73acc40dbb
uber_valid() answered one question -- valid or not -- and a version mismatch returned the same as a failed checksum. Those two states need opposite handling: A damaged uberblock means STEP OVER IT. That is what the 128-slot ring is for, and the older root is a consistent filesystem. This is crash recovery. A sound uberblock from a newer format means STOP. Falling back mounts a STALE filesystem: every commit made since the volume was upgraded is discarded, the mount reports success, and nobody finds out. Demonstrated rather than asserted. A forged image with two uberblocks -- (version 1, generation 1, root 129) and (version 2, generation 2, root 130) -- made the old code mount root 129 and exit 0, silently rolling the filesystem back to before the upgrade. uber_check() returns BAD / OK / RO / TOO_NEW, and asks its questions in order: is it ours (magic), is it intact (crc), can we read it (version, features), does it make sense (root in range). Compatibility is asked before sanity on purpose -- the fields a sanity check reads are only meaningfully placed if the format is one we know. Plus feature flags in three classes, which is what stops a version number being a blunt instrument: compat (ignore unknown bits), ro_compat (mount read-only), incompat (refuse). The test for which class is one question -- what happens if a driver that does not know this feature writes to the volume? Nothing -> compat. Something goes stale -> ro_compat. Something is unreadable -> incompat. They occupy what was reserved0, so every later field keeps its offset and existing images -- which have zeros there -- read unchanged. schfs_vol_commit memsets the uberblock before filling it in, which is why v1 volumes already say "no features" without having been written by code that knew the field existed. That trick is available exactly once. Four _Static_asserts now pin the layout. Verified on forged images: version bump refuses, incompat refuses, blocksize mismatch refuses, ro_compat mounts the NEWEST root read-only rather than falling back. Also here, because they are the same file: SchFS's transaction owner is a pid alongside the pointer, since a bare struct proc * does not identify a process -- ptable slots are recycled, and an exited owner's pointer compares equal to whichever unrelated process lands in that slot next, at which point klock() skips the lock entirely and two callers share one volume's scratch pages. And schfs_lockinfo(), so /proc/fsstat can report a wedged volume instead of leaving every path asleep in acquiresleep with no way to ask why. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01VQ7Qx8E1q1M1bbCq8QLHS2
66 lines
3.2 KiB
C
66 lines
3.2 KiB
C
// Error numbers, matching the Linux x86_64 ABI values so that musl-linked
|
|
// programs interpret syscall failures correctly. Kernel code returns these
|
|
// negated (e.g. `return -ENOSYS;`), exactly like Linux does internally.
|
|
#ifndef SCHOS_ERRNO_H
|
|
#define SCHOS_ERRNO_H
|
|
|
|
#define EPERM 1 // Operation not permitted
|
|
#define ENOENT 2 // No such file or directory
|
|
#define ESRCH 3 // No such process
|
|
#define EINTR 4 // Interrupted system call
|
|
#define EIO 5 // I/O error
|
|
#define ENXIO 6 // No such device or address
|
|
#define E2BIG 7 // Argument list too long
|
|
#define ENOEXEC 8 // Exec format error
|
|
#define EBADF 9 // Bad file descriptor
|
|
#define ECHILD 10 // No child processes
|
|
#define EAGAIN 11 // Try again
|
|
#define ENOMEM 12 // Out of memory
|
|
#define EACCES 13 // Permission denied
|
|
#define EFAULT 14 // Bad address
|
|
#define ENOTBLK 15 // Block device required
|
|
#define EBUSY 16 // Device or resource busy
|
|
#define EEXIST 17 // File exists
|
|
#define EXDEV 18 // Cross-device link
|
|
#define ENODEV 19 // No such device
|
|
#define ENOTDIR 20 // Not a directory
|
|
#define EISDIR 21 // Is a directory
|
|
#define EINVAL 22 // Invalid argument
|
|
#define ENFILE 23 // File table overflow
|
|
#define EMFILE 24 // Too many open files
|
|
#define ENOTTY 25 // Not a typewriter
|
|
#define EFBIG 27 // File too large
|
|
#define ENOSPC 28 // No space left on device
|
|
#define ESPIPE 29 // Illegal seek
|
|
#define EROFS 30 // Read-only file system
|
|
#define EMLINK 31 // Too many links
|
|
#define EPIPE 32 // Broken pipe
|
|
#define ERANGE 34 // Math result not representable
|
|
#define ENAMETOOLONG 36 // File name too long
|
|
#define ENOSYS 38 // Function not implemented
|
|
#define ENOTEMPTY 39 // Directory not empty
|
|
#define ELOOP 40 // Too many symbolic links encountered
|
|
|
|
// Sockets. Same Linux x86_64 values, so strerror() in a musl-linked program
|
|
// prints the message the programmer expected rather than a neighbouring one.
|
|
#define ENOTSOCK 88 // Socket operation on non-socket
|
|
#define EDESTADDRREQ 89 // Destination address required
|
|
#define EMSGSIZE 90 // Message too long
|
|
#define EPROTOTYPE 91 // Protocol wrong type for socket
|
|
#define ENOPROTOOPT 92 // Protocol not available
|
|
#define EPROTONOSUPPORT 93 // Protocol not supported
|
|
#define EOPNOTSUPP 95 // Operation not supported on transport endpoint
|
|
#define EAFNOSUPPORT 97 // Address family not supported by protocol
|
|
#define EADDRINUSE 98 // Address already in use
|
|
#define EADDRNOTAVAIL 99 // Cannot assign requested address
|
|
#define ECONNRESET 104 // Connection reset by peer
|
|
#define EISCONN 106 // Transport endpoint is already connected
|
|
#define ENODATA 61 // No data available -- no such attribute
|
|
#define ENOBUFS 105 // No buffer space available
|
|
#define ENOTSUP 95 // Operation not supported
|
|
#define ENETDOWN 100 // Network is down
|
|
#define ENETUNREACH 101 // Network is unreachable
|
|
#define ENOTCONN 107 // Transport endpoint is not connected
|
|
#define ECONNREFUSED 111 // Connection refused
|
|
|
|
#endif // SCHOS_ERRNO_H
|