4.4 KiB
M6 cartridge software validation
Verified on 2026-09-21 on the x86_64 Arch build host. These results use actual AArch64 binaries, kernel USB events, s6 services and filesystem mounts in QEMU 11.1.1. Physical Pi wiring, bay calibration, simultaneous physical devices and USB electrical behavior remain deferred. Twelve-device virtual stress follows in M11; this milestone does not claim that test has already run.
Behavior verified
make cartridge-test passed in out/m6-vm.u4w9b7pl/:
- The unconfigured production image reports twelve UNCONFIGURED bays. A probe
discovers the virtual controller's actual topology; the fixture then maps its
USB 2/3 companion ports explicitly. No
/dev/sdXname selects a bay. - The SYSTEM image boots from virtual USB and is reported PROTECTED. Eject fails.
- A virtual keyboard is recognized by the hardware catalog without a filesystem.
- The ordinary FDS user can query the daemon. A different UID is rejected even when the test temporarily relaxes socket file permissions. Slow and oversized clients do not prevent another control request from completing.
- Inserting ENVIRONMENT media triggers a validated read-only mount. Writes fail. Metadata is inspected privately before the mount becomes publicly accessible.
- A shell inside the mount and an additional bind mount each prevent SAFE. After those uses end, eject unmounts successfully and reports SAFE. A service restart preserves that ejected state until removal and reinsertion.
- Reinsertion into another port follows that bay. Wrong manifest classes, symlink metadata, and multiple named partitions are rejected without choosing a first candidate. Surprise removal clears inventory; restart remounts valid, nonejected read-only media.
- Holding cartridged before its readiness notification does not prevent the ordinary UID-1000 FDS console from accepting a command.
Every VM disk used read-only remained byte-identical. Tests use disposable image files and virtual USB devices, never host disks or physical USB passthrough. VM test helpers and the temporary root test console do not ship in SYSTEM.
Shared unit tests also cover USB bus renumbering, mapping aliases and overlapping mappings, manifest symlinks/FIFOs, malformed contracts, and absent USB subsystems. The older native-init VM revealed the absent-USB case; its corrected empty-inventory behavior passed a new unit test and the complete native-init boot afterward.
Final artifacts and regression evidence
| Artifact | SHA-256 |
|---|---|
Rootfs TAR, out/rootfs-build.FpSNiJ/ |
00fc851affe0f1c42d289cc05ae376788beae9a6b0dce39c6a1f3b86687d1baf |
SYSTEM, out/system-build.df52fwqj/ |
908645b47bfe207470eeb82436f8a644d34cf3703156a7bdcbf2a3534e9346fe |
Production boot FAT, out/boot-build.bka9vs1y/ |
fb54582a9bd3bb393299002a65a5b0035e806e6733e81a437369a0b152b297e2 |
The rootfs contains 112 packages and 1,170 AArch64 ELF files; its TAR is
408,248,320 bytes. fds-cartridged is statically linked, installed by its own
mandatory base package and supervised by native s6. No external Rust dependency
or locked external version changed; the lockfile change only adds the workspace
member. Existing libc, serde, serde_json and toml provide the required interfaces.
The final pipeline exited zero: fresh rootfs and initramfs, tooling tests,
make check, rootfs checks, native-init boot, SYSTEM/boot-volume construction,
the nine-case stage0 matrix, console tests and cartridge tests. Logs are
out/logs/m6-verified-*.log. M0 bootstrap and smoke-test also passed in
out/logs/m6-final-bootstrap.log and out/logs/m6-final-smoke-test.log.
The optional M0 host-PATH emulator skip remains explicit; project-local ARM
execution and full-system tests actually ran.
Native-init evidence is in out/m2-vm.S16Noo/; stage0 cases are in
out/m4-vm.XBTVEW/; ordinary-console traces are in out/m5-vm.51n612y3/.
The normal trace measured 1,753.878 ms from the kernel clock to console, versus
1,669.027 ms in the final M5 normal trace: +84.851 ms, below the 100 ms explanation
threshold. The actual ARM comparison tool passed; see
out/logs/m6-boot-regression.log. These are individual emulator observations,
not proof of physical Pi latency or a statistically established timing change.
Writable DATA, consumer shutdown and syncfs follow in M7; desktop/profile activation follows in M8. Read Cartridge usage for exact commands, configuration syntax, current states and safe-eject boundaries.