Anyone network in the browser, a standards-based engine, and a fast network path

.github/workflows/verify.yml

@@ -351,8 +351,11 @@ jobs:
           - theme_proofs
           - tls_proofs
           - audio_proto_proofs
+          - browser_http_proofs
           - capsule_crypto_proofs
           - aes_proofs
+          - anon_ntor_proofs
+          - anon_link_proofs
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4.2.2
         with:

Cargo.toml

@@ -162,6 +162,7 @@ nonos-capsule-net-ntp           = []
 nonos-capsule-net-core          = []
 nonos-capsule-net-sockets       = []
 nonos-capsule-net-nym           = []
+nonos-capsule-net-anon          = []
 nonos-capsule-socks5            = []
 nonos-capsule-linux             = []
 nonos-capsule-market            = []
@@ -541,6 +542,7 @@ microkernel-desktop-base = [
   "nonos-capsule-net-core",
   "nonos-capsule-net-sockets",
   "nonos-capsule-net-nym",
+  "nonos-capsule-net-anon",
   "nonos-capsule-socks5",
   "nonos-capsule-input-router",
   "nonos-capsule-compositor",

mk/20-build.mk

@@ -613,6 +613,7 @@ include userland/capsule_net_dns/Capsule.mk
 include userland/capsule_net_ntp/Capsule.mk
 include userland/capsule_net_sockets/Capsule.mk
 include userland/capsule_net_nym/Capsule.mk
+include userland/capsule_net_anon/Capsule.mk
 include userland/capsule_socks5/Capsule.mk
 include userland/capsule_wallpaper/Capsule.mk
 include userland/capsule_attest/Capsule.mk

scripts/baselines/stubs.txt

@@ -166,8 +166,8 @@ userland/nonos_qjs/build.rs:23
 userland/nonos_qjs/build.rs:77
 userland/nonos_qjs/src/lib.rs:26
 userland/sdk/nonos_std/src/io/error.rs:28
-userland/toolkit/src/image/bmp.rs:27
-userland/toolkit/src/image/bmp.rs:35
+userland/toolkit/src/image/bmp/readable.rs:22
+userland/toolkit/src/image/bmp/readable.rs:26
 userland/toolkit/src/image/gif/decoder.rs:58
 userland/toolkit/src/image/gif/decoder.rs:68
 userland/toolkit/src/image/gif/decoder.rs:69

scripts/gen_encoding_index.py

@@ -0,0 +1,74 @@
+#!/usr/bin/env python3
+# NONOS Operating System
+# Copyright (C) 2026 NONOS Contributors
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with this program. If not, see <https://www.gnu.org/licenses/>.
+"""Build the browser's text-decoding tables from the Encoding Standard.
+usage: gen_encoding_index.py <dir holding encodings.json and index-*.txt>
+Both come from https://encoding.spec.whatwg.org/. Each table is a run of
+little-endian u16 code points indexed by pointer (.idx files), 0 where the index has
+none; Big5's plane-2 code points keep their low 16 bits and set a bit in
+big5_astral.idx. gb18030 ranges are (pointer, code point) u32 pairs.
+labels.txt holds one encoding per line, its name first (#n for the n-th
+single-byte table), then its labels. SOURCE.txt records each index's
+identifier and date."""
+import json, struct, sys
+from pathlib import Path
+
+OUT = Path("userland/capsule_browser/src/browser/http/response/charset/index")
+SRC = Path(sys.argv[1])
+
+
+def index(name):
+    rows, meta = {}, []
+    for line in (SRC / f"index-{name}.txt").read_text(encoding="utf-8").split("\n"):
+        if line.startswith("# Identifier") or line.startswith("# Date"):
+            meta.append(line[2:])
+        elif line.strip() and not line.startswith("#"):
+            p, c = line.split("\t")[:2]
+            rows[int(p)] = int(c, 16)
+    SOURCES[name] = f"index-{name}.txt " + " ".join(meta)
+    return rows
+
+
+def u16s(rows, size):
+    return b"".join(struct.pack("<H", rows.get(p, 0) & 0xFFFF) for p in range(size))
+
+
+SOURCES, labels, single = {}, [], []
+for group in json.loads((SRC / "encodings.json").read_text()):
+    for e in group["encodings"]:
+        name = e["name"].lower()
+        if group["heading"] == "Legacy single-byte encodings":
+            table = "iso-8859-8" if name == "iso-8859-8-i" else name
+            single.append(u16s(index(table), 128))
+            name = f"#{len(single) - 1}"
+        labels.append(" ".join([name] + e["labels"]))
+OUT.mkdir(parents=True, exist_ok=True)
+(OUT / "labels.txt").write_text("\n".join(labels) + "\n")
+(OUT / "single_byte.idx").write_bytes(b"".join(single))
+for name, file in [("jis0208",) * 2, ("jis0212",) * 2, ("gb18030",) * 2, ("euc-kr", "euc_kr")]:
+    rows = index(name)
+    (OUT / f"{file}.idx").write_bytes(u16s(rows, max(rows) + 1))
+big5 = index("big5")
+(OUT / "big5.idx").write_bytes(u16s(big5, max(big5) + 1))
+bits = bytearray((max(big5) + 8) // 8)
+for p, c in big5.items():
+    if c > 0xFFFF:
+        assert c >> 16 == 2, "Big5 leaves plane 2"
+        bits[p // 8] |= 1 << (p % 8)
+(OUT / "big5_astral.idx").write_bytes(bytes(bits))
+ranges = index("gb18030-ranges")
+(OUT / "gb18030_ranges.idx").write_bytes(b"".join(struct.pack("<II", p, c) for p, c in sorted(ranges.items())))
+(OUT / "SOURCE.txt").write_text("https://encoding.spec.whatwg.org/\n" + "\n".join(SOURCES.values()) + "\n")

src/arch/x86_64/context/switch/kernel_thread.rs

@@ -48,12 +48,7 @@ pub(super) fn resume_kernel_thread(pcb: &Arc<ProcessControlBlock>, pid: u32) {
     let ctx = match INTERRUPT_SAVED_CONTEXTS.write().remove(&pid) {
         Some(c) => c,
         None => {
-            // No saved context to resume. Leaving the task Ready let the
-            // scheduler re-select it every iteration and fail to resume, which
-            // spins the core. Drop it from the run queue and park it so an
-            // unresumable task is not re-picked.
-            crate::process::scheduler::dispatch::remove_from_run_queue(pid);
-            *pcb.state.lock() = ProcessState::Sleeping;
+            super::retry_unsaved::retry_unsaved(pid);
             return;
         }
     };

src/arch/x86_64/context/switch/mod.rs

@@ -18,6 +18,7 @@ mod dispatch;
 mod first_entry;
 mod kernel_thread;
 mod resume;
+mod retry_unsaved;
 mod validate_resume;
 
 pub(crate) use dispatch::switch_to_user_pcb_x86_64;

src/arch/x86_64/context/switch/retry_unsaved.rs

@@ -0,0 +1,27 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+/*
+ * No saved context yet: the task was woken on another CPU while the CPU it
+ * runs on had not finished yielding it. Parking it Sleeping with no deadline
+ * lost it for good, since the wake had already been spent. Park it on a one
+ * tick deadline instead, so the sweep retries once its context is saved,
+ * without the core re-picking it in a loop.
+ */
+pub(super) fn retry_unsaved(pid: u32) {
+    let retry_ms = crate::time::timestamp_millis().saturating_add(1);
+    crate::process::scheduler::dispatch::sleep_until(pid, retry_ms);
+}

src/hardware/broker/irq/dispatch.rs

@@ -65,9 +65,10 @@ pub fn on_vector(vector: u8) {
         slot.overflow.fetch_add(1, Ordering::AcqRel);
     }
 
+    /* Try only: code this ISR interrupted may hold the waiter's state. */
     let waiter = slot.waiter.swap(0, Ordering::AcqRel);
-    if waiter != 0 {
-        crate::sched::wake_process(waiter);
+    if waiter != 0 && !crate::process::scheduler::dispatch::try_wake::try_wake_process(waiter) {
+        let _ = slot.waiter.compare_exchange(0, waiter, Ordering::AcqRel, Ordering::Relaxed);
     }
 
     crate::interrupts::apic::send_eoi();

src/interrupts/handlers/exceptions/fault_address.rs

@@ -0,0 +1,26 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+use x86_64::registers::control::Cr2;
+
+/*
+ * Raw read: `Cr2::read` panics when CR2 is not canonical, and QEMU TCG
+ * loads CR2 on a non-canonical access too. The fault is still handled
+ * (and a user process killed) instead of panicking the kernel.
+ */
+pub(super) fn fault_address() -> u64 {
+    Cr2::read_raw()
+}

src/interrupts/handlers/exceptions/mod.rs

@@ -22,6 +22,7 @@ pub mod debug;
 pub mod device;
 pub mod divide;
 pub mod double_fault;
+mod fault_address;
 pub mod floating_point;
 pub mod gpf;
 pub mod machine_check;

src/interrupts/handlers/exceptions/page_fault.rs

@@ -15,7 +15,6 @@
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
 use crate::memory::addr::VirtAddr;
-use x86_64::registers::control::Cr2;
 use x86_64::structures::idt::InterruptStackFrame;
 
 use super::context::{log_page_fault, ExceptionContext, PageFaultContext, PageFaultErrorCode};
@@ -32,7 +31,7 @@ use crate::security::observability::redact::redact_address;
 pub fn handle(frame: InterruptStackFrame, error_code: u64) {
     let _ctx = set_interrupt_context();
 
-    let accessed_address = Cr2::read().as_u64();
+    let accessed_address = super::fault_address::fault_address();
     crate::arch::x86_64::diag::dump_trap(b"PF", &frame, Some(error_code), Some(accessed_address));
     let exception = ExceptionContext::from_frame(&frame);
     let error = PageFaultErrorCode::from_bits(error_code);

src/kernel_core/process_spawn/capsule_spawn/runner/install/priority.rs

@@ -27,9 +27,32 @@ use crate::process::core::Priority;
 const INTERACTIVE: [&str; 4] =
     ["driver.ps2_kbd0", "input_router", "compositor", "driver.virtio_gpu0"];
 
+/*
+ * Capsules that move a frame between the card and TCP: the card drivers and
+ * the stack, which is where acknowledgements are made. They park the same way
+ * (`mk_irq_wait`, `mk_ipc_recv_from` with a timeout), so the band stays empty
+ * on an idle network. In the Normal band a wake queued behind every runnable
+ * capsule, and a capture of a 92 KB page load showed a median of 230 ms
+ * between the guest's acknowledgements, which set the pace of every
+ * slow-start round.
+ *
+ * `net.sockets` and `net.tcp` stay Normal: they wait for a connection by
+ * yielding in a loop, and two of those in this band could hold it for a whole
+ * connect timeout.
+ */
+const PACKET_PATH: [&str; 7] = [
+    "driver.virtio_net0",
+    "driver.e1000_0",
+    "driver.rtl8169_0",
+    "driver.rtl8139_0",
+    "driver.iwlwifi0",
+    "driver.rtl8821ce0",
+    "net.core",
+];
+
 /// Scheduling band a freshly installed capsule starts in.
 pub(super) fn for_capsule(name: &str) -> Priority {
-    if INTERACTIVE.contains(&name) {
+    if INTERACTIVE.contains(&name) || PACKET_PATH.contains(&name) {
         Priority::High
     } else {
         Priority::Normal

src/kernel_core/surface_registry/attach_map/mod.rs

@@ -19,6 +19,7 @@ mod forget_handle;
 mod forget_pid;
 mod lookup;
 mod record;
+pub mod snapshot;
 mod state;
 
 pub use forget::forget;

src/kernel_core/surface_registry/attach_map/snapshot.rs

@@ -0,0 +1,30 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+use alloc::vec::Vec;
+
+use crate::kernel_core::surface_registry::attach_map::state::ATTACHES;
+use crate::kernel_core::surface_registry::types::SurfaceHandle;
+
+/* True when a process other than `owner` holds an attach record for `handle`. */
+pub fn has_foreign_holder(handle: SurfaceHandle, owner: u32) -> bool {
+    ATTACHES.lock().iter().any(|r| r.handle == handle && r.pid != owner)
+}
+
+/* (handle, base_va) of every attach record held by `pid`. */
+pub fn records_of(pid: u32) -> Vec<(SurfaceHandle, u64)> {
+    ATTACHES.lock().iter().filter(|r| r.pid == pid).map(|r| (r.handle, r.base_va)).collect()
+}

src/kernel_core/surface_registry/mod.rs

@@ -19,6 +19,7 @@ mod dump;
 #[cfg(feature = "input-probe-inject")]
 pub mod inject;
 pub mod input_ring;
+pub mod pin;
 pub mod release;
 mod ring_math;
 pub mod share;

src/kernel_core/surface_registry/pin/claim_owned.rs

@@ -0,0 +1,73 @@
+// NONOS Operating System
+// Copyright (C) 2026 NONOS Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+use alloc::vec::Vec;
+
+use crate::kernel_core::surface_registry::attach_map::snapshot::{has_foreign_holder, records_of};
+use crate::kernel_core::surface_registry::table::SLOTS;
+use crate::kernel_core::surface_registry::types::{encode_handle, SurfaceHandle};
+
+use super::frames_of::frames_of;
+use super::window::Window;
+
+/*
+ * Surfaces `pid` registered from [addr, end) stop being attachable: their
+ * frame list leaves the slot. A fully unmapped window that another process
+ * still has attached becomes an orphan the registry frees later. A partly
+ * unmapped attached window stays live and keeps the unmapped frames
+ * allocated. Caller holds the gate, so no attach runs meanwhile.
+ */
+pub(super) fn claim_owned(pid: u32, addr: u64, end: u64, out: &mut Vec<Window>) {
+    let mut hits: Vec<(usize, SurfaceHandle, bool)> = Vec::new();
+    for (idx, entry) in SLOTS.lock().iter().enumerate() {
+        let Some(slot) = entry.as_ref() else { continue };
+        let base = slot.owner_base_va;
+        let win_end = base.saturating_add(slot.frames.len() as u64 * 4096);
+        if slot.owner_pid == pid && !slot.frames.is_empty() && base < end && addr < win_end {
+            let whole = addr <= base && win_end <= end;
+            hits.push((idx, encode_handle(idx as u32, slot.epoch), whole));
+        }
+    }
+    for (idx, handle, whole) in hits {
+        let attached = has_foreign_holder(handle, pid);
+        let mut slots = SLOTS.lock();
+        let Some(slot) = slots[idx].as_mut() else { continue };
+        if encode_handle(idx as u32, slot.epoch) != handle || slot.owner_pid != pid {
+            continue;
+        }
+        let base = slot.owner_base_va;
+        if !attached {
+            slot.frames = Vec::new();
+        } else if whole {
+            let mut w = Window::held(base, core::mem::take(&mut slot.frames));
+            w.orphan = Some((pid, handle));
+            out.push(w);
+        } else {
+            out.push(Window::held(base, slot.frames.clone()));
+        }
+    }
+}
+
+/* Windows `pid` attached from other owners that overlap [addr, end). */
+pub(super) fn foreign_windows(pid: u32, addr: u64, end: u64, out: &mut Vec<Window>) {
+    for (handle, base) in records_of(pid) {
+        let Some((owner, frames)) = frames_of(handle) else { continue };
+        let win_end = base.saturating_add(frames.len() as u64 * 4096);
+        if owner != pid && base < end && addr < win_end {
+            out.push(Window::held(base, frames));
+        }
+    }
+}