[BUG] Parallel interrupt tests can reset each other’s pending events #4

New issue

Closed

opened 2026-09-12 08:40:51 +02:00 by erikinkinen · 0 comments

erikinkinen commented

2026-09-12 08:40:51 +02:00

Owner

Summary

Kernel interrupt unit tests mutate one shared runtime singleton without holding
a common guard for the complete test transaction. Parallel execution can reset
another test's pending event and make an unchanged assertion fail, obscuring
actual regressions in the strict component suite.

Reproduction

At kernel commit ec7b63d11c2a8dc91b0741e97a863bafc7b94788, run
RUSTFLAGS='-D warnings' cargo test --all-targets with ordinary parallel test
execution and the original commit-pinned Git dependencies.

The first observed exact-source run failed once; no failure-frequency estimate
or deterministic schedule is claimed. Code inspection identifies four tests in
src/kobj/interrupt.rs that call init_interrupts() and then operate on the
same singleton without transaction-wide test isolation. Another test can reset
the pending state between wait and acknowledgement.

Expected and actual behavior

ack_rejects_sequence_mismatch should retain its pending event until it checks
an incorrect sequence and receives SequenceMismatch. It instead received
NotPending at the assertion. Cargo exited 101 with 584 tests passed, one failed
and three explicitly ignored performance experiments.

Environment and identity

Kernel: ec7b63d11c2a8dc91b0741e97a863bafc7b94788, default features,
ordinary host unit-test parallelism, Rust 1.97.1 on x86_64 Linux.
All six dependency packages retained original Git source URLs and matching
full declared/resolved commit hashes in Cargo metadata. No path patches or
ancestor Cargo configuration participated in this failing run.
No image, firmware, VM input or guest authority is involved; the tests own
simulated kernel state within the host unit-test process.
The failing interrupt test bodies are unchanged by the endpoint-test
partition. No earlier reliably race-free revision is established.

Evidence and prior checks

The observed assertion reported left: NotPending, right: SequenceMismatch.
Formatting and strict default Clippy passed before the failing unit suite.
The first earlier suite used a different local dependency-override environment
and is not accepted as immutable-source validation. All results are retained;
the failing run is not replaced by a retry of unchanged inputs.

The transaction-wide guard is implemented in signed commit
c20dfa04627654748316d601b0ddd18a3e4ad13f and retained at
0911b10fd6e76de8ebe97d5ce755f22da8037864. Seven focused interrupt tests pass
with eight threads; exact-source default/all-feature suites pass 586/610 tests
with the three pre-existing ignored experiments. Strict component checks pass
without compiler warnings. Production behavior and original assertions are
unchanged; current-head CI review is recorded below.

Current CI reconciliation — 17 September 2026: Current signed 28dfaea22796925ca438b4a57175520a8d9e7a8c passes original push CI 588 and PR CI 589. All four complete terminal logs are classified: 712,357 bytes and zero warning candidates. Both workflows retain the named regression controls, 671 default/695 all-feature unit results and both standalone controls; three existing experiments remain ignored. Local four strict matrices, host/native Clippy, rustdoc, formatting and two native builds also pass without warnings. No production attribution rule or global harness concurrency is changed. This closes the bounded host-fixture issue, while full source/frame and guest-build acceptance remain open.

Tracking

Related audit: erix/kernel#2. Implementation review: erix/kernel#3.

Serialize only tests touching the shared interrupt runtime, using the
established kernel test guard and checking other callers for the same hazard.
Preserve runtime interrupt behavior and all original assertions.
Pass the exact-source default/all-feature suites with ordinary parallel
execution, strict Clippy, formatting and warning-denied component checks.
Review exact-head CI and retain this original failure as separate evidence.

## Summary Kernel interrupt unit tests mutate one shared runtime singleton without holding a common guard for the complete test transaction. Parallel execution can reset another test's pending event and make an unchanged assertion fail, obscuring actual regressions in the strict component suite. ## Reproduction At kernel commit `ec7b63d11c2a8dc91b0741e97a863bafc7b94788`, run `RUSTFLAGS='-D warnings' cargo test --all-targets` with ordinary parallel test execution and the original commit-pinned Git dependencies. The first observed exact-source run failed once; no failure-frequency estimate or deterministic schedule is claimed. Code inspection identifies four tests in `src/kobj/interrupt.rs` that call `init_interrupts()` and then operate on the same singleton without transaction-wide test isolation. Another test can reset the pending state between wait and acknowledgement. ## Expected and actual behavior `ack_rejects_sequence_mismatch` should retain its pending event until it checks an incorrect sequence and receives `SequenceMismatch`. It instead received `NotPending` at the assertion. Cargo exited 101 with 584 tests passed, one failed and three explicitly ignored performance experiments. ## Environment and identity - Kernel: `ec7b63d11c2a8dc91b0741e97a863bafc7b94788`, default features, ordinary host unit-test parallelism, Rust 1.97.1 on x86_64 Linux. - All six dependency packages retained original Git source URLs and matching full declared/resolved commit hashes in Cargo metadata. No path patches or ancestor Cargo configuration participated in this failing run. - No image, firmware, VM input or guest authority is involved; the tests own simulated kernel state within the host unit-test process. - The failing interrupt test bodies are unchanged by the endpoint-test partition. No earlier reliably race-free revision is established. ## Evidence and prior checks The observed assertion reported `left: NotPending`, `right: SequenceMismatch`. Formatting and strict default Clippy passed before the failing unit suite. The first earlier suite used a different local dependency-override environment and is not accepted as immutable-source validation. All results are retained; the failing run is not replaced by a retry of unchanged inputs. The transaction-wide guard is implemented in signed commit `c20dfa04627654748316d601b0ddd18a3e4ad13f` and retained at `0911b10fd6e76de8ebe97d5ce755f22da8037864`. Seven focused interrupt tests pass with eight threads; exact-source default/all-feature suites pass 586/610 tests with the three pre-existing ignored experiments. Strict component checks pass without compiler warnings. Production behavior and original assertions are unchanged; current-head CI review is recorded below. Current CI reconciliation — 17 September 2026: Current signed `28dfaea22796925ca438b4a57175520a8d9e7a8c` passes original [push CI 588](https://git.erikinkinen.fi/erix/kernel/actions/runs/588) and [PR CI 589](https://git.erikinkinen.fi/erix/kernel/actions/runs/589). All four complete terminal logs are classified: 712,357 bytes and zero warning candidates. Both workflows retain the named regression controls, 671 default/695 all-feature unit results and both standalone controls; three existing experiments remain ignored. Local four strict matrices, host/native Clippy, rustdoc, formatting and two native builds also pass without warnings. No production attribution rule or global harness concurrency is changed. This closes the bounded host-fixture issue, while full source/frame and guest-build acceptance remain open. ## Tracking Related audit: erix/kernel#2. Implementation review: erix/kernel#3. - [x] Serialize only tests touching the shared interrupt runtime, using the established kernel test guard and checking other callers for the same hazard. - [x] Preserve runtime interrupt behavior and all original assertions. - [x] Pass the exact-source default/all-feature suites with ordinary parallel execution, strict Clippy, formatting and warning-denied component checks. - [x] Review exact-head CI and retain this original failure as separate evidence.

erikinkinen added the

bug

phase-6

labels

2026-09-12 08:40:51 +02:00

erikinkinen referenced this issue

2026-09-12 08:49:31 +02:00

[BUG] Mapping-cleanup unit test loses its root CSpace slot in parallel CI #5

erikinkinen referenced this issue from a commit

2026-09-12 09:00:52 +02:00

fix: Isolate shared kernel test state

~~erikinkinen referenced this issue 2026-09-12 09:03:23 +02:00~~