init survives stray signals; commands are 4-34x faster

Two bugs reported from actual use, plus a test harness that had stopped
testing.

init could be killed by Ctrl-C, taking the machine with it. SIGINT goes
to the foreground process group, init is pgid 1, and any window where
tty_fg_pgrp is 1 -- before a shell claims the terminal, after one exits,
or between the two while the key is held -- lands it on init. init has
no handler, so killed was set, exit() ran, and exit() panics outright on
initproc. Spamming Ctrl-C at a frozen program is exactly the input that
finds that window. POSIX and Linux both discard a default-action signal
for pid 1; init_ignores() now does the same, SIGKILL included, because
init is not killable from userspace on any Unix.

Everything was slow because BSIZE was 1024 while a SchFS block is 4096,
so every block cost four IDE requests, each with its own interrupt and
sleep/wakeup. exec() of the 800 KB toybox binary meant ~800 round trips.
The giveaway: `seq 1 200`, which touches no file and prints nothing,
cost the same 2.0s as `cat /bin/toybox`, and `ls | wc -l` cost exactly
double -- both dominated by loading the same binary twice.

BSIZE is 4096 now, one request per SchFS block, and NBUF is 256 blocks
(1 MB) rather than 90 KB -- smaller than the binary every command execs,
so nothing was ever still resident. ideinit() issues SET MULTIPLE MODE,
which is what makes a 4096-byte transfer legal: READ/WRITE MULTIPLE move
the drive's multiple count per interrupt and nothing had ever set it,
which is the real reason idestart() carried a sector_per_block > 7 panic.

  seq 1 200          2.02s -> 0.06s
  ls /bin            2.76s -> 0.68s
  ls /bin | wc -l    4.68s -> 0.73s

And the harness. bootcheck called Find-Qemu from a param() default,
which is bound before any function in the body exists -- so it died on
its first line and printed an error containing neither "FAIL" nor
"Exception", the two things being grepped for. It had not run since it
was made host-portable. Worse, an earlier index-based edit had deleted
the Expect blocks for -Tty, -Usb, -Sock, -Ps and -Evdev, so five of the
seven modes asserted nothing at all. Restored, and the USB run gets its
own 16 MB build/usbstick.img: it had been pointed at build/fs.img, which
nothing builds since SchFS became root, so QEMU refused to start.

242 checks across seven modes, all passing, and make schfs-check green.
This commit is contained in:
Nexoniarz 2026-08-09 15:54:05 +02:00
commit 686d5cf006
13 changed files with 220 additions and 13 deletions

View file

@ -49,7 +49,7 @@ param(
# else in this suite touches.
[switch]$Ps,
[int]$BootSeconds = 20,
[string]$Qemu = (Find-Qemu)
[string]$Qemu
)
# QEMU, on whichever host this is.
@ -75,6 +75,8 @@ function Find-Qemu {
throw "qemu-system-x86_64 not found on PATH. Install QEMU, or pass -Qemu <path>."
}
if (-not $Qemu) { $Qemu = Find-Qemu }
$ErrorActionPreference = 'Stop'
# Repo root is two levels up: this script lives in tools/windows/.
$root = Split-Path (Split-Path $PSScriptRoot -Parent) -Parent
@ -132,6 +134,22 @@ $commands += 'wc -l /etc/motd'
# above and fail here.
$commands += 'cat /proc/schfs'
# init must survive signals it has no handler for.
#
# This is a crash-the-whole-machine bug, not a nicety: Ctrl-C sends SIGINT to
# the foreground process group, init is pgid 1, and any window where
# tty_fg_pgrp is 1 lands it on init -- which had no handler, so killed was set,
# exit() ran, and exit() panics outright on initproc. Spamming Ctrl-C at a
# frozen program is what finds that window.
#
# SIGKILL is in here deliberately: init is not killable from userspace on any
# Unix, and a guard that covers SIGINT but not SIGKILL is half a fix.
$commands += 'kill -INT 1'
$commands += 'kill -KILL 1'
$commands += 'kill -TERM 1'
$commands += 'echo INIT-SURVIVED'
$commands += 'ps | head -3'
if ($Fb) {
# /dev/fb0. The geometry has to come back from the mode the bootloader
# actually programmed -- three places in the kernel used to assume
@ -213,14 +231,14 @@ $usbDevices = if ($Usb) {
# the hub sits on port 2 and the mouse on port 2.1 of the same bus.
'-device usb-hub,id=hub,bus=xhci.0,port=2'
'-device usb-mouse,bus=xhci.0,port=2.1'
# Always the v1 image, never $hdb. The checks below read a v1 superblock
# Its own small image, never $hdb. The checks below read a v1 superblock
# off this stick and assert on its sector count and size field, so the
# stick has to be a v1 image whatever the root filesystem is -- under
# the root $hdb is a SchFS volume and those fields are simply not
# there, which failed three USB checks that had nothing wrong with USB.
# It also stops the same file being attached twice, once as the root
# disk and once as a USB device.
"-drive id=usbstick,file=`"$(Join-Path $root 'build/fs.img')`",format=raw,if=none"
"-drive id=usbstick,file=`"$(Join-Path $root 'build/usbstick.img')`",format=raw,if=none"
'-device usb-storage,bus=xhci.0,drive=usbstick')
} else { @() }
@ -419,6 +437,12 @@ Expect '00:01\.1 8086:7010 IDE' 'the IDE controller was identified by class'
Expect '\[vga\]' 'a driver bound itself to the display controller'
Expect 'vga: display controller' 'the display driver found its aperture'
# If init had died the machine would have panicked and nothing below this
# point would appear at all -- but check explicitly, so a failure names the
# cause instead of showing up as "the shell stopped answering".
Expect 'INIT-SURVIVED' 'init survives SIGINT, SIGKILL and SIGTERM'
Expect '(?m)^\s*1\s' 'pid 1 is still in the process table afterwards'
Expect 'schfs: mounted' 'the kernel mounted SchFS as the root filesystem'
Expect 'init: ready' 'init came up on a SchFS root'
Expect 'label:\s*schos' '/proc/schfs reports the volume label'
@ -457,5 +481,62 @@ if ($Fb) {
Expect 'gradient drawn' 'mmap of /dev/fb0 maps the real framebuffer'
}
if ($Tty) {
# Each of these is a bug that once looked like a broken *command*.
# `ls | wc -l` reported 48 rather than the real count because ioctl
# answered TIOCGWINSZ on a pipe with success, so ls formatted in columns.
# Anything in the hundreds means it printed one name per line.
Expect '(?m)^\s*[2-9][0-9]{2}\s*$' 'ls into a pipe prints one name per line'
# writev capped iovcnt at 16; toybox builds 256 of them, so `yes` failed
# outright.
Expect '(?ms)yes \| head -2\s*\n\s*y\s*\n\s*y' 'yes writes through a pipe'
# 0x7F E L F. Four bytes, not three -- the leading byte is invisible.
Expect 'ELF' 'a binary reads back through a pipe intact'
Expect 'caf.*-.*-' 'UTF-8 survives the terminal unmangled'
# SIG_IGN is handler value 1, and signal delivery once jumped to address 1,
# which killed the shell rather than the pipeline.
Expect 'TTY-SURVIVED' 'the shell is still alive after all of that'
Expect 'shmtest: all checks passed' 'shared memory and file-backed mmap work'
}
if ($Usb) {
# A registered handler that never fires looks exactly like a working one
# from userspace. A non-zero count on the xhci line is the difference.
# Not anchored to the start of the line: xHCI shares IRQ 11 with the e1000
# here, so the line reads "11: 28 e1000, 28 xhci level" and the xhci
# entry is the second one on it.
Expect '[1-9]\d*\s+xhci' 'the xHCI interrupt is actually delivered'
# build/usbstick.img is 16 MB = 32768 sectors of 512 bytes. READ CAPACITY
# returning the true geometry is what separates a driver that parsed the
# reply from one that assumed a size.
Expect 'usb-storage: 32768 sectors of 512 bytes' 'READ CAPACITY returned the true size'
# And then an actual transfer: block 1 of a v1 image is its superblock.
Expect 'block 1 magic 10203040' 'a real block came back off the USB disk'
Expect 'size 4096' 'the superblock read over USB is the right one'
}
if ($Sock) {
Expect 'socktest: ALL CHECKS PASSED' 'every socket check passed'
}
if ($Ps) {
# /proc is synthetic, so a per-process directory is the thing to prove.
# `ls /proc` prints in columns, so pid 1 is a token on a line rather than a
# line of its own.
Expect '(?m)^1\s+\d' '/proc has a directory for pid 1'
Expect '(?m)^1 \(' '/proc/1/stat starts with the pid and comm'
Expect 'sinit|init' 'ps names pid 1'
Expect '(?m)PID.*PPID.*COMM' 'ps honours -o with the requested columns'
Expect 'load average|Mem|CPU' 'top produces a report rather than an error'
}
if ($Evdev) {
# A key has to be *pressed* for this to say anything: characters typed at
# the serial port never reach the keyboard controller, which is why this
# run drives the QEMU monitor's sendkey instead.
Expect 'inputtest: done|event limit reached' 'the input layer delivered events'
Expect 'value' 'events carry a value, not just a type'
}
if ($script:fail) { exit 1 }
Write-Host 'boot check passed' -ForegroundColor Green