Tell the person where it hurts
A fault stopped the machine and printed a line to standard error. On a terminal that is a diagnosis. Behind a window it is a frozen picture and no reason at all, because the message went somewhere nobody was looking - the machine looked hung and was not. It had stopped, and said so invisibly. CosmOS catches all five faults now and says what happened on the screen, with the address, in red. A FAULT ENDS THE PROGRAM, NOT THE MACHINE. That is the answer to "carry on or start again", and it is not a compromise: a bare RETI from most of these meets the instruction that failed and fails again, so carrying on was never on offer. But the machine is almost never what is broken. Everything the shell puts back when a program exits - the Stack, its vectors, the drive, the working directory, the console, the screen - is exactly what wants putting back after one dies, so the handler sets a status and joins handleExit. You are back at the prompt, and the program is recorded as having STOPPED rather than finished, because saying "finished" under a red fault message would be the shell contradicting itself. A fault below where programs load is the system's own, and there is nothing to go back to. That one says so and stops. THE SCREEN GOES BACK TO A MODE TEXT CAN BE SEEN IN, and that is the part that matters rather than the part that is prettiest. A program that faulted in bitmap mode left the console with no text rows, so it draws nothing at all: the message would be perfectly correct and completely invisible, which is the one thing it must never be. Two palette entries go back for the same reason, since a program that wrote its own colours can leave every ink the same as every paper. Only the two the message needs, so the rest of what the program chose is left alone. Both halves are checked by looking at the PICTURE, because the serial line was never where the problem was. Crash blind ruins the palette and drops into bitmap mode before it faults; without the mode the screen comes back 320 by 200 with nothing on it, and without the palette it is the right size with the message present and unreadable. Each break loses the red on its own. Crash is also a program worth having: it breaks in whichever of the five ways you name, so a fault screen can be looked at without having written a bug first. Two things found on the way: The native assembler keeps its OWN copy of the reserved vector names, so it did not know NoHandler or NoDevice and built a cosmos.bin that differed from the host assembler's. Caught by native.sh, which is exactly the drift that test exists for. And cosmosMonitor had dead input. It assembles code into 0x8000 and runs it, and that code faults - which used to kill the machine, so everything after it in the file had never run. It runs now, and the recording grew by sixty lines of monitor session that had been unreachable since the day the fault was put there. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01E2JrLzFvuFX9fgi1LDRjrW
This commit is contained in:
Anachronaut
co-authored by
Claude Opus 5
Claude Opus 5
parent
000a6d39cb
commit
fd9c4c75f8
Executable
+277
@@ -0,0 +1,277 @@
|
||||
#!/usr/bin/env bash
|
||||
# Checks SplitDisk against the SBFS format.
|
||||
#
|
||||
# The tool and the SplitBit side are two implementations of one written specification,
|
||||
# and nothing but that document keeps them the same. This checks the host half on its
|
||||
# own: that a file put onto a disk comes back off it byte for byte, that the sizes which
|
||||
# exercise the block and tail arithmetic all survive, and that the things the format
|
||||
# says cannot happen are refused rather than half done.
|
||||
#
|
||||
# Written by Anachronaut
|
||||
|
||||
set -u
|
||||
ROOT="$(cd "$(dirname "$0")/.." && pwd)"
|
||||
TOOL="$ROOT/SplitDisk"
|
||||
WORK="$ROOT/Tests/build/disk"
|
||||
|
||||
PASS=0
|
||||
FAIL=0
|
||||
FAILED_NAMES=()
|
||||
|
||||
GREEN=$'\033[32m'; RED=$'\033[31m'; RESET=$'\033[0m'
|
||||
[ -t 1 ] || { GREEN=""; RED=""; RESET=""; }
|
||||
|
||||
check() {
|
||||
local name="$1"; shift
|
||||
if "$@" >/dev/null 2>&1; then
|
||||
PASS=$((PASS + 1)); printf " [%sok %s] %s\n" "$GREEN" "$RESET" "$name"
|
||||
else
|
||||
FAIL=$((FAIL + 1)); FAILED_NAMES+=("$name")
|
||||
printf " [%sFAIL%s] %s\n" "$RED" "$RESET" "$name"
|
||||
fi
|
||||
}
|
||||
|
||||
# The opposite: the command is supposed to fail, and passing would be the bug.
|
||||
refuses() {
|
||||
local name="$1"; shift
|
||||
if "$@" >/dev/null 2>&1; then
|
||||
FAIL=$((FAIL + 1)); FAILED_NAMES+=("$name")
|
||||
printf " [%sFAIL%s] %s (it was allowed)\n" "$RED" "$RESET" "$name"
|
||||
else
|
||||
PASS=$((PASS + 1)); printf " [%sok %s] %s\n" "$GREEN" "$RESET" "$name"
|
||||
fi
|
||||
}
|
||||
|
||||
if [ ! -x "$TOOL" ]; then
|
||||
echo "SplitDisk is not built."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
rm -rf "$WORK"; mkdir -p "$WORK"
|
||||
cd "$WORK" || exit 1
|
||||
|
||||
echo "Checking SplitDisk against the SBFS format."
|
||||
|
||||
check "format a disk" "$TOOL" format work.img 64 2
|
||||
refuses "refuse a disk with no room" "$TOOL" format tiny.img 2 4
|
||||
refuses "refuse an unformatted disk" "$TOOL" list /dev/null
|
||||
|
||||
# The sizes that exercise every corner of blocks-plus-tail: nothing at all, less than a
|
||||
# block, exactly a block, a part block, and an exact multiple.
|
||||
: > empty.bin
|
||||
printf 'x' > one.bin
|
||||
head -c 256 /dev/urandom > exact.bin
|
||||
head -c 700 /dev/urandom > part.bin
|
||||
head -c 768 /dev/urandom > whole.bin
|
||||
|
||||
for f in empty.bin one.bin exact.bin part.bin whole.bin; do
|
||||
check "put $f" "$TOOL" put work.img "$f"
|
||||
done
|
||||
|
||||
roundTrip() {
|
||||
"$TOOL" get work.img "$1" "got_$1" >/dev/null 2>&1 || return 1
|
||||
cmp -s "$1" "got_$1"
|
||||
}
|
||||
for f in empty.bin one.bin exact.bin part.bin whole.bin; do
|
||||
check "$f comes back byte for byte" roundTrip "$f"
|
||||
done
|
||||
|
||||
refuses "refuse a name of 29 characters" "$TOOL" put work.img part.bin twentyNineCharactersLong.asm
|
||||
refuses "refuse a duplicate name" "$TOOL" put work.img one.bin
|
||||
refuses "refuse a file that is not there" "$TOOL" get work.img nosuch.bin out.bin
|
||||
check "delete" "$TOOL" delete work.img one.bin
|
||||
refuses "the deleted file is gone" "$TOOL" get work.img one.bin out.bin
|
||||
check "the name can be used again" "$TOOL" put work.img one.bin
|
||||
|
||||
# Contiguous files mean a disk can have room without having room in one piece. That is a
|
||||
# consequence of the format rather than a bug, so it is checked rather than worked around.
|
||||
"$TOOL" format frag.img 16 1 >/dev/null 2>&1
|
||||
head -c 1024 /dev/urandom > a.bin; cp a.bin b.bin; cp a.bin c.bin
|
||||
"$TOOL" put frag.img a.bin >/dev/null 2>&1
|
||||
"$TOOL" put frag.img b.bin >/dev/null 2>&1
|
||||
"$TOOL" put frag.img c.bin >/dev/null 2>&1
|
||||
"$TOOL" delete frag.img a.bin >/dev/null 2>&1
|
||||
"$TOOL" delete frag.img c.bin >/dev/null 2>&1
|
||||
head -c 2048 /dev/urandom > big.bin
|
||||
refuses "refuse a file with no run long enough" "$TOOL" put frag.img big.bin
|
||||
head -c 512 /dev/urandom > fits.bin
|
||||
check "but one that fits the gap goes on" "$TOOL" put frag.img fits.bin
|
||||
|
||||
# ---- Directories ----
|
||||
#
|
||||
# Version two, which adds a parent to each entry and a flag bit saying an entry is a
|
||||
# directory. Both come out of bytes the entry had already set aside, so nothing moved and
|
||||
# a version one disk needs no converting: zero in those bytes means the root, which is
|
||||
# exactly where every file on a flat disk is.
|
||||
#
|
||||
# The version is therefore a statement about what is ON a disk rather than about what made
|
||||
# it, and these check that it is only raised when it becomes true.
|
||||
"$TOOL" format tree.img 64 2 >/dev/null 2>&1
|
||||
printf 'a file in the root' > root.txt
|
||||
check "a fresh disk is flat" "$TOOL" put tree.img root.txt
|
||||
version() { "$TOOL" list "$1" 2>/dev/null | head -1 | grep -q "version $2"; }
|
||||
check "and says it is version 1" version tree.img 1
|
||||
check "make a directory" "$TOOL" mkdir tree.img /Apps
|
||||
check "which raises it to version 2" version tree.img 2
|
||||
check "make one inside it" "$TOOL" mkdir tree.img /Apps/Source
|
||||
check "put a file down a path" "$TOOL" put tree.img root.txt /Apps/Source/deep.txt
|
||||
|
||||
# The point of the whole exercise: a name means something different in each place, so the
|
||||
# same one can be used twice without either being in the other's way.
|
||||
check "the same name in two places" "$TOOL" put tree.img root.txt /Apps/root.txt
|
||||
roundTripAt() {
|
||||
"$TOOL" get tree.img "$1" got_deep.txt >/dev/null 2>&1 || return 1
|
||||
cmp -s root.txt got_deep.txt
|
||||
}
|
||||
check "it comes back byte for byte" roundTripAt /Apps/Source/deep.txt
|
||||
check ". and .. walk the path" roundTripAt /Apps/./Source/../root.txt
|
||||
check ".. from the root is the root" roundTripAt /Apps/../../root.txt
|
||||
|
||||
# Each of these is a way the tree could be made to contradict itself, and each is refused
|
||||
# rather than half done.
|
||||
refuses "no file where a directory goes" "$TOOL" put tree.img root.txt /root.txt/x.txt
|
||||
refuses "no putting into thin air" "$TOOL" put tree.img root.txt /Nowhere/x.txt
|
||||
refuses "no duplicate in one directory" "$TOOL" mkdir tree.img /Apps
|
||||
refuses "no getting a directory" "$TOOL" get tree.img /Apps out.bin
|
||||
refuses "delete will not take a directory" "$TOOL" delete tree.img /Apps
|
||||
refuses "rmdir will not take a file" "$TOOL" rmdir tree.img /root.txt
|
||||
refuses "nor the root" "$TOOL" rmdir tree.img /
|
||||
|
||||
# THE REFUSAL THAT MATTERS MOST. Parents are entry indices and a freed index is handed out
|
||||
# again, so removing a directory with things still in it would let the next file created
|
||||
# adopt them. Emptying it first is the only safe order.
|
||||
refuses "no removing an occupied one" "$TOOL" rmdir tree.img /Apps/Source
|
||||
check "empty it first" "$TOOL" delete tree.img /Apps/Source/deep.txt
|
||||
check "then it goes" "$TOOL" rmdir tree.img /Apps/Source
|
||||
|
||||
# A path is names with separators between them, and a name is still twenty two characters.
|
||||
refuses "refuse a 23 character component" "$TOOL" mkdir tree.img /Apps/abcdefghijklmnopqrstuvw
|
||||
refuses "refuse a path naming nothing" "$TOOL" mkdir tree.img /Apps/
|
||||
|
||||
# A directory costs an entry and no blocks at all, which is what keeps the flat array of
|
||||
# entries the whole allocation map. If a directory ever took a block, this would drop.
|
||||
blocksFree() { "$TOOL" list "$1" 2>/dev/null | tail -1 | sed 's/.*used, //; s/ blocks free.*//'; }
|
||||
before=$(blocksFree tree.img)
|
||||
"$TOOL" mkdir tree.img /Empty >/dev/null 2>&1
|
||||
check "a directory costs no blocks" [ "$before" = "$(blocksFree tree.img)" ]
|
||||
|
||||
# ---- A directory no bigger than the parent field can name ----
|
||||
#
|
||||
# Eight entries to a block and the parent is an index plus one in two bytes, so entry
|
||||
# 65535 has no parent number: adding one wraps to zero, and zero is the root. Such an
|
||||
# entry does not refuse what is put inside it. It writes the thing into the ROOT while
|
||||
# reporting the path that was asked for, and then cannot find it again - so the same
|
||||
# create succeeds over and over, piling up entries of one name in one directory, which is
|
||||
# the exact corruption rename exists to refuse.
|
||||
refuses "no directory past the wrap" "$TOOL" format huge.img 65535 8192
|
||||
check "the largest that fits" "$TOOL" format huge.img 65535 8191
|
||||
|
||||
# And a disk claiming one, which is what something that never checked would have written.
|
||||
# The claim is in the superblock, so it does not need a disk that size to be made.
|
||||
"$TOOL" format lying.img 64 2 >/dev/null
|
||||
printf '\x20\x00' | dd of=lying.img bs=1 seek=10 conv=notrunc status=none
|
||||
refuses "nor reading one that claims it" "$TOOL" list lying.img
|
||||
|
||||
# ---- A boot area, and the two halves of the superblock that describe it ----
|
||||
#
|
||||
# bootBlocks and directoryStart say the same thing from two sides, so a disk where they
|
||||
# disagree is one where there is no way to tell which is wrong. Both are refused.
|
||||
check "format with a boot area" "$TOOL" format boot.img 512 4 32
|
||||
check "and it reads back" "$TOOL" list boot.img
|
||||
refuses "no boot area bigger than a disk" "$TOOL" format small.img 32 2 64
|
||||
check "and none at all is still fine" "$TOOL" format plain.img 64 2
|
||||
|
||||
bootField() { python3 -c "
|
||||
import sys
|
||||
f = open(sys.argv[1], 'r+b'); f.seek(int(sys.argv[2])); f.write(bytes.fromhex(sys.argv[3]))
|
||||
" "$@"; }
|
||||
cp boot.img lying.boot.img
|
||||
bootField lying.boot.img 14 0010 # Claims 16 blocks a slot, directory says 32.
|
||||
refuses "nor a boot area that disagrees" "$TOOL" list lying.boot.img
|
||||
cp boot.img badslot.img
|
||||
bootField badslot.img 16 07 # Names slot 7, and there are two.
|
||||
refuses "nor a slot that does not exist" "$TOOL" list badslot.img
|
||||
|
||||
# ---- Writing a boot slot, and choosing between them ----
|
||||
#
|
||||
# Two commands rather than one, deliberately: writing a slot and starting from it are
|
||||
# different decisions, and joining them would make every write a commitment.
|
||||
printf 'not really a bootloader' > stage.bin
|
||||
check "write a boot slot" "$TOOL" boot boot.img stage.bin 0
|
||||
check "and the other one" "$TOOL" boot boot.img stage.bin 1
|
||||
check "choose which one starts" "$TOOL" bootslot boot.img 1
|
||||
refuses "no third slot to write" "$TOOL" boot boot.img stage.bin 2
|
||||
refuses "nor a third to choose" "$TOOL" bootslot boot.img 2
|
||||
refuses "no boot slot without an area" "$TOOL" boot plain.img stage.bin 0
|
||||
|
||||
# A slot holds what it holds. Something too big for one is refused rather than cut off,
|
||||
# because half a bootloader is the failure with no way back.
|
||||
head -c 9000 /dev/zero > toobig.bin # A slot on boot.img is 32 blocks, so 8192.
|
||||
refuses "nor more than a slot holds" "$TOOL" boot boot.img toobig.bin 0
|
||||
|
||||
# THE WHOLE SLOT IS WRITTEN, not just the part the file fills. A slot still holding the
|
||||
# tail of whatever was there before is one whose contents depend on its history.
|
||||
printf 'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa' > long.bin
|
||||
"$TOOL" boot boot.img long.bin 0 >/dev/null
|
||||
"$TOOL" boot boot.img stage.bin 0 >/dev/null
|
||||
check "and it is written whole" python3 -c "
|
||||
import sys
|
||||
d = open('boot.img','rb').read()
|
||||
slot = d[256:256 + 32 * 256]
|
||||
sys.exit(1 if b'aaaa' in slot else 0)"
|
||||
|
||||
# ---- How the last start went ----
|
||||
check "the boot state reads" "$TOOL" bootstate boot.img
|
||||
check "and can be set" "$TOOL" bootstate boot.img 2
|
||||
refuses "but only to a state there is" "$TOOL" bootstate boot.img 7
|
||||
check "a fresh disk is settled" python3 -c "
|
||||
import sys
|
||||
sys.exit(0 if open('plain.img','rb').read()[17] == 0 else 1)"
|
||||
|
||||
# ---- Mirroring a host directory ----
|
||||
#
|
||||
# What the system disk is built with. Every file goes through put and every directory
|
||||
# through mkdir, so this is a walk over machinery already checked above - what wants
|
||||
# checking is the walk: that it goes all the way down, that it leaves behind what it was
|
||||
# told to, and that it REFUSES a name the format cannot hold rather than skipping it, since
|
||||
# a disk quietly missing a file is the failure a mirror exists to prevent.
|
||||
mkdir -p tree/inner/deeper tree/leave
|
||||
printf 'top' > tree/top.txt
|
||||
printf 'inner' > tree/inner/middle.txt
|
||||
printf 'deep' > tree/inner/deeper/bottom.txt
|
||||
printf 'not this' > tree/leave/ignored.txt
|
||||
: > tree/.hidden
|
||||
|
||||
"$TOOL" format mirror.img 256 8 >/dev/null
|
||||
check "mirror a directory tree" "$TOOL" mirror mirror.img tree /
|
||||
|
||||
"$TOOL" list mirror.img > mirrored.txt 2>&1
|
||||
grep -q '/inner/deeper/bottom.txt' mirrored.txt \
|
||||
&& { PASS=$((PASS + 1)); printf " [%sok %s] %s\n" "$GREEN" "$RESET" "it goes all the way down"; } \
|
||||
|| { FAIL=$((FAIL + 1)); FAILED_NAMES+=("depth"); printf " [%sFAIL%s] %s\n" "$RED" "$RESET" "it goes all the way down"; }
|
||||
grep -q 'hidden' mirrored.txt \
|
||||
&& { FAIL=$((FAIL + 1)); FAILED_NAMES+=("hidden"); printf " [%sFAIL%s] %s\n" "$RED" "$RESET" "and leaves dotfiles behind"; } \
|
||||
|| { PASS=$((PASS + 1)); printf " [%sok %s] %s\n" "$GREEN" "$RESET" "and leaves dotfiles behind"; }
|
||||
|
||||
# Named on the command line, which is how a project keeps what it builds out of what it
|
||||
# wrote.
|
||||
"$TOOL" format skipped.img 256 8 >/dev/null
|
||||
check "mirror with something left out" "$TOOL" mirror skipped.img tree / leave
|
||||
"$TOOL" list skipped.img > skipped.txt 2>&1
|
||||
grep -q 'ignored.txt' skipped.txt \
|
||||
&& { FAIL=$((FAIL + 1)); FAILED_NAMES+=("skip"); printf " [%sFAIL%s] %s\n" "$RED" "$RESET" "and the skipped one is not there"; } \
|
||||
|| { PASS=$((PASS + 1)); printf " [%sok %s] %s\n" "$GREEN" "$RESET" "and the skipped one is not there"; }
|
||||
|
||||
# Twenty-three characters, one more than a directory entry holds.
|
||||
printf 'too long' > tree/aNameOfTwentyThreeChars
|
||||
"$TOOL" format refused.img 256 8 >/dev/null
|
||||
refuses "a name too long stops the mirror" "$TOOL" mirror refused.img tree /
|
||||
rm -f tree/aNameOfTwentyThreeChars
|
||||
|
||||
echo
|
||||
if [ "$FAIL" -eq 0 ]; then
|
||||
echo "All $PASS disk tool checks passed."
|
||||
exit 0
|
||||
fi
|
||||
echo "$PASS passed, $FAIL failed: ${FAILED_NAMES[*]}"
|
||||
exit 1
|
||||
Reference in New Issue
Block a user