Split the fingerprint's identity out, and tsc=reliable - #2
Merged
Conversation
Reading the three files is the expensive half of a fingerprint — 76 MB of SHA-256 — and a caller that memoises it needs the other half whole to key the memo on. There was no way to get it: shape was reachable, the device topology and the conditional host CPU were not, so a caller had to keep a hand-written list of the fields it thought mattered. That list goes stale silently, and the symptom is a stale fingerprint — a template matching a machine it does not describe, restored into rather than refused. Identity is that half, and Fingerprint is now the files plus it, so there is nothing to keep in step. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019GHRRFvbnZi5q3KSTvyW5a
A statement about this machine's hardware, so it belongs with the rest of them: the clocksource watchdog exists for silicon whose TSC drifts or stops, and this machine's TSC is the host's, which KVM advertises as invariant and the guest is told about through CPUID. It was on the command line of the project this one was extracted from and did not come across — an omission, not a decision, found by diffing the two. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019GHRRFvbnZi5q3KSTvyW5a
aledbf
added a commit
to spin-stack/spinbox
that referenced
this pull request
Sep 8, 2026
go.mod carried spin-machine as indirect while three files import it; `go mod tidy` says what is true. The pin is a branch commit again and not a tag, for the reason the last one was: spin-stack/spin-machine#2 carries Spec.Identity, which this repository's template cache keys on, and which the merge of #1 did not take. It moves to a release once that lands. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019GHRRFvbnZi5q3KSTvyW5a
aledbf
added a commit
to spin-stack/spinbox
that referenced
this pull request
Sep 8, 2026
go.mod carried spin-machine as indirect while three files import it; `go mod tidy` says what is true. The pin is a branch commit again and not a tag, for the reason the last one was: spin-stack/spin-machine#2 carries Spec.Identity, which this repository's template cache keys on, and which the merge of #1 did not take. It moves to a release once that lands. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019GHRRFvbnZi5q3KSTvyW5a
aledbf
added a commit
to spin-stack/spinbox
that referenced
this pull request
Sep 8, 2026
go.mod named 4a006f3, a commit that only ever existed on the branch of spin-stack/spin-machine#2. It was cherry-picked onto main and merged as 58d404e, so the pin resolved to a commit that is not in the history of anything. There is no tag to move to and there will not be one: spin-machine is versioned CalVer, and `v20260908.01` is not valid semver, so the module system resolves it to a pseudo-version of the commit it points at anyway. A pseudo-version off main is what a pin here looks like, and go.sum is what makes it exact. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019GHRRFvbnZi5q3KSTvyW5a
aledbf
added a commit
that referenced
this pull request
Sep 10, 2026
…ves it
The research's ranked candidate for a kernel rebuild was CONFIG_XFRM=n, on the
grounds that xfrm_init runs inside ip_rt_init and register_xfrm_state_bpf does
BTF work Docker does not need. The measurements agree right up to the last step
and then invert the conclusion.
function_graph at depth 1, silent console, dmesg read back from the guest:
inet_init 9252 us
└─ ip_rt_init 9444 us (97% of it)
└─ xfrm_init 8971 / 8638 / 9135 us over three boots
└─ register_xfrm_state_bpf 9045 / 9306 us - essentially all of it
Which reads as a 9 ms saving sitting behind one config symbol. It is not. Filter
on register_btf_kfunc_id_set instead and the boot makes 51 calls to it:
#1 9301.9 us #2 0.75 us #3 1.52 us ... #51
The first call pays the one-time parse of the 4.35 MB .BTF section and every
other call is microseconds. XFRM is not expensive; it is merely first in the
queue. CONFIG_XFRM=n would hand the same 9 ms to whichever kfunc set registers
next, and the only symbol that removes it is CONFIG_DEBUG_INFO_BTF=n - which is
the one thing here that is not up for discussion.
Recorded at the BTF assertion in kernel/Dockerfile, where the decision to keep
BTF now carries its price.
That is the third time in this session a per-function number turned out to
belong to something else: acpi_purge_cached_objects at 26x under a wide filter,
ksm_init and kcompactd_init at 3 ms of vCPU descheduling each, and now this.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019GHRRFvbnZi5q3KSTvyW5a
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two commits that were on #1's branch and are not on main — the merge took the first commit's tree only, so
Spec.Identityandtsc=reliablenever landed. The branch still had them; this is those two, rebased.Spec.IdentityReading the three files is the expensive half of a fingerprint — 76 MB of SHA-256, 29 ms measured — and a consumer that memoises it needs the other half whole to key the memo on. There was no way to get it: the shape was reachable, the device topology and the conditional host CPU were not, so a caller had to keep a hand-written list of the fields it believed mattered.
That list goes stale the next time a device is added to the machine, and the way it fails has no symptom: a cache hit returns the fingerprint of a machine this is not, which is a template restored into hardware it did not come from.
Identityis that half, andFingerprintis now the files plus it, so there is nothing left to keep in step.spinbox's template cache is the consumer, and it had exactly that hand-written list.
tsc=reliableA statement about this machine's hardware, so it belongs with the rest of them: the clocksource watchdog exists for silicon whose TSC drifts or stops, and this machine's TSC is the host's, which KVM advertises as invariant and the guest is told about through CPUID.
It was on the command line of the project this repository was extracted from and did not come across — an omission rather than a decision, found by diffing the two.
🤖 Generated with Claude Code
https://claude.ai/code/session_019GHRRFvbnZi5q3KSTvyW5a