[BUG] Managed-frame occupancy diagnostic maps a Kernel heap address outside the ordinary domain #28

New issue

Closed

opened 2026-09-22 05:31:18 +02:00 by erikinkinen · 0 comments

erikinkinen commented

2026-09-22 05:31:18 +02:00

Owner

Summary

The maintained managed-frame occupancy VM fails during bootstrap because its diagnostic uses a Kernel heap virtual address as an ordinary managed-frame mapping destination. The ordinary address-domain guard correctly rejects that upper-half address. Host tests pass with lower-half host allocator addresses and do not expose this native fixture mismatch.

Reproduction

At Integration c17d8f1f18f55c0d159a80772ab8e5bbad8d7f04, selecting signed Kernel fa9491c65d173fa618c4c0ad241a5c4fe93d28e2, run:

bash scripts/run-scenario.sh tests/scenarios/kernel-managed-frame-occupancy-positive.toml components.toml

One original execution failed. No rerun or deadline extension was used. The original source graph and actual producer artifacts were retained before making any correction.

Expected and actual behavior

Expected: allocator self-test start, managed-frame occupancy success, allocator summary success and subsequent service/Rootd readiness within the original 60-second deadline and expected guest exit code 0x10.

Actual: outer runner exit status 1 with the following ordered failure markers; occupancy success and service readiness are absent:

ERIX_KERNEL:RAM_ALLOCATOR_DOMAIN_SELFTEST:START
ERIX_KERNEL:RAM_ALLOCATOR_DOMAIN_SELFTEST:FAIL
ERIX_KRN:ROOT_SLOT_POLICY_VIOLATION
ERIX_KERNEL:ROOT_LAUNCH_FAIL

Environment and identity

Kernel and Integration revisions are specified above; subsequent documentation-only public heads preserve these executable inputs.
Maintained subsystem-positive release image, x86-64 full-system QEMU/OVMF, one CPU, Rust 1.97.1 and the scenario's original RAM allocator domain diagnostic feature selection.
Boot image SHA-256: 7f8a40994e64658aef84773dd82d4c113efd6c2198857504a97be9f952dfad34.
The diagnostic operates through explicitly allocated private VSpace and managed-frame capabilities in the bootstrap CSpace. Its VSpace stays inactive and has no Process binding.
Older passing CI baseline: Kernel a9bdf6163813d378e0b4a164bceb839e24fbb6b7, selected by Integration 9c62af2d2484b1ab0cadba768adc025dfd017485; original CI 1707 and 1708 both report the occupancy scenario passing within their complete 489-scenario catalogs. This baseline was verified from complete logs after the initial report.

Evidence and prior checks

All seven principal image/firmware/serial artifacts and original producer inputs are retained. The packaged Kernel matches exactly one normally stripped original cache ELF. Its Kernel heap symbol lies in the upper half, confirming the source-level fixture mismatch. No compiler/image warnings were observed. This report records a diagnostic regression, not an observed bypass of the production guard.

The corrected Kernel admits an explicit, initially empty lower-half window and removes the unnecessary heap allocation and raw-pointer cleanup state. It preserves production ordinary-domain enforcement and all original 64-page occupancy, alias retirement, lowest-hole reuse, physical-byte and partial-cleanup controls. Four strict host configurations pass 766/790 tests with three existing ignored cases; fourteen native builds and binary Clippy profiles, formatting and host/native private rustdoc pass without warnings.

The coordinated signed catalog passes all 172 maintained helpers. The occupancy and allocator-domain VM scenarios each pass with their original 60/120-second deadlines, all prior markers, 73 exact signed source identities and retained packaged-ELF matches. The ordinary exec-successor VM also passes against the full graph and original deadline. No image warnings or QEMU stderr were observed. The original failed run, image and producer artifacts remain independently retained. This closes the diagnostic mismatch; independent roots, complete authority cleanup and full guest rebuilding remain open.

Tracking

Track the correction in Kernel PR 3 and coordinated source adoption in Integration PR 12. The phase checklist remains open. Independent-root design retains the separate inactive physical-access window follow-up. No complete guest build or authority-cleanup acceptance follows from repairing this diagnostic.

## Summary The maintained managed-frame occupancy VM fails during bootstrap because its diagnostic uses a Kernel heap virtual address as an ordinary managed-frame mapping destination. The ordinary address-domain guard correctly rejects that upper-half address. Host tests pass with lower-half host allocator addresses and do not expose this native fixture mismatch. ## Reproduction At Integration `c17d8f1f18f55c0d159a80772ab8e5bbad8d7f04`, selecting signed Kernel `fa9491c65d173fa618c4c0ad241a5c4fe93d28e2`, run: ```sh bash scripts/run-scenario.sh tests/scenarios/kernel-managed-frame-occupancy-positive.toml components.toml ``` One original execution failed. No rerun or deadline extension was used. The original source graph and actual producer artifacts were retained before making any correction. ## Expected and actual behavior Expected: allocator self-test start, managed-frame occupancy success, allocator summary success and subsequent service/Rootd readiness within the original 60-second deadline and expected guest exit code `0x10`. Actual: outer runner exit status 1 with the following ordered failure markers; occupancy success and service readiness are absent: ```text ERIX_KERNEL:RAM_ALLOCATOR_DOMAIN_SELFTEST:START ERIX_KERNEL:RAM_ALLOCATOR_DOMAIN_SELFTEST:FAIL ERIX_KRN:ROOT_SLOT_POLICY_VIOLATION ERIX_KERNEL:ROOT_LAUNCH_FAIL ``` ## Environment and identity - Kernel and Integration revisions are specified above; subsequent documentation-only public heads preserve these executable inputs. - Maintained subsystem-positive release image, x86-64 full-system QEMU/OVMF, one CPU, Rust 1.97.1 and the scenario's original RAM allocator domain diagnostic feature selection. - Boot image SHA-256: `7f8a40994e64658aef84773dd82d4c113efd6c2198857504a97be9f952dfad34`. - The diagnostic operates through explicitly allocated private VSpace and managed-frame capabilities in the bootstrap CSpace. Its VSpace stays inactive and has no Process binding. - Older passing CI baseline: Kernel `a9bdf6163813d378e0b4a164bceb839e24fbb6b7`, selected by Integration `9c62af2d2484b1ab0cadba768adc025dfd017485`; original [CI 1707](https://git.erikinkinen.fi/erix/integration/actions/runs/1707) and [1708](https://git.erikinkinen.fi/erix/integration/actions/runs/1708) both report the occupancy scenario passing within their complete 489-scenario catalogs. This baseline was verified from complete logs after the initial report. ## Evidence and prior checks All seven principal image/firmware/serial artifacts and original producer inputs are retained. The packaged Kernel matches exactly one normally stripped original cache ELF. Its Kernel heap symbol lies in the upper half, confirming the source-level fixture mismatch. No compiler/image warnings were observed. This report records a diagnostic regression, not an observed bypass of the production guard. The [corrected Kernel](https://git.erikinkinen.fi/erix/kernel/commit/bc49d6da2684dae6073a03c422e0ea2265d03f31) admits an explicit, initially empty lower-half window and removes the unnecessary heap allocation and raw-pointer cleanup state. It preserves production ordinary-domain enforcement and all original 64-page occupancy, alias retirement, lowest-hole reuse, physical-byte and partial-cleanup controls. Four strict host configurations pass 766/790 tests with three existing ignored cases; fourteen native builds and binary Clippy profiles, formatting and host/native private rustdoc pass without warnings. The [coordinated signed catalog](https://git.erikinkinen.fi/erix/integration/commit/69a1303d848d629efebcc532fff73457c3ab834f) passes all 172 maintained helpers. The occupancy and allocator-domain VM scenarios each pass with their original 60/120-second deadlines, all prior markers, 73 exact signed source identities and retained packaged-ELF matches. The ordinary exec-successor VM also passes against the full graph and original deadline. No image warnings or QEMU stderr were observed. The original failed run, image and producer artifacts remain independently retained. This closes the diagnostic mismatch; independent roots, complete authority cleanup and full guest rebuilding remain open. ## Tracking Track the correction in [Kernel PR 3](https://git.erikinkinen.fi/erix/kernel/pulls/3) and coordinated source adoption in [Integration PR 12](https://git.erikinkinen.fi/erix/integration/pulls/12). [The phase checklist](https://git.erikinkinen.fi/erix/integration/issues/65) remains open. [Independent-root design](https://git.erikinkinen.fi/erix/kernel/issues/22) retains the separate inactive physical-access window follow-up. No complete guest build or authority-cleanup acceptance follows from repairing this diagnostic.

erikinkinen added the

bug

phase-6

labels

2026-09-22 05:31:18 +02:00

erikinkinen referenced this issue

2026-09-22 05:31:18 +02:00

WIP: Enforce native lifetime and staged construction authority #3

erikinkinen referenced this issue

2026-09-22 05:31:20 +02:00

[FEATURE] Own hardware page-table roots for native address-space switching #22

erikinkinen referenced this issue from erix/integration