - CPU context after interrupt
  */
-struct cpu_status_t* interrupt_dispatch(struct cpu_status_t* context)
+struct cpu_status* interrupt_dispatch(struct cpu_status* context)
 {
     if (context == NULL) {
         panic(NULL, "Interrupt dispatch recieved NULL context!");
diff --git a/src/arch/x86/syscall.c b/src/arch/x86/syscall.c
index 380c5fc..544c2a6 100644
--- a/src/arch/x86/syscall.c
+++ b/src/arch/x86/syscall.c
@@ -7,7 +7,7 @@
 #include <arch/x86.h>
 #include <kernel.h>
 
-struct cpu_status_t* syscall_handler(struct cpu_status_t* regs)
+struct cpu_status* syscall_handler(struct cpu_status* regs)
 {
     DEBUG("Syscall %lx with argument %lx", regs->rdi, regs->rsi);
 
diff --git a/src/debug/panic.c b/src/debug/panic.c
index 22ff590..bbeb884 100644
--- a/src/debug/panic.c
+++ b/src/debug/panic.c
@@ -47,7 +47,7 @@ void read_rflags(uint64_t rflags)
  * Will display to terminal if it is initialized, otherwise serial only.
  * Can be called with or without a CPU context.
  */
-void panic(struct cpu_status_t* ctx, const char* str)
+void panic(struct cpu_status* ctx, const char* str)
 {
 	CLEAR_INTERRUPTS;
 	panic_count += 1;
diff --git a/src/io/serial/serial.c b/src/io/serial/serial.c
index f36a450..655d479 100644
--- a/src/io/serial/serial.c
+++ b/src/io/serial/serial.c
@@ -11,7 +11,7 @@
 extern struct init_status init;
 
 extern int panic_count;
-struct spinlock_t serial_lock = {0};
+struct spinlock serial_lock = {0};
 
 /*
  * outb - Writes a byte to a CPU port
diff --git a/src/io/term/term.c b/src/io/term/term.c
index e4f7546..e3bd2ca 100644
--- a/src/io/term/term.c
+++ b/src/io/term/term.c
@@ -29,8 +29,8 @@ because this shitty implementation will be replaced one day by Flanterm
 extern struct flanterm_context* ft_ctx;
 extern struct init_status init;
 
-struct spinlock_t term_lock = {0};
-struct spinlock_t printf_lock = {0};
+struct spinlock term_lock = {0};
+struct spinlock printf_lock = {0};
 
 extern int panic_count;
 
diff --git a/src/kmain.c b/src/kmain.c
index 813e761..470bc73 100644
--- a/src/kmain.c
+++ b/src/kmain.c
@@ -63,9 +63,9 @@ extern volatile struct limine_hhdm_request hhdm_request;
 extern volatile struct limine_kernel_address_request kerneladdr_request;
 extern volatile struct limine_boot_time_request date_request;
 
-extern struct process_t* processes_list;
-extern struct process_t* current_process;
-struct process_t* idle_proc;
+extern struct process* processes_list;
+extern struct process* current_process;
+struct process* idle_proc;
 
 void idle_main(void* arg)
 {
diff --git a/src/mem/kheap.c b/src/mem/kheap.c
index 2359c36..5c58e36 100644
--- a/src/mem/kheap.c
+++ b/src/mem/kheap.c
@@ -17,7 +17,7 @@ extern uint64_t kernel_virt_base;
 
 uintptr_t kheap_start;
 
-static struct heap_block_t* head = NULL;
+static struct heap_block* head = NULL;
 static uintptr_t end;
 
 // Kernel root table (level 4)
@@ -55,8 +55,8 @@ void kheap_init()
     end = current_addr;
 
     // Give linked list head its properties
-    head = (struct heap_block_t*)kheap_start;
-    head->size = (end-kheap_start) - sizeof(struct heap_block_t);
+    head = (struct heap_block*)kheap_start;
+    head->size = (end-kheap_start) - sizeof(struct heap_block);
     head->free = true;
     head->next = NULL;
     DEBUG("Kernel heap initialized, head=0x%p, size=%u bytes", head, head->size);
@@ -80,16 +80,16 @@ void* kmalloc(size_t size)
     if (!size) return NULL;
     size = ALIGN(size);
 
-    struct heap_block_t* curr = head;
+    struct heap_block* curr = head;
 
     while (curr) {
         // Is block free and big enough for us?
         if (curr->free && curr->size >= size) {
             // We split the block if it is big enough
-            if (curr->size >= size + sizeof(struct heap_block_t) + 16) {
-                struct heap_block_t* split = (struct heap_block_t*)((uintptr_t)curr + sizeof(struct heap_block_t) + size);
+            if (curr->size >= size + sizeof(struct heap_block) + 16) {
+                struct heap_block* split = (struct heap_block*)((uintptr_t)curr + sizeof(struct heap_block) + size);
                 
-                split->size = curr->size - size - sizeof(struct heap_block_t);
+                split->size = curr->size - size - sizeof(struct heap_block);
                 split->free = true;
                 split->next = curr->next;
 
@@ -99,7 +99,7 @@ void* kmalloc(size_t size)
 
             // Found a good block, we return it
             curr->free = false;
-            return (void*)((uintptr_t)curr + sizeof(struct heap_block_t));
+            return (void*)((uintptr_t)curr + sizeof(struct heap_block));
         }
         // Continue browsing the list if nothing good was found yet
         curr = curr->next;
@@ -127,11 +127,11 @@ void kfree(void* ptr)
     if (!ptr) return;
 
     // Set it free!
-    struct heap_block_t* block = (struct heap_block_t*)((uintptr_t)ptr - sizeof(struct heap_block_t));
+    struct heap_block* block = (struct heap_block*)((uintptr_t)ptr - sizeof(struct heap_block));
     block->free = true;
 
     // merge adjacent free blocks (coalescing)
-    struct heap_block_t* curr = head;
+    struct heap_block* curr = head;
     while (curr && curr->next) {
         if (curr->free && curr->next->free) {
             curr->size += sizeof(*curr) + curr->next->size;
@@ -169,7 +169,7 @@ void* kalloc_stack()
 void kheap_info()
 {
     uint64_t free_bytes = 0;
-    struct heap_block_t* curr = (struct heap_block_t*)kheap_start;
+    struct heap_block* curr = (struct heap_block*)kheap_start;
 
     while (curr) {
         if (curr->free == true) {
diff --git a/src/sched/process.c b/src/sched/process.c
index 9a20c42..81c7eb2 100644
--- a/src/sched/process.c
+++ b/src/sched/process.c
@@ -16,8 +16,8 @@
 
 extern struct flanterm_context* ft_ctx;
 
-struct process_t* processes_list;
-struct process_t* current_process;
+struct process* processes_list;
+struct process* current_process;
 
 extern uint64_t *kernel_pml4;
 
@@ -39,10 +39,10 @@ void process_init()
  * This function prints the linked list of processes
  * to the DEBUG output.
  */
-void process_display_list(struct process_t* processes_list)
+void process_display_list(struct process* processes_list)
 {
     int process_view_id = 0;
-    struct process_t* tmp = processes_list;
+    struct process* tmp = processes_list;
     while (tmp != NULL) {
         DEBUG("{%d: %p} -> ", process_view_id, tmp);
         tmp = tmp->next;
@@ -64,11 +64,11 @@ void process_display_list(struct process_t* processes_list)
  * Return:
  * <proc> - pointer to created process
  */
-struct process_t* process_create(char* name, void(*function)(void*), void* arg)
+struct process* process_create(char* name, void(*function)(void*), void* arg)
 {
     CLEAR_INTERRUPTS;
-    struct process_t* proc = (struct process_t*)kmalloc(sizeof(struct process_t));
-    struct cpu_status_t* ctx = (struct cpu_status_t*)kmalloc(sizeof(struct cpu_status_t));
+    struct process* proc = (struct process*)kmalloc(sizeof(struct process));
+    struct cpu_status* ctx = (struct cpu_status*)kmalloc(sizeof(struct cpu_status));
 
     // No more memory?
     if (!proc) return NULL;
@@ -108,7 +108,7 @@ struct process_t* process_create(char* name, void(*function)(void*), void* arg)
  * @processes_list: pointer to the head of the linked list
  * @process:        process to add at the end of the linked list
  */
-void process_add(struct process_t** processes_list, struct process_t* process)
+void process_add(struct process** processes_list, struct process* process)
 {
     if (!process) return;
     process->next = NULL;
@@ -119,7 +119,7 @@ void process_add(struct process_t** processes_list, struct process_t* process)
         return;
     }
 
-    struct process_t* tmp = *processes_list;
+    struct process* tmp = *processes_list;
     while (tmp->next != NULL) {
         tmp = tmp->next;
     }
@@ -132,7 +132,7 @@ void process_add(struct process_t** processes_list, struct process_t* process)
  * @processes_list: pointer to head of linked list
  * @process:        the process to delete from the list
  */
-void process_delete(struct process_t** processes_list, struct process_t* process)
+void process_delete(struct process** processes_list, struct process* process)
 {
     if (!processes_list || !*processes_list || !process) return;
 
@@ -144,7 +144,7 @@ void process_delete(struct process_t** processes_list, struct process_t* process
         return;
     }
 
-    struct process_t* tmp = *processes_list;
+    struct process* tmp = *processes_list;
     while (tmp->next && tmp->next != process) {
         tmp = tmp->next;
     }
@@ -167,7 +167,7 @@ void process_delete(struct process_t** processes_list, struct process_t* process
  * Return:
  * <process->next> - process right after the one specified
  */
-struct process_t* process_get_next(struct process_t* process)
+struct process* process_get_next(struct process* process)
 {
     if (!process) return NULL;
     return process->next;
diff --git a/src/sched/scheduler.c b/src/sched/scheduler.c
index 34acfdf..c320b70 100644
--- a/src/sched/scheduler.c
+++ b/src/sched/scheduler.c
@@ -10,9 +10,9 @@
 #include <stdint.h>
 #include <io/serial/serial.h>
 
-extern struct process_t* processes_list;
-extern struct process_t* current_process;
-extern struct process_t* idle_proc;
+extern struct process* processes_list;
+extern struct process* current_process;
+extern struct process* idle_proc;
 
 /*
  * scheduler_init - Choose the first process
@@ -32,7 +32,7 @@ void scheduler_init()
  * Return:
  * <context> - CPU context for next process
  */
-struct cpu_status_t* scheduler_schedule(struct cpu_status_t* context)
+struct cpu_status* scheduler_schedule(struct cpu_status* context)
 {
     if (context == NULL) {
         panic(NULL, "Scheduler called with NULL context"); 
@@ -51,7 +51,7 @@ struct cpu_status_t* scheduler_schedule(struct cpu_status_t* context)
     current_process->context = context;
 
     for (;;) {
-        struct process_t* prev_process = current_process;
+        struct process* prev_process = current_process;
         if (current_process->next != NULL) {
             current_process = current_process->next;
         } else {
diff --git a/src/sched/spinlock.c b/src/sched/spinlock.c
index efe4213..54d70ed 100644
--- a/src/sched/spinlock.c
+++ b/src/sched/spinlock.c
@@ -16,7 +16,7 @@
  * Saves the RFLAGS register, then acquires a lock.
  * Pause instruction is used to ease the CPU.
  */
-void spinlock_acquire(struct spinlock_t* lock)
+void spinlock_acquire(struct spinlock* lock)
 {
     uint64_t rflags;
     asm volatile("pushfq ; pop %0 ; cli" : "=rm"(rflags) : : "memory");
@@ -36,7 +36,7 @@ void spinlock_acquire(struct spinlock_t* lock)
  * unlocks it (clears locked state).
  * RFLAGS is then restored.
  */
-void spinlock_release(struct spinlock_t* lock)
+void spinlock_release(struct spinlock* lock)
 {
     uint64_t rflags = lock->rflags;
     __atomic_clear(&lock->locked, __ATOMIC_RELEASE);

From 8be2a744b4c617f6b1666b5b47ec378ba1c4cc65 Mon Sep 17 00:00:00 2001
From: xamidev <xamidev@riseup.net>
Date: Wed, 1 Apr 2026 11:44:57 +0200
Subject: [PATCH 13/17] Refactor GDT entry filling

---
 src/arch/x86/gdt.c | 76 +++++++++++++++++++++++++++-------------------
 1 file changed, 44 insertions(+), 32 deletions(-)

diff --git a/src/arch/x86/gdt.c b/src/arch/x86/gdt.c
index 54dd6fc..37edfd3 100644
--- a/src/arch/x86/gdt.c
+++ b/src/arch/x86/gdt.c
@@ -51,6 +51,43 @@ static void gdt_flush()
     );
 }
 
+/*
+ * get_set_entry - Sets a GDT entry
+ * @num:    Number of the entry (index in GDT)
+ * @flags:  Flags (Granularity, Size, Long mode)
+ * @access: Access byte (contains Descriptor Privilege Level)
+ *
+ * This function fills a GDT entry with the specified @flags
+ * and @access byte. The base and limit fields are left to zero
+ * because we don't use segmentation for memory management.
+ */
+
+static void gdt_set_entry(int num, uint8_t flags, uint8_t access)
+{
+    uint64_t gdt_entry = 0;
+
+    gdt_entry |= (access << 8);
+    gdt_entry |= (flags << 20);
+    
+    // Rest (base, limit) is always zero
+    gdt_entries[num] = gdt_entry << 32;
+}
+
+/*
+ * gdt_set_tss - Setup the TSS entry in the GDT
+ * @num: Number of the entry (index in GDT)
+ *
+ * This function sets up a Task State Segment entry
+ * in the Global Descriptor Table.
+ *
+ * The entry is 128-bit long, so it actually takes
+ * two 64-bit GDT entries.
+ */
+static void gdt_set_tss(int num)
+{
+
+}
+
 /*
  * gdt_init - Global Descriptor Table initialization 
  *
@@ -62,38 +99,11 @@ static void gdt_flush()
  */
 void gdt_init()
 {
-    // Null descriptor (required)
-    gdt_entries[0] = 0;
-
-    // Kernel code segment
-    uint64_t kernel_code = 0;
-    kernel_code |= 0b1101 << 8; // Selector type: accessed, read-enable, no conforming
-    kernel_code |= 1 << 12; // not a system descriptor
-    kernel_code |= 0 << 13; // DPL field = 0
-    kernel_code |= 1 << 15; // Present
-    kernel_code |= 1 << 21; // Long mode
-
-    // Left shift 32 bits so we place our stuff in the upper 32 bits of the descriptor.
-    // The lower 32 bits contain limit and part of base and therefore are ignored in Long Mode
-    // (because we'll use paging; segmentation is used only for legacy)
-    gdt_entries[1] = kernel_code << 32;
-
-    uint64_t kernel_data = 0;
-    kernel_data |= 0b0011 << 8;
-    kernel_data |= 1 << 12;
-    kernel_data |= 0 << 13;
-    kernel_data |= 1 << 15;
-    kernel_data |= 1 << 21;
-
-    gdt_entries[2] = kernel_data << 32;
-
-    // We re-use the kernel descriptors here, and just update their DPL fields
-    // (Descriptor privilege level) from ring 0 -> to ring 3 (userspace)
-    uint64_t user_code = kernel_code | (3 << 13);
-    gdt_entries[3] = user_code;
-
-    uint64_t user_data = kernel_data | (3 << 13);
-    gdt_entries[4] = user_data;
+    gdt_set_entry(0, 0, 0); // Null descriptor  (0x0)
+    gdt_set_entry(1, 0xA, 0x9B); // Kernel code (0x8)
+    gdt_set_entry(2, 0xC, 0x93); // Kernel data (0x10)
+    gdt_set_entry(3, 0xA, 0xFB); // User code   (0x18)
+    gdt_set_entry(4, 0xC, 0xF3); // User data   (0x20)
 
     // The -1 subtraction is some wizardry explained in the OSDev wiki -> GDT
     gdtr.limit = NUM_GDT_ENTRIES * sizeof(uint64_t) - 1;
@@ -103,5 +113,7 @@ void gdt_init()
     gdt_load();
     gdt_flush();
 
+    // Here we should load the task register with TSS selector
+
     DEBUG("GDT initialized");
 }
\ No newline at end of file

From d64412690132fc876cb86aaa8ed721c018df70ed Mon Sep 17 00:00:00 2001
From: xamidev <xamidev@riseup.net>
Date: Wed, 1 Apr 2026 13:04:33 +0200
Subject: [PATCH 14/17] TSS setup

---
 include/arch/gdt.h | 15 ++++++++++++++-
 src/arch/x86/gdt.c | 23 +++++++++++++++++++++--
 2 files changed, 35 insertions(+), 3 deletions(-)

diff --git a/include/arch/gdt.h b/include/arch/gdt.h
index af85dac..f2297b9 100644
--- a/include/arch/gdt.h
+++ b/include/arch/gdt.h
@@ -13,19 +13,32 @@
 // we'll only use this as a requirement for paging, not more.
 // This means base 0 and no limit (whole address space)
 
-#define NUM_GDT_ENTRIES 5
+#define NUM_GDT_ENTRIES 7
 
 #define NULL_SELECTOR 0x00
 #define KERNEL_CODE_SEGMENT 0x08
 #define KERNEL_DATA_SEGMENT 0x10
 #define USER_CODE_SEGMENT 0x18
 #define USER_DATA_SEGMENT 0x20
+#define TSS_SEGMENT 0x28
 
 struct GDTR {
     uint16_t limit;
     uint64_t address;
 } __attribute__((packed));
 
+struct tss {
+    uint32_t reserved0;
+    uint64_t rsp0;
+    uint64_t rsp1;
+    uint64_t rsp2;
+    uint64_t reserved1;
+    uint64_t ist[7];
+    uint64_t reserved2;
+    uint16_t reserved3;
+    uint16_t iopb;
+} __attribute__((packed));
+
 void gdt_init(void);
 
 #endif
\ No newline at end of file
diff --git a/src/arch/x86/gdt.c b/src/arch/x86/gdt.c
index 37edfd3..9f2100e 100644
--- a/src/arch/x86/gdt.c
+++ b/src/arch/x86/gdt.c
@@ -1,6 +1,6 @@
 /*
  * @author  xamidev <xamidev@riseup.net>
- * @brief   Global Descriptor Table (for legacy reasons)
+ * @brief   Global Descriptor Table and Task State Segment setup
  * @license GPL-3.0-only
  */
 
@@ -14,6 +14,8 @@
 uint64_t gdt_entries[NUM_GDT_ENTRIES];
 struct GDTR gdtr;
 
+struct tss tss = {0};
+
 /*
  * gdt_load - Loads Global Descriptor Table
  */
@@ -85,7 +87,22 @@ static void gdt_set_entry(int num, uint8_t flags, uint8_t access)
  */
 static void gdt_set_tss(int num)
 {
+    uint64_t tss_base = (uint64_t)&tss;
+    uint64_t tss_limit = sizeof(struct tss) - 1;
 
+    tss.iopb = sizeof(struct tss);
+
+    uint64_t tss_low = 0;
+    tss_low |= (tss_limit & 0xFFFFULL);
+    tss_low |= (tss_base & 0xFFFFFFULL) << 16;
+    tss_low |= 0x89ULL << 40;
+    tss_low |= ((tss_limit >> 16) & 0xFULL) << 48;
+    tss_low |= ((tss_base >> 24) & 0xFFULL) << 56;
+
+    uint64_t tss_high = (tss_base >> 32) & 0xFFFFFFFFULL;
+
+    gdt_entries[num] = tss_low;
+    gdt_entries[num + 1] = tss_high;
 }
 
 /*
@@ -104,6 +121,7 @@ void gdt_init()
     gdt_set_entry(2, 0xC, 0x93); // Kernel data (0x10)
     gdt_set_entry(3, 0xA, 0xFB); // User code   (0x18)
     gdt_set_entry(4, 0xC, 0xF3); // User data   (0x20)
+    gdt_set_tss(5);                            // TSS         (0x28)
 
     // The -1 subtraction is some wizardry explained in the OSDev wiki -> GDT
     gdtr.limit = NUM_GDT_ENTRIES * sizeof(uint64_t) - 1;
@@ -113,7 +131,8 @@ void gdt_init()
     gdt_load();
     gdt_flush();
 
-    // Here we should load the task register with TSS selector
+    // Load task register with new TSS
+    asm volatile("ltr %%ax" : : "a"(TSS_SEGMENT) : "memory");
 
     DEBUG("GDT initialized");
 }
\ No newline at end of file

From 11a9dd4adbc690416ca72e38c37e3d3379316be9 Mon Sep 17 00:00:00 2001
From: xamidev <xamidev@riseup.net>
Date: Wed, 1 Apr 2026 15:51:04 +0200
Subject: [PATCH 15/17] Load limine module + alloc user stack

---
 Makefile                |  2 ++
 include/config.h        |  4 ++++
 include/kernel.h        |  1 +
 include/sched/process.h |  1 +
 limine.conf             |  1 +
 src/boot/boot.c         | 11 +++++++++--
 src/debug/panic.c       |  2 +-
 src/kmain.c             | 12 ++++++++++++
 src/mem/vmm.c           | 25 +++++++++++++++++++++++++
 user/hello.S            |  5 +++++
 10 files changed, 61 insertions(+), 3 deletions(-)
 create mode 100644 user/hello.S

diff --git a/Makefile b/Makefile
index 07bf3e1..1542d6d 100644
--- a/Makefile
+++ b/Makefile
@@ -21,6 +21,7 @@ CC_FLAGS=-Wall -Wextra -std=gnu99 -nostdlib -ffreestanding -fstack-protector -fn
 LD := x86_64-elf-ld
 
 $(ELFFILE): $(BUILDDIR) $(OBJFILES)
+	nasm -f bin user/hello.S -o $(BUILDDIR)/hello
 	nasm -f elf64 src/arch/x86/idt.S -o $(BUILDDIR)/idt_stub.o
 	$(LD) -o $(ELFFILE) -T linker.ld $(OBJFILES) $(BUILDDIR)/idt_stub.o
 	# Get the symbols for debugging
@@ -47,6 +48,7 @@ build-iso: limine/limine $(ELFFILE)
 	cp -v $(ELFFILE) iso_root/boot
 	mkdir -p iso_root/boot/limine
 	cp -v limine.conf iso_root/boot/limine
+	cp $(BUILDDIR)/hello iso_root/boot/
 	mkdir -p iso_root/EFI/BOOT
 	cp -v limine/limine-bios.sys limine/limine-bios-cd.bin limine/limine-uefi-cd.bin iso_root/boot/limine/
 	cp -v limine/BOOTX64.EFI iso_root/EFI/BOOT/
diff --git a/include/config.h b/include/config.h
index 2ec0d50..811ad4d 100644
--- a/include/config.h
+++ b/include/config.h
@@ -40,6 +40,10 @@
 #define KERNEL_STACK_SIZE 65536
 #define KERNEL_IDT_ENTRIES 33
 
+/* user */
+#define USER_STACK_TOP 0x80000000
+#define USER_STACK_PAGES 16 // 16*4096 = 64kb
+
 /* paging */
 #define PAGING_MAX_PHYS 0x200000000
 
diff --git a/include/kernel.h b/include/kernel.h
index d77ca98..7a9712b 100644
--- a/include/kernel.h
+++ b/include/kernel.h
@@ -54,6 +54,7 @@ struct boot_context {
 	struct limine_hhdm_response* hhdm;
 	struct limine_kernel_address_response* kaddr;
 	struct limine_boot_time_response* bootdate;
+	struct limine_module_response* module;
 };
 
 // Are these modules initialized yet?
diff --git a/include/sched/process.h b/include/sched/process.h
index 22548f6..c42bf0d 100644
--- a/include/sched/process.h
+++ b/include/sched/process.h
@@ -24,6 +24,7 @@ struct process {
     status_t status;
     struct cpu_status* context;
 	void* root_page_table; // Process PML4 (should contain kernel PML4 in higher half [256-511]
+    void* kernel_stack; // Used for interrupts (syscall: int 0x80), defines the TSS RSP0
     struct process* next;
 };
 
diff --git a/limine.conf b/limine.conf
index 71825ed..980ace0 100644
--- a/limine.conf
+++ b/limine.conf
@@ -6,3 +6,4 @@ interface_branding: Welcome to the PepperOS disk!
 	
 	comment: Default configuration (warning: spicy)
 	path: boot():/boot/pepperk
+	module_path: boot():/boot/hello
diff --git a/src/boot/boot.c b/src/boot/boot.c
index 6fa8b9f..06a7eb4 100644
--- a/src/boot/boot.c
+++ b/src/boot/boot.c
@@ -13,6 +13,9 @@
 #include <limine.h>
 #include <stddef.h>
 
+__attribute__((used, section(".limine_requests_start")))
+volatile LIMINE_REQUESTS_START_MARKER;
+
 __attribute__((used, section(".limine_requests")))
 volatile struct limine_framebuffer_request framebuffer_request = {
 	.id = LIMINE_FRAMEBUFFER_REQUEST,
@@ -43,8 +46,11 @@ volatile struct limine_boot_time_request date_request = {
 	.revision = 0
 };
 
-__attribute__((used, section(".limine_requests_start")))
-volatile LIMINE_REQUESTS_START_MARKER;
+__attribute__((used, section(".limine_requests")))
+volatile struct limine_module_request module_request = {
+	.id = LIMINE_MODULE_REQUEST,
+	.revision = 0
+};
 
 __attribute__((used, section(".limine_requests_end")))
 volatile LIMINE_REQUESTS_END_MARKER;
@@ -58,4 +64,5 @@ void populate_boot_context(struct boot_context* ctx)
 	ctx->hhdm = hhdm_request.response ? hhdm_request.response : NULL;
 	ctx->kaddr = kerneladdr_request.response ? kerneladdr_request.response : NULL;
 	ctx->bootdate = date_request.response ? date_request.response : NULL;
+	ctx->module = module_request.response ? module_request.response : NULL;
 }
\ No newline at end of file
diff --git a/src/debug/panic.c b/src/debug/panic.c
index bbeb884..71310b2 100644
--- a/src/debug/panic.c
+++ b/src/debug/panic.c
@@ -18,7 +18,7 @@ extern int panic_count;
  */
 void read_rflags(uint64_t rflags)
 {
-	DEBUG("\x1b[38;5;226m%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s\x1b[38;5;231m",
+	printf("\x1b[38;5;226m%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s\x1b[38;5;231m",
 		CHECK_BIT(rflags, 0) ? "CF " : "", /*carry flag*/
 		CHECK_BIT(rflags, 2) ? "PF " : "", /*parity flag*/
 		CHECK_BIT(rflags, 4) ? "AF " : "", /*auxiliary carry flag*/
diff --git a/src/kmain.c b/src/kmain.c
index 470bc73..6d7cd21 100644
--- a/src/kmain.c
+++ b/src/kmain.c
@@ -62,6 +62,9 @@ extern volatile struct limine_memmap_request memmap_request;
 extern volatile struct limine_hhdm_request hhdm_request;
 extern volatile struct limine_kernel_address_request kerneladdr_request;
 extern volatile struct limine_boot_time_request date_request;
+extern volatile struct limine_module_request module_request;
+
+struct limine_file* file;
 
 extern struct process* processes_list;
 extern struct process* current_process;
@@ -119,6 +122,15 @@ void kmain()
 
 	scheduler_init();
 
+	if (!boot_ctx.module) {
+		panic(NULL, "could not load 'hello' executable :(");
+	}
+
+	if (boot_ctx.module->module_count == 1) {
+		file = boot_ctx.module->modules[0];
+		DEBUG("file: addr=%p size=%u", file->address, file->size);
+	}
+
 	printf(PEPPEROS_SPLASH);
 	init.all = true;
 
diff --git a/src/mem/vmm.c b/src/mem/vmm.c
index 46de4fc..ec20a39 100644
--- a/src/mem/vmm.c
+++ b/src/mem/vmm.c
@@ -13,6 +13,7 @@ in a specified virtual space
 compared to the PMM which allocs/frees 4kb frames ("physical pages").
 */
 
+#include "config.h"
 #include <mem/vmm.h>
 #include <mem/paging.h>
 #include <stddef.h>
@@ -225,6 +226,30 @@ void* vmm_alloc_region(uint64_t* pml4, size_t pages, uint64_t flags)
     return NULL;
 }
 
+/*
+ * vmm_map_user_stack - Map a user stack
+ * @pml4: the user process's PML4
+ *
+ * This function maps and allocates a userspace
+ * stack in the user @pml4 provided, according
+ * to constants USER_STACK_TOP and USER_STACK_PAGES.
+ *
+ * Return:
+ * <addr> - User stack top address
+ */
+
+uintptr_t vmm_alloc_user_stack(uint64_t* pml4)
+{
+    uintptr_t stack_top = USER_STACK_TOP;
+    size_t stack_size = USER_STACK_PAGES*PAGE_SIZE;
+
+    for (size_t i=stack_top; i>stack_top-stack_size; i-=PAGE_SIZE) {
+        vmm_map(pml4, i, PTE_PRESENT | PTE_WRITABLE | PTE_USER);
+    }
+
+    return stack_top;
+}
+
 void vmm_init()
 {
     // NO U
diff --git a/user/hello.S b/user/hello.S
new file mode 100644
index 0000000..be06990
--- /dev/null
+++ b/user/hello.S
@@ -0,0 +1,5 @@
+bits 64
+
+hello:
+    mov qword rax, 0xcafebabe
+    jmp hello
\ No newline at end of file

From aa30d9c6b56f843f15de609653e6a95c0e604412 Mon Sep 17 00:00:00 2001
From: xamidev <xamidev@riseup.net>
Date: Thu, 2 Apr 2026 17:05:51 +0200
Subject: [PATCH 16/17] user program (still many #PF)

---
 include/arch/x86.h      |  1 -
 include/config.h        |  1 +
 include/mem/vmm.h       |  2 ++
 include/sched/process.h |  3 +++
 src/arch/x86/idt.c      |  7 ++---
 src/arch/x86/init.c     |  2 +-
 src/kmain.c             | 13 ++++-----
 src/mem/paging.c        | 22 +++++++++++++---
 src/mem/vmm.c           | 11 ++++++++
 src/sched/process.c     | 58 +++++++++++++++++++++++++++++++++++++++++
 user/hello.S            |  3 +--
 11 files changed, 107 insertions(+), 16 deletions(-)

diff --git a/include/arch/x86.h b/include/arch/x86.h
index d6900e3..b0b9029 100644
--- a/include/arch/x86.h
+++ b/include/arch/x86.h
@@ -10,7 +10,6 @@ void wrmsr(uint32_t msr, uint64_t value);
 bool x86_has_msr();
 void x86_arch_init();
 
-
 void x86_cpu_identification();
 int cpuid_get_vendor_string(char* str);
 
diff --git a/include/config.h b/include/config.h
index 811ad4d..f3564ec 100644
--- a/include/config.h
+++ b/include/config.h
@@ -43,6 +43,7 @@
 /* user */
 #define USER_STACK_TOP 0x80000000
 #define USER_STACK_PAGES 16 // 16*4096 = 64kb
+#define USER_CODE_START 0x400000 // like linux
 
 /* paging */
 #define PAGING_MAX_PHYS 0x200000000
diff --git a/include/mem/vmm.h b/include/mem/vmm.h
index 64e1f0c..5383622 100644
--- a/include/mem/vmm.h
+++ b/include/mem/vmm.h
@@ -22,6 +22,8 @@ void vmm_unmap(uint64_t* pml4, uint64_t virt);
 void* vmm_map(uint64_t* pml4, uint64_t virt, uint64_t flags);
 uint64_t* vmm_create_address_space();
 uint64_t vmm_virt_to_phys(uint64_t* pml4, uint64_t virt);
+uintptr_t vmm_alloc_user_stack(uint64_t* pml4);
+uintptr_t vmm_alloc_user_code(uint64_t* pml4, void* code_addr, uint64_t code_size);
 
 #define VMM_USER_SPACE_START 0x0000000000001000 
 #define VMM_USER_SPACE_END   0x00007FFFFFFFF000
diff --git a/include/sched/process.h b/include/sched/process.h
index c42bf0d..ef00d3e 100644
--- a/include/sched/process.h
+++ b/include/sched/process.h
@@ -10,6 +10,7 @@
 #include <stddef.h>
 #include <config.h>
 #include <stdint.h>
+#include <limine.h>
 
 typedef enum {
     READY,
@@ -37,4 +38,6 @@ void process_exit(void);
 
 void process_display_list(struct process* processes_list);
 
+void process_create_user(struct limine_file* file);
+
 #endif
diff --git a/src/arch/x86/idt.c b/src/arch/x86/idt.c
index 75d5514..4a29524 100644
--- a/src/arch/x86/idt.c
+++ b/src/arch/x86/idt.c
@@ -77,7 +77,7 @@ void idt_init()
         idt_set_entry(i, vector_0_handler + (i*16), 0);
     }
 
-    idt_set_entry(0x80, vector_128_handler, 0);
+    idt_set_entry(0x80, vector_128_handler, 3);
 
     idt_load(&idt);
     DEBUG("IDT initialized");
@@ -264,9 +264,10 @@ struct cpu_status* interrupt_dispatch(struct cpu_status* context)
             // Send an EOI so that we can continue having interrupts
             outb(0x20, 0x20);
 
-            if (ticks % SCHEDULER_QUANTUM == 0) {
+            // Scheduler is temporarily disabled to test user trampoline
+            /* if (ticks % SCHEDULER_QUANTUM == 0) {
                 return scheduler_schedule(context);
-            }
+            } */
 
             break;
 
diff --git a/src/arch/x86/init.c b/src/arch/x86/init.c
index e1736c3..997793a 100644
--- a/src/arch/x86/init.c
+++ b/src/arch/x86/init.c
@@ -45,7 +45,7 @@ static void x86_enable_fpu()
 	__asm__ volatile("mov %%cr4, %0" : "=r"(cr4));
 	cr4 |= 0x200;
 	__asm__ volatile("mov %0, %%cr4" :: "r"(cr4));
-    uint16_t cw = 0x37F;
+    uint16_t cw = 0x37F; // control word
     asm volatile("fldcw %0" :: "m"(cw));
 }
 
diff --git a/src/kmain.c b/src/kmain.c
index 6d7cd21..89bd3b0 100644
--- a/src/kmain.c
+++ b/src/kmain.c
@@ -124,15 +124,16 @@ void kmain()
 
 	if (!boot_ctx.module) {
 		panic(NULL, "could not load 'hello' executable :(");
-	}
-
-	if (boot_ctx.module->module_count == 1) {
-		file = boot_ctx.module->modules[0];
-		DEBUG("file: addr=%p size=%u", file->address, file->size);
-	}
+	} 
 
 	printf(PEPPEROS_SPLASH);
 	init.all = true;
 
+	if (boot_ctx.module->module_count == 1) {
+		file = boot_ctx.module->modules[0];
+		DEBUG("file: addr=%p size=%u", file->address, file->size);
+		process_create_user(file);
+	}
+
 	idle();
 }
diff --git a/src/mem/paging.c b/src/mem/paging.c
index 4b76536..bd0b812 100644
--- a/src/mem/paging.c
+++ b/src/mem/paging.c
@@ -99,30 +99,46 @@ void paging_map_page(uint64_t* root_table, uint64_t virt, uint64_t phys, uint64_
 
     uint64_t *pdpt, *pd, *pt;
 
+    // Any parent entry on a userspace mapping must also carry PTE_USER,
+    // otherwise CPL3 accesses fault even if the final PTE is user.
+    uint64_t parent_flags = PTE_PRESENT | PTE_WRITABLE;
+    if (flags & PTE_USER) {
+        parent_flags |= PTE_USER;
+    }
+
     // PML4
     // If the entry at index is not present, allocate enough space for it
     // then populate the entry with correct addr + flags
     if (!(root_table[pml4_i] & PTE_PRESENT)) {
         pdpt = alloc_page_table();
-        root_table[pml4_i] = VIRT_TO_PHYS(pdpt) | PTE_PRESENT | PTE_WRITABLE;
+        root_table[pml4_i] = VIRT_TO_PHYS(pdpt) | parent_flags;
     } else {
         pdpt = (uint64_t *)PHYS_TO_VIRT(root_table[pml4_i] & PTE_ADDR_MASK);
+        if (flags & PTE_USER) {
+            root_table[pml4_i] |= PTE_USER;
+        }
     }
 
     // PDPT: same here
     if (!(pdpt[pdpt_i] & PTE_PRESENT)) {
         pd = alloc_page_table();
-        pdpt[pdpt_i] = VIRT_TO_PHYS(pd) | PTE_PRESENT | PTE_WRITABLE;
+        pdpt[pdpt_i] = VIRT_TO_PHYS(pd) | parent_flags;
     } else {
         pd = (uint64_t *)PHYS_TO_VIRT(pdpt[pdpt_i] & PTE_ADDR_MASK);
+        if (flags & PTE_USER) {
+            pdpt[pdpt_i] |= PTE_USER;
+        }
     }
 
     // PD: and here
     if (!(pd[pd_i] & PTE_PRESENT)) {
         pt = alloc_page_table();
-        pd[pd_i] = VIRT_TO_PHYS(pt) | PTE_PRESENT | PTE_WRITABLE;
+        pd[pd_i] = VIRT_TO_PHYS(pt) | parent_flags;
     } else {
         pt = (uint64_t *)PHYS_TO_VIRT(pd[pd_i] & PTE_ADDR_MASK);
+        if (flags & PTE_USER) {
+            pd[pd_i] |= PTE_USER;
+        }
     }
 
     // PT: finally, populate the page table entry
diff --git a/src/mem/vmm.c b/src/mem/vmm.c
index ec20a39..d17970a 100644
--- a/src/mem/vmm.c
+++ b/src/mem/vmm.c
@@ -250,6 +250,17 @@ uintptr_t vmm_alloc_user_stack(uint64_t* pml4)
     return stack_top;
 }
 
+uintptr_t vmm_alloc_user_code(uint64_t* pml4, void* code_addr, uint64_t code_size)
+{
+    uintptr_t code_start = USER_CODE_START;
+
+    for (size_t i=code_start; i<code_start+code_size; i+=PAGE_SIZE) {
+        vmm_map(pml4, i, PTE_PRESENT | PTE_WRITABLE | PTE_USER);
+    }
+    
+    return code_start;
+}
+
 void vmm_init()
 {
     // NO U
diff --git a/src/sched/process.c b/src/sched/process.c
index 81c7eb2..24b04dd 100644
--- a/src/sched/process.c
+++ b/src/sched/process.c
@@ -4,6 +4,8 @@
  * @license GPL-3.0-only
  */
 
+#include "mem/paging.h"
+#include "mem/vmm.h"
 #include <stddef.h>
 #include <sched/process.h>
 #include <mem/kheap.h>
@@ -13,6 +15,7 @@
 #include <config.h>
 #include <io/serial/serial.h>
 #include <io/term/flanterm.h>
+#include <mem/utils.h>
 
 extern struct flanterm_context* ft_ctx;
 
@@ -196,4 +199,59 @@ void process_exit()
     for (;;) {
         asm("hlt");
     }
+}
+
+/*
+ * process_jump_to_user - Jump to userland
+ * @stack_top: Address of the top of the user stack
+ * @user_code: Address of the first instruction of user code
+ */
+void process_jump_to_user(uintptr_t stack_top, uintptr_t user_code)
+{
+    // 0x20 | 3 = 0x23 (user data segment | 3)
+    // 0x18 | 3 = 0x1B (user code segment | 3)
+    asm volatile(" \
+        push $0x23 \n\
+        push %0 \n\
+        push $0x202 \n\
+        push $0x1B \n\
+        push %1 \n\
+        iretq \n\
+        " :: "r"(stack_top), "r"(user_code));
+}
+
+// Kernel stack used for interrupts from userland process.
+// Should be set in TSS.RSP0 when switching to userland process.
+uint8_t interrupt_stack[0x8000];
+
+extern struct tss tss;
+
+/*
+ * process_create_user - Create a new user process
+ * @file: pointer to Limine file structure
+ *
+ * This function takes a loaded Limine executable
+ * module, and maps its code, a user stack, sets the
+ * TSS RSP0 for interrupts, and finally jumps to the
+ * user code.
+ */
+void process_create_user(struct limine_file* file)
+{
+    void* exec_addr = file->address;
+    uint64_t exec_size = file->size;
+
+    uint64_t* user_pml4 = vmm_create_address_space();
+    uintptr_t stack_top = vmm_alloc_user_stack(user_pml4);
+    uint64_t code = vmm_alloc_user_code(user_pml4, exec_addr, exec_size);
+    
+    // Could be kalloc_stack()ed PER PROCESS when we grow that
+    tss.rsp0 = (uint64_t)(interrupt_stack + sizeof(interrupt_stack));
+
+    // Load user_pml4 into cr3 along here??
+    load_cr3(VIRT_TO_PHYS((uint64_t)user_pml4));
+
+    // Copy code into user pages
+    memcpy((uint64_t*)code, exec_addr, exec_size);
+
+    process_jump_to_user(stack_top, code);
 }
\ No newline at end of file
diff --git a/user/hello.S b/user/hello.S
index be06990..2520195 100644
--- a/user/hello.S
+++ b/user/hello.S
@@ -1,5 +1,4 @@
 bits 64
 
 hello:
-    mov qword rax, 0xcafebabe
-    jmp hello
\ No newline at end of file
+    mov rax, 0xcafebabe
\ No newline at end of file

From dbffb7f5fa23e97434bef27935eedb59e22cb5a3 Mon Sep 17 00:00:00 2001
From: xamidev <xamidev@riseup.net>
Date: Thu, 2 Apr 2026 19:11:37 +0200
Subject: [PATCH 17/17] userland HELLO WORLD

---
 src/arch/x86/syscall.c | 46 +++++++++++++++++++++++++++++++++++++-----
 user/hello.S           | 14 ++++++++++++-
 2 files changed, 54 insertions(+), 6 deletions(-)

diff --git a/src/arch/x86/syscall.c b/src/arch/x86/syscall.c
index 544c2a6..8adb178 100644
--- a/src/arch/x86/syscall.c
+++ b/src/arch/x86/syscall.c
@@ -4,21 +4,57 @@
  * @license GPL-3.0-only
  */
 
+#include "sched/scheduler.h"
 #include <arch/x86.h>
 #include <kernel.h>
+#include <stddef.h>
+#include <io/term/term.h>
 
+void sys_write(unsigned int fd, const char* buf, size_t count)
+{
+    switch (fd) {
+        case 1: //stdout
+            for (size_t i=0; i<count; i++) {
+                internal_putc(buf[i], NULL);
+            }
+            break;
+
+        case 2: //stderr
+            break;
+    }
+}
+
+/*
+ * syscall_handler - System call dispatcher
+ * @regs: CPU state
+ *
+ * This function is called from the interrupt dispatcher,
+ * when an interrupt 0x80 is emitted from userland.
+ *
+ * It switches control to the syscall number provided
+ * in %rax. 
+ *
+ * We try to follow the System V convention here:
+ * - syscall number in %rax
+ * - args in %rdi, %rsi, %rdx, %r10, %r8, %r9
+ * - return value (if any) in %rax
+ *
+ * Return:
+ * <regs> - CPU state after system call
+ */
 struct cpu_status* syscall_handler(struct cpu_status* regs)
 {
-    DEBUG("Syscall %lx with argument %lx", regs->rdi, regs->rsi);
+    DEBUG("Syscall %lx with (arg0=%lx arg1=%lx)", regs->rax, regs->rdi, regs->rsi);
 
-    switch (regs->rdi)
+    switch (regs->rax)
     {
-        case 0:
+        case 0: //sys_read
             break;
-        case 1:
+        case 1: //sys_write
+            sys_write(regs->rdi, (char*)regs->rsi, regs->rdx);
             break;
         default:
-            regs->rsi = 0xdeadbeef;
+            regs->rax = 0xbad515ca11;
             break;
     }
 
diff --git a/user/hello.S b/user/hello.S
index 2520195..d3e94f7 100644
--- a/user/hello.S
+++ b/user/hello.S
@@ -1,4 +1,16 @@
 bits 64
 
+section .data
+    hi db "hi from userland :) we did it man", 0
+
+section .text
+
 hello:
-    mov rax, 0xcafebabe
\ No newline at end of file
+    mov rax, 0x1        ;sys_write
+    mov rdi, 0x1        ;stdout
+    lea rsi, [rel hi]   ;char* buf
+    mov rdx, 33         ;count
+    int 0x80
+
+.loop:
+    jmp .loop
\ No newline at end of file