[BUG] VSpace fixtures inherit a previous private process #17

New issue

Closed

opened 2026-09-17 18:42:05 +02:00 by erikinkinen · 0 comments

erikinkinen commented

2026-09-17 18:42:05 +02:00

Owner

Summary

Synthetic VSpace operation tests can inherit a preceding test's current private
process after rebuilding the root CSpace. The shared object-state guard excludes
concurrent mutation but does not reset attribution. Related mapping fixtures have
the same setup gap. This is a host-test isolation defect; no native authority or
delivery failure is established by these observations.

Reproduction

Original push CI 586
fails at signed fb4e134f2130e9f60608bad0ecc02d8a278887a8 during the optimized
all-feature unit suite. The same-head
PR CI 587 passes.
The original failure is retained and has not been retried unchanged.

Deterministic controls first select a real private TCB/CSpace, then execute the
original fixture reset and assertions. Both existing synthetic controls fail at
endpoint construction with CspaceSlotMissing using:

cargo test --locked --all-features --release kobj::endpoint::vspaced_operation_tests::

The controlled source adds explicit predecessor setup and extracts an existing
shared helper; it is not an unchanged-checkout reproduction. An additional
mapping inventory injects the same predecessor into 32 existing fixture setups
and runs cargo test --locked --all-features --release kobj::vspace::.

Expected and actual behavior

Expected: each bootstrap fixture clears predecessor attribution before resetting
CSpace state. Existing protocol, mapping, lifetime and rights assertions must run
against that fixture's own root, independently of harness order.

Actual original CI: development/default and release/default suites pass 671
units. Release/all-feature reports 694 passed, one failed and three existing
ignored experiments; synthetic_vspaced_requests_reject_mismatched_operations
panics with endpoint: CspaceSlotMissing, and Cargo exits 101.
The two deterministic synthetic controls both fail with the same setup error.
The wider mapping run reports 83 passed, 27 failed, one existing ignored and
587 filtered tests; failures also expose neighbouring frame-fixture attribution.
These diagnostic selections retain their real exit 101 and complete streams.

Environment and identity

Signed Kernel fb4e134f2130e9f60608bad0ecc02d8a278887a8, unchanged original dependencies.
Linux x86_64, Rust 1.97.1 for local controls, optimized all-feature tests,
ordinary test-harness concurrency and warning-denied compilation.
The original synthetic fixture source predates the diagnostic cleanup.
No VM, firmware, external caller, privileged instruction or added production
capability route is involved in the deterministic controls.
Earlier passing schedules do not establish order-independent fixture behavior.

Evidence and prior checks

Both original workflows are terminal: push failure and PR success. All four
complete logs total 706,594 bytes and contain zero warning candidates; both
Markdown jobs pass. The failed synthetic test already holds the shared guard.
Resetting CSpaces leaves its predecessor's TCB pointing at a removed private
CSpace, explaining the deterministic endpoint-construction failure.

The correction shares an existing private-process predecessor helper, clears
TCB attribution before constructing the fresh root, and verifies the resulting
root route. Synthetic and mapping tests retain their behavioral assertions and
run with explicit predecessor controls. The large mapping-test file is split
thematically with documented functions and unchanged test identities. Signed 28dfaea22796925ca438b4a57175520a8d9e7a8c passes four strict development/release matrices: 671 default and 695 all-feature units plus both standalone controls, with three existing ignored experiments. Formatting, private rustdoc, warning-denied host/native Clippy and two freestanding builds pass. All 31 original mapping test identities remain, and the largest thematic file is 277 lines. Original corrected-head automatic CI passes; no production attribution rule or global test concurrency is changed.

Current CI reconciliation — 17 September 2026: Current signed 28dfaea22796925ca438b4a57175520a8d9e7a8c passes original push CI 588 and PR CI 589. All four complete terminal logs are classified: 712,357 bytes and zero warning candidates. Both workflows retain the named regression controls, 671 default/695 all-feature unit results and both standalone controls; three existing experiments remain ignored. Local four strict matrices, host/native Clippy, rustdoc, formatting and two native builds also pass without warnings. No production attribution rule or global harness concurrency is changed. This closes the bounded host-fixture issue, while full source/frame and guest-build acceptance remain open.

Tracking

Owning audit #2 and feature #1; implementation in
PR #3.
Related earlier fixture groups: #5, #8 and #13. Their bounded corrections do not
close this newly reproduced VSpace group. Preserve original failures and close
this issue only after deterministic controls, strict matrices and both original
corrected-head CI runs are classified.

## Summary Synthetic VSpace operation tests can inherit a preceding test's current private process after rebuilding the root CSpace. The shared object-state guard excludes concurrent mutation but does not reset attribution. Related mapping fixtures have the same setup gap. This is a host-test isolation defect; no native authority or delivery failure is established by these observations. ## Reproduction Original [push CI 586](https://git.erikinkinen.fi/erix/kernel/actions/runs/586) fails at signed `fb4e134f2130e9f60608bad0ecc02d8a278887a8` during the optimized all-feature unit suite. The same-head [PR CI 587](https://git.erikinkinen.fi/erix/kernel/actions/runs/587) passes. The original failure is retained and has not been retried unchanged. Deterministic controls first select a real private TCB/CSpace, then execute the original fixture reset and assertions. Both existing synthetic controls fail at endpoint construction with `CspaceSlotMissing` using: ```sh cargo test --locked --all-features --release kobj::endpoint::vspaced_operation_tests:: ``` The controlled source adds explicit predecessor setup and extracts an existing shared helper; it is not an unchanged-checkout reproduction. An additional mapping inventory injects the same predecessor into 32 existing fixture setups and runs `cargo test --locked --all-features --release kobj::vspace::`. ## Expected and actual behavior Expected: each bootstrap fixture clears predecessor attribution before resetting CSpace state. Existing protocol, mapping, lifetime and rights assertions must run against that fixture's own root, independently of harness order. Actual original CI: development/default and release/default suites pass 671 units. Release/all-feature reports 694 passed, one failed and three existing ignored experiments; `synthetic_vspaced_requests_reject_mismatched_operations` panics with `endpoint: CspaceSlotMissing`, and Cargo exits 101. The two deterministic synthetic controls both fail with the same setup error. The wider mapping run reports 83 passed, 27 failed, one existing ignored and 587 filtered tests; failures also expose neighbouring frame-fixture attribution. These diagnostic selections retain their real exit 101 and complete streams. ## Environment and identity - Signed Kernel `fb4e134f2130e9f60608bad0ecc02d8a278887a8`, unchanged original dependencies. - Linux x86_64, Rust 1.97.1 for local controls, optimized all-feature tests, ordinary test-harness concurrency and warning-denied compilation. - The original synthetic fixture source predates the diagnostic cleanup. - No VM, firmware, external caller, privileged instruction or added production capability route is involved in the deterministic controls. - Earlier passing schedules do not establish order-independent fixture behavior. ## Evidence and prior checks Both original workflows are terminal: push failure and PR success. All four complete logs total 706,594 bytes and contain zero warning candidates; both Markdown jobs pass. The failed synthetic test already holds the shared guard. Resetting CSpaces leaves its predecessor's TCB pointing at a removed private CSpace, explaining the deterministic endpoint-construction failure. The correction shares an existing private-process predecessor helper, clears TCB attribution before constructing the fresh root, and verifies the resulting root route. Synthetic and mapping tests retain their behavioral assertions and run with explicit predecessor controls. The large mapping-test file is split thematically with documented functions and unchanged test identities. Signed `28dfaea22796925ca438b4a57175520a8d9e7a8c` passes four strict development/release matrices: 671 default and 695 all-feature units plus both standalone controls, with three existing ignored experiments. Formatting, private rustdoc, warning-denied host/native Clippy and two freestanding builds pass. All 31 original mapping test identities remain, and the largest thematic file is 277 lines. Original corrected-head automatic CI passes; no production attribution rule or global test concurrency is changed. Current CI reconciliation — 17 September 2026: Current signed `28dfaea22796925ca438b4a57175520a8d9e7a8c` passes original [push CI 588](https://git.erikinkinen.fi/erix/kernel/actions/runs/588) and [PR CI 589](https://git.erikinkinen.fi/erix/kernel/actions/runs/589). All four complete terminal logs are classified: 712,357 bytes and zero warning candidates. Both workflows retain the named regression controls, 671 default/695 all-feature unit results and both standalone controls; three existing experiments remain ignored. Local four strict matrices, host/native Clippy, rustdoc, formatting and two native builds also pass without warnings. No production attribution rule or global harness concurrency is changed. This closes the bounded host-fixture issue, while full source/frame and guest-build acceptance remain open. ## Tracking Owning audit #2 and feature #1; implementation in [PR #3](https://git.erikinkinen.fi/erix/kernel/pulls/3). Related earlier fixture groups: #5, #8 and #13. Their bounded corrections do not close this newly reproduced VSpace group. Preserve original failures and close this issue only after deterministic controls, strict matrices and both original corrected-head CI runs are classified.

erikinkinen added the

bug

phase-6

refactor

labels

2026-09-17 18:42:05 +02:00

~~erikinkinen referenced this issue 2026-09-17 18:43:50 +02:00~~

WIP: Enforce native lifetime and staged construction authority #3

erikinkinen referenced this issue

2026-09-17 18:43:53 +02:00

[FEATURE] Supply authorized memory, TLS, threads and race-free blocking for runtimes #1

erikinkinen referenced this issue