erix/kernel

Watch

Fork 0

generated from erix/meta

[BUG] Host fixtures retain a predecessor process attribution #8

New issue

Closed

opened 2026-09-14 09:41:16 +02:00 by erikinkinen · 0 comments

erikinkinen commented

2026-09-14 09:41:16 +02:00

Owner

Summary

RAM allocator unit tests can inherit the previous test's current private process after rebuilding the root CSpace. The shared test lock prevents simultaneous fixture mutation, but does not reset process attribution. This makes otherwise valid allocator seeding depend on test order.

Reproduction

At signed kernel 7eb9bc32a08a8a91db2b0e88d0d8e5f3174ece3e, PR CI 523 fails two allocator tests under ordinary harness concurrency. Push CI 522 passes the same head.

A new deterministic host regression first creates and selects a real private TCB/CSpace, then invokes the allocator's existing root-only seed fixture. With the original initialization retained, cargo test --lib kobj::ram_allocator::tests::ram_fixture_discards_previous_process_attribution -- --exact --nocapture fails with Cargo status101 and seed: CspaceSlotMissing. This local regression includes the new test and a thematic test-module extraction; it is not claimed as an unchanged clean-checkout command.

Expected and actual behavior

Each allocator fixture must explicitly initialize the process attribution used by current-CSpace capability operations. Seeding should install its allocator in the newly created root fixture, regardless of the previous test's process.

Actual PR CI result:606 passed,2 failed,3 existing ignored experiments. totals_track_live_frame_bytes_without_counting_aliases fails at seeding; allocator_domain_has_no_per_extent_slot_limit fails at aggregate-domain seeding, both with CspaceSlotMissing. The new deterministic order regression reproduces the stale-attribution boundary once with the original setup.

Environment and identity

Kernel revision: 7eb9bc32a08a8a91db2b0e88d0d8e5f3174ece3e, branch feature/posix-compat.
Selected IPC: de6892790de69f40f749c393d24078b287b36175; capability ABI: 984c9f7b0ca910488f8c5b035d2f0cb88f18d304.
Native Linux x86_64 unit-test executable; local deterministic reproduction uses Rust 1.97.1. CI uses the repository's selected workflow container.
No EriX syscall is executed on Linux, and no VM image or native allocator failure is involved in this report.
The prior strict local matrix and the same-head push CI pass; they do not disprove the observed order-dependent PR failure.

Evidence and prior checks

The complete failed PR log and successful push log are retained. Local source inspection confirms that the allocator fixtures reset CSpaces and allocator state but leave the previous current TCB selected. A private TCB can therefore direct current-CSpace operations to a CSpace absent from the new table.

The proposed correction explicitly resets TCB attribution before constructing the root fixture, shares complete fixture initialization and preserves all allocator assertions. The tests move into a thematic module so the new regression does not push the existing 973-line source file over the limit. The first local exact test filter selected zero tests; that setup attempt is retained and receives no pass credit. The corrected full test name produces the actual failure above. Validation and the corrected commit's own CI remain required; do not retry the unchanged failed workflow as a substitute.

The later entry-constraint checkpoint 5acfa6335dcf021ec21bb0fca3f735adee833a27 exposes two remaining synthetic-service fixtures in push CI 530: synthetic_memd_alloc_call_returns_frame_response and synthetic_service_startup_call_returns_ready_status fail endpoint setup with CspaceSlotMissing (607 passed, two failed, three existing ignores). Its complete test and Markdown logs are retained with zero warning candidates. The earlier explicit-root and allocator fixture corrections remain intact; this is additional incomplete fixture initialization under the same process-attribution defect.

The synthetic fixtures reset CSpace and endpoint tables but retain the preceding current TCB. When that TCB belongs to a private CSpace, endpoint creation follows the stale owner into a CSpace removed by the fixture reset. Add a deterministic private-process predecessor control and initialize TCB state before CSpace state in all five synthetic-service fixtures. Preserve response assertions and ordinary test harness concurrency. The native distinct-argument/lifetime VM passes independently and does not validate host fixture isolation.

Validation checkpoint — 14 September 2026: The deterministic private-process predecessor control fails against the old synthetic initializer. All five synthetic fixtures now reset TCB attribution before CSpace/endpoint state, preserving every response assertion and ordinary harness concurrency. The CI 530 failure and CI 531 pass remain separately retained. Signed feature e6bea362f9199230bf84269b1a8da6bd8da6470d carries original signed maintenance ancestor 2f85d8a0e2e502ff1126ba40263296bc72f4635a. The ordinary and lifetime graphs preserve their respective IPC/capability selections. All strict default/all development/release checks pass; the final fixture matrix passes 610/634 units plus one standalone on the feature graph and 586/610 units on the maintenance graph, with three pre-existing ignores. CI 532 and 533 pass with four complete logs, 624,386 bytes and zero warning candidates. Integration 7cc0593e101b2e0ca42f24d4fa189dd96cb1455c passes the actual native distinct-argument/lifetime VM in 20.204185 seconds and the unchanged ordinary Rootd IPC-framing VM in 45.264436 seconds, with empty stderr. These are host build/run durations, not guest performance results. Both signed images are byte-identical to the preceding accepted transition images. Realm producer adoption and full guest builds remain open.

Tracking

Current signed 90fb945e291d1f8bb0b838d7ab8deccd1895600c passes push CI 524 and PR CI 525. Four complete logs total 622,018 bytes, with no compiler/lint warning candidates. Each test job passes 609 development-default, 609 release-default and 633 release-all units, plus the standalone allocation regression in all three selections. Three pre-existing experiments remain ignored per unit suite. The deterministic order regression and both originally failing allocator tests pass in all three selections; both Markdown jobs pass. Original CI523 and the deterministic pre-fix failure remain retained in #8. This closes the allocator fixture regression only; native VM, manual/API, producer, audit and self-hosting gates remain open.

Owning audit: #2; lifetime mechanism: #7; implementation and validation: #3.
Retain the failed CI evidence, add the deterministic order regression, run all supported host selections with ordinary harness concurrency, and monitor the corrected signed checkpoint before closing this issue.

## Summary RAM allocator unit tests can inherit the previous test's current private process after rebuilding the root CSpace. The shared test lock prevents simultaneous fixture mutation, but does not reset process attribution. This makes otherwise valid allocator seeding depend on test order. ## Reproduction At signed kernel `7eb9bc32a08a8a91db2b0e88d0d8e5f3174ece3e`, [PR CI 523](https://git.erikinkinen.fi/erix/kernel/actions/runs/523) fails two allocator tests under ordinary harness concurrency. [Push CI 522](https://git.erikinkinen.fi/erix/kernel/actions/runs/522) passes the same head. A new deterministic host regression first creates and selects a real private TCB/CSpace, then invokes the allocator's existing root-only seed fixture. With the original initialization retained, `cargo test --lib kobj::ram_allocator::tests::ram_fixture_discards_previous_process_attribution -- --exact --nocapture` fails with Cargo status101 and `seed: CspaceSlotMissing`. This local regression includes the new test and a thematic test-module extraction; it is not claimed as an unchanged clean-checkout command. ## Expected and actual behavior Each allocator fixture must explicitly initialize the process attribution used by current-CSpace capability operations. Seeding should install its allocator in the newly created root fixture, regardless of the previous test's process. Actual PR CI result:606 passed,2 failed,3 existing ignored experiments. `totals_track_live_frame_bytes_without_counting_aliases` fails at seeding; `allocator_domain_has_no_per_extent_slot_limit` fails at aggregate-domain seeding, both with `CspaceSlotMissing`. The new deterministic order regression reproduces the stale-attribution boundary once with the original setup. ## Environment and identity - Kernel revision: `7eb9bc32a08a8a91db2b0e88d0d8e5f3174ece3e`, branch `feature/posix-compat`. - Selected IPC: `de6892790de69f40f749c393d24078b287b36175`; capability ABI: `984c9f7b0ca910488f8c5b035d2f0cb88f18d304`. - Native Linux x86_64 unit-test executable; local deterministic reproduction uses Rust 1.97.1. CI uses the repository's selected workflow container. - No EriX syscall is executed on Linux, and no VM image or native allocator failure is involved in this report. - The prior strict local matrix and the same-head push CI pass; they do not disprove the observed order-dependent PR failure. ## Evidence and prior checks The complete failed PR log and successful push log are retained. Local source inspection confirms that the allocator fixtures reset CSpaces and allocator state but leave the previous current TCB selected. A private TCB can therefore direct current-CSpace operations to a CSpace absent from the new table. The proposed correction explicitly resets TCB attribution before constructing the root fixture, shares complete fixture initialization and preserves all allocator assertions. The tests move into a thematic module so the new regression does not push the existing 973-line source file over the limit. The first local exact test filter selected zero tests; that setup attempt is retained and receives no pass credit. The corrected full test name produces the actual failure above. Validation and the corrected commit's own CI remain required; do not retry the unchanged failed workflow as a substitute. The later entry-constraint checkpoint `5acfa6335dcf021ec21bb0fca3f735adee833a27` exposes two remaining synthetic-service fixtures in push CI 530: `synthetic_memd_alloc_call_returns_frame_response` and `synthetic_service_startup_call_returns_ready_status` fail endpoint setup with `CspaceSlotMissing` (607 passed, two failed, three existing ignores). Its complete test and Markdown logs are retained with zero warning candidates. The earlier explicit-root and allocator fixture corrections remain intact; this is additional incomplete fixture initialization under the same process-attribution defect. The synthetic fixtures reset CSpace and endpoint tables but retain the preceding current TCB. When that TCB belongs to a private CSpace, endpoint creation follows the stale owner into a CSpace removed by the fixture reset. Add a deterministic private-process predecessor control and initialize TCB state before CSpace state in all five synthetic-service fixtures. Preserve response assertions and ordinary test harness concurrency. The native distinct-argument/lifetime VM passes independently and does not validate host fixture isolation. Validation checkpoint — 14 September 2026: The deterministic private-process predecessor control fails against the old synthetic initializer. All five synthetic fixtures now reset TCB attribution before CSpace/endpoint state, preserving every response assertion and ordinary harness concurrency. The CI 530 failure and CI 531 pass remain separately retained. Signed feature `e6bea362f9199230bf84269b1a8da6bd8da6470d` carries original signed maintenance ancestor `2f85d8a0e2e502ff1126ba40263296bc72f4635a`. The ordinary and lifetime graphs preserve their respective IPC/capability selections. All strict default/all development/release checks pass; the final fixture matrix passes 610/634 units plus one standalone on the feature graph and 586/610 units on the maintenance graph, with three pre-existing ignores. CI [532](https://git.erikinkinen.fi/erix/kernel/actions/runs/532) and [533](https://git.erikinkinen.fi/erix/kernel/actions/runs/533) pass with four complete logs, 624,386 bytes and zero warning candidates. Integration `7cc0593e101b2e0ca42f24d4fa189dd96cb1455c` passes the actual native distinct-argument/lifetime VM in 20.204185 seconds and the unchanged ordinary Rootd IPC-framing VM in 45.264436 seconds, with empty stderr. These are host build/run durations, not guest performance results. Both signed images are byte-identical to the preceding accepted transition images. Realm producer adoption and full guest builds remain open. ## Tracking Current signed `90fb945e291d1f8bb0b838d7ab8deccd1895600c` passes [push CI 524](https://git.erikinkinen.fi/erix/kernel/actions/runs/524) and [PR CI 525](https://git.erikinkinen.fi/erix/kernel/actions/runs/525). Four complete logs total 622,018 bytes, with no compiler/lint warning candidates. Each test job passes 609 development-default, 609 release-default and 633 release-all units, plus the standalone allocation regression in all three selections. Three pre-existing experiments remain ignored per unit suite. The deterministic order regression and both originally failing allocator tests pass in all three selections; both Markdown jobs pass. Original CI523 and the deterministic pre-fix failure remain retained in #8. This closes the allocator fixture regression only; native VM, manual/API, producer, audit and self-hosting gates remain open. - Owning audit: #2; lifetime mechanism: #7; implementation and validation: #3. - Retain the failed CI evidence, add the deterministic order regression, run all supported host selections with ordinary harness concurrency, and monitor the corrected signed checkpoint before closing this issue.

erikinkinen added the

phase-6

bug

labels

2026-09-14 09:41:16 +02:00

~~erikinkinen referenced this issue 2026-09-14 09:45:19 +02:00~~

WIP: Enforce native lifetime and staged construction authority #3

erikinkinen referenced this issue

2026-09-14 09:45:20 +02:00

[FEATURE] Audit authority, code quality and documentation in kernel #2

erikinkinen referenced this issue

2026-09-14 09:45:20 +02:00

[FEATURE] Bind a local SEND revoker to its holder's process lifetime #7

erikinkinen closed this issue

2026-09-14 09:47:01 +02:00

erikinkinen reopened this issue

2026-09-14 13:26:31 +02:00

erikinkinen changed title from ~~[BUG] RAM allocator tests inherit stale process attribution~~ to [BUG] Host fixtures retain a predecessor process attribution

2026-09-14 13:41:02 +02:00

erikinkinen closed this issue

2026-09-14 13:41:02 +02:00

erikinkinen referenced this issue

2026-09-17 18:42:05 +02:00

[BUG] VSpace fixtures inherit a previous private process #17

erikinkinen referenced this issue

2026-09-22 07:39:20 +02:00

[BUG] Drop-local-cap window fixture inherits the previous private process #29