v0.4.2

SavanXP v0.4.2 — summarized change list: the opening line of each entry. Full detail in CHANGELOG.md ([0.4.2] — 2026-11-06).

Highlights

• First boot on real hardware. The ISO, written to a USB stick, boots an AMD desktop (Zen, 400-series chipset, UEFI) and is driven by its USB keyboard and mouse.
• A USB stack on xHCI: keyboards, mice and tablets next to PS/2 and virtio, USB sticks as disks, hubs, and hot plug.
• FAT and Disk Management, users, permissions and elevation, SxGL and Nightwood, the first game on the native API.

Download

SavanXP-v0.4.2.iso is a LiveCD that boots through BIOS and UEFI: from a CD image in QEMU (q35, 512 MiB of RAM or more), or written to a USB stick (dd, or Rufus in DD image mode) on a real PC with an x86_64 CPU and Secure Boot off. The Limine menu adds boot log on screen and no USB entries for real hardware. The system volume loads into RAM, so changes do not survive a reboot. The live system sees the machine's SATA and USB disks (not NVMe); only Disk Management writes to them, and only when asked. The image is the plain system build plus the Doom port with the Freedoom: Phase 1 IWAD (freedoom1.wad, BSD-3-Clause; license in FREEDOOM-LICENSE.txt). The FFmpeg port, the Media Player and Celeste Classic are not included. Checksums in SHA256SUMS.

Added

• Boot options for real hardware
• xHCI on real hardware
• USB hubs and hot plug
• USB sticks
• USB keyboards, mice and tablets
• USB: xHCI controllers and device enumeration.
• QEMU machines with USB
• System Properties
• Disk Management mounts FAT volumes
• A FAT driver, and the boot volume at /boot
• Disk Management
• Files: Explorer toolbar and address bar
• Files: Large Icons view
• Display Properties
• Desktop icons and shortcuts
• Context menus in applications
• The kernel lock reports its contention
• Task Manager: Applications tab
• Task Manager: one CPU graph per core and kernel times
• Task Manager: User Name, CPU Time and Threads columns, sort by header, End Process Tree
• SUN programs can use the SXGUI toolkit
• SUN programs can read the process table and the system
• SxFS records an owner, a group and a mode on every inode
• Every process carries an identity, and the VFS checks it
• Elevation: a program can run with the system's rights once the user says yes
• SxGL, the 3D rasterizer: a documented OpenGL 1.1 fixed-function subset in software
• Nightwood, the first game written against SUN
• SUN programs can play sound
• A window can capture the pointer
• SAVANXP_QEMU_DISPLAY=sdl opens QEMU with SDL instead of GTK

Changed

• The user's settings live in /users/user/Settings
• The development boot drive is attached as fat:<dir>,snapshot=on
• Only a driver marked can_be_root mounts /
• GPT tables are checked before they are used
• The version shows the build number
• The Start menu opens without the one-second wait
• Smokes and tools/shoot.sh boot at the default resolution
• Clicking the desktop gives it the keyboard
• A kernel panic or ring-0 fault stops every core
• Device interrupts go to the APs
• QEMU boots two cores by default
• Task Manager is a SUN program
• SXN_SYS_TERMINATE follows kill's rule
• The taskbar looks like Windows NT 4.0's.
• Gears draws with SxGL
• The elevation prompt shows every argument
• The desktop runs as the user
• Add or Remove Programs asks for elevation
• Settings live in the user's profile
• The system runs from its disk, mounted at /
• The initramfs is a rescue system
• The kernel is written against namespace arch
• The userland runtime's units are listed once
• SXGFX, SXCHROME and SXGUI-C left the POSIX SDK for the platform layer
• The WM protocol headers moved to include/wm/
• The VFS reaches filesystems only through fs::Driver
• Input drivers register with the kernel's input layer
• SUN programs are named <name>.sxe on disk

Fixed

• Booting without a PS/2 controller hung
• A FAT volume over a whole disk is no longer read as an MBR
• Asking for a volume's usage no longer stalls the system
• POSIX open with no access mode returns EINVAL
• A port can no longer be sent over a pipe
• A program started by name from the Command Prompt shows its own title and icon
• The APs start on processors without SMEP
• Four cores under QEMU TCG no longer crawl
• Task Manager's End Process works on processes that are not the user's
• A held key no longer answers the elevation prompt
• Add or Remove Programs refuses a data_dir under /users
• elevation-smoke runs from a clean checkout
• taskbar-smoke passes again.
• CMake uses the python3 on PATH

v0.4.1

SavanXP v0.4.1 — summarized change list: the opening line of each entry. Full detail in CHANGELOG.md ([0.4.1] — 2026-10-23).

Download

SavanXP-v0.4.1.iso is a LiveCD that boots through BIOS and UEFI (tested in QEMU, q35, with 512 MiB of RAM or more). The system volume loads into RAM, so changes do not survive a reboot. The image is the plain system build plus the Doom port with the Freedoom: Phase 1 IWAD (freedoom1.wad, BSD-3-Clause; license in FREEDOOM-LICENSE.txt). The FFmpeg port, the Media Player and Celeste Classic are not included. Checksums in SHA256SUMS.

Added

• Native processes can have threads.
• Each native thread has its own %fs and %gs.
• Native threads can sleep on a word of memory.
• POSIX programs can use threads.
• AHCI (SATA) disk driver with DMA.
• The Command Prompt, the first SUN application.
• SUN windows choose their size, title and icon, and present rectangles.
• SUN gets CreatePipe and CreateProcess with chosen handles.
• The Start menu shows ▲/▼ arrows when its list does not fit.
• Native programs have a heap.
• SXN_SYS_SPAWN_STDIO and SXN_SYS_SET_NONBLOCKING.
• SXN_SYS_PROCESS_QUERY tells a native process about any other.
• SXN_SYS_WAIT_MANY, and pipes and devices can be waited on.
• sessiond, the session manager.
• SXN_SYS_TERMINATE ends a child.
• Ports, and POSIX on the native floor.
• Native calls for handles, devices and time.
• Window roles and global hotkeys for the shell.
• Web Viewer (/bin/webview), a local HTML viewer in the spirit of IE 1.1.
• Web Viewer gains its browser chrome.
• Web Viewer fetches http:// pages from numeric IPs, follows links and redirects, and shows source.
• Web Viewer paints a first CSS.
• Web Viewer resolves names through DNS.
• The taskbar shows a W2K-style clock that opens a calendar.
• Manual date/time setting (/bin/date, SET_REALTIME).
• Automatic time sync (/bin/ntpsync, ntp-smoke).
• Paint (/bin/paint), in the Accessories group.
• Paint gains brush, eraser, picker and undo.
• Paint gains a flood-fill bucket.
• libsximg.so.0.4, a PNG decoder the tree builds and installs in /disk/lib.
• --gui external applications link the window-chrome module.
• GitHub Actions CI (.github/workflows/ci.yml) on every push and pull request.
• <dlfcn.h>: dlopen, dlsym, dlclose, dlerror and dladdr for PIE programs.

Changed

• Every house icon is redrawn in a Windows 2000 look
• The Start menu draws each program's own 16x16 icon
• Static programs map their ELF headers.
• The kernel schedules threads, not processes.
• Disk writes are written back in the background.
• Disk writes are ordered by explicit flushes.
• The libc FILE buffer is 4 KiB
• SxFS commits write only the metadata sectors that changed.
• The taskbar's Start label uses the caption font.
• The visual harness opens programs through the Command Prompt.
• AltGr never triggers a hotkey.
• Program Manager no longer opens with the session.
• The desktop's text is Wine's MS Sans Serif, crisp and 1-bit.
• malloc's page source is a replaceable hook.
• The platform services live in system/.
• Application frames go straight to compositord.
• compositord composes the desktop.
• compositord is a session service.
• windowd is a native process.
• compositord connects to windowd through a private port.
• Closing a window asks the program; a hung one gets an End Program dialog.
• The shell role goes to a process the session started.
• Programs connect to windowd for a window (WM protocol v5).
• Each window publishes its own title, icon, accent and style.
• compositord is a native process.
• Ctrl+Esc opens the Start menu, Ctrl+Shift+Esc opens Task Manager, and Alt+Tab shows its own switcher.
• The shell is one /bin/desktop process.
• New app-paint and app-webview icons.
• The system edition is centralized as SAVANXP_EDITION.
• The native syscall dispatcher is a separate kernel unit.
• The kernel has an sx:: native surface.
• The POSIX dispatcher is a separate translation unit.
• The native ABI is standalone, with its first guest test.
• Neutral sx:: sync primitives.
• Native spawn/wait (SXN_SYS_SPAWN, SXN_SYS_WAITPID).
• Native event/section/wait syscalls plus the sxn.h userland surface.
• First native window, proven inside real windowd.
• Native input ring plus the sxnwm.h toolkit seed.
• Native widgets with scripted interaction.
• Real PS/2 keys into a native form, native apps in the launcher.
• POSIX translation out of the kernel.
• The kernel stops including the POSIX SDK.
• The current directory leaves the process state.
• The kernel no longer parks processes for poll().
• POSIX signals leave the process state.
• The smoke runner no longer leaves a QEMU behind when it is killed.
• A wedged disk is reset instead of failing the operation.
• The error space belongs to the kernel.
• Native IPC proven over sections plus events.
• Neutral sx:: sections, views and waits.

Removed

• The icon generators are no longer in the repository
• Eight redundant test programs.
• SDK examples that duplicated in-tree programs.
• shellapp, the old terminal window.
• The BusyBox port.
• The Task List.
• /bin/shellui, /bin/taskbar, /bin/startmenu, /bin/volumepopup, /bin/clockpopup and /bin/kbdlayoutpopup, now part of /bin/desktop, and the four shell launch flags
• The Haxe native experiment is removed.

Fixed

• clear in the Command Prompt no longer loses the prompt.
• A process ended by SXN_SYS_TERMINATE no longer reads as running.
• Windows opened during a fullscreen app get the desktop's size.
• Paint no longer overwrites PNG files or resizes what it opens.
• IDE flushes reach the drive.
• waitpid returns to the parent that is waiting, not to whoever waits first.
• Window titles are sharp.
• windowd-stats lines are back.
• A POSIX program started by a native one has its POSIX state.
• The kernel's text console no longer stalls the machine when it scrolls.
• Leaving fullscreen right after compositord died left the screen in the low mode.
• Minimizing a window from the taskbar left the next window's caption inactive.
• A clean checkout builds again.
• tools/verify_doom_persistence.sh runs on any host.
• ./build.sh test builds and passes again.
• The loader no longer holds a descriptor per library, nor leaks a failed load's segments.

v0.4.0

SavanXP v0.4.0 — summarized change list: the opening line of each entry. Full detail in CHANGELOG.md ([0.4.0] — 2026-10-08).

Added

• Per-song GENMIDI bank in libsxmidi.
• libsxmidi.so.0.4, a General MIDI synthesizer the tree builds and installs in /disk/lib.
• The DoomGeneric port has music.
• The port's music is checked on the guest audio, and on what follows it.
• Three SpicyGame pixel fonts join the baked set.
• Start menu (trimmed): Start button plus a flat Programs list.
• The Start menu gains a footer, a banner strip, a logo button and a self-listed launcher.
• libffmpeg.so.0.4, FFmpeg's five components as one shared library.
• The Media Player is a program that depends on a library.
• The Media Player is a program of the system tree, and the FFmpeg port builds no program at all.
• A program whose library is missing now says so and keeps running.
• A missing dependency no longer leaves the program unrelocated, and no longer takes the rest of them with it.
• The loader applies R_X86_64_64.
• libgfx2d.so.0.4, the 2D painter and window chrome, as a shared library.
• Up to 32 shared libraries per process, instead of 8.
• The library loader no longer leaks a descriptor per library.
• A rebuilt program now reaches the bootable image.
• The visual scenarios now assert the glyphs on screen, not just that something moved.
• A program can now ask the loader which dependency failed to load.
• The Media Player is built position-independent.
• Two Media Player smoke scenarios are removed.
• A missing shared library is now recorded as reported by the application itself.
• Dead code in the binaries is now measured against what would recover it:
• A relocation type the loader does not implement now says so,
• Three more loader failures now say what they are, and each has a self-test.
• The library loader says which symbol it could not resolve.
• The runtime for external applications is derived from the one for the system's own programs
• The build now fails if a program carries its own copy of a library it loads.
• The kernel now tells a program where its own image starts.
• libsxgfx.so.0.4, the graphics layer, as a shared library.
• sxgui-smoke, which drives the visual scenario as a smoke test.
• libsxgui.so.0.4, and ten programs now draw through it.
• ldso_symbol_is_shared()
• sx_start_dynamic reports a failing interpreter.
• calc now links as a PIE
• crt0 now runs the library loader before main.
• libtest, the first program that links against a shared library.
• The loader relocates the executable, not just libraries.
• The executable is now in the library loader's symbol scope.
• A library now loads the libraries it declares.
• pietest, the first PIE executable in the tree.
• The kernel loads ET_DYN images with a load bias.
• The kernel reads PT_INTERP and hands the path to crt0.
• libmath.so.0.4, a real shared library, and a minimal loader that maps it.
• section_open_range backs a section with part of a file.
• section_open maps a file into a read-only section.
• map_view_at maps a section view at an address the caller chooses.
• savanxp_system_info reports live section counts.
• SAVANXP_SECTION_EXEC maps a section view as executable.
• fscheck reports SxFS consistency from inside the system.
• Celeste Classic is now an official port.
• The SDK now owns Doom-style pixel presentation and timed PCM mixing.
• Linux builds can now be driven by Bash and CMake.
• Official ports now have a versioned layout.
• DoomGeneric now has a versioned official port.
• The optional Haxe subsystem now has a standalone Linux build.
• Linux now has a headless smoke runner.
• Linux smoke orchestration now covers audio, TCP, and external native apps.
• Linux build commands now match the one-word smoke aliases and SDK install destinations.
• The host sxfs-cli check command validates SxFS metadata.
• SxFS images now compact safely when fragmentation blocks an apply.
• Stack canaries are randomized at kernel boot and for every new process.
• Kernel security boundaries are documented and enforced.
• Alt+F4 closes the active window,
• System name and version at the bottom right of the desktop,
• Dialogs are windows of their own.
• Media Player is now a system application in Accessories.
• The FFmpeg port decodes the common formats.
• Gears (/bin/gears), in the Diagnostics group.
• Fixed-size windows: window_flags=fixed_size in a .sxres.
• Floating point in every app of the image.
• docs/SXGL_ROADMAP.md.
• Calculator (/bin/calc), in the Accessories group.
• Minesweeper (/bin/mines), in the Games group.
• System master volume and mute.
• Taskbar volume button and popup.
• sx_audio_mixer_set_voice_loop.
• Celeste Classic now plays music.
• Two programs can now sound at once.
• Per-application volume.
• Per-application sliders in the volume popup.

Changed

• Doom music now plays the WAD's OPL2 instruments.
• The MIDI bank stopped being one waveform per family.
• The calculator's arithmetic now comes from libmath.so.0.4.
• The calculator shows 15 significant digits instead of 16
• Section budgets raised: 64 section views per process, 256 sections system-wide.
• Two PT_LOAD segments may now share a page.
• The ELF loader reports which program header it rejected.
• The section cache keys on the file range, not just the inode.
• savanxp_system_info reports live section counts
• Window caption bars are two pixels taller.
• The test machine now boots with 1 GiB of RAM
• SxFS format v2: 4096 inodes and a 1 GiB ceiling.
• ATA now splits large requests instead of rejecting them.
• fscheck reports metadata commit cost.
• The development path no longer carries the persistent volume as a boot module.
• build/disk.img may now be larger than the volume inside it.
• Window titles use RetroSans instead of Noto Sans.
• Active captions follow the declared accent instead of tinting the blue base.
• init relaunches the audio daemon only when it dies serving.
• The test machine now boots with 512 MiB of RAM
• Window title text is now one pixel smaller and bold.
• Normal builds no longer regenerate desktop source icons.
• Gears (/bin/gears) has a redesigned app icon.
• The About app now identifies the system as the Alpha edition.
• The boot screen fades in from black, like a classic desktop splash.
• Visual desktop verification uses the native Bash launcher.
• Linux Program Manager and Add/Remove Programs smokes restore Doom when its external ELF exists.
• Doom persistence now has an isolated Linux regression command.
• ISO verification now covers El Torito plus BIOS and UEFI boot.
• WM↔client protocol v4: the session opens all 12 windows.
• The automated smokes honour --accel.
• The system 3D edges moved to savanxp/sxchrome.h, out of the toolkit.
• The userland links with --gc-sections.
• The managed app layer (Haxe on a VM) is deferred until after v1.0.
• About is now System Properties.
• The Shell window opens and repaints far faster.
• The compositor accumulates damage as an exact region.
• tools/shoot.sh drives other hardware and loads the display path.
• Launcher icon captions wrap to two lines.
• The boot screen is now a splash with the project logo.
• The splash bar keeps moving through the long boot steps.
• All repository documentation is in English, and the README leads with a quickstart.
• The filesystem is now called SxFS, and the 2 leaves the name.
• assert() reports when it fails.
• struct stat has the fields third-party code names.
• exec no longer copies the whole image into physically contiguous pages.
• The user stack goes from a fixed 128 KiB to 1 MiB on demand, with a guard page.
• spawn/exec accept 128 arguments and 8 KiB total, instead of 15 arguments of 63 characters.
• Streams read in batches and malloc aligns to 16.
• The libc stops renaming with #define: the standard names are now real symbols.
• One userland runtime and one printf.
• icon= in progman.ini points at a program, not at an art catalog.
• The sxgui chrome moves to the Win95 two-pixel bevel.
• The sxgui apps share a single layout grid.
• tools/shoot.sh gains the files scenario.
• The keyboard event carries the modifiers.

Removed

• The SxMedia multimedia layer is withdrawn, and the Media Player is the optional FFmpeg port again rather than a system program.
• The alternate host compatibility surface is removed.
• The legacy SDK trees for Doom and FFmpeg are removed.
• The wavinfo and player FFmpeg demos.
• The icon set baked into desktop_icons.h is down to one.
• The start menu strip art is deleted.
• The eight hand-written coreutils in subsystems/posix/userland are deleted.

Fixed

• Celeste's effects no longer saturate at any volume.
• A jittery audio stream is concealed instead of zeroed.
• Changing the music no longer stalls the game for a second.
• A missing library is now named deterministically, and counted.
• The emulated disk transfers 32 bits per port access instead of 16
• Four loader diagnostics can now fail.
• The launcher's baked table and the manifests agree.
• The visual smoke scenarios work on a virtio machine.
• Moving the mouse over a virtio machine no longer freezes the VM.
• smoke_runner_layout_test.py runs again.
• progman-smoke passes again.
• **Relocated global pointers in a PIE no longer bec...