Begin initial implementation of the POSIX shim by jaybosamiya-ms · Pull Request #2 · microsoft/litebox

Jay Bosamiya (Microsoft) (jaybosamiya-ms) · 2025-02-05T23:43:37Z

This PR introduces the basic shape of the POSIX shim layer on top of LiteBox. Currently, only open and close have been implemented, but should give an indication of how the rest of the code will end up looking like.

This PR is stacked on top of #1

Jay Bosamiya (Microsoft) (jaybosamiya-ms) · 2025-02-05T23:43:58Z

Note: ignore the semver checks CI check, since I was not using PRs before, the CI for it is not fully working. The PR itself should stand just fine without it (and is ready to review). I will have the semver checks CI thing fixed soon.

Jay Bosamiya (Microsoft) (jaybosamiya-ms) · 2025-02-06T00:06:26Z

Note: semver checks CI has now been fixed, but it will still complain on this PR since we are introducing a new crate. This is expected (for this PR), and should not be considered to actually be a CI failure.

Weiteng Chen (CvvT)

LGTM!

Jay Bosamiya (Microsoft) (jaybosamiya-ms) · 2025-02-06T23:06:09Z

Marked Weidong Cui (@wdcui) as reviewer too, since I believe you (Weidong) wanted the first few sets of PRs on this repo to have more than one reviewer (GitHub-free prevents us from marking more than one at the same time; but accepted reviews can be maintained in parallel to a review request).

Weidong Cui (wdcui)

I left some comments.

- CLAUDE.md Writing-Tests principle #2 rewritten: tests use registered handlers via Command::Run, not new Command::* variants. - New CLAUDE.md 'Handler Model' section with concrete authoring guide, multi-agent rendezvous notes, same-pipe gotcha, os::* wrapper guidance, and the rare-new-primitive policy. - protocol.rs: doc comment on the Command enum stating the closed invariant. - agent.rs: doc comment on agent_loop stating the same invariant and pointing at handlers. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Documents the architectural work needed to flip the 12 deterministic litebox failures the new PIDF.*/SFD.* tests pin: Gap #1 (4 tests): pidfd inheritance across non-PIE fork+exec. Needs fork-snapshot extension to carry a broker pidfd handle when migrating local-Pidfd descriptors across workers. Same delayed-fork-bridge architectural piece as the P2.A unix-socket case (see ~/src/litebox-cwfd-p2-unix/PROGRESS.md). Gap #2 (10 tests): broker signalfd not reached by shim-virtualized guest signal delivery. Needs a shim signal-delivery hook that pushes siginfo to subscribed broker signalfds via the NotificationDispatcher. Both gaps are ~2-3 days of careful product work each, suitable for dedicated sessions rather than autopilot continuation. The cwfd-p2-integration branch carries the substrate (P2.0/0.5/B/C plumbing + handler-native test families) that those product fixes will use. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

…+ P2.F) Lands the unmerged CWFD Phase 2 substrate that has been in flight on wportnoy/clone3-fork-like (and transitively cwfd-p2-fork-bridge / cwfd-p2-integration / cwfd-p2-signalfd / cwfd-p2-pidfd / cwfd-p2-stubs / cwfd-p2-refactor). 24 commits. ## What lands - **P2.0 / 0.5**: BrokerSubscribable + BrokerBackedCommon refactor; multi-kind FdKind tag prep; StateObject trait gains kind-agnostic subscribe/unsubscribe. - **P2.B (pidfd)**: BrokerPidfdProvider trait + RunnerBrokerPidfdProvider impl + broker-side PidfdState + shim EventFile::PidfdBrokerBacked variant + sys_pidfd_open routing for remote targets. - **P2.C (signalfd)**: BrokerSignalfdProvider trait + RunnerBrokerSignalfdProvider impl + broker-side SignalfdState + payload-variant NotificationFrame + shim variant. - **P2.F (fork-snapshot codec)**: FdMetadataSnapshot.broker_handle wire codec extension; broker promotion across fork-snapshot for inheritable fd types. - **clone3 fork-like**: removes the ENOSYS reject for fork-like clone3 (modern glibc fork() needs this when targeting a binary whose load addresses force exec_on_remote_host). - **close-on-exec correctness**: close-all-non-stdio in exec_on_remote_host placeholder; FD_CLOEXEC clone_for_fork regression test. - **broker eventfd pre-subscribe**: fix blocking read in exec_on_remote_host eventfd bridge. - **CWFD_NEXT.md**: design doc for the two remaining gaps (Gap #1 fork-snapshot pidfd bridge, Gap #2 signalfd shim-side delivery hook). To be addressed in Phase B.1 / B.2 of plan.md. ## Status Substrate only — Gap #1 and Gap #2 from CWFD_NEXT.md are NOT yet implemented in this merge. The previously-observed PIDF.exit_inherit.{nonpie-glibc, non-pie-static-musl} and SFD.* failures persist; they are scoped for Phase B in plan.md. What this merge does provide: a complete broker pidfd/signalfd state substrate that those follow-up commits will wire into the shim's fork-snapshot path and signal-delivery path respectively. ## Conflicts resolved clone3-fork-like was forked before the pid-uniqueness + pxeof-tests merges. The pull-amalgamation-forward merge commit 5809915 on clone3-fork-like resolves the divergence: - SubsystemTag: Process renumbered to wire byte 8 (was 3, which clone3-fork-like had assigned to Pidfd). - Opcode: RegisterProcess renumbered to 0x70/0xF0 (was 0x20, which clone3-fork-like had assigned to CreatePidfd). The fd-token opcode_ranges doc gained a new PROCESS_BASE entry. - state_service: keeps all three handlers (create_pidfd, pidfd_exited, register_process). - ProcessState: extends impl StateObject with the new subscribe/unsubscribe trait methods (Phase 1 has no subscriptions; stubs return Ok). - Provider installs: union of eventfd + pidfd + signalfd + guest_pid providers. - coordinator/mod.rs: union of pid_uniqueness + pidfd_inherit module registrations. Verified: cargo build (full workspace) + cargo build -p litebox_test_harness + cargo rustc non-pie variant all clean. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

ed299eb by subagent. Implements the signalfd shim-side delivery gap (CWFD_NEXT Gap #2): - New broker PushSiginfo opcode for queueing signal info. - Signal delivery hook checks for active signalfd subscription matching the (blocked) signal; if matched, push siginfo into signalfd's broker queue, mark consumed (skip user handler). - signalfd read drains the broker queue. - Minimal fork-snapshot signalfd preservation. Verified by subagent: SFD.basic_self.* — native+litebox both pass SFD.inherit_self_raise.* — still fails on litebox (known: remote fork-child host-signal delivery bypasses guest signalfd routing; needs deeper work) 13 files changed; minimal-scope landing per the 'deprioritized: COLD code' note on the todo. Future work needed for full inheritance support. Subagent: signalfd (background, 21 min). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> # Conflicts: # litebox_shim_linux/src/lib.rs

Adds host-side identifiers to audit JSONL + broker connection log: #1 host_tid (gettid, thread_local cached) on every shim audit entry #4 SO_PEERCRED capture at broker control-socket accept; logged as CONN OPEN: conn_id=N peer_pid=P peer_uid=U peer_gid=G Enables host-PID ↔ guest-PID correlation when diagnosing cross-worker issues. Diagnostic-only; no behavior change. Validated 199/199. Subagent assessment of remaining audit improvements: #2 migration handoff: medium, ~80-150 LOC, high value — land next #3 broker_conn_id per RPC: medium-high, ~120-250 LOC — after #2 #5 parent_host_pid: small, opportunistic #6 guest_context_pid: defer (broad delayed-fork changes) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

…rrors Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

…, broker-direct handles Phase 3 of the legacy-pipes migration: every fd entering litebox becomes a broker-held handle at the boundary; siblings reference it via handle-id instead of socketpair fd-passing through a parent dispatcher thread. Major changes: - D2: AttachHostFd opcode + SubsystemTag::HostFd + broker HostFdState dispatch + runner/control-listener wiring. Host fds inherited via SCM_RIGHTS get a broker handle at attach time. - D3: broker-global OFD registry (litebox_broker::ofd_registry). RegisterOfd(parent_9p_fid)->open_file_id; CloneOfd(open_file_id, new_fid). Both sides reference the same kernel Arc<File> for POSIX shared-position inheritance over delayed-fork. - D5: all five mux-stream kinds (host, vsocket, vpipe, vpty, fs) migrated to direct broker handles in the delayed-fork commit path. Parent emits --broker-fd-bridge specs; worker installs them before fork-restore ack. - D6/D7: deleted parent mux dispatcher block, worker mux block, multiplexer.rs, MuxParentStream/MuxPtySlaveFd/install_mux_pipe_fd*, --mux-fd/--mux-stream CLI args, and the LITEBOX_NEW_MUX feature flag (default-on, then deleted). - Phase 5 deletion: litebox/src/pipes.rs (1083 LOC), RawFdRef::Pipes, GlobalState.pipes, EpollDescriptor::Pipe, all dispatch arms. Rubber-duck review surfaced 6 findings, all fixed test-first: - #1 fork-restore install gap (install before ack on both 9P/non-9P). - #2 UnixSocket install consume-list parity with Pipe/TcpConn. - #3 OFD register/clunk race (write-lock serialization). - #4 clone_ofd_into_fid metadata-error refcount leak. - #5 fs_fid post-CloneOfd cleanup (Tclunk on every failure path). - #6 dup_handle failures propagate as install failure across all kinds. Validation: broad regression gate litebox::{dropbear_bash, EPIPE, FORK, P1, FS., PB., NPIPE, BPIPE, CL3} 542/542 PASS at LITEBOX_TEST_JOBS=8 (first-run, zero flakes). Net diff: ~5,145 insertions / ~5,012 deletions across 45 files. Branch: wportnoy/legacy-pipes-phase-3 (tip 6691630) 36 individual commits across phases D2–D7 + Phase 5 deletion + review fixes. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

…egression bar Two fixes to the regression_class view, driven by the epoll-edge-fix triage where the classifier reported 6 hard_regression + 18 new_fail that were all pre-existing flakes: 1. preexisting_flake (#1): a branch fail with no definitive merge-base verdict was always `new_fail`, even when the test demonstrably flakes on the upstream lineage. Split it: if the test flaps pass/fail OR has any upstream fail in-window, it's `preexisting_flake` (benign, confidence n/a); `new_fail` is now reserved for the genuinely unexplained case (no baseline AND clean upstream). Automates the cross-branch-history evidence a session would otherwise re-derive by hand. 2. Harder hard_regression bar (#2): a single branch fail of an occasionally-flaky test, against a thin single-pass merge-base baseline, read as `hard` because the 7-day flake window missed low-rate flakes (fails ~every 10 days fell just outside it). Widen _RECENT_FLAKE_WINDOW_MS 7d -> 30d AND demote to `soft_regression` on ANY upstream fail in-window (`n_fail > 0`), not just pass/fail flapping. `hard_regression` now requires a genuinely solid-upstream test (no flaps, zero upstream fails in 30d); high confidence therefore also implies a rock-solid 30d upstream history. Validated on a backup-API copy of the live store (1.17M run_results): v6->v7 upgrade lossless, SCHEMA_VERSION still 4; the 6 remaining hard_regression all have zero upstream fails (e.g. BASH.fork_ls p80/f0), preexisting_flake rows all have heavy upstream fails (e.g. RL.parent_exits_first p30/f54), new_fail rows all have clean upstream (p_/f0). View eval 4.9s (was ~4.5s). +5 unit tests, 61 pass. Data-safe: classification_schema_version 6->7 recreates the views; SCHEMA_VERSION untouched; run_results never read-modify-written. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Brings the broker-seqpacket SCM_RIGHTS token transport (wportnoy/seqpacket-scm) into the named-AF_UNIX-stream work stream so the whole AF_UNIX broker-coverage effort lands as a single session branch. seqpacket-scm extends the existing SocketSeqPacketSend / SocketSeqPacketRecvResponse body framing to carry PassedToken arrays (no new opcodes), so the exhaustive Opcode matches added on this branch are unaffected. Merged clean (no textual conflicts); broker+common_linux unit tests 329/329. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Jay Bosamiya (Microsoft) (jaybosamiya-ms) · 2025-02-05T23:43:37Z