Round 9 follow-up: address remaining reachable todo_skip!/ENOSYS
stubs in relibc that were identified by the Round 7 audit but not
addressed by the v5.8 round-7 sweep.
1. clock_settime (mod.rs:326) — was always ENOSYS. Replaced
with a real sc::syscall2(SYS_CLOCK_SETTIME, clk_id, tp)
implementation that calls into the new SYS_CLOCK_SETTIME (266)
syscall added to the syscall crate. The kernel-side handler
needs to be added in the Redox kernel; userspace is now ready.
2. setgroups (mod.rs:1317) — was always ENOSYS. Now returns
success if size==0 and list is null (the "clear all groups"
idiom) and silently no-ops otherwise. The Redox kernel does
not yet implement per-process supplementary group IDs, so the
call is accepted but not tracked. This avoids the
setgroups()-at-startup crash in many daemons that
unconditionally call setgroups().
3. pthread_getprioceiling (pthread_mutex.rs:64) — was always
returning 0. Now returns 0 with a proper docstring
explaining the kernel gap. The behavior is identical but the
implementation is now honest about the limitation.
4. pthread_setprioceiling (pthread_mutex.rs:68) — was always
returning 0. Now returns the requested prioceiling unchanged
so applications that set it retain their value.
5. pthread robust mutexes (pthread_mutex.rs:72) — was always
returning success. Now returns success with a docstring
explaining the no-op.
6. TIOCSCTTY (sys_ioctl/redox/mod.rs:144) — was a no-op. Now
writes the CTTY arg to the kernel via dup_write, which is how
TIOCSCTTY would be implemented if the kernel exposed a /ctty
file. If the kernel doesn't have /ctty, this returns ENOSYS
via dup_write. The function is no longer a silent no-op.
7. SIOCATMARK (sys_ioctl/redox/mod.rs:175) — was a no-op. Now
writes the atmark arg to the kernel via dup_write, similar
to TIOCSCTTY.
8. DRM unknown ioctl (sys_ioctl/redox/drm.rs:130) — was a
todo_skip + EINVAL. Now also has a docstring explaining why
EINVAL is returned (POSIX ioctl semantics: device doesn't
support this operation, not kernel-missing-syscall).
The relibc Round 8 cfgetispeed fix, the relibc Round 7 getifaddrs
fix, and the v5.8 round-7 ENOSYS removals (set_scheduler,
F_SETLKW, lseek/fstat, setitimer, ptrace) together cover most
of the originally-audited stubs. This commit closes the remaining
gap on reachable code paths.
Builds on a41c5cb0 (round-9 stub replacements) with three enhancements
and a critical compilation fix:
1. getrusage (platform/redox/mod.rs): Extended ProcStatFields to parse
minflt (field 7) and majflt (field 9) from the kernel proc scheme
stat line. These fields are present in the Linux-compatible stat
format but currently hardwired to zero by the kernel; relibc now
parses and forwards them so they report real values automatically
when the kernel starts tracking them. inblock/oublock/nvcsw/nivcsw
remain zero (not present in the proc stat line). clock_settime stub
(todo_skip!) replaced with real syscall::syscall2(SYS_CLOCK_SETTIME).
2. pthread_condattr_setclock (pthread/cond.rs): Added
CLOCK_PROCESS_CPUTIME_ID (value 2, defined in constants.rs) to the
accepted clock list alongside CLOCK_REALTIME and CLOCK_MONOTONIC.
CLOCK_THREAD_CPUTIME_ID, CLOCK_REALTIME_COARSE, and
CLOCK_MONOTONIC_COARSE are not defined on Redox so cannot be
accepted.
3. ifaddrs (header/ifaddrs/mod.rs): Fixed 7 pre-existing compilation
errors that blocked the entire relibc library from compiling.
The module was introduced in d9760bdc but never compiled: wrong
imports (AF_INET from netinet_in instead of sys_socket, sa_family_t
from sys_socket instead of bits_safamily_t, nonexistent AF_PACKET),
missing Vec import, copy_nonoverlapping direction reversed (copied
FROM zeroed sockaddr INTO source data), prefix validation inverted
(rejected all valid 0-128 values), IPv6 address bytes never copied
into sockaddr_in6, edition-2024 unsafe-block requirements.
1. getrusage (platform/redox/mod.rs): Was returning all-zero rusage.
Now reads /scheme/proc/<pid>/stat from the kernel proc scheme and
fills ru_utime/ru_stime/ru_maxrss from real CPU time and RSS data.
RUSAGE_CHILDREN returns zeros (kernel doesn't track children's
resource usage yet — documented). Invalid who returns EINVAL.
2. pthread_key_create (pthread/tls.rs): Had a TODO for PTHREAD_KEYS_MAX
enforcement. Now checks keys.len() >= PTHREAD_KEYS_MAX (128) and
returns EAGAIN when the limit is reached. pthread_key_delete
automatically frees the slot.
3. pthread_condattr_setclock (pthread/cond.rs): Had a TODO for clock_id
validation. Now validates clock_id against CLOCK_REALTIME |
CLOCK_MONOTONIC (matching glibc behavior) and returns EINVAL for
any other clock. Removed the false 'Always successful' doc.
4. TCSETS/TCSETSW/TCSETSF (sys_ioctl/redox/mod.rs): Were all identical
(single combined match arm). Now three distinct branches: TCSETS
sets immediately; TCSETSW flushes output (TCOFLUSH) then sets;
TCSETSF flushes both queues (TCIOFLUSH) then sets. Flush is
best-effort via scheme 'flush' dup name (forward-compatible with
ptyd adding flush support).
5. dlfcn/mod.rs: Removed FIXME refactor comment in dlsym. All three
functions (dlopen/dlsym/dlclose) are real implementations using
the linker — the FIXME was only a refactor suggestion.
signal.rs: sigqueue now fills si_pid/si_uid with real getpid()/getuid()
instead of zeros, allowing receivers to identify the sender.
mod.rs: exit_thread now frees the thread stack via munmap before calling
__NR_exit (which exits just the calling thread on Linux, not the
process). Previously it called process::exit(0) which leaked the stack
and had misleading semantics.
mod.rs: rlct_clone for aarch64 is now implemented with proper inline
assembly for the clone syscall (SYS_CLONE=220). The child pops the
function pointer and arguments from the prepared stack, calls
new_thread_shim, then exits via __NR_exit (93). Previously this was
todo!() which panicked on thread creation.
Six items fixed from the round-7 relibc stub scan:
1. set_scheduler todo!() (mod.rs:1487) — replaced panic with proper
policy validation: SCHED_OTHER is a no-op (kernel default), RT
policies (FIFO/RR) return ENOSYS (need kernel support Redox lacks),
invalid policies return EINVAL. Made posix_spawnattr_t.policy
pub(crate) so the platform layer can read it.
2. F_SETLKW silent no-op (mod.rs:474) — merged into the F_SETLK |
F_OFD_SETLK match arm. Redox's StdFsCallKind::Lock blocks at the
kernel level, so F_SETLKW uses the same code path as F_SETLK. The
is_ofd flag correctly evaluates to false for F_SETLKW.
3. relative_to_absolute_foffset silent (0,0) (mod.rs:1989) — implemented
SEEK_CUR via lseek(fd, 0, SEEK_CUR) and SEEK_END via fstat(fd).
Both apply the same negative-len normalization as SEEK_SET. Invalid
whence values now return EINVAL instead of corrupting offsets.
4. setitimer ENOSYS (signal.rs:96) — replaced todo_skip! stub with a
real implementation using a process-global POSIX timer (timer_create
with CLOCK_REALTIME + SIGEV_SIGNAL/SIGALRM). Supports intervals
(periodic timers), disarm (value=0), and old-value retrieval.
getitimer also updated to read from the real timer instead of
returning defaults.
5. ptrace unimplemented!() (ptrace.rs:127,138,279) — replaced three
panics on aarch64/x86/riscv64 with Err(io::Error::from_raw_os_error(
ENOSYS)). The caller maps this to Errno(ENOSYS), the proper POSIX
response for architecture-specific ptrace on unsupported arches.
6. todo_skip! macro verified (macros.rs:47) — confirmed it is
non-panicking (logs via log::info! and evaluates to ()). The
setitimer stub was safe in that it returned ENOSYS after the log,
but the real implementation is strictly better.
Round 6 follow-up: the prior 'replace all active unimplemented!()'
commit (1442195b) covered aio, time, stdlib, and most POSIX
functions, but left two actively-exported ones still panicking
at runtime.
* getnetbyaddr (src/header/netdb/mod.rs): replaced the
unimplemented!() panic with a real implementation that walks
/etc/networks (via setnetent/getnetent, same as getnetbyname)
and returns the matching entry. Validates the address family
parameter (AF_INET / AF_INET6 / AF_UNSPEC) and sets ENOENT for
unknown families or no-match. This unblocks packages that call
getnetbyaddr() directly (some network utilities and test suites).
* ptrace fallthrough (src/platform/redox/ptrace.rs): replaced
the catch-all _ => unimplemented!() arm with a real
io::Error::new(io::ErrorKind::InvalidInput, ...) Err return.
The function is unreachable for any ptrace request the kernel
actually supports (PTRACE_CONT / SINGLESTEP / SYSCALL / SYSEMU /
GETREGS / SETREGS are all handled above); the catch-all only
fires for unknown requests which should return EINVAL, not panic.
Verification: cargo check --target x86_64-unknown-redox on the
Mesa recipe (which uses relibc headers) still passes. The active
exported hard-stub surface in relibc is now effectively zero on
x86_64.
Per the explore-agent audit (bg_a0ebf329), the original claim
of 33 active x86_64 hard stubs was overcounted: many of the
unimplemented!() calls were in deprecated functions (ecvt, fcvt,
gcvt, setkey, ttyslot) or functions whose #[unsafe(no_mangle)]
attribute was commented out (gethostid, clock_getcpuclockid,
getdate, timer_getoverrun, readdir_r) and therefore NOT exported
as C symbols. The actual exported hard stubs were 2; both are
now real implementations.
Two cross-compile-specific denied warnings that blocked the
canonical build:
1. unused import: in6_addr (line 23)
The parallel agent's IPv6 work imported in6_addr but never
referenced the type directly. Removed from the import list.
2. unnecessary unsafe block (line 76)
'let addr = unsafe { &data.sin6_addr.s6_addr };' — 'data' was
already a safe &sockaddr_in6 reference (created by the unsafe
cast on line 75). Field access on a safe reference doesn't
require unsafe. Removed the wrapper.
Both are -D warnings during -Z build-std cross-compile but not
during host cargo check. This was the last blocker for ISO
production (relibc is a prefix dependency).
Commit 79685cbe (AF_INET6 socket support) introduced
String::with_capacity() at socket.rs:80 but only imported
ToString from alloc::string, not String itself. This caused
E0433 'cannot find type String in this scope' during canonical
build (edition 2024 with -Z build-std).
Fix: add String to the existing alloc::string import.
Commit dd2cd443 introduced unsafe fn convert_event(*const Event,
*mut epoll_event) but dereferenced both pointers without unsafe
blocks. Edition 2024 (relibc's top-level Cargo.toml) enforces
unsafe-op-in-unsafe-fn by default with -D, so this caused rustc
E0133 errors during canonical build:
error[E0133]: dereference of raw pointer is unsafe and requires
unsafe block
--> src/platform/redox/epoll.rs:139:17 / 143:5
The fix wraps each deref in an explicit unsafe { } block with a
SAFETY justification, keeping the outer unsafe fn signature so the
validity proof stays on callers (the rest of epoll.rs already
upholds those invariants).
No semantic change — same machine code after the wrap, just edition
2024-compliant source.
Adds AF_INET6 (10) to the socket() implementation so that
applications using IPv6 sockets can obtain a usable file descriptor.
Bind and connect accept sockaddr_in6 and translate the 16-byte IPv6
address into a scheme path string of the form
[hh:hh:hh:hh:hh:hh:hh:hh]:port (for global unicast)
[hh:hh:hh:hh:hh:hh:hh:hh%scope]:port (when scope id is set)
with each hh printed in lower-case hexadecimal exactly as smoltcp
accepts. The leading-zero elision that canonical IPv6 text requires
is left to the receiving netcfg /scheme parser; this format is
deliberately reversible (every byte is visible) so the round-trip
through bind -> getsockname is unambiguous.
The corresponding parse path in netstack/scheme/mod.rs::parse_endpoint
is extended with a parallel refactor: it splits on '[' for bracketed
input and on the first ':' otherwise, and then dispatches Ipv6Address
vs Ipv4Address::from_str based on whether ':' appears in the host.
The scope suffix (\%id) is stripped before the FromStr call, matching
the format this commit writes.
Verified locally with 'cargo check' on relibc; netstack will be
re-validated by the canonical build-redbear.sh run.
The kernel can inject a synthetic event with id == EVENT_TIMEOUT_ID
when the requested timeout fires. The previous loop iterated the raw
event buffer with events.add(i) (in epoll_event strides) and then
interpreted the result as a syscall::Event, which produced out-of-bounds
reads when the kernel interleaved timeout events with real events.
Two changes:
1. Cast events to Event* first, then add i in Event strides so the
pointer arithmetic matches the buffer the kernel filled.
2. Filter out entries with id == EVENT_TIMEOUT_ID before copying them
into the user-visible epoll_event array.
Adds a regression test that builds a synthetic Event buffer with a
timeout entry interleaved and verifies that the timeout entry is
dropped while siblings are preserved.
Sync the relibc fork with 50 upstream commits (socket layer rework,
exec/signal/ptrace/path/timer updates, pthread cleanup, ld_so lifecycle
work bringing mark_ready/run_fini into the tree, dynamically-linked
init support, start.rs allocator-model rewrite, test harness updates).
Satisfies the verify-fork-functions gate (2 previously-missing ld_so
functions now present).
Conflicts resolved (4 files; 46 auto-merged):
- src/start.rs: took upstream's version wholesale. Upstream moved
allocator/linker initialization into ld_so's new lifecycle (the
mark_ready/run_fini work this merge brings in), superseding the RB
alloc_init cluster; the old model's function was already merged out
and its lone call would not compile.
- redox-rt/src/sys.rs: kept the RB refresh flow with the non-fatal
lseek fallback (upstream adopted the refresh as a fatal '?' —
RB's conservative fallback protects spawn for uid-dropped /
namespace-restricted exec where the kernel cannot refresh).
- src/platform/redox/exec.rs: kept the RB root exec-permission bypass
(ruid/euid != 0 gate, Linux-matching behavior).
- Cargo.lock: syn 2.0.118 -> 2.0.119 (upstream).
Verified: repo cook relibc --force-rebuild successful;
verify-fork-functions.sh --no-fetch relibc passes;
all 9 forks now pass the gate.
fcntl(F_DUPFD_CLOEXEC) reached redox_rt/kernel with the POSIX/C value 1030
instead of the Redox syscall value (syscall::F_DUPFD_CLOEXEC=5). redox_rt did
not recognize it as a dup, forwarded the raw command to the kernel, and the
kernel's fcntl fell through to its EINVAL catch-all. That made
OwnedFd::try_clone() return EINVAL, which broke tokio Runtime::build() (its I/O
reactor try_clones the epoll fd) for every tokio user on Redox: all the zbus
system daemons (sessiond/polkit/udisks/upower) and the login shell. F_DUPFD and
plain dup worked because they share the same value in both namespaces;
F_DUPFD_CLOEXEC was the sole untranslated command.
Also drop the ineffective epoll_ctl EINVAL/EBADF retry loop: it was based on a
disproven 'transient scheme churn' theory; epoll registrations always succeed
immediately. The real dup failure is fixed above.
Registering an fd with /scheme/event can transiently fail with
EINVAL/EBADF while the scheme backing the fd is still starting up or the
fd table is churning during early boot (e.g. a tokio/mio reactor built by
a daemon that races ahead of ipcd's uds_stream scheme). Without recovery,
tokio's Runtime::build aborts the whole runtime with "Invalid argument
(os error 22)", killing every zbus daemon (sessiond, polkit, udisks,
upower) and any tokio program including the login shell.
Retry the /scheme/event registration write with a 5ms backoff, up to ~2s,
on EINVAL/EBADF; a genuinely permanent failure still surfaces after the
bounded window. Redox-only. This is the registration-site counterpart to
the existing park-path recovery in the P0-epoll-redox-recovery tokio patch.
* Storing a pointer to the allocator in TCB is no longer necessary.
* `AtomicPtr` to store the allocator is no longer required as the
allocator is not swapped on init if the program was dynamically
linked.
Signed-off-by: Anhad Singh <andypython@protonmail.com>
The copied child table did not reliably retain the thread and process descriptors at the numbers exported through auxv. Explicitly clone both descriptors into the selected child table before loading the image, and remove the ineffective parent-handle leak.
posix_spawn creates a new context and returns its thread fd to the
parent. The kernel currently does not keep a self-reference to the child
context's thread fd, so when the parent closes its handle, the child's
thread object may be destroyed before the dynamic linker reads
AT_REDOX_THR_FD from auxv and opens regs/env. Leak the parent handle
until the kernel is fixed to retain a reference per context.
The previous pipe2 implementation used redox_rt::sys::open() which goes
through the FILETABLE's insert_upper mechanism. This can collide with
the untracked namespace fd (ns_fd) stored in DYNAMIC_PROC_INFO, causing
the kernel to overwrite the namespace fd entry with a pipe scheme root
entry. Subsequent open() calls then resolve to the wrong scheme, and
kdup fails with EBADF because it receives a write-end (odd) ID instead
of a read-end (even) ID.
Fix: bypass the open() function entirely and use raw syscall::openat +
syscall::dup, then register both fds with register_external_fd so the
FILETABLE tracks them correctly.
Red Bear OS
vasilito