Enum GlobalRequest 

pub enum GlobalRequest {
    WithForwardedCount(u64, Box<GlobalRequest>),
    RequestResources(Resources, DetPid),
    ParkedRequest(Resources, DetPid, ControlCapability),
    ResumeParkedRequest {
        ticket: ResumeTicket,
        current_site: CallbackSignalSite,
    },
    FinishParkedObservation {
        wait: ContinuationId,
        lease: ParkedObservationLease,
        site: CallbackSignalSite,
        finish: ObservationFinish,
    },
    ParkedProtocolFailure(ProtocolFailure),
    SignalDequeued {
        detpid: DetPid,
        identity: SignalTaskIdentity,
        dequeue: SignalDequeue,
    },
    ReleaseResources(Resources),
    ReleaseAllResources,
    ReportUnsupportedSyscall(String),
    AnnounceSignalHandlerNotInstalled(i32),
    PolicyRefusal(String),
    PrepareExec(DetPid, MmId, Box<ExecFdState>),
    CancelExec(DetPid),
    ReconnectExec {
        former: DetTid,
        process: DetPid,
    },
    ResumeExec(DetPid),
    RetireExec {
        thread: ThreadDeregistration,
        signaled: bool,
    },
    MarkPastFirstExecve(DetPid, Option<SignalTaskIdentity>, Option<ExecRecord>, Option<(u64, u64)>),
    CreateChildThread(DetTid, DetPid, usize, Option<CloneFlags>, c_int, Option<(i32, i32)>, Option<Priority>),
    CreateVforkChildThread(DetTid, DetPid, DetTid, usize, CloneFlags, c_int, Option<Priority>),
    StartNewThread(DetTid, DetPid, Option<(i32, i32)>, Option<SignalTaskIdentity>),
    DeregisterThread(ThreadDeregistration),
    SetChildTidAddress(usize),
    SetSavedGuestSigmask(Option<u64>),
    PublishedGuestSigmask(DetTid),
    SetSigtimedwaitSet(Option<u64>),
    OwnProcessSignalInputs,
    ProcessSignalReceiver(DetPid, DetTid, i32),
    ProcessSignalSent(DetPid),
    OwnProcessSignalChoice(DetTid, i32),
    RecordGuestMarkerSignal,
    FutexAction(DetTid, FutexAction, FutexID, i32, u32, bool),
    DeterminizeInode(RawInode, ObservedMtime, InodeSighting, Option<ProcfsName>),
    DeterminizeMappingInodes(Vec<RawInode>),
    DeterminizeDevice(u64),
    DeterminizeMountId(u64, Option<Vec<u64>>),
    ResolveMountinfoIds(Vec<u64>, Vec<u64>),
    RetireInode(RawInode),
    ForgetRetiredInode(RawInode, Option<ProcfsName>),
    DirectorySnapshotMark,
    ReadyChannel(ChannelId, Wants),
    HandOffTurn,
    CommitFatalDelivery(bool),
    TouchFile(RawInode),
    SetFileMtime(RawInode, LogicalTime),
    GlobalTimeLowerBound,
    TraceSchedEvent(SchedEvent, DetPid, bool, Option<Box<AccessPayload>>),
    RegisterAlarm(DetPid, DetTid, LogicalTime, LogicalTime, SigWrapper),
    RegisterPosixTimer(DetPid, DetTid, i32, Option<LogicalTime>, LogicalTime, PosixTimerNotification),
    AlarmRemaining(DetPid),
    ReconcileAlarm(DetPid),
    NoteGuestSigalrm(GuestSigalrmTarget),
    NoteSigalrmDisposition,
    ReadyChildWait(DetPid, ChildWaitSpec),
    ConsumeChildWait(DetPid, DetPid),
    ProcessGroup(DetPid),
    SetProcessGroup(DetPid, DetPid),
    CreateSession(DetPid),
    ResolveKillTargets(DetPid),
    NamesHermitTask(DetTid, Option<i32>, i32),
    NotifySignalPending(DetTid, SigWrapper, Option<DetPid>, SignalScope),
    HoldTurnForGroupExit(DetTid),
    NotifyUnresolvedSigkill(Option<DetPid>),
    ThreadIsLive(DetTid),
    PendingRealTimeExpirations(DetPid),
    DiscardPendingRealTimeExpirations(DetPid, u64),
    RegisterSignalfd(DetPid, u64),
    RecordHandlerRestoreMask(DetPid, u64),
    ExactChildWaitState(DetPid, DetPid),
    UnrecoverableShutdown,
    RequestPort(OpenFileId),
    AddUsedPort(u16, OpenFileId),
    ReleasePort(OpenFileId),
    RobustListWakes(Vec<(DetTid, FutexID)>),
    Network(NetworkRequest),
    RecordHostInput {
        path: String,
        syscall: u64,
        identity: HostFileIdentity,
        source: Option<String>,
        regular: bool,
        exec: bool,
        kernel_object: bool,
    },
    RecordHostMutation {
        path: String,
    },
    RecordHostTimedSignals(DetTid, HostTimedSignalScope, u64),
    HostTimedSignals(DetTid),
    SharedOpenFile(OpenFileControl),
    Sigalrm(SigalrmControl),
    ChildExitSigchld(ChildExitSigchldControl),
    RecordDeterminismLoss(String),
    SetChildSubreaper(DetPid, bool),
    RegisteredProcessOf(DetTid),
    SetSigchldDisposition(DetPid, bool, bool),
    SignalTargetProcess(DetPid),
    ReserveSigkill(DetTid, DetTid, u32),
    CommitSigkill(u64, bool),
    ReserveSigkillGroup(DetTid, DetPid, u32),
    PosixTimerThread(DetPid, i32),
    ForgetThreadTimerCopies(DetPid, i32),
    GuestPid(DetTid, i32),
    LocalPid(DetTid, DetTid),
    ExecTimerFlush(DetPid),
    RetireExitedLeader,
    DiscardedSignal(DiscardedSignalControl),
    DescriptorsReplaced(FilesId, u32, u32),
    ThreadIdRefused(DetTid),
    ProcfsListing(Option<DetPid>),
    ParentDeathSignal(Option<i32>),
    PrepareNativeExec(PrepareNativeExec),
    SealNativeExecStats {
        ticket: ExecTicket,
        runtime_digest: [u8; 32],
        runtime: Vec<u8>,
    },
    IssueNativeExec {
        ticket: ExecTicket,
        state_digest: [u8; 32],
    },
    CancelNativeExec {
        ticket: ExecTicket,
    },
    CompleteNativeExec {
        ticket: ExecTicket,
    },
    NamesARetiredExitedLeader(DetTid),
    ProcfsIds(bool, Vec<i32>),
    GroupOrSession(DetPid, bool),
    SetsidDecision(DetPid),
    SetpgidDecision(DetPid, i32, i32),
    ProcessImage(DetPid),
    ProcfsTask(DetTid, Option<DetTid>),
    RenderedFileState(u64, RenderedFileChange),
    PublishSignalDispositions(u64, Option<CopiedDispositions>),
    GuestLog(Option<GuestLogRecord>, u64),
    PublishSignalMask(Option<u64>),
    RecordProcessAuxv(Vec<u8>, Option<CmdlineArea>),
    ProcessAuxv(DetPid),
    AuxvFromKernel(AuxvFromKernel, Option<CmdlineArea>),
    AnnounceRefusedSignalControls(u64, bool),
    CheckBrkMappings(BrkMappingCheck, ControllerCaptureFact),
    PublishRuntimePrivateMemory(RuntimePrivateMemory),
    MarkChangedRoot,
    RootChanged(DetPid),
    DescriptionLocks(OpenFileId, Result<Vec<HeldLock>, String>, u32),
    TableReleased(OpenFileId, u32),
    GuestLockRows(Vec<LockRowFacts>),
    TableExec(Vec<(OpenFileId, u32)>),
    AliasedInode(Option<String>),
    HostTimedAndPrivateSigchld(DetTid),
    LockLedgerRefused(String),
    MappingCapture(Request),
    StoppingRefusal(String),
    ProcessCmdline(DetPid),
    KernelRunTarget(DetTid),
    CallbackCheckpointMismatch {
        checkpoint: Checkpoint,
        hard: bool,
        actual: Origin,
    },
    TaskStatFacts(DetTid, Option<DetTid>),
    SetTaskComm(DetTid, TaskComm),
    RecordExternalParent(DetPid, i32),
    SetRssLimit(DetPid, u64),
    PublishTemporaryMask(TemporaryMaskControl),
    InPidNamespaceInit(DetTid),
    VirtualInotifyCookies(Vec<u32>),
    RegisterPlaceholder(PlaceholderDirectory, OpenFileId),
    Placeholder(u64),
    PlaceholderFlock(PlaceholderFlock),
    PlaceholderWriteHint(PlaceholderLockKey, Option<u64>),
    PlaceholderCopies(PlaceholderCopies),
    CpuAffinity(DetTid),
    SetCpuAffinity(DetTid, CpuSet),
    SigkillDyingThreads(u64),
    RecordSigkillRobustLists(u64, Vec<(DetTid, MmId, RobustListSnapshot)>),
    TakeSigkillRobustList,
    NextGuestId,
    GaveHostId,
    ReplayDeparture {
        previous: LogicalTime,
        observed: LogicalTime,
        slice: u64,
    },
    DescriptionLocksTaken(OpenFileId, Vec<HeldLock>, Vec<HeldLock>, u32, LedgerIdentity),
    LockOwners(OpenFileId, Vec<HeldLock>),
    LedgerLockRows,
    SecondIdentityLocks(OpenFileId, Vec<HeldLock>, u32),
    HoldTable(HeldTable),
    RecordLocksHeldAsOfd(Option<Vec<String>>),
    HostDiskstats,
    UserNamespaceRelation(DetTid, DetTid),
    UserNamespaceOwnerMayDiffer(DetTid),
    ProcfsSequence(OpenFileId),
    StoreProcfsSequence(OpenFileId, ProcfsSequence),
}

Existing full request wire type; native controls preserve its exact tags. This is public only so it can be used in the GlobalTool trait. It should NOT be used by any client outside of this file.

Variants

WithForwardedCount(u64, Box<GlobalRequest>)

request, sent with the number of records this guest thread produced for forwarding since its previous counted request, so the coordinator can check they all arrived (detlog::check_forwarded_count). Sent only by a thread that has produced some (counted_request).

RequestResources(Resources, DetPid)

Lock the resources Also contains the DetPid of the process containing the thread requesting resources.

ParkedRequest(Resources, DetPid, ControlCapability)

Request resources with the actual backend parked-callback capability.

ResumeParkedRequest

Resume a previously parked request at its actual current callback site.

Fields

ticket: ResumeTicket

Scheduler-issued one-use continuation ticket.

current_site: CallbackSignalSite

Actual callback site supplied by the backend on resumption.

FinishParkedObservation

Finish the observation belonging to one scheduler-owned parked wait.

Fields

wait: ContinuationId

Actual pending wait identity.

lease: ParkedObservationLease

Backend observation lease belonging to that wait.

site: CallbackSignalSite

Actual callback site at the observation boundary.

finish: ObservationFinish

Result of the observation, including an explicit failure.

ParkedProtocolFailure(ProtocolFailure)

Report a terminal violation of the parked continuation protocol.

SignalDequeued

Report an actual signal removed from this process’s pending set.

Fields

detpid: DetPid

Deterministic process whose signal was dequeued.

identity: SignalTaskIdentity

Backend identity of the actual signal task.

dequeue: SignalDequeue

Exact signal dequeue observation.

ReleaseResources(Resources)

Release the locks

ReleaseAllResources

For convenience, release all the resources held by the current TID.

ReportUnsupportedSyscall(String)

Add a syscall to the run-wide unsupported-use summary.

AnnounceSignalHandlerNotInstalled(i32)

A guest asked for a disposition of this signal that Detcore answered with success but did not install. The coordinator announces it once per signal per run.

PolicyRefusal(String)

The fail-closed policy is ending the run, for this reason. Sent just before the Tool image exits with HERMIT_POLICY_REFUSAL_EXIT, which on an in-guest backend ends only the guest process: the launcher reads the reason here to report the refusal (GlobalState::policy_refusal).

PrepareExec(DetPid, MmId, Box<ExecFdState>)

Save the caller, address-space identity, and logically blocking descriptors before exec. A successful backend may reload the Tool or preserve and transfer its thread state. Boxed, as is GlobalResponse::MarkPastFirstExecve’s: inline, the largest payload sizes every RPC future, and each of the hundreds of handler futures handle_syscall_event awaits holds some, which in a debug build overflowed the 2 MiB test thread that runs ptrace record through the library (record_replay’s public_record_* tests).

CancelExec(DetPid)

Clear the saved transition after an exec attempt returns with an error.

ReconnectExec

Authenticate the preserved exec caller taking over its process leader’s TID.

Fields

former: DetTid

Preserved caller before the kernel leader-identity transition.

process: DetPid

Continuing process leader identity.

ResumeExec(DetPid)

Acquire the replacement’s first turn without newborn state initialization.

RetireExec

Consume a transferred owner if genuine cancellation interrupts local rebinding. The Tool copies signaled from the backend’s exit status; ordinary exit requires a separately recorded backend failure.

Fields

thread: ThreadDeregistration

Final transferred thread state and accounting.

signaled: bool

Whether the backend observed signal termination.

MarkPastFirstExecve(DetPid, Option<SignalTaskIdentity>, Option<ExecRecord>, Option<(u64, u64)>)

Complete a successful image transition, including the initial image, and delete the process’s POSIX timer deadlines before the new image runs. The last field is the device and inode of the file the kernel’s /proc/<pid>/exe link names for the new image, where the tool can read it, which the image’s record is checked against (crate::exec_record). Before it, in a run that declares a launcher, the record the new image resolved from the path its exec was given, for an exec Detcore did not prepare.

CreateChildThread(DetTid, DetPid, usize, Option<CloneFlags>, c_int, Option<(i32, i32)>, Option<Priority>)

The parent is adding a child-thread to the round-robin pool. Contains the dettid of the new child and it’s starting scheduler priority IF it is available to the caller. The only scenario where the Priority will be missing is when we’re replaying preemptions. In that case it is the global state that holds the information regarding the new thread’s initial priority.

CreateVforkChildThread(DetTid, DetPid, DetTid, usize, CloneFlags, c_int, Option<Priority>)

A vfork child registering itself while its parent is blocked inside the kernel. Contains the (real) parent dettid and detpid, the child dettid, the child TID address, the clone flags, and the starting priority (absent only when replaying preemptions).

StartNewThread(DetTid, DetPid, Option<(i32, i32)>, Option<SignalTaskIdentity>)

New thread is alive and waiting to run its first instruction. Contains the dettid and detpid of the new child.

DeregisterThread(ThreadDeregistration)

Remove a thread from scheduler data structures, guaranteeing that it will consume no further turns. Carries its final timeslice distribution and any chaos-epoch transitions not yet flushed by a priority-change commit.

SetChildTidAddress(usize)

Replace the address cleared and woken when the calling thread exits. A zero address disables the exit-time store and wake.

SetSavedGuestSigmask(Option<u64>)

Record (Some) or clear (None) the calling thread’s own signal mask while Detcore holds it under a private blocking mask, so the scheduler’s child-exit classification reads the guest’s mask, not Detcore’s.

PublishedGuestSigmask(DetTid)

The guest’s own signal mask that a thread published while Detcore holds it under a private blocking mask, if any (Scheduler::published_guest_sigmask), for its /proc status.

SetSigtimedwaitSet(Option<u64>)

Record (Some) or clear (None) the set the calling thread waits for while it polls rt_sigtimedwait.

OwnProcessSignalInputs

The inputs to a process-directed signal the calling thread sends to its own process (Scheduler::own_process_signal_inputs).

ProcessSignalReceiver(DetPid, DetTid, i32)

The thread of a process that takes the process-directed signal the calling thread sends naming a task of it (Scheduler::process_signal_receiver).

ProcessSignalSent(DetPid)

The calling thread’s forwarded process-directed send to this process, whose receiver the scheduler chose, succeeded (Scheduler::process_signal_sent).

OwnProcessSignalChoice(DetTid, i32)

The calling thread is about to forward a send of this signal to its own process, naming this task, that Linux gives to it (Scheduler::own_process_signal_choice).

RecordGuestMarkerSignal

The calling thread sends SIGSTKFLT (Scheduler::record_guest_marker_signal).

FutexAction(DetTid, FutexAction, FutexID, i32, u32, bool)

Notify scheduler before/after futex action. The final arguments are the initial memory word, the mask, and whether the caller may have passed descriptors outside the guest.

DeterminizeInode(RawInode, ObservedMtime, InodeSighting, Option<ProcfsName>)

Translate nondeterministic to deterministic inode, and report what the caller observed of the host mtime (see ObservedMtime), how it reached the file (see InodeSighting), and, for a procfs entry, its name (see procfs_inode::ProcfsName and InodePool::procfs_key).

DeterminizeMappingInodes(Vec<RawInode>)

Translate the inode of every file-backed line of one /proc/*/maps read, in line order, repeats included: one numbering request per line.

DeterminizeDevice(u64)

Translate a nondeterministic (host-assigned) device number to a deterministic one.

DeterminizeMountId(u64, Option<Vec<u64>>)

Translate a host-assigned fdinfo mount ID to a run-local identity. The fallback order is populated only by low-level callers without captured namespace provenance.

ResolveMountinfoIds(Vec<u64>, Vec<u64>)

Seed or validate the snapshot’s canonical mountinfo identity order (first field), then return the run-local identity of each entry of the observation order (second field: the same raw IDs, rows then parents), numbering unseen entries in that observation order.

RetireInode(RawInode)

The file behind this host inode lost its last name (see InodePool::retire).

ForgetRetiredInode(RawInode, Option<ProcfsName>)

An open found this host inode linked or freshly created (see InodePool::forget_retired); for a procfs entry, also its name (see procfs_inode::ProcfsName and InodePool::procfs_key).

DirectorySnapshotMark

The inode pool’s state, for a directory snapshot (see SnapshotMark).

ReadyChannel(ChannelId, Wants)

--pipe-wake-latency: an action of the calling thread readied the pollers of a channel that want this (Scheduler::ready_channel).

HandOffTurn

--pipe-wake-latency: the calling thread’s hand-off is due (Scheduler::hand_off_turn).

CommitFatalDelivery(bool)

The calling thread is delivering a signal whose default action ends its process (Scheduler::commit_fatal_delivery), and whether the kernel carries that action out when it resumes the thread, so the process’s other threads may be retired now.

TouchFile(RawInode)

Bump mtime

SetFileMtime(RawInode, LogicalTime)

Set mtime to a guest-requested time (utimensat and friends).

GlobalTimeLowerBound

Retrieve global time.

TraceSchedEvent(SchedEvent, DetPid, bool, Option<Box<AccessPayload>>)

Record scheduling event in a total order. The last field is what the event adds to the access trace (--record-access-trace-to); None without one.

RegisterAlarm(DetPid, DetTid, LogicalTime, LogicalTime, SigWrapper)

Basically performs an alarm syscall, takes a logical duration.

RegisterPosixTimer(DetPid, DetTid, i32, Option<LogicalTime>, LogicalTime, PosixTimerNotification)

Register, re-arm, or disarm one POSIX timer, or delete it.

AlarmRemaining(DetPid)

Return the logical time remaining on a process’s one-shot alarm.

ReconcileAlarm(DetPid)

Reconcile the process’s Inactive ITIMER_REAL after a call that may have dequeued its SIGALRM (Scheduler::reconcile_alarm).

NoteGuestSigalrm(GuestSigalrmTarget)

A guest’s committed SIGALRM send (rule 4, Scheduler::note_guest_sigalrm).

NoteSigalrmDisposition

The caller changed SIGALRM’s disposition (rule 5).

ReadyChildWait(DetPid, ChildWaitSpec)

Deterministically select a logically exited matching child.

ConsumeChildWait(DetPid, DetPid)

Retire a consumed terminal child wait status.

ProcessGroup(DetPid)

Query scheduler-owned process-group membership.

SetProcessGroup(DetPid, DetPid)

Apply a successful setpgid transition.

CreateSession(DetPid)

Apply a successful setsid transition.

ResolveKillTargets(DetPid)

Query live threads before translating process-directed signal delivery, and the process’s exit state (Scheduler::exited_process_is_zombie).

NamesHermitTask(DetTid, Option<i32>, i32)

Whether a pid or tid that a guest task named (with the thread group it named, if any) is one of Hermit’s own tasks; see hermit_task_named.

NotifySignalPending(DetTid, SigWrapper, Option<DetPid>, SignalScope)

A successful kill(2) queued a physical signal for this sole target, sent with the given scope.

HoldTurnForGroupExit(DetTid)

The sender, holding the serial grant in its signal-delivery turn, decided that a default action ends its thread group: its next request, the group Exit, is granted before any other thread runs (Scheduler::hold_turn_for_group_exit).

NotifyUnresolvedSigkill(Option<DetPid>)

A successful SIGKILL whose victims the scheduler is not told one by one: a process-group kill (Some(group)), or a pidfd whose process Detcore did not record (None).

ThreadIsLive(DetTid)

Liveness of one tid, leader or not; see thread_is_live.

PendingRealTimeExpirations(DetPid)

The pending real-time timer expirations of a process; see pending_real_time_expirations.

DiscardPendingRealTimeExpirations(DetPid, u64)

Discard pending real-time timer expirations of a process (a kernel sigset) whose disposition became SIG_IGN.

RegisterSignalfd(DetPid, u64)

A process created a signalfd for these signals (a kernel sigset).

RecordHandlerRestoreMask(DetPid, u64)

A handler’s return in a process restores a mask leaving these real-time signals (a kernel sigset) unblocked.

ExactChildWaitState(DetPid, DetPid)

Scheduler-owned lifecycle state for a direct child process.

UnrecoverableShutdown

The container is shutting down. Exit the scheduler “thread”.

RequestPort(OpenFileId)

Request a port for an open file description.

AddUsedPort(u16, OpenFileId)

Add a port to the used-port list for an open file description.

ReleasePort(OpenFileId)

Release the port when the last alias of its open file description closes.

RobustListWakes(Vec<(DetTid, FutexID)>)

Deliver robust-futex wakes collected before exit after the backend has confirmed that Linux’s physical task cleanup completed.

Network(NetworkRequest)

One external network record or replay operation.

RecordHostInput

Record that the sending thread, in its syscall number syscall, opened path and found the host file identity (see detcore_model::host_input). An observation for hermit run --verify only: answered before any clock or scheduler accounting. Appended at the end, so that adding it left every earlier variant’s encoded tag unchanged.

Fields

path: String

Guest pathname observed by the original syscall.

syscall: u64

Number of the syscall that observed the input.

identity: HostFileIdentity

Captured actual host file identity.

source: Option<String>

Where the tool found the file at the open (the kernel’s path for the guest’s descriptor, or for an exec’s image), for the run’s end to read its content (crate::host_inputs::content_at_end): present for a regular file or a directory the tool could name.

regular: bool

Whether the file is a regular file.

exec: bool

Whether the kernel opened the file for an exec (detcore_model::host_input::HostInputRecord::exec).

kernel_object: bool

Whether the descriptor’s own path is a kernel object (detcore_model::host_input::HostInputRecord::kernel_object).

RecordHostMutation

Record that the sending thread rebound path in the guest’s file namespace (see detcore_model::host_input::HostMutationRecord). An observation for hermit run --verify only, answered like Self::RecordHostInput. Appended at the end, so that adding it left every earlier variant’s encoded tag unchanged.

Fields

path: String

Guest pathname whose namespace binding changed.

RecordHostTimedSignals(DetTid, HostTimedSignalScope, u64)

This thread armed, in its turn, a host-timed source of these signals; see record_host_timed_signals. Appended after RecordHostMutation, so that adding it left every earlier variant’s encoded tag unchanged.

HostTimedSignals(DetTid)

The signals no gated wait of this thread ends for; see host_timed_signals. Appended after RecordHostTimedSignals, for the same reason.

SharedOpenFile(OpenFileControl)

A control message about a shared open file description, answered before any clock or scheduler accounting (see crate::shared_open_files). Appended after HostTimedSignals, for the same reason.

Sigalrm(SigalrmControl)

A SIGALRM ledger control message, answered before any clock or scheduler accounting (see sigalrm_refuses). Appended after SharedOpenFile, for the same reason.

ChildExitSigchld(ChildExitSigchldControl)

A child-exit SIGCHLD control message (scheduler::child_exit_sigchld).

RecordDeterminismLoss(String)

A determinism loss to record for the run (see crate::detlog::write_loss_notice), from a guest-side handler, which may run in a process whose own record verification never reads. Answered before any clock or scheduler accounting. Appended after ChildExitSigchld, for the same reason.

SetChildSubreaper(DetPid, bool)

Mirror a successful prctl(PR_SET_CHILD_SUBREAPER) by this process, in the caller’s turn (set_child_subreaper). Appended after RecordDeterminismLoss, for the same reason.

RegisteredProcessOf(DetTid)

The process Detcore registered DetTid in: its own thread group’s leader in the thread tree. Unlike the backend’s Guest::pid, it names a raw clone child with a non-SIGCHLD exit signal as its own process. Appended after SetChildSubreaper, for the same reason.

SetSigchldDisposition(DetPid, bool, bool)

Mirror a successful rt_sigaction(SIGCHLD, ...) by this process: whether the action is SIG_IGN, and whether it has SA_NOCLDWAIT (set_sigchld_disposition). Appended after RegisteredProcessOf, for the same reason.

SignalTargetProcess(DetPid)

The process a signal naming this id goes to (Scheduler::signal_target_process). Appended after SetSigchldDisposition, for the same reason.

ReserveSigkill(DetTid, DetTid, u32)

Reserve the victims of a SIGKILL the sender is about to send to the process of the given thread, before the physical send (scheduler::sigkill_retirement). Appended after RegisteredProcessOf, for the same reason.

CommitSigkill(u64, bool)

Commit (true: the send succeeded) or unwind a SIGKILL reservation. Appended after ReserveSigkill, for the same reason.

ReserveSigkillGroup(DetTid, DetPid, u32)

Reserve the victims of a kill(-pgid, SIGKILL): every live process in the recorded process group. Appended after CommitSigkill, for the same reason.

PosixTimerThread(DetPid, i32)

The thread a SIGEV_THREAD_ID timer of this process names by this id (Scheduler::posix_timer_thread). Appended after ReserveSigkillGroup, for the same reason.

ForgetThreadTimerCopies(DetPid, i32)

A disposition change in this process flushed this signal from every thread (Scheduler::forget_thread_timer_copies). Appended after PosixTimerThread, for the same reason.

GuestPid(DetTid, i32)

What a positive pid the given nested thread names, in its own PID namespace, names (PidNamespaces::resolve_for). Appended after ReserveSigkillGroup, for the same reason.

LocalPid(DetTid, DetTid)

The pid the given nested thread sees for a task (PidNamespaces::localize_for). Appended after GuestPid, for the same reason.

ExecTimerFlush(DetPid)

The POSIX timer copies a successful exec of this process flushes (Scheduler::take_exec_timer_flush), asked by its surviving thread. Appended after LocalPid, for the same reason.

RetireExitedLeader

The calling thread-group leader is about to complete its own exit while its group lives on (Scheduler::retire_exited_leader). Appended after ExecTimerFlush, for the same reason.

DiscardedSignal(DiscardedSignalControl)

A discarded-at-send record message (scheduler::discarded_at_send), answered before any clock or scheduler accounting. Appended after RetireExitedLeader, for the same reason.

DescriptorsReplaced(FilesId, u32, u32)

A close, close_range, dup2 or dup3 released or replaced the descriptors first..=last of the caller’s table, named by its identity (Scheduler::note_descriptors_replaced). Appended after DiscardedSignal, for the same reason.

ThreadIdRefused(DetTid)

Whether a task of this run had this id and it is not a zombie’s pid (thread_id_refused). Appended after DescriptorsReplaced, for the same reason.

ProcfsListing(Option<DetPid>)

The processes /proc lists, and the threads the task directory of the given process lists (Scheduler::procfs_listing). Appended after ThreadIdRefused, for the same reason.

ParentDeathSignal(Option<i32>)

Arm (Some, 0 disarms) or read (None) the sender’s parent-death signal that Detcore sends itself (parent_death_signal). Appended after ProcfsListing, for the same reason.

PrepareNativeExec(PrepareNativeExec)

Neutral controls appended without changing any existing wire tag.

SealNativeExecStats

Seal the exact versioned runtime bytes before one-use descriptor provision.

Fields

ticket: ExecTicket

Retained prepared transaction ticket.

runtime_digest: [u8; 32]

SHA-256 of the exact runtime envelope bytes.

runtime: Vec<u8>

Bounded actual runtime envelope, not host-decoded Tool state.

IssueNativeExec

Last old-image control after the sealed empty forwarding cut.

Fields

ticket: ExecTicket

Successfully provisioned retained transaction ticket.

state_digest: [u8; 32]

Independently computed composite Tool/runtime digest.

CancelNativeExec

Invalidate a pre-redemption ticket; ordinary CancelExec still follows.

Fields

ticket: ExecTicket

Prepared or Issued ticket whose physical exec did not succeed.

CompleteNativeExec

Acknowledge the real new-mm lifecycle after MarkPastFirstExecve.

Fields

ticket: ExecTicket

Consumed successor ticket after real lifecycle and frontend checks.

NamesARetiredExitedLeader(DetTid)

Whether a tid names a thread-group leader retired at its own exit while its group lives on (names_a_retired_exited_leader). Appended last, for the same reason as the controls above.

ProcfsIds(bool, Vec<i32>)

The kernel’s numbers for guest process or thread numbers (true), or the guest’s for kernel numbers (false), as /proc spells them (Scheduler::procfs_ids). Appended last, for the same reason.

GroupOrSession(DetPid, bool)

The process group (false) or session (true) of the task with an id, as getpgid and getsid answer it (Scheduler::group_or_session_of). Appended last, for the same reason.

SetsidDecision(DetPid)

Linux’s answer to setsid() by a process (Scheduler::setsid_decision), deciding nothing yet. Appended last.

SetpgidDecision(DetPid, i32, i32)

Linux’s answer to setpgid(pid, pgid) by a process (Scheduler::setpgid_decision), deciding nothing yet. Appended last.

ProcessImage(DetPid)

The image a guest process executes, as Detcore recorded it at the process’s exec (crate::exec_record), for its /proc/<pid>/exe link. Appended last.

ProcfsTask(DetTid, Option<DetTid>)

Whether the task a per-process /proc file names exists, whether it has exited unreaped, and the incarnation of its numbers (Scheduler::procfs_task). Appended last.

RenderedFileState(u64, RenderedFileChange)

Change or read the state Detcore keeps on a rendered per-process /proc file’s inode (InodePool::rendered_file_state). Appended last.

PublishSignalDispositions(u64, Option<CopiedDispositions>)

The sender’s process’s signal dispositions as Detcore’s copy holds them, or None to withdraw them, with the publication’s generation (Scheduler::publish_signal_dispositions). Answered before any clock or scheduler accounting. Appended last.

GuestLog(Option<GuestLogRecord>, u64)

A Detcore warning or error from inside the guest, which the coordinator emits at the run’s own log level (crate::guest_log), or none, and how many of the sender’s process could not be sent before it. Answered before forwarded records are drained and before any clock or scheduler accounting. Appended last.

PublishSignalMask(Option<u64>)

The sender’s mask as Detcore’s copy holds it, or None to withdraw it (Scheduler::publish_signal_mask). Answered before any clock or scheduler accounting. Appended last.

RecordProcessAuxv(Vec<u8>, Option<CmdlineArea>)

The auxiliary vector the sender’s process’s new image found on its initial stack (ProcessAuxvTable::record), and the image’s argument and environment areas there, if Detcore found them (ProcessAuxvTable::record_cmdline). Appended last.

ProcessAuxv(DetPid)

A process’s image’s auxiliary vector (ProcessAuxvTable::current), for /proc/<pid>/auxv. Appended last.

AuxvFromKernel(AuxvFromKernel, Option<CmdlineArea>)

The sender’s process’s new image’s /proc/<pid>/auxv is left to the kernel beneath (ProcessAuxvTable::forget), for the reason given. Answers whether this is the run’s first such image for that reason, which the sender warns of. Also the image’s argument and environment areas on its initial stack, if Detcore found them (ProcessAuxvTable::record_cmdline). Appended last.

AnnounceRefusedSignalControls(u64, bool)

The signals whose new action an in-guest runtime refused, bit n - 1 for signal n, and whether it refused an alternate signal stack (crate::refused_signal_controls). Answered before the forwarded-record drain and any clock or scheduler accounting. Appended last.

CheckBrkMappings(BrkMappingCheck, ControllerCaptureFact)

A fixed reply from an external controller while the sender retains its serial grant. The runtime fact and the scheduler jointly establish that no guest can observe the temporary procfs descriptor. Appended last.

PublishRuntimePrivateMemory(RuntimePrivateMemory)

Current image’s native ownership facts, authenticated by the RPC MmId. Answered without granting another task or advancing logical time.

MarkChangedRoot

The sender’s process changed its root with chroot (ProcessAuxvTable::mark_changed_root). Appended last.

RootChanged(DetPid)

Whether the process a number names has changed its root (ProcessAuxvTable::root_changed). Appended last.

DescriptionLocks(OpenFileId, Result<Vec<HeldLock>, String>, u32)

The OFD and flock locks this open file description holds, as its fdinfo showed them after a call through one of the sender’s descriptors, and how many slots of the sender’s descriptor table name it (procfs::locks::LockLedger::note_locks), or why that fdinfo could not be read (procfs::locks::LockLedger::note_unknown). Appended last.

TableReleased(OpenFileId, u32)

How many slots of the sender’s descriptor table still name this description after a close or replacement there (procfs::locks::LockLedger::release). Appended last.

GuestLockRows(Vec<LockRowFacts>)

Which rows of a /proc/locks snapshot the guest owns (procfs::locks::guest_lock_rows). Appended last.

TableExec(Vec<(OpenFileId, u32)>)

The descriptions whose locks Detcore read that the sender’s process’s table still names after its successful exec, with their slot counts (procfs::locks::LockLedger::exec_kept). Appended last.

AliasedInode(Option<String>)

A lock or unlock went through a descriptor whose description the ledger may know under another identity, on the file with this inode number, or on an unknown one (procfs::locks::LockLedger::alias_inode). Appended last.

HostTimedAndPrivateSigchld(DetTid)

The calling thread’s host-timed signals and the SIGCHLD the schedule recorded in its private queue (Scheduler::host_timed_and_private_sigchld). Appended last.

LockLedgerRefused(String)

A lock or unlock through a descriptor whose description the ledger may know under another identity, whose fdinfo could not be read for this reason (procfs::locks::LockLedger::refuse). Appended last.

MappingCapture(Request)

Contained mapping capture; answered without changing the serial grant.

StoppingRefusal(String)

The in-guest delivery protocol cannot go on in this run, for this reason: the whole refusal line, conventionally hermit refused to continue the run (NAME): ... (A5 design D49). The coordinator ends the whole run on it (scheduler::exit_on_scheduler_refusal): it writes the line and exits with HERMIT_POLICY_REFUSAL_EXIT, and where the scheduler runs as the init of the guest’s PID namespace, the kernel then kills every guest process. Unlike PolicyRefusal, which records a reason while only the refusing Tool image exits, no guest process runs on after it, and it is never answered. Filed only under Config::in_guest_signal_delivery, whose gate requires that ownership. Appended last.

ProcessCmdline(DetPid)

The process a /proc/<pid>/cmdline names (a thread’s number names its process), and its argument and environment areas (ProcessAuxvTable::current_cmdline). Appended last.

KernelRunTarget(DetTid)

What the scheduler holds for this thread if its latest committed request is a kernel-run call whose continuation turn has not been granted (A5 design D44, Scheduler::kernel_run_block), asked by a sender in its turn under the in-guest delivery gate. Appended last.

CallbackCheckpointMismatch

Error-only notice, not a resource or a scheduling turn. Appended last.

Fields

checkpoint: Checkpoint

The first unconsumed checkpoint, as sent on thread start.

hard: bool

A semantic endpoint/phase mismatch rather than time/RCB drift.

actual: Origin

Independently observed actual callback coordinates.

TaskStatFacts(DetTid, Option<DetTid>)

What the process table says about the task a per-process stat file names (Scheduler::task_stat_facts): the top-level number and the thread below task/. Appended last.

SetTaskComm(DetTid, TaskComm)

Record a task’s name (Scheduler::set_task_comm): the name a new image’s AT_EXECFN gives it at its exec, or the one PR_SET_NAME set, in the task’s own turn. Appended last.

RecordExternalParent(DetPid, i32)

Record the guest-visible parent of a process whose real parent is outside the guest’s tree, its own getppid answer when it first opens or lists its rendered stat (Scheduler::record_external_parent). Appended last.

SetRssLimit(DetPid, u64)

Record a process’s virtual soft RLIMIT_RSS after a setrlimit or prlimit64 changed it (Scheduler::set_rss_limit). Appended last.

PublishTemporaryMask(TemporaryMaskControl)

A5 step 3c.1e A, IR-23(a): the sender’s masked wait publishes its temporary mask with D37’s held masks before its first expired-timerfd publication, or withdraws that publication as a call that filed no later request returns (Scheduler::temporary_mask_control). Answered in the sender’s own turn with no scheduling decision; filed only under Config::in_guest_signal_delivery. Appended last.

InPidNamespaceInit(DetTid)

A5 step 3c.1e A, IR-15: whether this thread’s process is the init of a PID namespace it created with CLONE_NEWPID (ThreadTree::is_pid_namespace_init), asked under Config::in_guest_signal_delivery before a two-phase delivery’s announcement and a predicted death. Appended last.

VirtualInotifyCookies(Vec<u32>)

The virtual cookie for each host inotify rename cookie of one read, in order (crate::syscalls::inotify). Answered in the sender’s own turn with no scheduling decision. Appended last.

RegisterPlaceholder(PlaceholderDirectory, OpenFileId)

Register a placeholder directory a guest opened, and the open file description it opened it in (InodePool::register_placeholder). Appended last.

Placeholder(u64)

The placeholder directory a kernel position tags (InodePool::placeholder). Appended last.

PlaceholderFlock(PlaceholderFlock)

A flock through a placeholder descriptor (procfs::locks::LockLedger::placeholder_flock). Appended last.

PlaceholderWriteHint(PlaceholderLockKey, Option<u64>)

Set (Some) or read the write hint of a placeholder directory’s inode (procfs::locks::LockLedger::placeholder_write_hint). Appended last.

PlaceholderCopies(PlaceholderCopies)

A change to the copies of placeholder descriptions in flight over SCM_RIGHTS (procfs::locks::LockLedger::placeholder_copies). Appended last.

CpuAffinity(DetTid)

A live task’s CPU affinity under --virtual-cpus (Scheduler::cpu_affinity). Appended last.

SetCpuAffinity(DetTid, CpuSet)

Record a live task’s CPU affinity under --virtual-cpus, in the turn of the sched_setaffinity that set it (Scheduler::set_cpu_affinity). Appended last.

SigkillDyingThreads(u64)

The threads the send of SIGKILL reservation token kills, asked by its sender before the send so it can record their robust lists (Scheduler::sigkill_dying_threads). Appended last.

RecordSigkillRobustLists(u64, Vec<(DetTid, MmId, RobustListSnapshot)>)

The robust lists the sender of SIGKILL reservation token recorded before its send, for the threads it kills (Scheduler::record_sigkill_robust_lists). Appended last.

TakeSigkillRobustList

A thread a SIGKILL ended takes the robust list its sender recorded for it, in its exit callback (Scheduler::take_sigkill_robust_list). Answered before clock accounting. Appended last.

NextGuestId

Take the ID for the task a clone-family call is about to create, when Detcore chooses the IDs (GuestIds::Chosen), in the caller’s turn. Appended last.

GaveHostId

Report a host-ID outcome or a conservative pre-vfork attempt while Detcore chooses IDs (GlobalState::host_id_tasks). Appended last.

ReplayDeparture

A faithful thread could not file its next change point. The receiver derives identity/source/output coordinates, acknowledges within the existing grant, and does not consume time or grant state. Appended last.

Fields

previous: LogicalTime

The previous change point filed by this thread.

observed: LogicalTime

The attempted time, at or before the previous filing.

slice: u64

The thread’s actual slice counter at detection.

DescriptionLocksTaken(OpenFileId, Vec<HeldLock>, Vec<HeldLock>, u32, LedgerIdentity)

As DescriptionLocks, with the locks known, after a call of the sender’s that can take a lock through the description, and the locks the call proved it took, which are the sender’s process’s, and what else names its open file description: possibly another identity (one recorded on reception as a description of its own), or the other standard streams of its alias group, with their slots in the sender’s table (procfs::locks::LedgerIdentity, procfs::locks::LockLedger::note_locks_taken). Appended last.

LockOwners(OpenFileId, Vec<HeldLock>)

The owner each of these locks, held through this description, shows on a lock line of a rendered fdinfo (procfs::locks::LockLedger::owners). Appended last.

LedgerLockRows

The /proc/locks rows Detcore renders from the ledger where the guest’s procfs is not the kernel’s (procfs::locks::LockLedger::rendered_rows). Appended last.

SecondIdentityLocks(OpenFileId, Vec<HeldLock>, u32)

As DescriptionLocks, with the locks known, for a description of the sender’s table that may be a second identity of another, read after a call of its own that took no lock: one the sender recorded on reception as a description of its own (procfs::locks::LockLedger::note_second_identity_locks). Appended last.

HoldTable(HeldTable)

The descriptor table the sender holds, at its start or after an exec gave it a new one, for the terminal receipt of a death by a fatal signal to let go of (GlobalState::held_tables, Detcore::name_table_for_death). Sent only where the tool runs in this process (HeldTable). Answered at once, outside the scheduler. Appended last.

RecordLocksHeldAsOfd(Option<Vec<String>>)

A guest’s record-lock request (F_SETLK, F_SETLKW) succeeded, where the ledger takes the backend’s fact, and the backend holds the lock it took as an OFD lock, on these files (MAJOR:MINOR:INODE), or on a file the fact could not name (None) (procfs::locks::LockLedger::note_record_locks_held_as_ofd). Appended last.

HostDiskstats

The host’s /proc/diskstats as the run first read it, which every /proc/diskstats Detcore renders starts from (GlobalState::host_diskstats). A fact of the host, not of the guest’s state: answered before any clock accounting, with no time. Appended last.

UserNamespaceRelation(DetTid, DetTid)

Where the user namespace of the process of task .1 is from that of the process of thread .0, and whether the namespace whose owner Linux’s rule asks about there may be owned by an effective user ID other than the real user ID every guest task has (scheduler::user_namespaces). Appended last.

UserNamespaceOwnerMayDiffer(DetTid)

The clone that made process .0, which made a user namespace, was a creator’s whose effective user ID was not its real user ID, read as the overflow ID, or could not be read; sent once the clone succeeded, in the turn that registered the process (UserNamespaces::note_owner_may_differ). Appended last.

ProcfsSequence(OpenFileId)

The record sequence of the open file description .0, a per-process file whose description a fork copied where the tool runs in each guest process, as the last read, positioned read or seek of it, in whichever process, left it (Detcore::take_procfs_sequence); none before the first. Appended last.

StoreProcfsSequence(OpenFileId, ProcfsSequence)

Keep .1 as the record sequence of the open file description .0 after a read, positioned read or seek of it (Detcore::store_procfs_sequence). Appended last.

Trait Implementations

impl Clone for GlobalRequest

fn clone(&self) -> GlobalRequest

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for GlobalRequest

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for GlobalRequest

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Eq for GlobalRequest

impl PartialEq for GlobalRequest

fn eq(&self, other: &GlobalRequest) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl Serialize for GlobalRequest

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for GlobalRequest