601 Commits

Include renames

Author	SHA1	Message	Date
aLinCheandlongjin	5a0707b6b2	feat(ptrace): implement Linux-compatible tracing and remote access (#2198) ... feat(ptrace): implement Linux-compatible tracing and remote access Implement a Linux 6.6-compatible ptrace subsystem and integrate it with signal delivery, syscall dispatch, seccomp, process lifecycle events, wait semantics, remote memory access, x86 debug traps, and uprobes. Replace the original monolithic implementation with ownership-oriented modules: - define ptrace ABI types, options, events, and syscall-info separately; - model active stops, pending events, completed resumes, and request freezes as typed state with explicit generation ownership; - maintain bidirectional tracer relationships with O(1) slot-based link and unlink operations; - centralize attach, seize, detach, wait, exit, fork, group-stop, and SIGCONT transactions in the lifecycle layer; - expose registers, siginfo, sigmask, event messages, and remote memory only through a session-and-stop-generation-bound request guard. Make tracing lifecycle transitions race-safe: - bind stops, events, waits, debug handoffs, and fork inheritance to the exact tracing session that created them; - wait for the tracee to become inactive before accessing its kernel stack TrapFrame; - revoke request freezes and replay deferred fatal wakeups exactly once; - preserve group-stop state across detach and tracer exit; - prevent EXITKILL, EXEC, SECCOMP, SIGCONT, and pending-stop events from leaking into a replacement tracing session; - hand traced zombies from exactly one tracer waiter to the real parent; - prepare fallible allocations outside IRQ-disabled relation transactions and commit only after capacity and ownership revalidation. Implement the ptrace execution and event ABI, including TRACEME, ATTACH, SEIZE, DETACH, CONT, SYSCALL, SINGLESTEP, SYSEMU, INTERRUPT, LISTEN, GET/SETREGS, NT_PRSTATUS GET/SETREGSET, PEEK/POKEUSER, signal and sigmask access, event messages, syscall information, and fork/clone/vfork, exec, exit, seccomp, and group-stop events. Introduce a shared remote-memory engine for ptrace, /proc/<pid>/mem, and process_vm_readv/writev. Preserve Linux permission checks, precise short copy results, forced-access COW, MAP_PRIVATE isolation, shared page-cache dirty accounting, and RISC-V executable-memory I-cache synchronization. Continue rejecting unsupported special or external-PFN VMAs instead of adding an unsafe generic provider workaround. Complete x86_64 tracing state support: - virtualize and context-switch hardware debug registers; - coordinate #BP/#DB routing between ptrace and uprobe XOL execution; - preserve hardware breakpoint, watchpoint, single-step, DR6, and RF semantics; - validate and restore CS, SS, DS, ES, FS, and GS selectors according to Linux rules; - preserve FS/GS selectors and bases across ptrace writes, context switches, signal return, and VMX host transitions; - recover safely from missing data descriptors and preserve the original fault frame on invalid iret selectors. Align siginfo conversion, tracer identity, syscall-number rewriting, regset partial-copy behavior, dumpability, user-namespace capability checks, Yama policy, and procfs TracerPid reporting with Linux 6.6. Add deterministic dunitest and gVisor coverage for ptrace lifecycle, group-stop, concurrent ownership, EXITKILL, syscall information, seccomp TRACE, x86 debug state, segment registers, process_vm access, proc-mem, page-cache persistence, and remote I-cache synchronization. Remove the ptrace Int3 blocklist and declare only the verified INT3:TRUE gVisor platform capability. Validation on the final head includes: - x86_64, RISC-V, and LoongArch build, format, and static checks; - successful x86_64 Dunitest and integration workflows; - 1172 local Ubuntu 24.04 two-vCPU dunitests with 0 failures and 0 timeouts; - 12/12 targeted x86 ptrace register/debug tests on both Linux and DragonOS; - successful MM host tests and final adversarial architecture, correctness, concurrency, security, and performance review. PTRACE_O_SUSPEND_SECCOMP and non-NT_PRSTATUS regsets remain explicitly unsupported. Remote access to special/external-PFN VMAs continues to require a future safe provider contract. Signed-off-by: aLinChe <1129332011@qq.com> Signed-off-by: longjin <longjin@dragonos.org> Co-authored-by: longjin <longjin@dragonos.org>	2026-08-28 16:42:48 +08:00
火花andlongjin	05a568fd39	feat(uprobe): implement uprobe breakpoint support (#2150 phase 1) (#2163) ... * feat(uprobe): implement uprobe breakpoint support (#2150 phase 1) Implement userspace breakpoint probes (uprobe), phase 1 of issue #2150, enabling agentsight to instrument SSL_read/SSL_write entry points. The design is XOL-based rather than reusing kprobe's kernel-buffer single-step (impossible at CPL=3). Key pieces: - per-mm uprobe table guarded by an irqsave SpinLock (not the global KPROBE_MANAGER lock nor the mm RwSem; the #BP/#DB hit path is IRQ-off) - breakpoint page install replicates do_wp_page private COW: copy_page_as_normal + single atomic set_entry + rmap attach/detach + flush_tlb_range. No transient empty PTE; each mm gets a private copy so writeback never persists 0xcc into the shared page-cache (.so) - XOL: a per-mm user slot page executes the saved instruction copy with RIP-relative relocation (yaxpeax-x86), validated at registration time - do_int3/do_debug gain is_from_user() dispatch. The #BP handler runs pre_handler + BPF (rip kept as the original probe address), then jumps rip to the pre-filled XOL slot, sets TF and NEED_UPROBE. The #DB handler recognizes XOL completion via NEED_UPROBE and restores rip; unconsumed user #BP is delivered as SIGTRAP(TRAP_BRKPT) - perf: PERF_TYPE_MAX dispatches to uprobe when the name contains '/'; UprobePerfEvent mirrors KprobePerfEvent and reuses BPF_PROG_TYPE_KPROBE Delivered in four batches: uprobe crate (x86 instruction analysis), mm integration (per-mm table / XOL / breakpoint page), exception dispatch, and perf attach. Verified: `make kernel` builds with 0 error / 0 warning; `cargo test -p uprobe` passes 7/7. An independent reviewer confirmed the F1-F10 review findings are satisfied with no kprobe/fork regression, and flagged two bugs that are fixed: re-registering the same probe_vaddr no longer reads 0xcc as the original instruction, and a RIP-relative displacement overflow now fails fast at registration instead of panicking at hit time. Out of scope: uretprobe (phase 2) and the QEMU runtime integration test. Refs: #2150 test(uprobe): add dunitest suite for uprobe breakpoint probes Add suites/normal/uprobe.cc covering the userspace perf_event_open uprobe path (issue #2150 phase 1): - RegisterAndTriggerSurvivesHit: perf_event_open(type=PERF_TYPE_MAX, config1=path, config2=offset) on the current process, then call the probed function and assert it survives the #BP -> XOL -> #DB -> resume hit path and returns the correct value - InvalidPathIsRejected / InvalidOffsetIsRejected: error inputs return negative errno Target offset is resolved from /proc/self/maps (executable segment + file pgoff), so the suite works regardless of PIE layout. Compiles cleanly via `make build-suites`; the gtest framework runs (the two negative cases pass on host Linux; the core trigger case is DragonOS-specific and is validated at runtime under QEMU). Refs: #2150 fix(uprobe): resolve CI failures - format check and cross-arch build - Apply rustfmt to uprobe integration code (reorder modules, imports, line width) to pass format-check on all arches - Add #[cfg(target_arch = "x86_64")] gates to uprobe integration points (exception/perf/mm-ucontext modules, AddressSpace fields, fork path, perf dispatch arm) so riscv64/loongarch64 build succeeds - Non-x86_64 perf dispatch returns ENOSYS for uprobe paths - Fix unused_mut on phys_addr in fork path for non-x86_64 * fix(uprobe): address P1 review findings (threads 1/2/3/5) - Thread 1: add ptrace access check (check_process_vm_access) before taking a target mm for cross-process uprobe, preventing unprivileged users from instrumenting arbitrary processes - Thread 2: reject control-flow instructions (call/jmp/ret/jcc/loop/int/ syscall) at registration time — XOL cannot safely single-step them - Thread 3: read_user_insn_bytes now continues into the next page when the probe is near a page boundary, returning real bytes instead of zero-padding that could decode to a different instruction - Thread 5: build_xol_slot fills trailing slot bytes with int3 (0xcc) so that a racy unregister during the XOL single-step window re-triggers #BP instead of executing zero-filled garbage * fix(uprobe): address maintainer review (12 findings, R1-R12) Security & correctness: - R1: pid==-1 (system-wide) now requires CAP_SYS_PTRACE; pid<-1 returns EINVAL. Per-pid path keeps check_process_vm_access. - R4: user #DB not consumed by uprobe now falls through to the normal DebugException path (restores pre-PR master behavior for ptrace/hardware breakpoints/single-step). - R5: original RFLAGS.TF is saved per-thread before XOL redirect and restored on completion (previously cleared unconditionally, silently disabling a program's own single-step mode). - R6: old_instruction copy now covers the full decoded instruction across page boundaries (was limited to first-page remainder). - R7: the breakpoint byte is restored only when the LAST consumer at that address unregisters (previously restored on every unregister, silently disabling remaining same-address consumers). - R8: unregister writes the original byte on the CURRENT mapped page instead of remapping the registration-time page, preserving the program's own writes to other bytes of that page. - R10: reject MOV SS (suppresses #DB) and POPF (overwrites RFLAGS/TF) at registration, in addition to control-flow instructions. - R11a: honor perf_event_attr.disabled (event starts disabled). Architecture (per-thread state, R2/R3/R12): - ActiveXol per-thread state on the PCB: probe_vaddr, return_addr, orig_tf, xol_page_base. Saved at #BP before rip redirect, consumed at #DB: O(1) completion independent of uprobe_list (racy unregister between #BP and #DB no longer corrupts resume), abort path when rip is outside the XOL page (signal/fault diversion), callbacks run outside the per-mm spinlock. Durable probe identity (R9): - Global registry keyed by inode+offset with consumer ids. New file mappings (dlopen/mmap via file_mapping_with_file_ext) and fork get late-applied probes; exec starts with an empty table. Consumer close drops registry entries plus late handles (per-mm unregister via the existing UprobeHandle::Drop with R7/R8 semantics). fork inherits instances with privatized child breakpoint pages. Verified: make kernel 0 error/0 warning; make fmt (clippy) clean; cargo test -p uprobe 9/9; QEMU dunitest uprobe 6/6, exec_abi 6/6, process_signal_fork 10/10. * fix(uprobe): align perf lifecycle with Linux semantics Match the uprobe PMU ABI with Linux for event type discovery, perf_event_attr validation, PID and CPU selection, path resolution, unsupported options, BPF attachment, and file descriptor behavior. Refactor definitions, consumers, sites, and XOL state so canonical file identity, enable and disable transitions, concurrent teardown, callback snapshots, and instruction restoration have explicit ownership and locking rules. Reconcile probes across mmap, mremap, mprotect, madvise, fork, exec, signal, fault, and exit paths while revalidating VMA identity after page faults and preserving strict error reporting for eligible mappings. Add dunitest coverage for lifecycle control, invalid attributes, aliasing, relative paths, tmpfs-backed probes, multiple consumers, and unsupported operations. Signed-off-by: longjin <longjin@dragonos.org> * fix(uprobe): close teardown and task scope races Filter task-scoped callbacks by exact task identity and make the breakpoint entry atomic with teardown rendezvous. Keep the kernel-owned XOL mapping immutable across VMA operations and reject unsafe repeated string instructions during registration. Preserve MREMAP_FIXED failure atomicity and add guest coverage for repeated instructions and concurrent final-consumer teardown. Signed-off-by: longjin <longjin@dragonos.org> * fix(uprobe): serialize runtime snapshots and reject pushf Serialize participant snapshot collection and publication, and release retired callbacks after leaving the IRQ-disabled registry lock. Reject PUSHF/PUSHFQ in phase-1 XOL so the temporary trap flag cannot leak into user-visible flags. Preserve Linux MADV_DONTNEED per-VMA side-effect ordering while using range-indexed probe lookup. Apply rustfmt to the touched perf, BPF, and ucontext sources. Tests: - make fmt FMT_CHECK=--check - cargo test --manifest-path kernel/Cargo.toml -p uprobe - make kernel - DragonOS QEMU uprobe suite (20/20) - DragonOS QEMU Madvise suite (1/1) Signed-off-by: longjin <longjin@dragonos.org> * fix(uprobe): reject xbegin and deduplicate installs Reject XBEGIN from phase-1 XOL execution because its relative abort target cannot be preserved by the current exact-end single-step state machine. Move same-consumer idempotence checking into the existing mm write-locked registration path so concurrent enable and VMA apply operations cannot publish duplicate callbacks. Keep LSS supported: Intel documents that it does not suppress events like MOV SS or POP SS, matching Linux 6.6.139. Tests: - make fmt FMT_CHECK=--check - cargo test --manifest-path kernel/Cargo.toml -p uprobe - make kernel - DragonOS QEMU uprobe suite (21/21) Signed-off-by: longjin <longjin@dragonos.org> * fix(uprobe): preserve XOL fault addresses Report the original probed instruction in SIGFPE siginfo when a divide fault occurs during XOL execution. Pass the registry snapshot consumer directly into installation so matching probes do not rescan the global registry for every site. Add a DragonOS regression test for the fault address and use a lock-free atomic result channel in its signal handler. Tests: - make fmt - make fmt FMT_CHECK=--check - cargo test --manifest-path kernel/Cargo.toml -p uprobe - make kernel - DragonOS QEMU uprobe suite (22/22) Signed-off-by: longjin <longjin@dragonos.org> * fix(uprobe): harden BPF attachment Reject duplicate PERF_EVENT_IOC_SET_BPF attachments atomically with EEXIST, matching Linux semantics. Allocate size-aware JIT memory fallibly and release it on every failure path. Add regression coverage for duplicate attachment and large JIT programs. Signed-off-by: longjin <longjin@dragonos.org> * fix(uprobe): serialize fork breakpoint restoration Restore inherited breakpoint bytes while the child address space is still write-locked, before file-rmap registration scans can enter it. Replay enabled consumers after publication and add bounded concurrent fork coverage for system-wide registration. Signed-off-by: longjin <longjin@dragonos.org> * perf(uprobe): scope task mapping scans Enumerate only the target address space for task-scoped open and enable, while retaining inode file-rmap traversal for system-wide consumers. Reuse the common enable lifecycle for initial activation and remove the duplicate open scan. Signed-off-by: longjin <longjin@dragonos.org> * fix(uprobe): preserve instruction mapping semantics Synchronize same-page breakpoint publication across active CPUs, validate complete instruction mappings and bytes, and track instruction-tail VMA changes. Drain and deduplicate consumer site references so repeated enable and disable does not grow stale attachment state. Signed-off-by: longjin <longjin@dragonos.org> * fix(uprobe): reject unsupported loop branches Classify the complete x86 LOOP-family as unsupported control flow so phase-one XOL cannot retry a taken branch after mutating the counter. Cover the decoder variants and perf event error contract with regression tests. Signed-off-by: longjin <longjin@dragonos.org> * fix(uprobe): expose perf hit counts Provide the raw singleton perf read ABI for uprobe events, keep advanced read formats explicitly unsupported, and serialize counter shutdown with in-flight callbacks. Also remove empty address keys when breakpoint installation rolls back. Signed-off-by: longjin <longjin@dragonos.org> * fix(uprobe): validate relocation and perf attributes Signed-off-by: longjin <longjin@dragonos.org> * fix(uprobe): preserve identity across VMA splits Signed-off-by: longjin <longjin@dragonos.org> * fix(uprobe): close perf event lifecycle gaps Signed-off-by: longjin <longjin@dragonos.org> * refactor(uprobe): consolidate probe lifecycle architecture Split the MM uprobe implementation into definition, consumer, site, reconciliation, and XOL ownership domains. Replace per-consumer site instances with one installed site per address and publish immutable RCU hit snapshots for the exception path. Model enable, disable, close, task exit, and exec through one-shot consumer epochs with explicit install and delivery admission. Move the authoritative XOL phase into task-owned state, keep BPF/JIT ownership in the perf adapter, and prevent heavyweight teardown from escaping into interrupt or RCU contexts. Restructure live VMA operations around fallible planning, precise probe withdrawal, infallible mutation, and best-effort reconciliation. Install probes for new executable mappings while holding the MM write guard and use a fixed-capacity mremap execution-publication transaction to close normal source and destination execution windows without post-commit allocation. Extend dunitest coverage for lifecycle transitions, fork and exec interactions, mapping splits, MAP_FIXED, mprotect, madvise, mremap move and DONTUNMAP behavior, locked mappings, in-place growth, BPF delivery, counter reset, and concurrent execution. Signed-off-by: longjin <longjin@dragonos.org> * fix(uprobe): grow the per-mm XOL slot pool Replace the fixed single-page XOL area with a lazily growing per-mm pool so registered probe sites are no longer capped at 256 addresses. Keep slot allocation and page creation on the registration path, preserving the allocation-free exception hot path and lifetime-pinned slots. Reserve pool capacity before mapping each additional XOL page, protect every page from user VMA changes, and prefer the newest page while still reusing released slots. Add a guest regression that registers 257 distinct sites and executes the first site backed by the second XOL page. Signed-off-by: longjin <longjin@dragonos.org> * fix(uprobe): synchronize VMA publication and hit lookup Keep uprobe state consistent across executable VMA mutations and high-volume site updates. - split VMA validation, withdrawal, commit, locked reconciliation, and permission publication into explicit phases - hold temporary execute/write barriers across mprotect, madvise, mmap, and mremap publication, including installed-site teardown windows - revalidate stale user protection faults against stable leaf permissions without masking genuine protection faults - replace full BTreeMap hit snapshots with a persistent Patricia index and serialize RCU publication with control mutations - accept CAP_PERFMON alongside the legacy CAP_SYS_ADMIN capability - add DragonOS regressions for permission transitions, VMA concurrency, DONTNEED, alias mappings, and capability checks Signed-off-by: longjin <longjin@dragonos.org> * fix(perf): harden probe inputs and remote writes Bound dynamic probe names according to the Linux perf ABI and return E2BIG when uprobe paths or kprobe symbols are not terminated within their type-specific limits. Rework process_vm_writev around remote writable-page acquisition: validate VM_WRITE, resolve remote write faults and COW, preserve private-page fork isolation, pin shared page-cache entries, publish dirty state before copying, and retain exact partial-write accounting. Reject writes to active read-only uprobe mappings instead of bypassing their protection. Restore an original uprobe opcode only while the software breakpoint is still present, so teardown cannot overwrite a newer byte. Add dunitest coverage for bounded probe names, active uprobe write rejection, anonymous and private COW writes, shared-file persistence, and partial-copy semantics. Signed-off-by: longjin <longjin@dragonos.org> * fix(uprobe): stabilize instruction installation Allocate XOL slots within the exact disp32 relocation range and keep the pool ordered so distant aliases neither reuse unreachable slots nor degrade into full-pool scans. Roll back unpublished XOL mappings on failed installation. Build breakpoint COW pages from a stable source snapshot, validate the bytes that will actually be published, and defer RCU hit metadata until all fallible preparation has completed. Propagate Page contention so strict registration waits outside mm.write and then fully revalidates. Reject SYSENTER and SYSEXIT probes, and return ENODEV only for offline per-CPU events while preserving Linux task-event semantics. Add regression coverage for distant RIP-relative aliases and fast system-call instructions. Signed-off-by: longjin <longjin@dragonos.org> * fix(uprobe): keep fork replay best-effort Keep inherited-breakpoint sanitization inside the fallible fork transaction, but treat consumer replay as observational work that cannot change fork's result. Mapping and fork reconciliation now attempt contended pages once, while explicit consumer activation retains strict wait and rollback semantics. Add a regression covering a privately modified MAP_PRIVATE instruction page under a system-wide uprobe. Signed-off-by: longjin <longjin@dragonos.org> * fix(uprobe): preserve rseq restart semantics across XOL Expose the original probe address as rseq's logical instruction pointer while XOL is active. When rseq commits an abort redirect, consume the XOL state first so single-step completion cannot overwrite the abort target and the original trap flag and slot lease are restored correctly. Add an x86 regression that forces preemption between the uprobe callback and XOL execution and distinguishes active-XOL aborts from legitimate pre-probe rseq aborts. Signed-off-by: longjin <longjin@dragonos.org> * perf(uprobe): bound reconciliation overhead Scope executable publication barriers to consumers that permit the target address space and skip fork replay when no system-wide consumer is active, while retaining inherited breakpoint sanitization. Replace per-mutation participant vector rebuilds with an RCU-published structurally shared chain, per-site membership liveness, and proportional compaction so registration and teardown no longer accumulate quadratic copying. Add task-scoped fork coverage to verify that child execution is sanitized without inheriting event counts or disarming the parent site. Signed-off-by: longjin <longjin@dragonos.org> * perf(uprobe): scope exec reconciliation Avoid full address-space replay when active uprobes cannot target the exec task. Reuse the task consumer index and system-wide activity counter to gate reconciliation without allocation. Move replay out of the ELF loader and into stable exec success and recoverable rollback points, preserving task-scoped events across exec while closing concurrent enable publication gaps. Add a task-scoped exec regression test. Signed-off-by: longjin <longjin@dragonos.org> * fix(uprobe): retain sites across writable mprotect Keep Linux's distinction between new uprobe installation eligibility and the lifetime of an existing site. A writable private VMA still rejects a new installation, while adding WRITE through mprotect no longer withdraws an already armed breakpoint. Removing WRITE continues to reconcile a persistent consumer. Add dunitest coverage for both the retained-site transition and delayed installation after WRITE is removed, and remove the obsolete installed-site intersection helper. Signed-off-by: longjin <longjin@dragonos.org> * fix(uprobe): bound teardown and classify XOL completion Index task-scoped consumers by their stable consumer IDs and remove only the known empty inode-offset bucket during teardown. This avoids quadratic scans while preserving weak ownership and existing lifecycle ordering. Treat a Running XOL at its exact slot endpoint as completed even when a virtualized debug exception omits DR6.BS. Continue forwarding hardware breakpoint causes and reject ICEBP from XOL analysis. Signed-off-by: longjin <longjin@dragonos.org> * fix(uprobe): quiesce events on final close Close install and delivery admission synchronously when the final perf file reference is released, while leaving sleepable epoch draining, site teardown, and BPF retirement to the existing release worker. Split release admission from worker ownership so late ioctls and callbacks cannot outlive close. Fix the admission guard's eager construction bug, which decremented a closed gate without a matching acquire and could leave teardown waiting forever. Index same-offset consumers by stable ID to reduce repeated close from quadratic irq-disabled scans to O(N log N), while preserving contiguous reconciliation snapshots. Validated with make fmt, a full x86_64 kernel build, the 60-case uprobe dunitest suite, and a three-persona adversarial review. Signed-off-by: longjin <longjin@dragonos.org> * docs(uprobe): document architecture and execution model Replace temporary implementation notes and planning material with reader-facing bilingual design documentation. Explain the file-offset identity model, per-mm sites, private breakpoint pages, XOL execution, VMA transactions, lifecycle ordering, performance characteristics, and Linux-compatible boundaries, and link both versions from the tracing indexes. Signed-off-by: longjin <longjin@dragonos.org> * fix(mm): serialize mremap mapping validation Signed-off-by: longjin <longjin@dragonos.org> --------- Signed-off-by: sparkzky <sparkhhhhhhhhhh@outlook.com> Signed-off-by: longjin <longjin@dragonos.org> Co-authored-by: longjin <longjin@dragonos.org>	2026-08-26 01:03:20 +08:00
火花andlongjin	6ef75fc963	feat(fs): implement inotify filesystem event notification (#2164) ... * feat(fs): implement inotify filesystem event notification Implements inotify (issue #2151): the fsnotify core notification layer, the inotify pseudo-device, 4 syscalls (init/init1/add_watch/rm_watch), and VFS write-path hooks for all standard events (create/delete/move/ modify/access/close/attrib/self events). Architecture: - fsnotify/ unified dispatch layer: global (inode_id, dev_id) index, TOTAL_WATCHES atomic fast-path (zero cost when no watches), lock-family separation (global index lock / events lock / wd lock never nested). - inotify.rs device: InotifyInode implements IndexNode + PollableInode, epoll-integrated via LockedEPItemLinkedList, exact inotify_event layout (name field aligned to sizeof(inotify_event)=16, matching Linux ABI). - VFS hooks placed in syscall-core layer (vcore/open/rename_utils/...), NOT per-filesystem: single anchor covers ext4/tmpfs/overlayfs/fuse. Hooks fire only after success and never alter syscall return values. Review fixes incorporated: - Directory watches receive child content events (issue B): IN_MODIFY/ ACCESS/OPEN/CLOSE delivered to parent dir watch with child name. MountFSInode::as_any_ref() returns the inner inode's Any, so use downcast_arc instead of downcast_ref for parent resolution. - Guard DELETE_SELF on hardlink unlink/rename-over: only emit when i_nlink reaches 0, matching Linux fsnotify_link_count() semantics. - Composite mark index key (inode_id, dev_id): prevents FUSE cross-mount event leakage when multiple mounts reuse same inode number. - Remove has_any_watch() gate on File::inotify_parent resolution so watches added after open receive content events. - Tolerate metadata failure after unlink/rename-over (FUSE GETATTR can return ENOENT); cache nlinks before the namespace operation. - SYS_INOTIFY_INIT only registered on x86_64 (generic syscall ABI uses inotify_init1); riscv64/loongarch64 lack the legacy init syscall. - Skip MOVED events on no-op rename; EOF reads no longer deliver IN_ACCESS; reject mask==0 and IN_MASK_ADD|IN_MASK_CREATE. Test: dunitest inotify_dir_watch (2 tests) + inotify_events (6 tests) covering content/namespace/self events, multi-instance, and poll. Design doc: docs/kernel/filesystem/inotify.md Signed-off-by: sparkzky <sparkhhhhhhhhhh@outlook.com> * fix(fsnotify): harden inotify lifecycle and semantics Linearize mark publication, dispatch, and removal around stable object identities so watch updates, one-shot delivery, inode deletion, and final unmount cannot race. Make queue overflow, read consumption, allocation rollback, user quotas, and dentry snapshots safe under concurrency and memory pressure. Align VFS event routing with Linux semantics for open, close, links, rename, attributes, exclusion of unlinked paths, and deletion ordering. Add dunitest coverage for namespace events, inode lifecycle, O_PATH, hard links, rename aliases, multi-instance delivery, and poll readiness. Validated with make kernel and 12 passing inotify tests on both host Linux and a DragonOS QEMU guest. Signed-off-by: longjin <longjin@dragonos.org> * fix(fsnotify): address follow-up semantic reviews Close lifecycle epoch races when final deletion notifications overlap relink and keep FUSE atomic-truncate cache invalidation atomic. Match Linux mount-boundary rename handling, lookup error precedence, no-op ordering, open and truncate event order, exec open notification, EXCL_UNLINK data kinds, and chown ABI/symlink semantics. Extend inotify and FUSE regression coverage for bind mounts, rename precedence, O_TRUNC, exec, chown flags and symlinks, event merging, and cache refresh. Signed-off-by: longjin <longjin@dragonos.org> * fix(fsnotify): address quota and event review findings Charge inotify usage through ancestor user namespaces and serialize rename notifications with conflicting namespace commits without holding the global topology lock during dispatch. Emit missing mknod and utimes events, preserve pathname O_TRUNC semantics, and extend the focused regression coverage. Signed-off-by: longjin <longjin@dragonos.org> * fix(fsnotify): avoid global lookups for unwatched objects Track watch presence in the existing per-object state shared by inode aliases. Event dispatch and final detach can now bypass the global mark index when neither target is watched, while add, removal, shutdown, and OOM rollback keep the hint synchronized with mark publication. Signed-off-by: longjin <longjin@dragonos.org> * fix(fsnotify): report successful xattr changes Emit IN_ATTRIB from the shared setxattr and removexattr success paths so path, fd, and no-follow syscalls notify both inode and parent watches. Cover successful, repeated, and failed mutations and document the event source. Signed-off-by: longjin <longjin@dragonos.org> * fix(fsnotify): address review findings and test timeout Handle directory rename-over deletion, release the inotify reader mutex before waiting, and add watch-presence hints for anonymous pipes. Report killpriv attribute changes with Linux-compatible masks and ordering, close the empty-queue read race, and make synchronous inotify tests drain without fixed delays. Signed-off-by: longjin <longjin@dragonos.org> * fix(fsnotify): complete zero-copy I/O notifications Make final-mark index removal allocation-free so low-memory cleanup cannot retain empty object keys. Keep the immutable multi-mark snapshot rebuild fallible and protect replacement with the existing Arc identity check. Publish splice and tee content events only after positive transfer progress, preserve Linux event ordering, and defer regular-file ACCESS for file-to-pipe transfers to avoid premature or duplicate events. Retain pathname identity when File substitutes a runtime special inode so named FIFO and procfd watches target the same object, while suppressing special-file content events on parent directory watches. Add shared-queue ordering and pipe/file/FIFO regression coverage. Tests: - make kernel - FMT_CHECK=1 make fmt - make -C user/apps/tests/dunitest bin/normal/inotify_events_test -j2 - inotify_events_test --gtest_filter='InotifyAnonymousObjects.*Splice*' Signed-off-by: longjin <longjin@dragonos.org> * fix(fsnotify): preserve mknod event ordering Queue mknod CREATE notifications while the parent mutation gate still serializes competing namespace changes. Share the commit-aware path between mknod and mknodat, add a bounded concurrency regression test, and avoid directory notification snapshots when no watches exist. Signed-off-by: longjin <longjin@dragonos.org> * fix(inotify): close review lifecycle gaps Reject pathname reopening of inotify anonymous files so a procfd open cannot tear down the original instance. Preserve Linux hard-link notification order under concurrent namespace mutations and drain unmount marks from a single fallible snapshot. Add regression coverage for procfd reopen, hard-link event order, and concurrent link/unlink publication. Signed-off-by: longjin <longjin@dragonos.org> * fix(inotify): serialize regular file create events Publish O_CREAT notifications at the backing namespace commit point while the parent children gate is still held. This prevents a concurrent unlink from queuing IN_DELETE before IN_CREATE. Cover both atomic create-and-open and the generic create fallback, and add a bounded concurrency regression for create/delete event ordering. Signed-off-by: longjin <longjin@dragonos.org> * fix(inotify): serialize namespace mutation events Publish mkdir, symlink, unlink, and rmdir notifications at their MountFS namespace commit boundaries while the parent children gate remains held. Preserve internal idempotent mkdir behavior while enforcing syscall EEXIST under the gate. Add bounded concurrency coverage for delete/recreate ordering and same-name mkdir. Signed-off-by: longjin <longjin@dragonos.org> * fix(inotify): align transfer and fallocate events Defer copy_file_range and sendfile data notifications until positive syscall-level progress while preserving write-side metadata events and partial-success semantics. Propagate committed fallocate metadata changes for ordered ATTRIB/MODIFY delivery and correct FUSE rename-over directory link counts. Add focused regression coverage. Signed-off-by: longjin <longjin@dragonos.org> * fix(fsnotify): harden lifecycle and event ordering Move mounted watches to object-local state and immutable mark snapshots so unrelated filesystem activity no longer contends on the global fallback index. Publish marks active only after accounting and index setup, and retire them through a single token-owned cleanup path. Model link removal and rename replacement with typed outcomes across VFS, FUSE, overlayfs, ext4, FAT, ramfs, and tmpfs. Keep delete epochs ordered by canonical inode mutation coordinators and publish namespace events at the actual commit boundary. Align open, truncate, fallocate, xattr, rename, and anonymous-object notifications with Linux ordering. Handle direct inotify reads without 64 KiB syscall re-entry, preserve EFAULT semantics, and avoid holding reader serialization across user faults. Make FAT zero-extension allocation fallible and rollback-aware, reuse measured chain extents, and preserve allocation metadata across retryable failures. Restore correctness-critical wait-queue wakeups and fatal group-signal delivery. Add dunitest coverage for lifecycle, ordering, read-boundary, fallocate, and concurrent FAT allocation regressions. Validation: - CARGO_INCREMENTAL=0 make -C kernel check ARCH=x86_64 - make kernel ARCH=x86_64 - inotify_events guest suite: 47 passed, 1 skipped, 0 failed - fat_concurrent_allocation guest suite: 2 passed, 0 failed Signed-off-by: longjin <longjin@dragonos.org> * fix(fsnotify): align I/O notification boundaries Emit IN_ACCESS once per successful read syscall instead of once per 64 KiB implementation chunk, while preserving bounded buffering and partial-read semantics. Keep overlay copy-up data transfers from publishing chunk-level ACCESS/MODIFY events without suppressing normal backing-file notifications. Translate non-atomic FUSE O_TRUNC as an ATTR_OPEN truncate without FATTR_FH. Add regressions for large reads and overlay copy-up notification ownership, and apply the formatting and Clippy fixes required by CI. Signed-off-by: longjin <longjin@dragonos.org> * fix(vfs): align fsnotify commit boundaries Resolve rename source and replacement objects under the same parent gates that serialize the backing mutation. Validate permissions and ancestor constraints against that authoritative snapshot, treat the locked filesystem NoOp outcome as final, and publish dentry state plus rename notifications from coherent metadata-free target seeds. Defer ordinary readv ACCESS delivery until the syscall result is known so bounded chunks and multiple iovecs emit one event. Preserve the existing single-read socket path and accept Linux-compatible zero-segment readv calls. Add regression coverage for large vectored reads, zero-segment ACCESS delivery, and same-inode rename no-op behavior. Signed-off-by: longjin <longjin@dragonos.org> * fix(ramfs): preserve written data during fallocate Use the locked data vector length as RamFS's authoritative file size when handling mode-0 fallocate requests. This prevents a stale cached metadata size from shrinking data previously grown by write or resize paths. Add a mounted RamFS regression test that writes a full payload, requests a smaller allocation range, and verifies both the file size and tail contents. The test fixture owns and cleans up its fd, file, mount, and temporary directory on every exit path. Signed-off-by: longjin <longjin@dragonos.org> * fix(inotify): support FIONREAD Implement the Linux FIONREAD contract for inotify descriptors by reporting the serialized byte size of every currently readable record, including the logical overflow event. Take the queue snapshot under its lock and release the lock before copying the result to userspace, so user faults cannot block queue producers or readers. Preserve ENOTTY for unsupported ioctl commands and EFAULT for invalid result pointers. Add a regression test covering named and unnamed events, non-consuming queries, invalid pointers, exact-size reads, empty queues, and assertion-safe resource cleanup. Signed-off-by: longjin <longjin@dragonos.org> * fix(vfs): preserve positioned I/O event boundaries Defer ACCESS and MODIFY publication across the internal 64 KiB pread/pwrite chunks, then emit one data event when the syscall has made positive progress. Keep metadata side effects at their real commit point, preserve partial results when later chunks fail, and make bounce-buffer allocation fallible. Replace the scheduler-dependent page-cache chunk-release selftest handshake with a deterministic probe at the same drop/yield/relock boundary used by production. Add a 200 KiB inotify regression covering parent and inode watches and unchanged positioned-I/O offsets. Signed-off-by: longjin <longjin@dragonos.org> * fix(inotify): preserve vector-read and interest-cache semantics Publish IN_ACCESS once for successful preadv and preadv2 calls, including zero-byte vector completions, while preserving scalar pread behavior. Validate signed offsets before flags and user iovec access so Linux error precedence is retained. Add an epoch-validated negative interest cache to mounted dentries. Watch transitions and namespace topology changes invalidate cached misses, avoiding repeated dentry locks and parent/name clones for unrelated I/O without adding alias scans or a global hot-path lock. Extend dunitest coverage for zero-length and EOF vector reads, invalid offset precedence, watch transitions, rename invalidation, and retained file descriptors. Tests: make kernel Tests: make -C user/apps/tests/dunitest build Tests: inotify_events_test (53/53, Ubuntu 24.04 guest) Tests: tcp_socket_test SelfConnectSendRecv (100 rounds, Ubuntu 24.04 guest) Signed-off-by: longjin <longjin@dragonos.org> * fix(inotify): satisfy x86 clippy borrow check Pass the existing parent reference directly to the mounted fsnotify state resolver. This removes the needless double borrow reported by the x86_64 format job without changing identity, lifetime, or locking semantics. Tests: make fmt Signed-off-by: longjin <longjin@dragonos.org> * docs(inotify): align architecture guide with implementation Replace the obsolete implementation plan with a user-oriented description of the current event model, routing, lifecycle, queue semantics, and performance design. Split the English version into the locales tree and register both language pages in their filesystem indexes. Checks: git diff --cached --check Signed-off-by: longjin <longjin@dragonos.org> * docs: translate newly-added Chinese comments to English Translate Chinese code comments introduced by the inotify/fsnotify work into English, and fix a stale function reference in inotify.rs add_watch (try_reserve_watch -> reserve_watch / adjust_total_watches). --------- Signed-off-by: sparkzky <sparkhhhhhhhhhh@outlook.com> Signed-off-by: longjin <longjin@dragonos.org> Co-authored-by: longjin <longjin@dragonos.org>	2026-08-25 14:02:38 +08:00
LoGin	1fb3b878e2	fix(waitqueue): prevent lockless empty checks from losing wakeups (#2207) ... WaitQueue wake_one() and wake_all() used a lockless waiter count as a correctness-critical negative check. An unlocker could publish the condition, observe a stale zero count, and skip the wake while the waiter failed its condition recheck and went to sleep. Always acquire the queue lock before deciding whether a wake queue is empty. This puts waiter registration and wake selection in the same linearization domain, matching the locking contract used by the regular Linux waitqueue wake path. Keep is_empty() as an explicitly advisory snapshot. Add a DoubleEpollOneShot progress regression that exercises the AF_UNIX mutex and waitqueue path through two independent EPOLLONESHOT registrations. Use a no-progress watchdog and MSG_NOSIGNAL so failures terminate deterministically without adding periodic wakeups to the operation under test. Fixes: #2202 Signed-off-by: longjin <longjin@dragonos.org>	2026-08-23 22:31:48 +08:00
LoGin	f64a0d5633	feat(vfs): implement close_range syscall (#2200) ... * feat(vfs): implement close_range syscall Add Linux-compatible close_range(2) handling for close, CLOEXEC, and UNSHARE operations with the expected u32 ABI and validation order. Introduce a fallible two-phase fd-table clone so allocation failures cannot mutate the shared table or trigger close side effects. Scan close ranges with bounded work, perform file finalization outside fd-table locks, preserve reserved descriptors, and retain the correct POSIX lock owner semantics. Add deterministic no-skip coverage for range validation, raw argument truncation, shared and private tables, sparse descriptors, lowered RLIMIT_NOFILE, next-fd reuse, and record-lock ownership. Validated with x86_64 kernel format/check/clippy/build, a RISC-V kernel check, host Linux tests, and DragonOS guest tests. Signed-off-by: longjin <longjin@dragonos.org> * fix(vfs): bound close_range clone population Separate the cloned fd-table layout size from the installed File population bound. Tail punch-hole clones now stop copying at the last descriptor that must be retained instead of cloning up to the minimum 1024-slot layout and then closing those files. This avoids redundant Arc clones, range scans, and observable flush_for_close callbacks while preserving the minimum table capacity, reserved-fd behavior, next_fd recomputation, and ordinary clone semantics. Add a focused clone-plan regression test for a 64-fd retained prefix in a 1024-slot layout. Validated with kernel format, check, clippy, make kernel, host close_range tests, and three independent adversarial reviews. Signed-off-by: longjin <longjin@dragonos.org> * fix(vfs): track fd table task ownership Separate files-table lifetime references from PCB attachment ownership so procfs, BPF, and in-flight syscall observers cannot be mistaken for CLONE_FILES users. Introduce a lightweight FileDescriptorTable identity with an atomic task-user count and an RAII FdTableAttachment for PCB slots. Route private replacement, CLONE_FILES sharing, exec, close_range, fork cleanup, and exit through the attachment lifecycle while keeping final table destruction outside basic and fd-table locks. Use coherent table-and-sharing snapshots for exec and close_range, preserve the fallible close_range clone transaction, and add a focused ownership regression test proving observer Arcs do not affect sharing decisions. Signed-off-by: longjin <longjin@dragonos.org> * fix(vfs): harden fd table unshare semantics Track task attachments independently from transient Arc observers so close_range and exec only unshare genuinely shared descriptor tables. Keep table lifetime ownership separate from task-sharing identity and preserve POSIX lock ownership for private tables. Reuse the fallible descriptor-table clone path across close_range, fork, and exec. Preserve the allocation-before-population transaction boundary, use conditional rescheduling during range scans, and keep old table teardown outside process and fdtable locks. Harden exec after the point of no return by preparing fallible signal state early and terminating through the normal fatal-exec path when later image installation fails. Add close_range ownership and exec isolation regression coverage. Signed-off-by: longjin <longjin@dragonos.org> * fix(exec): avoid synchronous RCU sighand reclamation Retire replaced sighand references outside task_lock through a fallible RCU callback admission path so shared-sighand exec no longer waits for a global grace period during normal operation. Reserve both pending and ready callback capacity before publication to keep grace-period advancement allocation-free. Preserve the removed Arc on allocation failure and use a no-allocation yielding grace-period fallback instead of turning post-PONR memory pressure into a kernel panic. Add RCU selftests for fallible deferred drop and no-allocation grace-period progress, plus deterministic successful and post-PONR shared-sighand exec isolation coverage. Validated with kernel build, formatting, nightly clippy, DragonOS guest exec ABI tests, and multi-agent adversarial review. Signed-off-by: longjin <longjin@dragonos.org> --------- Signed-off-by: longjin <longjin@dragonos.org>	2026-08-22 00:54:54 +08:00
LoGin	60c7f860d3	feat(kernel): add SMP-safe text patching (#2203) ... * feat(kernel): add SMP-safe text patching Introduce a transactional text patching core and an x86_64 backend that parks remote CPUs, validates expected instruction bytes, writes through dedicated RW+NX fixmap aliases, and synchronizes instruction fetch before returning. Vendor static-keys 0.8.2 with a minimal transactional backend interface so a key publishes its enabled state only after every branch site commits successfully. Migrate tracepoints to audited DragonOS declarations and propagate control-plane failures without adding work to the disabled fast path. Move perf event final release to a preallocated deferred worker so File::drop never sleeps or patches text. Quiesce patching during reboot and add single-CPU, SMP stable-epoch, tracepoint, and deferred-release coverage. RISC-V and LoongArch64 remain fail-closed until their SMP, IPI, and W^X prerequisites are implemented. Signed-off-by: longjin <longjin@dragonos.org> * doc: add text patching docs Signed-off-by: longjin <longjin@dragonos.org> * fix(kernel): address text patching regressions Preserve tracepoint enablement on architectures without a live text-patching backend by using the Linux-style dynamic-key fallback, while keeping x86 static branches unchanged. Validate all early-ioremap size and address arithmetic before slot allocation, publish static-key initialization with acquire/release ordering, and restore hosted dependencies required by workspace tests. Signed-off-by: longjin <longjin@dragonos.org> * fix(kernel): satisfy x86 text patching lints Use direct iteration for the text-poke alias table, remove a redundant perf-worker closure, and document the unsafe transaction queue contract. Signed-off-by: longjin <longjin@dragonos.org> * fix(perf): retry transient text patch timeouts Keep the release node and callbacks alive when an x86 text rendezvous times out before commit, then retry from the sleepable worker after a bounded backoff. Document the retry-safety contract for perf event implementations. Signed-off-by: longjin <longjin@dragonos.org> * fix(perf): requeue timed-out releases Return a timed-out release node to the existing intrusive queue after backoff so one unresponsive text-patch target cannot monopolize the global perf release worker. Signed-off-by: longjin <longjin@dragonos.org> * test(tracepoint): restore SMP test affinity Use an RAII guard to restore the gtest thread's original CPU mask on both normal completion and fatal assertion exits. Signed-off-by: longjin <longjin@dragonos.org> * fix(kernel): enforce strong text patch completion Use the calibrated TSC only for the boot-time rendezvous probe, then give live text updates stop-machine-style strong completion semantics. Remove deferred perf retry amplification and route executable-text invariant failures through a no-unwind machine stop. Signed-off-by: longjin <longjin@dragonos.org> --------- Signed-off-by: longjin <longjin@dragonos.org>	2026-08-20 00:47:48 +08:00
火花andlongjin	6672d99e03	feat(tracepoint): add sched_process_exec tracepoint (#2154) ... * feat(tracepoint): add sched_process_exec tracepoint 为 execve 成功路径添加 sched_process_exec tracepoint，供 ANOLISA agentsight 的 eBPF 程序追踪进程 exec 事件、构建 AI agent 进程树。 - 新增 kernel/src/process/trace.rs：声明 sched_process_exec tracepoint（comm/pid/old_pid 字段），TP_system(sched) - execve.rs：在 load_binary_file_with_context 之前捕获 old_pid（de_thread 会交换 pid）；trace 调用置于 arch_do_execve 成功后、is_ok() 分支内，对齐 Linux fs/exec.c:1803 - mod.rs：注册 process::trace 模块 tracepoint 注册、debugfs 导出、eBPF attach 全部由现有框架自动完成。static key 保证未启用时零开销。 Refs: #2149 Signed-off-by: sparkzky <sparkhhhhhhhhhh@outlook.com> * test(dunitest): add sched_process_exec tracepoint test 新增 sched_tracepoint dunitest，验证 sched_process_exec tracepoint 的 debugfs 导出（format/enable/id 文件 + 字段）与 execve 触发行为。 - EventFilesExist: 验证 events/sched/sched_process_exec/{format,id,enable} 存在，format 含 comm/pid/old_pid/common_pid 字段 - FiresOnExecve: enable + 清空 trace 后 fork+execve(/proc/self/exe)，断言 trace 含 sched_process_exec 记录与 comm 字段 - whitelist 注册 normal/sched_tracepoint Refs: #2149 Signed-off-by: sparkzky <sparkhhhhhhhhhh@outlook.com> * fix(test): sched_tracepoint id assertion - id starts from 0 TracePointIdFile 的 id 由 global_init_events 的 AtomicUsize::new(0) fetch_add 分配，从 0 开始递增。原断言 EXPECT_GT(idval, 0) 错误假设 id 从 1 开始，导致 CI 中拿到 id=0 的 tracepoint 失败。改为 EXPECT_GE(idval, 0)。 Refs: #2149 Signed-off-by: sparkzky <sparkhhhhhhhhhh@outlook.com> * fix(execve): release basic read lock before triggering sched_process_exec PR review 发现：trace_sched_process_exec(pcb.basic().name(), ...) 持有 basic 读锁 guard 直到 trace 调用返回，而 trace 默认回调内部的 trace_cmdline_push() 会再次获取同一把 basic 读锁。DragonOS RwLock 读锁不可重入，若此时另一 CPU 排队写锁，将导致 reader 等 writer、writer 等 reader 的 deadlock。 修复：先将 comm 复制到栈缓冲并在内层作用域释放读锁 guard，再调用 trace，消除锁重入。 Refs: #2149 Signed-off-by: sparkzky <sparkhhhhhhhhhh@outlook.com> * fix(execve): avoid splitting multi-byte UTF-8 char in comm truncation bug-hunter fanout 发现：comm_len = bytes.len().min(15) 在原始字节偏移截断，当进程名第 15 字节落在多字节 UTF-8 字符中间时（如 Unicode 路径名），from_utf8 失败导致 comm 变空字符串。用 is_char_boundary 回退到字符边界修复。 同时加强测试：strtol 解析 id 后校验 end 指针，确认整个字符串都是数字而非仅前缀可解析。 Refs: #2149 Signed-off-by: sparkzky <sparkhhhhhhhhhh@outlook.com> * style(execve): use name.len() per clippy needless_as_bytes make fmt / clippy: name.as_bytes().len() → name.len()（字符串可直接调 len()）。 Refs: #2149 Signed-off-by: sparkzky <sparkhhhhhhhhhh@outlook.com> * test(dunitest): cover tracepoint gating and non-leader exec pid swap Add 3 targeted cases to sched_tracepoint.cc: - DefaultDisabledNoRecords: verify zero records when disabled (static-key gate / zero-overhead guarantee) - DisableStopsFiring: verify enable/disable state machine toggles the static-key and stops firing after disable - NonLeaderExecFiresWithDistinctOldPid: cover the de_thread raw_pid swap path with a multi-threaded non-leader execve, asserting old_pid != pid (FiresOnExecve only exercised single-threaded leader exec where old_pid == pid) All 5 cases pass on QEMU x86_64. Signed-off-by: sparkzky <sparkhhhhhhhhhh@outlook.com> * fix(execve): trace after vfork completes and skip prep when disabled Address two P1 review items from fslongjin: - Thread: trace_sched_process_exec now runs after vfork_done complete_all(), not before. The prior order blocked the vfork parent behind every tracepoint callback after the child committed exec; Linux completes vfork from exec_mmap()/exec_mm_release() before trace_sched_process_exec() runs in the successful exec tail. - Thread: add a trace_<name>_enabled() read-only guard to define_event_trace! (GenericStaticKey::is_enabled, Relaxed atomic) and gate the whole comm field construction (basic read lock, UTF-8 boundary scan, copy) behind it in do_execve_internal. Rust evaluates call arguments before entering the static-key branch inside trace_<name>(), so the disabled path previously took the irqsave basic lock and scanned/copied the name on every exec. Now disabled execs pay zero trace overhead. Purely additive: all 12 existing tracepoints gain the guard, none change behavior. sched_tracepoint dunitest still passes 5/5 on QEMU x86_64. Signed-off-by: sparkzky <sparkhhhhhhhhhh@outlook.com> * test(dunitest): fail-fast on mount and RAII-clean tracepoint state Address one P2 and one P1 review item from fslongjin: - mount_debugfs returns AssertionResult now; callers use ASSERT_TRUE so a mount failure terminates the calling test instead of cascading against an ordinary directory. - Add a DebugfsMount RAII guard acquired right after mount (before enable) and armed after a successful enable write. Its destructor restores pre-test state on every exit path: disable (if armed) -> umount -> rmdir. Any mid-test ASSERT return can no longer leak a globally-enabled static key, pollute the shared ring buffer, or leak the mount point into later tests. Assertion semantics unchanged; 5/5 pass on QEMU x86_64. Signed-off-by: sparkzky <sparkhhhhhhhhhh@outlook.com> * fix(tracepoint): align sched exec tracing with Linux ABI Encode sched_process_exec with a Linux-compatible __data_loc filename record and preserve the original exec-visible path across interpreter rewrites. Separate aggregate producer activation from tracefs and per-perf delivery, make owner transitions idempotent, isolate mutable BPF contexts, and keep callback execution outside registry spinlocks with Arc-backed snapshots. Harden the trace cmdline cache against UTF-8 truncation and invalid cached bytes, and add DragonOS regression coverage for raw layout, shebang paths, Unicode names, enable lifecycle, and non-leader exec PID semantics. Signed-off-by: longjin <longjin@dragonos.org> --------- Signed-off-by: sparkzky <sparkhhhhhhhhhh@outlook.com> Signed-off-by: longjin <longjin@dragonos.org> Co-authored-by: longjin <longjin@dragonos.org>	2026-08-18 15:06:54 +08:00
LoGin	b915f28ba7	fix(vfs): preserve poll timeout without wait sources (#2197) ... PollAdapter treated an empty internal epoll registry as an immediate return even when no pollfd had produced revents. Arrays containing only ignored descriptors therefore bypassed their timeout, causing callers such as SpawnExecPipeRace to exhaust a nominal multi-second wait budget in milliseconds. Distinguish immediate results from the no-source state and route the latter through the existing timeout/signal wait path. Align the timeout-only path with Linux ready-before-signal-before-timeout ordering by checking pending signals before an expired deadline. Add deterministic poll and ppoll coverage for ignored descriptors, regular files with no requested events, POLLNVAL immediacy, and pending-signal precedence. Keep the suite in the mandatory dunitest set. Signed-off-by: longjin <longjin@dragonos.org>	2026-08-14 14:56:48 +08:00
LoGin	f705cc12f0	fix(net): preserve TCP self-connect partial reads (#2196) ... * fix(net): preserve TCP self-connect partial reads Keep self-connected receive probe errors inside the cumulative read loops so a later EAGAIN cannot discard bytes that were already copied and dequeued during the same syscall. Apply the same result propagation to direct user-buffer reads and kernel-buffer recv paths. Treat an exhausted receive-shutdown allowance as the current probe's EOF result instead of returning past previously accumulated progress. Add deterministic IPv4 and IPv6 regression coverage for read, recv, initial would-block behavior, and receive-shutdown partial progress. Enable the suite in the dunitest whitelist and require it to run without skips. Signed-off-by: longjin <longjin@dragonos.org> * test(gvisor): block failing dev tty case Block only BasicPtyTest.OpenDevTTY in pty_test because the forked child currently exits with status 1 on the master baseline. Keep all adjacent PTY coverage enabled so unrelated terminal behavior continues to run in integration CI. Signed-off-by: longjin <longjin@dragonos.org> --------- Signed-off-by: longjin <longjin@dragonos.org>	2026-08-14 14:02:11 +08:00
LoGin	3baab8d70b	test(net): cover IPv6 raw checksum optlen semantics (#2195) ... Add non-skippable dunitest coverage for the Linux 6.6 IPV6_CHECKSUM length and user-access contract. Verify short lengths fail before touching optval, full-length inaccessible values return EFAULT, oversized lengths consume only the integer prefix, and rejected operations preserve the configured checksum offset. Exercise EBADF and ENOTSOCK precedence, use guarded mappings to make the EINVAL/EFAULT boundary deterministic, and keep resource cleanup local to the tests. Exclude only the stale gVisor ReadShort subtest, which expects Linux behavior from before fb7bc9204095, while retaining the rest of the raw socket suite. Signed-off-by: longjin <longjin@dragonos.org>	2026-08-14 12:02:32 +08:00
LoGin	6aff128d71	fix(vfs): implement SEEK_DATA and SEEK_HOLE (#2192) ... Decode the Linux SEEK_DATA and SEEK_HOLE whence values instead of treating SEEK_DATA as an end-of-file alias. Preserve Linux error precedence by resolving the file descriptor before validating whence. Implement the generic regular-file fallback in File::lseek: report offsets before EOF as data, report EOF as the virtual hole, return ENXIO at or beyond EOF, and leave the shared open-file-description offset unchanged on failure. Reuse one metadata snapshot and reject sparse-seek operations for unsupported file types and VecCursor. Add dunitest coverage for dense and empty files, boundary errors, shared offsets through dup, invalid descriptor precedence, and directory rejection. Signed-off-by: longjin <longjin@dragonos.org>	2026-08-13 20:58:20 +08:00
LoGin	c435e93986	fix(exec): clean robust futex state before mm replacement (#2191) ... Successful exec replaced the current address space while leaving the task's robust-list registration pointing into the old mm. A later task exit attempted to walk that stale userspace list, producing recoverable missing-VMA faults and skipping the required owner-death transition. Take robust-list ownership exactly once and reuse one cleanup core for exit and exec. During the successful exec commit, temporarily restore the old mm, perform best-effort owner-death cleanup, and switch back to the new mm. Keep failed exec paths unchanged. Align exec mm switching with the scheduler's active-CPU and TLB ordering. Replace raw userspace AtomicU32 operations with exception-table-protected cmpxchg implementations for x86_64, RISC-V, and LoongArch, including 32-bit sign-extension and weak LL/SC ordering requirements. Validate robust entries, preserve PI and pending metadata, use namespace-visible task IDs, and stop safely on malformed userspace state. Defer missing-VMA diagnostics until exception-table recovery fails so expected nofault accesses do not emit misleading errors. Add exec ABI coverage for owner-death cleanup, registration reset, deterministic read-only futex faults, and early and late exec failure preservation. Signed-off-by: longjin <longjin@dragonos.org>	2026-08-13 16:23:17 +08:00
LoGin	567e2b119d	fix(epoll): prevent hardirq registration deadlocks (#2188) ... Encapsulate poll-source epoll registrations behind an IRQ-safe list API so task-context add and remove operations cannot be interrupted and re-enter the same spin lock from a device IRQ. Linearize callback publication with DEL, file release, and epoll close through an active registration state protected by the ready-state lock. Use open-file identity together with the descriptor as the registration key, remove socket registrations precisely, retain the signalfd registration owner, and clean up epoll sources using the registered file rather than the caller's descriptor table. Add bounded regressions for concurrent HVC TX completions, callback requeue after DEL, duplicated socket descriptors, and descriptor-number reuse. Signed-off-by: longjin <longjin@dragonos.org>	2026-08-13 14:22:13 +08:00
LoGin	dace5e9e0e	fix(ext4): implement atomic symbolic link creation (#2187) ... * fix(ext4): implement atomic symbolic link creation Implement a filesystem-specific symlink creation path instead of relying on the generic create-and-write fallback, which published an empty inode before ext4 rejected the target write with EINVAL. Store fast symlink targets in the inode inline area and initialize longer targets in an extent-backed data block before publishing the directory entry. Preserve directory insertion failure classification so only provably unpublished inodes are reclaimed, while indeterminate metadata writes fail-stop the mount without reusing a potentially reachable inode. Harden unpublished inode rollback for inline and extent-backed representations, including the transient state where an extent tree is updated before i_blocks is recomputed. Add host fault-injection coverage and loop-ext4 tests for the 59/60-byte boundary, remount persistence, target fidelity, and resource reclamation. Signed-off-by: longjin <longjin@dragonos.org>	2026-08-13 11:45:44 +08:00
LoGin	824d2574cc	fix(mm): support shared /dev/zero mappings (#2185) ... * fix(mm): support shared /dev/zero mappings Create an independent anonymous shared backing for each MAP_SHARED /dev/zero mmap while preserving that backing across fork and other derived VMAs. This matches Linux shmem-visible behavior without introducing a global inode page cache or a new shmem subsystem. Route faults and fault-around through the shared backing, publish newly allocated pages with a two-phase race-safe path, and teach futex, mincore, and msync to interpret hybrid file/shared-anonymous VMAs consistently. Keep fault-around lookup-only so sparse accesses do not allocate cold neighbor pages. Add dunitest coverage for lazy faults across fork, per-mmap isolation for same and different file descriptors, futex wakeups, mincore residency, msync, and sparse fault-around behavior. Fixes #2181 Signed-off-by: longjin <longjin@dragonos.org> * fix(mm): serialize shared page publication Keep the PageManager mutex across allocation and backing publication, and recheck the backing after acquiring it. Concurrent faults can now reuse a page published by the allocator lock holder instead of reporting a false ENOMEM while that page is still in flight. This also removes duplicate candidate allocation and cleanup without introducing per-index state or another sleeping lock. Signed-off-by: longjin <longjin@dragonos.org> --------- Signed-off-by: longjin <longjin@dragonos.org>	2026-08-13 00:39:38 +08:00
LoGin	03359a2454	test(procfs): fix TID reuse cache test semantics (#2179) ... pthread_join only waits for CLONE_CHILD_CLEARTID completion and does not guarantee that the exiting TID has already been unhashed from procfs. Remove the immediate ENOENT assertion that depended on that unsupported ordering. Treat failure to observe TID reuse within the fixed construction budget as an unmet test precondition on every platform. The namespace open and readlink checks still execute while each replacement thread is alive, so a stale cached TID directory continues to fail whenever reuse is actually observed. Fixes #2174 Signed-off-by: longjin <longjin@dragonos.org>	2026-08-12 16:14:48 +08:00
LoGin	bb8207ac79	perf(mm): compact page-level reverse mappings (#2183) ... Replace the per-page reverse-mapping HashSet with a private compact representation that stores the first two VMA references inline and upgrades to a sticky HashSet only when a third distinct VMA is attached. Move existing Arc references between Empty, One, Two, and Many states instead of cloning them during transitions. Allocate the Many representation before taking the inline state so allocation failure cannot discard existing reverse mappings, while preserving map counts, duplicate detection, mlock tracking, and final page reclamation semantics. Add a SysV shared-memory regression test that faults the same pages through three aliases, verifies coherence, and detaches each alias independently. This exercises inline insertion, HashSet promotion, sticky removal, and the final transition back to an empty reverse map. Validation includes x86_64 kernel builds, RISC-V and LoongArch64 checks, the full SysV shared-memory suite, page-fault, TLB-shootdown, mlock, and OOM regression suites, plus fork and VMA-split performance comparisons. Signed-off-by: longjin <longjin@dragonos.org>	2026-08-12 16:11:07 +08:00
火花andlongjin	977b3966db	feat(packet): add TPACKET V1/V2 RX mmap rings (#2096) ... feat(packet): add TPACKET V1/V2 RX mmap rings Implement Linux-compatible PACKET_RX_RING support for AF_PACKET sockets using TPACKET_V1 and TPACKET_V2. - add host-tested TPACKET UAPI layouts, offset calculations, and ring geometry validation - implement RAW/DGRAM receive rings with cBPF truncation, VLAN metadata, realtime timestamps, statistics, and readiness notifications - serialize ring control transitions, purge stale receive queues, and quiesce in-flight writers before teardown - track mmap lifetimes across fork, VMA splits, mremap, and partial unmaps - add transactional bulk page allocation, PageCache adoption, identity rollback, and extent-based buddy release - migrate perf BPF mmap backing to the shared bulk allocation path - harden socket option copy lengths, access ordering, and errno behavior to match Linux 6.6 - add host unit tests and DragonOS dunitest coverage for ring data paths, mmap lifetimes, allocation failures, and concurrent publication This phase intentionally excludes TPACKET_V3, PACKET_TX_RING, and PACKET_COPY_THRESH. Closes #2030 Signed-off-by: --global <sparkhhhhhhhhhh@outlook.com> Signed-off-by: longjin <longjin@dragonos.org> Co-authored-by: longjin <longjin@dragonos.org>	2026-08-12 14:58:17 +08:00
LoGin	4dc7f8e253	perf(mm): optimize anonymous page fault handling (#2182) ... Remove the per-fault CPUID query from the x86 SMAP check and evaluate the active CR4 state only for supervisor faults. Align the access-flag condition with Linux semantics. Return newly allocated managed pages from PageMapper so anonymous and /dev/zero fault handlers can reuse the original Arc directly. This avoids redundant page-table translations and global page-manager lookups while preserving allocation failure cleanup. Reuse fault-time VMA snapshots, reject malformed shared-anonymous mappings, and prevent /dev/zero fault-around population from replacing existing leaf mappings. Add regression coverage for overlapping /dev/zero fault-around windows, MAP_POPULATE, shared-anonymous delayed faults across fork, and page-fault accounting. Signed-off-by: longjin <longjin@dragonos.org>	2026-08-12 14:55:32 +08:00
LoGin	eda4b96964	feat(mm): account page faults through Linux-compatible APIs (#2180) ... Track completed minor and major faults per task and expose the existing resource aggregation through getrusage and procfs. Distinguish thread-group and per-thread /proc stat views while preserving exited-thread and reaped-child accounting. Add cache-line-sharded system pgfault and pgmajfault counters. Record major events at the backing-I/O source, defer retry accounting until completion, and keep failed or interrupted waiter paths aligned with Linux 6.6 semantics without adding locks, allocation, CPU probing, or logging to the fault hot path. Add dunitest coverage for anonymous write faults, thread versus thread-group reporting, vmstat updates, and reaped-child aggregation. Validated with: - make kernel - cargo +nightly-2026-02-24 fmt --manifest-path kernel/Cargo.toml -- --check - page_fault_accounting dunitest on Linux and DragonOS QEMU - wait_rusage dunitest on DragonOS QEMU - git diff --check Signed-off-by: longjin <longjin@dragonos.org>	2026-08-12 13:26:37 +08:00
LoGin	5f1d437f85	fix(tty): support virtual consoles without framebuffer (#2178) ... Select and cache the virtual terminal console backend when the first VT is installed. Use the framebuffer console when fb0 exists and the dummy console otherwise, while preserving one shared backend across all virtual consoles. Represent vcN as an identity-protected devfs symlink to ttyN so aliases do not register duplicate device numbers. Keep symlink creation and removal atomic under the devfs operation lock, including correct unlink metadata updates. Roll back automatically allocated TTY indexes when installation fails, preserve explicit index ownership, and keep default console selection available when tty0 creation reports an error. Add dunitest coverage for tty0 and vc0 device semantics in framebuffer-less boots. Signed-off-by: longjin <longjin@dragonos.org>	2026-08-11 23:39:47 +08:00
LoGin	86d14be129	fix(ahci): integrate controller with PCI driver model (#2168) ... * fix(ahci): integrate controller with PCI driver model Register AHCI controllers through the standard PCI driver lifecycle and distinguish absent controllers, empty ports, and genuine device failures. Preserve PCI command state and make controller, port, command-memory, and disk ownership explicit during probe, I/O, removal, and shutdown. Add bounded physical-page allocation for DMA masks, reject incompatible pooled buffers, and provide an on-demand debugfs self-test with deterministic buddy split, merge, fragmentation, and address-bound checks. Align block-device publication with Linux semantics by retaining the whole-disk node across partition scan or publication failures, preserving MBR slot numbers, and clipping partitions to device capacity. Add dunitest coverage for DMA allocation behavior and zero-capacity loop devices. The change has been validated with kernel builds, targeted dunitests, and QEMU AHCI matrices covering empty, valid-MBR, invalid-MBR, and injected-I/O-error devices. Signed-off-by: longjin <longjin@dragonos.org> * fix(ahci): handle disks without flush capability Treat synchronization as a successful no-op only when IDENTIFY reports neither an enabled write cache nor a supported FLUSH CACHE command. This prevents completed writes from being reported as unsupported while preserving real command failures. Track the advertised reliable-flush capability separately from the command selected for synchronization. If write cache is enabled but FLUSH capability bits are absent, follow Linux libata and attempt the base FLUSH CACHE command without advertising a reliable power-loss barrier. Signed-off-by: longjin <longjin@dragonos.org> * fix(ahci): harden detach and link recovery Make PCI removal a non-fallible terminal notification and detach AHCI block devices even while stale userspace or mount references remain. Gate new I/O, stop hardware when accessible, disable bus mastering, and keep delayed drops hardware-silent. Retain DMA allocations when engine shutdown cannot be proven, then reclaim the BDF-keyed quarantine only after a later probe completes an HBA reset with bus mastering disabled. Add irreversible best-effort block-device unpublication for physically detached hardware. Validate the complete 48-bit IDENTIFY capacity, avoid yielding on the first polling iteration, and train candidate links concurrently in one bounded controller window. Stop provisional FIS receivers without invalidating successful link classification. Validated with make kernel, x86_64 workspace tests, QEMU empty-controller boot, and QEMU AHCI disk discovery/read/sync smoke tests. Signed-off-by: longjin <longjin@dragonos.org> * style(ahci): apply rustfmt to stop polling Match the repository rustfmt output for the non-short-circuit provisional port stop expression. FMT_CHECK=1 make fmt now passes, including the kernel clippy check. Signed-off-by: longjin <longjin@dragonos.org> * fix(ahci): bound controller teardown latency Stop all implemented ports in two controller-wide phases: clear ST and wait up to 500 ms for every CR bit, then clear FRE and give every FR bit a separate 500 ms window. Each scan visits every port, so teardown latency no longer scales with port count. Treat an un-stoppable port during multi-port probe as a controller-fatal rollback. Quiesce published I/O, stop or reset the HBA, enter the detached terminal state, retire or quarantine DMA, and unpublish earlier disks before releasing the BDF probe reservation. Reuse the final Bus Master disable, detached publication, and DMA retirement sequence between normal remove and probe rollback so delayed mount references remain hardware-silent. Validated with make kernel, FMT_CHECK=1 make fmt, git diff --check, QEMU AHCI boot/device discovery/sync, and independent architecture, safety, and semantic reviews. Signed-off-by: longjin <longjin@dragonos.org> * fix(ahci): isolate port failures and bound command batches Keep controller-wide Bus Master enabled when a single port cannot stop, quarantine only that port DMA buffer, and reject queued I/O after the port is marked failed. Probe IDENTIFY and teardown FLUSH commands in fair controller-wide batches so one stalled port cannot multiply latency or starve healthy ports. Use the complete Linux AHCI error mask and ordered PxCI/PxIS sampling to avoid false command success. Add compile-time command status checks and preserve bounded concurrent cleanup for all failed ports. Signed-off-by: longjin <longjin@dragonos.org> * fix(ahci): harden firmware handoff cleanup Keep the entry PCI Command value intact until the controller is safe for OS ownership. Follow the AHCI BIOS handoff grace periods, force a bounded takeover without rolling back OOS, and disable bus mastering before resetting firmware DMA state. Restore the original non-DMA PCI decode state on detach. Restrict the on-demand DMA allocator self-test to architectures with implemented page-frame allocation so the LoongArch64 release build does not instantiate its placeholder MMArch. Signed-off-by: longjin <longjin@dragonos.org> * fix(build): restore musl source download The configured DragonOS mirror now returns HTTP 404 for the pinned musl 1.2.4 archive, which prevents x86_64 user-space builds from preparing their environment even though the kernel build succeeds. Use the official musl HTTPS release URL while preserving the pinned version, archive root, and build configuration. The downloaded archive was verified as gzip with the expected musl-1.2.4 root and SHA-256 7a35eae33d5372a7c0da1188de798726f68825513b7ae3ebe97aaaa52114f039. Signed-off-by: longjin <longjin@dragonos.org> * fix(ahci): address lifecycle and DMA review Release the controller registry read guard before taking the per-controller lifecycle lock so shutdown cannot deadlock against concurrent hot removal. Keep scanning a bounded DMA pool after discarding incompatible high-address entries, and strengthen the on-demand allocator self-test with a compatible entry below an incompatible LIFO entry. Skip redundant zeroing only for AHCI host-to-device payloads, which are fully initialized before submission. Device-written, bidirectional, identify, and command buffers remain zeroed. Signed-off-by: longjin <longjin@dragonos.org> * fix(ahci): preallocate DMA quarantine ownership Reserve both the per-controller and global quarantine slots while the HBA is healthy and bus mastering is disabled. Cache the device key so fatal teardown transfers up to 32 port buffers plus the command arena without allocating. Preserve quarantine capacity across successful command-engine stops, release DMA objects outside quarantine locks, and retain ownership rather than panic if a safety invariant is ever violated. Signed-off-by: longjin <longjin@dragonos.org> * fix(build): use reliable musl source mirror Fetch the canonical musl 1.2.4 release archive from the Buildroot source mirror. The archive matches the upstream SHA-256 and layout while avoiding the CI hang observed against the upstream release host. Signed-off-by: longjin <longjin@dragonos.org> * fix(build): fetch musl from GitHub mirror Use the v1.2.4 tag from the GitHub mirror whose commit matches the official musl tag. GitHub Actions can access this archive and its musl-1.2.4 root layout, unlike the Buildroot endpoint that returned non-gzip content to hosted runners. Signed-off-by: longjin <longjin@dragonos.org> * fix(build): pin musl mirror revision Pin the GitHub archive to the full commit referenced by the official musl v1.2.4 tag and update the extracted root directory. This prevents a mutable mirror tag from changing the source selected by clean CI builds. Signed-off-by: longjin <longjin@dragonos.org> * fix(driver-core): serialize device binding lifecycle Serialize probe, unbind, and device removal with a per-device sleeping lock so teardown cannot observe or invalidate a partially committed binding. Revalidate lifecycle state at binding commit and cover preset-driver attachment with the same synchronization and rollback rules. Signed-off-by: longjin <longjin@dragonos.org> * fix(mm): bound dma32 buddy allocation Split buddy free lists into DMA32 and Normal zones and keep non-empty metadata chains so exact 32-bit DMA allocation checks a fixed number of orders while interrupts are disabled. Reuse empty metadata pages, preserve low memory for constrained devices, and extend the on-demand allocator self-test and dunitest contract. Signed-off-by: longjin <longjin@dragonos.org> * fix(driver-core): drain bindings before shutdown Block new probe and preset-driver binding operations once shutdown starts, and wait for admitted bindings to complete before walking the device list. Serialize each shutdown callback with the existing per-device lifecycle lock and use exact device identity for the committed-binding check. Signed-off-by: longjin <longjin@dragonos.org> * fix(ahci): yield during controller polling Centralize the AHCI polling pause policy and use it for firmware handoff, power stabilization, and HBA reset waits so probe and teardown do not monopolize a CPU. Keep the protocol-sensitive 1 ms COMRESET assertion as a busy wait. Correct cold-presence handling while touching the power-settle path: CPD is a per-port PxCMD capability, CPS reports whether a device is attached, and only real SUD/POD transitions require the stabilization delay. Treat a firmware handoff without BB as the normal takeover path instead of a warning. Add compile-time coverage for the SSS/SUD and CPD/CPS/POD state combinations. Tests: make fmt FMT_CHECK=--check Tests: make kernel Tests: make -C kernel check ARCH=riscv64 Tests: make -C kernel check ARCH=loongarch64 Tests: make qemu-nographic (q35 empty AHCI controller, booted to userspace) Signed-off-by: longjin <longjin@dragonos.org> * fix(driver-core): amortize lifecycle lock cleanup Avoid scanning the entire lifecycle lock table on every new device once the table contains 64 live entries. Track an insertion budget and run dead-entry cleanup no more frequently than the current table size, keeping cleanup cost amortized under bulk registration. Preserve live weak entries so every lifecycle operation for the same Device allocation continues to rendezvous on one lock, including across unregister and later references. Signed-off-by: longjin <longjin@dragonos.org> * fix(mm): separate DMA cache address domains Keep DMA32-constrained and wider requests in separate bounded free lists for each DMA size class. Select cached buffers with an exact full-range mask check so a constrained allocation neither consumes nor releases incompatible entries from another device domain. Preserve the logical pool key in DmaBuffer, make pool return ownership explicit, and reserve optional list metadata before taking IRQ-safe locks. Extend the allocator self-test and dunit contract for domain isolation, narrow and 40-bit masks, range boundaries, overflow, and low-memory reuse. Signed-off-by: longjin <longjin@dragonos.org> * fix(ahci): recover ports after command errors Treat an isolated ATA task-file error as a command failure instead of permanently disabling the whole port. Stop command-list processing, validate a coherent PxIS/PxSERR/PxTFD/PxCI/PxSACT/PxSSTS snapshot, clear only observed status, and reopen the port only when the link and engine remain safe. Keep fatal, interface, timeout, hotplug, and ambiguous states fail-closed. Preserve DMA payload ownership until recovery completes, quarantine it when CR cannot clear, and roll back partial engine starts. Reuse cooperative polling in the HBA stop waits so a stuck CR or FR bit cannot monopolize a CPU. Add build-time coverage for recoverable UNC, fatal and overflow status, reset-worthy and recovered SError, ICRC, DRDY, active slots, post-recovery state, and link presence. Tests: make fmt FMT_CHECK=--check Tests: make kernel Tests: make -C kernel check ARCH=riscv64 Tests: make -C kernel check ARCH=loongarch64 Tests: make qemu-nographic (q35 empty AHCI controller, booted to userspace) Signed-off-by: longjin <longjin@dragonos.org> * fix(ahci): harden pre-command timeout recovery Recover a port once with COMRESET when BSY or DRQ remains set before command submission, then reinitialize it and revalidate the device identity with IDENTIFY. Keep the timed-out request failed and isolate the port whenever recovery cannot prove a safe reusable state. Derive command and FIS pointers from the controller-owned command arena instead of trusting mutable MMIO addresses. Remove the teardown allocation by draining the existing weak-device registry in place. Allow DMA32 allocations under buddy pressure to take a compatible low buffer from the unrestricted cache and migrate it one way into the constrained pool. Extend the allocator self-test to cover migration while retaining incompatible high entries. Signed-off-by: longjin <longjin@dragonos.org> * fix(ahci): reject overflowed transfers Treat PxIS.OFS as a command error so a completed slot cannot expose truncated DMA data or report an overflowing write as successful. Keep INFS non-fatal as required by AHCI and pin both cases with compile-time checks. Move the existing gendisk map out of detached block metadata and iterate it directly. This removes the remaining temporary Vec allocation from irreversible AHCI removal while keeping devfs and manager callbacks outside the metadata lock. Signed-off-by: longjin <longjin@dragonos.org> * revert(build): keep musl source configuration unchanged Restore the musl 1.2.4 DADK configuration to the PR base version. The mirror changes are unrelated to the AHCI driver work and should not be included in this pull request. Signed-off-by: longjin <longjin@dragonos.org> --------- Signed-off-by: longjin <longjin@dragonos.org>	2026-08-09 21:16:29 +08:00
LoGin	fc4146b2d5	test(procfs): cover TID reuse refreshing task namespace directory (#2166) ... Add a dunitest that verifies /proc/<pid>/task/<tid>/ns/<name> entries follow TID reuse instead of resolving through a stale cached directory. The test spawns a thread, opens and readlinks its IPC namespace file, and confirms the per-TID task directory reports ENOENT once the thread exits. It then reuses the released TID across up to 128 replacement threads, asserting the task directory and its UTS namespace links resolve to the new thread, matching Linux 6.6 semantics. On Linux, TID reuse is not guaranteed within a small fixed attempt budget, so the final assertion is gated to DragonOS and the test skips on other kernels when reuse is not observed. Signed-off-by: longjin <longjin@dragonos.org>	2026-08-01 23:04:06 +08:00
LoGin	4ce6e061d5	fix(fs): stabilize epoll and namespace lifecycles (#2165) ... * fix(fs): stabilize epoll and namespace lifecycles Eliminate the epoll wait lock inversion by removing the unreachable shutdown state and keeping waiter registration entirely within the ready-state synchronization domain. Refresh proc task entries by PID object identity and thread-group ownership so recycled TIDs cannot resolve stale cached directories. Resolve proc namespace magic links to namespace-backed files and preserve their mount projection through anonymous, non-cached dentries, allowing bind mounts to outlive the source task without leaking wrapper-cache entries. Add concurrent epoll ctl/wait coverage and namespace bind-lifetime regression coverage, including checks that ordinary proc fd magic-link projection remains unchanged. Validation: - make fmt - make kernel - DragonOS proc PID/TID reuse, UTS namespace, epoll, and mount suites - CubeSandbox container create/exec/destroy, 5/5 on the final kernel Signed-off-by: longjin <longjin@dragonos.org> * fix(procfs): preserve namespace fd identities Carry a stable namespace dentry name with mount-projected magic-link targets so open namespace descriptors render type:[inode] instead of falling back to anon_inode. Keep bind-mounted namespace descriptors on the ordinary mount path and expose anonymous namespace roots in mountinfo without a leading slash, matching Linux d_path and nsfs semantics. Extend the namespace bind regression test to cover the original fd identity, the bind-mounted fd path, and the mountinfo root. Signed-off-by: longjin <longjin@dragonos.org> --------- Signed-off-by: longjin <longjin@dragonos.org>	2026-08-01 10:01:58 +08:00
LoGin	4a99bd415a	fix(net): restore deadline-driven TCP progress (#2162) ... Publish smoltcp future poll deadlines through an atomic per-interface state and notify namespace pollers whenever a sleeping worker must recompute its timeout. Claim due deadlines before handing work to NAPI, restore claims after failed handoffs, and bound direct polling for interfaces without NAPI. Make NAPI schedule and completion results explicit across disable and detach races. Serialize RTNETLINK link mutations so interface state transitions cannot lose deadline rearming or publish inconsistent operational state. Add concurrent state-machine coverage for publish, claim, restore, schedule, complete, and disable transitions. Add a TCP receive-window regression test that verifies receiver progress makes a backpressured sender writable without relying on a fixed buffer threshold. Validated with make fmt, make kernel, net-poll-state and napi-state host tests, plus DragonOS guest TCP window, close, epoll timeout, and RTNETLINK link regression tests. Signed-off-by: longjin <longjin@dragonos.org>	2026-07-31 22:00:41 +08:00
LoGin	a43e491a6a	fix(ext4): eliminate delayed allocation retry storms (#2161) ... * fix(ext4): eliminate delayed allocation retry storms Replace fixed yield and sleep retries with a filesystem-scoped metadata mutation progress bridge. Publish generation changes when the final direct owner or exclusive owner releases the gate, wake all mount waiters on progress and fail-stop, and preserve linear reclaim and delayed-allocation ownership while waiting. Serialize delayed transaction submissions per mount so per-inode workers contend in the same ownership domain as the lower transaction gate. Treat a busy raw transaction core behind an acquired gate as an ownership invariant failure instead of retryable contention. Coalesce physically contiguous journal and checkpoint blocks without changing commit, flush, checkpoint, or clean-tail durability boundaries. Reserve bounded scratch space before publishing the active journal tail and validate immutable journal mappings at core construction time. Add lower-level gate, wraparound, poison, transaction collision, bulk I/O failure, and multi-inode delayed writeback recovery coverage. Validated with: - make fmt - make kernel - cargo test --lib in another_ext4 (161 passed) - recovery_fault_injection crash-recovery matrix - ext4_inode_identity_test in DragonOS QEMU (33 passed) Signed-off-by: longjin <longjin@dragonos.org> * docs(ext4): clarify direct gate retry semantics Document that compatible direct-owner CAS contention must remain a lock-free retry rather than being converted into EAGAIN. Explain the generation invariant that prevents bounded retry exhaustion from having a valid wakeup event. Signed-off-by: longjin <longjin@dragonos.org> --------- Signed-off-by: longjin <longjin@dragonos.org>	2026-07-31 15:01:44 +08:00
3 people	a74d4b7e6c	fix(fs): align post-write sync with Linux generic_write_sync (#2147) ... fix(vfs): make synchronous writes operation-owned Replace the default-false inode sync capability with an explicit per-open write policy so generic, delegated, and non-applicable write operations own their synchronization responsibilities. Propagate O_SYNC, O_DSYNC, S_SYNC, and synchronous-superblock intent exactly once through VFS, mount wrappers, OverlayFS, block devices, and retained backing files. Preserve partial-write progress, synchronize only the completed range, and report per-open writeback errors correctly. Complete FAT file-level durability with ordered page-cache writeback, metadata submission, and a final device barrier. Retain loop backing File descriptions across I/O and flush operations, serialize configuration changes with active I/O, enforce Linux change-fd and loop-control semantics, and defer busy LOOP_CLR_FD detach through AUTOCLEAR until the final opener and mount holder leave. Add regression coverage for synchronous-write policies, errseq handling, FAT durability, stacked files, loop lifecycle, allocation, permissions, autoclear, and loop-to-FUSE synchronization. --------- Signed-off-by: Donjuanplatinum <donplat@barrensea.org> Signed-off-by: longjin <longjin@dragonos.org> Co-authored-by: Donjuanplatinum <donplat@barrensea.org> Co-authored-by: longjin <longjin@dragonos.org>	2026-07-30 20:12:15 +08:00
LoGin	8bbc724a95	feat(ext4): implement recovery-safe delayed allocation (#2160) ... * feat(ext4): implement recovery-safe delayed allocation Introduce a reservation-backed delayed-allocation pipeline that keeps foreground admission, PageCache ownership, ext4 mapping, journal publication, and durable EOF updates in one explicit protocol. - reserve data and extent metadata capacity before publishing dirty pages, with mount-scoped linear leases and fail-stop accounting invariants - serialize per-inode append writeback through opaque capabilities, FIFO claims, stable dirty certificates, and bounded journal credit/extent-node pools - publish initialized data, extents, inode size, and timestamps with crash-safe journal ordering and orphan recovery coverage - coordinate truncate, fsync, mmap, reclaim, eviction, and unmount with admission closure, lifecycle ownership, queue draining, and errseq reporting - strengthen PageCache writeback generations, cancellation, deferred retry, MM fault handoff, and post-commit population semantics - add host power-loss fault injection plus dunitest coverage for queue ordering, inode identity, writeback accounting, sync ranges, and memory locking Signed-off-by: longjin <longjin@dragonos.org> * refactor(mm): split page cache by responsibility Separate the oversized page cache implementation into focused mapping, read-DMA, runtime self-test, and writeback modules while retaining the existing parent facade and public paths. - keep PageCacheManager's Weak<PageCache> ownership model and external API unchanged - isolate VMA invalidation and truncate coordination from cache membership operations - colocate DMA reservation and writeback state machines with their lifecycle helpers - constrain cross-module protocol access to the minimum page-cache-local visibility - preserve all locks, atomic orderings, wait predicates, error paths, and drop semantics Validated with make fmt, make kernel, symbol/declaration equivalence checks, and targeted 2-vCPU QEMU dunitest coverage for page-cache accounting, mmap truncate, sync_file_range, errseq reporting, ext4 I/O, and FUSE. * fix(ext4): batch delayed allocation writeback Aggregate contiguous per-inode delayed-allocation entries at the writeback boundary so a bounded batch shares data flush and journal commit costs without weakening foreground space guarantees. - carry one dirty-incarnation certificate and reservation per page through PageCache selection, ext4 FIFO claim, rollback, completion, and terminal failure paths - let the lower mapper consume fragmented physical allocations in one transaction with transaction-aware extent staging and conservative pre-claim credit bounds - query and clear a partial durable EOF tail before staging a promoted extent root, preserving the single successful data flush - make owner-free Claimed admission waits passive and interruptible while keeping published writeback and journal ownership non-cancellable - extend recovery fault injection for real batch submission, sparse forwarding, extent growth and split/merge, partial EOF root promotion, and I/O failure boundaries Signed-off-by: longjin <longjin@dragonos.org> * fix(fs): harden delayed writeback completion Preserve frozen range ownership across ordinary reclaim and writeback races by excluding tagged pages, serializing Legacy claims with invalidation, and assigning every Writeback transition a unique incarnation. Replace yield-based tagged retry loops with exact incarnation completion continuations. Dispatch retries from success, failure, detach, and deferred completion paths without blocking shared workers or allocating in infallible completion paths. Propagate mapping errseq failures through O_SYNC and O_DSYNC writes, restore delayed-allocation admission after a failed sibling mount, and make FIFO claim admission constant-time. Add PageCache incarnation/invalidation regression coverage and synchronous-write errseq dunitests. Signed-off-by: longjin <longjin@dragonos.org> * fix(ext4): bound mount and direct read serialization Replace the global mount registry critical section with a short lookup of a per-device mount domain. Keep journal recovery and delayed-allocation draining serialized only against mounts of the same block device. Restore delayed-allocation admission through an RAII rollback owner on every failed sibling-mount path, including failures while draining existing owners. Preserve fail-stop fencing while allowing healthy mounts with pending queues to resume. Make O_DIRECT reads persist only the FIFO prefix needed to reach delayed pages overlapping the requested range, then write back eager dirty pages in that range. This matches Linux range-based direct-read coherence without draining an unrelated append tail. Validated with make fmt, make kernel, and the 31-case ext4_inode_identity guest suite. Signed-off-by: longjin <longjin@dragonos.org> * fix(page-cache): bound writeback freeze exclusion Release the mapping invalidation writer between bounded dirty-tag scan chunks so large sync ranges do not stall file faults and other mapping operations for the complete scan. Serialize only competing freeze scanners across chunk boundaries to preserve epoch ownership. Resample the writeback incarnation frontier under the final exclusion window so ordinary claims which run between chunks remain covered by the frozen operation. Add a deterministic runtime self-test which queues an invalidation reader at the initial freeze boundary and verifies that it acquires before the unscanned tail is tagged. Validated with make fmt, make kernel, page_cache_accounting, sync_file_range, ext4_inode_identity, and repeated proc_self_exec_cmdline guest tests. Signed-off-by: longjin <longjin@dragonos.org> --------- Signed-off-by: longjin <longjin@dragonos.org>	2026-07-30 11:24:04 +08:00
LoGin	ae28b35276	fix(process): serialize non-leader exec handoff (#2156) ... Model non-leader exec as an owned group-exec transaction that serializes sibling teardown, old-leader exit, fatal cancellation, identity migration, and observer visibility. Atomically preserve PID/TGID/PGID/SID membership, raw-PID lookup, cgroup placement, parent-child ownership, ptrace relations, pidfd identity, session state, and accumulated resource usage across the leader handoff. Align wait, SIGCHLD, ptrace exit notification, fatal thread-group signals, and process-group delivery with Linux 6.6 semantics. Preserve exited-thread CPU accounting and publish child-exit state before waking signal and wait observers. Serialize controlling-TTY ownership and PTY peer lifetime transitions to prevent stale session updates, duplicate group signals, premature ctty removal, and slave-open races. Add deterministic dunitest coverage for non-leader exec identity, pidfd visibility, fatal-signal races, wait ownership, resource accounting, process groups, ptrace siginfo, and PTY lifetime behavior. Fixes #2153 Signed-off-by: longjin <longjin@dragonos.org>	2026-07-25 13:51:11 +08:00
LoGin	e374b45138	fix(kernel): stabilize apt update under sustained I/O (#2157) ... * fix(kernel): stabilize apt update under sustained I/O Rework NAPI scheduling around an exact-once SCHED/MISSED state machine with bounded, fair polling. Move virtio-net to deeper raw queues with preallocated DMA buffers, asynchronous TX completion, and race-closing EVENT_IDX callback handling. Track actual cross-CPU task ownership independently from runqueue placement and serialize stop wakeups, affinity changes, and migration tails so a task cannot execute or enqueue twice during network wakeups. Batch ext4 sequential range allocation and orphan extent reclamation, preserve journal credit and checksum invariants, and avoid read-before-write for complete blocks. This prevents apt package-store writes and interrupted-download cleanup from synchronously amplifying metadata I/O. Treat disappearing proc fd and fdinfo tables as normal exit races, refresh the pinned virtio-drivers revision, and add host-testable NAPI transition coverage. Validated with cargo test -p napi-state, cargo test -p another_ext4, and make kernel. Signed-off-by: longjin <longjin@dragonos.org> * fix(kernel): refresh dynamic proc and block state Refresh whole-disk capacity from the backing block device so loop devices expose their configured size after LOOP_SET_FD. Keep the static start LBA on I/O hot paths, safely fall back after device teardown, and report only complete loop sectors. Revalidate cached proc fd and fdinfo entries against the live descriptor table. Return ENOENT across zombie and reaped-task paths, including reads from an already-open fdinfo file, matching Linux 6.6 semantics. Add a dunitest covering cached fd entries across process exit. Signed-off-by: longjin <longjin@dragonos.org> * fix(net): defer virtio response TX reservation Consume completed RX buffers independently of TX queue availability so NAPI can continue making receive progress under transmit pressure. Use a lazy response token for receive-side replies and reserve DMA capacity only when smoltcp actually emits a frame. Keep explicitly reserved tokens for standalone transmit calls and split RX/TX token types to preserve their ownership invariants. Signed-off-by: longjin <longjin@dragonos.org> * fix(net): report standard MTU without blocking boot Keep the smoltcp Ethernet frame limit separate from the user-visible IP MTU so rtnetlink reports 1500 bytes instead of 1514. Run the existing DHCP acquisition window in a kernel worker, allowing SystemState::Running and userspace startup to proceed when no DHCP server is available. Add a strict rtnetlink MTU regression and teach dunitest to parse singular GoogleTest summaries so the one-case suite is enforced by CI. Signed-off-by: longjin <longjin@dragonos.org> * fix(fat): serialize concurrent cluster allocation Signed-off-by: longjin <longjin@dragonos.org> * fix(ext4): bound transactional range probes Signed-off-by: longjin <longjin@dragonos.org> --------- Signed-off-by: longjin <longjin@dragonos.org>	2026-07-24 13:20:55 +08:00
kadoandlongjin	59365fad2d	feat(tty): Implement missing TTY termios ioctls (TCSETSF, TCSETA*) (#2141) ... feat(tty): complete Linux-compatible termios and serial semantics Implement the legacy TCGETA/TCSETA ioctl family and the drain and flush behavior required by TCSETSW, TCSETSF, TCSETAW, and TCSETAF. Preserve termio flag merging, c_line ABI values, control characters, baud-rate encoding, job-control checks, and safe userspace copy-out semantics in line with Linux 6.6. Track retained N_TTY output and use interruptible, event-driven drain waits with correct handling for partial writes, signals, hangups, and peer teardown. Add bounded PTY staging queues and deferred peer delivery to preserve write ordering while avoiding cross-endpoint termios lock deadlocks. Align PTY polling, packet mode, flushing, unthrottling, and per-file hangup behavior with Linux semantics. Replace direct serial8250 PIO writes with an interrupt-driven TX queue, apply termios framing settings to hardware, implement bounded physical transmitter waits, and correctly route legacy COM ports over IRQ3 and IRQ4. Serialize console, emergency, and runtime output and notify blocking and epoll writers when TX capacity becomes available. Make TTY fasync and hangup state follow individual open file descriptions. Serialize F_SETFL updates with lifecycle cleanup and unregister stale TTY, pipe, and socket fasync entries on final release. Add focused termios, PTY hangup, tcflush, and fasync regression tests, and validate independent COM2 transmission without relying on IRQ4 traffic. Co-authored-by: longjin <longjin@dragonos.org> Co-authored-by: kado <2448956191@qq.com> Signed-off-by: kado <2448956191@qq.com> Signed-off-by: longjin <longjin@dragonos.org>	2026-07-24 01:38:01 +08:00
LoGin	1f4e6b60ab	fix(pipe): correct waitqueue wakeup semantics (#2148) ... * fix(pipe): correct waitqueue wakeup semantics Track blocked writer intents while holding the pipe state lock and choose single or broadcast wakeups according to whether heterogeneous write predicates may be waiting. Reuse the lock guard returned by the wait path so predicate publication, sleep, and revalidation remain ordered. Move waitqueue, epoll, async I/O, and SIGPIPE notifications outside pipe spinlocks. Preserve partial-write results and observer notifications when readers close, and align zero-length, nonblocking EPIPE, resize, splice, and tee behavior with Linux semantics. Prevent splice-held data from being consumed twice and keep tee source data intact while preserving partial progress. Add deterministic dunitest coverage for endpoint side effects, writer eligibility, partial-write notifications, splice and tee wakeups, reader baton passing, and resize threshold changes. Signed-off-by: longjin <longjin@dragonos.org> * fix(pipe): select eligible writer waiters Replace unconditional multi-writer broadcasts with predicate-tagged waits. Track the free-space requirement of each blocked writer, choose one eligible class in round-robin order, and wake only that class to avoid thundering-herd retries. Preserve progress with bounded fallback across the register-before-enqueue window. Pass the writer baton only after the selected write or splice operation completes or aborts, and pass the reader baton when an interrupted reader leaves consumable data behind. Keep tagged waitqueue lookup and cleanup bounded, reserve the ordinary waiter tag, and move wake-all destruction outside the IRQ-disabled critical section. Add homogeneous and heterogeneous writer, splice, tee, signal, and resize regression coverage. Tests: make fmt Tests: make kernel Tests: pipe_waitqueue_wakeup_test (11/11) Tests: pipe_release_test (8/8) Tests: splice_concurrent_io_test (7/7) Tests: epoll_timeout_budget_test (1/1) Tests: TCPResetDuringClose (12/12, twice) Signed-off-by: longjin <longjin@dragonos.org> * fix(pipe): serialize splice writer transactions Add a per-pipe writer transaction that coordinates writes, output-side splice operations, endpoint close, and pipe resizing. Blocking writers publish their tagged wait predicate before releasing the transaction and pass an eligible writer baton only when another published waiter remains. Keep file-to-pipe splice ownership across the input read and commit so competing writers cannot steal previously observed capacity. Validate readers before consuming stream input, including nonblocking EPIPE handling, and retain destination-only transaction locking for pipe-to-pipe splice and tee to avoid ABBA. Add Dunitest regressions for no-reader stream preservation and competing writer serialization. Bound regression reads with poll deadlines so incorrect behavior fails deterministically instead of timing out. Signed-off-by: longjin <longjin@dragonos.org> --------- Signed-off-by: longjin <longjin@dragonos.org>	2026-07-22 23:59:11 +08:00
LoGin	229557c64e	fix(timekeeping): restore monotonic clock and clocksource semantics (#2145) ... * fix(timekeeping): restore monotonic clock and clocksource semantics DragonOS used the realtime epoch as the basis for monotonic clocks and spread clocksource cycle state across multiple owners. The resulting updates could lose elapsed time, recurse through the timekeeper lock, and make timeout consumers depend on wall-clock adjustments. KVM clock CPU bring-up and interrupt-context locking also lacked transactional failure handling. Rework the timekeeping core around independently maintained monotonic and raw read bases, with realtime and boottime represented as offsets. Keep clocksource selection, watchdog state, switching, and rollback under a single control transaction, and preserve elapsed time and fractional state when a source changes. Make KVM clock setup per-CPU and transactional, including AP failure rollback. Add writer-preferred RwLock progress and explicit interrupt context tracking so timekeeper writers cannot deadlock behind continuous readers or acquire blocking paths from hardirq/softirq context. Align POSIX clock reads, nanosleep restart handling, signal waits, and futex timeouts with their Linux clock domains. Add kernel selftests, dunitest coverage, a guest calibration workload, and a fail-closed host calibration harness for KVM and TCG evidence. Validation: - x86_64 kernel build and link - RISC-V Rust build and kernel ELF link - 31 host calibration unit tests - guest calibration workload static build - QEMU runner and Python syntax checks - KVM 2-vCPU timekeeping/restart suite: 19/19 relevant tests passed - fixed-CPU and migrating 10,000,000-read monotonicity tests passed Signed-off-by: longjin <longjin@dragonos.org> * fix(timekeeping): address CI and review regressions Serialize watchdog cleanup with clocksource registration and fully roll back partially published watchdog state. Keep hardirq nesting counters cache-line isolated and avoid the CAS loop on interrupt entry and exit. Match Linux's settimeofday boundary after suspend, expose clocksource selftests through debugfs, and bound normal guest semantic loops while retaining the opt-in ten-million-read stress gates. Make QEMU argv evidence fail closed, release partially initialized serial transport resources, and resolve the formatting regressions reported by CI. Validated with make fmt, make kernel, host calibration tests, the calibration host build, and DragonOS guest timekeeping selftest and semantics suites. Signed-off-by: longjin <longjin@dragonos.org> * fix(timekeeping): preserve selftest execution state Restore preemption when an already-registered rwlock writer acquisition fails, and cover the failure path in the debugfs selftest. Consolidate all selftest-only registered writer attempts behind the balanced helper. Also preserve the underlying serial socket error in calibration diagnostics and verify both the reported detail and resource cleanup. Validated with format and Clippy checks, the kernel build, calibration unit and host tests, and DragonOS guest timekeeping selftests. Signed-off-by: longjin <longjin@dragonos.org> * fix(net): snapshot bound sockets before notification Network polling walked the bound-socket vector by index while dropping the lock around every notification. Concurrent socket teardown could remove an earlier entry, shift the vector, and make the next index skip a poll waiter entirely. Take one coherent Arc snapshot and reuse the shared notification path for regular polling, NAPI polling, and listener teardown. Notifications still run outside the bounds lock, preserving the required lock order, while a single read-side acquisition avoids writer-fair reacquisition stalls under close-heavy workloads. This prevents tcp_close_semantics poll timeouts during concurrent IPv4 and dual-stack reset/close stress. Signed-off-by: longjin <longjin@dragonos.org> * fix(process): serialize kernel stack allocation safely Kernel stack allocation and reclamation used try_lock_irqsave().unwrap() on their shared mapper lock. Concurrent fork and exit activity therefore converted ordinary lock contention into a kernel panic, as observed when tcp_socket_test created processes on both CPUs. Acquire KSTACK_LOCK with the blocking irqsave spin-lock operation in both paths. This preserves the existing mapper serialization and interrupt exclusion while allowing the contending CPU to wait for the current stack operation to finish. The gVisor tcp_socket_test now completes all 184 tests without triggering the allocation race. Signed-off-by: longjin <longjin@dragonos.org> * fix(kernel): avoid poll allocation and TTY lock recursion Make the network interface's bound-socket table copy-on-write. Poll and notification paths now clone only the outer Arc while interrupts are disabled, while the less frequent bind and unbind paths perform any required Vec clone. This preserves a coherent notification snapshot without O(n) IRQ-off allocation or the index-shift race fixed earlier. Use one by-value termios snapshot for each N_TTY receive batch and pass it through the nested input helpers. The previous receive path recursively acquired the same read lock; once a termios writer queued, writer-fair admission blocked the recursive reader and deadlocked both CPUs. A value snapshot preserves consistent per-batch input semantics and removes the recursive locking dependency. Validated with make kernel, all 27 CubeSandbox PTY exec-chain tests, and all 6 TCP close semantics tests. Signed-off-by: longjin <longjin@dragonos.org> * style(kernel): format N_TTY snapshot changes Apply the repository rustfmt output required by the architecture format-check jobs. No behavior changes. Signed-off-by: longjin <longjin@dragonos.org> * fix(x86_64): roll back failed HPET enablement Treat HPET enablement as a hardware transaction. If any validation, counter check, timer lookup, or IRQ registration step fails, restore the firmware general configuration instead of relying on the enabled flag, which is intentionally published only after IRQ setup succeeds. Snapshot and restore each timer comparator together with its configuration. Restore timer state while the counter is disabled, then write the complete firmware general configuration last so a firmware-enabled counter resumes only after all timer registers are coherent. Normal HPET disable now reuses the same restoration path. Validated with the repository format and Clippy checks, make kernel, and a DragonOS x86_64 fallback boot with HPET unavailable. Signed-off-by: longjin <longjin@dragonos.org> * fix(tty,time): eliminate PTY input hangs Use a persistent waiter notification for nanosleep timers, preserve deadline semantics across signal and restart races, and avoid recursive N_TTY termios, flow, and line-discipline wakeup locking during input processing. This fixes the ByteStream PTY deadlocks observed in CI while keeping absolute sleeps from returning before their POSIX clock deadline. Signed-off-by: longjin <longjin@dragonos.org> * fix(tty): satisfy clippy auto-deref lint Signed-off-by: longjin <longjin@dragonos.org> * fix(dunitest): synchronize reparent wait test Signed-off-by: longjin <longjin@dragonos.org> * fix(time): return EOPNOTSUPP for thread CPU nanosleep Signed-off-by: longjin <longjin@dragonos.org> --------- Signed-off-by: longjin <longjin@dragonos.org>	2026-07-20 21:06:15 +08:00
LoGin	45931ee3b3	chore(rootfs): remove deprecated default apps (#2146) ... Signed-off-by: longjin <longjin@dragonos.org>	2026-07-19 13:07:04 +08:00
LoGin	e683b2062c	fix(namespace): pass mount and pivot_root conformance (#2137) ... * fix(namespace): pass mount and pivot_root conformance Align mount namespaces, propagation, pivot_root, proc mount topology, VFS permissions, and tmpfs accounting with Linux 6.6 semantics. Make current-task publication and x86 fast CPU identification safe across context switches and AP startup, and harden page-cache allocation and rollback paths. Add focused dunit and gVisor coverage for mount, pivot_root, dangling symlinks, tmpfs quota, and propagation. Make both runners fail closed on incomplete XML, unexpected skips, timeouts, and stale results while always publishing CI artifacts. Validated with kernel builds, runner unit tests and linting, slab allocator tests, QEMU boot, the full dunit suite, focused namespace tests, and gVisor mount/pivot_root tests. Signed-off-by: longjin <longjin@dragonos.org> * fix(vfs): address review and CI regressions Make atime updates field-specific and synchronized in mutable filesystems, serialize FUSE and ext4 metadata updates, enforce O_NOATIME ownership, and cover directory access semantics. Compute tmpfs statfs data from atomic page accounting without taking a superblock write lock on every page operation. Preserve slab allocator soundness without clearing an entire object page. Restore the origin/master current-task implementation that predates the wait/epoll CI regressions, reject invalid open flag combinations, read complete symlink targets, and decouple existing mount topology traversal from mount-max admission limits. Add dunit coverage for metadata races, atime flags, tmpfs quota reporting, long symlinks, open errors, and lowered mount limits. Signed-off-by: longjin <longjin@dragonos.org> * fix(vfs): skip atime updates for anonymous inodes Use the optional filesystem lookup before checking mount state during access-time updates. Anonymous kernel objects such as sockets now report that they are not backed by a filesystem, matching Linux socket read semantics and avoiding a panic in readv and splice paths.\n\nDocument the expanded try_fs contract so callers can distinguish filesystem-backed inodes from anonymous objects without relying on a panicking fs implementation.\n\nThis fixes the gVisor TCP splice timeout and UDP writev/readv failure observed in the integration workflow. Signed-off-by: longjin <longjin@dragonos.org> * fix(vfs): address follow-up review findings Preserve Linux open error precedence by applying O_NOATIME ownership checks after path, type, and DAC validation while keeping them ahead of direct-I/O and socket-open failures. Add regression coverage for final symlinks and directory O_DIRECT combinations.\n\nReuse one fallibly allocated PATH_MAX buffer across a symlink walk to avoid per-hop allocation and clearing.\n\nEnsure the gVisor runner terminates the full test process group and reaps its leader when try_wait fails, sharing the same cleanup path used for timeouts. Signed-off-by: longjin <longjin@dragonos.org> * fix(vfs): address latest review and integration failures Initialize new inode ownership before publication across tmpfs, ramfs, and ext4, including mknod and rename whiteouts. Preserve setgid directory inheritance while stripping unauthorized executable setgid modes. Harden transactional page-cache rollback against concurrent dirty publication, update regular-file atime on EOF reads, and avoid filesystem lookups for anonymous socket permission checks. Disable required-test manifest enforcement completely when requested and add regression coverage for ownership, SGID, EOF atime, and runner behavior. Signed-off-by: longjin <longjin@dragonos.org> * fix(vfs): preserve bootstrap inode creation Use the initial root credential for kernel-owned filesystem objects created before ProcessManager installs a current task. Keep setgid directory inheritance intact while avoiding an early-boot current_pcb spin during procfs initialization. Signed-off-by: longjin <longjin@dragonos.org> * fix(vfs): preserve fallocate metadata and defer atime writes Apply Linux-compatible write-side metadata effects after successful tmpfs fallocate allocation, including timestamp updates and setid removal, while preserving rollback atomicity. Cache ext4 atime updates in memory, track them through the existing dirty inode queue, and commit them with size and mtime during periodic or explicit metadata writeback instead of synchronously writing from the read path. Add dunitest coverage for fallocate metadata effects, failure stability, setid clearing, and ext4 atime visibility and persistence. Signed-off-by: longjin <longjin@dragonos.org> * fix(vfs): address symlink and ext4 timestamp review Enforce Linux symlink creation semantics in the common syscall path, including empty targets, trailing slashes, parent search/write permission ordering, immutable directories, and an atomic tmpfs permission recheck under the parent inode lock. Keep ext4 inode timestamps authoritative in memory and evaluate relatime without io_lock or disk getattr. Add masked setattr support and generation-based atime/mtime writeback commits so concurrent reads, writes, mmap faults, setters, resize, and writeback cannot lose dirty timestamp updates. Add dunitest coverage for symlink error and permission semantics plus ext4 relatime behavior. Validated with make kernel and the full DragonOS dunitest suite (797 tests, 0 failures). Signed-off-by: longjin <longjin@dragonos.org> * ci(test): align job and guest timeout budgets Raise the syscall workflow timeout to cover its 50-minute guest monitor after the build and disk preparation phases, while preserving time for cleanup and diagnostic uploads. Apply the same outer-timeout invariant to dunitest so its 30-minute monitor can terminate QEMU and publish the serial artifact before the Actions job deadline. Signed-off-by: longjin <longjin@dragonos.org> * fix(ext4): publish created inode without reread Return authoritative attributes from the in-memory inode used by create, mkdir, and mknod transactions, while preserving the existing inode-number APIs. Initialize canonical VFS inodes from those attributes for regular creation, special nodes, and rename whiteouts. This removes the post-link getattr failure window that could report EIO after the directory entry was already committed. Keep lookup-time getattr behavior unchanged and add coverage for complete in-memory FileAttr conversion. Validated with make kernel, all 130 another_ext4 tests, and the full DragonOS dunitest suite (797 tests, 0 failures). Signed-off-by: longjin <longjin@dragonos.org> * fix(namespace): stabilize propagation conformance checks Replace the scheduler-dependent recursive propagation observer with explicit shared/private phase acknowledgements and a midpoint stress snapshot handshake. Preserve the two unsynchronized 512-transition halves, namespace copying, and concurrent topology mutation while reporting the exact failing child status. Allocate a fresh conceptual hidden-parent mount ID when copying an attached namespace so mountinfo never exposes the source namespace's parent identity. Keep ordinary overlay traversal single-pass for the common shallow path and defer cycle detection to pathological depths without imposing a semantic limit. Require the recursive-bind topology and mount-limit rollback suites to remain skip-free alongside the existing namespace conformance binaries. Validated with make kernel, 12 dunit runner tests, the full DragonOS dunit suite, and 100-run focused stress loops on Linux and in the DragonOS guest. Signed-off-by: longjin <longjin@dragonos.org> * fix(namespace): address propagation review findings Signed-off-by: longjin <longjin@dragonos.org> * fix(mm): preserve zero-length mmap error priority Signed-off-by: longjin <longjin@dragonos.org> --------- Signed-off-by: longjin <longjin@dragonos.org>	2026-07-18 16:03:44 +08:00
火花andlongjin	66ddcba7c7	feat(net): implement PACKET_FANOUT for AF_PACKET load balancing (#2119) ... * feat(net): implement PACKET_FANOUT for AF_PACKET load balancing Implement PACKET_FANOUT (setsockopt SOL_PACKET option 18) for AF_PACKET sockets, distributing ingress frames across group members instead of broadcasting a full copy to every socket. Supported fanout modes: HASH (flow hash), LB (round-robin), CPU, ROLLOVER, RND. Supported flags: FLAG_ROLLOVER (backup fallback), FLAG_UNIQUEID (kernel-assigned group id). Unsupported modes (QM/CBPF/EBPF) and flags (DEFRAG/IGNORE_OUTGOING) return EINVAL. Architecture: FanoutGroup registry in NetNamespace using RCU copy-on-write (RcuArcSlot), mirroring the existing packet_sockets broadcast registry. deliver_to_packet_sockets skips fanout members in the broadcast loop and dispatches one copy per group via group.deliver(). join/leave TOCTOU closed under fanout_groups_writer lock. Per-packet deliver path is zero-allocation (two-pass member selection). AtomicBool fanout_active mirror avoids RwSem on the broadcast hot path. Closes #2032 Signed-off-by: sparkzky <sparkhhhhhhhhhh@outlook.com> * fix(net): close fanout join/leave concurrency bugs and restore PACKET_TIMESTAMP Fix three P1 issues found in adversarial review: 1. ABBA deadlock: join acquired fanout_groups_writer → fanout.write() while leave acquired fanout.write() → fanout_groups_writer. Unified lock order to always fanout_groups_writer → fanout.write() by moving the socket's fanout field clear into the netns leave path under the writer lock. 2. TOCTOU race in join_fanout: the EBUSY check (fanout.read().is_some()) ran outside the writer lock, allowing concurrent setsockopt on the same socket to bypass it and leak the socket into two groups simultaneously. Moved the check inside fanout_group_join after acquiring the writer lock. 3. PACKET_TIMESTAMP constant (value 17) was inadvertently removed from the packet_option module. Restored. Signed-off-by: sparkzky <sparkhhhhhhhhhh@outlook.com> * fix(net): resolve clippy too_many_arguments on fanout_group_join Bundle the 7 fanout join parameters (id_req, unique, mode, flags, sock_type, bound_ifindex, bound_protocol) into a FanoutJoinParams struct, reducing fanout_group_join's argument count from 9 to 3 and clearing the clippy::too_many_arguments error under #![deny(clippy::all)]. Signed-off-by: sparkzky <sparkhhhhhhhhhh@outlook.com> * refactor(net): simplify fanout group construction and registry publish Reduce FanoutGroup::new from 6 positional args to (id, params) by reusing the existing FanoutJoinParams bundle (a Copy struct), eliminating the duplicated argument lists at both join call sites. Extract publish_fanout_groups() helper for the registry Vec rebuild + RCU snapshot publish pattern that was triplicated across join, leave, and cleanup. Net -20 lines; behavior unchanged. Signed-off-by: sparkzky <sparkhhhhhhhhhh@outlook.com> * fix(net): harden AF_PACKET fanout semantics Rework fanout registration and delivery around one immutable per-netns RCU topology so plain sockets and fanout groups cannot observe split registry state. Make join, leave, close, and orphan cleanup construct replacement snapshots before publication and preserve allocator and membership invariants on allocation failure. Align the data path with Linux semantics for HASH, LB, CPU, RND, and ROLLOVER modes, including per-primary rollover state, fragment-safe flow hashing, nested VLAN protocol discovery, PACKET_FANOUT_FLAG_UNIQUEID, IGNORE_OUTGOING, and the 8-byte fanout_args max_num_members ABI. Keep protocol and flow parsing lazy and frame-local, preserve the existing cBPF/VLAN ingress path, and avoid allocations or locks in packet delivery. Add control-plane and end-to-end coverage for option validation, group capacity, lifecycle rules, and exactly-once balanced delivery. The new LB regression sends 16 frames and requires a total of 16 deliveries split 8/8 across two sockets. Validation: make kernel; af_packet_sockopt_test (38/38); af_packet_e2e_test (14/14). Signed-off-by: longjin <longjin@dragonos.org> * fix(net): guarantee AF_PACKET cleanup progress Wake the network-namespace poller when a fallible AF_PACKET topology unregister leaves stale entries behind. Keep cleanup and network wake reasons separate so cleanup-only work does not spuriously schedule interface NAPI. Retry failed immutable-topology rebuilds with a bounded exponential delay and an absolute deadline. Treat inactive plain and fanout members as stale immediately so closed sockets cannot receive frames while deferred cleanup is pending. Add a regression test covering the rebased PACKET_MR_PROMISC and PACKET_FANOUT close path, including restoration of the interface promiscuity reference count. Tested with make kernel and DragonOS QEMU dunitest suites: af_packet_sockopt_test (38/38), af_packet_e2e_test (14/14), and af_packet_mcast_test (14/14). Signed-off-by: longjin <longjin@dragonos.org> * docs(net): remove AF_PACKET fanout plan Keep the pull request focused on the implementation and regression coverage by removing the internal development plan from the published change set. Signed-off-by: longjin <longjin@dragonos.org> --------- Signed-off-by: sparkzky <sparkhhhhhhhhhh@outlook.com> Signed-off-by: longjin <longjin@dragonos.org> Co-authored-by: longjin <longjin@dragonos.org>	2026-07-18 16:01:25 +08:00
火花andlongjin	37a5f06369	feat(net): implement PACKET_ADD_MEMBERSHIP / PACKET_DROP_MEMBERSHIP (#2132) ... * feat(net): implement PACKET_ADD_MEMBERSHIP / PACKET_DROP_MEMBERSHIP Implement multicast membership management for AF_PACKET sockets, supporting all four mr_type values: PACKET_MR_PROMISC, PACKET_MR_ALLMULTI, PACKET_MR_MULTICAST, PACKET_MR_UNICAST. Changes: - New module kernel/src/net/socket/packet/mreq.rs: per-socket membership list with add/drop/revert-on-close - IfaceCommon: promiscuity/allmulti AtomicI32 refcounts with atomic fetch_or/fetch_and flag transitions (IFF_PROMISC/IFF_ALLMULTI) - PacketSocket: mreq_list field - sockopt.rs: replace no-op stub with real handlers - close_binding: revert all memberships before unregistering socket - Tests: EINVAL for invalid mr_type, ENODEV for unknown ifindex Refs #2033 Signed-off-by: sparkzky <sparkhhhhhhhhhh@outlook.com> * fix(net): align packet memberships with Linux Signed-off-by: longjin <longjin@dragonos.org> --------- Signed-off-by: sparkzky <sparkhhhhhhhhhh@outlook.com> Signed-off-by: longjin <longjin@dragonos.org> Co-authored-by: longjin <longjin@dragonos.org>	2026-07-18 01:32:14 +08:00
火花andlongjin	23247dacef	feat(net): implement BPF filter (SO_ATTACH_FILTER) for AF_PACKET (#2031) (#2110) ... * feat(net): implement BPF filter support for AF_PACKET (#2031) Extract cBPF interpreter from seccomp.rs to bpf/classic.rs as shared infrastructure. Generalize to accept &[u8] input for packet filtering. Support: BPF_W/BPF_H/BPF_B load widths, BPF_ABS/BPF_IND addressing, BPF_MSH (IP header length extraction), full ALU/JMP/RET/MISC ops. Security: validate_cbpf checks program bounds (<=4096 insns), last insn is RET, checked_add on jump targets, static div/mod k!=0 reject, ST/STX k<16, LD/LDX mode whitelist. Runtime: OOB reads return a=0, div/mod by zero returns a=0, fall-through returns 0 (drop). AF_PACKET: SO_ATTACH_FILTER/SO_DETACH_FILTER/SO_LOCK_FILTER via PSOL::SOCKET dispatch. Filter stored in RcuArcSlot (lock-free read), AtomicBool fast-path skip when no filter attached. Filter runs on frame[start..] (RAW: full frame, DGRAM: L3 payload). Seccomp: refactored to use bpf::classic, seccomp-specific validation layered on top of validate_cbpf. Big-endian serialization preserves existing behavior. Refs: #2031, #691 Signed-off-by: sparkzky <sparkhhhhhhhhhh@outlook.com> * test: update af_packet_sockopt dunitest for SO_ATTACH_FILTER The test AttachFilterIsNotSilentlyAccepted expected ENOPROTOOPT (option unimplemented). Now that SO_ATTACH_FILTER is implemented (PR #2110), update to expect success. Add DetachFilterReturnsEnoentWhenNoFilter test. Signed-off-by: sparkzky <sparkhhhhhhhhhh@outlook.com> * fix: correct TestSockFprog casing in dunitest (FProg→Fprog) Signed-off-by: sparkzky <sparkhhhhhhhhhh@outlook.com> * fix: pass dummy value to SO_DETACH_FILTER in dunitest sys_setsockopt with optlen=0 may short-circuit before calling set_option. Pass a dummy int to ensure the kernel handler runs. Signed-off-by: sparkzky <sparkhhhhhhhhhh@outlook.com> * fix(net): align AF_PACKET classic BPF with Linux Harden the shared classic BPF validator and interpreter with exact opcode validation, definite scratch-memory initialization, fail-closed packet loads, and fallible user-controlled allocations. Keep seccomp on its Linux-compatible instruction subset without serializing seccomp_data for every filter. Use a zero-copy packet view for AF_PACKET filtering, propagate real ingress metadata, implement the Linux ancillary and payload-offset semantics, and apply filter snaplen consistently to queue accounting and recv behavior. Linearize filter attach, detach, and lock operations around one control lock and an optional RCU publication point. Preserve Linux optlen, errno, lock ordering, and ENOMEM behavior. Extend AF_PACKET, seccomp, and RCU dunitests to cover validator boundaries, runtime failures, snaplen, ancillary offsets, socket option ABI behavior, and optional RCU slot lifetimes. Signed-off-by: longjin <longjin@dragonos.org> * fix(net): preserve outgoing inline VLAN filters Keep inline 802.1Q and 802.1ad headers visible to AF_PACKET SOCK_RAW filters for PACKET_OUTGOING frames, matching Linux dev_queue_xmit_nit semantics. Continue normalizing received VLAN headers into metadata, while deriving protocol, network-relative loads, RAW/DGRAM offsets, ancillary values, and queued bytes from the same packet view. Add a deterministic veth regression that filters outgoing traffic by packet type and the inline VLAN EtherType. Signed-off-by: longjin <longjin@dragonos.org> * fix(net): align classic filter socket option ABI Signed-off-by: longjin <longjin@dragonos.org> * fix(net): retain zero-length packet datagrams Signed-off-by: longjin <longjin@dragonos.org> * fix(net): harden socket filter option handling Signed-off-by: longjin <longjin@dragonos.org> * fix(rcu): harden arc slot lifetime handling Avoid entering an RCU read-side section for empty optional slots while reloading and pinning non-empty snapshots under RCU protection. Make raw slot swaps unsafe so callers must preserve removed references through a grace period, and update packet filters and signal handlers to document that obligation. Add bounded cross-task RCU lifecycle and overlap coverage plus AF_PACKET replacement state regression tests. Signed-off-by: longjin <longjin@dragonos.org> --------- Signed-off-by: sparkzky <sparkhhhhhhhhhh@outlook.com> Signed-off-by: longjin <longjin@dragonos.org> Co-authored-by: longjin <longjin@dragonos.org>	2026-07-17 22:25:24 +08:00
DonjuanPlatinum	6b693daac6	add /usr/sbin and /sbin for profile (#2139) ... Signed-off-by: Donjuanplatinum <donplat@barrensea.org>	2026-07-17 17:28:20 +08:00
LoGin	7383e9a850	fix(vfs): complete pivot_root topology semantics (#2134) ... * fix(vfs): complete pivot_root topology semantics Reject unattached namespace roots while preserving Linux 6.6 errno precedence for identity loops, shared parents, disconnected dentries, and locked mounts. Keep the topology transaction allocation-free after its first edge mutation, add test-only reservation failure injection, and verify lock transfer plus exact mount topology through expanded guest tests. Wake both endpoints when Unix stream or seqpacket shutdown publishes shared ring state, including level-triggered RDHUP/HUP events. This fixes the synchronization primitive used by the original gVisor locked-root tests. Add bounded shutdown wakeup regressions and run them by default through the dunitest whitelist. Fixes: #2105 Signed-off-by: longjin <longjin@dragonos.org> * fix(kernel): address pivot_root review findings Preserve the hidden rootfs attachment semantics for normal boot roots and mount namespace copies while continuing to reject the initial rootfs and initramfs. Restore namespace-root pivot transactions without weakening topology validation or atomic publication. Make Unix stream and seqpacket receive paths consistently treat local SHUT_RD as EOF after draining queued data, and make event queries safe when racing with close. Add focused regression coverage for namespace-root pivots, attachment copying, shutdown EOF, poll, recvmsg, and waiter wakeups. Signed-off-by: longjin <longjin@dragonos.org> --------- Signed-off-by: longjin <longjin@dragonos.org>	2026-07-16 21:43:58 +08:00
LoGin	891fa324f3	fix(vfs): use caller fs root for pivot_root (#2130) ... * fix(vfs): use caller fs root for pivot_root Resolve and pin the caller fs root, new_root, and put_old as mount-aware paths so pivot_root follows Linux object identity and reachability semantics after chroot. Serialize task publication with exact root/pwd migration, keep mount and dentry topology under one guard, and pre-reserve all edge and task-tracking capacity before the infallible commit. Preserve stacked mount ordering and Linux errno precedence without visible-path approximations. Add focused dunitests for chrooted pivots, namespace-root failures, cross-process fs reference updates, stacked mounts, symlink and bind aliases, and unrelated upper mounts. Tests: make kernel Tests: test_pivot_root_test (20/20) Tests: mount_object_topology_test (9/9) Tests: mount_move_test (11/11) Tests: mount_propagation_test (24/24) Signed-off-by: longjin <longjin@dragonos.org> * fix(vfs): address pivot_root review races Restore the namespace-root pivot path while preserving DragonOS mount namespace invariants and publish the replacement root only after the topology commit is complete. Serialize fs_struct copying and publication against pivot_root migration with a reader-writer barrier covering fork, unshare, setns, and exec namespace switches. Extend pivot_root coverage to verify the standard namespace-root operation and the old-root attachment. Signed-off-by: longjin <longjin@dragonos.org> * test(vfs): cover shared namespace root pivot Distinguish the caller's shared root mount from the private parent of the new root, matching Linux pivot_root propagation checks. Keep markers on both the replacement root and the relocated old root so the test also verifies the committed topology. Signed-off-by: longjin <longjin@dragonos.org> * fix(process): release fs slot before cleanup Clear the exiting task's filesystem slot under its update lock, then release the lock before dropping the final FsStruct owner. This matches Linux exit_fs lifetime ordering and keeps path-pin and mount lifecycle cleanup outside the pivot_root slot critical section. Signed-off-by: longjin <longjin@dragonos.org> * fix(vfs): avoid pivot_root lock inversion Acquire every dentry mount gate touched by pivot_root before taking the dentry topology snapshot. Sort and deduplicate the fixed gate set, and require an unforgeable commit token for prelocked mount-edge operations so the canonical order is enforced by the API. Revalidate namespace membership, exact mount roots, connectivity, propagation constraints, and path reachability only after lifecycle, namespace, gate, and dentry locks are held. Keep all fallible reservations before the first edge mutation and preserve the topology guard across fs reference repair. This removes the ABBA cycle with unlink, rmdir, and rename, which acquire mount gates before the dentry topology writer. Signed-off-by: longjin <longjin@dragonos.org> * style(vfs): satisfy repository format checks Apply the repository rustfmt layout and remove a needless borrow reported by the deny-by-default clippy configuration. Signed-off-by: longjin <longjin@dragonos.org> * perf(process): narrow fork fs publication barrier Complete signal, address-space, architecture, and metadata copies before entering the fs reference publication barrier. Keep copy_fs and copy_namespaces adjacent, and retain the read guard through namespace-dependent PID setup and final PCB publication. Release the guard immediately after add_pcb so pivot_root still observes every copied fs_struct without making unrelated cgroup accounting and fork counters part of the global critical section. Signed-off-by: longjin <longjin@dragonos.org> --------- Signed-off-by: longjin <longjin@dragonos.org>	2026-07-16 18:05:00 +08:00
LoGin	c6808a8cd6	fix(mm): balance page cache membership accounting (#2131) ... * fix(mm): balance page cache membership accounting Track immutable file and shmem membership on each page-cache entry so removal and final cache teardown can update VM counters exactly once without upgrading an owner that is already being destroyed. Keep dirty, writeback, and unevictable accounting tied to the currently mapped entry. Revalidate entry identity across truncate and writeback completion, and require the legacy reclaimer to claim the expected physical page before submitting stale snapshots. Preserve the existing PageEntry layout, use vacant-only insertion, and align tmpfs construction with immutable shmem classification. Add a debugfs accounting selftest and dunitest coverage for membership, inflight teardown, late completion, aggregate VM wiring, and layout stability. Validated with make fmt, make kernel, the page-cache accounting dunitest, FUSE core and extended suites, repeated non-DAX VirtioFS mount/read/unmount beyond guest RAM, and CubeSandbox master/candidate performance checks. Signed-off-by: longjin <longjin@dragonos.org>	2026-07-16 17:15:57 +08:00
LoGin	56acd9bfd5	perf(virtiofs): isolate virtio PCI interrupt vectors (#2129) ... * perf(virtiofs): isolate virtio PCI interrupt vectors Allocate monotonic x86 PCI MSI/MSI-X vectors for interrupt-driven VirtIO transports instead of routing every device through vector 56. Rebind allocated descriptors to the local APIC edge flow, skip reserved vectors, and keep allocation fail-safe until a complete free_irq lifecycle exists. Defer vector allocation until IRQ setup so polling-only transports remain usable on architectures without PCI MSI support. Centralize PCI and MMIO IRQ registration in the transport layer, remove duplicate sysfs registration, and avoid descriptor lock recursion in the shared-action mismatch path. Keep PCI ISR acknowledgement owned by the hard IRQ path while retaining bridge-side acknowledgement for polling fallback. Add a deterministic parallel-read workload with immutable per-worker files, bounded low-impact start coordination, aligned wall/CPU measurement boundaries, exact EOF and checksum validation, and transcript regression coverage. Validated with make fmt, make kernel, host transcript tests, and a fresh-boot non-DAX VirtioFS mount/read smoke test across VirtIO filesystem, block, network, and console devices. Signed-off-by: longjin <longjin@dragonos.org> * fix(virtio): defer MMIO IRQ registration Return an explicit deferred IRQ token for MMIO transports so the global IRQ action is installed only after the concrete virtio device has completed construction. Keep the existing PCI setup path unchanged. Preserve per-device failure semantics: block, net, and console devices abort registration without panicking; pmem falls back to polling. Clean up the block worker, queues, transport, and allocated device ID when deferred IRQ installation fails. Retain virtio-net dispatch registration at the end of probe so interrupts are routed only after the network interface is ready. Signed-off-by: longjin <longjin@dragonos.org> --------- Signed-off-by: longjin <longjin@dragonos.org>	2026-07-16 14:10:49 +08:00
LoGin	4816406676	fix(namespace): lock cross-user mount copies (#2128) ... Downgrade shared mounts to slaves when a mount namespace is copied into a different user namespace, and preserve Linux-style topology and per-mount attribute locks across copies and propagation. Require CAP_SYS_ADMIN in the superblock owner user namespace before ordinary remounts can reconfigure shared filesystem state. Keep bind remounts scoped to per-mount flags. Prepare peer and slave registry capacity before publishing copied mounts so allocation failures cannot expose partial propagation state. Add focused failure-injection and dunitest coverage for ordering, propagation direction, locked attributes, remount permissions, and nested copies. Closes #2103 Signed-off-by: longjin <longjin@dragonos.org>	2026-07-16 12:04:43 +08:00
LoGin	7d2915fe85	feat(namespace): enforce mount namespace limits (#2127) ... * feat(namespace): enforce mount namespace limits Add Linux-compatible per-mount-namespace accounting with committed and pending reservations. Reserve complete local, recursive, propagated, moved-copy, and namespace-copy mount trees before publication, commit only after topology updates succeed, and release capacity exactly once during unmount or namespace teardown. Expose /proc/sys/fs/mount-max with the Linux 6.6 default and numeric sysctl offset, range, token, and short-write semantics. Keep propagation admission incremental so an ENOSPC failure stops constructing further peer or slave copies, and make detached-copy failure cleanup allocation-safe and deadlock-free. Add guest dunitests for sysctl compatibility, exact boundaries, recursive bind rollback, propagation and shared move atomicity, namespace copy admission, concurrent creators, and capacity reuse. Fixes #2102 Signed-off-by: longjin <longjin@dragonos.org> * ci: enable disk save mode for x86 tests Set DISK_SAVE_MODE at the workflow level so every integration-test step inherits the disk-saving configuration from job startup. Remove the redundant syscall-test step override while preserving the existing Makefile behavior. Signed-off-by: longjin <longjin@dragonos.org> * fix(namespace): allow copying over-limit mount namespaces Match Linux 6.6 by treating mount namespace copies as existing topology rather than newly admitted mounts. Initialize the copied namespace accounting directly, while keeping mount-max enforcement for subsequent mount creation. Update the dunitest regression to require CLONE_NEWNS to succeed after mount-max is lowered and verify that new mounts still fail with ENOSPC. Signed-off-by: longjin <longjin@dragonos.org> * fix(procfs): protect global mount-max writes Revalidate the caller's global effective UID for every mount-max write, matching Linux's 0644 sysctl permission check and preventing child user namespace capabilities from modifying the global limit. Cover inherited descriptors, reopen behavior, and the Linux-compatible global-root case with dunitest regression tests. Signed-off-by: longjin <longjin@dragonos.org> --------- Signed-off-by: longjin <longjin@dragonos.org>	2026-07-16 02:00:41 +08:00
LoGin	f5883d55c7	perf(virtiofs): eliminate readdir per-entry lookups (#2125) ... * perf(virtiofs): eliminate readdir per-entry lookups Preserve filesystem-provided inode, type, and opaque cookie data through FUSE, VFS, mount wrappers, and overlayfs so directory scans no longer fall back to lookup plus getattr for every entry. Serialize per-open directory snapshots with seek state, implement READDIRPLUS_AUTO behavior, bound the positive lookup cache with lazy LRU eviction, and retain overlay inode identity and whiteout semantics. Extend the virtiofs benchmark with deterministic readdir datasets and request-count assertions, and add dunitest coverage for typed records, cookie resume, shared-fd concurrency, AUTO request sequencing, and overlay lower-layer scans. Signed-off-by: longjin <longjin@dragonos.org> * fix(fuse): harden readdir compatibility Preserve opaque FUSE directory cookies and raw name bytes through the VFS getdents path. Keep per-open snapshots stable across zero-cookie records and undersized userspace buffers, detect daemon offset cycles without rejecting valid records, and retry READDIR after READDIRPLUS returns ENOSYS. Guarantee RELEASEDIR after every opened-directory request or parser failure, balance non-UTF-8 READDIRPLUS lookup references with FORGET, and forward byte-oriented lookup through mount wrappers and overlay whiteout checks. Restore bounded positive-cache expiry cleanup without scanning or perturbing live LRU entries. Correct the local test daemon's root-child enumeration and populate READDIRPLUS validity fields so the tests exercise real Linux-compatible cache behavior. Validated with make fmt, make kernel, FuseCore 5/5, and FuseExtended 70/70 in a DragonOS QEMU guest. Signed-off-by: longjin <longjin@dragonos.org> * fix(vfs): resume rebuilt directory snapshots Honor a nonzero saved directory cookie when getdents rebuilds a snapshot after rewind. Use one cookie-to-index path for both lseek against an existing snapshot and deferred positioning after a new snapshot is populated. Keep zero-cookie streams distinct from an explicit rewind, and preserve the selected entry across an undersized getdents buffer. Extend the FUSE typed-directory regression with rewind, saved-cookie seek, EINVAL retry, and resume assertions. Validated with make fmt, make kernel, FuseCore 5/5, and FuseExtended 70/70 in a DragonOS QEMU guest. Signed-off-by: longjin <longjin@dragonos.org> * fix(vfs): preserve directory cursor semantics Treat SEEK_CUR with a zero delta as a serialized position query so zero and repeated opaque cookies cannot rewind a live directory snapshot. Reject cookies outside the signed getdents64 and lseek range before emitting a record or advancing file state. Make native typed directory records an explicit optional capability. FUSE and overlay keep their typed fast path, while legacy filesystems cache names and resolve metadata only as the caller buffer advances; overlay materializes legacy metadata only when a full layer merge requires it. Balance READDIRPLUS lookup references when a complete name is followed by truncated alignment padding without changing Linux short-record behavior. Extend coverage for zero and duplicate cookies, SEEK_CUR queries, signed-cookie bounds, and truncated lookup accounting. Validated with make fmt, make kernel, FuseCore 5/5, FuseExtended 70/70, and DevtmpfsSemantics 7/7 in a DragonOS QEMU guest. Signed-off-by: longjin <longjin@dragonos.org> * fix(virtiofs): report readdir pre-scan failures Ensure readdir_scan always terminates its transcript with a machine-readable result when pre-scan quiescence times out or the statistics baseline is unavailable. Preserve the first failure while closing the dataset directory and report ETIMEDOUT or EIO explicitly. Extend the host transcript regression suite to exercise both failure paths and verify their single-result contract. Signed-off-by: longjin <longjin@dragonos.org> * fix(fuse): synchronize shared readdir test workers Replace volatile start, stop, and readiness flags in the shared-directory readdir regression with C++ atomics. Use release stores and acquire loads so worker startup and shutdown have defined happens-before relationships on optimized and weakly ordered targets. Keep worker result fields non-atomic because they are consumed only after pthread_join, which provides the required completion synchronization. Signed-off-by: longjin <longjin@dragonos.org> --------- Signed-off-by: longjin <longjin@dragonos.org>	2026-07-16 02:00:15 +08:00
LoGin	fcfc8eb8ce	fix(vfs): snapshot recursive bind topology (#2123) ... Hold the mount lifecycle and dentry topology snapshot across source validation, detached root preparation, and recursive child cloning. This aligns the operation with Linux copy_tree semantics and prevents root and descendants from observing different mount states. Keep filesystem metadata checks outside the topology critical section so FUSE requests cannot block global mount and rename progress. Add regression coverage for unbindable subtree filtering and colliding parent-side inode numbers across independent FUSE instances. Fixes: #2101 Signed-off-by: longjin <longjin@dragonos.org>	2026-07-15 22:17:50 +08:00
LoGin	72ebe13f64	perf(virtiofs): batch non-DAX writeback (#2122) ... * perf(virtiofs): batch non-DAX writeback Buffer writes in the generic page cache only after FUSE_WRITEBACK_CACHE is negotiated, then claim and submit bounded contiguous batches according to the negotiated write and page limits. Preserve Linux-compatible fsync, close, truncate, mmap, invalidation, stable EOF, redirty, short-write, and errseq behavior. Separate terminal writeback completion from generic page-cache workers so host invalidation cannot strand published Writeback pages behind its own waiters. Harden kernel-thread creation and wakeup ordering required by the new worker pools. Add exact FUSE/page-cache counters, benchmark phase reporting, focused FUSE regressions, and root-only kthread and completion-domain selftests. Validated with make kernel -j2, kernel formatting and diff checks, the completion-domain selftest, targeted close/flush coverage, and FuseExtended 69/69 in a DragonOS guest. Signed-off-by: longjin <longjin@dragonos.org> * refactor(fuse): group negotiated io limits Pass negotiated read, write, page, capability, and effective payload limits through a dedicated stats value object. This keeps the INIT statistics update cohesive and satisfies the project-wide Clippy argument-count lint enforced by make fmt without changing the negotiated values or publication ordering. Signed-off-by: longjin <longjin@dragonos.org> --------- Signed-off-by: longjin <longjin@dragonos.org>	2026-07-15 19:59:02 +08:00
LoGin	6c6d313a87	fix(namespace): implement propagated unmount transactions (#2121) ... * fix(namespace): implement propagated unmount transactions Resolve propagated unmount targets by exact parent and mountpoint identity, process the complete local source subtree, and compute Linux-compatible mark, remove, restore, and lazy-retain decisions before mutation. Commit mount-edge and propagation-graph changes under the topology lock with prepared capacity and exactly-once lifecycle cleanup. Preserve root stack ordering, locked root restoration, and detached-connected locked descendants. Add object-level topology coverage and DragonOS dunitest regressions for private children, complete subtrees, blockers, root covers, selected toppers, locked descendants, and propagation chains. Fixes: #2100 Signed-off-by: longjin <longjin@dragonos.org> * fix(namespace): unmount visible propagated shadow Map Linux's mount-hash head lookup to DragonOS's visible stack topper. DragonOS stores direct mounts oldest-to-newest, so selecting the first vector entry could detach a hidden lower mount instead of the propagated mount that is currently visible. Use lookup_top consistently during target preparation and final validation, remove the misleading lookup_first helper, and add a regression test for a direct [lower, top] shadow stack. Signed-off-by: longjin <longjin@dragonos.org> * test(namespace): cover tucked shadow restoration Document the Linux 6.6 distinction between a normal nested overmount and the flat-source race that tucks an older propagated copy below the new copy root. Verify that propagated lazy unmount removes the new copy while restoring the tucked lower copy with exact edge, backlink, and lifecycle invariants. Also express the propagation closure scans with iterators so the repository-wide make fmt clippy gate passes without changing behavior. Signed-off-by: longjin <longjin@dragonos.org> --------- Signed-off-by: longjin <longjin@dragonos.org>	2026-07-15 13:49:26 +08:00
LoGin	d5440446f3	perf(virtiofs): reuse create handles for atomic open (#2120) ... FUSE_CREATE already returns an opened file handle, but the VFS create path discarded it with FUSE_RELEASE and constructed the file through a second FUSE_OPEN. This added two protocol requests for every created file and amplified metadata-heavy container workloads. Add an optional VFS create-and-open operation backed by an RAII preopened-file guard. Carry the returned FUSE handle through MountFS wrapping and File construction, skip the redundant open request, and close the handle on every intermediate failure path. Cache FUSE_CREATE ENOSYS at the connection level and preserve the Linux-compatible MKNOD plus OPEN fallback. Forward Linux-compatible create flags while keeping close, cache-state, writeback, and file-mode initialization consistent with normal FUSE opens. Extend FuseExtended coverage for handle reuse, CREATE flag filtering, ENOSYS fallback caching, and RELEASE/FORGET cleanup of invalid replies. Signed-off-by: longjin <longjin@dragonos.org>	2026-07-15 00:40:21 +08:00