admin/LithosAnanake
1
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Stage D: parked-idle VMs are killable, KILL unregisters; fix uninitialized pending_reap (FABRIC-3.8 §3.5, G6)

Browse Source 
sk_vm_parked_idle(): saved context + exactly its own IDLE frame.
capsule_vm_kill_refusal() is the single kill rule, shared by
capsule_vm_kill() and the KILL word: refuse SWITCHED_OUT mid-task, parked
with mail pending, or the VM running; allow parked-idle. capsule_vm_kill()
now unregisters the switch slot (G6).

Finding fixed: vm_registry_alloc() never initialized pending_reap (kmalloc
does not zero); C-b's reap_pending walks every participant, so garbage
reaped a healthy VM (seen live before any KILL). Now zeroed at alloc.

Probe (reverted): baseline KILL refused, slots 3->4->4 (FAIL, proves G6);
with Stage D dprobe parked idle, KILL dead, slots 3->4->3, PASS on amd64/
aarch64/riscv64. Acceptance: dict_hash unchanged, relay 3, idle growth 0.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
Robert Allan James
2026-09-23 19:14:50 -04:00
co-authored by Claude Opus 5.5
parent 06bcab504d
commit 604ad7aadc
25 changed files with 82548 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/starkernel/capsule/mama_forth_words.c
+14 -8
View File
@@ -607,17 +607,23 @@ void mama_word_kill(VM *vm)
* before capsule_vm_kill()'s own Hera guard below ever runs. */
{
VMRegistryEntry entry;
/* FABRIC-3.md §XXVIII, Stage 2 (2026-09-13): mirror the refusal
* capsule_vm_kill() itself now enforces -- checked here too so the
/* FABRIC-3.md §XXVIII, Stage 2 (2026-09-13): refuse here too, so the
* heat-fanout/active-VM cleanup below never runs against a VM
* that's about to be refused anyway. */
if (capsule_vm_find_by_name_nocase(name_buf, &entry) == 0 &&
entry.state == VM_STATE_SWITCHED_OUT) {
console_println("KILL: refused -- switched-out (context parked)");
return;
* that's about to be refused anyway. FABRIC-3.8.md §3.5 (Stage D):
* the rule itself now lives in one place, capsule_vm_kill_refusal(),
* rather than a copy of capsule_vm_kill()'s old blanket
* SWITCHED_OUT refusal -- a VM parked idle is killable. */
if (capsule_vm_find_by_name_nocase(name_buf, &entry) == 0) {
const char *why = capsule_vm_kill_refusal(&entry);
if (why) {
console_puts("KILL: ");
console_puts(name_buf);
console_println(why);
return;
}
}
if (capsule_vm_find_by_name_nocase(name_buf, &entry) == 0 &&
entry.state == VM_STATE_LIVE) {
(entry.state == VM_STATE_LIVE || entry.state == VM_STATE_SWITCHED_OUT)) {
if (!vm_uuid_is_hera(entry.vm_id)) {
vm_physics_retire(entry.vm_id);
}