init survives stray signals; commands are 4-34x faster

Two bugs reported from actual use, plus a test harness that had stopped
testing.

init could be killed by Ctrl-C, taking the machine with it. SIGINT goes
to the foreground process group, init is pgid 1, and any window where
tty_fg_pgrp is 1 -- before a shell claims the terminal, after one exits,
or between the two while the key is held -- lands it on init. init has
no handler, so killed was set, exit() ran, and exit() panics outright on
initproc. Spamming Ctrl-C at a frozen program is exactly the input that
finds that window. POSIX and Linux both discard a default-action signal
for pid 1; init_ignores() now does the same, SIGKILL included, because
init is not killable from userspace on any Unix.

Everything was slow because BSIZE was 1024 while a SchFS block is 4096,
so every block cost four IDE requests, each with its own interrupt and
sleep/wakeup. exec() of the 800 KB toybox binary meant ~800 round trips.
The giveaway: `seq 1 200`, which touches no file and prints nothing,
cost the same 2.0s as `cat /bin/toybox`, and `ls | wc -l` cost exactly
double -- both dominated by loading the same binary twice.

BSIZE is 4096 now, one request per SchFS block, and NBUF is 256 blocks
(1 MB) rather than 90 KB -- smaller than the binary every command execs,
so nothing was ever still resident. ideinit() issues SET MULTIPLE MODE,
which is what makes a 4096-byte transfer legal: READ/WRITE MULTIPLE move
the drive's multiple count per interrupt and nothing had ever set it,
which is the real reason idestart() carried a sector_per_block > 7 panic.

  seq 1 200          2.02s -> 0.06s
  ls /bin            2.76s -> 0.68s
  ls /bin | wc -l    4.68s -> 0.73s

And the harness. bootcheck called Find-Qemu from a param() default,
which is bound before any function in the body exists -- so it died on
its first line and printed an error containing neither "FAIL" nor
"Exception", the two things being grepped for. It had not run since it
was made host-portable. Worse, an earlier index-based edit had deleted
the Expect blocks for -Tty, -Usb, -Sock, -Ps and -Evdev, so five of the
seven modes asserted nothing at all. Restored, and the USB run gets its
own 16 MB build/usbstick.img: it had been pointed at build/fs.img, which
nothing builds since SchFS became root, so QEMU refused to start.

242 checks across seven modes, all passing, and make schfs-check green.

kernel/dev/ide.c

@@ -23,6 +23,7 @@
 #define IDE_CMD_READ  0x20
 #define IDE_CMD_WRITE 0x30
 #define IDE_CMD_RDMUL 0xc4
+#define IDE_CMD_SETMULT 0xc6
 #define IDE_CMD_WRMUL 0xc5
 
 // idequeue points to the buf now being read/written to the disk.
@@ -69,6 +70,28 @@ ide_irq(void *arg)
   ideintr();
 }
 
+// SET MULTIPLE MODE: how many sectors the drive moves per interrupt during
+// READ/WRITE MULTIPLE. Must equal BSIZE/SECTOR_SIZE or idestart()'s single
+// insl/outsl of a whole block does not line up with the drive's bursts.
+//
+// A drive may refuse a count it cannot do (IDENTIFY word 47 carries its
+// maximum; QEMU allows 16). If it does, say so rather than continue: the
+// transfers would silently desynchronise, which reads as filesystem
+// corruption rather than as a driver problem.
+static void
+ide_set_multiple(int dev)
+{
+  int spb = BSIZE / SECTOR_SIZE;
+
+  outb(0x1f6, 0xe0 | ((dev & 1) << 4));
+  if(idewait(0) < 0)
+    return;
+  outb(0x1f2, spb);
+  outb(0x1f7, IDE_CMD_SETMULT);
+  if(idewait(1) < 0)
+    cprintf("ide%d: SET MULTIPLE MODE %d rejected; expect trouble\n", dev, spb);
+}
+
 void
 ideinit(void)
 {
@@ -95,6 +118,23 @@ ideinit(void)
     }
   }
 
+  // Tell each drive how many sectors to move per interrupt.
+  //
+  // READ/WRITE MULTIPLE transfer the drive's *multiple count* of sectors
+  // between interrupts, and that count is whatever SET MULTIPLE MODE last
+  // established -- it is not taken from the sector-count register. Nothing
+  // ever issued it here, so the count was undefined, which is the real reason
+  // idestart() carried a `sector_per_block > 7` panic: BSIZE was 1024, two
+  // sectors, and nobody had tested further.
+  //
+  // Establishing it explicitly is what lets BSIZE be a whole SchFS block. At
+  // 1024 every 4096-byte SchFS block cost four IDE requests, each with its own
+  // interrupt and sleep/wakeup, and exec() of the 800 KB toybox binary meant
+  // ~800 round trips -- about two seconds, on every command.
+  ide_set_multiple(0);
+  if(havedisk1)
+    ide_set_multiple(1);
+
   // Switch back to disk 0.
   outb(0x1f6, 0xe0 | (0<<4));
 }
@@ -121,7 +161,10 @@ idestart(struct buf *b)
   int read_cmd = (sector_per_block == 1) ? IDE_CMD_READ :  IDE_CMD_RDMUL;
   int write_cmd = (sector_per_block == 1) ? IDE_CMD_WRITE : IDE_CMD_WRMUL;
 
-  if (sector_per_block > 7) panic("idestart");
+  // No `sector_per_block > 7` panic here any more. That limit existed because
+  // nothing had set the drive's multiple count, so anything past the tested
+  // two sectors was a guess; ideinit() issues SET MULTIPLE MODE now, and the
+  // count is whatever BSIZE says.
 
   idewait(0);
   outb(0x3f6, 0);  // generate interrupt

kernel/proc/proc.c

@@ -551,6 +551,26 @@ wakeup(void *chan)
 // mksh depends on kill(getpid(), SIGCHLD) genuinely re-raising SIGCHLD
 // (its held_sigchld recovery in j_startjob); the previous sys_kill
 // silently discarded every non-fatal signal.
+// PID 1 does not die from a signal it never asked to handle.
+//
+// POSIX, and Linux in sig_task_ignored(): a signal whose disposition is the
+// default action is discarded for init rather than delivered. Without this the
+// system has a single keystroke that kills it -- Ctrl-C sends SIGINT to the
+// foreground process group, init is pgid 1, and any moment where tty_fg_pgrp
+// is 1 (before a shell claims the terminal, after one exits, or in the window
+// between the two while the key is held down) lands SIGINT on init. init has
+// no handler, so killed is set, exit() runs, and exit() panics outright on
+// initproc: "init exiting". Spamming Ctrl-C at a frozen program is exactly the
+// input that finds that window.
+//
+// Applies to SIGKILL too, which is the point: init is not killable from
+// userspace on any Unix. A handler it did install is still delivered.
+static int
+init_ignores(struct proc *p, int sig)
+{
+  return p == initproc && p->sig_handler[sig] == 0;
+}
+
 int
 sigsend(int pid, int sig)
 {
@@ -562,6 +582,10 @@ sigsend(int pid, int sig)
   acquire(&ptable.lock);
   for(p = ptable.proc; p < &ptable.proc[NPROC]; p++){
     if(p->pid == pid && p->state != UNUSED && p->state != ZOMBIE){
+      if(init_ignores(p, sig)){
+        release(&ptable.lock);
+        return 0;           // silently dropped, as POSIX requires
+      }
       p->pending_signals |= 1ULL << sig;
       if(p->sig_handler[sig] == 0 &&
          (sig == SIGKILL || sig == SIGTERM || sig == SIGABRT ||
@@ -607,6 +631,8 @@ sigsend_pgrp(int pgid, int sig)
     found = 1;
     if(sig == 0)
       continue;              // signal 0 is an existence probe only
+    if(init_ignores(p, sig))
+      continue;              // see init_ignores(): this is the Ctrl-C case
     p->pending_signals |= 1ULL << sig;
     if(p->sig_handler[sig] == 0 &&
        (sig == SIGKILL || sig == SIGTERM || sig == SIGABRT ||