Anachronaut
d6cbbb5034
The streamed commit is bounded, the memory map is checked against itself, and the save guarantee says what it is. Three left: the temporary-file namespace, one path length both implementations agree on, and a bound on directory entries that keeps every one of them nameable as a parent.
61 lines
3.0 KiB
Markdown
61 lines
3.0 KiB
Markdown
# Delete me after these things are fixed
|
|
|
|
Temporary notes from the SBFS v2 and CosmOS review, in priority order.
|
|
|
|
## Protect the temporary-file namespace
|
|
|
|
Whole-file saves and streamed writes use the fixed names `sbfs.part` and `sbfs.out`.
|
|
Starting another operation deletes an existing entry with the corresponding name as stale
|
|
temporary output, but these are otherwise legal user filenames. A real user file with one
|
|
of those names can therefore be deleted.
|
|
|
|
Possible resolutions:
|
|
|
|
- Reserve these names and refuse ordinary creation under them.
|
|
- Use a spare descriptor flag to identify temporary entries, and clean up by identity
|
|
rather than by name.
|
|
- Move temporary artifacts into a defined `/tmp` policy where appropriate. A stream's
|
|
temporary currently needs to be in the destination directory because rename changes a
|
|
name but not a parent, so `/tmp` alone may require adding a move operation.
|
|
|
|
Whatever rule is chosen should be enforced in both SplitDisk and the native SBFS code and
|
|
documented as part of the format or CosmOS policy.
|
|
|
|
## Establish one portable path-length limit
|
|
|
|
SplitDisk carries paths up to 511 characters, while the native path machinery appears to
|
|
use a 255-byte limit. Paths are not stored on disk, so this does not change the format, but
|
|
the host can construct a tree addressable by a path that CosmOS cannot express in one
|
|
operation.
|
|
|
|
Declare a portable CosmOS/SBFS path limit and have SplitDisk enforce it when modifying an
|
|
image. The native 255-byte limit is reasonable; the important property is agreement and
|
|
documentation. Component names remain limited to 22 bytes independently.
|
|
|
|
## Bound the number of directory entries
|
|
|
|
The parent field is 16 bits and stores `descriptor index + 1`, with zero reserved for the
|
|
root. Descriptor index 65535 therefore cannot be represented as a parent because adding
|
|
one wraps to zero. SplitDisk currently accepts directory sizes large enough to exceed the
|
|
representable parent domain.
|
|
|
|
Define and validate a maximum directory-block/entry count such that every directory entry
|
|
can be named as a parent. Apply the check while formatting and mounting/reading malformed
|
|
images in both implementations.
|
|
|
|
## Design strengths worth preserving
|
|
|
|
- Parent-as-index-plus-one makes every version one entry a valid root child without
|
|
conversion.
|
|
- Directories consume one descriptor and no data blocks, leaving the descriptor array as
|
|
the complete allocation map.
|
|
- Files remain contiguous and the block allocator remains ignorant of hierarchy.
|
|
- Path resolution below the service boundary gave existing applications directories
|
|
without changing their interfaces.
|
|
- The current directory is a two-byte identity rather than a stored string, and the shell
|
|
restores it after applications run.
|
|
- The independent host/native implementations and byte-identical disk agreement tests are
|
|
unusually strong validation of the written format.
|
|
- `osFileStart`/`osFileWrite`/`osFileFetch`/`osFileDone` provide the bounded-memory output
|
|
abstraction needed by assemblers, compilers, linkers, and future sequential pipelines.
|