vms-7eb: executive L2 AF_PACKET datalink + PHY_IO gate (booted-SCS keystone, piece 1) - #1009
Merged
Conversation
A booted (non-root) VMS process cannot open an AF_PACKET raw socket (needs CAP_NET_RAW), which is why booted-node SCS was impossible. This adds an executive-owned L2 datalink: the KERNEL owns the AF_PACKET/SOCK_RAW socket (sock_create_kern, bypassing CAP_NET_RAW like exec_socket_create_icmp), reached by a new /dev/vms ioctl surface, so SCSD needs zero Linux caps. Access is gated on the real VMS PHY_IO privilege (executive is the authority, never the environment) — vms-1e4's milestone slice. New: src/kernel/vms_l2.h (VMS_IOCTL_L2_OPEN/SEND/RECV/CLOSE 0x92-0x95 + ABI _Static_asserts), src/kernel-core/vms_l2.c (handler: vms_proc_find_or_err -> PHY_IO gate -> exec_l2_*, per-proc handle table), tests/qemu/test_syssvc_l2_datalink.c. Wired the "N places": exec_kbackend_linux.h (real AF_PACKET primitive) + exec_kbackend.h contract + netbsd stubs (ride vms-024), vms_module.c dispatch, vms_kif.c/.h client (SS$_NOSUCHDEV fail-honest), libvmssys_shr.vec exports, Makefile + distro Kbuild object lists, vms_internal.h handle table, prv_agreement.c PHY_IO lockstep. Userspace + vms.ko build clean; 59/59 host unit tests pass (no regression). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014MbZZun7YK3dhF2u6BnbCX
…forced) QEMU /dev/vms run surfaced two real failures (caught by the test, not shipped): 1. L2_SEND failed ENETDOWN — the minimal test initramfs leaves eth0 administratively down; bind() succeeds but the first send fails. Fix (faithful): exec_l2_open now brings the interface UP when the executive opens the datalink — exactly as PEDRIVER brings up the LAN adapter when the cluster starts. Idempotent, RTNL-locked. This also makes a booted SCS self-sufficient (it gets a working link on open, not dependent on external ifup). 2. test_syssvc_ident F assertion: adding PRV$M_PHY_IO to VMS_PRV_M_ENFORCED (needed for the L2 gate) makes F$GETJPI CURPRIV render PHY_IO for SYSTEM/ALL, so the golden grew by ",PHY_IO" (bit 22, after MOUNT bit 17 in the ascending render). Exactly the precedent vms-651 set when it added MOUNT. Legitimate golden update reflecting a real enforcement change, not test-weakening. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014MbZZun7YK3dhF2u6BnbCX
This was referenced Aug 31, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What & why
A booted (non-root) VMS process cannot open an AF_PACKET raw socket (needs
CAP_NET_RAW) — this is why booted-node SCS was impossible, and why the lab probe only ever "joined a cluster" on the k3s pod's ambient caps. This adds an executive-owned L2 datalink: the kernel owns theAF_PACKET/SOCK_RAWsocket (sock_create_kern, bypassingCAP_NET_RAWlikeexec_socket_create_icmp), reached by a new/dev/vmsioctl surface. So SCSD needs zero Linux caps. Opening it is gated on the real VMS PHY_IO privilege — the executive is the authority, never the environment (INV-6). This is the keystone of vms-110b (booted OVMX joins a real VAX); piece 1 of 3.Proven against real /dev/vms (QEMU, KVM)
The zero-cap property is real: the process holds no
CAP_NET_RAW; the kernel does the I/O. That is exactly what makes the milestone gate un-fakeable (boot withCAP_NET_RAWdenied → a join proves the executive did it).Changes
src/kernel/vms_l2.h(VMS_IOCTL_L2_OPEN/SEND/RECV/CLOSE0x92–0x95 + ABI_Static_asserts),src/kernel-core/vms_l2.c(handler: resolve proc → PHY_IO gate →exec_l2_*, per-proc handle table),tests/qemu/test_syssvc_l2_datalink.c.exec_kbackend_linux.hrealAF_PACKETkernel socket (+ brings the NIC up on open, PEDRIVER-style); NetBSD contract-only stubs (ride vms-024); contract inexec_kbackend.h.vms_module.c), kif client (vms_kif.c/.h,SS$_NOSUCHDEVfail-honest),libvmssys_shr.vec, Makefile + distro Kbuild object lists,vms_internal.hhandle table.VMS_PRV_M_ENFORCEDwith userspace/kernel_Static_assertlockstep;test_syssvc_identgolden updated to render it (same precedent as vms-651/MOUNT).Notes for the gate
Executive-as-authority ✓ ·
SS$_NOSUCHDEVfail-honest, no fallback ✓ · honest negctl (PHY_IO-dropped →SS$_NOPRIV) ✓ · real /dev/vms output ✓. No "joins" claim — that's piece 3 (the harness + a peer). Piece 2 (scsd reroute, compile-time transport separation) follows.🤖 Generated with Claude Code
https://claude.ai/code/session_014MbZZun7YK3dhF2u6BnbCX