fix(namespace): pass mount and pivot_root conformance (#2137)

* fix(namespace): pass mount and pivot_root conformance

Align mount namespaces, propagation, pivot_root, proc mount topology, VFS permissions, and tmpfs accounting with Linux 6.6 semantics.

Make current-task publication and x86 fast CPU identification safe across context switches and AP startup, and harden page-cache allocation and rollback paths.

Add focused dunit and gVisor coverage for mount, pivot_root, dangling symlinks, tmpfs quota, and propagation. Make both runners fail closed on incomplete XML, unexpected skips, timeouts, and stale results while always publishing CI artifacts.

Validated with kernel builds, runner unit tests and linting, slab allocator tests, QEMU boot, the full dunit suite, focused namespace tests, and gVisor mount/pivot_root tests.

Signed-off-by: longjin <longjin@dragonos.org>

* fix(vfs): address review and CI regressions

Make atime updates field-specific and synchronized in mutable filesystems, serialize FUSE and ext4 metadata updates, enforce O_NOATIME ownership, and cover directory access semantics.

Compute tmpfs statfs data from atomic page accounting without taking a superblock write lock on every page operation. Preserve slab allocator soundness without clearing an entire object page.

Restore the origin/master current-task implementation that predates the wait/epoll CI regressions, reject invalid open flag combinations, read complete symlink targets, and decouple existing mount topology traversal from mount-max admission limits.

Add dunit coverage for metadata races, atime flags, tmpfs quota reporting, long symlinks, open errors, and lowered mount limits.

Signed-off-by: longjin <longjin@dragonos.org>

* fix(vfs): skip atime updates for anonymous inodes

Use the optional filesystem lookup before checking mount state during access-time updates. Anonymous kernel objects such as sockets now report that they are not backed by a filesystem, matching Linux socket read semantics and avoiding a panic in readv and splice paths.\n\nDocument the expanded try_fs contract so callers can distinguish filesystem-backed inodes from anonymous objects without relying on a panicking fs implementation.\n\nThis fixes the gVisor TCP splice timeout and UDP writev/readv failure observed in the integration workflow.

Signed-off-by: longjin <longjin@dragonos.org>

* fix(vfs): address follow-up review findings

Preserve Linux open error precedence by applying O_NOATIME ownership checks after path, type, and DAC validation while keeping them ahead of direct-I/O and socket-open failures. Add regression coverage for final symlinks and directory O_DIRECT combinations.\n\nReuse one fallibly allocated PATH_MAX buffer across a symlink walk to avoid per-hop allocation and clearing.\n\nEnsure the gVisor runner terminates the full test process group and reaps its leader when try_wait fails, sharing the same cleanup path used for timeouts.

Signed-off-by: longjin <longjin@dragonos.org>

* fix(vfs): address latest review and integration failures

Initialize new inode ownership before publication across tmpfs, ramfs, and ext4, including mknod and rename whiteouts. Preserve setgid directory inheritance while stripping unauthorized executable setgid modes.

Harden transactional page-cache rollback against concurrent dirty publication, update regular-file atime on EOF reads, and avoid filesystem lookups for anonymous socket permission checks.

Disable required-test manifest enforcement completely when requested and add regression coverage for ownership, SGID, EOF atime, and runner behavior.

Signed-off-by: longjin <longjin@dragonos.org>

* fix(vfs): preserve bootstrap inode creation

Use the initial root credential for kernel-owned filesystem objects created before ProcessManager installs a current task. Keep setgid directory inheritance intact while avoiding an early-boot current_pcb spin during procfs initialization.

Signed-off-by: longjin <longjin@dragonos.org>

* fix(vfs): preserve fallocate metadata and defer atime writes

Apply Linux-compatible write-side metadata effects after successful tmpfs fallocate allocation, including timestamp updates and setid removal, while preserving rollback atomicity.

Cache ext4 atime updates in memory, track them through the existing dirty inode queue, and commit them with size and mtime during periodic or explicit metadata writeback instead of synchronously writing from the read path.

Add dunitest coverage for fallocate metadata effects, failure stability, setid clearing, and ext4 atime visibility and persistence.

Signed-off-by: longjin <longjin@dragonos.org>

* fix(vfs): address symlink and ext4 timestamp review

Enforce Linux symlink creation semantics in the common syscall path, including empty targets, trailing slashes, parent search/write permission ordering, immutable directories, and an atomic tmpfs permission recheck under the parent inode lock.

Keep ext4 inode timestamps authoritative in memory and evaluate relatime without io_lock or disk getattr. Add masked setattr support and generation-based atime/mtime writeback commits so concurrent reads, writes, mmap faults, setters, resize, and writeback cannot lose dirty timestamp updates.

Add dunitest coverage for symlink error and permission semantics plus ext4 relatime behavior.

Validated with make kernel and the full DragonOS dunitest suite (797 tests, 0 failures).

Signed-off-by: longjin <longjin@dragonos.org>

* ci(test): align job and guest timeout budgets

Raise the syscall workflow timeout to cover its 50-minute guest monitor after the build and disk preparation phases, while preserving time for cleanup and diagnostic uploads.

Apply the same outer-timeout invariant to dunitest so its 30-minute monitor can terminate QEMU and publish the serial artifact before the Actions job deadline.

Signed-off-by: longjin <longjin@dragonos.org>

* fix(ext4): publish created inode without reread

Return authoritative attributes from the in-memory inode used by create, mkdir, and mknod transactions, while preserving the existing inode-number APIs.

Initialize canonical VFS inodes from those attributes for regular creation, special nodes, and rename whiteouts. This removes the post-link getattr failure window that could report EIO after the directory entry was already committed.

Keep lookup-time getattr behavior unchanged and add coverage for complete in-memory FileAttr conversion. Validated with make kernel, all 130 another_ext4 tests, and the full DragonOS dunitest suite (797 tests, 0 failures).

Signed-off-by: longjin <longjin@dragonos.org>

* fix(namespace): stabilize propagation conformance checks

Replace the scheduler-dependent recursive propagation observer with explicit shared/private phase acknowledgements and a midpoint stress snapshot handshake. Preserve the two unsynchronized 512-transition halves, namespace copying, and concurrent topology mutation while reporting the exact failing child status.

Allocate a fresh conceptual hidden-parent mount ID when copying an attached namespace so mountinfo never exposes the source namespace's parent identity. Keep ordinary overlay traversal single-pass for the common shallow path and defer cycle detection to pathological depths without imposing a semantic limit.

Require the recursive-bind topology and mount-limit rollback suites to remain skip-free alongside the existing namespace conformance binaries.

Validated with make kernel, 12 dunit runner tests, the full DragonOS dunit suite, and 100-run focused stress loops on Linux and in the DragonOS guest.

Signed-off-by: longjin <longjin@dragonos.org>

* fix(namespace): address propagation review findings

Signed-off-by: longjin <longjin@dragonos.org>

* fix(mm): preserve zero-length mmap error priority

Signed-off-by: longjin <longjin@dragonos.org>

---------

Signed-off-by: longjin <longjin@dragonos.org>

Author: fslongjin

.github/workflows/dunitest.yml

@@ -17,7 +17,8 @@ jobs:
   dunitest:
     name: Dunitest
     runs-on: ubuntu-latest
-    timeout-minutes: 30
+    # Allow the 30-minute guest test budget plus build, cleanup, and diagnostics.
+    timeout-minutes: 50
     container:
       image: dragonos/dragonos-dev:v1.23
       options: --privileged -v /dev:/dev
@@ -41,3 +42,11 @@ jobs:
           DISK_SAVE_MODE: "1"
         run: |
           make test-dunit
+
+      - name: Preserve dunitest serial log
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: dunitest-serial-x86_64-${{ github.run_id }}-${{ github.run_attempt }}
+          path: serial_opt.txt
+          if-no-files-found: error

.github/workflows/test-x86.yml

@@ -18,7 +18,8 @@ jobs:
   integration-test:
     name: Integration Test
     runs-on: ubuntu-latest
-    timeout-minutes: 60
+    # Allow the 50-minute guest test budget plus build, cleanup, and diagnostics.
+    timeout-minutes: 75
     container:
       image: dragonos/dragonos-dev:v1.23
       options: --privileged -v /dev:/dev
@@ -42,6 +43,14 @@ jobs:
         run: |
           make test-syscall
 
+      - name: Preserve syscall serial log
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: gvisor-serial-x86_64-${{ github.run_id }}-${{ github.run_attempt }}
+          path: serial_opt.txt
+          if-no-files-found: error
+
       - name: Upload test results
         if: always() && github.repository == 'DragonOS-Community/DragonOS'
         shell: bash -ileo pipefail {0}

kernel/crates/another_ext4/src/ext4/alloc.rs

@@ -400,9 +400,14 @@ impl Ext4 {
         self.transaction_stage_super_block(transaction, &sb)
     }
 
-    /// Create a new inode, returning the inode and its number
+    /// Create a new inode with its final owner, returning the inode and its number.
     #[inline(never)]
-    pub(super) fn create_inode(&self, mode: InodeMode) -> Result<InodeRef> {
+    pub(super) fn create_inode_with_owner(
+        &self,
+        mode: InodeMode,
+        uid: u32,
+        gid: u32,
+    ) -> Result<InodeRef> {
         self.ensure_mutable()?;
         // Allocate an inode
         let is_dir = mode.file_type() == FileType::Directory;
@@ -413,6 +418,8 @@ impl Ext4 {
             let mut inode = Box::new(Inode::default());
             inode.set_generation(generation);
             inode.set_mode(mode);
+            inode.set_uid(uid);
+            inode.set_gid(gid);
             inode.extent_init();
             let mut inode_ref = InodeRef::new(id, inode);
             self.write_inode_with_csum(&mut inode_ref)?;
@@ -443,6 +450,8 @@ impl Ext4 {
         mode: InodeMode,
         major: u32,
         minor: u32,
+        uid: u32,
+        gid: u32,
     ) -> Result<InodeRef> {
         self.ensure_mutable()?;
         // Device nodes are never directories
@@ -453,6 +462,8 @@ impl Ext4 {
             let mut inode = Box::new(Inode::default());
             inode.set_generation(generation);
             inode.set_mode(mode);
+            inode.set_uid(uid);
+            inode.set_gid(gid);
             inode.set_device(major, minor);
             let mut inode_ref = InodeRef::new(id, inode);
             self.write_inode_with_csum(&mut inode_ref)?;

kernel/crates/another_ext4/src/ext4/low_level.rs

@@ -48,6 +48,12 @@ pub struct SetAttr {
     pub crtime: Option<u32>,
 }
 
+#[derive(Clone, Copy)]
+pub struct InodeOwner {
+    pub uid: u32,
+    pub gid: u32,
+}
+
 impl SetAttr {
     /// Create a new SetAttr struct with all fields set to None.
     pub fn new() -> Self {
@@ -270,15 +276,19 @@ impl Ext4 {
             return_error!(ErrCode::EINVAL, "Invalid inode {}", id);
         }
 
+        Ok(Self::file_attr(&inode))
+    }
+
+    fn file_attr(inode: &InodeRef) -> FileAttr {
         // Get device number for device nodes
         let rdev = if inode.inode.is_device() {
             inode.inode.device()
         } else {
             (0, 0)
         };
 
-        Ok(FileAttr {
-            ino: id,
+        FileAttr {
+            ino: inode.id,
             size: inode.inode.size(),
             blocks: inode.inode.block_count(),
             atime: inode.inode.atime(),
@@ -291,7 +301,7 @@ impl Ext4 {
             uid: inode.inode.uid(),
             gid: inode.inode.gid(),
             rdev,
-        })
+        }
     }
 
     /// Set file attributes.
@@ -486,6 +496,7 @@ impl Ext4 {
         &self,
         id: InodeId,
         size: Option<u64>,
+        atime: Option<u32>,
         mtime: Option<u32>,
     ) -> Result<()> {
         self.ensure_mutable()?;
@@ -498,6 +509,9 @@ impl Ext4 {
         if let Some(size) = size {
             inode.inode.set_size(size);
         }
+        if let Some(atime) = atime {
+            inode.inode.set_atime(atime);
+        }
         if let Some(mtime) = mtime {
             inode.inode.set_mtime(mtime);
         }
@@ -510,7 +524,7 @@ impl Ext4 {
     ///
     /// Call this after successful page-cache write to finalise the new file size.
     pub fn commit_inode_size(&self, id: InodeId, size: u64, mtime: Option<u32>) -> Result<()> {
-        self.commit_inode_metadata(id, Some(size), mtime)
+        self.commit_inode_metadata(id, Some(size), None, mtime)
     }
 
     /// Link a newly created inode into `parent`.
@@ -557,6 +571,30 @@ impl Ext4 {
     /// * `ENOTDIR` - `parent` is not a directory
     /// * `ENOSPC` - No space left on device
     pub fn create(&self, parent: InodeId, name: &str, mode: InodeMode) -> Result<InodeId> {
+        self.create_with_owner(parent, name, mode, InodeOwner { uid: 0, gid: 0 })
+    }
+
+    pub fn create_with_owner(
+        &self,
+        parent: InodeId,
+        name: &str,
+        mode: InodeMode,
+        owner: InodeOwner,
+    ) -> Result<InodeId> {
+        Ok(self
+            .create_with_owner_and_attr(parent, name, mode, owner)?
+            .ino)
+    }
+
+    /// Create and link a file, returning the attributes from the authoritative
+    /// in-memory inode used by the namespace transaction.
+    pub fn create_with_owner_and_attr(
+        &self,
+        parent: InodeId,
+        name: &str,
+        mode: InodeMode,
+        owner: InodeOwner,
+    ) -> Result<FileAttr> {
         self.ensure_mutable()?;
         let _metadata_guard = self.lock_direct_metadata_mutation()?;
         let _namespace_guard = self.namespace_lock.lock();
@@ -567,10 +605,9 @@ impl Ext4 {
             return_error!(ErrCode::ENOTDIR, "Inode {} is not a directory", parent.id);
         }
         // Create child inode and link it to parent directory
-        let mut child = self.create_inode(mode)?;
+        let mut child = self.create_inode_with_owner(mode, owner.uid, owner.gid)?;
         self.link_new_inode_or_free(&mut parent, &mut child, name)?;
-        // Create file handler
-        Ok(child.id)
+        Ok(Self::file_attr(&child))
     }
 
     /// Create a device node (character or block device).
@@ -603,6 +640,41 @@ impl Ext4 {
         major: u32,
         minor: u32,
     ) -> Result<InodeId> {
+        self.mknod_with_owner(
+            parent,
+            name,
+            mode,
+            major,
+            minor,
+            InodeOwner { uid: 0, gid: 0 },
+        )
+    }
+
+    pub fn mknod_with_owner(
+        &self,
+        parent: InodeId,
+        name: &str,
+        mode: InodeMode,
+        major: u32,
+        minor: u32,
+        owner: InodeOwner,
+    ) -> Result<InodeId> {
+        Ok(self
+            .mknod_with_owner_and_attr(parent, name, mode, major, minor, owner)?
+            .ino)
+    }
+
+    /// Create and link a device node, returning the attributes from the
+    /// authoritative in-memory inode used by the namespace transaction.
+    pub fn mknod_with_owner_and_attr(
+        &self,
+        parent: InodeId,
+        name: &str,
+        mode: InodeMode,
+        major: u32,
+        minor: u32,
+        owner: InodeOwner,
+    ) -> Result<FileAttr> {
         self.ensure_mutable()?;
         let _metadata_guard = self.lock_direct_metadata_mutation()?;
         let _namespace_guard = self.namespace_lock.lock();
@@ -619,13 +691,13 @@ impl Ext4 {
         }
 
         // Create device inode (uses create_device_inode which sets device number)
-        let mut child = self.create_device_inode(mode, major, minor)?;
+        let mut child = self.create_device_inode(mode, major, minor, owner.uid, owner.gid)?;
 
         // Link to parent directory
         self.link_new_inode_or_free(&mut parent_ref, &mut child, name)?;
 
         trace!("mknod {} ({}:{}) -> inode {}", name, major, minor, child.id);
-        Ok(child.id)
+        Ok(Self::file_attr(&child))
     }
 
     /// Read data from a file. This function will read exactly `buf.len()`
@@ -1404,6 +1476,30 @@ impl Ext4 {
     /// * `ENOTDIR` - `parent` is not a directory
     /// * `ENOSPC` - no space left on device
     pub fn mkdir(&self, parent: InodeId, name: &str, mode: InodeMode) -> Result<InodeId> {
+        self.mkdir_with_owner(parent, name, mode, InodeOwner { uid: 0, gid: 0 })
+    }
+
+    pub fn mkdir_with_owner(
+        &self,
+        parent: InodeId,
+        name: &str,
+        mode: InodeMode,
+        owner: InodeOwner,
+    ) -> Result<InodeId> {
+        Ok(self
+            .mkdir_with_owner_and_attr(parent, name, mode, owner)?
+            .ino)
+    }
+
+    /// Create and link a directory, returning the attributes from the
+    /// authoritative in-memory inode used by the namespace transaction.
+    pub fn mkdir_with_owner_and_attr(
+        &self,
+        parent: InodeId,
+        name: &str,
+        mode: InodeMode,
+        owner: InodeOwner,
+    ) -> Result<FileAttr> {
         self.ensure_mutable()?;
         let _metadata_guard = self.lock_direct_metadata_mutation()?;
         let _namespace_guard = self.namespace_lock.lock();
@@ -1415,7 +1511,7 @@ impl Ext4 {
         }
         // Create file/directory
         let mode = mode & InodeMode::PERM_MASK | InodeMode::DIRECTORY;
-        let mut child = self.create_inode(mode)?;
+        let mut child = self.create_inode_with_owner(mode, owner.uid, owner.gid)?;
         // Add "." entry
         let child_self = child.clone();
         if let Err(error) = self.dir_add_entry(&mut child, &child_self, ".") {
@@ -1427,7 +1523,7 @@ impl Ext4 {
         child.inode.set_link_count(1);
         // Link the new inode
         self.link_new_inode_or_free(&mut parent, &mut child, name)?;
-        Ok(child.id)
+        Ok(Self::file_attr(&child))
     }
 
     /// Look up a directory entry by name.
@@ -1705,6 +1801,39 @@ mod tests {
     use crate::FileType;
     use core::sync::atomic::{AtomicBool, AtomicUsize, Ordering};
 
+    #[test]
+    fn file_attr_is_derived_from_the_authoritative_in_memory_inode() {
+        let mut inode = Box::new(Inode::default());
+        inode.set_mode(InodeMode::CHARDEV | InodeMode::from_bits_retain(0o640));
+        inode.set_uid(0x12345);
+        inode.set_gid(0x23456);
+        inode.set_size(0x1_0000_0020);
+        inode.set_block_count(17);
+        inode.set_atime(11);
+        inode.set_mtime(12);
+        inode.set_ctime(13);
+        inode.set_crtime(14);
+        inode.set_link_count(2);
+        inode.set_device(259, 0x1_0002);
+        let inode = InodeRef::new(42, inode);
+
+        let attr = Ext4::file_attr(&inode);
+
+        assert_eq!(attr.ino, 42);
+        assert_eq!(attr.ftype, FileType::CharacterDev);
+        assert_eq!(attr.perm.bits(), 0o640);
+        assert_eq!(attr.uid, 0x12345);
+        assert_eq!(attr.gid, 0x23456);
+        assert_eq!(attr.size, 0x1_0000_0020);
+        assert_eq!(attr.blocks, 17);
+        assert_eq!(
+            (attr.atime, attr.mtime, attr.ctime, attr.crtime),
+            (11, 12, 13, 14)
+        );
+        assert_eq!(attr.links, 2);
+        assert_eq!(attr.rdev, (259, 0x1_0002));
+    }
+
     struct StubBlockDevice {
         sb_block: Block,
     }

kernel/crates/another_ext4/src/ext4/mod.rs

@@ -17,7 +17,7 @@ mod orphan;
 mod rw;
 mod xattr_reclaim;
 
-pub use low_level::SetAttr;
+pub use low_level::{InodeOwner, SetAttr};
 
 /// Simple fixed-size inode cache.
 /// When full, the entire cache is cleared (simple but effective for common workloads).

kernel/crates/another_ext4/src/lib.rs

@@ -14,7 +14,7 @@ mod prelude;
 
 pub use constants::{BLOCK_SIZE, EXT4_ROOT_INO, INODE_BLOCK_SIZE};
 pub use error::{ErrCode, Ext4Error};
-pub use ext4::{Ext4, SetAttr};
+pub use ext4::{Ext4, InodeOwner, SetAttr};
 pub use ext4_defs::{
     Block, BlockDevice, DirEntry, FileAttr, FileType, Inode, InodeMode, InodeReclaimError,
     InodeReclaimHandle, InodeRef,