[BUG] Optimized receive fixtures can select modeled stack backing #6

New issue

Closed

opened 2026-09-14 08:33:47 +02:00 by erikinkinen · 0 comments

erikinkinen commented

2026-09-14 08:33:47 +02:00

Owner

Summary

The earlier receive-fixture correction is incomplete. Each simulated stack owns
one aligned 4-KiB page, while startup can materialize a 16-KiB window below its
saved top. This can shadow neighbouring host receive allocations. Original PR
CI 583 reports a successful transfer whose host header fails with InvalidMagic.
No native guest delivery failure is established by this host-test observation.

Reproduction

The original failure occurs in the default development unit suite of
PR CI 583, at signed
829b949dd591bb82e6cac0fcbb47fdd1d6346cbd, in
queued_pager_fault_preserves_transfer_rendezvous_for_exactly_one_retry.
The same-head push CI 582
passes. The failed workflow has not been retried unchanged.

A new deterministic host regression selects a fixture TCB with a low synthetic
entry address. It verifies the owned backing and checks the immediately adjacent
addresses using mapping metadata, without dereferencing foreign host memory.
On the original one-page fixture, the following command exits 101 because the
startup mapping covers an address below the owned allocation:

cargo test --locked --no-default-features initial_stack_mapping_stays_inside_owned_fixture

Expected and actual behavior

Expected: every modeled startup-stack page belongs to the fixture; direct host
receive buffers remain outside modeled mappings. Existing transfer, scheduling,
capability and payload assertions must remain intact.

Actual original PR run: 669 unit tests pass, one fails, and three existing
experiments are ignored. The failing assertion is delivered header: InvalidMagic.
Actual original boundary regression: zero pass, one fails at the ownership-boundary
assertion. This deterministic geometry defect is confirmed; the exact heap
addresses from the earlier CI failure were not instrumented.

Environment and identity

Signed Kernel: 829b949dd591bb82e6cac0fcbb47fdd1d6346cbd, original pinned dependencies.
Local deterministic regression: Linux x86_64, Rust 1.97.1, default development
test profile, warning-denied compilation, ordinary test-harness concurrency.
Production startup-window sizing is unchanged; the earlier fixture-only repair
was signed a498af7c6535733127ba642d7297c4cedf9f18e2.
The regression uses modeled TCB/VSpace state and owned host buffers. It runs no
native instructions, VM, external caller, or new capability route.
A compiler-independent last working one-page fixture is not established.

Evidence and prior checks

All four original terminal CI logs are retained and verified: 482,331 bytes,
zero warning candidates. Both Markdown jobs pass. The earlier signed repair
passed CI 520/521 and isolated the host stack, but did not reserve the complete
production startup window. Those original passing observations remain valid
within their tested source and allocation layout.

The correction allocates the complete startup window using the production
constant, preserves all nine fixture lifetimes, and checks each receive byte
for mapping overlap. Failure to validate a whole buffer alone cannot exclude a
partial overlap. Signed correction 0bf941cf8ff4b7c1e8b6c9ed7941b5413250629a passes four strict development/release matrices (671 default and 695 all-feature units, both standalone controls, three existing ignored experiments). Formatting, warning-denied host/native Clippy, private rustdoc and two freestanding builds pass. Original push CI 584 and PR CI 585 both pass. All four terminal logs are complete and verified: 712,326 bytes, zero warnings. The new boundary regression and the previously failing receive test pass in every applicable CI selection. This completes the bounded fixture correction. No production receive, scheduling,
mapping or authority behavior is changed or bypassed.

Tracking

Owning audit: kernel #2.
Implementation: kernel PR #3.
Complete fixture ownership and deterministic boundary coverage pass locally and in both original corrected-head workflows. Close this host-fixture defect; preserve all original failures, timeout limits and existing ignored-test policy. Full native and self-hosting acceptance remain separate.

## Summary The earlier receive-fixture correction is incomplete. Each simulated stack owns one aligned 4-KiB page, while startup can materialize a 16-KiB window below its saved top. This can shadow neighbouring host receive allocations. Original PR CI 583 reports a successful transfer whose host header fails with `InvalidMagic`. No native guest delivery failure is established by this host-test observation. ## Reproduction The original failure occurs in the default development unit suite of [PR CI 583](https://git.erikinkinen.fi/erix/kernel/actions/runs/583), at signed `829b949dd591bb82e6cac0fcbb47fdd1d6346cbd`, in `queued_pager_fault_preserves_transfer_rendezvous_for_exactly_one_retry`. The same-head [push CI 582](https://git.erikinkinen.fi/erix/kernel/actions/runs/582) passes. The failed workflow has not been retried unchanged. A new deterministic host regression selects a fixture TCB with a low synthetic entry address. It verifies the owned backing and checks the immediately adjacent addresses using mapping metadata, without dereferencing foreign host memory. On the original one-page fixture, the following command exits 101 because the startup mapping covers an address below the owned allocation: ```sh cargo test --locked --no-default-features initial_stack_mapping_stays_inside_owned_fixture ``` ## Expected and actual behavior Expected: every modeled startup-stack page belongs to the fixture; direct host receive buffers remain outside modeled mappings. Existing transfer, scheduling, capability and payload assertions must remain intact. Actual original PR run: 669 unit tests pass, one fails, and three existing experiments are ignored. The failing assertion is `delivered header: InvalidMagic`. Actual original boundary regression: zero pass, one fails at the ownership-boundary assertion. This deterministic geometry defect is confirmed; the exact heap addresses from the earlier CI failure were not instrumented. ## Environment and identity - Signed Kernel: `829b949dd591bb82e6cac0fcbb47fdd1d6346cbd`, original pinned dependencies. - Local deterministic regression: Linux x86_64, Rust 1.97.1, default development test profile, warning-denied compilation, ordinary test-harness concurrency. - Production startup-window sizing is unchanged; the earlier fixture-only repair was signed `a498af7c6535733127ba642d7297c4cedf9f18e2`. - The regression uses modeled TCB/VSpace state and owned host buffers. It runs no native instructions, VM, external caller, or new capability route. - A compiler-independent last working one-page fixture is not established. ## Evidence and prior checks All four original terminal CI logs are retained and verified: 482,331 bytes, zero warning candidates. Both Markdown jobs pass. The earlier signed repair passed CI 520/521 and isolated the host stack, but did not reserve the complete production startup window. Those original passing observations remain valid within their tested source and allocation layout. The correction allocates the complete startup window using the production constant, preserves all nine fixture lifetimes, and checks each receive byte for mapping overlap. Failure to validate a whole buffer alone cannot exclude a partial overlap. Signed correction `0bf941cf8ff4b7c1e8b6c9ed7941b5413250629a` passes four strict development/release matrices (671 default and 695 all-feature units, both standalone controls, three existing ignored experiments). Formatting, warning-denied host/native Clippy, private rustdoc and two freestanding builds pass. Original [push CI 584](https://git.erikinkinen.fi/erix/kernel/actions/runs/584) and [PR CI 585](https://git.erikinkinen.fi/erix/kernel/actions/runs/585) both pass. All four terminal logs are complete and verified: 712,326 bytes, zero warnings. The new boundary regression and the previously failing receive test pass in every applicable CI selection. This completes the bounded fixture correction. No production receive, scheduling, mapping or authority behavior is changed or bypassed. ## Tracking - Owning audit: [kernel #2](https://git.erikinkinen.fi/erix/kernel/issues/2). - Implementation: [kernel PR #3](https://git.erikinkinen.fi/erix/kernel/pulls/3). - Complete fixture ownership and deterministic boundary coverage pass locally and in both original corrected-head workflows. Close this host-fixture defect; preserve all original failures, timeout limits and existing ignored-test policy. Full native and self-hosting acceptance remain separate.

erikinkinen added the

bug

phase-6

labels

2026-09-14 08:33:47 +02:00

erikinkinen referenced this issue

2026-09-14 08:40:55 +02:00

[FEATURE] Audit authority, code quality and documentation in kernel #2

~~erikinkinen referenced this issue 2026-09-14 08:40:55 +02:00~~

WIP: Enforce native lifetime and staged construction authority #3

erikinkinen closed this issue

2026-09-14 08:44:28 +02:00