generated from erix/meta
[FEATURE] Define and validate the pure POSIX compatibility ABI #1
Labels
No labels
bug
ci
docs
duplicate
enhancement
help wanted
invalid
performance
phase-6
question
refactor
security
wontfix
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set
Reference
erix/lib-posixabi#1
Loading…
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Problem and motivation
The libc and POSIX service need one versioned ABI for layouts, errors, identifiers and wire framing. Independent definitions would invite mismatched sizes, ambiguous ownership and divergent malformed-input behavior.
Proposed behavior and scope
Implement the x86_64 C and IPC layout/error contract in a pure library with matching C declarations, checked file/time arithmetic and independent layout probes. Publish compatibility rules before dependent services adopt the ABI.
This issue records planned work; its unchecked criteria are not implementation proof. The normative basis is Phase 6 and AC1–AC24.
The next reviewed slice selects POSIX.1-2024 Base as its semantic reference,
with optional interfaces and complete profile coverage recorded separately.
Retain the existing x86_64 LP64/System V integer boundary. This does not publish
conformance feature macros or establish a complete C runtime.
Use original EriX errno assignments with stable append-only numbering:
EACCES=1, EAGAIN=2, EBADF=3, EBUSY=4, ECHILD=5, EEXIST=6, EINTR=7,
EINVAL=8, EIO=9, EMFILE=10, ENFILE=11, ENOENT=12, ENOMEM=13,
ENOSPC=14, ENOSYS=15, ENOTSUP=16, EOVERFLOW=17, EPERM=18, ESRCH=19.
These are EriX ABI choices; POSIX leaves the numeric assignments unspecified.
The initial subset does not exhaust the required errno names. Extend it
without renumbering earlier values, and negotiate the eventual containing
message contract. POSIX error reporting
Add checked positive-i32 Rust values, prefixed C declarations and exact
four-byte little-endian codecs. Keep existing query bytes unchanged. First add
a shared checked representation of the nine existing native IPC result codes
to lib-ipc, then select its reviewed signed original commit for this library.
No dependency on the syscall bridge or kernel is needed.
Mapping requires an explicit operation context: user-service transport RETRY
retains an accepted pending request, completed kernel wait RETRY can mean no
event only when queue initialization is independently established, and a process-stop service RETRY can follow an already-issued kill.
Unknown codes, missing context, pending effects and uncertain cleanup remain
distinct outcomes. They must not become a generic errno or trigger resubmission.
Only established terminal conditions map to the finite errno subset; confirmed
partial byte progress takes precedence over interruption/nonblocking failure.
No unchecked output length or failed reply can assert that progress.
POSIX read semantics
This slice requires literal C/Rust numeric and codec probes, native-code/domain
negatives, pending/partial-I/O and cleanup precedence tests, strict checks for
both pure libraries and their original dependency closure. Actual runtime
adapters, TLS errno storage and complete native operation mappings remain open.
Published implementation: compatibility PR #3 now contains signed
af01f597fe8d0b18b0559f395ba1437174be24a5, including the numeric byte extent specified below alongside signed file/time arithmetic and the contextual native domain from IPC PR #2. All 35 local checks pass. Each default/all-feature debug/release host configuration passes 55 unit tests and three doctests; strict host/freestanding checks, eight private-rustdoc configurations and 26 Python driver tests pass. GCC/Clang O0/O2 probes pass four host executions, four freestanding links with no named undefined symbols and ten negative controls. All retained parent and non-object C command logs contain no warnings. Numeric extent tests independently check inclusive-end subtraction and literal boundaries; actual C calls preserve raw register/stack aggregates and overflowing field values. The initial generated Cargo lock and original dependency identities remain unchanged. Both current-revision push CI 11 and PR CI 12 pass, with all four complete logs free of warning diagnostics. The matching extent manual/API update is published and validated in the linked documentation PR as detailed below. These results do not implement runtime adapters, pointer intake, clock/file operations or the complete native-error map.The arithmetic slice defines pure
FileOffsetandTimeSecondsvaluescovering every signed 64-bit integer, with infallible scalar construction and
explicit checked addition/subtraction.
TimespecV1has private typed secondsand a canonical fractional field from zero through 999999999. Negative seconds
remain representable; for example, (-1, 999999999) denotes minus one nanosecond.
Construction rejects malformed fractions rather than normalizing them.
The selected numerical contract follows the Issue 8 clock/timer representation.
Matching prefixed C additions use signed-long file-offset/seconds aliases and
struct erix_posix_timespec_v1 { tv_sec, tv_nsec }: both fields are signed64-bit integers, with size16, alignment8 and offsets0/8 on the selected x86_64
LP64 boundary. Raw records accept all integer bit patterns; fieldwise conversion
checks the fraction. Add the mirrored nanoseconds-per-second unit constant.
These are native-memory declarations, with no new wire opcode, standard POSIX
typedef, feature macro or C callable arithmetic function.
Timespec arithmetic applies one fractional carry/borrow in a wide seconds
intermediate before checking the final signed64 range. It must accept the
representable boundary cases (MIN,999999999)+(-1,1)=(MIN,0) and
(MAX,0)-(-1,1)=(MAX,999999999), and reject true overflow. Production arithmetic
needs no division, allocation or total-nanosecond conversion. Reuse the local
Overflow error and add InvalidNanoseconds; neither chooses a POSIX errno.
Meaningful rustdoc and independent literal/oracle boundary tests accompany the
C layout, scalar/record call and callback probes under the existing GCC/Clang
host/freestanding matrix. Check for exhaustive Error matches when extending it.
Generic values impose no year, filesystem-size, unsigned-native-time or clock
limits. They grant no authority and perform no lookup, IPC or clock/file change.
Negative relative offsets are distinct from an invalid final file position;
Issue 8 lseek
keeps operation errors separate from representation overflow. Future consumers
must specify clock/epoch identity, nonnegative waits, timestamp-update sentinels,
rounding, native conversions and errno precedence. This slice does not implement
those operations, a general timespec argument parser or the complete file/time
ABI. All larger acceptance criteria remain open until their own evidence exists.
The next descriptive addition is a prefixed file-status base, with checked
FileStatusV1,FileModeV1andFileTypeV1values and integer-only raw storage.It follows the POSIX.1-2024 stat semantics
and type requirements.
The proposed EriX LP64 record has size 88, alignment 8 and no padding: unsigned
64-bit filesystem device and file serial at offsets 0/8; unsigned 32-bit mode,
link count, owner and group at 16/20/24/28; signed 64-bit size at 32; and the
existing 16-byte raw timespec at 40/56/72 for access, modification and status
change. Status change is not birth time. These widths and encodings are EriX
choices, not a platform-independent POSIX binary layout.
Use type mask 0170000 and the seven explicit FIFO, character, directory, block,
regular, symbolic-link and socket encodings 0010000, 0020000, 0040000, 0060000,
0100000, 0120000 and 0140000, with permission/special bits 07777. The type field
is an enumeration, not independent flags. Checked mode construction rejects
unknown upper bits and unassigned type encodings. Raw integer storage preserves
every bit pattern. Checked status conversion validates mode first, then access,
modification and change fractions; malformed fractions reuse
InvalidNanoseconds, and invalid mode addsInvalidFileMode. Tests can observemode-versus-fraction precedence; identical fraction errors do not distinguish
the three timestamp checks' relative order.
Retain the full scalar domains for device, serial, link count and owner/group,
including zero and maximum values. Retain every signed size and timestamp second
as descriptive data, while leaving operation-specific meaning to consumers.
Unsigned size-to-
FileOffsetconversion must report the existingOverflowabove the signed maximum, without narrowing or clamping. No new errno, operation
classifier, capability, pointer conversion, IPC message or dependency is added.
The identity pair must distinguish simultaneously existing files; hard links
share their pair, and later reuse is permitted. Link count concerns links
within the underlying filesystem. Scalar records do not authenticate identity,
freshness, ownership, permission or these provider obligations. A native bridge
remains absent: current VFS metadata lacks the required identity pair and uses
zero for unknown values. Neither zero-filled owners/times, represented device
numbers, path hashes nor open-description IDs may fabricate valid stat facts.
Even symbolic-link status requires meaningful identity, owners and timestamps;
only its permission bits are unspecified. stat/lstat requirements
This is a partial prefixed base, not
struct stat,sys/stat.h, Linux binarycompatibility or a conformance declaration. XSI device/block fields, native
translation, clock/epoch validity, ACLs and actual file operations remain open.
Acceptance for this addition requires independent literal layouts and all-field
C/Rust argument, return and callback probes, including the 88-byte memory-class
aggregate after six integer arguments under the existing GCC/Clang host and
freestanding matrix. Add exhaustive low-16-bit mode-domain checks, each unknown
upper bit, full-width scalar boundaries, invalid raw storage and checked-error
tests. Run strict Rust formatting, Clippy, unit/doctest, build and rustdoc checks
and update canonical component documents and the matching manual/API reference.
The signed implementation and actual validation are recorded in the current checkpoint below; native operations and complete ABI acceptance remain open.
Authority, security and reliability
fd, PID, realm and credential values describe state but confer no authority. ABI parsing performs no service lookup or syscall. Reject surplus capability transfer, unknown flags, nonzero reserved fields, invalid identifiers and arithmetic overflow deterministically.
Apply the priority order: security, reliability, then performance. Keep suspected vulnerabilities in the repository’s restricted SECURITY.md reporting channel.
Acceptance criteria
structure layouts and ABI version negotiation.
authority, absence, unsupported operation, interruption, would-block, exhaustion, stale
identity and partial I/O.
and realm identifiers as non-authoritative compatibility data.
Implemented and validated at
edc4fdca7edcc717380979fe79f80602f9cc6429withindependent integer/domain probes and warning-free push CI 3
and PR CI 4.
Definitions and dedicated tests remain unchanged in the scalar successor.
Actual object identity, generation freshness and authority remain runtime-owner duties.
signal/action/set, wait and resource-limit types/constants.
version/reserved-field rules and normalized capability transfer expectations; keep pure ABI
parsing free of syscalls or service lookup.
conversion and deterministic overflow/error behavior.
layout/constant agreement with independent C and Rust probes.
reserved fields, extra capabilities and noncanonical errors.
cross-target and exact-head CI gates before consumers depend on it.
For each implementation slice, retain actual formatting, strict Clippy, unit/doctest and warning-denied build results for all altered Rust repositories and valid configurations. Add relevant runtime VM coverage, monitor older unit/VM regressions in exact-head CI, and update canonical component documents and affected technical-manual/API material. Every authored code file must remain below 1,000 physical lines, with meaningful inline documentation and missing_docs enforcement in Rust crates.
The implemented bounded ABI addition is a pure numeric byte extent.
ByteExtentV1stores privateu64address and byte-length fields, with one checked constructor, scalar getters, emptiness and au128mathematical exclusive end. It accepts precisely the extents whose mathematical end is at most2^64;(u64::MAX, 1)and(1, u64::MAX)are valid endpoint cases, while true overflow returns the existingError::Overflow.A target-gated raw
RawByteExtentV1and Cstruct erix_posix_byte_extent_v1each contain two unsigned 64-bit fields; the selected LP64 C declarations useunsigned long, size 16, alignment 8 and offsets 0/8. Raw-to-checked conversion validates arithmetic only. No pointer conversion/dereference, C callable function, wire message, errno assignment or dependency is added.Numeric zero, empty extents, unaligned/high coordinates and lengths above the signed-count boundary remain representable if the extent fits. These choices do not establish a usable pointer, CPU canonicality, live mapping, provenance, permissions, ownership or lifetime. Operation-specific null/count rules, Rust reference requirements, mapping freshness, concurrent unmapping, cancellation and authority-backed intake remain required runtime contracts. Empty metadata cannot skip an operation's independent error checks.
Acceptance for this descriptive addition requires literal endpoint/domain regressions and an independent inclusive-end subtraction oracle; malformed raw storage must remain representable and fail only checked conversion. Rust and C size/alignment/offset/type assertions and actual C aggregate argument/return/callback/stack probes must preserve high-bit values and field order. Run the existing strict host/freestanding, default/all-feature, optimization, rustdoc and independent C validation without weakening gates. Update canonical component documentation and the selected manual/API reference after signed publication. This addition does not close the complete pointer-intake or runtime implementation criteria above.
Alternatives and tradeoffs
Embedding ABI parsing in each service duplicates security-sensitive validation. Keep shared representation and error rules pure, while leaving policy, kernel mechanisms and storage in their actual owners.
Tracking and rollout
Current file-status source
2417b283c2a82840ce18cf95eb9ca67d99fa2cc9is signed and pushed in PR #3. Rust 1.97.1 formatting, strict Clippy, host/freestanding builds and eight private-rustdoc configurations pass. Each of four host selections passes 66 unit tests and three doctests; all 26 Python driver tests pass. Independent GCC/Clang O0/O2 probes pass four host executions, four freestanding raw links and twelve designated compiler rejections. The C receipt retains 280 actual commands, including 221 original-object reads; all 201 original dependency files correlate. Accepted checks and final documentation are warning-free.Initial Markdown wrapping, object-store selection and probe-scope failures remain preserved. The final raw target probe transports every malformed field and keeps the named-undefined-symbol gate; actual checked conversions execute against the library after both host C returns. No target Rust runtime, native metadata production or stat operation is claimed. Push CI 13 and PR CI 14 both pass for signed
2417b283c2a82840ce18cf95eb9ca67d99fa2cc9. All four complete logs (101,072 bytes) are correlated with the original workflow and checker sources and contain no compiler/lint warning candidates. Each runtime job passes formatting, strict host/freestanding Clippy and builds, 66 unit tests plus three doctests in each development/release selection, private rustdoc, 26 Python tests and the bounded C ABI checker. Detailed C command/artifact counts remain local evidence; inner CI artifacts were not retrieved. Matching Docs7ccbe0bfa83ce5942878fb7cf8c57bb1abe75d00is signed and pushed in Docs PR #4. Its original-source references select ABI2417b283and eighteen-function libc bdcbbea, with 161 and twenty API routes respectively. All 44 documentation tests, both API checks and 55 Markdown files pass. The complete 2,339-page manual passes in 154.64 seconds with zero final warnings; all 425,255 word boxes fit and nine actual previews pass visual review. The first render was interrupted by an outer watchdog that could not observe the inner log; its failed statuses and clean cleanup are retained. The corrected outer budget preserves the inner hard/progress limits, and passing API/unit checks were reused. Matching Docs push CI 837 and PR CI 838 both pass for signed7ccbe0bfa83ce5942878fb7cf8c57bb1abe75d00, ending by 05:58:35 UTC on September 14. All four complete logs total 752,104 bytes and are correlated with the original workflow and build/publish scripts. Each manual job passes 44 tests and finishes at 2,339 pages with zero final-pass warnings; thirty first-pass and one second-pass convergence warnings resolve. Each Markdown job checks 55 files with zero errors. The logged CI PDF size is 4,105,617 bytes; CI artifact bytes and geometry were not independently inspected. Local layout and visual evidence remain separate. This adds no native metadata operation, companion migration or complete guest build result. The following accepted extent/manual evidence applies to the preceding interface.The matching extent API and narrative are now signed and published as Docs
0912e7313c0212cd3be6f06fae7d932174ce087ain Docs PR #4. Fresh original-source export preserves all 137 earlier signatures and adds exactly seven routes. All 44 documentation tests and the complete 2317-page manual pass, with no final warnings or out-of-page word boxes and actual changed-page visual review. Both exact-revision push CI 819 and PR CI 820 pass. Each passes 44 unit tests, 55 Markdown files and the complete 2317-page manual. All four terminal job logs are retained (744804 bytes); reference/rerun diagnostics resolve across LaTeX passes, leaving zero final warnings. CI reports a 4050835-byte PDF; its bytes were not downloaded, and no local PDF hash is attributed to CI.Dependencies: integration#1;
shared native-result work: lib-ipc#1.
Dependencies identify required contracts and closure gates; preparatory inventory/design can proceed in parallel under one owner per edited file. Link bounded implementation issues and their PRs here before claiming acceptance. Use
feature/posix-compat, regular signed commits in the canonical contribution format, and WIP PRs linked to the exact coherent component graph. All cross-repository Cargo/catalog selections and CI helpers use full 40-character lowercase commit hashes, including transitive dependencies; do not substitute branch, tag or implicit HEAD selection.Close criteria only with their own reviewed deliverables and validation evidence. Pending, skipped, cancelled, failed or predecessor-only results remain distinct. Keep main images unchanged until explicit promotion direction; technical completion does not authorize merges, release tags or publication.
Acknowledged terminal consumer dependencies — 21 September 2026: signed commit d5616f1fccc4a705de316a53c3d4d580374cb02d aligns original shared revisions for repeatable terminal observation and exact acknowledgement under Kernel design 20. No local API or capability policy changes. Four strict 69-unit host configurations, four native builds, host/native Clippy, private rustdoc, formatting and dependency checks pass without warnings. Original CI 15, 16 passes; four complete logs total 101,062 bytes with verified hashes and zero warning candidates. Actual service consumer and coherent full VM adoption remain open in phase completion.
[FEATURE] [P05] Define and validate the pure POSIX compatibility ABIto [FEATURE] Define and validate the pure POSIX compatibility ABIerikinkinen referenced this issue from erix/lib-ipc2026-09-12 12:00:32 +02:00