EriX Virtual Space Service (vspaced)

vspaced is the user-space virtual address-space policy service. It governs mapping layout policy and address-space construction above kernel primitives.

EriX is a clean-room, capability-based microkernel operating system written entirely in Rust.

Technical requirements are tracked in the EriX requirements, conventions, and project documentation.

See:

• docs for design documents, specifications, and development plans.
• Related architecture repositories for kernel, services, libraries, drivers, and integration tooling.

Purpose of This Repository

This repository implements the EriX vspace service daemon. Its purpose in EriX is to provide the vspace service role through explicit IPC and startup authority.

Functionally, it implements the daemon runtime, IPC handling, authority admission, and validation tests. The repository keeps the implementation, interface contracts, tests, and documentation for that behavior in one reviewable ownership boundary.

The maintained responsibilities are:

• implement the stateless vspace mediation runtime
• validate startup authority before accepting IPC requests
• handle exactly framed service operations through the assigned endpoint set
• keep service behavior, tests, and authority invariants documented

Clean-Room Policy

EriX follows a strict clean-room philosophy:

• No external source code may be copied.
• No external Rust crates are allowed.
• No code generation tools that embed third-party code.
• All code must be authored within the project.

Violations will result in rejection of the contribution.

License

All EriX repositories are licensed under the ISC License.

Development Model

EriX development is modular, deterministic, reproducible, authority-explicit, security-first, and self-hosting oriented.

This repository follows the project roadmap and the validation rules documented in its own roadmap.

Implementation Status

Runtime baseline:

• no_std executable service binary (x86_64-unknown-none) with SysV entry ABI
• startup envelope parsing/validation via lib-bootstrap
• role/intake contract validation via lib-capabi
• startup ready-state validates actual local slot type/rights with caller-local QUERY_LOCAL_CAP on bare metal and QUERY_CAP in host/test scaffolding
• the host/test QUERY_CAP fallback is cfg-scoped so runtime/release builds remain warning-free
• runtime IPC server loop (RECV + retained REPLY) for map/unmap requests, using the canonical transport capacity and no service-local receive deadline
• primary control slot is the dedicated vspace endpoint SLOT_KERNEL_VSPACE_ENDPOINT (2240)
• deterministic mapping-range and permission validation; the kernel remains the authoritative owner of mapping identity, overlap, and page-table state
• no deployment-sized mapping table or service-local mapping-record capacity
• the emitted runtime image now keeps the declared .stack_reserve reservation after ordinary BSS so the startup stack remains inside explicit in-image stack space instead of colliding with live service state
• vspaced has no registry or logging dependency: it becomes available for virtual-address-space requests before named and logd start
• vspaced does not receive a name-resolution scope, self-register, or hold a broad discovery endpoint

Authority cleanup status:

• runtime map/unmap now pass the delegated local vspace_cap_slot directly to the kernel vspace endpoint
• every operation must deliver exactly the VSpace and frame receipts named by its body, with exact type and rights; arbitrary nonzero destination slots are accepted because the receipt—not a service-local slot range—is the authority
• receipts are checked against the live local capability inventory and retired before any response becomes observable; malformed receipt framing or uncertain cleanup terminates the service while the caller remains blocked
• map and unmap requests use explicit operation identifiers and compact bodies with no reserved compatibility fields
• the map request contains only the delegated VSPACE and frame-capability selectors, virtual range, and permissions; ordinary frames arrive already physically backed, so no flag or caller-supplied physical address exists
• mapping responses carry no authority and are retained through kernel backpressure until delivery or authoritative endpoint loss
• linker garbage collection must not discard the declared stack reserve; vspaced keeps only the canonical .stack_reserve* input explicitly in the runtime stack-reserve output section.

Dynamic Boot Artifact Evidence

The image build packages vspaced as an ELF64 x86_64 ET_DYN executable with .erix_dynlink metadata in the signed dynlink-store and mirrors it under /lib/erix/dynlink with its required shared objects.

Startup remains rootd/kernel process-control before procd is available; authority remains the explicit VSpace-control endpoint and startup transfer set. Dynamic packaging and filesystem mirror records are evidence and launch inputs only; they do not grant filesystem, loader, object-store, service- discovery, provider-bypass, block-device, or dynlinkd authority. vspaced receives only the documented startup endpoints, peers, and capabilities for its role.

Governance Principles

vspaced governance is scoped to virtual address-space service behavior.

The scoped governance rules are:

• It uses only assigned address-space authority for explicit callers.
• It validates map, unmap, and protection requests before changing process address spaces.
• It keeps address-space policy in user space while preserving kernel isolation guarantees.
• It does not receive storage, driver, broad discovery, or unrelated service-resolution authority.

Authority Boundaries

• vspaced operates only through startup-assigned service capabilities.
• New authority must be represented in bootstrap/capability validation and integration tests before use.

Contact

Development occurs in EriX organization and discussions happen in issues and design documents.

No decisions are considered valid without documented rationale.

Maintainers can be reached via email: admin@erikinkinen.fi.