[BUG] Realm bootstrap endpoint collides with the native CSpace root

erikinkinen commented

2026-09-15 11:06:35 +02:00

Owner

Summary

The newly assigned mediator bootstrap endpoint destination collides with the native child's CSpace root. Every mediator stage using that destination is rejected before the executable can run. This is an availability defect in the new staged path; no runnable realm acceptance has been claimed.

Reproduction

Capability ABI e5a3e864491479981b9ab37749109dafe52fa330 assigns the endpoint to slot 1. Invoke the actual Kernel staged-process constructor with owner grant slot 40, endpoint-master slot 41, child endpoint slot 1, owner VSpace receipt slot 60 and child window [0, 4096). Native setup installs the CSpace root in child slot 1 before attempting endpoint creation. A targeted regression against Kernel 60da5858d7198185efd103f0e91e5ac2e0b63e67 reproduces the failure deterministically; the regression will be published with the correction.

Expected and actual behavior

Expected: successful creation of a staged mediator with an endpoint distinct from its native CSpace, VSpace and TCB roots. Actual: IPC_RESULT_DENIED (1), while the success expectation is IPC_RESULT_OK (0). The targeted test reports zero passed and one failed, with cargo status 101. The child remains unstarted.

Environment and identity

Native Kernel object/dispatcher implementation exercised by its host regression harness on x86-64 with Rust 1.97.1. The reproducer uses the existing original Kernel dependency pins and the literal published mediator destination. Affected producer revisions are Loaderd adefd028c47d0e60bde65ef2ff2d95c8bfae11b6, Launchd 64b563482c9ecab115283fe56c8562d948fbbabd, and Procd cdb0fe4d1496073521626ce21f0fa2c95a81bd36. This newly introduced mediator path has no last known working native revision.

Evidence and prior checks

The actual constructor test fails with left: 1 and right: 0. Earlier mocked producer tests, strict Clippy and freestanding builds passed because they did not run this constructor with the selected destination. Source inspection confirms native root slots 1, 2 and 3 are already installed. Select a disjoint endpoint destination, preserve native root bindings and validate actual construction plus complete cleanup in the native regression scenario. Keep the failed source identities and results visible.

Native bootstrap destination correction — 15 September 2026

The temporary endpoint destination is now child-local slot 4, after the mandatory CSpace, VSpace and TCB roots in slots 1–3. The initial slot-1 contract was incorrect: the actual native constructor returned DENIED before creating a child. The original failure and published source identities are retained in capability ABI bug #3. Capability ABI c7c72ae2a777b2a9f4ae5d7fb8eef86e5fc1fae5 corrects the constant; Kernel b98156427362a468ae78195a3582901e2474fea5 adds an actual constructor regression and six CPL3 creation/cleanup calls. The expanded lifetime VM passes with ordered, unique staging and cleanup markers and empty QEMU stderr. This proves the constructor boundary; coordinated mediator startup, seal, client I/O, retirement and full guest builds remain open. Matching component CI is still being monitored.

Slot-collision acceptance — 15 September 2026: Corrected capability ABI c7c72ae2a7 and Kernel b98156427362a468ae78195a3582901e2474fea5 pass the actual constructor and both native VM scenarios. Reserved roots 1–3 remain intact, endpoint creation uses slot 4, and the six exercised creation/disposal calls complete with exact markers and empty QEMU stderr. Capability ABI CI 220/221 and Kernel CI 564/565, along with corrected Procd/Loaderd/Launchd CI, pass with complete warning-free logs. The original collision and failing source remain recorded. This closes the destination collision only; broader failure-path, startup and full realm acceptance are separate work.

Tracking

Related to the realm design erix/posixd#1 and component feature issue #1. Correct the shared slot, coordinate all affected original dependency revisions and documentation, strengthen native constructor coverage, and rerun both the changed lifetime VM and existing owned-invocation VM before closing this report.

## Summary The newly assigned mediator bootstrap endpoint destination collides with the native child's CSpace root. Every mediator stage using that destination is rejected before the executable can run. This is an availability defect in the new staged path; no runnable realm acceptance has been claimed. ## Reproduction Capability ABI `e5a3e864491479981b9ab37749109dafe52fa330` assigns the endpoint to slot 1. Invoke the actual Kernel staged-process constructor with owner grant slot 40, endpoint-master slot 41, child endpoint slot 1, owner VSpace receipt slot 60 and child window [0, 4096). Native setup installs the CSpace root in child slot 1 before attempting endpoint creation. A targeted regression against Kernel `60da5858d7198185efd103f0e91e5ac2e0b63e67` reproduces the failure deterministically; the regression will be published with the correction. ## Expected and actual behavior Expected: successful creation of a staged mediator with an endpoint distinct from its native CSpace, VSpace and TCB roots. Actual: IPC_RESULT_DENIED (1), while the success expectation is IPC_RESULT_OK (0). The targeted test reports zero passed and one failed, with cargo status 101. The child remains unstarted. ## Environment and identity Native Kernel object/dispatcher implementation exercised by its host regression harness on x86-64 with Rust 1.97.1. The reproducer uses the existing original Kernel dependency pins and the literal published mediator destination. Affected producer revisions are Loaderd `adefd028c47d0e60bde65ef2ff2d95c8bfae11b6`, Launchd `64b563482c9ecab115283fe56c8562d948fbbabd`, and Procd `cdb0fe4d1496073521626ce21f0fa2c95a81bd36`. This newly introduced mediator path has no last known working native revision. ## Evidence and prior checks The actual constructor test fails with `left: 1` and `right: 0`. Earlier mocked producer tests, strict Clippy and freestanding builds passed because they did not run this constructor with the selected destination. Source inspection confirms native root slots 1, 2 and 3 are already installed. Select a disjoint endpoint destination, preserve native root bindings and validate actual construction plus complete cleanup in the native regression scenario. Keep the failed source identities and results visible. ### Native bootstrap destination correction — 15 September 2026 The temporary endpoint destination is now child-local slot 4, after the mandatory CSpace, VSpace and TCB roots in slots 1–3. The initial slot-1 contract was incorrect: the actual native constructor returned DENIED before creating a child. The original failure and published source identities are retained in [capability ABI bug #3](https://git.erikinkinen.fi/erix/lib-capabi/issues/3). Capability ABI `c7c72ae2a777b2a9f4ae5d7fb8eef86e5fc1fae5` corrects the constant; Kernel `b98156427362a468ae78195a3582901e2474fea5` adds an actual constructor regression and six CPL3 creation/cleanup calls. The expanded lifetime VM passes with ordered, unique staging and cleanup markers and empty QEMU stderr. This proves the constructor boundary; coordinated mediator startup, seal, client I/O, retirement and full guest builds remain open. Matching component CI is still being monitored. Slot-collision acceptance — 15 September 2026: Corrected capability ABI c7c72ae2a777b2a9f4ae5d7fb8eef86e5fc1fae5 and Kernel b98156427362a468ae78195a3582901e2474fea5 pass the actual constructor and both native VM scenarios. Reserved roots 1–3 remain intact, endpoint creation uses slot 4, and the six exercised creation/disposal calls complete with exact markers and empty QEMU stderr. Capability ABI CI 220/221 and Kernel CI 564/565, along with corrected Procd/Loaderd/Launchd CI, pass with complete warning-free logs. The original collision and failing source remain recorded. This closes the destination collision only; broader failure-path, startup and full realm acceptance are separate work. ## Tracking Related to the realm design https://git.erikinkinen.fi/erix/posixd/issues/1 and component feature issue #1. Correct the shared slot, coordinate all affected original dependency revisions and documentation, strengthen native constructor coverage, and rerun both the changed lifetime VM and existing owned-invocation VM before closing this report.

erikinkinen added the

bug

phase-6

labels

2026-09-15 11:06:35 +02:00

erikinkinen referenced this issue from a commit

2026-09-15 11:15:15 +02:00

fix: Keep the realm endpoint separate from native root bindings

erikinkinen referenced this issue from erix/posixd

2026-09-15 11:28:04 +02:00

[FEATURE] Implement isolated compatibility realms and exact grant lifecycles #1

erikinkinen referenced this issue from erix/lib-ipc