IPC Protocol Labels
Every SYS_CALL or SYS_SEND that targets a server endpoint carries a 40-bit label in the message info word.
The label tells the server which operation is being requested.
This page is the full reference for the labels defined under lib/trona/uapi/protocol/, organized by server.
All eight files are included verbatim into substrate via substrate/protocol.rs, so every call site sees the same numeric constants at compile time:
pub mod vfs { include!("../uapi/protocol/vfs.rs"); }
pub mod procmgr { include!("../uapi/protocol/procmgr.rs"); }
pub mod mmsrv { include!("../uapi/protocol/mmsrv.rs"); }
pub mod namesrv { include!("../uapi/protocol/namesrv.rs"); }
pub mod posix { include!("../uapi/protocol/posix.rs"); }
pub mod win32 { include!("../uapi/protocol/win32.rs"); }
pub mod server { include!("../uapi/protocol/server.rs"); }
pub mod rsrcsrv { include!("../uapi/protocol/rsrcsrv.rs"); }
This page only documents the label numbers and roles.
For the wire format of individual operations, see the server-specific documentation — docs/spec/ in the saltyos tree is the eventual landing place for that detail.
VFS server — vfs.rs
The VFS server owns the file descriptor table and every file-like object: regular files, directories, sockets, pipes, SHM objects, and poll/epoll sets.
Core file I/O
| Label | Operation |
|---|---|
|
Open a path, return a file descriptor. |
|
Read from an fd into an inline IPC buffer region. |
|
Write an inline buffer to an fd. |
|
Close an fd. |
|
|
|
Seek within an fd. |
|
|
|
Check access permissions on a path. |
|
Remove a file or directory entry. |
|
Rename a path. |
|
Create a directory. |
|
Remove an empty directory. |
|
Open a directory for enumeration. |
|
Read the next directory entry. |
|
|
|
Multiplex fd readiness. |
|
|
|
|
|
Truncate an fd to a given size. |
Sockets
| Label | Operation |
|---|---|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Create a socket pair. |
|
Shut down one or both directions of a socket. |
|
Local address of a socket. |
|
Remote address of a connected socket. |
|
Set a socket option. |
|
Get a socket option. |
Pipes, descriptors, and fd table
| Label | Operation |
|---|---|
|
Create an anonymous pipe pair. |
|
|
|
|
|
Clone a subset of the fd table into a child CNode. |
|
Generic |
|
|
|
Create a named pipe. |
Labels 34 and 35 were moved to protocol/posix.rs (as VFS_POSIX_ISATTY and VFS_POSIX_FCNTL) because they are POSIX personality-only operations — see posix.rs below.
Labels 45 and 46 were removed when mmap ownership moved from VFS to mmsrv; the numbers are retired.
Directory and path operations
| Label | Operation |
|---|---|
|
|
|
|
|
|
|
|
*at() family
| Label | Operation |
|---|---|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Epoll
| Label | Operation |
|---|---|
|
Create an epoll fd. |
|
Add / modify / delete an epoll entry. |
|
Wait for epoll events. |
Bulk I/O, pagers, and administrative operations
| Label | Operation |
|---|---|
|
Client notifies VFS it is exiting so the fd table and poll sets can be reaped. |
|
Positional read. |
|
Positional write. |
|
Prepare a shared-memory region for bulk I/O larger than the IPC register window. |
|
Bulk read into the shared region. |
|
Bulk positional write. |
|
Pager-side read: mmsrv asks VFS to fill a backing page. |
|
Pager-side write-back. |
|
Resolve an fd into a backing file / mount / device descriptor for mmsrv to page against. |
|
Debug dump of pending VFS requests. |
Multi-user, xattr, mount, and system operations
| Label | Operation |
|---|---|
|
Stat + permission check used by |
|
Flush file data to backing storage. |
|
Read an extended attribute. |
|
Write an extended attribute. |
|
Remove an extended attribute. |
|
List extended attribute names. |
|
Mount a filesystem. |
|
Unmount a filesystem. |
|
|
|
Personality registration — carries subsystem ID. |
|
Generic sysctl read/write. |
|
Canonicalize a path for |
|
Windows-shaped open carrying |
|
|
The VFS label space is by far the largest in trona and the one that changes most often as new POSIX and Win32 features land.
Process manager — procmgr.rs
procmgr owns process and thread lifecycle, signals, credentials, resource limits, and session/pgrp state.
| Label | Operation |
|---|---|
|
Spawn a new process from an ELF image. |
|
Current process exits. |
|
|
|
Return the caller’s PID. |
|
Fork the current process (paired with |
|
|
|
Return the parent PID. |
|
Send a signal to a process. |
|
Install a signal handler. |
|
Real user ID. |
|
Real group ID. |
|
Set process group ID. |
|
Get process group ID of a process. |
|
Create a new session and become session leader. |
|
Effective user ID. |
|
Effective group ID. |
|
Supplementary group list. |
|
Client registration — hands procmgr the client’s badge. |
|
Get session ID of a process. |
|
Get pgid of the badged caller itself. |
|
Get sid of the badged caller itself. |
|
Send a signal to an entire process group. |
|
Give a capability to another running process (used by init during bootstrap). |
|
Enumerate live PIDs. |
|
Query per-process metadata (name, state, uid, …). |
|
Resume a suspended process. |
|
Read/write the umask. |
|
Set an interval timer. |
|
Read an interval timer. |
|
Look up the executable path of a process. |
|
Debug dump of pending procmgr requests. |
|
Get the TCB / SC / vspace caps of a thread. |
Credentials
| Label | Operation |
|---|---|
|
|
|
|
|
|
|
|
|
|
|
|
|
Set supplementary groups. |
|
Look up credentials of a badged caller — used by VFS. |
|
|
|
|
|
|
|
|
Limits, TTY, and providers
| Label | Operation |
|---|---|
|
|
|
|
|
Attach a controlling TTY to the current session. |
|
Detach the controlling TTY. |
|
Change the foreground process group of the controlling TTY. |
|
Register a personality provider (e.g. posix_ttysrv). |
Thread lifecycle (personality-agnostic)
| Label | Operation |
|---|---|
|
Create a new thread. Called by |
|
Current thread exits. |
|
Wait for a thread to exit and collect its retval. |
|
Mark a thread as detached. |
|
Enumerate threads in a process. |
Boot-time init → procmgr handoff
| Label | Operation |
|---|---|
|
Init ships the parsed |
|
Init registers a pre-procmgr service provider endpoint with procmgr so later |
Memory manager — mmsrv.rs
The memory manager owns heap break, mmap regions, SHM objects, COW pools, and page-fault backing resolution. Labels are allocated in the 0x80–0xA3 range, with a gap at 0x91 and several retired numbers.
| Label | Operation |
|---|---|
|
Client registration. |
|
Client teardown. |
|
Set the heap break. |
|
Increment the heap break. |
|
Anonymous mmap. |
|
Unmap. |
|
Change page protection flags. |
|
Map multiple regions atomically. |
|
Allocate a reserved VA window. |
|
Release a reserved VA window. |
|
Create a POSIX-style shared memory segment. |
|
Map an existing SHM segment. |
|
Unmap an SHM segment. |
|
Clone the caller’s mapped regions into a child vspace (used by |
|
Destroy an SHM segment. |
|
Resize an SHM segment. |
|
Query per-client memory usage. |
|
Register a region that will be shared with another client. |
|
Map a MemoryObject-backed region. |
|
Sync a file-backed mapping to VFS. |
|
File-backed mmap. Delegates through |
|
Force write-back of a dirty file-backed mapping. |
|
Pager client → mmsrv: please resolve a fault at this vaddr. |
|
Pager client → mmsrv: writeback request. |
|
Debug dump of pending mmsrv requests. |
|
Register a pager endpoint — used by drivers that provide page-fault handling for their own regions. |
|
Allocate a private heap region. |
|
Allocate a private VA window. |
|
Copy a range out of the initrd into a fresh mmsrv-owned frame. |
|
Copy a range out of the bootinfo page. |
|
Copy from one client’s region into another. |
|
Allocate private memory initialized from a client region. |
Labels 0x91, 0x96, 0x98, 0x99 are reserved or retired:
-
0x91is the numeric gap between client stats (0x90) and the shared-region labels (0x92+). -
0x96is reserved — device mmap is handled as a subcase ofMM_FILE_MMAP. -
0x98/0x99wereMM_PROVISION_UNTYPEDandMM_QUERY_CAPACITYfrom the era when mmsrv owned its own untyped pool; the numbers are retired but not reused.
Name service — namesrv.rs
namesrv is deliberately minimal: only two labels.
| Label | Operation |
|---|---|
|
Register a name → endpoint mapping. |
|
Look up an endpoint by name. |
The current name service is a flat dictionary used chiefly so that dns_resolve in trona_posix can find the dnssrv endpoint without having to hard-code a capability slot.
More structured naming (directories, hierarchies) is planned but not yet landed.
POSIX personality — posix.rs
POSIX-only operations that are not part of the generic VFS protocol. These labels live in a separate file to make it clear that non-POSIX subsystems must not depend on them.
posix_ttysrv
| Label | Operation |
|---|---|
|
|
|
|
|
Attach caller as the controlling TTY. |
|
Detach controlling TTY. |
|
Allocate a new pty pair. |
|
Read from a pty slave. |
|
Write to a pty slave. |
|
Close a pty endpoint. |
|
Pty tcgetattr. |
|
Pty tcsetattr. |
|
Pty ioctl. |
|
Pty poll. |
|
Input event from the console driver. |
|
Collect buffered data from a pty. |
|
Write from the pty master side. |
|
Client teardown notification. |
POSIX-only VFS labels
Labels 34 and 35 are VFS operations that were carved out of the generic VFS label space because they are POSIX personality-only:
| Label | Operation |
|---|---|
|
|
|
|
The POSIX_TTYSRV_* constants in posix.rs duplicate the same names in server.rs.
Both copies use the same numeric values.
This redundancy is transitional and will be resolved when protocol/server.rs is reorganized.
|
Win32 personality — win32.rs
Labels used between PE binaries (via kernel32.dll or the yet-to-be-built trona_win32 Rust crate) and the win32_csrss server.
| Label | Operation |
|---|---|
|
PE rtld import resolution. Wire: |
|
Console write with inline data. Wire: |
|
Console read. Wire: |
|
Get mode flags for a console handle. Wire: |
|
Set mode flags. Wire: |
|
PE process announces itself to csrss. Empty wire, |
|
PE process is exiting. Wire: |
The win32.rs file also defines console mode flag constants that W32_GET_CONSOLE_MODE / W32_SET_CONSOLE_MODE exchange:
| Bit | Constant | Meaning |
|---|---|---|
0x0001 |
|
Input side — process Ctrl-C as |
0x0002 |
|
Input side — cook input line-by-line. |
0x0004 |
|
Input side — echo typed characters. |
0x0001 |
|
Output side — interpret escape sequences. |
0x0002 |
|
Output side — wrap lines at end of line. |
Default modes are DEFAULT_INPUT_MODE = PROCESSED_INPUT | LINE_INPUT | ECHO_INPUT (0x0007) and DEFAULT_OUTPUT_MODE = PROCESSED_OUTPUT | WRAP_AT_EOL_OUTPUT (0x0003), matching the Windows defaults.
Of the seven Win32 labels, only W32_RESOLVE_IMPORT (via the PE rtld import resolver), W32_CLIENT_REGISTER (via the future crt startup), and W32_CLIENT_EXIT (via ExitProcess) are expected to be wired in the current PE pipeline.
The four W32_CONSOLE_* labels are defined in the UAPI but are not used by any code built today — kernel32.dll’s `WriteConsoleA/ReadConsoleA implementations go through VFS directly, and the trona_win32 Rust crate that would have called these labels is not built by any meson target.
See trona_win32 Overview for the full story.
|
Server and driver — server.rs
A catch-all file for labels used between servers and drivers that do not fit elsewhere.
Console server
| Label | Operation |
|---|---|
|
Write bytes to the console. |
|
Read bytes from the console. |
|
Console termios query. |
|
Console termios update. |
posix_ttysrv (duplicate of posix.rs)
The same 15 POSIX_TTYSRV_* labels from protocol/posix.rs are re-declared here with the same values (1–4, 10–21).
Call sites historically included this file before the split; the duplication is transitional.
Display server
| Label | Operation |
|---|---|
|
Query display metrics. |
|
Present a framebuffer update. |
|
Fill a rectangle. |
|
Write text at given coordinates. |
|
Write to the terminal subregion. |
|
Set up a command ring buffer for async drawing. |
PCI enumeration server
| Label | Operation |
|---|---|
|
Look up a PCI device by vendor:device. |
|
Enumerate the device’s capability list. |
|
List every enumerated device. |
|
Read a 32-bit config space register. |
|
Return a cap to a BAR range. |
|
Write a 32-bit config space register. |
Block device driver
| Label | Operation |
|---|---|
|
Read sectors. |
|
Write sectors. |
|
Device geometry query. |
|
Flush caches. |
|
Return the SHM descriptor used for bulk transfer. |
SaltyFS server
| Label | Operation |
|---|---|
|
Mount a SaltyFS image. |
|
Lookup a name in a directory. |
|
Read a file. |
|
Enumerate a directory. |
|
Stat a file. |
|
Volume-level info. |
|
Read a small file inline via IPC registers. |
|
Write inline. |
|
Create a file. |
|
Create a directory. |
|
Remove a file. |
|
Remove an empty directory. |
|
Rename. |
|
Truncate a file. |
|
Set up bulk transfer SHM. |
|
Bulk write. |
|
Create a symlink. |
|
Read a symlink target. |
|
Hard link. |
|
Get the parent inode. |
|
Change mode bits. |
|
Change owner. |
|
Get extended attribute. |
|
Set extended attribute. |
|
Remove xattr. |
|
List xattrs. |
Network stack (netsrv)
| Label | Operation |
|---|---|
|
Create a socket. |
|
Connect. |
|
Send. |
|
Receive. |
|
Close. |
|
Bind. |
|
Listen. |
|
Accept. |
|
Sendto. |
|
Recvfrom. |
|
Shutdown. |
|
Get local address. |
|
Get peer address. |
|
Set option. |
|
Get option. |
|
Readiness query. |
|
Register a VFS as a netsrv client. |
|
Completion notification for a deferred operation. |
|
DNS A/AAAA lookup. |
|
DNS PTR lookup. |
|
Read network config. |
|
Look up an ARP entry. |
|
Split blocking primitive for recv. |
|
Split blocking primitive for accept. |
|
Split blocking primitive for recvfrom. |
|
Split blocking primitive for send. |
|
Split blocking primitive for sendto. |
Resource server — rsrcsrv.rs
rsrcsrv is the runtime authority for kernel object allocation, quota accounting, and owner-based reclaim. Labels live in the 0xE0–0xE6 range.
| Label | Operation |
|---|---|
|
Allocate a single kernel object. Request: |
|
Allocate a heterogeneous batch in one IPC. Up to 8 entries inline via MRs; larger batches use the IPC buffer. |
|
Free a handle previously returned by |
|
Reclaim every handle owned by a given |
|
Query current quota usage — bytes in use and handle count. |
|
Set or update quota limits. Setting both to 0 means unlimited. The high bit of |
|
Hand an untyped capability to rsrcsrv’s pool. Used by init during boot to transfer all root untypeds after spawning rsrcsrv. |
RES_QUOTA_FLAG_PROMOTE_PRIVILEGED is a flag used inside the RES_SET_QUOTA request, not a standalone label.
Related pages
-
Syscall ABI — the
SYS_CALL/SYS_SENDsyscalls that carry these labels. -
Invoke Labels — kernel capability invocation labels (distinct from IPC protocol labels).
-
Error Codes — the error space returned in replies to these calls.
-
trona_posix Overview — the client-side code that builds most of these messages.