init survives stray signals; commands are 4-34x faster

Two bugs reported from actual use, plus a test harness that had stopped
testing.

init could be killed by Ctrl-C, taking the machine with it. SIGINT goes
to the foreground process group, init is pgid 1, and any window where
tty_fg_pgrp is 1 -- before a shell claims the terminal, after one exits,
or between the two while the key is held -- lands it on init. init has
no handler, so killed was set, exit() ran, and exit() panics outright on
initproc. Spamming Ctrl-C at a frozen program is exactly the input that
finds that window. POSIX and Linux both discard a default-action signal
for pid 1; init_ignores() now does the same, SIGKILL included, because
init is not killable from userspace on any Unix.

Everything was slow because BSIZE was 1024 while a SchFS block is 4096,
so every block cost four IDE requests, each with its own interrupt and
sleep/wakeup. exec() of the 800 KB toybox binary meant ~800 round trips.
The giveaway: `seq 1 200`, which touches no file and prints nothing,
cost the same 2.0s as `cat /bin/toybox`, and `ls | wc -l` cost exactly
double -- both dominated by loading the same binary twice.

BSIZE is 4096 now, one request per SchFS block, and NBUF is 256 blocks
(1 MB) rather than 90 KB -- smaller than the binary every command execs,
so nothing was ever still resident. ideinit() issues SET MULTIPLE MODE,
which is what makes a 4096-byte transfer legal: READ/WRITE MULTIPLE move
the drive's multiple count per interrupt and nothing had ever set it,
which is the real reason idestart() carried a sector_per_block > 7 panic.

  seq 1 200          2.02s -> 0.06s
  ls /bin            2.76s -> 0.68s
  ls /bin | wc -l    4.68s -> 0.73s

And the harness. bootcheck called Find-Qemu from a param() default,
which is bound before any function in the body exists -- so it died on
its first line and printed an error containing neither "FAIL" nor
"Exception", the two things being grepped for. It had not run since it
was made host-portable. Worse, an earlier index-based edit had deleted
the Expect blocks for -Tty, -Usb, -Sock, -Ps and -Evdev, so five of the
seven modes asserted nothing at all. Restored, and the USB run gets its
own 16 MB build/usbstick.img: it had been pointed at build/fs.img, which
nothing builds since SchFS became root, so QEMU refused to start.

242 checks across seven modes, all passing, and make schfs-check green.
This commit is contained in:
Nexoniarz 2026-08-09 15:54:05 +02:00
commit 686d5cf006
13 changed files with 220 additions and 13 deletions

View file

@ -711,6 +711,27 @@ $(BUILD)/sysroot.stamp: sysroot-install
@cmp -s $@.new $@ || mv -f $@.new $@
@rm -f $@.new
# A small block device for the USB test to read.
#
# bootcheck -Usb attaches this as a usb-storage device and has the driver read
# block 1 off it, which is the only check that separates "a device answered
# INQUIRY" from "the driver can actually transfer data".
#
# Its own image, not the root volume and not build/fs.img:
# - attaching the root volume twice (once as hdb, once over USB) broke the
# xHCI interrupt check as well as the storage ones;
# - build/fs.img is no longer built by anything, since SchFS became the root,
# so pointing at it meant QEMU refused to start at all;
# - at FSSIZE blocks it would now be ~600 MB, because BSIZE went from 1024 to
# 4096. 16 MB is plenty to read one block from.
USBSTICK = $(BUILD)/usbstick.img
$(USBSTICK): $(MKFS) $(BUILD)/sysroot.stamp
@mkdir -p $(BUILD)
@rm -f $@
$(MKFS) $@ --size 4096 --sysroot $(SYSROOT)
usbstick: $(USBSTICK)
$(BUILD)/fs.img: $(MKFS) $(BUILD)/sysroot.stamp
@mkdir -p $(BUILD)
@echo "Creating SchOS File System Image..."

View file

@ -13,7 +13,18 @@
#define FS_H
#define ROOTINO 1 // root i-number
#define BSIZE 1024 // block size
// Buffer-cache block size. Matches SCHFS_BLKSIZE deliberately.
//
// This was 1024, inherited from xv6, while a SchFS block is 4096 -- so every
// SchFS block cost *four* bread() calls, and each bread() is one IDE request
// with its own interrupt, sleep and wakeup. Loading the 800 KB toybox binary
// meant ~800 round-trips, which is why every command took about two seconds:
// `seq 1 200`, which touches no file and prints nothing, cost the same 2.0s as
// `cat /bin/toybox`, because both are dominated by exec() reading the same
// binary. `ls | wc -l` cost exactly double, loading it twice.
//
// At 4096 a SchFS block is one request. Keep the two equal.
#define BSIZE 4096 // block size
// Permission mode bits (rwmode field)
#define RW 3 // 11 read+write

View file

@ -24,5 +24,16 @@
#define MAXPATH 128 // max path
#define MAXOPBLOCKS 30 // max # of blocks any FS op writes
#define LOGSIZE (MAXOPBLOCKS*3) // max data blocks in on-disk log
#define NBUF (MAXOPBLOCKS*3) // size of disk block cache
// Disk block cache, in blocks. 256 * BSIZE = 1 MB.
//
// Was MAXOPBLOCKS*3 = 90 blocks, and at the old 1 KB BSIZE that is a 90 KB
// cache -- smaller than the toybox binary that every single command execs. So
// nothing was ever still resident on the next command and each one paid the
// full read again. 1 MB holds toybox with room to spare, which is what makes
// the *second* command fast rather than just the first.
//
// Sized rather than maximised: these are statically allocated in bio.c, so
// this is memory the system always spends. 1 MB is affordable on a machine
// with tens of megabytes; 8 MB would not be.
#define NBUF 256
#define FSSIZE 150000 // size of file system in blocks

View file

@ -23,6 +23,7 @@
#define IDE_CMD_READ 0x20
#define IDE_CMD_WRITE 0x30
#define IDE_CMD_RDMUL 0xc4
#define IDE_CMD_SETMULT 0xc6
#define IDE_CMD_WRMUL 0xc5
// idequeue points to the buf now being read/written to the disk.
@ -69,6 +70,28 @@ ide_irq(void *arg)
ideintr();
}
// SET MULTIPLE MODE: how many sectors the drive moves per interrupt during
// READ/WRITE MULTIPLE. Must equal BSIZE/SECTOR_SIZE or idestart()'s single
// insl/outsl of a whole block does not line up with the drive's bursts.
//
// A drive may refuse a count it cannot do (IDENTIFY word 47 carries its
// maximum; QEMU allows 16). If it does, say so rather than continue: the
// transfers would silently desynchronise, which reads as filesystem
// corruption rather than as a driver problem.
static void
ide_set_multiple(int dev)
{
int spb = BSIZE / SECTOR_SIZE;
outb(0x1f6, 0xe0 | ((dev & 1) << 4));
if(idewait(0) < 0)
return;
outb(0x1f2, spb);
outb(0x1f7, IDE_CMD_SETMULT);
if(idewait(1) < 0)
cprintf("ide%d: SET MULTIPLE MODE %d rejected; expect trouble\n", dev, spb);
}
void
ideinit(void)
{
@ -95,6 +118,23 @@ ideinit(void)
}
}
// Tell each drive how many sectors to move per interrupt.
//
// READ/WRITE MULTIPLE transfer the drive's *multiple count* of sectors
// between interrupts, and that count is whatever SET MULTIPLE MODE last
// established -- it is not taken from the sector-count register. Nothing
// ever issued it here, so the count was undefined, which is the real reason
// idestart() carried a `sector_per_block > 7` panic: BSIZE was 1024, two
// sectors, and nobody had tested further.
//
// Establishing it explicitly is what lets BSIZE be a whole SchFS block. At
// 1024 every 4096-byte SchFS block cost four IDE requests, each with its own
// interrupt and sleep/wakeup, and exec() of the 800 KB toybox binary meant
// ~800 round trips -- about two seconds, on every command.
ide_set_multiple(0);
if(havedisk1)
ide_set_multiple(1);
// Switch back to disk 0.
outb(0x1f6, 0xe0 | (0<<4));
}
@ -121,7 +161,10 @@ idestart(struct buf *b)
int read_cmd = (sector_per_block == 1) ? IDE_CMD_READ : IDE_CMD_RDMUL;
int write_cmd = (sector_per_block == 1) ? IDE_CMD_WRITE : IDE_CMD_WRMUL;
if (sector_per_block > 7) panic("idestart");
// No `sector_per_block > 7` panic here any more. That limit existed because
// nothing had set the drive's multiple count, so anything past the tested
// two sectors was a guess; ideinit() issues SET MULTIPLE MODE now, and the
// count is whatever BSIZE says.
idewait(0);
outb(0x3f6, 0); // generate interrupt

View file

@ -551,6 +551,26 @@ wakeup(void *chan)
// mksh depends on kill(getpid(), SIGCHLD) genuinely re-raising SIGCHLD
// (its held_sigchld recovery in j_startjob); the previous sys_kill
// silently discarded every non-fatal signal.
// PID 1 does not die from a signal it never asked to handle.
//
// POSIX, and Linux in sig_task_ignored(): a signal whose disposition is the
// default action is discarded for init rather than delivered. Without this the
// system has a single keystroke that kills it -- Ctrl-C sends SIGINT to the
// foreground process group, init is pgid 1, and any moment where tty_fg_pgrp
// is 1 (before a shell claims the terminal, after one exits, or in the window
// between the two while the key is held down) lands SIGINT on init. init has
// no handler, so killed is set, exit() runs, and exit() panics outright on
// initproc: "init exiting". Spamming Ctrl-C at a frozen program is exactly the
// input that finds that window.
//
// Applies to SIGKILL too, which is the point: init is not killable from
// userspace on any Unix. A handler it did install is still delivered.
static int
init_ignores(struct proc *p, int sig)
{
return p == initproc && p->sig_handler[sig] == 0;
}
int
sigsend(int pid, int sig)
{
@ -562,6 +582,10 @@ sigsend(int pid, int sig)
acquire(&ptable.lock);
for(p = ptable.proc; p < &ptable.proc[NPROC]; p++){
if(p->pid == pid && p->state != UNUSED && p->state != ZOMBIE){
if(init_ignores(p, sig)){
release(&ptable.lock);
return 0; // silently dropped, as POSIX requires
}
p->pending_signals |= 1ULL << sig;
if(p->sig_handler[sig] == 0 &&
(sig == SIGKILL || sig == SIGTERM || sig == SIGABRT ||
@ -607,6 +631,8 @@ sigsend_pgrp(int pgid, int sig)
found = 1;
if(sig == 0)
continue; // signal 0 is an existence probe only
if(init_ignores(p, sig))
continue; // see init_ignores(): this is the Ctrl-C case
p->pending_signals |= 1ULL << sig;
if(p->sig_handler[sig] == 0 &&
(sig == SIGKILL || sig == SIGTERM || sig == SIGABRT ||

View file

@ -49,7 +49,7 @@ param(
# else in this suite touches.
[switch]$Ps,
[int]$BootSeconds = 20,
[string]$Qemu = (Find-Qemu)
[string]$Qemu
)
# QEMU, on whichever host this is.
@ -75,6 +75,8 @@ function Find-Qemu {
throw "qemu-system-x86_64 not found on PATH. Install QEMU, or pass -Qemu <path>."
}
if (-not $Qemu) { $Qemu = Find-Qemu }
$ErrorActionPreference = 'Stop'
# Repo root is two levels up: this script lives in tools/windows/.
$root = Split-Path (Split-Path $PSScriptRoot -Parent) -Parent
@ -132,6 +134,22 @@ $commands += 'wc -l /etc/motd'
# above and fail here.
$commands += 'cat /proc/schfs'
# init must survive signals it has no handler for.
#
# This is a crash-the-whole-machine bug, not a nicety: Ctrl-C sends SIGINT to
# the foreground process group, init is pgid 1, and any window where
# tty_fg_pgrp is 1 lands it on init -- which had no handler, so killed was set,
# exit() ran, and exit() panics outright on initproc. Spamming Ctrl-C at a
# frozen program is what finds that window.
#
# SIGKILL is in here deliberately: init is not killable from userspace on any
# Unix, and a guard that covers SIGINT but not SIGKILL is half a fix.
$commands += 'kill -INT 1'
$commands += 'kill -KILL 1'
$commands += 'kill -TERM 1'
$commands += 'echo INIT-SURVIVED'
$commands += 'ps | head -3'
if ($Fb) {
# /dev/fb0. The geometry has to come back from the mode the bootloader
# actually programmed -- three places in the kernel used to assume
@ -213,14 +231,14 @@ $usbDevices = if ($Usb) {
# the hub sits on port 2 and the mouse on port 2.1 of the same bus.
'-device usb-hub,id=hub,bus=xhci.0,port=2'
'-device usb-mouse,bus=xhci.0,port=2.1'
# Always the v1 image, never $hdb. The checks below read a v1 superblock
# Its own small image, never $hdb. The checks below read a v1 superblock
# off this stick and assert on its sector count and size field, so the
# stick has to be a v1 image whatever the root filesystem is -- under
# the root $hdb is a SchFS volume and those fields are simply not
# there, which failed three USB checks that had nothing wrong with USB.
# It also stops the same file being attached twice, once as the root
# disk and once as a USB device.
"-drive id=usbstick,file=`"$(Join-Path $root 'build/fs.img')`",format=raw,if=none"
"-drive id=usbstick,file=`"$(Join-Path $root 'build/usbstick.img')`",format=raw,if=none"
'-device usb-storage,bus=xhci.0,drive=usbstick')
} else { @() }
@ -419,6 +437,12 @@ Expect '00:01\.1 8086:7010 IDE' 'the IDE controller was identified by class'
Expect '\[vga\]' 'a driver bound itself to the display controller'
Expect 'vga: display controller' 'the display driver found its aperture'
# If init had died the machine would have panicked and nothing below this
# point would appear at all -- but check explicitly, so a failure names the
# cause instead of showing up as "the shell stopped answering".
Expect 'INIT-SURVIVED' 'init survives SIGINT, SIGKILL and SIGTERM'
Expect '(?m)^\s*1\s' 'pid 1 is still in the process table afterwards'
Expect 'schfs: mounted' 'the kernel mounted SchFS as the root filesystem'
Expect 'init: ready' 'init came up on a SchFS root'
Expect 'label:\s*schos' '/proc/schfs reports the volume label'
@ -457,5 +481,62 @@ if ($Fb) {
Expect 'gradient drawn' 'mmap of /dev/fb0 maps the real framebuffer'
}
if ($Tty) {
# Each of these is a bug that once looked like a broken *command*.
# `ls | wc -l` reported 48 rather than the real count because ioctl
# answered TIOCGWINSZ on a pipe with success, so ls formatted in columns.
# Anything in the hundreds means it printed one name per line.
Expect '(?m)^\s*[2-9][0-9]{2}\s*$' 'ls into a pipe prints one name per line'
# writev capped iovcnt at 16; toybox builds 256 of them, so `yes` failed
# outright.
Expect '(?ms)yes \| head -2\s*\n\s*y\s*\n\s*y' 'yes writes through a pipe'
# 0x7F E L F. Four bytes, not three -- the leading byte is invisible.
Expect 'ELF' 'a binary reads back through a pipe intact'
Expect 'caf.*-.*-' 'UTF-8 survives the terminal unmangled'
# SIG_IGN is handler value 1, and signal delivery once jumped to address 1,
# which killed the shell rather than the pipeline.
Expect 'TTY-SURVIVED' 'the shell is still alive after all of that'
Expect 'shmtest: all checks passed' 'shared memory and file-backed mmap work'
}
if ($Usb) {
# A registered handler that never fires looks exactly like a working one
# from userspace. A non-zero count on the xhci line is the difference.
# Not anchored to the start of the line: xHCI shares IRQ 11 with the e1000
# here, so the line reads "11: 28 e1000, 28 xhci level" and the xhci
# entry is the second one on it.
Expect '[1-9]\d*\s+xhci' 'the xHCI interrupt is actually delivered'
# build/usbstick.img is 16 MB = 32768 sectors of 512 bytes. READ CAPACITY
# returning the true geometry is what separates a driver that parsed the
# reply from one that assumed a size.
Expect 'usb-storage: 32768 sectors of 512 bytes' 'READ CAPACITY returned the true size'
# And then an actual transfer: block 1 of a v1 image is its superblock.
Expect 'block 1 magic 10203040' 'a real block came back off the USB disk'
Expect 'size 4096' 'the superblock read over USB is the right one'
}
if ($Sock) {
Expect 'socktest: ALL CHECKS PASSED' 'every socket check passed'
}
if ($Ps) {
# /proc is synthetic, so a per-process directory is the thing to prove.
# `ls /proc` prints in columns, so pid 1 is a token on a line rather than a
# line of its own.
Expect '(?m)^1\s+\d' '/proc has a directory for pid 1'
Expect '(?m)^1 \(' '/proc/1/stat starts with the pid and comm'
Expect 'sinit|init' 'ps names pid 1'
Expect '(?m)PID.*PPID.*COMM' 'ps honours -o with the requested columns'
Expect 'load average|Mem|CPU' 'top produces a report rather than an error'
}
if ($Evdev) {
# A key has to be *pressed* for this to say anything: characters typed at
# the serial port never reach the keyboard controller, which is why this
# run drives the QEMU monitor's sendkey instead.
Expect 'inputtest: done|event limit reached' 'the input layer delivered events'
Expect 'value' 'events carry a value, not just a type'
}
if ($script:fail) { exit 1 }
Write-Host 'boot check passed' -ForegroundColor Green

View file

@ -14,7 +14,7 @@
param(
[int]$BootSeconds = 20,
[string]$Out = "build/crashscreen.ppm",
[string]$Qemu = (Find-Qemu)
[string]$Qemu
)
# QEMU, on whichever host this is.
@ -40,6 +40,8 @@ function Find-Qemu {
throw "qemu-system-x86_64 not found on PATH. Install QEMU, or pass -Qemu <path>."
}
if (-not $Qemu) { $Qemu = Find-Qemu }
$ErrorActionPreference = 'Stop'
# Repo root is two levels up: this script lives in tools/windows/.
$root = Split-Path (Split-Path $PSScriptRoot -Parent) -Parent

View file

@ -19,7 +19,7 @@
param(
[int]$BootSeconds = 20,
[string]$Out = "build/dispshot.ppm",
[string]$Qemu = (Find-Qemu)
[string]$Qemu
)
# QEMU, on whichever host this is.
@ -45,6 +45,8 @@ function Find-Qemu {
throw "qemu-system-x86_64 not found on PATH. Install QEMU, or pass -Qemu <path>."
}
if (-not $Qemu) { $Qemu = Find-Qemu }
$ErrorActionPreference = 'Stop'
# Repo root is two levels up: this script lives in tools/windows/.
$root = Split-Path (Split-Path $PSScriptRoot -Parent) -Parent

View file

@ -13,7 +13,7 @@ param(
[ValidateSet('fill', 'bars')]
[string]$Mode = 'fill',
[int]$BootSeconds = 20,
[string]$Qemu = (Find-Qemu)
[string]$Qemu
)
# QEMU, on whichever host this is.
@ -39,6 +39,8 @@ function Find-Qemu {
throw "qemu-system-x86_64 not found on PATH. Install QEMU, or pass -Qemu <path>."
}
if (-not $Qemu) { $Qemu = Find-Qemu }
$ErrorActionPreference = 'Stop'
# Repo root is two levels up: this script lives in tools/windows/.
$root = Split-Path (Split-Path $PSScriptRoot -Parent) -Parent

View file

@ -14,7 +14,7 @@
param(
[switch]$Run,
[switch]$Clean,
[string]$Qemu = (Find-Qemu)
[string]$Qemu
)
# QEMU, on whichever host this is.
@ -40,6 +40,8 @@ function Find-Qemu {
throw "qemu-system-x86_64 not found on PATH. Install QEMU, or pass -Qemu <path>."
}
if (-not $Qemu) { $Qemu = Find-Qemu }
$ErrorActionPreference = 'Stop'
# Repo root is two levels up: this script lives in tools/windows/.
$root = Split-Path (Split-Path $PSScriptRoot -Parent) -Parent

View file

@ -17,7 +17,7 @@ param(
[int]$Every = 400, # milliseconds between frames
[int]$For = 8, # seconds to keep capturing
[string]$OutDir = "build/shots",
[string]$Qemu = (Find-Qemu)
[string]$Qemu
)
# QEMU, on whichever host this is.
@ -43,6 +43,8 @@ function Find-Qemu {
throw "qemu-system-x86_64 not found on PATH. Install QEMU, or pass -Qemu <path>."
}
if (-not $Qemu) { $Qemu = Find-Qemu }
$ErrorActionPreference = 'Stop'
# Repo root is two levels up: this script lives in tools/windows/.
$root = Split-Path (Split-Path $PSScriptRoot -Parent) -Parent

View file

@ -19,7 +19,7 @@
param(
[int]$BootSeconds = 20,
[string]$Out = "build/textshot.ppm",
[string]$Qemu = (Find-Qemu)
[string]$Qemu
)
# QEMU, on whichever host this is.
@ -45,6 +45,8 @@ function Find-Qemu {
throw "qemu-system-x86_64 not found on PATH. Install QEMU, or pass -Qemu <path>."
}
if (-not $Qemu) { $Qemu = Find-Qemu }
$ErrorActionPreference = 'Stop'
# Repo root is two levels up: this script lives in tools/windows/.
$root = Split-Path (Split-Path $PSScriptRoot -Parent) -Parent

View file

@ -12,7 +12,7 @@
param(
[int]$BootSeconds = 22,
[string]$Out = "build/ttyshot.ppm",
[string]$Qemu = (Find-Qemu)
[string]$Qemu
)
# QEMU, on whichever host this is.
@ -38,6 +38,8 @@ function Find-Qemu {
throw "qemu-system-x86_64 not found on PATH. Install QEMU, or pass -Qemu <path>."
}
if (-not $Qemu) { $Qemu = Find-Qemu }
$ErrorActionPreference = 'Stop'
# Repo root is two levels up: this script lives in tools/windows/.
$root = Split-Path (Split-Path $PSScriptRoot -Parent) -Parent