Deterministic testing · devices, drivers, distributed systems

The bug happens in exactly one order. Make that order repeatable.

Calametra runs your real driver against a stateful model of the device on a single-threaded virtual clock. Same spec, same scenario, same seed — same trace hash, every time. A race stops being a story about a flaky rig and becomes a file you can replay.

See a race pinned Read the signal path

Trace reproduction

byte-exact

Replay matches the hash, or the run is reported failed.

Timing records

The complete observed table, with a real HP X27q EDID.

Fault primitives

Matchable at any transition in the model.

Dependencies

stdlib

The offline path needs only Python's standard library.

01 — Method

Search the orderings, then cut the failure to the bone

Exploration walks transport fault sites and seeded schedules until an invariant breaks. Delta-debugging then removes every event that is not load-bearing, until what remains is short enough to read aloud.

Input

Spec + seed

Descriptors, vendor requests, timing tables and a fault schedule, versioned as JSON.

Core

Virtual clock

One thread; simultaneous events ordered by seed, not by luck.

Device

Stateful model

RAM, EDID, timing, modeset, ready, flip state — transitions, not canned replies.

Bridge

QEMU frontend

Pinned 10.1.5 source build, framed socket, TCG instruction-count clock.

Real code

Linux 6.1 guest

USB core, xHCI, DRM/KMS. A real 1080p frame comes back.

Find it

$ make explore

explore  transport fault sites    24
explore  seeded schedules         48
hit      seed 0x4F21A9
fail     flip_state_matches_ram
         stale get_status accepted
         after disconnect

Shrink it

$ make minimize && make replay

delta    48 → 12 → 5 → 3 events
minimal  get_status · disconnect
         · get_status
replay   36/36 records reproduced
hash     sha256:9c41…e07 identical

02 — Specification

One undocumented target, one published one

The reference device is an unsupported MCT Trigger 6 graphics function. Beside it sits a USB DFU 1.1 class model: a published spec, so any mismatch there is a defect in Calametra rather than a mystery about hardware.

Item	Description	Value
Reference device	j5create JCD543 dock, unsupported USB graphics function	0711:5601 rev 1010
Descriptors	Device, configuration, interface, endpoint — exact from the dock	byte-exact
Vendor control	RAM, status, EDID, timing, init, modeset, ready, monitor control, finalise	9 groups
Bulk path	Command framing, bounded RAM writes, colour-bar transfer, decoded flip state	1920×1080
Fault injection	stall · timeout · short · disconnect · delay · corrupt	matchable
Guest coverage	Enumeration, control, bulk-OUT, driver query and active probe paths	Linux 6.1
Display output	DRM connectors with one real KMS frame delivered back to the model	2 connectors
Firmware lab	Fomu/Foboot RISC-V in Renode over USB/IP, driving a DFU campaign	experimental

03 — Boundary

An honest instrument names what it cannot see

These limits are quoted from the repository, not softened for a landing page.

Guaranteed

Isolation. Kernel modules load only inside the disposable QEMU guest.
Reproduction. Replay is byte-exact or the run fails.
Refusal. A stuck emulator records emulator_blocked and establishes no verdict.
Comparison. Bounded physical control-transfer observations are imported and diffed.

Never

No physical USB. No host device is passed into the container.
No host changes. No package install, module load, DKMS, service or desktop change.
Not record/replay. Determinism is the virtual clock plus an instruction-count clock.
Not certification. Curated historical summaries are evidence, not fresh proof.