//go:build linux

package cgroup

import (
	"bytes"
	"errors"
	"fmt"
	"io"
	"os"
	"os/exec"
	"os/signal"
	"path/filepath"
	"slices"
	"strconv"
	"strings"
	"syscall"
	"testing"
	"time"
	"unsafe"

	"golang.org/x/sys/unix"
)

// The placement shim against a real kernel (zdd readiness 3, Task 1).
// Opt-in: CARLOS_SHIM_KERNEL=1 inside a disposable unit with Delegate=yes:
//
//	systemd-run --user --wait --pipe --collect -p Delegate=yes \
//	  -E TMPDIR=/tmp/k/zddr3 -E CARLOS_SHIM_KERNEL=1 -E CARLOS_GEN_KERNEL=1 \
//	  cgroup.test -test.run 'ShimKernel|ShimExecFailure' -test.v -test.count=1
//
// Without the variable every test here skips. With it, a missing delegation
// fails the test: a run that was asked for cannot pass by skipping.

// shimKernelManager is genKernelManager's setup, except that once
// CARLOS_SHIM_KERNEL=1 asks for the run, no delegation is a failure.
func shimKernelManager(t *testing.T) *Manager {
	t.Helper()
	if os.Getenv("CARLOS_SHIM_KERNEL") != "1" {
		t.Skip("set CARLOS_SHIM_KERNEL=1 inside a unit with Delegate=yes (zdd readiness 3, Task 1)")
	}
	raw, err := os.ReadFile("/proc/self/cgroup")
	if err != nil {
		t.Fatalf("CARLOS_SHIM_KERNEL=1 but no cgroup: %v", err)
	}
	rel, ok := ParseSelfCgroup(string(raw))
	if !ok {
		t.Fatal("CARLOS_SHIM_KERNEL=1 but no unified cgroup path")
	}
	root := filepath.Join("/sys/fs/cgroup", rel)
	if filepath.Base(root) == "supervise" {
		root = filepath.Dir(root) // an earlier test in this process moved us
	}
	sup := filepath.Join(root, "supervise")
	if err := os.MkdirAll(sup, 0o755); err != nil {
		t.Fatalf("CARLOS_SHIM_KERNEL=1 but no delegation: %v", err)
	}
	if err := os.WriteFile(filepath.Join(sup, "cgroup.procs"), []byte(strconv.Itoa(os.Getpid())), 0o644); err != nil {
		t.Fatalf("CARLOS_SHIM_KERNEL=1 but no delegation: %v", err)
	}
	if err := enableChildren(root); err != nil {
		t.Fatalf("CARLOS_SHIM_KERNEL=1 but no delegation: %v", err)
	}
	return &Manager{root: root, logf: t.Logf}
}

// shimKernelTarget makes m.root/shim-<name> with the default tier's limits,
// and removes it when the test ends.
func shimKernelTarget(t *testing.T, m *Manager, name string) string {
	t.Helper()
	dir := filepath.Join(m.root, "shim-"+name)
	if err := os.Mkdir(dir, 0o755); err != nil {
		t.Fatal(err)
	}
	t.Cleanup(func() {
		if err := os.Remove(dir); err != nil {
			t.Errorf("remove %s: %v", dir, err)
		}
	})
	if err := m.applyLimit(name, dir, TierDefault, true); err != nil {
		t.Fatal(err)
	}
	return dir
}

// markerCmd is a tenant that touches marker first thing, then runs script.
func markerCmd(marker, script string) *exec.Cmd {
	return exec.Command("/bin/sh", "-c", `touch "$0"; `+script, marker)
}

func assertNoMarker(t *testing.T, marker string) {
	t.Helper()
	if _, err := os.Stat(marker); err == nil {
		t.Fatal("tenant code ran")
	}
}

func assertReaped(t *testing.T, cmd *exec.Cmd) {
	t.Helper()
	if cmd.Process == nil {
		t.Fatal("no shim was started")
	}
	if _, err := os.Stat(fmt.Sprintf("/proc/%d", cmd.Process.Pid)); err == nil {
		t.Fatalf("pid %d was not reaped", cmd.Process.Pid)
	}
}

func assertNothingInFlight(t *testing.T, m *Manager) {
	t.Helper()
	if n := m.placementsUnder(m.root); n != 0 {
		t.Fatalf("%d placements still registered", n)
	}
}

func shimCgroupPath(dir string) string { return strings.TrimPrefix(dir, "/sys/fs/cgroup") }

// setShimVar sets a package var for one test.
func setShimVar[T any](t *testing.T, p *T, v T) {
	orig := *p
	*p = v
	t.Cleanup(func() { *p = orig })
}

// shimDumpSep separates the dump's argv, env and cwd. It cannot be "\x00\x00":
// an empty argv element joins to exactly that.
const shimDumpSep = "\x00--shim-dump--\x00"

// TestShimKernelChild is the synthetic tenant. Outside a child run it does
// nothing, so a kernel run shows no skip for it.
func TestShimKernelChild(t *testing.T) {
	switch os.Getenv("CARLOS_SHIM_CHILD") {
	case "dump":
		wd, err := os.Getwd()
		if err != nil {
			os.Exit(3)
		}
		var b bytes.Buffer
		b.WriteString(strings.Join(os.Args, "\x00"))
		b.WriteString(shimDumpSep)
		b.WriteString(strings.Join(os.Environ(), "\x00"))
		b.WriteString(shimDumpSep)
		b.WriteString(wd)
		os.Stdout.Write(b.Bytes())
		os.Exit(0)
	case "state":
		var sig int
		if err := unix.Prctl(unix.PR_GET_PDEATHSIG, uintptr(unsafe.Pointer(&sig)), 0, 0, 0); err != nil {
			os.Exit(3)
		}
		pgid, err := unix.Getpgid(0)
		if err != nil {
			os.Exit(3)
		}
		fmt.Printf("pdeathsig %d\npgid-leader %v\n", sig, pgid == os.Getpid())
		os.Exit(0)
	}
}

func TestShimKernelPlacesBeforeExec(t *testing.T) {
	m := shimKernelManager(t)
	dir := shimKernelTarget(t, m, "places")
	cmd := exec.Command("/bin/sh", "-c", `cat /proc/self/cgroup; echo $$; read x || :`)
	var out bytes.Buffer
	cmd.Stdout = &out
	stdin, err := cmd.StdinPipe()
	if err != nil {
		t.Fatal(err)
	}
	refused, err := m.startViaShim(dir, cmd, nil)
	if refused || err != nil {
		t.Fatalf("refused=%v err=%v", refused, err)
	}
	assertNothingInFlight(t, m)
	want := "0::" + shimCgroupPath(dir)
	raw, err := os.ReadFile(fmt.Sprintf("/proc/%d/cgroup", cmd.Process.Pid))
	if err != nil {
		t.Fatal(err)
	}
	if strings.TrimSpace(string(raw)) != want {
		t.Fatalf("/proc/%d/cgroup = %q, want %q", cmd.Process.Pid, raw, want)
	}
	stdin.Close()
	if err := cmd.Wait(); err != nil {
		t.Fatal(err)
	}
	lines := strings.Split(strings.TrimSpace(out.String()), "\n")
	if len(lines) != 2 || lines[0] != want || lines[1] != strconv.Itoa(cmd.Process.Pid) {
		t.Fatalf("tenant printed %q, want %q and pid %d", out.String(), want, cmd.Process.Pid)
	}
}

func TestShimKernelExitCodePassesThrough(t *testing.T) {
	m := shimKernelManager(t)
	dir := shimKernelTarget(t, m, "exitcode")
	cmd := exec.Command("/bin/sh", "-c", "exit 7")
	if _, err := m.startViaShim(dir, cmd, nil); err != nil {
		t.Fatal(err)
	}
	err := cmd.Wait()
	var ee *exec.ExitError
	if !errors.As(err, &ee) || ee.ExitCode() != 7 {
		t.Fatalf("Wait = %v, want exit status 7", err)
	}
}

func TestShimKernelPassesArgvEnvExactly(t *testing.T) {
	m := shimKernelManager(t)
	dir := shimKernelTarget(t, m, "argvenv")
	wd := t.TempDir()
	mk := func(large string) *exec.Cmd {
		return &exec.Cmd{
			Path: os.Args[0],
			Args: []string{os.Args[0], "-test.run=^TestShimKernelChild$", "", "two words", "line\nbreak"},
			Env:  []string{"CARLOS_SHIM_CHILD=dump", "EMPTY=", "EQ=a=b", "BAD=\xff\xfe", "LARGE=" + large},
			Dir:  wd,
		}
	}
	run := func(cmd *exec.Cmd, viaShim bool) []byte {
		t.Helper()
		var out bytes.Buffer
		cmd.Stdout = &out
		cmd.Stderr = os.Stderr
		var err error
		if viaShim {
			_, err = m.startViaShim(dir, cmd, nil)
		} else {
			err = cmd.Start()
		}
		if err != nil {
			t.Fatalf("start (shim %v): %v", viaShim, err)
		}
		if err := cmd.Wait(); err != nil {
			t.Fatalf("wait (shim %v): %v", viaShim, err)
		}
		return out.Bytes()
	}
	large := strings.Repeat("v", 100<<10)
	want := mk(large)
	viaShim := run(mk(large), true)
	direct := run(mk(large), false)
	if !bytes.Equal(viaShim, direct) {
		t.Fatalf("the shim's tenant saw different argv, env or cwd from a direct start's")
	}
	parts := bytes.Split(viaShim, []byte(shimDumpSep))
	if len(parts) != 3 {
		t.Fatalf("dump has %d parts", len(parts))
	}
	if got := strings.Split(string(parts[0]), "\x00"); !slices.Equal(got, want.Args) {
		t.Fatalf("argv = %q, want %q", got, want.Args)
	}
	if got := strings.Split(string(parts[1]), "\x00"); !slices.Equal(got, want.Env) {
		t.Fatalf("env differs from cmd.Env (%d entries, want %d)", len(got), len(want.Env))
	}
	if string(parts[2]) != wd {
		t.Fatalf("cwd = %q, want %q", parts[2], wd)
	}

	// Above Linux's per-string limit (32 pages): both fail with E2BIG, and
	// the shim's is the command's own error, not a placement failure.
	huge := strings.Repeat("v", 200<<10)
	if err := mk(huge).Start(); !errors.Is(err, syscall.E2BIG) {
		t.Fatalf("direct start = %v, want E2BIG", err)
	}
	cmd := mk(huge)
	refused, err := m.startViaShim(dir, cmd, nil)
	var pe *os.PathError
	if refused || isPlacementError(err) || !errors.As(err, &pe) || pe.Op != "fork/exec" || !errors.Is(err, syscall.E2BIG) {
		t.Fatalf("shim start = %v, want *os.PathError fork/exec E2BIG", err)
	}
	assertReaped(t, cmd)
	assertNothingInFlight(t, m)
}

// stateScript prints the tenant's inherited state from a shell, which,
// unlike a Go program, leaves its signal mask and RLIMIT_NOFILE as it found
// them, then execs the Go child for what only prctl can read. ls lists the
// shell's descriptors, not its own.
const stateScript = `echo fds-begin; ls /proc/$$/fd; echo fds-end
grep -E '^(SigBlk|SigIgn|CapInh|CapPrm|CapEff|CapBnd|CapAmb|NoNewPrivs):' /proc/$$/status
echo nofile $(ulimit -Sn) $(ulimit -Hn)
exec "$0" "$@"`

func TestShimKernelInheritedStateMatchesADirectStart(t *testing.T) {
	m := shimKernelManager(t)
	dir := shimKernelTarget(t, m, "state")
	// SIGHUP is the case Go's runtime keeps ignored by itself; SIGTERM and
	// SIGUSR1 are ones the shim's runtime would replace with its handlers,
	// so the tenant's exec would reset them to default unless the shim
	// ignores them again (whole-branch review, finding 2).
	ignored := []syscall.Signal{syscall.SIGHUP, syscall.SIGTERM, syscall.SIGUSR1}
	for _, sig := range ignored {
		signal.Ignore(sig)
	}
	t.Cleanup(func() {
		for _, sig := range ignored {
			signal.Reset(sig)
		}
	})
	opened, err := syscall.Open("/dev/null", syscall.O_RDONLY, 0) // no O_CLOEXEC
	if err != nil {
		t.Fatal(err)
	}
	// Moved to 100 or above (F_DUPFD leaves close-on-exec clear), so the
	// tenant's ExtraFiles at 3 and 4 cannot cover it in a direct start.
	leaked, err := unix.FcntlInt(uintptr(opened), unix.F_DUPFD, 100)
	syscall.Close(opened)
	if err != nil {
		t.Fatal(err)
	}
	t.Cleanup(func() { syscall.Close(leaked) })

	run := func(viaShim bool) (fds []string, rest []string) {
		t.Helper()
		r1, w1, err := os.Pipe()
		if err != nil {
			t.Fatal(err)
		}
		defer r1.Close()
		defer w1.Close()
		r2, w2, err := os.Pipe()
		if err != nil {
			t.Fatal(err)
		}
		defer r2.Close()
		defer w2.Close()
		cmd := exec.Command("/bin/sh", "-c", stateScript, os.Args[0], "-test.run=^TestShimKernelChild$")
		cmd.Env = []string{"CARLOS_SHIM_CHILD=state"}
		cmd.SysProcAttr = &syscall.SysProcAttr{Setpgid: true, Pdeathsig: syscall.SIGKILL}
		cmd.ExtraFiles = []*os.File{r1, w2}
		var out bytes.Buffer
		cmd.Stdout = &out
		cmd.Stderr = os.Stderr
		if viaShim {
			_, err = m.startViaShim(dir, cmd, nil)
		} else {
			err = cmd.Start()
		}
		if err != nil {
			t.Fatalf("start (shim %v): %v", viaShim, err)
		}
		if err := cmd.Wait(); err != nil {
			t.Fatalf("wait (shim %v): %v", viaShim, err)
		}
		inFDs := false
		for _, l := range strings.Split(strings.TrimSpace(out.String()), "\n") {
			switch {
			case l == "fds-begin":
				inFDs = true
			case l == "fds-end":
				inFDs = false
			case inFDs:
				fds = append(fds, l)
			default:
				rest = append(rest, l)
			}
		}
		return fds, rest
	}
	shimFDs, shimState := run(true)
	directFDs, directState := run(false)
	t.Logf("shim tenant:   fds %v %q", shimFDs, shimState)
	t.Logf("direct tenant: fds %v %q", directFDs, directState)

	if !slices.Equal(shimFDs, []string{"0", "1", "2", "3", "4"}) {
		t.Fatalf("the shim's tenant has fds %v, want exactly 0 1 2 3 4", shimFDs)
	}
	// The control: a direct start does inherit the leaked descriptor, so the
	// shim's clean listing is the shim's doing and not an absent leak.
	if !slices.Contains(directFDs, strconv.Itoa(leaked)) {
		t.Fatalf("the direct start's fds %v lack the leaked fd %d: the control is broken", directFDs, leaked)
	}
	if !slices.Equal(shimState, directState) {
		t.Fatalf("inherited state differs:\nshim   %q\ndirect %q", shimState, directState)
	}
	// And the compared state is not vacuous.
	for _, want := range []string{"pdeathsig 9", "pgid-leader true"} {
		if !slices.Contains(shimState, want) {
			t.Fatalf("shim state %q lacks %q", shimState, want)
		}
	}
	sawSigIgn := false
	for _, l := range shimState {
		if v, ok := strings.CutPrefix(l, "SigIgn:\t"); ok {
			sawSigIgn = true
			mask, err := strconv.ParseUint(v, 16, 64)
			if err != nil {
				t.Fatalf("SigIgn %q: %v", v, err)
			}
			for _, sig := range ignored {
				if mask&(1<<(uint(sig)-1)) == 0 {
					t.Fatalf("SigIgn %q does not carry the ignored %v", v, sig)
				}
			}
		}
	}
	if !sawSigIgn {
		t.Fatal("the shim tenant's state has no SigIgn line")
	}
}

func TestShimKernelChdirFailureIsTheCommands(t *testing.T) {
	m := shimKernelManager(t)
	dir := shimKernelTarget(t, m, "chdir")
	marker := filepath.Join(t.TempDir(), "ran")
	cmd := markerCmd(marker, "")
	missing := filepath.Join(t.TempDir(), "missing")
	cmd.Dir = missing
	refused, err := m.startViaShim(dir, cmd, nil)
	var pe *os.PathError
	if refused || isPlacementError(err) || !errors.As(err, &pe) || pe.Op != "chdir" || pe.Path != missing || !errors.Is(err, syscall.ENOENT) {
		t.Fatalf("refused=%v err=%v, want *os.PathError chdir ENOENT", refused, err)
	}
	assertReaped(t, cmd)
	assertNoMarker(t, marker)
	assertNothingInFlight(t, m)
}

func TestShimExecFailureIsTheCommands(t *testing.T) {
	m := shimKernelManager(t)
	dir := shimKernelTarget(t, m, "execfail")
	cmd := &exec.Cmd{Path: "/nonexistent/app", Args: []string{"app"}}
	refused, err := m.startViaShim(dir, cmd, nil)
	var pe *os.PathError
	if refused || isPlacementError(err) || !errors.As(err, &pe) || pe.Op != "fork/exec" || pe.Path != "/nonexistent/app" || !errors.Is(err, syscall.ENOENT) {
		t.Fatalf("refused=%v err=%v, want *os.PathError fork/exec ENOENT", refused, err)
	}
	t.Logf("the command's own error: %v", err)
	assertReaped(t, cmd)
	assertNothingInFlight(t, m)
}

func TestShimKernelPlacementFailureNeverRunsTenant(t *testing.T) {
	m := shimKernelManager(t)
	dir := shimKernelTarget(t, m, "noprocs")
	procs := filepath.Join(dir, "cgroup.procs")
	if err := os.Chmod(procs, 0o444); err != nil {
		t.Fatal(err)
	}
	t.Cleanup(func() { _ = os.Chmod(procs, 0o644) })
	marker := filepath.Join(t.TempDir(), "ran")
	cmd := markerCmd(marker, "")
	refused, err := m.startViaShim(dir, cmd, nil)
	if refused || !isPlacementError(err) || !strings.Contains(err.Error(), "procs") {
		t.Fatalf("refused=%v err=%v, want the shim's procs refusal as a placement error", refused, err)
	}
	t.Logf("placement error: %v", err)
	assertReaped(t, cmd)
	assertNoMarker(t, marker)
	assertNothingInFlight(t, m)
}

func TestShimKernelBeforeRunsAfterPlacement(t *testing.T) {
	m := shimKernelManager(t)
	dir := shimKernelTarget(t, m, "before")
	var events string
	inFlight := -1
	before := func() error {
		b, err := os.ReadFile(filepath.Join(dir, "cgroup.events"))
		events = string(b)
		inFlight = m.placementsUnder(dir)
		return err
	}
	cmd := exec.Command("/bin/true")
	if refused, err := m.startViaShim(dir, cmd, before); refused || err != nil {
		t.Fatalf("refused=%v err=%v", refused, err)
	}
	if err := cmd.Wait(); err != nil {
		t.Fatal(err)
	}
	if !slices.Contains(strings.Split(events, "\n"), "populated 1") {
		t.Fatalf("before saw cgroup.events %q: the shim was not in place when it was asked", events)
	}
	if inFlight != 0 {
		t.Fatalf("before ran with %d placements registered; the registry covers only fork to placement", inFlight)
	}

	refusal := errors.New("not yours any more")
	marker := filepath.Join(t.TempDir(), "ran")
	cmd = markerCmd(marker, "")
	refused, err := m.startViaShim(dir, cmd, func() error { return refusal })
	if !refused || err != refusal {
		t.Fatalf("refused=%v err=%v, want before's own error", refused, err)
	}
	assertReaped(t, cmd)
	assertNoMarker(t, marker)
	assertNothingInFlight(t, m)
}

// waitShimHeld waits until the shim has marked its spec fd close-on-exec
// (its step 3), which it does just before the step-1 test hold.
func waitShimHeld(pid, specFD int) bool {
	path := fmt.Sprintf("/proc/%d/fdinfo/%d", pid, specFD)
	for deadline := time.Now().Add(5 * time.Second); time.Now().Before(deadline); time.Sleep(time.Millisecond) {
		b, err := os.ReadFile(path)
		if err != nil {
			continue
		}
		for _, l := range strings.Split(string(b), "\n") {
			if v, ok := strings.CutPrefix(l, "flags:"); ok {
				flags, err := strconv.ParseUint(strings.TrimSpace(v), 8, 64)
				if err == nil && flags&unix.O_CLOEXEC != 0 {
					return true
				}
			}
		}
	}
	return false
}

func TestShimKernelSignalBeforePlacement(t *testing.T) {
	m := shimKernelManager(t)
	dir := shimKernelTarget(t, m, "sigplace")
	setShimVar(t, &shimTestHold, 1)
	for _, sig := range []syscall.Signal{syscall.SIGTERM, syscall.SIGKILL} {
		orig := startCmd
		held := make(chan bool, 1)
		startCmd = func(cmd *exec.Cmd) error {
			if err := orig(cmd); err != nil {
				return err
			}
			// The spec fd is the first of the shim's three, after the
			// tenant's ExtraFiles: 3 + (len(cmd.ExtraFiles) - 3).
			specFD := len(cmd.ExtraFiles)
			go func() {
				held <- waitShimHeld(cmd.Process.Pid, specFD)
				_ = cmd.Process.Signal(sig)
			}()
			return nil
		}
		marker := filepath.Join(t.TempDir(), "ran")
		cmd := markerCmd(marker, "")
		_, err := m.startViaShim(dir, cmd, nil)
		startCmd = orig
		if !<-held {
			t.Fatalf("%v: the shim never reached its hold", sig)
		}
		if !isPlacementError(err) || !strings.Contains(err.Error(), "exited before placement") {
			t.Fatalf("%v: err=%v, want a placement error, exited before placement", sig, err)
		}
		t.Logf("%v: %v", sig, err)
		assertReaped(t, cmd)
		assertNoMarker(t, marker)
		assertNothingInFlight(t, m)
	}
}

func TestShimKernelSignalBeforeExec(t *testing.T) {
	m := shimKernelManager(t)
	dir := shimKernelTarget(t, m, "sigexec")
	setShimVar(t, &shimTestHold, 2)
	marker := filepath.Join(t.TempDir(), "ran")
	cmd := markerCmd(marker, "")
	setShimVar(t, &shimAfterRelease, func() { _ = cmd.Process.Kill() })
	_, err := m.startViaShim(dir, cmd, nil)
	if !isPlacementError(err) || !strings.Contains(err.Error(), "exited before exec") {
		t.Fatalf("err=%v, want a placement error, exited before exec", err)
	}
	assertReaped(t, cmd)
	assertNoMarker(t, marker)
	assertNothingInFlight(t, m)
}

// TestShimKernelExecBeforeAcknowledgement pins the rule that an exec that
// happened is never reported as a failure before exec: the tenant runs, the
// parent's deadline passes before it reads R, and the start is still
// reported started.
func TestShimKernelExecBeforeAcknowledgement(t *testing.T) {
	m := shimKernelManager(t)
	dir := shimKernelTarget(t, m, "lateack")
	setShimVar(t, &shimDeadline, shimDeadline)
	// The short deadline goes in once the shim is started, so it governs the
	// release-to-exec read the test is about, and a loaded box's slow shim
	// start cannot fail the placement read instead.
	orig := startCmd
	t.Cleanup(func() { startCmd = orig })
	startCmd = func(cmd *exec.Cmd) error {
		shimDeadline = 200 * time.Millisecond
		return orig(cmd)
	}
	marker := filepath.Join(t.TempDir(), "ran")
	cmd := markerCmd(marker, "")
	setShimVar(t, &shimAfterRelease, func() {
		for deadline := time.Now().Add(5 * time.Second); time.Now().Before(deadline); time.Sleep(time.Millisecond) {
			if _, err := os.Stat(marker); err == nil {
				break
			}
		}
		time.Sleep(400 * time.Millisecond)
	})
	refused, err := m.startViaShim(dir, cmd, nil)
	if refused || err != nil {
		t.Fatalf("refused=%v err=%v, want started", refused, err)
	}
	if err := cmd.Wait(); err != nil {
		t.Fatalf("Wait = %v", err)
	}
	if _, err := os.Stat(marker); err != nil {
		t.Fatal("the tenant did not run")
	}
}

func TestShimKernelDeadlineBeforePlacement(t *testing.T) {
	m := shimKernelManager(t)
	dir := shimKernelTarget(t, m, "deadline")
	setShimVar(t, &shimTestHold, 1)
	setShimVar(t, &shimDeadline, 300*time.Millisecond)
	marker := filepath.Join(t.TempDir(), "ran")
	cmd := markerCmd(marker, "")
	_, err := m.startViaShim(dir, cmd, nil)
	if !isPlacementError(err) || !strings.Contains(err.Error(), "no answer from the shim within 300ms") {
		t.Fatalf("err=%v, want a placement error naming the deadline", err)
	}
	assertReaped(t, cmd)
	assertNoMarker(t, marker)
	assertNothingInFlight(t, m)
}

// TestShimKernelSurvivesDeletedExecutable: a roll replaces the carlos binary
// on disk under a running agent; /proc/self/exe still execs the build the
// agent is running.
func TestShimKernelSurvivesDeletedExecutable(t *testing.T) {
	shimKernelManager(t)
	self, err := os.Executable()
	if err != nil {
		t.Fatal(err)
	}
	copyPath := filepath.Join(t.TempDir(), "copy.test")
	src, err := os.Open(self)
	if err != nil {
		t.Fatal(err)
	}
	dst, err := os.OpenFile(copyPath, os.O_WRONLY|os.O_CREATE|os.O_EXCL, 0o755)
	if err != nil {
		t.Fatal(err)
	}
	if _, err := io.Copy(dst, src); err != nil {
		t.Fatal(err)
	}
	src.Close()
	if err := dst.Close(); err != nil {
		t.Fatal(err)
	}
	child := exec.Command(copyPath, "-test.run=^TestShimKernelDeletedChild$", "-test.v", "-test.count=1")
	child.Env = []string{
		"CARLOS_SHIM_KERNEL=1", "CARLOS_SHIM_DELETED_CHILD=1", "CARLOS_GEN_KERNEL=1",
		"TMPDIR=" + os.TempDir(), "PATH=" + os.Getenv("PATH"),
	}
	out, err := child.CombinedOutput()
	t.Logf("child:\n%s", out)
	if err != nil || !strings.Contains(string(out), "--- PASS: TestShimKernelDeletedChild") {
		t.Fatalf("the child with a deleted executable failed: %v", err)
	}
}

// TestShimKernelDeletedChild is TestShimKernelSurvivesDeletedExecutable's
// child. Outside that run it does nothing.
func TestShimKernelDeletedChild(t *testing.T) {
	if os.Getenv("CARLOS_SHIM_DELETED_CHILD") != "1" {
		return
	}
	if err := os.Remove(os.Args[0]); err != nil {
		t.Fatal(err)
	}
	exe, err := os.Readlink("/proc/self/exe")
	if err != nil || !strings.HasSuffix(exe, " (deleted)") {
		t.Fatalf("/proc/self/exe = %q (%v), want a deleted file", exe, err)
	}
	t.Logf("running from %s", exe)
	m := shimKernelManager(t)
	dir := shimKernelTarget(t, m, "deleted")
	cmd := exec.Command("/bin/sh", "-c", "cat /proc/self/cgroup")
	var out bytes.Buffer
	cmd.Stdout = &out
	if refused, err := m.startViaShim(dir, cmd, nil); refused || err != nil {
		t.Fatalf("refused=%v err=%v", refused, err)
	}
	if err := cmd.Wait(); err != nil {
		t.Fatal(err)
	}
	if got, want := strings.TrimSpace(out.String()), "0::"+shimCgroupPath(dir); got != want {
		t.Fatalf("tenant ran in %q, want %q", got, want)
	}
}

// TestShimKernelOverhead is informational: it never fails on time.
func TestShimKernelOverhead(t *testing.T) {
	m := shimKernelManager(t)
	dir := shimKernelTarget(t, m, "overhead")
	const n = 20
	median := func(viaShim bool) time.Duration {
		var d []time.Duration
		for range n {
			cmd := exec.Command("/bin/true")
			start := time.Now()
			var err error
			if viaShim {
				_, err = m.startViaShim(dir, cmd, nil)
			} else {
				err = cmd.Start()
			}
			if err != nil {
				t.Fatal(err)
			}
			if err := cmd.Wait(); err != nil {
				t.Fatal(err)
			}
			d = append(d, time.Since(start))
		}
		slices.Sort(d)
		return d[n/2]
	}
	shim := median(true)
	direct := median(false)
	t.Logf("start-to-exit of /bin/true, median of %d: shim %v, direct %v, overhead %v", n, shim, direct, shim-direct)
}