admin/LithosAnanake
1
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Stage K-5: xHCI Input Context allocated full size once per slot (FABRIC-3.10.8 §4.5)

Browse Source 
- New XHCI_INPUT_CTX_BYTES (control ctx + slot + 31 EP contexts).
  Address Device allocates the Input Context at that size once per slot;
  Configure Endpoint reuses it (bounds-checked). It allocated a fresh one
  on every attach and never freed the old.
- Probe (removed), identical on all three ISAs: after the standard
  sequence's attach/detach/re-attach, input-context allocations=2 (one
  per xHCI slot) against configure-endpoint=3.
- Standard sequence on amd64/aarch64/riscv64: hash, G, ledger unchanged.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
Robert Allan James
2026-09-26 06:43:59 -04:00
co-authored by Claude Opus 5.5
parent 1166713cc9
commit bfa876a0e2
15 changed files with 54926 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files
FABRIC-3.10.8.md
+23
View File
@@ -600,3 +600,26 @@ The per-round growth halved, but about **3.4 KB is still retained per churned VM
- The G string and the ledger line (the K-3 baseline) are unchanged.
- **K-4 closes MC-0d findings 2 and 3.** K-1's heap criterion carries on as K-8.
### 4.5 K-5 — the xHCI Input Context leak (2026-09-26)
**Change.**
- New `XHCI_INPUT_CTX_BYTES` (xhci.h): the Input Control Context plus a Slot Context and all 31 Endpoint Contexts.
- Address Device allocates the slot's Input Context at that full size, once per xHCI slot, mirroring the Output Device Context fix.
- Configure Endpoint reuses it, bounds-checking its span. It used to allocate a new block on every attach and never free the old one.
**Evidence** (the named criterion, counted directly). Heap bytes would mix in the WIREBIND births that attach triggers, so a temporary counter recorded Input Context allocations against Configure Endpoint calls, read before and after the standard sequence:
- at Hera's prompt, before the sequence: **1 allocation / 1 configure**, the Zuse thumbdrive attached at boot;
- after the sequence (Bob's drive attached, detached and attached again): **2 allocations / 3 configures**, one per xHCI slot used. Before K-5 every configure allocated a fresh block.
The counts are identical on all three ISAs (probe logs: amd64 `logs/20260926-054615`, aarch64 `logs/20260926-055249`, riscv64 `logs/20260926-055939`).
**Standard sequence** (clean build, with the probe reverted; the tree is byte-identical to the saved stage diff).
| ISA | log | result |
|---|---|---|
| amd64 | `logs/20260926-060605` | hash `0x99b01134c3d3049c`, G A=40 B=40, all ok `3`, 0 B idle, 0 / 0 |
| aarch64 | `logs/20260926-061840` | same |
| riscv64 | `logs/20260926-063140` | same |
The ledger line is unchanged. **K-5 closes §8 defect 10.**