StarOS MMU-001 panic test: the probe's SBR1 record options. The maintainer asked that the panic handler's SBR1 publication and EXI handover be tested with the record present, and the behaviour without it. Until now the probe never created the record, so those paths ran only on the console.
Commit
15da28ad7b StarletBootstrapProbe: --sbr1-record and --sbr1-absent (Tools/StarletBootstrapProbe/StarletBootstrapProbe.cpp only, +55 −1).
--sbr1-record: before the run, writes StarOS's SBR1 record at MEM1 0x00200000 as the Broadway loader and the ARM relay leave it: version 1, size 0x1000, EXI owner 2 (Starlet), relay status 4 (jumping), then the magic 0x53425231 last.
After the run, with either option: prints the record's magic, state, reason, EXI owner, fault code, ring length, dropped count, and how many of its 1024 words are nonzero.
--sbr1-absent: creates nothing; the report must show every word still zero.
The two options exclude each other (usage error, status 2). Offsets and codes are StarOS's crates/boot-contract (report.rs).
No change without the options
Without either option the probe behaves as before: the StarOS scenarios without them give the same traces, positions and stderr. IOS LLE, ARMCore and StarletMemory are untouched.
Evidence (Windows x64, MSVC 19.51, Release)
Probe built by StarOS tools/dolphin/build_probe.py from this commit, clean checkout: SHA-256 8007a3e121d1f5ee03a08ee068fe04093aa57e0ebc435cd26c682ba8c27b5f97. StarOS scenarios, interpreter and JIT, identical:
idle with a record: state 3, EXI owner 1, ring 258 bytes, no Gecko emulated.
fatal-data: state 4, reason 3. undefined-entry: state 6, fault 1, ring empty (stack-free path).
Panic test image: state 5, reason 0, EXI owner 1 with a record; without one, nonzero_words 0.
Review fixes (maintainer review of 2026-10-14)
The review found two panic checks from F1 that were never fixed.
a62c65615a IOS LLE: StarOS's panic words must not alias. LoadBootstrapELF now rejects __panic_state and __panic_code when they are the same word or share bytes. New test BootstrapELFTest.PanicWordsMustNotAlias.
6ede30f99e StarletBootstrapProbe: wait for StarOS's whole panic path. --expect-panic no longer stops at the first nonzero guard. The probe keeps running until every condition holds, and still holds two slices later; it fails, naming the first unmet condition, if the run budget ends first:
__panic_state 1 and __panic_code 1;
with --sbr1-record: STARLET_STATE 5, FATAL_REASON 0, EXI_OWNER 1;
with --sbr1-absent: the record area still zero.
The check is the pure StarOSPanicCheck.h, covered by StarletProbePanicCheckTest.
Evidence:
Each of 8 mutants of the two rules fails a test.
Full tests.exe: 1563 tests, 1558 passed, 0 failed, 5 skipped (StarletEthernetNAT, which depends on the environment).
Three panic images derived from StarOS eb930ee pass the previous probe (15da28ad7b) and fail the new one, in the interpreter and the JIT: EXI kept by the Starlet, __panic_code never stored, the record written although absent. The original image passes both.
Fast-forward of master only after the maintainer's review.
StarOS MMU-001 panic test: the probe's SBR1 record options. The maintainer asked that the panic handler's SBR1 publication and EXI handover be tested with the record present, and the behaviour without it. Until now the probe never created the record, so those paths ran only on the console.
## Commit
`15da28ad7b` StarletBootstrapProbe: `--sbr1-record` and `--sbr1-absent` (`Tools/StarletBootstrapProbe/StarletBootstrapProbe.cpp` only, +55 −1).
- `--sbr1-record`: before the run, writes StarOS's SBR1 record at MEM1 `0x00200000` as the Broadway loader and the ARM relay leave it: version 1, size 0x1000, EXI owner 2 (Starlet), relay status 4 (jumping), then the magic `0x53425231` last.
- After the run, with either option: prints the record's magic, state, reason, EXI owner, fault code, ring length, dropped count, and how many of its 1024 words are nonzero.
- `--sbr1-absent`: creates nothing; the report must show every word still zero.
- The two options exclude each other (usage error, status 2). Offsets and codes are StarOS's `crates/boot-contract` (`report.rs`).
## No change without the options
Without either option the probe behaves as before: the StarOS scenarios without them give the same traces, positions and stderr. IOS LLE, `ARMCore` and `StarletMemory` are untouched.
## Evidence (Windows x64, MSVC 19.51, Release)
Probe built by StarOS `tools/dolphin/build_probe.py` from this commit, clean checkout: SHA-256 `8007a3e121d1f5ee03a08ee068fe04093aa57e0ebc435cd26c682ba8c27b5f97`. StarOS scenarios, interpreter and JIT, identical:
- `idle` with a record: state 3, EXI owner 1, ring 258 bytes, no Gecko emulated.
- `fatal-data`: state 4, reason 3. `undefined-entry`: state 6, fault 1, ring empty (stack-free path).
- Panic test image: state 5, reason 0, EXI owner 1 with a record; without one, `nonzero_words 0`.
## Review fixes (maintainer review of 2026-10-14)
The review found two panic checks from F1 that were never fixed.
1. `a62c65615a` IOS LLE: StarOS's panic words must not alias. `LoadBootstrapELF` now rejects `__panic_state` and `__panic_code` when they are the same word or share bytes. New test `BootstrapELFTest.PanicWordsMustNotAlias`.
2. `6ede30f99e` StarletBootstrapProbe: wait for StarOS's whole panic path. `--expect-panic` no longer stops at the first nonzero guard. The probe keeps running until every condition holds, and still holds two slices later; it fails, naming the first unmet condition, if the run budget ends first:
- `__panic_state` 1 and `__panic_code` 1;
- with `--sbr1-record`: STARLET_STATE 5, FATAL_REASON 0, EXI_OWNER 1;
- with `--sbr1-absent`: the record area still zero.
The check is the pure `StarOSPanicCheck.h`, covered by `StarletProbePanicCheckTest`.
Evidence:
- Each of 8 mutants of the two rules fails a test.
- Full `tests.exe`: 1563 tests, 1558 passed, 0 failed, 5 skipped (StarletEthernetNAT, which depends on the environment).
- Three panic images derived from StarOS `eb930ee` pass the previous probe (`15da28ad7b`) and fail the new one, in the interpreter and the JIT: EXI kept by the Starlet, `__panic_code` never stored, the record written although absent. The original image passes both.
Fast-forward of `master` only after the maintainer's review.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
StarOS's SBR1 boot record (MEM1 0x00200000) is created by its Broadway
loader before the image runs; the probe never had one, so the paths
that publish into it ran only on the console. --sbr1-record writes the
record as the loader and the ARM relay leave it (header, relay at its
last step, EXI channel 1 given to the Starlet, magic last); after the run
both options print the record's magic, state, reason, EXI owner, fault
code, ring length and dropped count, and how many of its 1024 words are
nonzero (0 is expected with --sbr1-absent). Without either option the
probe behaves as before.
With the StarOS M1 images (interpreter and JIT): idle publishes state 3
and hands EXI back (owner 1, ring 258 bytes, no Gecko emulated);
fatal-data state 4 reason 3; undefined-entry state 6, fault 1, ring
empty, as on the console (gates HW2-HW4).
Co-Authored-By: Claude Opus 5.5 <[email protected]>
LoadBootstrapELF accepted __panic_state and __panic_code at the same
address, or as two words sharing bytes: the code's store would then also
set the guard, and nothing could tell the two apart. They must now be two
non-overlapping words of the data segment, like the other checks, before
any byte is written. BootstrapELFTest.PanicWordsMustNotAlias: the same
word and three partial overlaps, all inside the data segment, are
rejected; adjacent words are accepted. With the rule disabled, the test
fails. (StarOS MMU-001 review of F1.)
Co-Authored-By: Claude Opus 5.5 <[email protected]>
--expect-panic passed as soon as __panic_state was nonzero at the end of
a 4096-cycle slice. StarOS's handler stores the guard first, then the
code, then publishes the SBR1 record, so the run could stop with the path
half done. The probe now keeps running until the path is finished and
still is two slices later, and fails if the run budget ends first:
- __panic_state 1 and __panic_code 1;
- with --sbr1-record: STARLET_STATE 5 (Panic), FATAL_REASON 0 and
EXI_OWNER 1 (handed back to the PPC);
- with --sbr1-absent: every word of the record area still zero.
The failure names the first unmet condition. The check is
StarOSPanicCheck.h, pure, with the SBR1 constants moved there, and
StarletProbePanicCheckTest covers each condition; each of 7 mutants of
the check fails a test. Runs that do not expect a panic are unchanged.
With StarOS's panic test image (eb930ee), interpreter and JIT: the
scenarios pass, two slices later than before. Three images derived from
it pass the previous probe and now fail: EXI kept by the Starlet
(--sbr1-record), __panic_code never stored, the record written although
absent (--sbr1-absent). (StarOS MMU-001 review of F1.)
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
StarOS MMU-001 panic test: the probe's SBR1 record options. The maintainer asked that the panic handler's SBR1 publication and EXI handover be tested with the record present, and the behaviour without it. Until now the probe never created the record, so those paths ran only on the console.
Commit
15da28ad7bStarletBootstrapProbe:--sbr1-recordand--sbr1-absent(Tools/StarletBootstrapProbe/StarletBootstrapProbe.cpponly, +55 −1).--sbr1-record: before the run, writes StarOS's SBR1 record at MEM10x00200000as the Broadway loader and the ARM relay leave it: version 1, size 0x1000, EXI owner 2 (Starlet), relay status 4 (jumping), then the magic0x53425231last.--sbr1-absent: creates nothing; the report must show every word still zero.crates/boot-contract(report.rs).No change without the options
Without either option the probe behaves as before: the StarOS scenarios without them give the same traces, positions and stderr. IOS LLE,
ARMCoreandStarletMemoryare untouched.Evidence (Windows x64, MSVC 19.51, Release)
Probe built by StarOS
tools/dolphin/build_probe.pyfrom this commit, clean checkout: SHA-2568007a3e121d1f5ee03a08ee068fe04093aa57e0ebc435cd26c682ba8c27b5f97. StarOS scenarios, interpreter and JIT, identical:idlewith a record: state 3, EXI owner 1, ring 258 bytes, no Gecko emulated.fatal-data: state 4, reason 3.undefined-entry: state 6, fault 1, ring empty (stack-free path).nonzero_words 0.Review fixes (maintainer review of 2026-10-14)
The review found two panic checks from F1 that were never fixed.
a62c65615aIOS LLE: StarOS's panic words must not alias.LoadBootstrapELFnow rejects__panic_stateand__panic_codewhen they are the same word or share bytes. New testBootstrapELFTest.PanicWordsMustNotAlias.6ede30f99eStarletBootstrapProbe: wait for StarOS's whole panic path.--expect-panicno longer stops at the first nonzero guard. The probe keeps running until every condition holds, and still holds two slices later; it fails, naming the first unmet condition, if the run budget ends first:__panic_state1 and__panic_code1;--sbr1-record: STARLET_STATE 5, FATAL_REASON 0, EXI_OWNER 1;--sbr1-absent: the record area still zero.The check is the pure
StarOSPanicCheck.h, covered byStarletProbePanicCheckTest.Evidence:
tests.exe: 1563 tests, 1558 passed, 0 failed, 5 skipped (StarletEthernetNAT, which depends on the environment).eb930eepass the previous probe (15da28ad7b) and fail the new one, in the interpreter and the JIT: EXI kept by the Starlet,__panic_codenever stored, the record written although absent. The original image passes both.Fast-forward of
masteronly after the maintainer's review.🤖 Generated with Claude Code
Pull request closed