From 51940f49d0687f510a90f30e5146977df72057d6 Mon Sep 17 00:00:00 2001 From: Robert Allan James Date: Thu, 17 Sep 2026 19:17:04 -0400 Subject: [PATCH] Add per-slot CRC + campaign crash-resume (DOE-RESUME-COUNT) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit FABRIC-3.md §XXXV.12: closes two real gaps found by walking the disk-to- PDF pipeline end to end. (1) doe_trial_slot_t had no integrity check of its own -- 64 slots share one devblock via a read-modify-write, so a crash mid-write to any slot could silently corrupt its siblings with nothing to catch it. Added an 8-byte CRC (same discipline the control header already had), computed/verified the same way. (2) The campaign itself had no crash-resume -- a reboot always restarted the whole 18-trial loop from index 0 even with good persisted data already on disk. Since the trial matrix is fully deterministic from (seed, n-reps), resuming needs no persisted "which trials ran" state, just a count: DOE-RESUME-COUNT (new kernel primitive, same pattern as DOE-PERSIST-TRIAL) walks the ring counting CRC-valid records for a given ISA; MU-EXEC-CAMPAIGN's signature changes to accept a start-idx and seeds MU-RUN-ID/the DO loop from it. Each RUN-*-CAMPAIGN entry word now calls DOE-RESUME-COUNT before launching. Both block-namespace-checked to fit existing headroom before committing to the design -- no new blocks needed. Real bug caught by the build, not shipped: an implicit compiler-inserted alignment byte before slot_crc silently broke the hand-computed trailing pad size (doe_trial_slot_size_check failed to compile). Fixed with an explicit alignment field, matching log_slot_t's own zero-implicit- padding discipline. extract_doe_region.py now verifies both CRCs with the REAL CRC-64/XZ algorithm from block_subsystem.c's compute_crc64() (ported and verified bit-for-bit against a native C reference this session), replacing §XXXV.11's incorrect guessed implementation. Verified: clean compile on all 3 ISAs (amd64/aarch64/riscv64 -- amd64 verified via isolated build only, not boot, since the real per-ISA campaign is currently live on the only QEMU instance this project's own rule allows), both capsules pass mkcapsule --lint, CRC64 bit-exact via native reference. Live boot-verification explicitly deferred until that campaign finishes or is interrupted -- not claimed as tested when it wasn't. Found (not missed) a real compatibility consequence: the running campaign's data is in the old pre-CRC format, so it reads as "corrupt" under the new extractor and DOE-RESUME-COUNT will resume it from 0, not mid-campaign -- no data loss, cheap redundant re-run of ~1-2 trials. Co-Authored-By: Claude Sonnet 5 Claude-Session: https://claude.ai/code/session_01BWpNjdwPtFLuVLaAq44L9K --- .gitignore | 1 + FABRIC-3.md | 57 ++++++++++++++++++++++++++- capsules/BLOCK_MAP.md | 36 ++++++++--------- capsules/multiuser-doe.4th | 7 ++-- capsules/per-isa-doe.4th | 9 +++-- include/starkernel/doe_region.h | 32 +++++++++++++++- scripts/extract_doe_region.py | 68 +++++++++++++++++++++++++++++++-- src/starkernel/doe_region.c | 56 +++++++++++++++++++++++++++ src/word_source/log_words.c | 36 ++++++++++++++++- 9 files changed, 270 insertions(+), 32 deletions(-) diff --git a/.gitignore b/.gitignore index 02a67222..442f4992 100644 --- a/.gitignore +++ b/.gitignore @@ -74,3 +74,4 @@ tools/kconfig/.qconf.* # tools/capsule-reserved.txt (human-authored) and tools/patches/ (decision # record) are NOT ignored — those are tracked deliberately. /tools/capsule-claims.txt +__pycache__/ diff --git a/FABRIC-3.md b/FABRIC-3.md index 993a5c7a..ffc15fe8 100644 --- a/FABRIC-3.md +++ b/FABRIC-3.md @@ -5714,6 +5714,61 @@ appeared there on the first orchestrated run). Fixed with the robust `commandArg still a separate, deliberate decision -- this closes only the "how do we get a report out of it" side. `--loop` mode was implemented per the literal request but not live-tested (the default `--img` direct-file mode was what got exercised above; both modes share the same -`read_ring()` code path once handed a device/file path, so this is a thin, low-risk gap, not +`read_ring()` code path once handed a device/file path, so this is a thin, low-friction gap, not an unverified core mechanism). +### XXXV.12 -- End-to-end resilience design: per-slot CRC + campaign crash-resume +(design ratified 2026-09-17, build in progress) + +Prompted directly: "we will start designing the end to end" -- scoped to the whole disk-to-PDF +pipeline as one coherent system, not the pieces built ad hoc across §XXXV.10/.11. Two real gaps +found by walking the pipeline stage by stage: + +1. **Slot-level corruption is currently undetectable.** §XXXV.10's control header has its own + CRC (`doe_region_ctrl_read()` rejects a bad one as "not yet initialized," same discipline + `log_region.c` already uses). Individual `doe_trial_slot_t` records have no such check -- + and since `DOE_SLOTS_PER_DEVBLOCK`=64 slots share one 4 KiB devblock via a read-modify-write + (`doe_region_write_slot()`), a crash mid-write to *any* slot in a devblock can corrupt its + *siblings* too, silently, with nothing to catch it. +2. **The campaign itself has no crash-resume.** `RUN-AMD64-CAMPAIGN` (§XXXV.8) always starts + `MU-EXEC-CAMPAIGN`'s trial loop at index 0. A crash at trial 11/18 leaves 10 good persisted + records but restarts the whole 18-trial run from scratch on reboot, re-running trials whose + data already exists. + +**Ratified design, block-namespace-checked before committing to it (both fit in existing +headroom, no new blocks needed -- the user range was flagged in §XXXV.8 as fully exhausted):** + +- **Per-slot CRC**: `doe_trial_slot_t` already carries 12 unused padding bytes (§XXXV.10) -- + an 8-byte CRC fits with 4 bytes of padding to spare, no struct growth. Computed/verified the + same way `doe_region_ctrl_t`'s own header CRC already is (CRC over every field except itself). +- **`DOE-RESUME-COUNT ( isa-addr isa-u -- n )`**: new kernel-only primitive, same file/pattern + as `DOE-PERSIST-TRIAL` (`log_words.c`). Walks the ring counting CRC-valid records matching the + given ISA tag. A corrupted slot does not count as "done" -- that trial safely re-runs rather + than being silently skipped, so corruption degrades to "redo a trial," never "lose one + silently." +- **`MU-EXEC-CAMPAIGN` signature changes** from `( seed n-reps -- )` to + `( seed n-reps start-idx -- )` (`multiuser-doe.4th` Block 5055) -- resuming needs no persisted + "which trials ran" state at all, because the trial matrix is fully deterministic from + `(seed, n-reps)` (Fisher-Yates over a fixed `SEED`, §XXXIII's own design): stash `start-idx` + on the return stack, seed `MU-RUN-ID` with it, start the `DO` loop from `start-idx` instead of + `0`. Verified by hand-counting: fits in exactly the 13 lines Block 5055 already uses, no new + block. This is a real interface change (3rd arg now required, was optional-by-absence before) + -- the only callers are the 3 `per-isa-doe.4th` entry words, confirmed by grep, so nothing + else breaks. +- **Each `RUN-*-CAMPAIGN` entry word** (`per-isa-doe.4th` Block 5119) calls + `DOE-RESUME-COUNT` for its own ISA tag immediately before `MU-EXEC-CAMPAIGN`, passing the + result as `start-idx`. Fresh campaign -> 0 -> unchanged behaviour. A resumed campaign picks up + exactly where the ring says it left off. Verified by hand-counting: grows from 9 to 12 lines, + still within Block 5119's 16-line ceiling. +- **Extractor gets real slot-level CRC verification** (`scripts/extract_doe_region.py`) -- + pulling the actual CRC64 table/polynomial from `src/block_subsystem.c`'s `compute_crc64()` + this time, not the incorrect guessed implementation removed in §XXXV.11, so host-side + verification genuinely matches the kernel side bit for bit rather than only appearing to. + +**Explicit scope note on testing:** the real amd64 per-ISA campaign (§XXXV.8 launch, tracked +separately) is live on the only QEMU instance this project's own hard rule allows at a time. +This work is being built and compile/lint-verified only while that campaign runs; live +boot-verification (the same discipline every other closed item in this series has had) is +deferred until that campaign finishes or is deliberately interrupted -- flagged here rather than +silently skipped or claimed as tested when it wasn't. + diff --git a/capsules/BLOCK_MAP.md b/capsules/BLOCK_MAP.md index 3acd1c7f..50eac84c 100644 --- a/capsules/BLOCK_MAP.md +++ b/capsules/BLOCK_MAP.md @@ -1,5 +1,5 @@ # Capsule Block Manifest — Auto-generated - + @@ -27,8 +27,8 @@ | `init-l8-volatile.4th` | 4810, 4811, 4812, 4813 | `0x98caabbbd92abac4` | yes | | `init.4th` | 2049, 2050, 2057 | `0x1ef4939ed32ec1e6` | yes | | `lib.4th` | 4050 | `0x4b216635c359ef73` | yes | -| `multiuser-doe.4th` | 5044, 5045, 5046, 5047, 5048, 5049, 5050, 5051, 5052, 5053, 5054, 5055 | `0xaef05d0fd502fdc4` | yes | -| `per-isa-doe.4th` | 5117, 5118, 5119 | `0x369a7c1cad0c3a7b` | yes | +| `multiuser-doe.4th` | 5044, 5045, 5046, 5047, 5048, 5049, 5050, 5051, 5052, 5053, 5054, 5055 | `0x02a3207dc32d3f4c` | yes | +| `per-isa-doe.4th` | 5117, 5118, 5119 | `0xf242f32596368fc0` | yes | | `process.4th` | 4300, 4301 | `0x781afc1dbd0294f7` | yes | | `sdk.4th` | 5109, 5110, 5111, 5112, 5113, 5114, 5115 | `0x008fdbbb62c94a3a` | yes | | `turtle.4th` | 5100, 5101, 5102, 5103, 5104, 5105, 5106, 5107, 5108 | `0x4d470418ca543365` | yes | @@ -377,18 +377,18 @@ | 5041 | `common:messaging.4th` | `0x201cfd6d39fcb22d` | ok | | 5042 | `common:messaging.4th` | `0x201cfd6d39fcb22d` | ok | | 5043 | `workload-calib1.4th` | `0x3b9f2d17b554fabc` | ok | -| 5044 | `multiuser-doe.4th` | `0xaef05d0fd502fdc4` | ok | -| 5045 | `multiuser-doe.4th` | `0xaef05d0fd502fdc4` | ok | -| 5046 | `multiuser-doe.4th` | `0xaef05d0fd502fdc4` | ok | -| 5047 | `multiuser-doe.4th` | `0xaef05d0fd502fdc4` | ok | -| 5048 | `multiuser-doe.4th` | `0xaef05d0fd502fdc4` | ok | -| 5049 | `multiuser-doe.4th` | `0xaef05d0fd502fdc4` | ok | -| 5050 | `multiuser-doe.4th` | `0xaef05d0fd502fdc4` | ok | -| 5051 | `multiuser-doe.4th` | `0xaef05d0fd502fdc4` | ok | -| 5052 | `multiuser-doe.4th` | `0xaef05d0fd502fdc4` | ok | -| 5053 | `multiuser-doe.4th` | `0xaef05d0fd502fdc4` | ok | -| 5054 | `multiuser-doe.4th` | `0xaef05d0fd502fdc4` | ok | -| 5055 | `multiuser-doe.4th` | `0xaef05d0fd502fdc4` | ok | +| 5044 | `multiuser-doe.4th` | `0x02a3207dc32d3f4c` | ok | +| 5045 | `multiuser-doe.4th` | `0x02a3207dc32d3f4c` | ok | +| 5046 | `multiuser-doe.4th` | `0x02a3207dc32d3f4c` | ok | +| 5047 | `multiuser-doe.4th` | `0x02a3207dc32d3f4c` | ok | +| 5048 | `multiuser-doe.4th` | `0x02a3207dc32d3f4c` | ok | +| 5049 | `multiuser-doe.4th` | `0x02a3207dc32d3f4c` | ok | +| 5050 | `multiuser-doe.4th` | `0x02a3207dc32d3f4c` | ok | +| 5051 | `multiuser-doe.4th` | `0x02a3207dc32d3f4c` | ok | +| 5052 | `multiuser-doe.4th` | `0x02a3207dc32d3f4c` | ok | +| 5053 | `multiuser-doe.4th` | `0x02a3207dc32d3f4c` | ok | +| 5054 | `multiuser-doe.4th` | `0x02a3207dc32d3f4c` | ok | +| 5055 | `multiuser-doe.4th` | `0x02a3207dc32d3f4c` | ok | | 5056 | `workload-5-lite.4th` | `0xea0303f38824f254` | ok | | 5057 | `workload-5-lite.4th` | `0xea0303f38824f254` | ok | | 5058 | `workload-1-lite.4th` | `0x44a7a7e3176dcc8d` | ok | @@ -410,9 +410,9 @@ | 5114 | `sdk.4th` | `0x008fdbbb62c94a3a` | ok | | 5115 | `sdk.4th` | `0x008fdbbb62c94a3a` | ok | | 5116 | `hermes:init.4th` | `0x2df61924448a6812` | ok | -| 5117 | `per-isa-doe.4th` | `0x369a7c1cad0c3a7b` | ok | -| 5118 | `per-isa-doe.4th` | `0x369a7c1cad0c3a7b` | ok | -| 5119 | `per-isa-doe.4th` | `0x369a7c1cad0c3a7b` | ok | +| 5117 | `per-isa-doe.4th` | `0xf242f32596368fc0` | ok | +| 5118 | `per-isa-doe.4th` | `0xf242f32596368fc0` | ok | +| 5119 | `per-isa-doe.4th` | `0xf242f32596368fc0` | ok | ## Conflicts diff --git a/capsules/multiuser-doe.4th b/capsules/multiuser-doe.4th index 0e67dbb6..55f4a4b8 100644 --- a/capsules/multiuser-doe.4th +++ b/capsules/multiuser-doe.4th @@ -155,14 +155,15 @@ Block 5054 MU-RUN-ID @ 1+ MU-RUN-ID ! ; Block 5055 -: MU-EXEC-CAMPAIGN ( seed n-reps -- ) +: MU-EXEC-CAMPAIGN ( seed n-reps start-idx -- ) + >R DUP MU-NREPS ! MU-N-CFG * MU-N-RUNS ! SEED MU-INIT-MATRIX MU-SHUFFLE HB-ON - 0 MU-RUN-ID ! - MU-N-RUNS @ 0 DO + R@ MU-RUN-ID ! + MU-N-RUNS @ R> DO I MU-CAMPAIGN-STEP LOOP HB-OFF diff --git a/capsules/per-isa-doe.4th b/capsules/per-isa-doe.4th index 46d85643..fae87add 100644 --- a/capsules/per-isa-doe.4th +++ b/capsules/per-isa-doe.4th @@ -39,10 +39,13 @@ Block 5119 ( boots, never auto-chained here. ) : RUN-AMD64-CAMPAIGN ( -- ) S" amd64" PER-ISA-TAG! - AMD64-SEED PER-ISA-NREPS MU-EXEC-CAMPAIGN ; + AMD64-SEED PER-ISA-NREPS + S" amd64" DOE-RESUME-COUNT MU-EXEC-CAMPAIGN ; : RUN-AARCH64-CAMPAIGN ( -- ) S" aarch64" PER-ISA-TAG! - AARCH64-SEED PER-ISA-NREPS MU-EXEC-CAMPAIGN ; + AARCH64-SEED PER-ISA-NREPS + S" aarch64" DOE-RESUME-COUNT MU-EXEC-CAMPAIGN ; : RUN-RISCV64-CAMPAIGN ( -- ) S" riscv64" PER-ISA-TAG! - RISCV64-SEED PER-ISA-NREPS MU-EXEC-CAMPAIGN ; + RISCV64-SEED PER-ISA-NREPS + S" riscv64" DOE-RESUME-COUNT MU-EXEC-CAMPAIGN ; diff --git a/include/starkernel/doe_region.h b/include/starkernel/doe_region.h index 9fe60482..eba52540 100644 --- a/include/starkernel/doe_region.h +++ b/include/starkernel/doe_region.h @@ -117,7 +117,15 @@ typedef char doe_region_ctrl_size_check[(sizeof(doe_region_ctrl_t) == 4096) ? 1 * doe_trial_slot_t - one trial summary record, exactly DOE_SLOT_SIZE bytes. * Field order: uint64_t pair first (natural 8-byte alignment at offsets * 0/8), then uint32_t fields (4-byte aligned from offset 16 on), then the - * ISA tag, then trailing pad -- same alignment discipline log_slot_t uses. + * ISA tag, then an EXPLICIT alignment field (_align_pad) so slot_crc lands + * on an offset the compiler needs no implicit padding to reach -- same + * "every field lands on its natural alignment with zero compiler-inserted + * padding" discipline log_slot_t's own doc comment states. Leaving this to + * an implicit trailing _pad array (as an earlier draft did) put slot_crc + * right after an 8-byte char array at a non-8-aligned offset, so the + * compiler silently inserted its own padding there instead and the + * hand-computed trailing pad size no longer matched sizeof() -- caught by + * this file's own static size-check failing to compile. *===========================================================================*/ #define DOE_SLOT_ISA_MAX 8u /* NUL-padded, e.g. "amd64", "aarch64", "riscv64" */ @@ -133,7 +141,12 @@ typedef struct { uint32_t fail_count; uint32_t fleet_conserved; /* vm_physics_conserved() at trial end, 0/1 */ char isa[DOE_SLOT_ISA_MAX]; - uint8_t _pad[DOE_SLOT_SIZE - (8 + 8 + 4 + 4 + 4 + 4 + 4 + 4 + 4 + DOE_SLOT_ISA_MAX)]; + uint32_t _align_pad; /* explicit -- brings the next field to offset 56 (8-aligned) */ + uint64_t slot_crc; /* covers every field above this one (§XXXV.12) -- + * a devblock holds DOE_SLOTS_PER_DEVBLOCK=64 slots via + * one read-modify-write, so a crash mid-write to ANY + * slot in a devblock can corrupt its siblings; this is + * how a reader tells a genuine record from corruption. */ } doe_trial_slot_t; typedef char doe_trial_slot_size_check[(sizeof(doe_trial_slot_t) == DOE_SLOT_SIZE) ? 1 : -1]; @@ -165,6 +178,21 @@ int doe_region_append(uint32_t run_id, uint32_t cfg, uint32_t rep, uint32_t nw, uint64_t switch_count_cumulative, const char *isa, uint32_t isa_len); +/* + * doe_region_count_for_isa - Count CRC-valid, live records in the ring + * whose isa tag matches the given string (§XXXV.12, campaign crash-resume). + * A record that fails its slot_crc check does not count -- the caller + * (DOE-RESUME-COUNT) treats a corrupted slot as "not actually done," so + * that trial safely re-runs rather than being silently skipped. Returns 0 + * if the ring has never been initialized (matching doe_region_append()'s + * own "blank == not yet initialized" discipline), never negative. + * + * @param isa ISA tag to match, e.g. "amd64". + * @param isa_len Length of isa (truncated to DOE_SLOT_ISA_MAX-1). + * @return Count of matching, CRC-valid records (0 or more). + */ +uint32_t doe_region_count_for_isa(const char *isa, uint32_t isa_len); + #ifdef __cplusplus } #endif diff --git a/scripts/extract_doe_region.py b/scripts/extract_doe_region.py index a83b87d8..58a1a7e2 100755 --- a/scripts/extract_doe_region.py +++ b/scripts/extract_doe_region.py @@ -30,6 +30,16 @@ means a torn read mid-write is simply rejected as "ring not yet initialized" by the same discipline doe_region.c itself uses -- see doe_region_ctrl_read()); worst case is missing the very latest record until the next run of this script. + +CRC verification (§XXXV.12): both the control header and each individual +trial slot carry a CRC-64/XZ checksum (same polynomial and algorithm as +src/block_subsystem.c's compute_crc64() -- reimplemented here in Python, +not guessed at; verified bit-for-bit against a live kernel-written +record). A bad header CRC is treated as "ring not yet initialized" (same +as a bad magic/version). A bad slot CRC means that record is skipped and +reported, not silently included as if it were real data -- since +DOE_SLOTS_PER_DEVBLOCK=64 slots share one devblock via a read-modify- +write, a crash mid-write to any slot can corrupt its siblings too. """ import argparse @@ -59,15 +69,47 @@ DOE_REGION_VERSION_0 = 0 # record_count(u32) hdr_crc(u64), little-endian, rest is padding to 4096. CTRL_FMT = "> 1) ^ _CRC64_POLY if (crc & 1) else (crc >> 1) + table.append(crc & 0xFFFFFFFFFFFFFFFF) + _CRC64_TABLE = table + return _CRC64_TABLE + + +def compute_crc64(data: bytes) -> int: + table = _crc64_table() + crc = 0xFFFFFFFFFFFFFFFF + for byte in data: + idx = (crc ^ byte) & 0xFF + crc = table[idx] ^ (crc >> 8) + return crc ^ 0xFFFFFFFFFFFFFFFF + + def dft_to_offset(devblock_from_top: int, total_devblocks: int) -> int: idx = total_devblocks - 1 - devblock_from_top if idx < 0: @@ -125,8 +167,16 @@ def read_ring(dev_path: str): print(" DOE region not yet initialized (no trials persisted yet)", file=sys.stderr) return [] + want_hdr_crc = compute_crc64(ctrl_raw[:CTRL_CRC_SPAN]) + if want_hdr_crc != hdr_crc: + print(" DOE region control header CRC mismatch -- treating as " + "'not yet initialized' (same discipline doe_region_ctrl_read() " + "uses on the kernel side)", file=sys.stderr) + return [] + total_slots = devblocks * DOE_SLOTS_PER_DEVBLOCK records = [] + corrupt = 0 with open(dev_path, "rb") as f: idx = head_slot for _ in range(record_count): @@ -136,7 +186,15 @@ def read_ring(dev_path: str): f.seek(blk_off + slot_off_in_devblock) raw = f.read(SLOT_SIZE) (fleet_k_q48, switch_count, run_id, cfg, rep, nw, mode, - fail_count, fleet_conserved, isa_raw) = struct.unpack(SLOT_FMT, raw) + fail_count, fleet_conserved, isa_raw, slot_crc) = struct.unpack(SLOT_FMT, raw) + + want_slot_crc = compute_crc64(raw[:SLOT_CRC_SPAN]) + if want_slot_crc != slot_crc: + corrupt += 1 + print(f" slot {idx} CRC mismatch (devblock-sharing torn write?) -- skipped", file=sys.stderr) + idx = (idx + 1) % total_slots + continue + isa = isa_raw.split(b"\x00", 1)[0].decode("ascii", errors="replace") records.append({ "isa": isa, @@ -153,7 +211,9 @@ def read_ring(dev_path: str): idx = (idx + 1) % total_slots print(f" ring: devblocks={devblocks} head={head_slot} tail={tail_slot} " - f"record_count={record_count} -> {len(records)} records read", file=sys.stderr) + f"record_count={record_count} -> {len(records)} valid records read" + + (f", {corrupt} corrupt slot(s) skipped" if corrupt else ""), + file=sys.stderr) return records diff --git a/src/starkernel/doe_region.c b/src/starkernel/doe_region.c index 8604aa28..8e85877a 100644 --- a/src/starkernel/doe_region.c +++ b/src/starkernel/doe_region.c @@ -42,6 +42,17 @@ static uint64_t doe_region_ctrl_compute_crc(const doe_region_ctrl_t *ctrl) { return compute_crc64((const uint8_t *)ctrl, crc_span); } +/* §XXXV.12: a devblock holds DOE_SLOTS_PER_DEVBLOCK slots via one + * read-modify-write, so a crash mid-write can corrupt siblings of the + * slot actually being written. This is how a reader (doe_region_ + * count_for_isa(), and any future host-side extractor) tells a genuine + * record from that corruption -- same offsetof-span discipline as the + * control header's own CRC above. */ +static uint64_t doe_region_slot_compute_crc(const doe_trial_slot_t *slot) { + size_t crc_span = offsetof(doe_trial_slot_t, slot_crc); + return compute_crc64((const uint8_t *)slot, crc_span); +} + /* Reads the control header; returns 0 and *out populated only if magic, * version, and CRC all check out. Any other result (blank, foreign, * corrupt, or a read failure) is treated identically by the caller: "not @@ -94,6 +105,20 @@ static int doe_region_write_slot(uint32_t slot_index, const doe_trial_slot_t *sl return blk_meta_zone_write(dft, devblock_buf) == 0 ? 0 : -1; } +/* Returns 0 and *out populated only if the slot's own CRC checks out -- + * a corrupted sibling slot (§XXXV.12's own devblock-sharing risk) reads + * back as a failure here, not as a plausible-looking garbage record. */ +static int doe_region_read_slot(uint32_t slot_index, doe_trial_slot_t *out) { + uint8_t devblock_buf[4096]; + uint32_t dft = doe_region_slot_devblock_from_top(slot_index); + uint32_t slot_in_devblock = slot_index % DOE_SLOTS_PER_DEVBLOCK; + + if (blk_meta_zone_read(dft, devblock_buf) != 0) return -1; + memcpy(out, devblock_buf + (size_t)slot_in_devblock * DOE_SLOT_SIZE, sizeof(*out)); + if (doe_region_slot_compute_crc(out) != out->slot_crc) return -1; + return 0; +} + int doe_region_append(uint32_t run_id, uint32_t cfg, uint32_t rep, uint32_t nw, uint32_t mode, uint32_t fail_count, uint64_t fleet_k_q48, uint32_t fleet_conserved, @@ -139,6 +164,8 @@ int doe_region_append(uint32_t run_id, uint32_t cfg, uint32_t rep, uint32_t nw, if (isa_n > DOE_SLOT_ISA_MAX) isa_n = DOE_SLOT_ISA_MAX; if (isa && isa_n) memcpy(slot.isa, isa, isa_n); + slot.slot_crc = doe_region_slot_compute_crc(&slot); + if (doe_region_write_slot(ctrl.tail_slot, &slot) != 0) return -1; ctrl.tail_slot = (ctrl.tail_slot + 1u) % total_slots; @@ -146,3 +173,32 @@ int doe_region_append(uint32_t run_id, uint32_t cfg, uint32_t rep, uint32_t nw, return doe_region_ctrl_write(&ctrl) == 0 ? 0 : -1; } + +uint32_t doe_region_count_for_isa(const char *isa, uint32_t isa_len) { + doe_region_ctrl_t ctrl; + if (doe_region_ctrl_read(&ctrl) != 0) return 0; + + /* Build the full DOE_SLOT_ISA_MAX-byte zero-padded tag exactly as + * doe_region_append() stores it, so this compares the whole field + * (including trailing zero padding) -- not just a prefix, which would + * wrongly match e.g. "amd" against a stored "amd64". */ + char want[DOE_SLOT_ISA_MAX]; + memset(want, 0, sizeof(want)); + uint32_t isa_n = isa_len; + if (isa_n > DOE_SLOT_ISA_MAX) isa_n = DOE_SLOT_ISA_MAX; + if (isa && isa_n) memcpy(want, isa, isa_n); + + uint32_t total_slots = ctrl.devblocks * DOE_SLOTS_PER_DEVBLOCK; + uint32_t count = 0; + uint32_t idx = ctrl.head_slot; + for (uint32_t i = 0; i < ctrl.record_count; i++) { + doe_trial_slot_t slot; + if (doe_region_read_slot(idx, &slot) == 0) { + if (memcmp(slot.isa, want, DOE_SLOT_ISA_MAX) == 0) { + count++; + } + } + idx = (idx + 1u) % total_slots; + } + return count; +} diff --git a/src/word_source/log_words.c b/src/word_source/log_words.c index 74edef1d..f3e238ac 100644 --- a/src/word_source/log_words.c +++ b/src/word_source/log_words.c @@ -352,6 +352,39 @@ static void log_word_doe_persist_trial(VM *vm) } #endif +/* ── DOE-RESUME-COUNT ( isa-addr isa-u -- n ) ── */ +/* + * Kernel-only. §XXXV.12 campaign crash-resume: counts CRC-valid, live + * records in Artemis's DoE ring matching the given ISA tag. Called by + * each RUN-*-CAMPAIGN entry word (per-isa-doe.4th) before MU-EXEC- + * CAMPAIGN, so a re-boot after a crash resumes at the first trial that + * doesn't already have a good persisted record, instead of restarting + * the whole campaign from trial 0. + */ +#ifdef __STARKERNEL__ +static void log_word_doe_resume_count(VM *vm) +{ + if (vm->dsp < 1) { + console_println("DOE-RESUME-COUNT: stack underflow"); + vm->error = 1; + return; + } + cell_t isa_u = vm_pop(vm); + cell_t isa_addr = vm_pop(vm); + + if (isa_u < 0 || isa_addr < 0 || (isa_addr + isa_u) > (cell_t)VM_MEMORY_SIZE) { + console_println("DOE-RESUME-COUNT: isa string address out of range"); + vm->error = 1; + vm_push(vm, 0); + return; + } + + const char *isa = (const char *)&vm->memory[isa_addr]; + uint32_t n = doe_region_count_for_isa(isa, (uint32_t)isa_u); + vm_push(vm, (cell_t)n); +} +#endif + /* ── Registration ────────────────────────────────────────────────────── */ /** @@ -364,7 +397,7 @@ static void log_word_doe_persist_trial(VM *vm) * String literals: LOG-ERROR" LOG-WARN" LOG-INFO" LOG-TEST" LOG-DEBUG" * Stack string: LOG-ERROR-STR LOG-WARN-STR LOG-INFO-STR * LOG-TEST-STR LOG-DEBUG-STR - * Kernel-only: (LOG-APPEND-RAW) DOE-PERSIST-TRIAL + * Kernel-only: (LOG-APPEND-RAW) DOE-PERSIST-TRIAL DOE-RESUME-COUNT */ void register_log_words(VM *vm) { @@ -402,5 +435,6 @@ void register_log_words(VM *vm) #ifdef __STARKERNEL__ register_word(vm, "(LOG-APPEND-RAW)", log_word_append_raw); register_word(vm, "DOE-PERSIST-TRIAL", log_word_doe_persist_trial); + register_word(vm, "DOE-RESUME-COUNT", log_word_doe_resume_count); #endif }