ABORT is documented and tested in this codebase as standard FORTH-79 behavior -- system_words_test.c:63: "Should clear stacks and return to QUIT" -- meaning it should unwind all the way back to the outermost interpreter loop, abandoning whatever's left of the current line/block. The implementation only unwound one level: every place that checked vm->abort_requested cleared it the instant it saw it, so it never survived to propagate past the first nested frame. This surfaced via Artemis's ART-HALT-UNRECOG (capsules/artemis/init.4th): on an unrecognized disk it correctly printed "ARTEMIS HALT: unrecognized disk content" and called ABORT, but WELCOME (the next line in the same block) ran anyway, and Artemis announced ready to Hermes and joined the fleet normally -- contradicting .claude/ARTEMIS.md's "Refuse to mount... do not overwrite it" requirement. Root cause is general, not Artemis-specific, and present identically in both the hosted and kernel VM cores. Fixed at every level execution can nest through, verified by exhaustively grepping every !vm->error-gated continuation loop and adding the parallel !vm->abort_requested check: - execute_colon_word (src/vm.c, src/starkernel/vm/vm_core.c): stop clearing the flag on return -- every colon-word call is a recursive call to this same function, so leaving it set lets every enclosing frame's own check also unwind. - vm_interpret (src/vm.c, src/starkernel/vm/vm_core.c): stop parsing further words in the current input string once the flag is set. - exec_block_with_retry (src/starkernel/capsule/capsule_loader.c): capsule birth's line-by-line block executor -- stop processing further lines in the current block, but return 0 (not -1), so capsule_exec_payload still loads later blocks in the same capsule payload. Returning -1 here would have silently broken word definitions in blocks that come after the aborting one for reasons unrelated to why it aborted (concretely, Artemis's ART-PING/LOAD-DOE in blocks 4851/4852, which follow the entry block 4133). - THRU and --> (src/word_source/block_words.c): stop processing further blocks/lines in their own loops. - DODOES (src/word_source/defining_words.c): the CREATE...DOES> runtime has its own hand-rolled execution loop, separate from execute_colon_word -- same bug class, same fix. Also guarded the post-loop "if (vm->rsp < base_rsp) vm->rsp = base_rsp" clamp so it doesn't fire on an abort exit -- ABORT's own reset_vm_state() already set rsp; restoring it to base_rsp would have partially undone that. - Both REPL loops (src/repl.c, src/starkernel/repl.c x2 call sites): clear the flag after each line, mirroring the existing vm->error pattern, so a mid-line abort doesn't silently freeze subsequent interactive input. Verified directly: ": AB-TEST 1 2 3 ABORT 999 . ; AB-TEST 42 . CR 777 . CR" -- 999 never prints (stops mid-colon-word), 42 never prints (stops the rest of the same line), 777 prints fine (next line unaffected). Artemis: WELCOME/"Artemis ready" no longer fires after the halt message. No regression: all three architectures still show PASS: persist-read, PASS: E2E msg flow, and matching dict_hash on the normal (non-aborted) boot path; hosted test suite 965 passed / 0 failed. Known follow-up, not fixed here (see memory for details): Artemis still announces ready to Hermes via a separate call path (CD-INIT, block 4141) that never went through capsule_exec_payload's block chain in the first place, and the disk file still picks up incidental writes even on a correctly-halted boot -- likely generic block-subsystem housekeeping, not traced yet. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
270 lines
9.2 KiB
C
270 lines
9.2 KiB
C
/*
|
||
StarForth — Steady-State Virtual Machine Runtime
|
||
|
||
Copyright (c) 2023–2025 Robert A. James
|
||
All rights reserved.
|
||
|
||
Licensed under the StarForth License, Version 1.0
|
||
*/
|
||
|
||
/**
|
||
* repl.c - Emergency FORTH REPL for LithosAnanke kernel
|
||
*
|
||
* Direct adaptation of src/repl.c for the freestanding kernel context.
|
||
* Replaces libc stdio (fgets/printf/fflush) with HAL serial I/O:
|
||
* - Input: console_getc() non-blocking poll with local echo and backspace
|
||
* - Output: console_puts() / console_putc()
|
||
*
|
||
* Idle spin: polls console_getc() and services the adaptive heartbeat.
|
||
* The APIC timer ISR increments heartbeat_ticks() at 100 Hz;
|
||
* the idle spin calls sk_repl_idle() once per SK_IDLE_BEAT_INTERVAL
|
||
* ticks. On QEMU TCG the ISR must fire for ticks to advance —
|
||
* check "Heartbeat: N ticks" in the serial log to confirm.
|
||
*
|
||
* Runs with interrupts enabled so the APIC heartbeat fires normally.
|
||
* Designed as the last thing kernel_main does before the idle loop.
|
||
*/
|
||
|
||
#include "starkernel/repl.h"
|
||
#include "console.h"
|
||
#include "vm.h"
|
||
#include "version.h"
|
||
#include "starkernel/timer.h"
|
||
#include "starkernel/arch.h"
|
||
#include <stdint.h>
|
||
|
||
const char lithos_version[64] = LITHOS_VERSION_STR;
|
||
|
||
/*===========================================================================
|
||
* USE-word dispatch: which VM receives REPL input.
|
||
*
|
||
* NULL means "use the REPL's own vm parameter" (default — Mama).
|
||
* Set via sk_repl_set_active_vm(); read by sk_repl_run() each iteration.
|
||
*===========================================================================*/
|
||
|
||
static VM *g_repl_active_vm = (void *)0;
|
||
|
||
void sk_repl_set_active_vm(VM *vm) { g_repl_active_vm = vm; }
|
||
VM *sk_repl_get_active_vm(void) { return g_repl_active_vm; }
|
||
|
||
/*===========================================================================
|
||
* Idle heartbeat service
|
||
*
|
||
* Called from sk_readline when heartbeat_ticks() has advanced by at least
|
||
* SK_IDLE_BEAT_INTERVAL since the last service call. Extend this function
|
||
* as higher-level subsystems (msg_fabric, capsule scheduler) come online.
|
||
*
|
||
* TODO: cadence policy and subsystem dispatch belong in Compudynamics once
|
||
* that layer governs cooperative VM execution.
|
||
*===========================================================================*/
|
||
|
||
#define SK_IDLE_BEAT_INTERVAL 100u /* ticks between idle service calls (1 s at 100 Hz) */
|
||
|
||
static uint64_t g_last_beat_tick; /* zero-initialized (BSS) */
|
||
|
||
static void sk_repl_idle(void)
|
||
{
|
||
/* Placeholder — extended by higher-level subsystems as they come online */
|
||
(void)0;
|
||
}
|
||
|
||
/*===========================================================================
|
||
* sk_readline - line read from serial console with echo
|
||
*
|
||
* Non-blocking poll of console_getc(). While no character is ready the idle
|
||
* spin services the adaptive heartbeat at SK_IDLE_BEAT_INTERVAL tick cadence.
|
||
* Supports backspace (0x7F and \b) and ignores other control characters.
|
||
* Returns the number of characters placed in buf (not counting '\0').
|
||
*===========================================================================*/
|
||
|
||
static int sk_readline(char *buf, int size)
|
||
{
|
||
int n = 0;
|
||
|
||
for (;;) {
|
||
int c = console_getc(); /* non-blocking poll */
|
||
|
||
if (c < 0) {
|
||
/* Idle — service the adaptive heartbeat if a beat has elapsed */
|
||
uint64_t now = heartbeat_ticks();
|
||
if (now - g_last_beat_tick >= SK_IDLE_BEAT_INTERVAL) {
|
||
g_last_beat_tick = now;
|
||
sk_repl_idle();
|
||
}
|
||
/*
|
||
* Do NOT use hlt here: QEMU single-threaded TCG can't process
|
||
* its APIC timer callbacks while the guest CPU is halted (the
|
||
* event loop and the TCG thread share the same OS thread).
|
||
* Interrupts are delivered at TB boundaries in a tight loop.
|
||
* On real hardware a wfi/hlt would be appropriate; add it here
|
||
* under an #ifdef REAL_HARDWARE guard when that path is needed.
|
||
*/
|
||
arch_relax(); /* PAUSE — reduce power, maintain tight poll */
|
||
continue;
|
||
}
|
||
|
||
if (c == '\r' || c == '\n') {
|
||
console_putc('\n');
|
||
break;
|
||
}
|
||
|
||
/* backspace: DEL (0x7F) or BS (0x08) */
|
||
if ((c == 0x7F || c == '\b') && n > 0) {
|
||
n--;
|
||
/* VT100 erase: move back, overwrite with space, move back again */
|
||
console_putc('\b');
|
||
console_putc(' ');
|
||
console_putc('\b');
|
||
continue;
|
||
}
|
||
|
||
if (c < 0x20) continue; /* ignore other control characters */
|
||
if (n >= size - 1) continue; /* buffer full — drop character */
|
||
|
||
buf[n++] = (char)c;
|
||
console_putc((char)c); /* echo */
|
||
}
|
||
|
||
buf[n] = '\0';
|
||
return n;
|
||
}
|
||
|
||
/*===========================================================================
|
||
* sk_repl - Emergency FORTH REPL
|
||
*
|
||
* Mirrors vm_repl() from src/repl.c:
|
||
* - Sets vm->emergency_console = 1 for the duration (this IS the emergency
|
||
* console; bypasses ACL so zuse authentication is not required to recover)
|
||
* - Prints "zuse)ok> " when zuse_session=1, else "ok> "
|
||
* - Reads a line via sk_readline (non-blocking, heartbeat-serviced)
|
||
* - Calls vm_interpret
|
||
* - Prints " ok" or " ERROR"
|
||
* - When EMERGENCY_CONSOLE_ENABLED=1: resets vm->error and loops (recovery)
|
||
* - When EMERGENCY_CONSOLE_ENABLED=0: halts VM on error (no fallthrough surface)
|
||
*===========================================================================*/
|
||
|
||
#if !EMERGENCY_CONSOLE_ENABLED
|
||
static void sk_fault_handler(VM *vm) {
|
||
console_println("VM fault — emergency console disabled; halting");
|
||
vm->halted = 1;
|
||
}
|
||
#endif
|
||
|
||
/*===========================================================================
|
||
* sk_repl_step - Execute one REPL turn on a VM and return.
|
||
*
|
||
* Prints the VM's prompt, reads one input line, interprets it, prints
|
||
* ok/ERROR, then returns. Used by the Compudynamics VM-STEP primitive
|
||
* so Hera can give a single REPL quantum to any child VM without
|
||
* surrendering control for the full sk_repl_run() loop.
|
||
*
|
||
* Returns 1 if the VM is still running, 0 if it halted during this turn.
|
||
*===========================================================================*/
|
||
|
||
int sk_repl_step(VM *vm)
|
||
{
|
||
char input[256];
|
||
|
||
if (!vm || vm->halted) return 0;
|
||
|
||
{
|
||
const char *vn = console_get_vm_name();
|
||
int is_hera = (!vn || (vn[0]=='H' && vn[1]=='e' && vn[2]=='r' && vn[3]=='a' && vn[4]=='\0'));
|
||
if (is_hera) {
|
||
vm->emergency_console = vm->zuse_session ? 0 : 1;
|
||
console_puts(vm->zuse_session ? "zuse)ok> " : "ok> ");
|
||
} else {
|
||
vm->emergency_console = 0;
|
||
console_puts(vn);
|
||
console_puts(")ok> ");
|
||
}
|
||
}
|
||
|
||
sk_readline(input, sizeof(input));
|
||
|
||
if (input[0] == '\0') {
|
||
console_puts(" ok\n");
|
||
return vm->halted ? 0 : 1;
|
||
}
|
||
|
||
vm_interpret(vm, input);
|
||
|
||
/* ABORT stops mid-line but leaves the flag set for the caller to
|
||
* consume -- this REPL step is that boundary. Clear it here so the
|
||
* next line isn't silently refused by vm_interpret's own check. */
|
||
vm->abort_requested = 0;
|
||
|
||
if (vm->error) {
|
||
console_puts(" ERROR\n");
|
||
vm->error = 0;
|
||
} else {
|
||
console_puts(" ok\n");
|
||
}
|
||
|
||
return vm->halted ? 0 : 1;
|
||
}
|
||
|
||
void sk_repl_run(VM *vm)
|
||
{
|
||
char input[256];
|
||
VM *active;
|
||
|
||
vm->halted = 0;
|
||
|
||
while (!vm->halted) {
|
||
/* USE may redirect input to a different VM each iteration */
|
||
active = g_repl_active_vm ? g_repl_active_vm : vm;
|
||
|
||
/* Named prompt: child VMs show <Name>)ok>, Hera shows zuse)ok>/ok>.
|
||
* emergency_console bypass applies only to Hera's bare ok> prompt. */
|
||
{
|
||
const char *vn = console_get_vm_name();
|
||
int is_hera = (!vn || (vn[0]=='H' && vn[1]=='e' && vn[2]=='r' && vn[3]=='a' && vn[4]=='\0'));
|
||
if (is_hera) {
|
||
active->emergency_console = active->zuse_session ? 0 : 1;
|
||
if (active->zuse_session)
|
||
console_puts("zuse)ok> ");
|
||
else
|
||
console_puts("ok> ");
|
||
} else {
|
||
active->emergency_console = 0;
|
||
console_puts(vn);
|
||
console_puts(")ok> ");
|
||
}
|
||
}
|
||
|
||
sk_readline(input, sizeof(input));
|
||
|
||
if (input[0] == '\0') {
|
||
console_puts(" ok\n");
|
||
continue;
|
||
}
|
||
|
||
vm_interpret(active, input);
|
||
|
||
/* ABORT stops mid-line but leaves the flag set for the caller to
|
||
* consume -- this REPL step is that boundary. Clear it here so the
|
||
* next line isn't silently refused by vm_interpret's own check. */
|
||
active->abort_requested = 0;
|
||
|
||
if (active->error) {
|
||
console_puts(" ERROR\n");
|
||
active->error = 0;
|
||
} else {
|
||
console_puts(" ok\n");
|
||
}
|
||
}
|
||
}
|
||
|
||
void sk_repl(VM *vm)
|
||
{
|
||
console_println(lithos_version);
|
||
console_puts("StarForth Version "); console_println(STARFORTH_VERSION);
|
||
console_println("");
|
||
console_println("StarForth Emergency CLI");
|
||
console_println("FORTH-79 interpreter — type BYE or power off to exit");
|
||
console_println("");
|
||
|
||
sk_repl_run(vm);
|
||
}
|