vms-387: anchor test_kmod_devtab_terminal (devtab-terminal-withdrawal-not-honored) - #1226
Merged
Merged
Conversation
baron-3dl
force-pushed
the
work/vms-devtab-terminal-anchor
branch
from
September 14, 2026 13:34
a4f527e to
139069a
Compare
baron-3dl
added a commit
that referenced
this pull request
Sep 14, 2026
… keep sharded gate tight (#1236) The adhoc negctl rail (negctl-adhoc.yml) runs the FULL ~124-suite pristine control UNSHARDED plus one full-suite boot per named defect. Measured today: under TCG contention a single 124-suite boot completes only ~89/124 in the 1800s wall (~20s/suite -> 124 needs ~2510s), self-exits (exit 1), and the run-order tail (imgact + tcpip + ssh) reports a false-red rc=MISSING mass. This flaked ~half of today's adhoc proofs and is the keystone blocking the whole negctl-proof pipeline (#1225/#1226 re-anchors, #1231/#1235 dispatches). Fix (vms-926 lineage, 600->1800 -> now 1800->2700), env-gated so it touches ONLY the adhoc path: - run_facility_negctl.sh: both the pristine control (line ~264) and each defect run (line ~273) now take KE_WALL_TIMEOUT="${NEGCTL_WALL:-1800}". Default 1800 is UNCHANGED, so the sharded CI negctl gate (kernel-executive-facility-negative-controls-shard, 22 shards @ 50m, which does NOT set NEGCTL_WALL) stays exactly as tight as before. - negctl-adhoc.yml: sets NEGCTL_WALL=2700 and raises the job timeout 60->100m (worst case 250s build + 2700 pristine + 2700 defect ~= 94m). Both walls move together because pristine and each defect boot the full suite set at the same cost -- bumping only one just relocates the flake to the other. Guards honored: the raise is a per-boot CEILING (an uncontended boot still finishes in ~250s and never reaches the wall, so nothing is slowed); the rc=124 outer fail-loud is preserved (message now cites ${NEGCTL_WALL}); ci.yml is untouched (0 changes) so the sharded graduation gate is not loosened; the raw kernel-executive-shard leg (600s run_tests.sh, no override) is likewise unaffected. Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
baron-3dl
force-pushed
the
work/vms-devtab-terminal-anchor
branch
from
September 14, 2026 16:52
c6ab66c to
c0f002b
Compare
…wal-not-honored
test_kmod_devtab_terminal was an in-scope negctl suite with NO can-fail anchor
(coverage-gate FAIL). It exercises the dynamic RTAn: terminal unit (vms-f881):
mint an executive-real, $GETDVI-visible, $ASSIGN-able terminal, PTY round-trip,
survive owner death, and WITHDRAW it when the session ends.
New defect neuters the teardown gate: vms_devtab_remove_terminal() unlinks only
a genuine dynamic terminal (`if (dynamic_term) exec_list_del(...)` then
`if (!dynamic_term) return -ENODEV`). Guarding the gate to `if (0 && dynamic_term)`
makes withdrawal a permanent no-op -- the RTAn: row is never unlinked and the
call returns -ENODEV, so a minted terminal leaks and $GETDVI keeps resolving
RTA0: after the session ended.
Isolated by construction: the MINT side is untouched (row still created with
dynamic_term=1, DC$_TERM, OPA0-shape devchar), so every creation/characteristics/
$ASSIGN-owner/PTY-round-trip assertion stays green; the OPA0: (console)
removal-refused check stays green (console is not dynamic_term, correctly still
refused). Only the two withdrawal assertions redden:
require_fail: vms_devtab_remove_terminal("RTA0:") withdraws the unit it minted
knock_on: RTA0: no longer exists after withdrawal
- targets kernel-core/vms_devtab.c; anchor `if (dynamic_term)` is unique.
- /* negctl */ source marker added above the withdrawal CHECK (pairing floor).
- floor 150 -> 151.
selftest: injects + no-op-reapply has teeth; every require_fail/knock_on text
exists literally in source; test_kmod_devtab_terminal cleared from both coverage
FAIL lists. Runtime exact-red set proven separately via negctl-adhoc before flag.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HMDFjHCqxDuXgbyxNU572h
… was rc=139 use-after-free The runtime proof caught that the first injection was FATAL, not a clean redden: guarding `if (dynamic_term)` to `if (0 && dynamic_term)` skipped the unlink but still fell through to exec_free() on a still-linked node (the real dynamic_term was still 1 for RTA0:, so the `if (!dynamic_term) return -ENODEV` guard did not fire) -- a use-after-free that SIGSEGV'd the guest (SUITE ... rc=139) and left 111 subsequent suites NEVER RAN. Corrected: force the LOCAL classification instead -- `dynamic_term = 0;`. Now remove treats every row as non-dynamic: the unlink is skipped AND `if (!dynamic_term) return -ENODEV` fires BEFORE exec_free(), so the row is neither unlinked nor freed. Clean no-op withdrawal, guest survives, only the two withdrawal assertions redden. Same isolation (OPA0: is genuinely non-dynamic and still correctly refused; mint/characteristics/$ASSIGN/PTY all untouched). selftest: injects + no-op-reapply has teeth; every require_fail/knock_on text exists literally in source. Runtime re-proven non-fatal before flagging. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
baron-3dl
force-pushed
the
work/vms-devtab-terminal-anchor
branch
from
September 14, 2026 17:17
c0f002b to
d7ceb64
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Gives
test_kmod_devtab_terminala real can-fail negctl anchor (it was an in-scope coverage-gate FAIL with no anchor). New defectdevtab-terminal-withdrawal-not-honored.Mechanism
vms_devtab_remove_terminal()unlinks only a genuine dynamic terminal (if (dynamic_term) exec_list_del(...)thenif (!dynamic_term) return -ENODEV). The defect guards that gate toif (0 && dynamic_term), making withdrawal a permanent no-op — the RTAn: row is never unlinked and the call returns -ENODEV, so a minted terminal leaks and$GETDVIkeeps resolving RTA0: after the session ended.Isolation
The MINT side is untouched (row still created with
dynamic_term=1,DC$_TERM, OPA0-shape devchar), so every creation/characteristics/$ASSIGN-owner/PTY-round-trip assertion stays green; the OPA0: console removal-refused check stays green (console isn't dynamic_term, correctly refused). Only two assertions redden:vms_devtab_remove_terminal("RTA0:") withdraws the unit it mintedRTA0: no longer exists after withdrawalProof
test_kmod_devtab_terminalcleared from both coverage FAIL lists; floor 150→151.🤖 Generated with Claude Code
https://claude.ai/code/session_01HMDFjHCqxDuXgbyxNU572h