Conversation
THE CHANNEL IS THE IDENTITY. sys$assign("TT:"/"TT0:"/"OPA0:"/"_OPA0:") now
calls vms_kif_assign("OPA0:") to obtain a channel FROM the executive's
device table (src/kernel/vms_devtab.c, vms-d0b) before opening anything
locally -- executive refusal refuses the whole $ASSIGN, no per-process
fallback identity (Rule 11). sys$qio revalidates that channel against the
executive (VMS_IOCTL_GETDVI by channel, a READ -- never a device-table
write as a side effect) on every call before doing real I/O. sys$dassgn
gives the executive channel back first and leaves the whole channel
assigned if the executive refuses.
MEASURED, NOT ASSUMED: the local I/O path was /dev/tty, which resolves to
the CALLING PROCESS's controlling terminal -- and nothing in OVMX ever
establishes one (grepped src/ovmx_init/ for setsid/TIOCSCTTY/"/dev/console":
nothing). This was completely latent because nothing called sys$assign or
sys$qio before this item (grepped the whole tree). Measured directly against
a real /dev/vms: sys$assign("TT:") returned SS$_NOSUCHDEV/ENXIO -- the
executive channel was granted and cleaned back up, only the local open()
failed. Switched the terminal path to /dev/console (OVMX's one physical
console, matching what OPA0: already is), not to a new session/ctty facility
-- that stays out of scope, as vms-d0b's own text requires.
tests/qemu/test_syssvc_qio_terminal.c: A-writes/B-reads through the PUBLIC
sys$ API against a real /dev/vms in QEMU -- a fresh process reads OPA0:'s
reference count up after sys$assign and back down after sys$dassgn, real
bytes go out sys$qiow WRITEVBLK, and a deassigned channel is refused
SS$_IVCHAN. 10/10 assertions pass positive; the negative-control rig (no
executive) proves no fabricated success, matching every other
test_syssvc_* suite's contract.
tests/qemu/facility_defects.sh: new defect assign-terminal-bypasses-executive
(skip the vms_kif_assign block entirely, the exact pre-fix facade) reddens
exactly the one A-writes/B-reads assertion this item exists to prove and
nothing else -- verified through the real podman+QEMU harness, not just the
manifest selftest.
KNOWN, DOCUMENTED, NOT FIXED HERE: the vms_kif CALLER CENSUS
(tests/integration/test_kif_caller_census.sh) now reports vms_kif_assign,
vms_kif_dassgn and vms_kif_getdvi_chan as "declared unwired but has a
product caller" -- their OVMX-UNWIRED lines in src/libvmssys/vms_kif.h were
deliberately left untouched per this wave's orchestration (avoid concurrent
edits to that file across parallel branches); the orchestrator deletes them
at merge time. This is the ONLY reason kif_caller_census and its own
negctl selftest (kif_caller_census_negctl) are red on this branch --
46/48 host ctest, both failures isolated to that gate.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Contributor
Author
|
Superseded by work/vms-1c57-r2, which deletes the three stale OVMX-UNWIRED declarations the census flagged and adds the three missing universals to all seven symbol-vector scripts. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this fixes
OVMX had two models of the same device: a real executive device table in
vms.kothatSHOW DEVICEand
SHOW TERMINALread correctly, and an I/O path that ignored it entirely. A channel obtained through$ASSIGNwas not the channel the executive issued, so nothing the table recorded could constrain orinform actual I/O. That divergence is what Rule 11 exists to prevent.
This was found and reported rather than stubbed by
vms-d0b, which is why it was well-specifiedenough to fix.
The principle it follows
The channel is the identity.
VMS_IOCTL_SETTERMdeliberately takes a channel and no name parameter —the executive resolves a channel it issued, takes the device off it, and copies its own name. As its
author put it: a name argument would have been the environment variable with an ioctl in front of it.
The same reasoning governs here:
$ASSIGNobtains a channel from the executive, and$QIOoperateson that channel. Explicitly not done: making
$QIOwrite the table as a side effect, which would makethe two models agree while leaving the I/O path independent of it — the facade shape one layer up.
Closes vms-1c57. Unblocks vms-d0b.
🤖 Generated with Claude Code