# K1121–K1139 syscall ABI preparation

This isolated no_std module prepares the V1 syscall ABI. K1125/K1130/K1135/K1140 require later actual process/EL0 integration after K1120. No SVC, ERET, physical CPU, guest or product acceptance is claimed by host tests or ARM check.

V1 uses SVC immediate zero, x7 version, x8 full 64-bit number and x0–x5 arguments. Numbers 0/1/2 are version, pure six-argument checksum and bounded write. Unknown full numbers and versions return ENOSYS, including u64::MAX; no number truncation is allowed. The checksum signature is U64/U32/I32/U64/U32/I32. U32 discards dirty upper bits; I32 sign extends the low word. Write takes fd U32, address U64 and length U64; a length above256 is EINVAL and address overflow is EFAULT. Unused arguments have no effect.

Success is a private value in0..=i64::MAX. Known errno values encode as negative signed64 in x0. The user decoder returns a tagged result; errors have no unsigned-length conversion. Unknown negative encodings are rejected. EBADF/EFAULT/ENOMEM are distinct.

Dispatcher exclusively owns the backend, frozen exception Controller, nonclone live EntryToken and actual Prepared. A trusted unsafe adapter binds the complete frame to a fresh actual SVC sequence and the current retained process/root. Frozen ReturnAuthority checks RX continuation and RW stack before any service. Preparation must check descriptor authority, the complete user range and retained mapping pins before external output. Commit errors have no output. Output is restricted to copied kernel bytes; user virtual addresses are never directly dereferenced. Failed release returns the actual Prepared.

Wrong CPU, IRQ, I0, wrong stack, stale sequence or malformed input fails before service access. Frame mutation is limited to x0 after all checks and controller leave. After-entry context drift, failed return checks, inconsistent commit length or failed release quarantines and retains the actual entry/prepared resources. A successful release followed by context drift retains the logical entry with no invented resource token. No errno/EL0 return is published on these kernel failures; an output may already exist if a trusted commit later violates its context contract.

Dropping/forgetting Dispatcher performs no resource retirement. Successful extraction requires a healthy quiescent dispatcher. Actual adapters must consume the nonclone UserReturn after all Rust borrows end and perform the source-bound assembly return. The host fixture models CPU/root/frame/descriptor authority and output, while using the real frozen exception ingress/return and Mapping/PinnedRange/copy APIs with owned host RAM. It does not prove an actual CPU instruction or process scheduler.