EriX Block Device Daemon (blockd)

blockd is the mediated storage service for the storage stack. It consumes raw block providers from deviced, validates GPT media through lib-partition, and publishes a logical block namespace through lib-block.

EriX is a clean-room, capability-based microkernel operating system written entirely in Rust.

Technical requirements are tracked in the EriX requirements, conventions, and project documentation.

See:

• docs for design documents, specifications, and development plans.
• Related architecture repositories for kernel, services, libraries, drivers, and integration tooling.

Purpose of This Repository

This repository implements the EriX block-storage mediation service. Its purpose in EriX is to turn raw block-provider access into a geometry-bounded logical block namespace for storage consumers.

Functionally, it validates GPT metadata, publishes whole-disk and partition devices, and translates bounded logical I/O to the active block provider. The repository keeps the implementation, interface contracts, tests, and documentation for that behavior in one reviewable ownership boundary.

The maintained responsibilities are:

• validate startup authority and bind only to providers explicitly streamed by deviced
• defer provider resolution and GPT namespace publication into the request path instead of blocking the startup frame or starving client calls
• discover GPT media and publish the complete format-declared whole-disk and active-partition namespace
• retain only the most recently resolved partition geometry while one provider binding is live, avoiding repeated full GPT scans for sequential filesystem I/O without imposing a partition-count ceiling
• translate logical block requests into provider-relative reads and writes
• reserve enough private runtime stack for the dynamic GPT namespace scan and synchronous provider RPC path
• keep storage publication deterministic and fail closed on malformed media

Clean-Room Policy

EriX follows a strict clean-room philosophy:

• No external source code may be copied.
• No external Rust crates are allowed.
• No code generation tools that embed third-party code.
• All code must be authored within the project.

Violations will result in rejection of the contribution.

License

All EriX repositories are licensed under the ISC License.

Development Model

EriX development is modular, deterministic, reproducible, authority-explicit, security-first, and self-hosting oriented.

This repository follows the project roadmap and the validation rules documented in its own roadmap.

Validation

• cargo fmt --all -- --check
• strict clippy with warnings as errors
• standalone crate CI through ../integration/scripts/setup-component-ci-overrides.sh so internal Git dependencies resolve from exact commit pins without cross-repo path deps
• local unit tests for transport framing and GPT publication logic
• full VM integration through integration storage scenarios
• Cargo.toml pins lib-block / lib-partition with full 40-character commit rev values; local validation preserves those Git objects in generated Integration caches without branch-head or synthetic-commit substitution

Dynamic Boot Artifact Evidence

The image build packages blockd as an ELF64 x86_64 ET_DYN executable with .erix_dynlink metadata in the signed dynlink-store and mirrors it under /lib/erix/dynlink with its required shared objects.

Startup remains rootd through procd staged dynamic creation before dynlinkd; authority remains explicit deviced/provider and block HAL peers. Dynamic packaging and filesystem mirror records are evidence and launch inputs only; they do not grant filesystem, loader, object-store, service-discovery, provider-bypass, block-device, or dynlinkd authority. blockd receives only the documented startup endpoints, peers, and capabilities for its role.

Governance Principles

blockd governance is scoped to mediated block-device publication and partition-relative I/O.

The scoped governance rules are:

• It may publish only devices derived from explicit provider-resolution authority and validated partition metadata.
• It must reject malformed GPT state instead of exposing ambiguous storage authority.
• It keeps partition translation deterministic and bounded by the discovered device geometry.
• It streams the complete GPT entry array through lib-partition, commits provisional entries only after the final CRC succeeds, and imposes no provider-local partition-count or entry-array-byte ceiling.
• It accepts and forwards exact data-bearing block fragments. Unused IPC capacity is never encoded as padding, and the only per-fragment bound is derived from the canonical kernel transport envelope. Provider-read capacity is derived from the selected device geometry, while the transport accepts a header-only typed error reply instead of mistaking capacity for a mandatory response length.
• It treats writes as explicit block authority delegated by deviced, never as ambient disk access.
• Once a block request is accepted, transient reply-delivery backpressure is yielded through until the kernel accepts the authoritative response or returns a terminal error; no service-local tick count abandons the reply.
• Its provider write-transfer buffer is service-static caller-owned storage; the shared block helper does not hide a full transport envelope on the runtime stack. Request snapshots and provider read/call responses likewise use single-thread-owned static storage. Compiler stack metadata reports a 10,440-byte largest frame, so the 64 KiB private reserve retains conservative nested-call headroom without granting device, filesystem, or loader authority.

Authority Boundaries

• blockd receives its service endpoint and dedicated deviced HAL-registration and provider-resolution endpoints. Provider authority arrives one endpoint at a time at the caller-selected transaction slot.
• It does not receive broad kernel-control, filesystem-provider, or driver-management authority.
• Required deviced HAL registration, provider resolution, and provider I/O have no arbitrary local acceptance or retry ceiling. Every accepted call retains its message storage until the authoritative reply arrives.
• Runtime calls and ordinary peer replies carry no authority. Unexpected receipts are retired before rejection; malformed or uncleanable receipt state fails stop.
• Successful provider resolution accepts exactly one correlated send-only endpoint receipt from the deviced per-instance interval into the requested slot. Missing, extra, mis-typed, or over-righted receipts are rejected and retired.
• Enumeration returns separate full-width opaque provider and format-defined GPT namespace cursors, so neither domain is narrowed by the mediator. Before switching providers or returning from an error, blockd retires the current endpoint; it never accumulates a provider table.

Contact

Development occurs in EriX organization and discussions happen in issues and design documents.

No decisions are considered valid without documented rationale.

Maintainers can be reached via email: admin@erikinkinen.fi.