Push remaining libc/extern callsites from vm into host_env

Add host_env wrappers and replace the corresponding vm call sites: - host_env::errno::strerror_string for libc::strerror - host_env::io::write_stderr_raw for libc::write(STDERR_FILENO,...) - host_env::locale::localeconv_data reused from vm::format - host_env::os::abort for the inline abort extern - host_env::os::urandom wraps getrandom; getrandom moves from vm to host_env - host_env::posix::lchmod for the macOS/BSD lchmod extern - host_env::posix::fcopyfile for the macOS fcopyfile extern - host_env::nt::wputenv for the Windows _wputenv extern vm/format.rs's get_locale_info now uses host_env on both unix and windows instead of the unix-only libc::localeconv path.
youknowone · May 20, 2026 · May 16, 2026 · May 16, 2026 · May 16, 2026 · May 16, 2026
commit ba3f4fa579ffa869271684041e8e68b5a038c9e7
diff --git a/Cargo.lock b/Cargo.lock
diff --git a/crates/host_env/Cargo.toml b/crates/host_env/Cargo.toml
@@ -12,6 +12,7 @@ license.workspace = true
 rustpython-wtf8 = { workspace = true }
 
 bitflags = { workspace = true }
+getrandom = { workspace = true }
 libc = { workspace = true }
 num-traits = { workspace = true }
 parking_lot = { workspace = true }

diff --git a/crates/host_env/src/errno.rs b/crates/host_env/src/errno.rs
@@ -1,5 +1,18 @@
 // spell-checker:disable
 
+/// Return the platform `strerror(errno)` message as an owned `String`.
+/// Returns `None` when the runtime gives no description for `errno`.
+#[cfg(any(unix, windows))]
+#[must_use]
+pub fn strerror_string(errno: i32) -> Option<String> {
+    let ptr = unsafe { libc::strerror(errno) };
+    if ptr.is_null() {
+        return None;
+    }
+    let s = unsafe { core::ffi::CStr::from_ptr(ptr) }.to_string_lossy();
+    Some(s.into_owned())
+}
+
 #[cfg(any(unix, windows, target_os = "wasi"))]
 pub mod errors {
     pub use libc::*;

diff --git a/crates/host_env/src/io.rs b/crates/host_env/src/io.rs
@@ -252,3 +252,13 @@ pub fn write_once(fd: crt_fd::Borrowed<'_>, buf: &[u8]) -> io::Result<usize> {
 pub fn close_owned_fd(fd: crt_fd::Owned) -> io::Result<()> {
     crt_fd::close(fd)
 }
+
+/// Async-signal-safe raw write to the platform stderr file descriptor.
+/// Avoids `std::io::stderr()` locking so it is safe to call from fork
+/// children and signal handlers.
+#[cfg(unix)]
+pub fn write_stderr_raw(buf: &[u8]) {
+    unsafe {
+        let _ = libc::write(libc::STDERR_FILENO, buf.as_ptr().cast(), buf.len());
+    }
+}
diff --git a/crates/host_env/src/nt.rs b/crates/host_env/src/nt.rs
@@ -1206,6 +1206,7 @@ pub fn mkdir(path: &widestring::WideCStr, mode: i32) -> io::Result<()> {
 
 unsafe extern "C" {
     fn _umask(mask: i32) -> i32;
+    fn _wputenv(envstring: *const u16) -> libc::c_int;
 }
 
 pub fn umask(mask: i32) -> io::Result<i32> {
@@ -1217,6 +1218,17 @@ pub fn umask(mask: i32) -> io::Result<i32> {
     }
 }
 
+/// Update the CRT environment via `_wputenv`.
+/// `envstring` must point to a nul-terminated wide string of the form `KEY=value`.
+pub fn wputenv(envstring: &widestring::WideCStr) -> io::Result<()> {
+    let result = unsafe { crate::suppress_iph!(_wputenv(envstring.as_ptr())) };
+    if result != 0 {
+        Err(crate::os::errno_io_error())
+    } else {
+        Ok(())
+    }
+}
+
 fn set_fd_inheritable(fd: i32, inheritable: bool) -> io::Result<()> {
     let borrowed = unsafe { crt_fd::Borrowed::borrow_raw(fd) };
     let handle = crt_fd::as_handle(borrowed)?;

diff --git a/crates/host_env/src/os.rs b/crates/host_env/src/os.rs
@@ -223,6 +223,21 @@ pub fn exit(code: i32) -> ! {
     std::process::exit(code)
 }
 
+/// Wrapper around the C `abort()` call: terminates the process abnormally.
+pub fn abort() -> ! {
+    unsafe extern "C" {
+        fn abort() -> !;
+    }
+    unsafe { abort() }
+}
+
+/// Read `size` cryptographically random bytes from the OS.
+pub fn urandom(size: usize) -> io::Result<Vec<u8>> {
+    let mut buf = vec![0u8; size];
+    getrandom::fill(&mut buf).map_err(io::Error::from)?;
+    Ok(buf)
+}
+
 #[cfg(any(unix, windows, target_os = "wasi"))]
 pub fn isatty(fd: i32) -> bool {
     unsafe { suppress_iph!(libc::isatty(fd)) != 0 }

diff --git a/crates/host_env/src/posix.rs b/crates/host_env/src/posix.rs
@@ -144,6 +144,36 @@ pub fn unlinkat(dir_fd: i32, path: &CStr) -> std::io::Result<()> {
     }
 }
 
+#[cfg(any(target_os = "macos", target_os = "freebsd", target_os = "netbsd"))]
+pub fn lchmod(path: &CStr, mode: libc::mode_t) -> std::io::Result<()> {
+    unsafe extern "C" {
+        fn lchmod(path: *const libc::c_char, mode: libc::mode_t) -> libc::c_int;
+    }
+    if unsafe { lchmod(path.as_ptr(), mode) } == 0 {
+        Ok(())
+    } else {
+        Err(std::io::Error::last_os_error())
+    }
+}
+
+#[cfg(target_os = "macos")]
+pub fn fcopyfile(in_fd: i32, out_fd: i32, flags: u32) -> std::io::Result<()> {
+    unsafe extern "C" {
+        fn fcopyfile(
+            in_fd: libc::c_int,
+            out_fd: libc::c_int,
+            state: *mut libc::c_void,
+            flags: u32,
+        ) -> libc::c_int;
+    }
+    let ret = unsafe { fcopyfile(in_fd, out_fd, core::ptr::null_mut(), flags) };
+    if ret < 0 {
+        Err(std::io::Error::last_os_error())
+    } else {
+        Ok(())
+    }
+}
+
 #[cfg(not(windows))]
 pub fn make_dir(path: &CStr, mode: u32) -> std::io::Result<()> {
     let ret = unsafe { libc::mkdir(path.as_ptr(), mode as _) };

diff --git a/crates/vm/Cargo.toml b/crates/vm/Cargo.toml
@@ -51,7 +51,6 @@ crossbeam-utils = { workspace = true }
 chrono = { workspace = true }
 constant_time_eq = { workspace = true }
 flame = { workspace = true, optional = true }
-getrandom = { workspace = true }
 hex = { workspace = true }
 indexmap = { workspace = true }
 itertools = { workspace = true }

diff --git a/crates/vm/src/exceptions.rs b/crates/vm/src/exceptions.rs
@@ -1385,28 +1385,16 @@ impl ToOSErrorBuilder for std::io::Error {
             // Use C runtime's strerror for POSIX errno values.
             // For Windows-specific error codes, fall back to FormatMessage.
             const MAX_POSIX_ERRNO: i32 = 127;
-            if errno > 0 && errno <= MAX_POSIX_ERRNO {
-                let ptr = unsafe { libc::strerror(errno) };
-                if !ptr.is_null() {
-                    let s = unsafe { core::ffi::CStr::from_ptr(ptr) }.to_string_lossy();
-                    if !s.starts_with("Unknown error") {
-                        break 'msg s.into_owned();
-                    }
-                }
+            if errno > 0 && errno <= MAX_POSIX_ERRNO
+                && let Some(s) = crate::host_env::errno::strerror_string(errno)
+                && !s.starts_with("Unknown error")
+            {
+                break 'msg s;
             }
             self.to_string()
         };
         #[cfg(unix)]
-        let msg = {
-            let ptr = unsafe { libc::strerror(errno) };
-            if !ptr.is_null() {
-                unsafe { core::ffi::CStr::from_ptr(ptr) }
-                    .to_string_lossy()
-                    .into_owned()
-            } else {
-                self.to_string()
-            }
-        };
+        let msg = crate::host_env::errno::strerror_string(errno).unwrap_or_else(|| self.to_string());
         #[cfg(not(any(windows, unix)))]
         let msg = self.to_string();
 

diff --git a/crates/vm/src/format.rs b/crates/vm/src/format.rs
@@ -10,34 +10,25 @@ use crate::common::format::*;
 use crate::common::wtf8::{Wtf8, Wtf8Buf};
 
 /// Get locale information from C `localeconv()` for the 'n' format specifier.
-#[cfg(unix)]
+#[cfg(any(unix, windows))]
 pub(crate) fn get_locale_info() -> LocaleInfo {
-    use core::ffi::CStr;
-    unsafe {
-        let lc = libc::localeconv();
-        if lc.is_null() {
-            return LocaleInfo {
-                thousands_sep: String::new(),
-                decimal_point: ".".to_string(),
-                grouping: vec![],
-            };
-        }
-        let thousands_sep = CStr::from_ptr((*lc).thousands_sep)
-            .to_string_lossy()
-            .into_owned();
-        let decimal_point = CStr::from_ptr((*lc).decimal_point)
-            .to_string_lossy()
-            .into_owned();
-        let grouping = parse_grouping((*lc).grouping);
-        LocaleInfo {
-            thousands_sep,
-            decimal_point,
-            grouping,
-        }
+    let lc = crate::host_env::locale::localeconv_data();
+    let mut grouping: Vec<u8> = lc.grouping.iter().map(|&c| c as u8).collect();
+    if !grouping.is_empty() {
+        grouping.push(0);
+    }
+    LocaleInfo {
+        thousands_sep: String::from_utf8_lossy(&lc.thousands_sep).into_owned(),
+        decimal_point: if lc.decimal_point.is_empty() {
+            ".".to_string()
+        } else {
+            String::from_utf8_lossy(&lc.decimal_point).into_owned()
+        },
+        grouping,
     }
 }
 
-#[cfg(not(unix))]
+#[cfg(not(any(unix, windows)))]
 pub(crate) fn get_locale_info() -> LocaleInfo {
     LocaleInfo {
         thousands_sep: String::new(),
@@ -46,30 +37,6 @@ pub(crate) fn get_locale_info() -> LocaleInfo {
     }
 }
 
-/// Parse C `lconv.grouping` into a `Vec<u8>`.
-/// Reads bytes until 0 or CHAR_MAX, then appends 0 (meaning "repeat last group").
-#[cfg(unix)]
-unsafe fn parse_grouping(grouping: *const libc::c_char) -> Vec<u8> {
-    let mut result = Vec::new();
-    if grouping.is_null() {
-        return result;
-    }
-
-    unsafe {
-        let mut ptr = grouping;
-        while ![0, libc::c_char::MAX].contains(&*ptr) {
-            result.push(*ptr as _);
-            ptr = ptr.add(1);
-        }
-    }
-
-    if !result.is_empty() {
-        result.push(0);
-    }
-
-    result
-}
-
 impl IntoPyException for FormatSpecError {
     fn into_pyexception(self, vm: &VirtualMachine) -> PyBaseExceptionRef {
         match self {

diff --git a/crates/vm/src/stdlib/os.rs b/crates/vm/src/stdlib/os.rs
@@ -466,11 +466,6 @@ pub(super) mod _os {
         }
     }
 
-    #[cfg(windows)]
-    unsafe extern "C" {
-        fn _wputenv(envstring: *const u16) -> libc::c_int;
-    }
-
     /// Check if wide string length exceeds Windows environment variable limit.
     #[cfg(windows)]
     fn check_env_var_len(wide_len: usize, vm: &VirtualMachine) -> PyResult<()> {
@@ -498,15 +493,13 @@ pub(super) mod _os {
             return Err(vm.new_value_error("illegal environment variable name"));
         }
         let env_str = format!("{key_str}={value_str}");
-        let wide = env_str.to_wide_with_nul();
-        check_env_var_len(wide.len(), vm)?;
+        // env_str is guaranteed nul-free by the checks above.
+        let wide = widestring::WideCString::from_str(&env_str)
+            .expect("env_str validated to contain no NUL");
+        check_env_var_len(wide.len() + 1, vm)?;
 
-        // Use _wputenv like CPython (not SetEnvironmentVariableW) to update CRT environ
-        let result = unsafe { rustpython_host_env::suppress_iph!(_wputenv(wide.as_ptr())) };
-        if result != 0 {
-            return Err(vm.new_last_errno_error());
-        }
-        Ok(())
+        // Use _wputenv (not SetEnvironmentVariableW) to update CRT environ.
+        rustpython_host_env::nt::wputenv(&wide).map_err(|e| e.into_pyexception(vm))
     }
 
     #[cfg(not(windows))]
@@ -1434,20 +1427,15 @@ pub(super) mod _os {
 
     #[pyfunction]
     fn abort() {
-        unsafe extern "C" {
-            fn abort();
-        }
-        unsafe { abort() }
+        crate::host_env::os::abort()
     }
 
     #[pyfunction]
     fn urandom(size: isize, vm: &VirtualMachine) -> PyResult<Vec<u8>> {
         if size < 0 {
             return Err(vm.new_value_error("negative argument not allowed"));
         }
-        let mut buf = vec![0u8; size as usize];
-        getrandom::fill(&mut buf).map_err(|e| io::Error::from(e).into_pyexception(vm))?;
-        Ok(buf)
+        crate::host_env::os::urandom(size as usize).map_err(|e| e.into_pyexception(vm))
     }
 
     #[pyfunction]

diff --git a/crates/vm/src/stdlib/posix.rs b/crates/vm/src/stdlib/posix.rs
@@ -999,16 +999,9 @@ pub mod module {
     #[cfg(any(target_os = "macos", target_os = "freebsd", target_os = "netbsd",))]
     #[pyfunction]
     fn lchmod(path: OsPath, mode: u32, vm: &VirtualMachine) -> PyResult<()> {
-        unsafe extern "C" {
-            fn lchmod(path: *const libc::c_char, mode: libc::mode_t) -> libc::c_int;
-        }
         let c_path = path.clone().into_cstring(vm)?;
-        if unsafe { lchmod(c_path.as_ptr(), mode as libc::mode_t) } == 0 {
-            Ok(())
-        } else {
-            let err = std::io::Error::last_os_error();
-            Err(OSErrorBuilder::with_filename(&err, path, vm))
-        }
+        rustpython_host_env::posix::lchmod(&c_path, mode as libc::mode_t)
+            .map_err(|err| OSErrorBuilder::with_filename(&err, path, vm))
     }
 
     #[pyfunction]
@@ -1660,27 +1653,11 @@ pub mod module {
         Ok(_os::TerminalSizeData { columns, lines })
     }
 
-    // from libstd:
-    // https://github.com/rust-lang/rust/blob/daecab3a784f28082df90cebb204998051f3557d/src/libstd/sys/unix/fs.rs#L1251
-    #[cfg(target_os = "macos")]
-    unsafe extern "C" {
-        fn fcopyfile(
-            in_fd: libc::c_int,
-            out_fd: libc::c_int,
-            state: *mut libc::c_void, // copyfile_state_t (unused)
-            flags: u32,               // copyfile_flags_t
-        ) -> libc::c_int;
-    }
-
     #[cfg(target_os = "macos")]
     #[pyfunction]
     fn _fcopyfile(in_fd: i32, out_fd: i32, flags: i32, vm: &VirtualMachine) -> PyResult<()> {
-        let ret = unsafe { fcopyfile(in_fd, out_fd, core::ptr::null_mut(), flags as u32) };
-        if ret < 0 {
-            Err(vm.new_last_errno_error())
-        } else {
-            Ok(())
-        }
+        rustpython_host_env::posix::fcopyfile(in_fd, out_fd, flags as u32)
+            .map_err(|err| err.into_pyexception(vm))
     }
 
     #[pyfunction]

diff --git a/crates/vm/src/vm/mod.rs b/crates/vm/src/vm/mod.rs
@@ -572,9 +572,7 @@ pub(super) fn stw_trace(msg: core::fmt::Arguments<'_>) {
             crate::stdlib::_thread::get_ident(),
             msg
         );
-        unsafe {
-            let _ = libc::write(libc::STDERR_FILENO, out.buf.as_ptr().cast(), out.len);
-        }
+        crate::host_env::io::write_stderr_raw(&out.buf[..out.len]);
     }
 }