attribution_processing/

lib.rs

// Copyright 2025 The Fuchsia Authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
use core::cell::RefCell;
use core::convert::Into;
use fidl_fuchsia_memory_attribution_plugin_common as fplugin;
use rustc_hash::FxHashMap;
use serde::Serialize;
use std::collections::HashSet;
use std::fmt::Debug;
use summary::MemorySummary;

mod name;
pub use name::ZXName;
pub mod digest;
pub mod fkernel_serde;
pub mod fplugin_serde;
mod macros;
pub mod summary;

#[cfg(target_os = "fuchsia")]
use {fuchsia_trace::duration, std::ffi::CStr};
#[cfg(target_os = "fuchsia")]
const CATEGORY_MEMORY_CAPTURE: &CStr = c"memory:capture";

/// Unique principal identifier across the whole system.
#[derive(PartialEq, Eq, PartialOrd, Ord, Hash, Clone, Copy, Debug, Serialize)]
pub struct GlobalPrincipalIdentifier(pub std::num::NonZeroU64);

impl GlobalPrincipalIdentifier {
    /// Should only be generated by a [GlobalPrincipalIdentifierFactory] except for tests.
    // #[cfg(test)] cannot be used because it is enabled only for the current crate tests.
    pub fn new_for_test(value: u64) -> Self {
        Self(std::num::NonZeroU64::new(value).unwrap())
    }
}

impl From<fplugin::PrincipalIdentifier> for GlobalPrincipalIdentifier {
    fn from(value: fplugin::PrincipalIdentifier) -> Self {
        Self(std::num::NonZeroU64::new(value.id).unwrap())
    }
}

impl From<GlobalPrincipalIdentifier> for fplugin::PrincipalIdentifier {
    fn from(value: GlobalPrincipalIdentifier) -> fplugin::PrincipalIdentifier {
        fplugin::PrincipalIdentifier { id: value.0.get() }
    }
}

/// Factory for GlobalPrincipalIdentifier, ensuring their uniqueness.
#[derive(Debug)]
pub struct GlobalPrincipalIdentifierFactory {
    next_id: std::num::NonZeroU64,
}

impl Default for GlobalPrincipalIdentifierFactory {
    fn default() -> GlobalPrincipalIdentifierFactory {
        GlobalPrincipalIdentifierFactory { next_id: std::num::NonZeroU64::new(1).unwrap() }
    }
}

impl GlobalPrincipalIdentifierFactory {
    pub fn next(&mut self) -> GlobalPrincipalIdentifier {
        let value = GlobalPrincipalIdentifier(self.next_id);
        // Fail loudly if we are no longer able to generate new [GlobalPrincipalIdentifier]s.
        self.next_id = self.next_id.checked_add(1).unwrap();
        return value;
    }
}

/// User-understandable description of a Principal
#[derive(PartialEq, Eq, Clone, Debug, Hash, Serialize)]
pub enum PrincipalDescription {
    Component(String),
    Part(String),
}

impl From<fplugin::Description> for PrincipalDescription {
    fn from(value: fplugin::Description) -> Self {
        match value {
            fplugin::Description::Component(s) => PrincipalDescription::Component(s),
            fplugin::Description::Part(s) => PrincipalDescription::Part(s),
            _ => unreachable!(),
        }
    }
}

impl From<PrincipalDescription> for fplugin::Description {
    fn from(value: PrincipalDescription) -> fplugin::Description {
        match value {
            PrincipalDescription::Component(s) => fplugin::Description::Component(s),
            PrincipalDescription::Part(s) => fplugin::Description::Part(s),
        }
    }
}

/// Type of a principal.
#[derive(PartialEq, Eq, Clone, Debug, Hash, Serialize)]
pub enum PrincipalType {
    Runnable,
    Part,
}

impl From<fplugin::PrincipalType> for PrincipalType {
    fn from(value: fplugin::PrincipalType) -> Self {
        match value {
            fplugin::PrincipalType::Runnable => PrincipalType::Runnable,
            fplugin::PrincipalType::Part => PrincipalType::Part,
            _ => unreachable!(),
        }
    }
}

impl From<PrincipalType> for fplugin::PrincipalType {
    fn from(value: PrincipalType) -> fplugin::PrincipalType {
        match value {
            PrincipalType::Runnable => fplugin::PrincipalType::Runnable,
            PrincipalType::Part => fplugin::PrincipalType::Part,
        }
    }
}

#[derive(Clone, Debug, Eq, Hash, PartialEq, Serialize)]
/// A Principal, that can use and claim memory.
pub struct Principal {
    // These fields are initialized from [fplugin::Principal].
    pub identifier: GlobalPrincipalIdentifier,
    pub description: Option<PrincipalDescription>,
    pub principal_type: PrincipalType,

    /// Principal that declared this Principal. None if this Principal is at the root of the system
    /// hierarchy (the root principal is a statically defined Principal encompassing all resources
    /// on the system). The Principal hierarchy forms a tree (no cycles).
    pub parent: Option<GlobalPrincipalIdentifier>,
}

/// Creates a new [Principal] from a [fplugin::Principal] object. The [Principal] object will
/// contain all the data from [fplugin::Principal] and have its other fields initialized empty.
impl From<fplugin::Principal> for Principal {
    fn from(value: fplugin::Principal) -> Self {
        Principal {
            identifier: value.identifier.unwrap().try_into().unwrap(),
            description: value.description.map(Into::into),
            principal_type: value.principal_type.unwrap().into(),
            parent: value.parent.map(|id| id.try_into().unwrap()),
        }
    }
}

impl From<Principal> for fplugin::Principal {
    fn from(value: Principal) -> fplugin::Principal {
        fplugin::Principal {
            identifier: Some(value.identifier.into()),
            description: value.description.map(Into::into),
            principal_type: Some(value.principal_type.into()),
            parent: value.parent.map(Into::into),
            ..Default::default()
        }
    }
}

/// A Principal, with its attribution claims and resources.
#[derive(Serialize)]
pub struct InflatedPrincipal {
    /// The principal definition.
    principal: Principal,

    // These fields are computed from the rest of the [fplugin::Snapshot] data.
    /// KOIDs of processes that have mapped regions attributed to this principal.
    mapped_processes: Vec<u64>,

    /// KOIDs of resources attributed to this principal, after resolution of sharing and
    /// reattributions.
    resources: Vec<u64>,
}

impl InflatedPrincipal {
    fn new(principal: Principal) -> InflatedPrincipal {
        InflatedPrincipal {
            principal,
            mapped_processes: Default::default(),
            resources: Default::default(),
        }
    }
}

impl InflatedPrincipal {
    fn name(&self) -> &str {
        match &self.principal.description {
            Some(PrincipalDescription::Component(component_name)) => component_name,
            Some(PrincipalDescription::Part(part_name)) => part_name,
            None => "?",
        }
    }
}

/// Type of the claim, that changes depending on how the claim was created.
#[derive(Clone, Copy, Eq, PartialEq, Hash, Debug, Serialize)]
pub enum ClaimType {
    /// A principal claimed this resource directly.
    Direct,
    /// A principal claimed a resource that contains this resource (e.g. a process containing a
    /// VMO).
    Indirect,
    /// A principal claimed a child of this resource (e.g. a copy-on-write VMO child of this VMO).
    Child,
}

#[derive(Clone, Copy, PartialEq, Eq, Hash)]
pub struct Koid(u64);

impl From<u64> for Koid {
    fn from(value: u64) -> Self {
        Koid(value)
    }
}

/// Attribution claim of a Principal on a Resource.
///
/// Note that this object is slightly different from the [fplugin::Attribution] object: it goes from
/// a Resource to a Principal, and covers also indirect attribution claims of sub- and parent
/// resources.
#[derive(Clone, Copy, Eq, PartialEq, Hash, Debug, Serialize)]
pub struct Claim {
    /// Principal to which the resources are attributed.
    pub(crate) subject: GlobalPrincipalIdentifier,
    /// Principal making the attribution claim.
    pub(crate) source: GlobalPrincipalIdentifier,
    pub(crate) claim_type: ClaimType,
}

#[derive(Clone, Debug, PartialEq, Serialize)]
pub struct Resource {
    pub koid: u64,
    pub name_index: usize,
    #[serde(with = "fplugin_serde::ResourceTypeDef")]
    pub resource_type: fplugin::ResourceType,
}

impl From<fplugin::Resource> for Resource {
    fn from(value: fplugin::Resource) -> Self {
        Resource {
            koid: value.koid.unwrap(),
            name_index: value.name_index.unwrap() as usize,
            resource_type: value.resource_type.unwrap(),
        }
    }
}

impl From<Resource> for fplugin::Resource {
    fn from(value: Resource) -> fplugin::Resource {
        fplugin::Resource {
            koid: Some(value.koid),
            name_index: Some(value.name_index as u64),
            resource_type: Some(value.resource_type),
            ..Default::default()
        }
    }
}

// Claim with a boolean tag, to help find leaves in the claim assignment graph.
pub struct TaggedClaim(Claim, bool);

#[derive(Clone, Debug, Serialize)]
pub struct BlobAnnotation {
    /// Path to the package's manifest.
    pub manifest: String,
    /// Path of blob in package.
    pub path: String,
}

#[derive(Clone, Debug, Serialize)]
pub enum ResourceAnnotation {
    Blob(BlobAnnotation),
}

/// Resource annotated with additional information.
#[derive(Debug, Serialize)]
pub struct InflatedResource {
    pub resource: Resource,
    pub claims: HashSet<Claim>,
    pub annotations: Vec<ResourceAnnotation>,
}

impl InflatedResource {
    fn new(resource: Resource) -> InflatedResource {
        InflatedResource { resource, claims: Default::default(), annotations: Default::default() }
    }

    fn children(&self) -> Vec<u64> {
        match &self.resource.resource_type {
            fplugin::ResourceType::Job(job) => {
                let mut r: Vec<u64> = job.child_jobs.iter().flatten().map(|k| *k).collect();
                r.extend(job.processes.iter().flatten().map(|k| *k));
                r
            }
            fplugin::ResourceType::Process(process) => {
                process.vmos.iter().flatten().map(|k| *k).collect()
            }
            fplugin::ResourceType::Vmo(_) => Vec::new(),
            _ => todo!(),
        }
    }

    /// Process the claims made on this resource to disambiguate between reassignment and sharing.
    ///
    /// [process_claims] looks at each claim made on this resource, and removes claims that are
    /// reassigned by another claim. This happens if a principal A gives a resource to principal B,
    /// and B then gives it to principal C. However, if two independent principals claim this
    /// resource, then both their claims are kept.
    /// This is done by:
    /// (i)  preserving all self claims, and
    /// (ii) preserving only leaves in the DAG following claim.source to claim.subject edges.
    fn process_claims(&mut self) {
        let mut claims_by_source: FxHashMap<GlobalPrincipalIdentifier, RefCell<Vec<TaggedClaim>>> =
            Default::default();
        let mut self_claims = Vec::new();

        for claim in self.claims.iter().cloned() {
            if claim.source == claim.subject {
                // Self claims are taken out of the graph because they are never transferred. This
                // is to implement sharing.
                self_claims.push(claim);
            } else {
                claims_by_source
                    .entry(claim.source)
                    .or_default()
                    .borrow_mut()
                    .push(TaggedClaim(claim, false));
            }
        }

        self.claims = self_claims.into_iter().collect();
        for (_, claimlist_refcell) in claims_by_source.iter() {
            let mut claimlist = claimlist_refcell.borrow_mut();
            for tagged_claim in claimlist.iter_mut() {
                self.claims.extend(
                    InflatedResource::process_claims_recursive(tagged_claim, &claims_by_source)
                        .into_iter(),
                );
            }
        }
    }

    /// Recursively look at claims to find the ones that are not reassigned.
    fn process_claims_recursive(
        tagged_claim: &mut TaggedClaim,
        claims: &FxHashMap<GlobalPrincipalIdentifier, RefCell<Vec<TaggedClaim>>>,
    ) -> Vec<Claim> {
        let claim = match tagged_claim.1 {
            true => {
                // We have visited this claim already, we can skip.
                return vec![];
            }
            false => {
                // We tag visited claims, so we don't visit them again.
                tagged_claim.1 = true;
                tagged_claim.0
            }
        };
        let subject = &claim.subject;
        // We find if this claim has been reassigned.
        let mut subject_claims = match claims.get(subject) {
            Some(value_ref) => {
                // [subject_claims] mutable borrow is held when recursing below, and
                // [RefCell::try_borrow_mut] returns an error if called when a mutable borrow is
                // already held. This ensures an error will be thrown at runtime if there is a
                // cycle.
                value_ref.try_borrow_mut().expect("Claims form a cycle, this is not supported")
            }
            None => {
                // The claim is not reassigned, we keep the claim.
                return vec![claim];
            }
        };
        let mut leaves = vec![];
        for subject_claim in subject_claims.iter_mut() {
            leaves.append(&mut InflatedResource::process_claims_recursive(subject_claim, claims));
        }
        leaves
    }
}

#[derive(Clone, Serialize)]
/// Holds the list of resources attributed to a Principal (subject) by another Principal (source).
pub struct Attribution {
    /// Principal making the attribution claim.
    pub source: GlobalPrincipalIdentifier,
    /// Principal to which the resources are attributed.
    pub subject: GlobalPrincipalIdentifier,
    /// List of resources attributed to `subject` by `source`.
    pub resources: Vec<ResourceReference>,
}

impl From<fplugin::Attribution> for Attribution {
    fn from(value: fplugin::Attribution) -> Attribution {
        Attribution {
            source: value.source.unwrap().into(),
            subject: value.subject.unwrap().into(),
            resources: value.resources.unwrap().into_iter().map(|r| r.into()).collect(),
        }
    }
}

impl From<Attribution> for fplugin::Attribution {
    fn from(value: Attribution) -> fplugin::Attribution {
        fplugin::Attribution {
            source: Some(value.source.into()),
            subject: Some(value.subject.into()),
            resources: Some(value.resources.into_iter().map(|r| r.into()).collect()),
            ..Default::default()
        }
    }
}

#[derive(Clone, Copy, Serialize)]
/// References a kernel [`Resource`], or some subset of a [`Resource`] (such as a part of a process
/// address space).
pub enum ResourceReference {
    /// Identifies a kernel object whose memory is being attributed.
    ///
    /// Refers to all memory held by VMOs reachable from the object
    /// (currently a Job, Process or VMO).
    KernelObject(u64),

    /// Identifies a part of a process address space.
    ProcessMapped {
        /// The KOID of the process that this VMAR lives in.
        process: u64,

        /// Base address of the VMAR.
        base: u64,

        /// Length of the VMAR.
        len: u64,

        /// True, when enumerating the handle table on this process is superfluous.
        /// This is a hint that can be ignored by the client without changing the result.
        hint_skip_handle_table: bool,
    },
}

impl From<fplugin::ResourceReference> for ResourceReference {
    fn from(value: fplugin::ResourceReference) -> ResourceReference {
        match value {
            fplugin::ResourceReference::KernelObject(ko) => ResourceReference::KernelObject(ko),
            fplugin::ResourceReference::ProcessMapped(fplugin::ProcessMapped {
                process,
                base,
                len,
                hint_skip_handle_table,
            }) => ResourceReference::ProcessMapped { process, base, len, hint_skip_handle_table },
            _ => unimplemented!(),
        }
    }
}

impl From<ResourceReference> for fplugin::ResourceReference {
    fn from(value: ResourceReference) -> fplugin::ResourceReference {
        match value {
            ResourceReference::KernelObject(ko) => fplugin::ResourceReference::KernelObject(ko),
            ResourceReference::ProcessMapped { process, base, len, hint_skip_handle_table } => {
                fplugin::ResourceReference::ProcessMapped(fplugin::ProcessMapped {
                    process,
                    base,
                    len,
                    hint_skip_handle_table,
                })
            }
        }
    }
}

/// Capture of the current memory usage of a device, as retrieved through the memory attribution
/// protocol. In this object, memory attribution is not resolved.
pub struct AttributionData {
    pub principals_vec: Vec<Principal>,
    pub resources_vec: Vec<Resource>,
    pub resource_names: Vec<ZXName>,
    pub attributions: Vec<Attribution>,
}

pub trait AttributionDataProvider: Send + Sync {
    /// Returns all the memory resources and attribution specifications.
    fn get_attribution_data(&self) -> Result<AttributionData, anyhow::Error>;
}

/// Processed snapshot of the memory usage of a device, with attribution of memory resources to
/// Principals resolved.
pub struct ProcessedAttributionData {
    pub principals: FxHashMap<GlobalPrincipalIdentifier, InflatedPrincipal>,
    pub resources: FxHashMap<u64, InflatedResource>,
    pub resource_names: Vec<ZXName>,
}

impl ProcessedAttributionData {
    fn new(
        principals: FxHashMap<GlobalPrincipalIdentifier, InflatedPrincipal>,
        resources: FxHashMap<u64, InflatedResource>,
        resource_names: Vec<ZXName>,
    ) -> Self {
        Self { principals, resources, resource_names }
    }

    /// Create a summary view of the memory attribution_data. See [MemorySummary] for details.
    pub fn summary(&self) -> MemorySummary {
        #[cfg(target_os = "fuchsia")]
        duration!(CATEGORY_MEMORY_CAPTURE, c"ProcessedAttributionData::summary");
        MemorySummary::build(&self.principals, &self.resources, &self.resource_names)
    }
}

/// Process data from a [AttributionData] to resolve attribution claims.
pub fn attribute_vmos(attribution_data: AttributionData) -> ProcessedAttributionData {
    #[cfg(target_os = "fuchsia")]
    duration!(CATEGORY_MEMORY_CAPTURE, c"attribute_vmos");

    // We use a vector + map of indexes instead of a single map to avoid using RefCells to allow
    // modification while iterating. This improves performance.

    // Vector of principals with dense integer indexing.
    let mut principals: Vec<InflatedPrincipal> =
        attribution_data.principals_vec.into_iter().map(InflatedPrincipal::new).collect();

    let principal_by_id: FxHashMap<GlobalPrincipalIdentifier, usize> =
        principals.iter().enumerate().map(|(idx, p)| (p.principal.identifier, idx)).collect();

    // Vector of resources with dense integer indexing.
    let mut resources: Vec<InflatedResource> =
        attribution_data.resources_vec.into_iter().map(InflatedResource::new).collect();

    let resource_by_koid: FxHashMap<u64, usize> =
        resources.iter().enumerate().map(|(idx, r)| (r.resource.koid, idx)).collect();

    // Cache used to avoid repeated heap allocations.
    let mut matched_vmo_indices: Vec<usize> = Vec::new();

    // Add direct claims to resources.
    for attribution in attribution_data.attributions {
        for resource in attribution.resources {
            match resource {
                ResourceReference::KernelObject(koid) => {
                    if let Some(&r_idx) = resource_by_koid.get(&koid) {
                        resources[r_idx].claims.insert(Claim {
                            source: attribution.source,
                            subject: attribution.subject,
                            claim_type: ClaimType::Direct,
                        });
                    }
                }
                ResourceReference::ProcessMapped {
                    process,
                    base,
                    len,
                    hint_skip_handle_table: _,
                } => {
                    if let Some(&principal_idx) = principal_by_id.get(&attribution.subject) {
                        principals[principal_idx].mapped_processes.push(process);
                    }
                    let Some(&process_idx) = resource_by_koid.get(&process) else {
                        continue;
                    };
                    matched_vmo_indices.clear();
                    if let fplugin::ResourceType::Process(process_data) =
                        &resources[process_idx].resource.resource_type
                    {
                        if let Some(mappings) = &process_data.mappings {
                            // Process mappings in Zircon are sorted in ascending order by
                            // address_base. We use partition_point to binary search for the first
                            // mapping in O(log M).
                            let start_idx =
                                mappings.partition_point(|m| m.address_base.unwrap_or(0) < base);
                            let end_bound = base.saturating_add(len);
                            for mapping in &mappings[start_idx..] {
                                let Some(mapping_base) = mapping.address_base else {
                                    continue;
                                };
                                // A mapping has a non-zero size, so we know it is out of bounds.
                                if mapping_base >= end_bound {
                                    break;
                                }
                                let Some(mapping_size) = mapping.size else {
                                    continue;
                                };
                                // We consider an entire VMO to be matched if it has a mapping
                                // within the claimed region.
                                if mapping_base.saturating_add(mapping_size) <= end_bound {
                                    if let Some(vmo_koid) = mapping.vmo {
                                        if let Some(&vmo_idx) = resource_by_koid.get(&vmo_koid) {
                                            matched_vmo_indices.push(vmo_idx);
                                        }
                                    }
                                }
                            }
                        }
                    }
                    for &vmo_idx in &matched_vmo_indices {
                        resources[vmo_idx].claims.insert(Claim {
                            source: attribution.source,
                            subject: attribution.subject,
                            claim_type: ClaimType::Direct,
                        });
                    }
                }
            }
        }
    }

    // Propagate claims. We propagate direct claims to child resources recursively until we hit a
    // resource that is directly claimed: this is because we consider that attributors deeper in the
    // principal hierarchy will not attribute resources higher in the resource hierarchy than the
    // ones attributed by their ancestors (ie. attribution is always more precise as we go deeper).
    for res_idx in 0..resources.len() {
        if !resources[res_idx].claims.iter().any(|c| c.claim_type == ClaimType::Direct) {
            // There is no direct claim to propagate, we can skip this resource.
            continue;
        }

        let propagated_claims: Vec<Claim> = resources[res_idx]
            .claims
            .iter()
            .filter(|c| c.claim_type == ClaimType::Direct)
            .map(|claim| Claim {
                source: claim.source,
                subject: claim.subject,
                claim_type: ClaimType::Indirect,
            })
            .collect();
        let mut frontier = Vec::new();
        frontier.extend(resources[res_idx].children());
        while let Some(child) = frontier.pop() {
            let Some(&child_idx) = resource_by_koid.get(&child) else {
                // This can happen if a resource is created or disappears while we were
                // collecting information about all the resources in the system. This should
                // remain a rare event.
                continue;
            };
            if resources[child_idx].claims.iter().any(|c| c.claim_type == ClaimType::Direct) {
                // If there is a direct claim on the resource, don't propagate.
                continue;
            }
            resources[child_idx].claims.extend(propagated_claims.iter().cloned());
            frontier.extend(resources[child_idx].children());
        }
    }

    for resource in &mut resources {
        resource.process_claims();
    }

    // Reusable buffers to avoid heap allocations per VMO.
    let mut ancestors_buf: Vec<u64> = Vec::with_capacity(8);
    let mut child_claims_buf: Vec<Claim> = Vec::new();

    // Push claimed resources to principals. We are interested in VMOs as the VMOs are the resources
    // actually holding memory. We also keep track of the process to display its name in the output.
    for res_idx in 0..resources.len() {
        let resource_koid = resources[res_idx].resource.koid;
        if let fplugin::ResourceType::Vmo(vmo) = &resources[res_idx].resource.resource_type {
            ancestors_buf.clear();
            ancestors_buf.push(resource_koid);

            // VMOs created by reference don't behave like COW-clones; their byte count is always
            // zero, and all pages are attributed to their parent. This is not what we want here,
            // as we prefer to acknowledge that the pages are shared between the parent and its
            // children. We currently don't have a way to formally distinguish between VMOs created
            // by reference and the other VMOs, so we use the heuristic of checking that they
            // report they are always empty.
            if vmo.total_populated_bytes.unwrap_or_default() == 0 {
                let mut current_parent = vmo.parent;
                child_claims_buf.clear();
                for c in &resources[res_idx].claims {
                    child_claims_buf.push(Claim {
                        subject: c.subject,
                        source: c.source,
                        claim_type: ClaimType::Child,
                    });
                }
                // Add the parents of a VMO as "Child" claims. This is done so that slices of VMOs,
                // with possibly no memory of their own, get attributed the resources of their
                // parent.
                while let Some(parent_koid) = current_parent {
                    if parent_koid == 0 {
                        panic!("Parent is not None but 0.");
                    }
                    // Some VMOs' ancestry is self referential: their parent's koid is set to their
                    // own koid. We want to detect this case and break early to avoid getting
                    // stuck in an infinite loop.
                    if parent_koid == resource_koid {
                        break;
                    }
                    ancestors_buf.push(parent_koid);
                    let Some(&parent_idx) = resource_by_koid.get(&parent_koid) else {
                        break;
                    };
                    resources[parent_idx].claims.extend(child_claims_buf.iter().cloned());
                    current_parent = match &resources[parent_idx].resource.resource_type {
                        fplugin::ResourceType::Job(_) => panic!("This should not happen"),
                        fplugin::ResourceType::Process(_) => panic!("This should not happen"),
                        fplugin::ResourceType::Vmo(current_vmo) => current_vmo.parent,
                        _ => unimplemented!(),
                    };
                }
            }

            for claim in &resources[res_idx].claims {
                if let Some(&p_idx) = principal_by_id.get(&claim.subject) {
                    principals[p_idx].resources.extend_from_slice(&ancestors_buf);
                }
            }
        } else if let fplugin::ResourceType::Process(_) = &resources[res_idx].resource.resource_type
        {
            for claim in &resources[res_idx].claims {
                if let Some(&p_idx) = principal_by_id.get(&claim.subject) {
                    principals[p_idx].resources.push(resource_koid);
                }
            }
        }
    }

    // Sort, deduplicate, and populate principal resource sets once per principal.
    for p in &mut principals {
        if !p.resources.is_empty() {
            p.resources.sort_unstable();
            p.resources.dedup();
        }
    }

    let principals_map = principals.into_iter().map(|p| (p.principal.identifier, p)).collect();
    let resources_map = resources.into_iter().map(|r| (r.resource.koid, r)).collect();

    ProcessedAttributionData::new(principals_map, resources_map, attribution_data.resource_names)
}

#[cfg(test)]
mod tests {
    use super::*;
    use std::collections::HashMap;
    use summary::{PrincipalSummary, VmoSummary};

    #[test]
    fn test_gather_resources() {
        // Create a fake snapshot with 4 principals:
        // root (1)
        //  - runner (2)
        //    - component 4 (4)
        //  - component 3 (3)
        //
        // and the following job/process/vmo hierarchy:
        // root_job (1000)
        //  * root_process (1001)
        //    . root_vmo (1002)
        //    . shared_vmo (1003)
        //  - runner_job (1004)
        //    * runner_process (1005)
        //      . runner_vmo (1006)
        //      . component_vmo (1007)
        //      . component_vmo2 (1012)
        //      . component_vmo3 (1013)
        //  - component_2_job (1008)
        //    * 2_process (1009)
        //      . 2_vmo (1010)
        //      . shared_vmo (1003)
        // And an additional parent VMO for 2_vmo, 2_vmo_parent (1011).

        let resource_names = vec![
            ZXName::from_string_lossy("root_job"),
            ZXName::from_string_lossy("root_process"),
            ZXName::from_string_lossy("root_vmo"),
            ZXName::from_string_lossy("shared_vmo"),
            ZXName::from_string_lossy("runner_job"),
            ZXName::from_string_lossy("runner_process"),
            ZXName::from_string_lossy("runner_vmo"),
            ZXName::from_string_lossy("component_vmo"),
            ZXName::from_string_lossy("component_2_job"),
            ZXName::from_string_lossy("2_process"),
            ZXName::from_string_lossy("2_vmo"),
            ZXName::from_string_lossy("2_vmo_parent"),
            ZXName::from_string_lossy("component_vmo_mapped"),
            ZXName::from_string_lossy("component_vmo_mapped2"),
        ];

        let attributions = vec![
            fplugin::Attribution {
                source: Some(fplugin::PrincipalIdentifier { id: 1 }),
                subject: Some(fplugin::PrincipalIdentifier { id: 1 }),
                resources: Some(vec![fplugin::ResourceReference::KernelObject(1000)]),
                ..Default::default()
            },
            fplugin::Attribution {
                source: Some(fplugin::PrincipalIdentifier { id: 1 }),
                subject: Some(fplugin::PrincipalIdentifier { id: 2 }),
                resources: Some(vec![fplugin::ResourceReference::KernelObject(1004)]),
                ..Default::default()
            },
            fplugin::Attribution {
                source: Some(fplugin::PrincipalIdentifier { id: 1 }),
                subject: Some(fplugin::PrincipalIdentifier { id: 3 }),
                resources: Some(vec![fplugin::ResourceReference::KernelObject(1008)]),
                ..Default::default()
            },
            fplugin::Attribution {
                source: Some(fplugin::PrincipalIdentifier { id: 2 }),
                subject: Some(fplugin::PrincipalIdentifier { id: 4 }),
                resources: Some(vec![
                    fplugin::ResourceReference::KernelObject(1007),
                    fplugin::ResourceReference::ProcessMapped(fplugin::ProcessMapped {
                        process: 1005,
                        base: 1024,
                        len: 1024,
                        hint_skip_handle_table: false,
                    }),
                ]),
                ..Default::default()
            },
        ]
        .into_iter()
        .map(|a| a.into())
        .collect();

        let principals = vec![
            fplugin::Principal {
                identifier: Some(fplugin::PrincipalIdentifier { id: 1 }),
                description: Some(fplugin::Description::Component("component_manager".to_owned())),
                principal_type: Some(fplugin::PrincipalType::Runnable),
                parent: None,
                ..Default::default()
            },
            fplugin::Principal {
                identifier: Some(fplugin::PrincipalIdentifier { id: 2 }),
                description: Some(fplugin::Description::Component("runner".to_owned())),
                principal_type: Some(fplugin::PrincipalType::Runnable),
                parent: Some(fplugin::PrincipalIdentifier { id: 1 }),
                ..Default::default()
            },
            fplugin::Principal {
                identifier: Some(fplugin::PrincipalIdentifier { id: 3 }),
                description: Some(fplugin::Description::Component("component 3".to_owned())),
                principal_type: Some(fplugin::PrincipalType::Runnable),
                parent: Some(fplugin::PrincipalIdentifier { id: 1 }),
                ..Default::default()
            },
            fplugin::Principal {
                identifier: Some(fplugin::PrincipalIdentifier { id: 4 }),
                description: Some(fplugin::Description::Component("component 4".to_owned())),
                principal_type: Some(fplugin::PrincipalType::Runnable),
                parent: Some(fplugin::PrincipalIdentifier { id: 2 }),
                ..Default::default()
            },
        ]
        .into_iter()
        .map(|p| p.into())
        .collect();

        let resources = vec![
            fplugin::Resource {
                koid: Some(1000),
                name_index: Some(0),
                resource_type: Some(fplugin::ResourceType::Job(fplugin::Job {
                    child_jobs: Some(vec![1004, 1008]),
                    processes: Some(vec![1001]),
                    ..Default::default()
                })),
                ..Default::default()
            },
            fplugin::Resource {
                koid: Some(1001),
                name_index: Some(1),
                resource_type: Some(fplugin::ResourceType::Process(fplugin::Process {
                    vmos: Some(vec![1002, 1003]),
                    mappings: None,
                    ..Default::default()
                })),
                ..Default::default()
            },
            fplugin::Resource {
                koid: Some(1002),
                name_index: Some(2),
                resource_type: Some(fplugin::ResourceType::Vmo(fplugin::Vmo {
                    private_committed_bytes: Some(1024),
                    private_populated_bytes: Some(2048),
                    scaled_committed_bytes: Some(1024),
                    scaled_populated_bytes: Some(2048),
                    total_committed_bytes: Some(1024),
                    total_populated_bytes: Some(2048),
                    ..Default::default()
                })),
                ..Default::default()
            },
            fplugin::Resource {
                koid: Some(1003),
                name_index: Some(3),
                resource_type: Some(fplugin::ResourceType::Vmo(fplugin::Vmo {
                    private_committed_bytes: Some(1024),
                    private_populated_bytes: Some(2048),
                    scaled_committed_bytes: Some(1024),
                    scaled_populated_bytes: Some(2048),
                    total_committed_bytes: Some(1024),
                    total_populated_bytes: Some(2048),
                    ..Default::default()
                })),
                ..Default::default()
            },
            fplugin::Resource {
                koid: Some(1004),
                name_index: Some(4),
                resource_type: Some(fplugin::ResourceType::Job(fplugin::Job {
                    child_jobs: Some(vec![]),
                    processes: Some(vec![1005]),
                    ..Default::default()
                })),
                ..Default::default()
            },
            fplugin::Resource {
                koid: Some(1005),
                name_index: Some(5),
                resource_type: Some(fplugin::ResourceType::Process(fplugin::Process {
                    vmos: Some(vec![1006, 1007, 1012]),
                    mappings: Some(vec![
                        fplugin::Mapping {
                            vmo: Some(1006),
                            address_base: Some(0),
                            size: Some(512),
                            ..Default::default()
                        },
                        fplugin::Mapping {
                            vmo: Some(1012),
                            address_base: Some(1024),
                            size: Some(512),
                            ..Default::default()
                        },
                        fplugin::Mapping {
                            vmo: Some(1013),
                            address_base: Some(1536),
                            size: Some(512),
                            ..Default::default()
                        },
                        fplugin::Mapping {
                            vmo: Some(1006),
                            address_base: Some(2048),
                            size: Some(512),
                            ..Default::default()
                        },
                    ]),
                    ..Default::default()
                })),
                ..Default::default()
            },
            fplugin::Resource {
                koid: Some(1006),
                name_index: Some(6),
                resource_type: Some(fplugin::ResourceType::Vmo(fplugin::Vmo {
                    private_committed_bytes: Some(1024),
                    private_populated_bytes: Some(2048),
                    scaled_committed_bytes: Some(1024),
                    scaled_populated_bytes: Some(2048),
                    total_committed_bytes: Some(1024),
                    total_populated_bytes: Some(2048),
                    ..Default::default()
                })),
                ..Default::default()
            },
            fplugin::Resource {
                koid: Some(1007),
                name_index: Some(7),
                resource_type: Some(fplugin::ResourceType::Vmo(fplugin::Vmo {
                    private_committed_bytes: Some(128),
                    private_populated_bytes: Some(256),
                    scaled_committed_bytes: Some(128),
                    scaled_populated_bytes: Some(256),
                    total_committed_bytes: Some(128),
                    total_populated_bytes: Some(256),
                    ..Default::default()
                })),
                ..Default::default()
            },
            fplugin::Resource {
                koid: Some(1008),
                name_index: Some(8),
                resource_type: Some(fplugin::ResourceType::Job(fplugin::Job {
                    child_jobs: Some(vec![]),
                    processes: Some(vec![1009]),
                    ..Default::default()
                })),
                ..Default::default()
            },
            fplugin::Resource {
                koid: Some(1009),
                name_index: Some(9),
                resource_type: Some(fplugin::ResourceType::Process(fplugin::Process {
                    vmos: Some(vec![1010, 1003]),
                    mappings: None,
                    ..Default::default()
                })),
                ..Default::default()
            },
            fplugin::Resource {
                koid: Some(1010),
                name_index: Some(10),
                resource_type: Some(fplugin::ResourceType::Vmo(fplugin::Vmo {
                    parent: Some(1011),
                    private_committed_bytes: Some(1024),
                    private_populated_bytes: Some(2048),
                    scaled_committed_bytes: Some(1024),
                    scaled_populated_bytes: Some(2048),
                    total_committed_bytes: Some(1024),
                    total_populated_bytes: Some(2048),
                    ..Default::default()
                })),
                ..Default::default()
            },
            fplugin::Resource {
                koid: Some(1011),
                name_index: Some(11),
                resource_type: Some(fplugin::ResourceType::Vmo(fplugin::Vmo {
                    private_committed_bytes: Some(1024),
                    private_populated_bytes: Some(2048),
                    scaled_committed_bytes: Some(1024),
                    scaled_populated_bytes: Some(2048),
                    total_committed_bytes: Some(1024),
                    total_populated_bytes: Some(2048),
                    ..Default::default()
                })),
                ..Default::default()
            },
            fplugin::Resource {
                koid: Some(1012),
                name_index: Some(12),
                resource_type: Some(fplugin::ResourceType::Vmo(fplugin::Vmo {
                    private_committed_bytes: Some(1024),
                    private_populated_bytes: Some(2048),
                    scaled_committed_bytes: Some(1024),
                    scaled_populated_bytes: Some(2048),
                    total_committed_bytes: Some(1024),
                    total_populated_bytes: Some(2048),
                    ..Default::default()
                })),
                ..Default::default()
            },
            fplugin::Resource {
                koid: Some(1013),
                name_index: Some(13),
                resource_type: Some(fplugin::ResourceType::Vmo(fplugin::Vmo {
                    private_committed_bytes: Some(1024),
                    private_populated_bytes: Some(2048),
                    scaled_committed_bytes: Some(1024),
                    scaled_populated_bytes: Some(2048),
                    total_committed_bytes: Some(1024),
                    total_populated_bytes: Some(2048),
                    ..Default::default()
                })),
                ..Default::default()
            },
        ]
        .into_iter()
        .map(|r| r.into())
        .collect();

        let output = attribute_vmos(AttributionData {
            principals_vec: principals,
            resources_vec: resources,
            resource_names,
            attributions,
        })
        .summary();

        assert_eq!(output.unclaimed, 2048);
        assert_eq!(output.principals.len(), 4);

        let principals: HashMap<u64, PrincipalSummary> =
            output.principals.into_iter().map(|p| (p.id, p)).collect();

        assert_eq!(
            principals.get(&1).unwrap(),
            &PrincipalSummary {
                id: 1,
                name: "component_manager".to_owned(),
                principal_type: "R".to_owned(),
                committed_private: 1024,
                committed_scaled: 1536.0,
                committed_total: 2048,
                populated_private: 2048,
                populated_scaled: 3072.0,
                populated_total: 4096,
                attributor: None,
                processes: vec!["root_process (1001)".to_owned()],
                vmos: vec![
                    (
                        ZXName::from_string_lossy("root_vmo"),
                        VmoSummary {
                            count: 1,
                            committed_private: 1024,
                            committed_scaled: 1024.0,
                            committed_total: 1024,
                            populated_private: 2048,
                            populated_scaled: 2048.0,
                            populated_total: 2048,
                            ..Default::default()
                        }
                    ),
                    (
                        ZXName::from_string_lossy("shared_vmo"),
                        VmoSummary {
                            count: 1,
                            committed_private: 0,
                            committed_scaled: 512.0,
                            committed_total: 1024,
                            populated_private: 0,
                            populated_scaled: 1024.0,
                            populated_total: 2048,
                            ..Default::default()
                        }
                    )
                ]
                .into_iter()
                .collect(),
            }
        );

        assert_eq!(
            principals.get(&2).unwrap(),
            &PrincipalSummary {
                id: 2,
                name: "runner".to_owned(),
                principal_type: "R".to_owned(),
                committed_private: 1024,
                committed_scaled: 1024.0,
                committed_total: 1024,
                populated_private: 2048,
                populated_scaled: 2048.0,
                populated_total: 2048,
                attributor: Some("component_manager".to_owned()),
                processes: vec!["runner_process (1005)".to_owned()],
                vmos: vec![(
                    ZXName::from_string_lossy("runner_vmo"),
                    VmoSummary {
                        count: 1,
                        committed_private: 1024,
                        committed_scaled: 1024.0,
                        committed_total: 1024,
                        populated_private: 2048,
                        populated_scaled: 2048.0,
                        populated_total: 2048,
                        ..Default::default()
                    }
                )]
                .into_iter()
                .collect(),
            }
        );

        assert_eq!(
            principals.get(&3).unwrap(),
            &PrincipalSummary {
                id: 3,
                name: "component 3".to_owned(),
                principal_type: "R".to_owned(),
                committed_private: 1024,
                committed_scaled: 1536.0,
                committed_total: 2048,
                populated_private: 2048,
                populated_scaled: 3072.0,
                populated_total: 4096,
                attributor: Some("component_manager".to_owned()),
                processes: vec!["2_process (1009)".to_owned()],
                vmos: vec![
                    (
                        ZXName::from_string_lossy("shared_vmo"),
                        VmoSummary {
                            count: 1,
                            committed_private: 0,
                            committed_scaled: 512.0,
                            committed_total: 1024,
                            populated_private: 0,
                            populated_scaled: 1024.0,
                            populated_total: 2048,
                            ..Default::default()
                        }
                    ),
                    (
                        ZXName::from_string_lossy("2_vmo"),
                        VmoSummary {
                            count: 1,
                            committed_private: 1024,
                            committed_scaled: 1024.0,
                            committed_total: 1024,
                            populated_private: 2048,
                            populated_scaled: 2048.0,
                            populated_total: 2048,
                            ..Default::default()
                        }
                    )
                ]
                .into_iter()
                .collect(),
            }
        );

        assert_eq!(
            principals.get(&4).unwrap(),
            &PrincipalSummary {
                id: 4,
                name: "component 4".to_owned(),
                principal_type: "R".to_owned(),
                committed_private: 2176,
                committed_scaled: 2176.0,
                committed_total: 2176,
                populated_private: 4352,
                populated_scaled: 4352.0,
                populated_total: 4352,
                attributor: Some("runner".to_owned()),
                processes: vec!["runner_process (1005)".to_owned()],
                vmos: vec![
                    (
                        ZXName::from_string_lossy("component_vmo"),
                        VmoSummary {
                            count: 1,
                            committed_private: 128,
                            committed_scaled: 128.0,
                            committed_total: 128,
                            populated_private: 256,
                            populated_scaled: 256.0,
                            populated_total: 256,
                            ..Default::default()
                        }
                    ),
                    (
                        ZXName::from_string_lossy("component_vmo_mapped"),
                        VmoSummary {
                            count: 1,
                            committed_private: 1024,
                            committed_scaled: 1024.0,
                            committed_total: 1024,
                            populated_private: 2048,
                            populated_scaled: 2048.0,
                            populated_total: 2048,
                            ..Default::default()
                        }
                    ),
                    (
                        ZXName::from_string_lossy("component_vmo_mapped2"),
                        VmoSummary {
                            count: 1,
                            committed_private: 1024,
                            committed_scaled: 1024.0,
                            committed_total: 1024,
                            populated_private: 2048,
                            populated_scaled: 2048.0,
                            populated_total: 2048,
                            ..Default::default()
                        }
                    )
                ]
                .into_iter()
                .collect(),
            }
        );
    }

    #[test]
    fn test_reshare_resources() {
        // Create a fake snapshot with 3 principals:
        // root (id: 1)
        //  - component 2 (id: 1)
        //    - component 3 (id: 2)
        //
        // and the following job/process/vmo hierarchy:
        // root_job (1000)
        //  - component_job (1001)
        //    * component_process (1002)
        //      . component_vmo (1003)
        //
        // In this scenario, component 2 reattributes component_job to component 3 entirely.

        let resource_names = vec![
            ZXName::from_string_lossy("root_job"),
            ZXName::from_string_lossy("component_job"),
            ZXName::from_string_lossy("component_process"),
            ZXName::from_string_lossy("component_vmo"),
        ];
        let attributions = vec![
            fplugin::Attribution {
                source: Some(fplugin::PrincipalIdentifier { id: 1 }),
                subject: Some(fplugin::PrincipalIdentifier { id: 1 }),
                resources: Some(vec![fplugin::ResourceReference::KernelObject(1000)]),
                ..Default::default()
            },
            fplugin::Attribution {
                source: Some(fplugin::PrincipalIdentifier { id: 1 }),
                subject: Some(fplugin::PrincipalIdentifier { id: 2 }),
                resources: Some(vec![fplugin::ResourceReference::KernelObject(1001)]),
                ..Default::default()
            },
            fplugin::Attribution {
                source: Some(fplugin::PrincipalIdentifier { id: 2 }),
                subject: Some(fplugin::PrincipalIdentifier { id: 3 }),
                resources: Some(vec![fplugin::ResourceReference::KernelObject(1001)]),
                ..Default::default()
            },
        ]
        .into_iter()
        .map(|a| a.into())
        .collect();
        let principals = vec![
            fplugin::Principal {
                identifier: Some(fplugin::PrincipalIdentifier { id: 1 }),
                description: Some(fplugin::Description::Component("component_manager".to_owned())),
                principal_type: Some(fplugin::PrincipalType::Runnable),
                parent: None,
                ..Default::default()
            },
            fplugin::Principal {
                identifier: Some(fplugin::PrincipalIdentifier { id: 2 }),
                description: Some(fplugin::Description::Component("component 2".to_owned())),
                principal_type: Some(fplugin::PrincipalType::Runnable),
                parent: Some(fplugin::PrincipalIdentifier { id: 1 }),
                ..Default::default()
            },
            fplugin::Principal {
                identifier: Some(fplugin::PrincipalIdentifier { id: 3 }),
                description: Some(fplugin::Description::Component("component 3".to_owned())),
                principal_type: Some(fplugin::PrincipalType::Runnable),
                parent: Some(fplugin::PrincipalIdentifier { id: 2 }),
                ..Default::default()
            },
        ]
        .into_iter()
        .map(|p| p.into())
        .collect();

        let resources = vec![
            fplugin::Resource {
                koid: Some(1000),
                name_index: Some(0),
                resource_type: Some(fplugin::ResourceType::Job(fplugin::Job {
                    child_jobs: Some(vec![1001]),
                    processes: Some(vec![]),
                    ..Default::default()
                })),
                ..Default::default()
            },
            fplugin::Resource {
                koid: Some(1001),
                name_index: Some(1),
                resource_type: Some(fplugin::ResourceType::Job(fplugin::Job {
                    child_jobs: Some(vec![]),
                    processes: Some(vec![1002]),
                    ..Default::default()
                })),
                ..Default::default()
            },
            fplugin::Resource {
                koid: Some(1002),
                name_index: Some(2),
                resource_type: Some(fplugin::ResourceType::Process(fplugin::Process {
                    vmos: Some(vec![1003]),
                    mappings: None,
                    ..Default::default()
                })),
                ..Default::default()
            },
            fplugin::Resource {
                koid: Some(1003),
                name_index: Some(3),
                resource_type: Some(fplugin::ResourceType::Vmo(fplugin::Vmo {
                    private_committed_bytes: Some(1024),
                    private_populated_bytes: Some(2048),
                    scaled_committed_bytes: Some(1024),
                    scaled_populated_bytes: Some(2048),
                    total_committed_bytes: Some(1024),
                    total_populated_bytes: Some(2048),
                    ..Default::default()
                })),
                ..Default::default()
            },
        ]
        .into_iter()
        .map(|r| r.into())
        .collect();

        let output = attribute_vmos(AttributionData {
            principals_vec: principals,
            resources_vec: resources,
            resource_names,
            attributions,
        })
        .summary();

        assert_eq!(output.unclaimed, 0);
        assert_eq!(output.principals.len(), 3);

        let principals: HashMap<u64, PrincipalSummary> =
            output.principals.into_iter().map(|p| (p.id, p)).collect();

        assert_eq!(
            principals.get(&1).unwrap(),
            &PrincipalSummary {
                id: 1,
                name: "component_manager".to_owned(),
                principal_type: "R".to_owned(),
                committed_private: 0,
                committed_scaled: 0.0,
                committed_total: 0,
                populated_private: 0,
                populated_scaled: 0.0,
                populated_total: 0,
                attributor: None,
                processes: vec![],
                vmos: vec![].into_iter().collect(),
            }
        );

        assert_eq!(
            principals.get(&2).unwrap(),
            &PrincipalSummary {
                id: 2,
                name: "component 2".to_owned(),
                principal_type: "R".to_owned(),
                committed_private: 0,
                committed_scaled: 0.0,
                committed_total: 0,
                populated_private: 0,
                populated_scaled: 0.0,
                populated_total: 0,
                attributor: Some("component_manager".to_owned()),
                processes: vec![],
                vmos: vec![].into_iter().collect(),
            }
        );

        assert_eq!(
            principals.get(&3).unwrap(),
            &PrincipalSummary {
                id: 3,
                name: "component 3".to_owned(),
                principal_type: "R".to_owned(),
                committed_private: 1024,
                committed_scaled: 1024.0,
                committed_total: 1024,
                populated_private: 2048,
                populated_scaled: 2048.0,
                populated_total: 2048,
                attributor: Some("component 2".to_owned()),
                processes: vec!["component_process (1002)".to_owned()],
                vmos: vec![(
                    ZXName::from_string_lossy("component_vmo"),
                    VmoSummary {
                        count: 1,
                        committed_private: 1024,
                        committed_scaled: 1024.0,
                        committed_total: 1024,
                        populated_private: 2048,
                        populated_scaled: 2048.0,
                        populated_total: 2048,
                        ..Default::default()
                    }
                ),]
                .into_iter()
                .collect(),
            }
        );
    }

    #[test]
    fn test_conversions() {
        let plugin_principal = fplugin::Principal {
            identifier: Some(fplugin::PrincipalIdentifier { id: 2 }),
            description: Some(fplugin::Description::Component("component_manager".to_owned())),
            principal_type: Some(fplugin::PrincipalType::Runnable),
            parent: None,
            ..Default::default()
        };

        let data_principal: Principal = plugin_principal.clone().into();

        assert_eq!(plugin_principal, data_principal.into());

        let plugin_resources = vec![
            fplugin::Resource {
                koid: Some(1000),
                name_index: Some(0),
                resource_type: Some(fplugin::ResourceType::Job(fplugin::Job {
                    child_jobs: Some(vec![1004, 1008]),
                    processes: Some(vec![1001]),
                    ..Default::default()
                })),
                ..Default::default()
            },
            fplugin::Resource {
                koid: Some(1001),
                name_index: Some(1),
                resource_type: Some(fplugin::ResourceType::Process(fplugin::Process {
                    vmos: Some(vec![1002, 1003]),
                    mappings: None,
                    ..Default::default()
                })),
                ..Default::default()
            },
            fplugin::Resource {
                koid: Some(1002),
                name_index: Some(2),
                resource_type: Some(fplugin::ResourceType::Vmo(fplugin::Vmo {
                    private_committed_bytes: Some(1024),
                    private_populated_bytes: Some(2048),
                    scaled_committed_bytes: Some(1024),
                    scaled_populated_bytes: Some(2048),
                    total_committed_bytes: Some(1024),
                    total_populated_bytes: Some(2048),
                    ..Default::default()
                })),
                ..Default::default()
            },
            fplugin::Resource {
                koid: Some(1005),
                name_index: Some(5),
                resource_type: Some(fplugin::ResourceType::Process(fplugin::Process {
                    vmos: Some(vec![1006, 1007, 1012]),
                    mappings: Some(vec![
                        fplugin::Mapping {
                            vmo: Some(1006),
                            address_base: Some(0),
                            size: Some(512),
                            ..Default::default()
                        },
                        fplugin::Mapping {
                            vmo: Some(1012),
                            address_base: Some(1024),
                            size: Some(512),
                            ..Default::default()
                        },
                    ]),
                    ..Default::default()
                })),
                ..Default::default()
            },
        ];

        let data_resources: Vec<Resource> =
            plugin_resources.iter().cloned().map(|r| r.into()).collect();

        let actual_resources: Vec<fplugin::Resource> =
            data_resources.into_iter().map(|r| r.into()).collect();

        assert_eq!(plugin_resources, actual_resources);
    }

    #[test]
    fn test_vmo_reference() {
        // Create a fake snapshot with 3 principals:
        // root (1)
        //  - component 2 (2)
        //
        // and the following job/process/vmo hierarchy:
        // root_job (1000)
        //  - component_job (1001)
        //    * component_process (1002)
        //      . component_vmo (1003)
        // component_vmo_parent (1004)
        //
        // In this scenario, component_vmo is a reference to component_vmo_parent and should get
        // shared attribution of its pages.

        let resource_names = vec![
            name::ZXName::from_string_lossy("root_job"),
            name::ZXName::from_string_lossy("component_job"),
            name::ZXName::from_string_lossy("component_process"),
            name::ZXName::from_string_lossy("component_vmo"),
            name::ZXName::from_string_lossy("component_vmo_parent"),
        ];
        let attributions = vec![
            fplugin::Attribution {
                source: Some(fplugin::PrincipalIdentifier { id: 1 }),
                subject: Some(fplugin::PrincipalIdentifier { id: 1 }),
                resources: Some(vec![fplugin::ResourceReference::KernelObject(1000)]),
                ..Default::default()
            },
            fplugin::Attribution {
                source: Some(fplugin::PrincipalIdentifier { id: 1 }),
                subject: Some(fplugin::PrincipalIdentifier { id: 2 }),
                resources: Some(vec![fplugin::ResourceReference::KernelObject(1001)]),
                ..Default::default()
            },
        ]
        .into_iter()
        .map(|a| a.into())
        .collect();
        let principals = vec![
            fplugin::Principal {
                identifier: Some(fplugin::PrincipalIdentifier { id: 1 }),
                description: Some(fplugin::Description::Component("component_manager".to_owned())),
                principal_type: Some(fplugin::PrincipalType::Runnable),
                parent: None,
                ..Default::default()
            },
            fplugin::Principal {
                identifier: Some(fplugin::PrincipalIdentifier { id: 2 }),
                description: Some(fplugin::Description::Component("component 2".to_owned())),
                principal_type: Some(fplugin::PrincipalType::Runnable),
                parent: Some(fplugin::PrincipalIdentifier { id: 1 }),
                ..Default::default()
            },
        ]
        .into_iter()
        .map(|p| p.into())
        .collect();

        let resources = vec![
            fplugin::Resource {
                koid: Some(1000),
                name_index: Some(0),
                resource_type: Some(fplugin::ResourceType::Job(fplugin::Job {
                    child_jobs: Some(vec![1001]),
                    processes: Some(vec![]),
                    ..Default::default()
                })),
                ..Default::default()
            },
            fplugin::Resource {
                koid: Some(1001),
                name_index: Some(1),
                resource_type: Some(fplugin::ResourceType::Job(fplugin::Job {
                    child_jobs: Some(vec![]),
                    processes: Some(vec![1002]),
                    ..Default::default()
                })),
                ..Default::default()
            },
            fplugin::Resource {
                koid: Some(1002),
                name_index: Some(2),
                resource_type: Some(fplugin::ResourceType::Process(fplugin::Process {
                    vmos: Some(vec![1003]),
                    mappings: None,
                    ..Default::default()
                })),
                ..Default::default()
            },
            fplugin::Resource {
                koid: Some(1003),
                name_index: Some(3),
                resource_type: Some(fplugin::ResourceType::Vmo(fplugin::Vmo {
                    parent: Some(1004),
                    private_committed_bytes: Some(0),
                    private_populated_bytes: Some(0),
                    scaled_committed_bytes: Some(0),
                    scaled_populated_bytes: Some(0),
                    total_committed_bytes: Some(0),
                    total_populated_bytes: Some(0),
                    ..Default::default()
                })),
                ..Default::default()
            },
            fplugin::Resource {
                koid: Some(1004),
                name_index: Some(4),
                resource_type: Some(fplugin::ResourceType::Vmo(fplugin::Vmo {
                    private_committed_bytes: Some(1024),
                    private_populated_bytes: Some(2048),
                    scaled_committed_bytes: Some(1024),
                    scaled_populated_bytes: Some(2048),
                    total_committed_bytes: Some(1024),
                    total_populated_bytes: Some(2048),
                    ..Default::default()
                })),
                ..Default::default()
            },
        ]
        .into_iter()
        .map(|r| r.into())
        .collect();

        let output = attribute_vmos(AttributionData {
            principals_vec: principals,
            resources_vec: resources,
            resource_names,
            attributions,
        })
        .summary();

        assert_eq!(output.unclaimed, 0);
        assert_eq!(output.principals.len(), 2);

        let principals: HashMap<u64, PrincipalSummary> =
            output.principals.into_iter().map(|p| (p.id, p)).collect();

        assert_eq!(
            principals.get(&1).unwrap(),
            &PrincipalSummary {
                id: 1,
                name: "component_manager".to_owned(),
                principal_type: "R".to_owned(),
                committed_private: 0,
                committed_scaled: 0.0,
                committed_total: 0,
                populated_private: 0,
                populated_scaled: 0.0,
                populated_total: 0,
                attributor: None,
                processes: vec![],
                vmos: vec![].into_iter().collect(),
            }
        );

        assert_eq!(
            principals.get(&2).unwrap(),
            &PrincipalSummary {
                id: 2,
                name: "component 2".to_owned(),
                principal_type: "R".to_owned(),
                committed_private: 1024,
                committed_scaled: 1024.0,
                committed_total: 1024,
                populated_private: 2048,
                populated_scaled: 2048.0,
                populated_total: 2048,
                attributor: Some("component_manager".to_owned()),
                processes: vec!["component_process (1002)".to_owned()],
                vmos: vec![
                    (
                        name::ZXName::from_string_lossy("component_vmo"),
                        VmoSummary {
                            count: 1,
                            committed_private: 0,
                            committed_scaled: 0.0,
                            committed_total: 0,
                            populated_private: 0,
                            populated_scaled: 0.0,
                            populated_total: 0,
                            ..Default::default()
                        }
                    ),
                    (
                        name::ZXName::from_string_lossy("component_vmo_parent"),
                        VmoSummary {
                            count: 1,
                            committed_private: 1024,
                            committed_scaled: 1024.0,
                            committed_total: 1024,
                            populated_private: 2048,
                            populated_scaled: 2048.0,
                            populated_total: 2048,
                            ..Default::default()
                        }
                    ),
                ]
                .into_iter()
                .collect(),
            }
        );
    }

    fn make_principal_def(id: u64, name: &str) -> fplugin::Principal {
        fplugin::Principal {
            identifier: Some(fplugin::PrincipalIdentifier { id }),
            description: Some(fplugin::Description::Component(name.to_owned())),
            principal_type: Some(fplugin::PrincipalType::Runnable),
            parent: None,
            ..Default::default()
        }
    }

    fn make_attribution_def(
        source: u64,
        subject: u64,
        resources: Vec<fplugin::ResourceReference>,
    ) -> fplugin::Attribution {
        fplugin::Attribution {
            source: Some(fplugin::PrincipalIdentifier { id: source }),
            subject: Some(fplugin::PrincipalIdentifier { id: subject }),
            resources: Some(resources),
            ..Default::default()
        }
    }

    fn make_test_attribution_data(
        principals: Vec<fplugin::Principal>,
        resources: Vec<fplugin::Resource>,
        resource_names: Vec<name::ZXName>,
        attributions: Vec<fplugin::Attribution>,
    ) -> AttributionData {
        AttributionData {
            principals_vec: principals.into_iter().map(|p| p.into()).collect(),
            resources_vec: resources.into_iter().map(|r| r.into()).collect(),
            resource_names,
            attributions: attributions.into_iter().map(|a| a.into()).collect(),
        }
    }

    /// What is tested: Reassigned claim DAG resolution (`InflatedResource::process_claims`) across
    /// diamond / branching claim topologies.
    ///
    /// Expectations verified:
    /// - Given a resource with claims `1 -> 2`, `2 -> 3`, and `2 -> 4`, `process_claims()` resolves
    ///   the reassignment chain so that Principal 1's claim is reattributed to both leaf subjects
    ///   (`3` and `4`).
    /// - Verifies that the final set of claim subjects on the resource is exactly `{3, 4}`.
    #[test]
    fn test_process_claims_fast_path_and_dag() {
        let mut res = InflatedResource::new(
            fplugin::Resource {
                koid: Some(100),
                name_index: Some(0),
                resource_type: Some(fplugin::ResourceType::Vmo(fplugin::Vmo::default())),
                ..Default::default()
            }
            .into(),
        );
        res.claims.insert(Claim {
            source: GlobalPrincipalIdentifier::new_for_test(1),
            subject: GlobalPrincipalIdentifier::new_for_test(2),
            claim_type: ClaimType::Direct,
        });
        res.claims.insert(Claim {
            source: GlobalPrincipalIdentifier::new_for_test(2),
            subject: GlobalPrincipalIdentifier::new_for_test(3),
            claim_type: ClaimType::Direct,
        });
        res.claims.insert(Claim {
            source: GlobalPrincipalIdentifier::new_for_test(2),
            subject: GlobalPrincipalIdentifier::new_for_test(4),
            claim_type: ClaimType::Direct,
        });

        res.process_claims();

        let mut final_subjects: Vec<u64> = res.claims.iter().map(|c| c.subject.0.get()).collect();
        final_subjects.sort_unstable();
        assert_eq!(final_subjects, vec![3, 4]);
    }

    /// What is tested: Top-down indirect claim propagation across multi-level resource hierarchies
    /// (`Job -> Child Job -> Process -> VMO`) and direct claim overriding.
    ///
    /// Expectations verified:
    /// - When a parent Job (1000) is claimed by Principal 1 and a child Job (1001) is claimed by
    ///   Principal 2, the child Job's direct claim overrides propagation from the parent Job.
    /// - Verifies that the descendant VMO (1003) receives ONLY Principal 2's claim (`subject == 2`)
    ///   and not Principal 1's claim.
    #[test]
    fn test_claim_propagation_hierarchy_and_overrides() {
        let resource_names = vec![
            name::ZXName::from_string_lossy("root_job"),
            name::ZXName::from_string_lossy("child_job"),
            name::ZXName::from_string_lossy("child_proc"),
            name::ZXName::from_string_lossy("child_vmo"),
        ];
        let principals = vec![
            make_principal_def(1, "parent_principal"),
            make_principal_def(2, "child_principal"),
        ];
        let resources = vec![
            fplugin::Resource {
                koid: Some(1000),
                name_index: Some(0),
                resource_type: Some(fplugin::ResourceType::Job(fplugin::Job {
                    child_jobs: Some(vec![1001]),
                    processes: Some(vec![]),
                    ..Default::default()
                })),
                ..Default::default()
            },
            fplugin::Resource {
                koid: Some(1001),
                name_index: Some(1),
                resource_type: Some(fplugin::ResourceType::Job(fplugin::Job {
                    child_jobs: Some(vec![]),
                    processes: Some(vec![1002]),
                    ..Default::default()
                })),
                ..Default::default()
            },
            fplugin::Resource {
                koid: Some(1002),
                name_index: Some(2),
                resource_type: Some(fplugin::ResourceType::Process(fplugin::Process {
                    vmos: Some(vec![1003]),
                    mappings: None,
                    ..Default::default()
                })),
                ..Default::default()
            },
            fplugin::Resource {
                koid: Some(1003),
                name_index: Some(3),
                resource_type: Some(fplugin::ResourceType::Vmo(fplugin::Vmo {
                    private_populated_bytes: Some(1000),
                    scaled_populated_bytes: Some(1000),
                    total_populated_bytes: Some(1000),
                    ..Default::default()
                })),
                ..Default::default()
            },
        ];
        let attributions = vec![
            make_attribution_def(1, 1, vec![fplugin::ResourceReference::KernelObject(1000)]),
            make_attribution_def(2, 2, vec![fplugin::ResourceReference::KernelObject(1001)]),
        ];

        let processed = attribute_vmos(make_test_attribution_data(
            principals,
            resources,
            resource_names,
            attributions,
        ));

        let vmo_res = processed.resources.get(&1003).expect("VMO 1003 should exist");
        let vmo_subjects: HashSet<u64> = vmo_res.claims.iter().map(|c| c.subject.0.get()).collect();
        assert_eq!(vmo_subjects, HashSet::from([2]));
    }

    /// What is tested: VMO ancestry traversal in `attribute_vmos` when a child VMO has 0 populated
    /// bytes (`total_populated_bytes == 0`).
    ///
    /// Expectations verified:
    /// - Multi-generation ancestry (`Child VMO 2003 -> Parent VMO 2002 -> Grandparent VMO 2001`):
    ///   verifies that `ClaimType::Child` claims are added to both parent (2002) and grandparent
    ///   (2001) when the child has 0 populated bytes.
    /// - Self-referential VMO parent (`koid 2004` where `parent = 2004`): verifies that the
    ///   ancestry loop breaks early without infinite looping or hanging.
    /// - Verifies that the principal's `resources` set includes all traversed ancestor KOIDs
    ///   (`2001, 2002, 2003, 2004`).
    #[test]
    fn test_vmo_ancestry_edge_cases() {
        let resource_names = vec![
            name::ZXName::from_string_lossy("grandparent"),
            name::ZXName::from_string_lossy("parent"),
            name::ZXName::from_string_lossy("child"),
            name::ZXName::from_string_lossy("self_ref"),
        ];
        let principals = vec![make_principal_def(1, "vmo_owner")];
        let resources = vec![
            fplugin::Resource {
                koid: Some(2001),
                name_index: Some(0),
                resource_type: Some(fplugin::ResourceType::Vmo(fplugin::Vmo {
                    parent: None,
                    total_populated_bytes: Some(4096),
                    ..Default::default()
                })),
                ..Default::default()
            },
            fplugin::Resource {
                koid: Some(2002),
                name_index: Some(1),
                resource_type: Some(fplugin::ResourceType::Vmo(fplugin::Vmo {
                    parent: Some(2001),
                    total_populated_bytes: Some(4096),
                    ..Default::default()
                })),
                ..Default::default()
            },
            fplugin::Resource {
                koid: Some(2003),
                name_index: Some(2),
                resource_type: Some(fplugin::ResourceType::Vmo(fplugin::Vmo {
                    parent: Some(2002),
                    total_populated_bytes: Some(0),
                    ..Default::default()
                })),
                ..Default::default()
            },
            fplugin::Resource {
                koid: Some(2004),
                name_index: Some(3),
                resource_type: Some(fplugin::ResourceType::Vmo(fplugin::Vmo {
                    parent: Some(2004),
                    total_populated_bytes: Some(0),
                    ..Default::default()
                })),
                ..Default::default()
            },
        ];
        let attributions = vec![
            make_attribution_def(1, 1, vec![fplugin::ResourceReference::KernelObject(2003)]),
            make_attribution_def(1, 1, vec![fplugin::ResourceReference::KernelObject(2004)]),
        ];

        let processed = attribute_vmos(make_test_attribution_data(
            principals,
            resources,
            resource_names,
            attributions,
        ));

        let parent_res = processed.resources.get(&2002).unwrap();
        assert!(parent_res.claims.iter().any(|c| c.claim_type == ClaimType::Child));
        let grandparent_res = processed.resources.get(&2001).unwrap();
        assert!(grandparent_res.claims.iter().any(|c| c.claim_type == ClaimType::Child));

        let p1 = processed.principals.get(&GlobalPrincipalIdentifier::new_for_test(1)).unwrap();
        assert!(p1.resources.contains(&2001));
        assert!(p1.resources.contains(&2002));
        assert!(p1.resources.contains(&2003));
        assert!(p1.resources.contains(&2004));
    }

    /// What is tested: `ResourceReference::ProcessMapped` attribution mapping in `attribute_vmos`
    /// and resilience against missing process KOIDs.
    ///
    /// Expectations verified:
    /// - A valid `ProcessMapped` reference pointing to Process 3001 correctly attributes its
    ///   mapped VMO (3002) to Principal 1.
    /// - A `ProcessMapped` reference pointing to a non-existent Process KOID (`9999`) is silently
    ///   ignored without panicking or aborting attribution processing.
    #[test]
    fn test_process_mapped_attributions() {
        let resource_names =
            vec![name::ZXName::from_string_lossy("proc1"), name::ZXName::from_string_lossy("vmo1")];
        let principals = vec![make_principal_def(1, "mapper_principal")];
        let resources = vec![
            fplugin::Resource {
                koid: Some(3001),
                name_index: Some(0),
                resource_type: Some(fplugin::ResourceType::Process(fplugin::Process {
                    vmos: Some(vec![3002]),
                    mappings: Some(vec![fplugin::Mapping {
                        vmo: Some(3002),
                        address_base: Some(0x1000),
                        size: Some(0x1000),
                        ..Default::default()
                    }]),
                    ..Default::default()
                })),
                ..Default::default()
            },
            fplugin::Resource {
                koid: Some(3002),
                name_index: Some(1),
                resource_type: Some(fplugin::ResourceType::Vmo(fplugin::Vmo {
                    total_populated_bytes: Some(4096),
                    ..Default::default()
                })),
                ..Default::default()
            },
        ];
        let attributions = vec![make_attribution_def(
            1,
            1,
            vec![
                fplugin::ResourceReference::ProcessMapped(fplugin::ProcessMapped {
                    process: 3001,
                    base: 0x1000,
                    len: 0x1000,
                    hint_skip_handle_table: false,
                }),
                fplugin::ResourceReference::ProcessMapped(fplugin::ProcessMapped {
                    process: 9999,
                    base: 0x2000,
                    len: 0x1000,
                    hint_skip_handle_table: false,
                }),
            ],
        )];

        let processed = attribute_vmos(make_test_attribution_data(
            principals,
            resources,
            resource_names,
            attributions,
        ));

        let vmo_res = processed.resources.get(&3002).unwrap();
        let vmo_subjects: HashSet<u64> = vmo_res.claims.iter().map(|c| c.subject.0.get()).collect();
        assert_eq!(vmo_subjects, HashSet::from([1]));
    }

    /// What is tested: Deduplication of KOIDs in `principal.resources` when multiple claims
    /// (Direct, Indirect, Child) apply to the same hierarchy.
    ///
    /// Expectations verified:
    /// - When a principal has both a direct claim on Job 5001 and a direct claim on VMO 5003,
    ///   `principal.resources` contains exactly 2 KOIDs (Process 5002 and VMO 5003, since Jobs are
    ///   not stored in `principal.resources`) without duplicates.
    #[test]
    fn test_attribute_vmos_principal_resources_dedup() {
        let resource_names = vec![
            name::ZXName::from_string_lossy("job"),
            name::ZXName::from_string_lossy("proc"),
            name::ZXName::from_string_lossy("vmo"),
        ];
        let principals = vec![make_principal_def(1, "p1")];
        let resources = vec![
            fplugin::Resource {
                koid: Some(5001),
                name_index: Some(0),
                resource_type: Some(fplugin::ResourceType::Job(fplugin::Job {
                    child_jobs: Some(vec![]),
                    processes: Some(vec![5002]),
                    ..Default::default()
                })),
                ..Default::default()
            },
            fplugin::Resource {
                koid: Some(5002),
                name_index: Some(1),
                resource_type: Some(fplugin::ResourceType::Process(fplugin::Process {
                    vmos: Some(vec![5003]),
                    mappings: None,
                    ..Default::default()
                })),
                ..Default::default()
            },
            fplugin::Resource {
                koid: Some(5003),
                name_index: Some(2),
                resource_type: Some(fplugin::ResourceType::Vmo(fplugin::Vmo {
                    total_populated_bytes: Some(4096),
                    ..Default::default()
                })),
                ..Default::default()
            },
        ];
        let attributions = vec![make_attribution_def(
            1,
            1,
            vec![
                fplugin::ResourceReference::KernelObject(5001),
                fplugin::ResourceReference::KernelObject(5003),
            ],
        )];

        let processed = attribute_vmos(make_test_attribution_data(
            principals,
            resources,
            resource_names,
            attributions,
        ));

        let p1 = processed.principals.get(&GlobalPrincipalIdentifier::new_for_test(1)).unwrap();
        assert_eq!(p1.resources.len(), 2);
        assert!(p1.resources.contains(&5002));
        assert!(p1.resources.contains(&5003));
    }

    /// What is tested: Multi-level VMO ancestry chain resolution and principal resource set
    /// accumulation with multiple principals and overlapping claims.
    ///
    /// Expectations verified:
    /// - Deep ancestry chain: Root VMO 8001 -> Child VMO 8002 (0 bytes) -> Leaf VMO 8003 (0 bytes).
    /// - Leaf VMO 8004 (0 bytes) also shares parent 8002.
    /// - P1 claims Leaf VMO 8003 and Process 8000; P2 claims Leaf VMO 8004.
    /// - Verifies P1 gets {8000, 8001, 8002, 8003} and P2 gets {8001, 8002, 8004}.
    /// - Verifies Child claims are correctly propagated to ancestors 8001 and 8002.
    #[test]
    fn test_vmo_ancestry_and_principal_resource_accumulation() {
        let resource_names = vec![
            name::ZXName::from_string_lossy("proc"),
            name::ZXName::from_string_lossy("root_vmo"),
            name::ZXName::from_string_lossy("mid_vmo"),
            name::ZXName::from_string_lossy("leaf_vmo1"),
            name::ZXName::from_string_lossy("leaf_vmo2"),
        ];
        let principals = vec![make_principal_def(1, "p1"), make_principal_def(2, "p2")];
        let resources = vec![
            fplugin::Resource {
                koid: Some(8000),
                name_index: Some(0),
                resource_type: Some(fplugin::ResourceType::Process(fplugin::Process {
                    vmos: Some(vec![8001, 8002, 8003, 8004]),
                    mappings: None,
                    ..Default::default()
                })),
                ..Default::default()
            },
            fplugin::Resource {
                koid: Some(8001),
                name_index: Some(1),
                resource_type: Some(fplugin::ResourceType::Vmo(fplugin::Vmo {
                    parent: None,
                    total_populated_bytes: Some(8192),
                    ..Default::default()
                })),
                ..Default::default()
            },
            fplugin::Resource {
                koid: Some(8002),
                name_index: Some(2),
                resource_type: Some(fplugin::ResourceType::Vmo(fplugin::Vmo {
                    parent: Some(8001),
                    total_populated_bytes: Some(0),
                    ..Default::default()
                })),
                ..Default::default()
            },
            fplugin::Resource {
                koid: Some(8003),
                name_index: Some(3),
                resource_type: Some(fplugin::ResourceType::Vmo(fplugin::Vmo {
                    parent: Some(8002),
                    total_populated_bytes: Some(0),
                    ..Default::default()
                })),
                ..Default::default()
            },
            fplugin::Resource {
                koid: Some(8004),
                name_index: Some(4),
                resource_type: Some(fplugin::ResourceType::Vmo(fplugin::Vmo {
                    parent: Some(8002),
                    total_populated_bytes: Some(0),
                    ..Default::default()
                })),
                ..Default::default()
            },
        ];
        let attributions = vec![
            make_attribution_def(
                1,
                1,
                vec![
                    fplugin::ResourceReference::KernelObject(8000),
                    fplugin::ResourceReference::KernelObject(8003),
                ],
            ),
            make_attribution_def(1, 2, vec![fplugin::ResourceReference::KernelObject(8004)]),
        ];

        let processed = attribute_vmos(make_test_attribution_data(
            principals,
            resources,
            resource_names,
            attributions,
        ));

        let p1 = processed.principals.get(&GlobalPrincipalIdentifier::new_for_test(1)).unwrap();
        assert_eq!(p1.resources.len(), 4);
        assert!(p1.resources.contains(&8000));
        assert!(p1.resources.contains(&8001));
        assert!(p1.resources.contains(&8002));
        assert!(p1.resources.contains(&8003));

        let p2 = processed.principals.get(&GlobalPrincipalIdentifier::new_for_test(2)).unwrap();
        assert_eq!(p2.resources.len(), 3);
        assert!(p2.resources.contains(&8001));
        assert!(p2.resources.contains(&8002));
        assert!(p2.resources.contains(&8004));

        let mid_vmo = processed.resources.get(&8002).unwrap();
        assert!(
            mid_vmo
                .claims
                .iter()
                .any(|c| c.claim_type == ClaimType::Child && c.subject.0.get() == 1)
        );
        assert!(
            mid_vmo
                .claims
                .iter()
                .any(|c| c.claim_type == ClaimType::Child && c.subject.0.get() == 2)
        );

        let root_vmo = processed.resources.get(&8001).unwrap();
        assert!(
            root_vmo
                .claims
                .iter()
                .any(|c| c.claim_type == ClaimType::Child && c.subject.0.get() == 1)
        );
        assert!(
            root_vmo
                .claims
                .iter()
                .any(|c| c.claim_type == ClaimType::Child && c.subject.0.get() == 2)
        );
    }

    /// What is tested: `ResourceReference::ProcessMapped` binary search (`partition_point`) over
    /// sorted process address mappings and boundary conditions.
    ///
    /// Expectations verified:
    /// - Given 6 mappings sorted by address base across a process address space:
    ///   - mapping 0: `[0x1000, 0x2000]` (VMO 6001) - before range `[0x3000, 0x7000]` -> skipped
    ///   - mapping 1: `[0x3000, 0x4000]` (VMO 6002) - fully inside range -> matched
    ///   - mapping 2: `[0x4000, 0x6000]` (VMO 6003) - fully inside range -> matched
    ///   - mapping 3: `[0x6000, 0x8000]` (VMO 6004) - exceeds upper bound (0x8000 > 0x7000)
    ///                 -> not matched
    ///   - mapping 4: `[0x7000, 0x8000]` (VMO 6005) - base == 0x7000 == end_bound
    ///                 -> triggers early loop break (mapping_base >= end_bound)
    ///   - mapping 5: `[0xa000, 0xb000]` (VMO 6006) - after break -> never visited
    /// - Verifies that only VMO 6002 and VMO 6003 are attributed, and `PrincipalSummary.processes`
    ///   correctly contains the mapped process.
    #[test]
    fn test_process_mapped_binary_search_and_boundaries() {
        let resource_names = vec![
            name::ZXName::from_string_lossy("test_proc"),
            name::ZXName::from_string_lossy("vmo1"),
            name::ZXName::from_string_lossy("vmo2"),
            name::ZXName::from_string_lossy("vmo3"),
            name::ZXName::from_string_lossy("vmo4"),
            name::ZXName::from_string_lossy("vmo5"),
            name::ZXName::from_string_lossy("vmo6"),
        ];
        let principals = vec![make_principal_def(1, "vmar_principal")];
        let resources = vec![
            fplugin::Resource {
                koid: Some(6000),
                name_index: Some(0),
                resource_type: Some(fplugin::ResourceType::Process(fplugin::Process {
                    vmos: Some(vec![6001, 6002, 6003, 6004, 6005, 6006]),
                    mappings: Some(vec![
                        fplugin::Mapping {
                            vmo: Some(6001),
                            address_base: Some(0x1000),
                            size: Some(0x1000),
                            ..Default::default()
                        },
                        fplugin::Mapping {
                            vmo: Some(6002),
                            address_base: Some(0x3000),
                            size: Some(0x1000),
                            ..Default::default()
                        },
                        fplugin::Mapping {
                            vmo: Some(6003),
                            address_base: Some(0x4000),
                            size: Some(0x2000),
                            ..Default::default()
                        },
                        fplugin::Mapping {
                            vmo: Some(6004),
                            address_base: Some(0x6000),
                            size: Some(0x2000),
                            ..Default::default()
                        },
                        fplugin::Mapping {
                            vmo: Some(6005),
                            address_base: Some(0x7000),
                            size: Some(0x1000),
                            ..Default::default()
                        },
                        fplugin::Mapping {
                            vmo: Some(6006),
                            address_base: Some(0xa000),
                            size: Some(0x1000),
                            ..Default::default()
                        },
                    ]),
                    ..Default::default()
                })),
                ..Default::default()
            },
            fplugin::Resource {
                koid: Some(6001),
                name_index: Some(1),
                resource_type: Some(fplugin::ResourceType::Vmo(fplugin::Vmo {
                    private_committed_bytes: Some(4096),
                    private_populated_bytes: Some(4096),
                    scaled_committed_bytes: Some(4096),
                    scaled_populated_bytes: Some(4096),
                    total_committed_bytes: Some(4096),
                    total_populated_bytes: Some(4096),
                    ..Default::default()
                })),
                ..Default::default()
            },
            fplugin::Resource {
                koid: Some(6002),
                name_index: Some(2),
                resource_type: Some(fplugin::ResourceType::Vmo(fplugin::Vmo {
                    private_committed_bytes: Some(4096),
                    private_populated_bytes: Some(4096),
                    scaled_committed_bytes: Some(4096),
                    scaled_populated_bytes: Some(4096),
                    total_committed_bytes: Some(4096),
                    total_populated_bytes: Some(4096),
                    ..Default::default()
                })),
                ..Default::default()
            },
            fplugin::Resource {
                koid: Some(6003),
                name_index: Some(3),
                resource_type: Some(fplugin::ResourceType::Vmo(fplugin::Vmo {
                    private_committed_bytes: Some(8192),
                    private_populated_bytes: Some(8192),
                    scaled_committed_bytes: Some(8192),
                    scaled_populated_bytes: Some(8192),
                    total_committed_bytes: Some(8192),
                    total_populated_bytes: Some(8192),
                    ..Default::default()
                })),
                ..Default::default()
            },
            fplugin::Resource {
                koid: Some(6004),
                name_index: Some(4),
                resource_type: Some(fplugin::ResourceType::Vmo(fplugin::Vmo {
                    private_committed_bytes: Some(8192),
                    private_populated_bytes: Some(8192),
                    scaled_committed_bytes: Some(8192),
                    scaled_populated_bytes: Some(8192),
                    total_committed_bytes: Some(8192),
                    total_populated_bytes: Some(8192),
                    ..Default::default()
                })),
                ..Default::default()
            },
            fplugin::Resource {
                koid: Some(6005),
                name_index: Some(5),
                resource_type: Some(fplugin::ResourceType::Vmo(fplugin::Vmo {
                    private_committed_bytes: Some(4096),
                    private_populated_bytes: Some(4096),
                    scaled_committed_bytes: Some(4096),
                    scaled_populated_bytes: Some(4096),
                    total_committed_bytes: Some(4096),
                    total_populated_bytes: Some(4096),
                    ..Default::default()
                })),
                ..Default::default()
            },
            fplugin::Resource {
                koid: Some(6006),
                name_index: Some(6),
                resource_type: Some(fplugin::ResourceType::Vmo(fplugin::Vmo {
                    private_committed_bytes: Some(4096),
                    private_populated_bytes: Some(4096),
                    scaled_committed_bytes: Some(4096),
                    scaled_populated_bytes: Some(4096),
                    total_committed_bytes: Some(4096),
                    total_populated_bytes: Some(4096),
                    ..Default::default()
                })),
                ..Default::default()
            },
        ];
        let attributions = vec![make_attribution_def(
            1,
            1,
            vec![fplugin::ResourceReference::ProcessMapped(fplugin::ProcessMapped {
                process: 6000,
                base: 0x3000,
                len: 0x4000,
                hint_skip_handle_table: false,
            })],
        )];

        let processed = attribute_vmos(make_test_attribution_data(
            principals,
            resources,
            resource_names,
            attributions,
        ));

        // VMO 6002 and 6003 should have claims from Principal 1
        assert_eq!(
            processed
                .resources
                .get(&6002)
                .unwrap()
                .claims
                .iter()
                .map(|c| c.subject.0.get())
                .collect::<Vec<_>>(),
            vec![1]
        );
        assert_eq!(
            processed
                .resources
                .get(&6003)
                .unwrap()
                .claims
                .iter()
                .map(|c| c.subject.0.get())
                .collect::<Vec<_>>(),
            vec![1]
        );
        // VMO 6001, 6004, 6005, 6006 should have no claims
        assert!(processed.resources.get(&6001).unwrap().claims.is_empty());
        assert!(processed.resources.get(&6004).unwrap().claims.is_empty());
        assert!(processed.resources.get(&6005).unwrap().claims.is_empty());
        assert!(processed.resources.get(&6006).unwrap().claims.is_empty());

        let summary = processed.summary();
        assert_eq!(summary.principals.len(), 1);
        assert_eq!(summary.principals[0].processes, vec!["test_proc (6000)".to_owned()]);
    }
}