drv-rtc-cmos

drv-rtc-cmos is the private CMOS real-time-clock provider for EriX. It reads one stable UTC wall-clock sample and submits that sample to timed over a dedicated authenticated route.

EriX is a clean-room, capability-based microkernel operating system written entirely in Rust. Project design documents live in the docs repository.

Purpose of This Repository

The maintained responsibilities are:

• validate the exact RTC1 startup tail and live capability inventory
• access only the kernel-mediated read-only CMOS RTC selector/data operations
• require update-in-progress to be clear around two identical snapshots
• decode BCD or binary and 12-hour or 24-hour RTC representations
• convert validated UTC civil fields in years 1970 through 9999 to Unix seconds
• submit one whole-second sample through the private send-only timed route
• report ready only after timed accepts that sample; when one bounded hardware attempt yields no valid sample, report optional-provider readiness without submission so timed remains explicitly unavailable
• terminate after acknowledgement so all temporary hardware/provider authority is torn down with the process

The driver cannot write CMOS data, set the clock, mask NMI, select unrelated CMOS storage, discover timed through named, or receive public time queries. Its fixed selectors are seconds (00), minutes (02), hours (04), day (07), month (08), year (09), status A/B (0A/0B), and the QEMU-default century register (32).

Runtime Packaging

drv-rtc-cmos is a post-mount executable. It belongs on the ext4 runtime partition and must be materialized and started through loaderd/dynlinkd/procd; it is not a boot.img executable. The local linker contract produces an ELF64 x86_64 position-independent executable with drv_rtc_cmos_entry as its entry. A distinct terminal 32-KiB writable reserve backs the downward-growing entry stack without overlapping the driver's ordinary IPC state.

Development

cargo fmt --all -- --check
cargo clippy --all-targets --all-features -- -D warnings
cargo test --all-targets --all-features
RUSTFLAGS='-D warnings' cargo build --all-targets --all-features
RUSTFLAGS='-D warnings -C link-arg=-Tlinker.ld' \
  cargo build --target x86_64-unknown-none --features drv-rtc-cmos-runtime
RUSTDOCFLAGS='-D warnings' cargo doc --no-deps --all-features

Integration may additionally compile the runtime with drv-rtc-cmos-integration-malformed-sample. That adversarial build changes only the serialized descriptive nanosecond field to its first invalid value. It constructs the otherwise canonical body before the deliberate wire mutation, then reports ready only after timed returns the exact correlated rejection with no accepted sequence. Production profiles never select the feature, and it adds no route, selector, or capability.

Internal dependencies use full 40-character commit rev pins: lib-bootstrap, lib-capabi, lib-ipc, lib-time, and ipc-syscall-x86_64. Integration and CI caches preserve the selected Git objects. No external crates are used.

Clean-Room and Authority Policy

No external source code or crate may be copied into this repository. All runtime authority must arrive through the documented startup capability transfer, must be validated before use, and must not survive beyond the one-shot provider lifetime. Clean provider exit after readiness is the expected lifecycle, not a restart-triggering service failure.

License and Contact

The repository uses the ISC License. Development occurs in the EriX organization; maintainers can be reached at admin@erikinkinen.fi.