M9: user-space VFS server + client file API (open/read/write/stat + stdio)

The payoff milestone: files are served by a user-space process, reached over
IPC — the kernel never sees a path or an fd.

- lib/vfs_proto.zig: the VFS wire protocol (Op, Request/Reply fixed header +
  inline payload, Stat), shared by client and server; one message <= MSG_MAX.
- lib/ipc.zig: replyWait() — the server-side dual-return stub (length in rax,
  badge in rdx via a "+{rdx}" read-write operand), deferred from M7.
- sbin/vfs.zig: the real VFS server — an in-heap ramfs (open creates a node)
  with an IPC_ReplyWait dispatch loop serving open/read/write/stat/close.
  Registers its endpoint under the well-known vfs id at startup.
- lib/unistd.zig: POSIX-style client API in rt — a per-process fd table +
  open/close/read/write/lseek/stat, each an IPC_Call to the VFS. The kernel
  knows nothing of fds; the table lives here.
- lib/stdio.zig: C stdio over unistd — FILE + fopen/fclose/fread/fwrite/
  fseek/ftell/rewind/feof/ferror/fputs/fputc/fgetc (unbuffered for now).
- sbin/vfstest.zig: a client that opens/writes/seeks/reads a file and only
  heartbeats "vfstest: ok" if the round trip matched. Packed in the initrd.
- New `vfs` test drives it end to end. initrd test relaxed to generic
  liveness. Suite 31/31.

lib/ipc.zig

@@ -50,5 +50,29 @@ pub fn call(h: Handle, msg: []const u8, reply: []u8) CallError!usize {
     return if (failed(r)) error.Failed else r;
 }
 
-// replyWait() (server side — returns message length + sender badge) lands with
-// the first server binary (M9), where it can be exercised end to end.
+/// The result of a `replyWait`: the request length and the sender's badge (a
+/// task id, or an IRQ notification if the high bit is set).
+pub const Received = struct {
+    len: usize,
+    badge: u64,
+};
+
+/// Server side of IPC_ReplyWait: deliver `reply` to the client last received (if
+/// any), then block until the next request arrives in `recv`. Returns its length
+/// and the sender badge. This syscall returns two values — the length in rax and
+/// the badge in rdx — so it needs a hand-written stub: rdx is a read-write
+/// operand (input = reply length, arg #3; output = badge).
+pub fn replyWait(h: Handle, reply: []const u8, recv: []u8) Received {
+    var rax: usize = undefined;
+    var rdx: usize = reply.len; // in: reply_len (arg #3 -> rdx); out: badge
+    asm volatile ("syscall"
+        : [rax] "={rax}" (rax),
+          [rdx] "+{rdx}" (rdx),
+        : [n] "{rax}" (@intFromEnum(danos.Syscall.ipc_reply_wait)),
+          [a0] "{rdi}" (h),
+          [a1] "{rsi}" (@intFromPtr(reply.ptr)),
+          [a3] "{r10}" (@intFromPtr(recv.ptr)),
+          [a4] "{r8}" (recv.len),
+        : .{ .rcx = true, .r11 = true, .memory = true });
+    return .{ .len = rax, .badge = rdx };
+}

lib/rt.zig

@@ -14,6 +14,12 @@ pub const sys = @import("sys.zig");
 pub const heap = @import("heap.zig");
 pub const ipc = @import("ipc.zig");
 pub const start = @import("start.zig");
+/// The VFS wire protocol (shared with the VFS server).
+pub const vfsproto = @import("vfs_proto.zig");
+/// POSIX-style file API: open/read/write/lseek/stat/close.
+pub const unistd = @import("unistd.zig");
+/// C stdio: fopen/fread/fwrite/fseek/ftell/fclose over unistd.
+pub const stdio = @import("stdio.zig");
 
 /// Re-exported so a user binary can `pub const panic = rt.panic;`.
 pub const panic = start.panic;

lib/stdio.zig

@@ -0,0 +1,115 @@
+//! A small C stdio layer over the POSIX-style file API (unistd.zig). Unbuffered
+//! for now — each fread/fwrite is one VFS round trip; an internal buffer (fewer
+//! IPC calls) is a later optimisation. Both a Zig-callable API and `extern "C"`
+//! symbols are provided, so Zig and future C programs share it.
+
+const std = @import("std");
+const unistd = @import("unistd.zig");
+const heap = @import("heap.zig");
+
+pub const SEEK_SET = unistd.SEEK_SET;
+pub const SEEK_CUR = unistd.SEEK_CUR;
+pub const SEEK_END = unistd.SEEK_END;
+
+/// A C `FILE`: an fd plus sticky end-of-file / error flags. Allocated on the
+/// heap; `fclose` frees it.
+pub const FILE = extern struct {
+    fd: i32,
+    eof: c_int = 0,
+    err: c_int = 0,
+};
+
+fn flagsFor(mode: []const u8) u32 {
+    if (mode.len == 0) return 0;
+    return switch (mode[0]) {
+        'w', 'a' => unistd.O_CREAT,
+        else => 0,
+    };
+}
+
+/// Open `path` in `mode` ("r"/"w"/"a", '+' ignored for now). Returns null on error.
+pub fn fopen(path: []const u8, mode: []const u8) ?*FILE {
+    const fd = unistd.open(path, flagsFor(mode));
+    if (fd < 0) return null;
+    const f = heap.allocator().create(FILE) catch {
+        unistd.close(fd);
+        return null;
+    };
+    f.* = .{ .fd = fd };
+    if (mode.len > 0 and mode[0] == 'a') _ = unistd.lseek(fd, 0, unistd.SEEK_END);
+    return f;
+}
+
+pub fn fclose(f: *FILE) c_int {
+    unistd.close(f.fd);
+    heap.allocator().destroy(f);
+    return 0;
+}
+
+/// Read `size*nmemb` bytes; returns the number of whole items read.
+pub fn fread(buf: []u8, size: usize, nmemb: usize, f: *FILE) usize {
+    const total = size * nmemb;
+    if (total == 0) return 0;
+    const n = unistd.read(f.fd, buf[0..@min(buf.len, total)]);
+    if (n <= 0) {
+        f.eof = 1;
+        return 0;
+    }
+    return @as(usize, @intCast(n)) / size;
+}
+
+/// Write `size*nmemb` bytes; returns the number of whole items written.
+pub fn fwrite(data: []const u8, size: usize, nmemb: usize, f: *FILE) usize {
+    const total = @min(data.len, size * nmemb);
+    if (total == 0) return 0;
+    const n = unistd.write(f.fd, data[0..total]);
+    if (n <= 0) {
+        f.err = 1;
+        return 0;
+    }
+    return @as(usize, @intCast(n)) / size;
+}
+
+pub fn fseek(f: *FILE, off: i64, whence: u32) c_int {
+    f.eof = 0;
+    return if (unistd.lseek(f.fd, off, whence) < 0) -1 else 0;
+}
+
+pub fn ftell(f: *FILE) i64 {
+    return unistd.lseek(f.fd, 0, unistd.SEEK_CUR);
+}
+
+pub fn rewind(f: *FILE) void {
+    _ = fseek(f, 0, SEEK_SET);
+}
+
+pub fn feof(f: *FILE) c_int {
+    return f.eof;
+}
+
+pub fn ferror(f: *FILE) c_int {
+    return f.err;
+}
+
+pub fn fputs(s: []const u8, f: *FILE) c_int {
+    return if (unistd.write(f.fd, s) < 0) -1 else 0;
+}
+
+pub fn fputc(c: u8, f: *FILE) c_int {
+    const b = [_]u8{c};
+    return if (unistd.write(f.fd, &b) == 1) c else -1;
+}
+
+pub fn fgetc(f: *FILE) c_int {
+    var b: [1]u8 = undefined;
+    const n = unistd.read(f.fd, &b);
+    if (n <= 0) {
+        f.eof = 1;
+        return -1; // EOF
+    }
+    return b[0];
+}
+
+// Real `extern "C"` symbols (fopen/fread/fseek/...) — with a C-string signature
+// distinct from the Zig slice API above — land with the first C program, wired
+// via @export so they don't collide with these Zig names.

lib/unistd.zig

@@ -0,0 +1,149 @@
+//! POSIX-style file API for user programs — the low level under C stdio. Files
+//! are named objects served by the user-space VFS server (sbin/vfs.zig); each
+//! call marshals a request, IPC_Calls the VFS, and unmarshals the reply. The
+//! kernel knows nothing of files or fds — the fd table lives here, per process.
+
+const std = @import("std");
+const proto = @import("vfs_proto.zig");
+const ipc = @import("ipc.zig");
+const danos = @import("danos");
+
+pub const O_CREAT = proto.O_CREAT;
+pub const SEEK_SET: u32 = 0;
+pub const SEEK_CUR: u32 = 1;
+pub const SEEK_END: u32 = 2;
+
+// Resolve (and cache) the VFS server endpoint, looked up by well-known id.
+var vfs_handle: usize = 0;
+var vfs_resolved = false;
+fn vfs() ?usize {
+    if (!vfs_resolved) {
+        vfs_handle = ipc.lookup(.vfs) orelse return null;
+        vfs_resolved = true;
+    }
+    return vfs_handle;
+}
+
+const max_fds = 32;
+const Fd = struct { used: bool = false, node: u64 = 0, offset: u64 = 0 };
+var fds = [_]Fd{.{}} ** max_fds;
+
+fn allocFd() ?usize {
+    for (&fds, 0..) |*f, i| {
+        if (!f.used) {
+            f.* = .{ .used = true };
+            return i;
+        }
+    }
+    return null;
+}
+
+const Result = struct { reply: proto.Reply, payload: []u8 };
+
+/// One request/reply round trip: [Request header][send payload] -> VFS ->
+/// [Reply header][recv payload]. The recv payload is written into `out`.
+fn transact(req: proto.Request, send: []const u8, out: []u8) ?Result {
+    const h = vfs() orelse return null;
+    var msg: [proto.msg_max]u8 = undefined;
+    @memcpy(msg[0..proto.req_size], std.mem.asBytes(&req));
+    const slen = @min(send.len, proto.max_payload);
+    @memcpy(msg[proto.req_size..][0..slen], send[0..slen]);
+
+    var rbuf: [proto.msg_max]u8 = undefined;
+    const n = ipc.call(h, msg[0 .. proto.req_size + slen], &rbuf) catch return null;
+    if (n < proto.reply_size) return null;
+    const reply = std.mem.bytesToValue(proto.Reply, rbuf[0..proto.reply_size]);
+    const rpl = @min(n - proto.reply_size, out.len);
+    @memcpy(out[0..rpl], rbuf[proto.reply_size..][0..rpl]);
+    return .{ .reply = reply, .payload = out[0..rpl] };
+}
+
+/// Open (or create, with O_CREAT) `path`; returns an fd or -1.
+pub fn open(path: []const u8, flags: u32) i32 {
+    const fd = allocFd() orelse return -1;
+    const req = proto.Request{ .op = .open, .node = 0, .offset = 0, .len = @intCast(path.len), .flags = flags };
+    const r = transact(req, path, &.{}) orelse {
+        fds[fd].used = false;
+        return -1;
+    };
+    if (r.reply.status != 0) {
+        fds[fd].used = false;
+        return -1;
+    }
+    fds[fd] = .{ .used = true, .node = r.reply.node, .offset = 0 };
+    return @intCast(fd);
+}
+
+fn fdPtr(fd: i32) ?*Fd {
+    if (fd < 0 or fd >= max_fds) return null;
+    const f = &fds[@intCast(fd)];
+    return if (f.used) f else null;
+}
+
+/// Read up to `buf.len` bytes at the current offset; returns the count or -1.
+pub fn read(fd: i32, buf: []u8) isize {
+    const f = fdPtr(fd) orelse return -1;
+    const want: u32 = @intCast(@min(buf.len, proto.max_payload));
+    const req = proto.Request{ .op = .read, .node = f.node, .offset = f.offset, .len = want, .flags = 0 };
+    const r = transact(req, &.{}, buf) orelse return -1;
+    if (r.reply.status != 0) return -1;
+    f.offset += r.reply.len;
+    return @intCast(r.reply.len);
+}
+
+/// Write `data` at the current offset; returns the count or -1.
+pub fn write(fd: i32, data: []const u8) isize {
+    const f = fdPtr(fd) orelse return -1;
+    const want: u32 = @intCast(@min(data.len, proto.max_payload));
+    const req = proto.Request{ .op = .write, .node = f.node, .offset = f.offset, .len = want, .flags = 0 };
+    const r = transact(req, data[0..want], &.{}) orelse return -1;
+    if (r.reply.status != 0) return -1;
+    f.offset += r.reply.len;
+    return @intCast(r.reply.len);
+}
+
+/// Reposition the fd's offset. Returns the new offset or -1. (SEEK_END needs the
+/// file size, which `stat` provides; handled by fetching it here.)
+pub fn lseek(fd: i32, off: i64, whence: u32) i64 {
+    const f = fdPtr(fd) orelse return -1;
+    const base: i64 = switch (whence) {
+        SEEK_SET => 0,
+        SEEK_CUR => @intCast(f.offset),
+        SEEK_END => blk: {
+            const req = proto.Request{ .op = .stat, .node = f.node, .offset = 0, .len = 0, .flags = 0 };
+            var sbuf: [@sizeOf(proto.Stat)]u8 = undefined;
+            const r = transact(req, &.{}, &sbuf) orelse return -1;
+            if (r.reply.status != 0 or r.payload.len < @sizeOf(proto.Stat)) return -1;
+            const st = std.mem.bytesToValue(proto.Stat, sbuf[0..@sizeOf(proto.Stat)]);
+            break :blk @intCast(st.size);
+        },
+        else => return -1,
+    };
+    const pos = base + off;
+    if (pos < 0) return -1;
+    f.offset = @intCast(pos);
+    return pos;
+}
+
+/// Stat `path`. Returns 0 or -1.
+pub fn stat(path: []const u8, out: *proto.Stat) i32 {
+    // Open, stat by node, close — simple and enough for now.
+    const fd = open(path, 0);
+    if (fd < 0) return -1;
+    defer close(fd);
+    const f = fdPtr(fd).?;
+    const req = proto.Request{ .op = .stat, .node = f.node, .offset = 0, .len = 0, .flags = 0 };
+    var sbuf: [@sizeOf(proto.Stat)]u8 = undefined;
+    const r = transact(req, &.{}, &sbuf) orelse return -1;
+    if (r.reply.status != 0 or r.payload.len < @sizeOf(proto.Stat)) return -1;
+    out.* = std.mem.bytesToValue(proto.Stat, sbuf[0..@sizeOf(proto.Stat)]);
+    return 0;
+}
+
+/// Close an fd (best effort — tells the VFS to release the open file).
+pub fn close(fd: i32) void {
+    const f = fdPtr(fd) orelse return;
+    const req = proto.Request{ .op = .close, .node = f.node, .offset = 0, .len = 0, .flags = 0 };
+    _ = transact(req, &.{}, &.{});
+    f.used = false;
+}

lib/vfs_proto.zig

@@ -0,0 +1,53 @@
+//! The VFS wire protocol — the message format spoken between a client (via the
+//! `rt` file API) and the user-space VFS server over IPC. A request is a fixed
+//! `Request` header followed by an inline payload (a path, or write bytes); a
+//! reply is a fixed `Reply` header followed by an inline payload (read bytes, or
+//! a Stat). Everything fits in one IPC message (<= ipc MSG_MAX = 256 bytes).
+//!
+//! This is user-space only — the kernel knows nothing of files or paths; it only
+//! moves the bytes. Shared by lib/unistd.zig (client) and sbin/vfs.zig (server).
+
+pub const Op = enum(u32) {
+    open, // open(path) -> node id
+    close, // close(node)
+    read, // read(node, offset, len) -> bytes
+    write, // write(node, offset, bytes) -> count
+    stat, // stat(node) -> Stat
+};
+
+/// Request header. `node` is the server-side open-file id (from a prior open);
+/// for `open` the path is the payload and `len` is its length. `offset`/`len`
+/// carry the read/write position and count.
+pub const Request = extern struct {
+    op: Op,
+    node: u64,
+    offset: u64,
+    len: u32,
+    flags: u32,
+};
+
+/// Reply header. `status` is 0 on success or a negative errno; `node` is the new
+/// open-file id (for `open`); `len` is the payload length (bytes read, or the
+/// Stat size).
+pub const Reply = extern struct {
+    status: i32,
+    _pad: u32 = 0,
+    node: u64 = 0,
+    len: u32 = 0,
+    _pad2: u32 = 0,
+};
+
+pub const Stat = extern struct {
+    size: u64,
+    kind: u32,
+    _pad: u32 = 0,
+};
+
+pub const msg_max: usize = 256;
+pub const req_size: usize = @sizeOf(Request);
+pub const reply_size: usize = @sizeOf(Reply);
+/// Largest inline payload that still fits one IPC message alongside a header.
+pub const max_payload: usize = msg_max - req_size;
+
+/// Open flags.
+pub const O_CREAT: u32 = 1;