[BUG] Mapping-cleanup unit test loses its root CSpace slot in parallel CI #5

New issue

Closed

opened 2026-09-12 08:49:31 +02:00 by erikinkinen · 0 comments

erikinkinen commented

2026-09-12 08:49:31 +02:00

Owner

Summary

The kernel mapping-cleanup unit test failed in parallel CI while creating its
fixture, before it could check selective graph cleanup. The same source head
passed a separate push run. The cause is now reproduced deterministically:
root setup removed the private CSpace still selected by a predecessor TCB.

Reproduction

Kernel PR run 509,
job 19281, ran the default host suite with ordinary test parallelism at
ec7b63d11c2a8dc91b0741e97a863bafc7b94788. The failing command was
cargo test --all-targets with warnings denied. This is one observed CI
failure; no failure-frequency estimate is established. A focused regression
now creates an explicit private-CSpace predecessor, leaves it current and runs
the old fixture ordering alone with one thread. It reproduces the same
CspaceSlotMissing error before the fix and passes afterward.

Expected and actual behavior

The fixture initializes the root CSpace and should install its root capability
before exercising selective cleanup. Instead,
dynlink_mapping::tests::selective_cleanup_revokes_only_the_failed_graph_objects
panicked at src/dynlink_mapping/tests.rs:74 with
cspace root cap: CspaceSlotMissing. The suite reported 584 passed, one failed
and three ignored performance experiments; Cargo exited 101.

Environment and identity

Kernel revision: ec7b63d11c2a8dc91b0741e97a863bafc7b94788.
Forgejo kernel CI, ordinary default host unit tests, x86_64 Linux.
This failure has no image, firmware, physical-input or guest-session route.
The fixture already holds the shared CSpace test guard. That fact does not
clear sequential state left by a preceding current TCB. No concurrent
execution is required for the deterministic reproduction.
No earlier reliably race-free revision is established. The mapping test
itself is unchanged by the endpoint-test source partition.

Evidence and prior checks

The complete failing log is attached to the public CI run above. Same-head
push run 508 succeeded;
that pass does not replace or invalidate the PR-run failure. CI reported no
compiler warning in the failing job. The separately observed interrupt-test
race is tracked in erix/kernel#4 and requires a separate guard correction.

Signed fixes c20dfa04627654748316d601b0ddd18a3e4ad13f and
0911b10fd6e76de8ebe97d5ce755f22da8037864 clear current-TCB context before
replacing root CSpace; mapping setup also installs its capability through the
explicit new root identity. Three existing root-policy/copy/move/attenuation
fixtures independently reproduce the same predecessor defect and now assert
a fresh root route. All original assertions remain; production code is unchanged.
Exact-source default/all-feature suites pass 586/610 tests, three existing
experiments remain ignored, and strict local checks pass without warnings.
Current-head CI review is recorded below.

Current CI reconciliation — 17 September 2026: Current signed 28dfaea22796925ca438b4a57175520a8d9e7a8c passes original push CI 588 and PR CI 589. All four complete terminal logs are classified: 712,357 bytes and zero warning candidates. Both workflows retain the named regression controls, 671 default/695 all-feature unit results and both standalone controls; three existing experiments remain ignored. Local four strict matrices, host/native Clippy, rustdoc, formatting and two native builds also pass without warnings. No production attribution rule or global harness concurrency is changed. This closes the bounded host-fixture issue, while full source/frame and guest-build acceptance remain open.

Tracking

Owning audit: erix/kernel#2. Review: erix/kernel#3.

Identify the root-slot loss through fixture-state and other-caller review.
Fix the established cause without changing production authority rules or
masking the failure with a globally serialized test runner.
Preserve all cleanup assertions and add focused regression coverage if
the cause requires behavior beyond existing tests.
Validate the exact-source component matrix and review both push/PR CI.

## Summary The kernel mapping-cleanup unit test failed in parallel CI while creating its fixture, before it could check selective graph cleanup. The same source head passed a separate push run. The cause is now reproduced deterministically: root setup removed the private CSpace still selected by a predecessor TCB. ## Reproduction Kernel PR [run 509](https://git.erikinkinen.fi/erix/kernel/actions/runs/509), job 19281, ran the default host suite with ordinary test parallelism at `ec7b63d11c2a8dc91b0741e97a863bafc7b94788`. The failing command was `cargo test --all-targets` with warnings denied. This is one observed CI failure; no failure-frequency estimate is established. A focused regression now creates an explicit private-CSpace predecessor, leaves it current and runs the old fixture ordering alone with one thread. It reproduces the same `CspaceSlotMissing` error before the fix and passes afterward. ## Expected and actual behavior The fixture initializes the root CSpace and should install its root capability before exercising selective cleanup. Instead, `dynlink_mapping::tests::selective_cleanup_revokes_only_the_failed_graph_objects` panicked at `src/dynlink_mapping/tests.rs:74` with `cspace root cap: CspaceSlotMissing`. The suite reported 584 passed, one failed and three ignored performance experiments; Cargo exited 101. ## Environment and identity - Kernel revision: `ec7b63d11c2a8dc91b0741e97a863bafc7b94788`. - Forgejo kernel CI, ordinary default host unit tests, x86_64 Linux. - This failure has no image, firmware, physical-input or guest-session route. - The fixture already holds the shared CSpace test guard. That fact does not clear sequential state left by a preceding current TCB. No concurrent execution is required for the deterministic reproduction. - No earlier reliably race-free revision is established. The mapping test itself is unchanged by the endpoint-test source partition. ## Evidence and prior checks The complete failing log is attached to the public CI run above. Same-head [push run 508](https://git.erikinkinen.fi/erix/kernel/actions/runs/508) succeeded; that pass does not replace or invalidate the PR-run failure. CI reported no compiler warning in the failing job. The separately observed interrupt-test race is tracked in erix/kernel#4 and requires a separate guard correction. Signed fixes `c20dfa04627654748316d601b0ddd18a3e4ad13f` and `0911b10fd6e76de8ebe97d5ce755f22da8037864` clear current-TCB context before replacing root CSpace; mapping setup also installs its capability through the explicit new root identity. Three existing root-policy/copy/move/attenuation fixtures independently reproduce the same predecessor defect and now assert a fresh root route. All original assertions remain; production code is unchanged. Exact-source default/all-feature suites pass 586/610 tests, three existing experiments remain ignored, and strict local checks pass without warnings. Current-head CI review is recorded below. Current CI reconciliation — 17 September 2026: Current signed `28dfaea22796925ca438b4a57175520a8d9e7a8c` passes original [push CI 588](https://git.erikinkinen.fi/erix/kernel/actions/runs/588) and [PR CI 589](https://git.erikinkinen.fi/erix/kernel/actions/runs/589). All four complete terminal logs are classified: 712,357 bytes and zero warning candidates. Both workflows retain the named regression controls, 671 default/695 all-feature unit results and both standalone controls; three existing experiments remain ignored. Local four strict matrices, host/native Clippy, rustdoc, formatting and two native builds also pass without warnings. No production attribution rule or global harness concurrency is changed. This closes the bounded host-fixture issue, while full source/frame and guest-build acceptance remain open. ## Tracking Owning audit: erix/kernel#2. Review: erix/kernel#3. - [x] Identify the root-slot loss through fixture-state and other-caller review. - [x] Fix the established cause without changing production authority rules or masking the failure with a globally serialized test runner. - [x] Preserve all cleanup assertions and add focused regression coverage if the cause requires behavior beyond existing tests. - [x] Validate the exact-source component matrix and review both push/PR CI.

erikinkinen added the

bug

phase-6

labels

2026-09-12 08:49:31 +02:00

erikinkinen referenced this issue from a commit

2026-09-12 09:00:53 +02:00

fix: Isolate shared kernel test state

~~erikinkinen referenced this issue 2026-09-12 09:03:23 +02:00~~

WIP: Enforce native lifetime and staged construction authority #3

erikinkinen referenced this issue

2026-09-17 18:42:05 +02:00