[BUG] Native lifetime fixture starts its observer before installing its context #14

New issue

Closed

opened 2026-09-15 10:04:45 +02:00 by erikinkinen · 0 comments

erikinkinen commented

2026-09-15 10:04:45 +02:00

Owner

Summary

The expanded isolated lifetime fixture selects its observer as current before installing its execution context. Native setup then rejects starting that already-Running record, so the scenario fails before its begin marker.

Reproduction

Use Kernel ae8d6982ccaea01126a8d97c0926faede6f49935, IPC c453b697b8cdb9cc1c36f1ad89ff868648190025, capability ABI fe8d558253ad01301b99554e20d287c4ea35bb1d, and Integration's native lifetime runner with these original pins. Run bash tests/kernel-lifetime-revocation-vm.sh. One matching-image attempt reproduces the setup failure.

Expected and actual behavior

Expected: the original lifetime markers plus process-bound installation acceptance, with QEMU status 33. Actual: ERIX_KERNEL:LIFETIME_REVOCATION_FAIL before the begin marker; QEMU status 37 and a failed harness result. No native acceptance is claimed for this image.

Environment and identity

Release x86-64 native image, QEMU TCG with one CPU and a 60-second deadline. The 2,252,800-byte boot image has SHA-256 26f6084a32022156805417c97b5d19f980e90a2b3c0539f41d7eb4d8debd3676. Three actual CPL3 participants and the observer's existing Process endpoint are selected by the isolated diagnostic. Kernel 5f497adaefa526108a0439e0e071717dddb85334 passed the preceding lifetime scenario.

Evidence and prior checks

Full strict Kernel host/target matrices and native builds passed; they did not execute this fixture. Retained serial output reaches syscall initialization and then the fixture failure marker. Code inspection identifies set_current_tcb changing a Created observer to Running before start_tcb, which only accepts Created. Defer caller-local branch setup until the original execution-context installation is complete. Preserve all native negative and cleanup checks.

Correction validated: signed Kernel 60da5858d7198185efd103f0e91e5ac2e0b63e67 delays observer selection and local branch derivation until ordinary code/stack installation and start have completed. The same expanded lifetime scenario passes all thirteen native control calls and complete added-custody cleanup in 23.129619 seconds. Its 2,260,992-byte boot image has SHA-256 8e6a9e8f68b90cc1ede61300958cec122b82a7c6dfd6318a51e40fefc7ba166e. The unchanged owned-invocation VM also passes in 27.962322 seconds with image SHA-256 b76a380d3cd6b03b0ff61a3b626ace0667679920684ad7356a1c3a36e2224953. Both have empty QEMU stderr and clean process teardown. Kernel CI 562/563 succeeds with complete warning-free logs. Original failure evidence is retained; no scenario assertion or production state transition was weakened.

Tracking

Related to #11 and process-bound installation. Require a corrected signed image to pass the expanded lifetime scenario and the unchanged owned-invocation VM. Keep this report open until the matching-image correction is demonstrated.

## Summary The expanded isolated lifetime fixture selects its observer as current before installing its execution context. Native setup then rejects starting that already-Running record, so the scenario fails before its begin marker. ## Reproduction Use Kernel `ae8d6982ccaea01126a8d97c0926faede6f49935`, IPC `c453b697b8cdb9cc1c36f1ad89ff868648190025`, capability ABI `fe8d558253ad01301b99554e20d287c4ea35bb1d`, and Integration's native lifetime runner with these original pins. Run `bash tests/kernel-lifetime-revocation-vm.sh`. One matching-image attempt reproduces the setup failure. ## Expected and actual behavior Expected: the original lifetime markers plus process-bound installation acceptance, with QEMU status 33. Actual: `ERIX_KERNEL:LIFETIME_REVOCATION_FAIL` before the begin marker; QEMU status 37 and a failed harness result. No native acceptance is claimed for this image. ## Environment and identity Release x86-64 native image, QEMU TCG with one CPU and a 60-second deadline. The 2,252,800-byte boot image has SHA-256 `26f6084a32022156805417c97b5d19f980e90a2b3c0539f41d7eb4d8debd3676`. Three actual CPL3 participants and the observer's existing Process endpoint are selected by the isolated diagnostic. Kernel `5f497adaefa526108a0439e0e071717dddb85334` passed the preceding lifetime scenario. ## Evidence and prior checks Full strict Kernel host/target matrices and native builds passed; they did not execute this fixture. Retained serial output reaches syscall initialization and then the fixture failure marker. Code inspection identifies `set_current_tcb` changing a Created observer to Running before `start_tcb`, which only accepts Created. Defer caller-local branch setup until the original execution-context installation is complete. Preserve all native negative and cleanup checks. Correction validated: signed Kernel `60da5858d7198185efd103f0e91e5ac2e0b63e67` delays observer selection and local branch derivation until ordinary code/stack installation and start have completed. The same expanded lifetime scenario passes all thirteen native control calls and complete added-custody cleanup in 23.129619 seconds. Its 2,260,992-byte boot image has SHA-256 `8e6a9e8f68b90cc1ede61300958cec122b82a7c6dfd6318a51e40fefc7ba166e`. The unchanged owned-invocation VM also passes in 27.962322 seconds with image SHA-256 `b76a380d3cd6b03b0ff61a3b626ace0667679920684ad7356a1c3a36e2224953`. Both have empty QEMU stderr and clean process teardown. Kernel CI 562/563 succeeds with complete warning-free logs. Original failure evidence is retained; no scenario assertion or production state transition was weakened. ## Tracking Related to #11 and process-bound installation. Require a corrected signed image to pass the expanded lifetime scenario and the unchanged owned-invocation VM. Keep this report open until the matching-image correction is demonstrated.

erikinkinen

2026-09-15 10:04:45 +02:00