[BUG] Drop-local-cap window fixture inherits the previous private process #29

New issue

Closed

opened 2026-09-22 07:39:20 +02:00 by erikinkinen · 0 comments

erikinkinen commented

2026-09-22 07:39:20 +02:00

Owner

Summary

The existing drop-local-cap window unit test can inherit the previous test's current private process while replacing the CSpace table. Its capability setup then targets a CSpace absent from the new table and fails before testing slot-window rejection. This is a host fixture isolation defect; no native capability-admission failure is established.

Reproduction

At Kernel 71e2ca157d9a3fc604f212eda86d1157bbd3a46b, original PR CI 651 fails arch::x86_64::syscall::tests::dispatch_drop_local_cap_rejects_zero_and_slots_outside_process_window; original push CI 650 passes the same revision. Neither workflow has been rerun.

A deterministic local control calls the existing test-only leave_private_cspace_current helper immediately after acquiring the test guard, leaving the original reset sequence and assertions unchanged. cargo test --locked --release --all-features --lib dispatch_drop_local_cap_rejects_zero_and_slots_outside_process_window then runs exactly one test and fails with Cargo status 101 and tcb cap: CspaceSlotMissing. This is one explicit predecessor-injection control, not an unchanged clean-checkout reproduction.

Expected and actual behavior

The fixture must clear predecessor task attribution before creating its root CSpace. Zero-slot and out-of-window rejection must remain independent of test order and retain their existing expected results.

The original PR run passes both default test configurations (785 tests each), then fails the release all-feature selection with 808 passed, one failed and three existing ignored cases. The failure occurs during TCB capability installation. The same-head push passes 785/809 tests. A successful independent run does not resolve the failed fixture.

Environment and identity

Kernel: 71e2ca157d9a3fc604f212eda86d1157bbd3a46b, branch feature/posix-compat, workflow ci.yml.
Host unit tests on Linux x86_64; deterministic local control uses Rust 1.97.1 with warning-denied compilation and original pinned dependency objects.
The shared fixture lock is held throughout reset and capability setup. It serializes mutation but does not reset the previous current TCB.
No VM image, production syscall ABI or userspace grant changes are involved in the reproduction.
A last passing exact revision is not asserted: both original same-head outcomes are retained.

Evidence and prior checks

All four original Kernel CI logs are complete and hash-verified, totaling 802,196 bytes with zero warning candidates. The deterministic failed source, output, exit status and process cleanup are retained separately. current_cspace_id follows the selected TCB; init_root_cspace resets CSpace records without changing that TCB. The explicit private predecessor reproduces the exact missing-CSpace setup error without relying on scheduler timing.

The correction reuses fresh_root_after_private_process, which deliberately seeds a private predecessor and resets task attribution before constructing the new root. Original slot assertions and ordinary test concurrency remain unchanged. Strict validation and CI of the corrected signed revision are required before closure; rerunning the failed revision supplies no correction.

Corrected fixture acceptance — 22 September 2026: signed Kernel 12184850cd73 reuses the existing deterministic predecessor initializer and preserves both original slot-rejection assertions. The explicit predecessor control fails against the original reset sequence and passes in every corrected local configuration. Four strict local 785/809-test configurations, fourteen native builds and binary Clippy profiles, formatting including the touched test fragment, and private rustdoc pass without warnings. Only the host test fragment and roadmap change; production sources, Git dependency pins and Integration catalogs retain their exact validated identity. No new runtime feature or VM execution is claimed for this host-only correction.

Corrected push CI 652 and PR CI 653 both pass. All four complete original logs (807,886 bytes) are hash-verified without warning candidates. Both runs pass 785/809 tests and the deterministic fixture under ordinary harness concurrency. The original failed PR 651, independent passing push 650 and deterministic Cargo-101 control remain retained. This closes the reported fixture defect; broader authority review and Phase 6 acceptance remain open.

Tracking

Related earlier fixture defects: allocator and synthetic-service attribution, endpoint attribution, and VSpace attribution. This report tracks the distinct remaining syscall fixture.

Owning Kernel audit, implementation review, and Phase 6 completion retain the broader obligations. Preserve the original failure, verify deterministic order independence and monitor the corrected full host matrix.

## Summary The existing drop-local-cap window unit test can inherit the previous test's current private process while replacing the CSpace table. Its capability setup then targets a CSpace absent from the new table and fails before testing slot-window rejection. This is a host fixture isolation defect; no native capability-admission failure is established. ## Reproduction At Kernel `71e2ca157d9a3fc604f212eda86d1157bbd3a46b`, original [PR CI 651](https://git.erikinkinen.fi/erix/kernel/actions/runs/651) fails `arch::x86_64::syscall::tests::dispatch_drop_local_cap_rejects_zero_and_slots_outside_process_window`; original [push CI 650](https://git.erikinkinen.fi/erix/kernel/actions/runs/650) passes the same revision. Neither workflow has been rerun. A deterministic local control calls the existing test-only `leave_private_cspace_current` helper immediately after acquiring the test guard, leaving the original reset sequence and assertions unchanged. `cargo test --locked --release --all-features --lib dispatch_drop_local_cap_rejects_zero_and_slots_outside_process_window` then runs exactly one test and fails with Cargo status 101 and `tcb cap: CspaceSlotMissing`. This is one explicit predecessor-injection control, not an unchanged clean-checkout reproduction. ## Expected and actual behavior The fixture must clear predecessor task attribution before creating its root CSpace. Zero-slot and out-of-window rejection must remain independent of test order and retain their existing expected results. The original PR run passes both default test configurations (785 tests each), then fails the release all-feature selection with 808 passed, one failed and three existing ignored cases. The failure occurs during TCB capability installation. The same-head push passes 785/809 tests. A successful independent run does not resolve the failed fixture. ## Environment and identity - Kernel: `71e2ca157d9a3fc604f212eda86d1157bbd3a46b`, branch `feature/posix-compat`, workflow `ci.yml`. - Host unit tests on Linux x86_64; deterministic local control uses Rust 1.97.1 with warning-denied compilation and original pinned dependency objects. - The shared fixture lock is held throughout reset and capability setup. It serializes mutation but does not reset the previous current TCB. - No VM image, production syscall ABI or userspace grant changes are involved in the reproduction. - A last passing exact revision is not asserted: both original same-head outcomes are retained. ## Evidence and prior checks All four original Kernel CI logs are complete and hash-verified, totaling 802,196 bytes with zero warning candidates. The deterministic failed source, output, exit status and process cleanup are retained separately. `current_cspace_id` follows the selected TCB; `init_root_cspace` resets CSpace records without changing that TCB. The explicit private predecessor reproduces the exact missing-CSpace setup error without relying on scheduler timing. The correction reuses `fresh_root_after_private_process`, which deliberately seeds a private predecessor and resets task attribution before constructing the new root. Original slot assertions and ordinary test concurrency remain unchanged. Strict validation and CI of the corrected signed revision are required before closure; rerunning the failed revision supplies no correction. Corrected fixture acceptance — 22 September 2026: signed [Kernel `12184850cd73`](https://git.erikinkinen.fi/erix/kernel/commit/12184850cd73fff066abcb7f97039a0828b2a928) reuses the existing deterministic predecessor initializer and preserves both original slot-rejection assertions. The explicit predecessor control fails against the original reset sequence and passes in every corrected local configuration. Four strict local 785/809-test configurations, fourteen native builds and binary Clippy profiles, formatting including the touched test fragment, and private rustdoc pass without warnings. Only the host test fragment and roadmap change; production sources, Git dependency pins and Integration catalogs retain their exact validated identity. No new runtime feature or VM execution is claimed for this host-only correction. Corrected [push CI 652](https://git.erikinkinen.fi/erix/kernel/actions/runs/652) and [PR CI 653](https://git.erikinkinen.fi/erix/kernel/actions/runs/653) both pass. All four complete original logs (807,886 bytes) are hash-verified without warning candidates. Both runs pass 785/809 tests and the deterministic fixture under ordinary harness concurrency. The original failed PR 651, independent passing push 650 and deterministic Cargo-101 control remain retained. This closes the reported fixture defect; broader authority review and Phase 6 acceptance remain open. ## Tracking Related earlier fixture defects: [allocator and synthetic-service attribution](https://git.erikinkinen.fi/erix/kernel/issues/8), [endpoint attribution](https://git.erikinkinen.fi/erix/kernel/issues/13), and [VSpace attribution](https://git.erikinkinen.fi/erix/kernel/issues/17). This report tracks the distinct remaining syscall fixture. Owning [Kernel audit](https://git.erikinkinen.fi/erix/kernel/issues/2), [implementation review](https://git.erikinkinen.fi/erix/kernel/pulls/3), and [Phase 6 completion](https://git.erikinkinen.fi/erix/integration/issues/65) retain the broader obligations. Preserve the original failure, verify deterministic order independence and monitor the corrected full host matrix.

erikinkinen added the

bug

phase-6

labels

2026-09-22 07:39:20 +02:00

erikinkinen referenced this issue

2026-09-22 07:39:21 +02:00

[FEATURE] Supply authorized memory, TLS, threads and race-free blocking for runtimes #1

erikinkinen referenced this issue

2026-09-22 07:39:23 +02:00

[FEATURE] Audit authority, code quality and documentation in kernel #2

erikinkinen referenced this issue