perf(kernel): linked cap tree, translate-based page lookup, next-fit frames/heap, targeted dequeue; host benches

crates/kernel/src/tests/captree_model.rs

@@ -93,12 +93,17 @@ impl Model {
         }
     }
 
+    /// Sorted, so a seed always means the same run (HashMap order is
+    /// random per process).
     fn held_by(&self, pid: ProcessId) -> Vec<(usize, CapSlot)> {
-        self.alive
+        let mut held: Vec<(usize, CapSlot)> = self
+            .alive
             .iter()
             .filter(|(_, (p, _))| *p == pid)
             .map(|(id, (_, s))| (*id, *s))
-            .collect()
+            .collect();
+        held.sort_by_key(|(id, _)| *id);
+        held
     }
 }
 
@@ -302,7 +307,14 @@ fn newly_used(before: [bool; 64], after: [bool; 64]) -> CapSlot {
 
 #[test]
 fn derivation_tree_matches_the_model() {
-    for seed in [5u64, 0xBADC0DE, 31337, 0x5EED, 2024] {
+    let extra: u64 = std::env::var("MODEL_SEEDS")
+        .ok()
+        .and_then(|v| v.parse().ok())
+        .unwrap_or(0);
+    for seed in [5u64, 0xBADC0DE, 31337, 0x5EED, 2024]
+        .into_iter()
+        .chain(1000..1000 + extra)
+    {
         let mut world = World::new();
         let mut rng = Rng(seed);
         let mut revokes = 0;
@@ -314,6 +326,9 @@ fn derivation_tree_matches_the_model() {
             }
             world.check();
         }
+        if seed >= 1000 {
+            continue; // extra seeds hunt for mismatches, not coverage
+        }
         assert!(
             revokes > 20,
             "seed {seed:#x}: too little deletion exercised"