daniel
7f415e724f
The display's first use of threads (docs/threading.md, docs/display.md). The
compositor stays the single owner of the framebuffer — only the main
service.run loop touches the backend and layer stack — and a dedicated
mouse-listener thread runs beside it:
- Listener: blocks on input.subscribeMouse(), accumulates relative dx/dy
into an absolute cursor position clamped to the screen, and hands it to
the compositor. It never touches the compositor, so no lock guards the
framebuffer; a parked next() lets the core halt.
- CursorChannel: a single-slot latest-value cell under a Thread.Mutex (the
renderer wants where the cursor is now, not a replay of deltas), with a
coalesced self-ipc.send poke that wakes the main loop — parked in
replyWait — as a message-notification. At most one poke is queued while
the last is undrained, so a fast mouse can't flood the endpoint.
- Render: the cursor is a top-z compositor layer; on the poke the main loop
moves it via configure + present (which damages old + new footprints).
The display binary opts into threads (addThreadedUserBinary), and
input-source gains a "mouse" mode that publishes pure motion to drive it.
Two kernel-level findings this surfaced, both fixed:
1. IPC handles do not cross threads. The handle table lives on the Task, so
the listener can't reuse the main loop's endpoint handle — it
ipc.lookup(.display)s its own handle to the same endpoint to poke through.
2. Concurrent IPC from two threads raced unlocked kernel state. The display
is the first process issuing IPC syscalls from two threads at once, which
exposed a data race (flaky #GP in installEntry): create_ipc_endpoint /
ipc_register / ipc_lookup allocate from the kernel heap and mutate the
global registry, endpoint refcounts, and handle tables without the big
kernel lock. They were safe only while a process couldn't race itself.
They now sync.enter() like call/reply_wait/send already did (the kernel
heap has no lock of its own yet — heap.zig: "a lock comes with
threads/SMP" — so the big lock keeps its callers serialized).
Test: -Dtest-case=display-cursor (smp:4) spawns the input service, the
threaded display, and input-source in mouse mode; asserts the display's
"cursor tracking mouse ok" marker once the cursor has tracked a run of motion
end to end. Verified green 6/6 under stress (the race hit ~1-in-4 before the
lock fix) and in the full 29-case QEMU guardrail suite; zig build test clean.
831 lines
42 KiB
Python
831 lines
42 KiB
Python
#!/usr/bin/env python3
|
|
"""Reproducible QEMU integration tests for danos.
|
|
|
|
For each test case it builds the kernel with `-Dtest-case=<name>`, boots it
|
|
headless in QEMU with the serial port captured to a file, and asserts that the
|
|
expected marker appears in that output before a timeout. The kernel's serial log
|
|
is machine-readable (see src/kernel/tests.zig and src/kernel/arch/*/serial.zig), so no
|
|
screen-scraping is involved.
|
|
|
|
Structured per-architecture so a second CPU (e.g. an AArch64 Raspberry Pi) is a
|
|
matter of adding an ARCHES entry and its serial/boot support — the test cases and
|
|
the runner stay the same.
|
|
|
|
Usage:
|
|
python3 test/qemu_test.py # run all cases on the default arch
|
|
python3 test/qemu_test.py --arch x86_64 # pick an architecture
|
|
python3 test/qemu_test.py smoke fault-pf # run only named cases
|
|
"""
|
|
|
|
import argparse
|
|
import json
|
|
import os
|
|
import re
|
|
import shutil
|
|
import socket
|
|
import subprocess
|
|
import sys
|
|
import tempfile
|
|
import time
|
|
|
|
REPO = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
|
|
WORK = os.path.join(REPO, "zig-out", "qemu-test")
|
|
|
|
# --- Architecture configurations -------------------------------------------
|
|
# Each describes how to build and boot that architecture. Only the fields that
|
|
# actually differ between architectures live here.
|
|
ARCHES = {
|
|
"x86_64": {
|
|
"zig_flags": [], # build.zig currently pins the kernel to x86_64
|
|
"qemu": "qemu-system-x86_64",
|
|
# Firmware lives in different places per OS/distro; resolve_firmware()
|
|
# picks the first that exists so the harness runs unconfigured on Arch,
|
|
# Debian/Ubuntu, Fedora, and macOS (Homebrew). Override by reordering or
|
|
# dropping an absolute path at the front.
|
|
"ovmf_code": [
|
|
"/usr/share/edk2/x64/OVMF_CODE.4m.fd", # Arch
|
|
"/usr/share/OVMF/OVMF_CODE_4M.fd", # Debian/Ubuntu
|
|
"/usr/share/OVMF/OVMF_CODE.fd", # older Debian/Ubuntu
|
|
"/usr/share/edk2-ovmf/x64/OVMF_CODE.fd", # Fedora
|
|
"/opt/homebrew/share/qemu/edk2-x86_64-code.fd", # macOS Homebrew (Apple Silicon)
|
|
"/usr/local/share/qemu/edk2-x86_64-code.fd", # macOS Homebrew (Intel)
|
|
],
|
|
"ovmf_vars": [
|
|
"/usr/share/edk2/x64/OVMF_VARS.4m.fd", # Arch
|
|
"/usr/share/OVMF/OVMF_VARS_4M.fd", # Debian/Ubuntu
|
|
"/usr/share/OVMF/OVMF_VARS.fd", # older Debian/Ubuntu
|
|
"/usr/share/edk2-ovmf/x64/OVMF_VARS.fd", # Fedora
|
|
"/opt/homebrew/share/qemu/edk2-i386-vars.fd", # macOS Homebrew (Apple Silicon)
|
|
"/usr/local/share/qemu/edk2-i386-vars.fd", # macOS Homebrew (Intel)
|
|
],
|
|
# zig-out is itself the FHS-shaped boot volume (docs/efi.md): the build
|
|
# installs BOOTX64.efi, the kernel, init, and the initial-ramdisk at their
|
|
# boot paths. The harness presents zig-out to the guest directly — exactly
|
|
# as `zig build run-x86-64` does — so there is no separate ESP to assemble.
|
|
# Built as a function so we can splice in per-run paths.
|
|
"qemu_args": lambda a, boot_volume, vars_fd, serial: [
|
|
"-machine", "q35", "-m", "128M",
|
|
"-drive", f"if=pflash,format=raw,readonly=on,file={a['ovmf_code']}",
|
|
"-drive", f"if=pflash,format=raw,file={vars_fd}",
|
|
# Boot off a FAT USB device: the boot volume is a mass-storage device on
|
|
# the xHCI bus (usb-kbd/usb-mouse ride the same controller). `boot_volume`
|
|
# is the FAT image the build produces. bootindex=0 steers OVMF to it.
|
|
"-device", "qemu-xhci,id=xhci",
|
|
"-device", "usb-kbd,bus=xhci.0",
|
|
"-device", "usb-mouse,bus=xhci.0",
|
|
"-drive", f"if=none,id=bootusb,format=raw,file={boot_volume}",
|
|
"-device", "usb-storage,bus=xhci.0,drive=bootusb,removable=on,bootindex=0",
|
|
"-net", "none",
|
|
"-vga", "none", "-device", "VGA,edid=on,xres=1280,yres=720",
|
|
"-display", "none",
|
|
"-serial", f"file:{serial}",
|
|
"-no-reboot", # exit instead of rebooting on a triple fault
|
|
],
|
|
},
|
|
# To add an architecture, e.g. "aarch64": provide its qemu binary, firmware,
|
|
# boot method, and the AArch64 kernel/serial support in src/kernel/arch/aarch64/.
|
|
}
|
|
|
|
# --- Test cases ------------------------------------------------------------
|
|
# `expect`: a regex that must appear in serial output => pass.
|
|
# `fail`: optional regex whose appearance => immediate fail.
|
|
CASES = [
|
|
# smoke also proves the QMP channel: the harmless query must be delivered
|
|
# (handshake + command) before the case may pass — see run_case.
|
|
{"name": "smoke",
|
|
"qmp_after": {"delay": 2, "command": "query-status"},
|
|
"expect": r"DANOS-TEST-RESULT: PASS",
|
|
"fail": r"DANOS-TEST-RESULT: FAIL"},
|
|
{"name": "discovery",
|
|
"expect": r"DANOS-TEST-RESULT: PASS",
|
|
"fail": r"DANOS-TEST-RESULT: FAIL"},
|
|
{"name": "wx",
|
|
"expect": r"DANOS-TEST-RESULT: PASS",
|
|
"fail": r"DANOS-TEST-RESULT: FAIL"},
|
|
{"name": "timer",
|
|
"expect": r"DANOS-TEST-RESULT: PASS",
|
|
"fail": r"DANOS-TEST-RESULT: FAIL"},
|
|
{"name": "clock",
|
|
"expect": r"DANOS-TEST-RESULT: PASS",
|
|
"fail": r"DANOS-TEST-RESULT: FAIL"},
|
|
# Wall-clock: the CMOS RTC read at boot gives a plausible current epoch (the
|
|
# foundation for filesystem mtime).
|
|
{"name": "wall-clock",
|
|
"expect": r"DANOS-TEST-RESULT: PASS",
|
|
"fail": r"DANOS-TEST-RESULT: FAIL"},
|
|
{"name": "vmm",
|
|
"expect": r"DANOS-TEST-RESULT: PASS",
|
|
"fail": r"DANOS-TEST-RESULT: FAIL"},
|
|
{"name": "heap",
|
|
"expect": r"DANOS-TEST-RESULT: PASS",
|
|
"fail": r"DANOS-TEST-RESULT: FAIL"},
|
|
{"name": "sched",
|
|
"expect": r"DANOS-TEST-RESULT: PASS",
|
|
"fail": r"DANOS-TEST-RESULT: FAIL"},
|
|
{"name": "priority",
|
|
"expect": r"DANOS-TEST-RESULT: PASS",
|
|
"fail": r"DANOS-TEST-RESULT: FAIL"},
|
|
{"name": "sleep",
|
|
"expect": r"DANOS-TEST-RESULT: PASS",
|
|
"fail": r"DANOS-TEST-RESULT: FAIL"},
|
|
{"name": "event",
|
|
"expect": r"DANOS-TEST-RESULT: PASS",
|
|
"fail": r"DANOS-TEST-RESULT: FAIL"},
|
|
{"name": "ipc",
|
|
"expect": r"DANOS-TEST-RESULT: PASS",
|
|
"fail": r"DANOS-TEST-RESULT: FAIL"},
|
|
# Synchronous IPC: a client and server ping-pong 100 calls through an
|
|
# endpoint (rendezvous, reply routing, cross-address-space copy).
|
|
{"name": "ipc-call",
|
|
"expect": r"DANOS-TEST-RESULT: PASS",
|
|
"fail": r"DANOS-TEST-RESULT: FAIL"},
|
|
# IPC capability passing (M13): a client hands the server an endpoint in a call,
|
|
# the server hands one back in its reply; each is verified same-object + shared.
|
|
{"name": "ipc-cap",
|
|
"expect": r"DANOS-TEST-RESULT: PASS",
|
|
"fail": r"DANOS-TEST-RESULT: FAIL"},
|
|
# DMA memory (M14): contiguous frame allocation, below-4G cap, coherent mapping,
|
|
# and reclaim on teardown.
|
|
{"name": "dma",
|
|
"expect": r"DANOS-TEST-RESULT: PASS",
|
|
"fail": r"DANOS-TEST-RESULT: FAIL"},
|
|
# MSI (M15): allocate a per-device vector and deliver it as a notification (a
|
|
# self-IPI stands in for the device's MSI write, since the HPET has no MSI).
|
|
{"name": "msi",
|
|
"expect": r"DANOS-TEST-RESULT: PASS",
|
|
"fail": r"DANOS-TEST-RESULT: FAIL"},
|
|
# IOMMU (M16): boot with an emulated VT-d unit and confirm danos parses the DMAR
|
|
# table and reads the unit's registers. Detection only — enforcement is future.
|
|
{"name": "iommu",
|
|
"qemu_extra": ["-device", "intel-iommu,intremap=off"],
|
|
"expect": r"DANOS-TEST-RESULT: PASS",
|
|
"fail": r"DANOS-TEST-RESULT: FAIL"},
|
|
# Port I/O grants: a claimed device's io_port resource lets a driver read/write its
|
|
# ports (PS/2 status 0x64), gated by the claim; out-of-range/unclaimed is refused.
|
|
{"name": "ioport",
|
|
"expect": r"DANOS-TEST-RESULT: PASS",
|
|
"fail": r"DANOS-TEST-RESULT: FAIL"},
|
|
# Display handoff (D1): the kernel seeds the loader's framebuffer as a claimable
|
|
# `display` device with a write-combining memory resource; the claim + mmio_map path
|
|
# maps it, and the leaf is genuinely write-combining (PAT entry 4), not the UC default.
|
|
{"name": "display",
|
|
"expect": r"DANOS-TEST-RESULT: PASS",
|
|
"fail": r"DANOS-TEST-RESULT: FAIL"},
|
|
# Display service (D2/D3): the user-space compositor claims the framebuffer, allocates
|
|
# a cacheable back buffer, clears it, and presents that composed frame (double-buffer
|
|
# path); then a startup self-check composites two overlapping layers and confirms the
|
|
# overlap shows the top layer (D3). Matched on the service's own heartbeats.
|
|
{"name": "display-service",
|
|
"expect": r"display: online \d+x\d+ pitch \d+[\s\S]*display: presented frame 0[\s\S]*display: compositor self-check ok",
|
|
"fail": r"display: could not|self-check FAILED|CPU EXCEPTION|KERNEL PANIC"},
|
|
# Display demo (D4): a separate process (display-demo) drives the compositor over the
|
|
# layer client API — wallpaper + a moving rectangle + a cursor, presented in a loop.
|
|
# `display-demo: ok` is printed only after it drove a run of frames of motion through
|
|
# the service (the visible motion is a screenshot via `zig build run-x86-64`).
|
|
{"name": "display-demo",
|
|
"expect": r"display-demo: scene up[\s\S]*display-demo: ok",
|
|
"fail": r"display-demo: (no display|create failed)|display: could not|CPU EXCEPTION|KERNEL PANIC"},
|
|
# Threaded compositor tracks a mouse (docs/threading.md, docs/display.md): the display
|
|
# runs a mouse-listener thread alongside its compositor loop. `input-source mouse`
|
|
# publishes pure motion -> the input service fans it to the display's listener -> the
|
|
# listener accumulates it into a cursor position handed to the render loop over a
|
|
# single-slot channel. `display: cursor tracking mouse ok` latches once the cursor has
|
|
# tracked a run of that motion end to end.
|
|
{"name": "display-cursor",
|
|
"smp": 4,
|
|
"expect": r"display: online \d+x\d+[\s\S]*display: cursor tracking mouse ok",
|
|
"fail": r"display: (could not|mouse subscribe failed)|CPU EXCEPTION|KERNEL PANIC"},
|
|
# Shared memory (v2 V2): shm-client creates a region, writes a pattern, and passes its
|
|
# capability to shm-server, which maps it and confirms the same bytes — proving
|
|
# cross-process shared pages over the extended capability passing.
|
|
{"name": "shm",
|
|
"expect": r"shm: shared 4096 bytes ok",
|
|
"fail": r"shm: (shared FAILED|create failed|no server|call failed|map)|CPU EXCEPTION|KERNEL PANIC"},
|
|
# virtio-gpu driver (v2 V3): boot with an emulated virtio-gpu. The device-manager stack
|
|
# discovers the PCI function and spawns the driver, which brings up the control virtqueue,
|
|
# creates a 2D scanout resource backed by DMA memory, set_scanouts it, paints a test
|
|
# pattern, transfers + flushes it, and waits for the device's used-ring ack, then reads
|
|
# the backing back. `scanout WxH online` + `flush acked, pixel check ok` are the markers.
|
|
{"name": "virtio-gpu",
|
|
"qemu_extra": ["-device", "virtio-gpu-pci"],
|
|
"expect": r"virtio-gpu: scanout \d+x\d+ online[\s\S]*virtio-gpu: flush acked, pixel check ok",
|
|
"fail": r"virtio-gpu:.*(failed|not acked|mismatch|unable to claim|not a virtio-gpu|too small|no PCI capability|does not offer|rejected|missing common-config|not a mapped resource|could not spawn)|CPU EXCEPTION|KERNEL PANIC"},
|
|
# Native backend + hot-attach (v2 V4): boot the compositor + display-demo with an emulated
|
|
# virtio-gpu. The driver announces its shared scanout surface to the compositor, which maps
|
|
# it, upgrades off the GOP floor, and drives frames through the native backend — reading a
|
|
# pixel back to confirm the composited frame reached the shared surface, while the demo runs.
|
|
{"name": "display-native",
|
|
"qemu_extra": ["-device", "virtio-gpu-pci"],
|
|
"mem": "512M", # boots the compositor + demo + the whole device-manager driver stack at once
|
|
# Order-independent: the demo's `ok` may print before or after the driver announces, so
|
|
# require all three markers to appear somewhere rather than in a fixed order.
|
|
"expect": r"(?s)(?=.*display: scanout upgraded to virtio-gpu)(?=.*display: native present verified)(?=.*display-demo: ok)",
|
|
"fail": r"display: native present FAILED|display: could not|display-demo: (no display|create failed)|CPU EXCEPTION|KERNEL PANIC"},
|
|
# Mode-set + EDID + vsync (v2 V5): same boot as display-native. After upgrading, the
|
|
# compositor queries the driver's modes, switches to a different resolution, and confirms the
|
|
# backend now reports it; the fenced present path makes it a vsync present. (The driver also
|
|
# logs the EDID preferred mode during bring-up.) Reuses the display-native kernel scenario.
|
|
{"name": "display-modeset",
|
|
"build_case": "display-native",
|
|
"qemu_extra": ["-device", "virtio-gpu-pci"],
|
|
"mem": "512M",
|
|
"expect": r"(?s)(?=.*display: mode set to \d+x\d+, verified)(?=.*display: vsync present ok)",
|
|
"fail": r"display: mode set FAILED|display: mode-set self-check: |display: native present FAILED|CPU EXCEPTION|KERNEL PANIC"},
|
|
# Resilience: driver restart + re-attach (v2 V6). device-manager (in test-scanout-restart
|
|
# mode) kills the virtio-gpu driver once after it hellos; the restart policy respawns it, it
|
|
# re-announces, and the compositor re-attaches — surviving the loss. Expect the initial
|
|
# upgrade AND the re-attach; any CPU exception / panic (the compositor crashing) is a fail.
|
|
{"name": "display-reattach",
|
|
"qemu_extra": ["-device", "virtio-gpu-pci"],
|
|
"mem": "512M",
|
|
"expect": r"(?s)(?=.*display: scanout upgraded to virtio-gpu)(?=.*display: scanout re-attached)",
|
|
"fail": r"CPU EXCEPTION|KERNEL PANIC|display: could not"},
|
|
# Monotonic clock (clock() syscall source): calibrated, advancing, never backwards.
|
|
{"name": "clock",
|
|
"expect": r"DANOS-TEST-RESULT: PASS",
|
|
"fail": r"DANOS-TEST-RESULT: FAIL"},
|
|
# Parallelism: needs more than one core, so this case boots with -smp 4.
|
|
{"name": "smp",
|
|
"smp": 4,
|
|
"expect": r"DANOS-TEST-RESULT: PASS",
|
|
"fail": r"DANOS-TEST-RESULT: FAIL"},
|
|
# Affinity: a pinned task must never migrate off its core.
|
|
{"name": "affinity",
|
|
"smp": 4,
|
|
"expect": r"DANOS-TEST-RESULT: PASS",
|
|
"fail": r"DANOS-TEST-RESULT: FAIL"},
|
|
# Stress the big kernel lock across cores; heavier, so a longer timeout.
|
|
{"name": "smp-stress",
|
|
"smp": 4,
|
|
"timeout": 150,
|
|
"expect": r"DANOS-TEST-RESULT: PASS",
|
|
"fail": r"DANOS-TEST-RESULT: FAIL"},
|
|
# Retry: a forced first-wake failure must still bring every core online.
|
|
{"name": "smp-retry",
|
|
"smp": 4,
|
|
"expect": r"DANOS-TEST-RESULT: PASS",
|
|
"fail": r"DANOS-TEST-RESULT: FAIL"},
|
|
# TSC clocksource + cross-core warp check (real Intel/AMD / KVM path). TCG won't
|
|
# advertise an invariant TSC, so the kernel forces the TSC clocksource on for this
|
|
# case (gated in kernel.zig) and runs the per-AP warp check across the 4 cores;
|
|
# their TSCs are synchronized, so it stays on the TSC (no HPET fallback). The rest
|
|
# of the suite exercises the HPET fallback instead. See docs/timers.md.
|
|
{"name": "tsc-sync",
|
|
"smp": 4,
|
|
"expect": r"DANOS-TEST-RESULT: PASS",
|
|
"fail": r"DANOS-TEST-RESULT: FAIL"},
|
|
{"name": "fault-ud", "expect": r"invalid opcode \(vector 6\)"},
|
|
{"name": "fault-pf", "expect": r"page fault \(vector 14\)"},
|
|
{"name": "fault-df", "expect": r"double fault \(vector 8\)"},
|
|
# Fault on an application processor: a #DF pinned to core 1 must be caught by that
|
|
# core's own IST (N >= 1), proving per-core TSS works; a broken one triple-faults.
|
|
{"name": "fault-ap-df",
|
|
"smp": 4,
|
|
"expect": r"core [1-9]\d*: double fault \(vector 8\)",
|
|
"fail": r"could not pin"},
|
|
{"name": "fault-nx",
|
|
"expect": r"page fault \(vector 14\)",
|
|
"fail": r"NX not enforced"},
|
|
{"name": "fault-null", "expect": r"page fault \(vector 14\)"},
|
|
# Memory grants: the mmap/munmap path hands out user pages into a process's
|
|
# arena, translate resolves them, munmap frees them, and no frames leak.
|
|
{"name": "usermem",
|
|
"expect": r"DANOS-TEST-RESULT: PASS",
|
|
"fail": r"DANOS-TEST-RESULT: FAIL"},
|
|
# Isolation: a ring-3 read of a kernel-only page must #PF with error code
|
|
# 0x5 (present|user) at the user IP. ([\s\S] spans lines; `.` doesn't.)
|
|
{"name": "user-pf",
|
|
"expect": r"page fault \(vector 14\)[\s\S]*error code : 0x5[\s\S]*IP\s*: 0x00007000000000",
|
|
"fail": r"DANOS-TEST-RESULT: FAIL"},
|
|
# Fault recovery: a scheduled ring-3 process that faults is killed — resources
|
|
# reclaimed, core kept — while init's heartbeat proves the OS survived.
|
|
{"name": "fault-recovery",
|
|
"timeout": 60,
|
|
"expect": r"DANOS-TEST-RESULT: PASS",
|
|
"fail": r"DANOS-TEST-RESULT: FAIL"},
|
|
|
|
# docs/threading-plan.md M1: address-space refcount — spaces destroyed exactly
|
|
# once per process, no leak/double-free (the foundation shared-address-space threads need).
|
|
{"name": "address-space-refcount",
|
|
"timeout": 60,
|
|
"expect": r"DANOS-TEST-RESULT: PASS",
|
|
"fail": r"DANOS-TEST-RESULT: FAIL"},
|
|
|
|
# docs/threading-plan.md M2: runtime.Thread.spawn — a worker thread runs in the
|
|
# caller's address space (a shared-memory write, observed by the main thread).
|
|
{"name": "thread-spawn",
|
|
"timeout": 60,
|
|
"expect": r"DANOS-TEST-RESULT: PASS",
|
|
"fail": r"DANOS-TEST-RESULT: FAIL"},
|
|
|
|
# docs/threading-plan.md M3: join + parallelism — N workers each do K atomic
|
|
# increments (total exactly N*K after join) and run on >1 core; plus detach.
|
|
{"name": "thread-join",
|
|
"smp": 4,
|
|
"timeout": 60,
|
|
"expect": r"DANOS-TEST-RESULT: PASS",
|
|
"fail": r"DANOS-TEST-RESULT: FAIL"},
|
|
|
|
# docs/threading-plan.md M4: futex — a thread parks in futex_wait and is woken by
|
|
# futex_wake (serial order waiting/waking/woke), and timedWait reports a timeout.
|
|
{"name": "thread-futex",
|
|
"smp": 4,
|
|
"timeout": 60,
|
|
"expect": r"thread-futex: waiting[\s\S]*thread-futex: waking[\s\S]*thread-futex: woke[\s\S]*DANOS-TEST-RESULT: PASS",
|
|
"fail": r"DANOS-TEST-RESULT: FAIL"},
|
|
|
|
# docs/threading-plan.md M5: Mutex + Condition — a bounded producer/consumer moves
|
|
# N unique items across cores; the consumed checksum matches exactly (no loss).
|
|
{"name": "thread-mutex",
|
|
"smp": 4,
|
|
"timeout": 60,
|
|
"expect": r"DANOS-TEST-RESULT: PASS",
|
|
"fail": r"DANOS-TEST-RESULT: FAIL"},
|
|
|
|
# docs/threading-plan.md M6: thread identity — getCurrentId is distinct and non-zero
|
|
# for the main thread and two workers.
|
|
{"name": "thread-id",
|
|
"smp": 4,
|
|
"timeout": 60,
|
|
"expect": r"DANOS-TEST-RESULT: PASS",
|
|
"fail": r"DANOS-TEST-RESULT: FAIL"},
|
|
|
|
# docs/threading-plan.md M7: thread-safe allocation — N threads hammer the shared heap
|
|
# (per-aspace mmap arena + locked free list) with no cross-block corruption.
|
|
{"name": "thread-alloc",
|
|
"smp": 4,
|
|
"timeout": 60,
|
|
"expect": r"DANOS-TEST-RESULT: PASS",
|
|
"fail": r"DANOS-TEST-RESULT: FAIL"},
|
|
|
|
# docs/threading-plan.md M8: the task reaper — spawn+kill many processes; total kernel
|
|
# stack bytes return to baseline (every dead task's stack reclaimed, no leak).
|
|
{"name": "task-reap",
|
|
"smp": 4,
|
|
"timeout": 60,
|
|
"expect": r"DANOS-TEST-RESULT: PASS",
|
|
"fail": r"DANOS-TEST-RESULT: FAIL"},
|
|
|
|
# docs/threading-plan.md M10: per-thread fs.base — two threads keep private %fs:8 TLS
|
|
# slots across context switches (no cross-talk).
|
|
{"name": "thread-tls",
|
|
"smp": 4,
|
|
"timeout": 60,
|
|
"expect": r"DANOS-TEST-RESULT: PASS",
|
|
"fail": r"DANOS-TEST-RESULT: FAIL"},
|
|
|
|
# docs/threading-plan.md M11: RwLock — readers/writers across cores; a reader never
|
|
# observes a half-written value (writers hold it exclusively).
|
|
{"name": "thread-rwlock",
|
|
"smp": 4,
|
|
"timeout": 60,
|
|
"expect": r"DANOS-TEST-RESULT: PASS",
|
|
"fail": r"DANOS-TEST-RESULT: FAIL"},
|
|
# Process arguments: argv arrives on the SysV entry stack (argv[0] = the spawned
|
|
# name, argv[1..] = the system_spawn argument blob) and echoes back intact.
|
|
{"name": "args",
|
|
"expect": r"DANOS-TEST-RESULT: PASS",
|
|
"fail": r"DANOS-TEST-RESULT: FAIL"},
|
|
# The real user binary: the bootloader ships /system/services/init off the ESP, the
|
|
# kernel loads the ELF and runs it in ring 3, and it writes + exits cleanly.
|
|
{"name": "init",
|
|
"expect": r"DANOS-TEST-RESULT: PASS",
|
|
"fail": r"DANOS-TEST-RESULT: FAIL"},
|
|
# Real processes: /system/services/init loaded as a scheduled ring-3 process with its
|
|
# own address space, run twice (create/exit/teardown/recreate), coexisting
|
|
# with a kernel task under preemption.
|
|
{"name": "process",
|
|
"smp": 4,
|
|
"expect": r"DANOS-TEST-RESULT: PASS",
|
|
"fail": r"DANOS-TEST-RESULT: FAIL"},
|
|
# process_enumerate: a task-table snapshot lists spawned processes by name and
|
|
# id alongside the kernel tasks, and a too-small buffer still reports the total.
|
|
{"name": "process-list",
|
|
"expect": r"DANOS-TEST-RESULT: PASS",
|
|
"fail": r"DANOS-TEST-RESULT: FAIL"},
|
|
# process_kill + the exit notification: only the supervisor may kill; a blocked
|
|
# victim is reaped in place and a spinning one dies by the deferred (tick) path;
|
|
# each death posts one exit badge to the endpoint given at spawn.
|
|
{"name": "process-kill",
|
|
"smp": 4,
|
|
"expect": r"DANOS-TEST-RESULT: PASS",
|
|
"fail": r"DANOS-TEST-RESULT: FAIL"},
|
|
# The user-side whole: process-test supervises two children from ring 3 —
|
|
# spawn with an exit endpoint, enumerate, kill, notification, gone.
|
|
{"name": "supervision",
|
|
"smp": 4,
|
|
"expect": r"DANOS-TEST-RESULT: PASS",
|
|
"fail": r"DANOS-TEST-RESULT: FAIL"},
|
|
# M17.1: a dead process's device claims are released by the reap — kill a child
|
|
# holding a claim, the device must be claimable again (process-lifecycle.md).
|
|
{"name": "claim-release",
|
|
"smp": 4,
|
|
"expect": r"DANOS-TEST-RESULT: PASS",
|
|
"fail": r"DANOS-TEST-RESULT: FAIL"},
|
|
# M17.3: published exit events — the VFS subscribes, a client dies holding an
|
|
# open handle, and the VFS releases it (process-lifecycle.md "Who learns of a death").
|
|
{"name": "vfs-client-death",
|
|
"smp": 4,
|
|
"expect": r"DANOS-TEST-RESULT: PASS",
|
|
"fail": r"DANOS-TEST-RESULT: FAIL"},
|
|
# M17.4: signals over IPC — ping, reload, terminate (clean exit), the one-shot
|
|
# timer, and the stop sequence's two endings, all driven from ring 3.
|
|
{"name": "signals",
|
|
"smp": 4,
|
|
"expect": r"DANOS-TEST-RESULT: PASS",
|
|
"fail": r"DANOS-TEST-RESULT: FAIL"},
|
|
# M18.2: bus tree reports — the xHCI driver scans its root-hub ports and
|
|
# reports both QEMU devices; the manager mirrors, prunes on the reporter's
|
|
# death, and the respawned driver re-reports (docs/device-manager.md).
|
|
{"name": "usb-report",
|
|
"smp": 4,
|
|
"timeout": 150,
|
|
# The xHCI bus + usb-kbd/usb-mouse come from the default boot config now
|
|
# (every case boots off a usb-storage device on that bus).
|
|
"expect": r"device-manager: child added[\s\S]*"
|
|
r"device-manager: child added[\s\S]*"
|
|
r"device-manager: test mode: killing the reporter[\s\S]*"
|
|
r"device-manager: child removed[\s\S]*"
|
|
r"device-manager: restarting usb-xhci-bus[\s\S]*"
|
|
r"device-manager: child added",
|
|
"fail": r"DANOS-TEST-RESULT: FAIL"},
|
|
# USB HID end to end: boot the full tree, enumerate the xHCI, and let the
|
|
# manager spawn the USB keyboard driver, which opens its device over the
|
|
# transfer protocol, asks for boot protocol, subscribes to its interrupt
|
|
# endpoint, and comes up — proof the class-driver <-> controller path works.
|
|
{"name": "usb-hid",
|
|
"smp": 4,
|
|
"timeout": 150,
|
|
# usb-kbd/usb-mouse ride the default boot xHCI bus (see qemu_args).
|
|
"expect": r"(?=[\s\S]*usb-hid/keyboard: ok)(?=[\s\S]*usb-hid/mouse: ok)",
|
|
"fail": r"DANOS-TEST-RESULT: FAIL"},
|
|
# USB mass storage end to end: the boot usb-storage device (the FAT32 image,
|
|
# which has a real 0x55AA boot sector) is enough — the manager spawns
|
|
# usb-storage, which opens the device, runs the Bulk-Only / SCSI bring-up,
|
|
# reads its capacity, and reads block 0 (the 0x55AA boot sig). Proof of the
|
|
# bulk transfer path + BOT + SCSI end to end.
|
|
{"name": "usb-storage",
|
|
"smp": 4,
|
|
"timeout": 150,
|
|
"expect": r"usb-storage: ready[\s\S]*usb-storage: block 0 signature 0x55aa",
|
|
"fail": r"DANOS-TEST-RESULT: FAIL"},
|
|
# FAT mount end to end: the fat server mounts the boot usb-storage device (the
|
|
# FAT32 image) into the VFS at /mnt/usb. A fat-test client then lists and reads
|
|
# through the mount — proof of the whole stack: block device -> FAT parse ->
|
|
# VFS routing -> file read.
|
|
{"name": "fat-mount",
|
|
"smp": 4,
|
|
"timeout": 150,
|
|
"expect": r"fat: mounted /mnt/usb[\s\S]*fat-test: ok",
|
|
"fail": r"DANOS-TEST-RESULT: FAIL"},
|
|
# Phase 2b: mkdir/unlink through the mount. Reuses the fat-mount build — the
|
|
# fat-test client, after listing, makes a directory, writes+reads a file inside
|
|
# it, then removes the file, exercising the whole VFS -> fat mutation path.
|
|
{"name": "fat-mutations",
|
|
"build_case": "fat-mount",
|
|
"smp": 4,
|
|
"timeout": 150,
|
|
"expect": r"fat-test: mutations ok",
|
|
"fail": r"fat-test: mutations FAILED|fat-test: mkdir .* failed|DANOS-TEST-RESULT: FAIL"},
|
|
# Phase 2c: rename through the mount — fat-test renames the file it created
|
|
# before removing it, and confirms the old name is gone.
|
|
{"name": "fat-rename",
|
|
"build_case": "fat-mount",
|
|
"smp": 4,
|
|
"timeout": 150,
|
|
"expect": r"fat-test: rename ok",
|
|
"fail": r"fat-test: mutations FAILED|DANOS-TEST-RESULT: FAIL"},
|
|
# Phase 2d: filesystem timestamps — a freshly-created file's mtime is a real
|
|
# current wall-clock time (stamped from the RTC), read back through stat.
|
|
{"name": "fat-mtime",
|
|
"build_case": "fat-mount",
|
|
"smp": 4,
|
|
"timeout": 150,
|
|
"expect": r"fat-test: mtime ok",
|
|
"fail": r"fat-test: mutations FAILED|DANOS-TEST-RESULT: FAIL"},
|
|
# Boot-from-USB smoke: the whole system now boots off the FAT32 image on a
|
|
# usb-storage device (OVMF -> \EFI\BOOT\BOOTX64.efi -> kernel), so the kernel
|
|
# reaching its PASS marker at all proves the USB boot path end to end. Reuses
|
|
# the smoke kernel build; the value is the explicit, named regression guard.
|
|
{"name": "usb-boot",
|
|
"build_case": "smoke",
|
|
"qmp_after": {"delay": 2, "command": "query-status"},
|
|
"expect": r"DANOS-TEST-RESULT: PASS",
|
|
"fail": r"DANOS-TEST-RESULT: FAIL"},
|
|
# M20.1: the ring-3 AML parse (the acpi service maps the blobs and parses
|
|
# them) finds exactly the Device count the kernel's own parse produced.
|
|
{"name": "acpi-parse",
|
|
"smp": 4,
|
|
"timeout": 60,
|
|
"expect": r"acpi-parse: ok",
|
|
"fail": r"acpi-parse: too few|DANOS-TEST-RESULT: FAIL"},
|
|
# M20.3: the flip — ps2-bus now comes up from the acpi service's report, not
|
|
# a kernel-built node. Ordered: report -> spawn -> the driver attaches its
|
|
# keyboard, proving discovery runs entirely in ring 3 (docs/discovery.md).
|
|
{"name": "acpi-ps2",
|
|
"smp": 4,
|
|
"timeout": 150,
|
|
"expect": r"acpi: reported PNP0303[\s\S]*"
|
|
r"device-manager: spawned ps2-bus[\s\S]*"
|
|
r"ps2-bus: keyboard driver attached",
|
|
"fail": r"DANOS-TEST-RESULT: FAIL"},
|
|
# M21.1: the SCI + power button. Boot the manager (which spawns the acpi
|
|
# service); ~4s in, QMP system_powerdown raises the ACPI power-button fixed
|
|
# event; the service's SCI handler must log the press (docs/acpi.md).
|
|
{"name": "power-button",
|
|
"smp": 4,
|
|
"timeout": 60,
|
|
"qmp_after": {"delay": 4, "command": "system_powerdown"},
|
|
"expect": r"power: button pressed",
|
|
"fail": r"DANOS-TEST-RESULT: FAIL"},
|
|
# M21.3 capstone: orderly shutdown. Boot init (the full tree comes up);
|
|
# ~5s in, QMP system_powerdown raises the power button; the acpi service
|
|
# publishes it, init stops its children then requests S5, and QEMU exits.
|
|
# The ordered regex proves button -> shutting-down -> entering-S5; the case
|
|
# passes on QEMU's self-exit through S5 (docs/power.md).
|
|
{"name": "orderly-shutdown",
|
|
"smp": 4,
|
|
"timeout": 90,
|
|
"qmp_after": {"delay": 5, "command": "system_powerdown"},
|
|
"expect": r"power: button pressed[\s\S]*"
|
|
r"init: shutting down[\s\S]*"
|
|
r"power: entering S5",
|
|
"fail": r"power: S5 write did not take|DANOS-TEST-RESULT: FAIL"},
|
|
# M8: the boot log is persisted to the USB FAT volume. Reuses the orderly-
|
|
# shutdown build (full tree + power button): init spawns log-flush at boot,
|
|
# which copies the kernel log to /mnt/usb/DANOS.LOG once /mnt/usb is mounted
|
|
# (first marker); then the power button drives init's own pre-teardown flush
|
|
# (second marker), proving both triggers write the file while storage is up.
|
|
{"name": "log-flush",
|
|
"build_case": "orderly-shutdown",
|
|
"smp": 4,
|
|
"timeout": 150,
|
|
"qmp_after": {"delay": 8, "command": "system_powerdown"},
|
|
"expect": r"log-flush: wrote \d+ bytes to /mnt/usb/DANOS\.LOG[\s\S]*"
|
|
r"init: flushed log to /mnt/usb/DANOS\.LOG[\s\S]*"
|
|
r"power: entering S5",
|
|
"fail": r"DANOS-TEST-RESULT: FAIL"},
|
|
# M20.2: the acpi service evaluates _CRS/_STA in ring 3 and registers +
|
|
# reports its _HID devices — the two PS/2 nodes must appear with resources
|
|
# (keyboard: io 0x60/0x64 + IRQ = 3; mouse: IRQ = 1) (docs/discovery.md).
|
|
{"name": "acpi-report",
|
|
"smp": 4,
|
|
"timeout": 150,
|
|
"expect": r"acpi: reported PNP0303 \(device \d+, 3 resources\)[\s\S]*"
|
|
r"acpi: reported PNP0F13 \(device \d+, 1 resources\)",
|
|
"fail": r"DANOS-TEST-RESULT: FAIL"},
|
|
# M19.1/M19.3: the ring-3 PCI scan. pci-bus walks the ECAM through its mmio_map
|
|
# grant and registers every function it finds; the kernel's own walk retired, so
|
|
# the broker starts empty and the driver populates it. The manager then runs the
|
|
# restart drill: ~1 s after the scan it kills pci-bus, prunes its child tree, and
|
|
# respawns it to re-claim, re-scan, and re-register the same functions. The kernel
|
|
# test asserts the broker equivalence (empty before, populated after, no
|
|
# duplicates); this ordered regex asserts the drill itself over the whole serial
|
|
# log — the backreference requires the respawn to re-scan the same count, and the
|
|
# full-capture match is immune to the transient-line races an in-kernel poll hits.
|
|
{"name": "pci-scan",
|
|
"smp": 4,
|
|
"timeout": 60,
|
|
"expect": r"pci-bus: (\d+) functions found[\s\S]*"
|
|
r"device-manager: test mode: killing the reporter[\s\S]*"
|
|
r"device-manager: restarting pci-bus[\s\S]*"
|
|
r"pci-bus: \1 functions found[\s\S]*"
|
|
r"DANOS-TEST-RESULT: PASS",
|
|
"fail": r"DANOS-TEST-RESULT: FAIL"},
|
|
# M18.3: the application surface — device-list enumerates the tree over IPC,
|
|
# subscribes (endpoint as capability), and observes the removed/added events
|
|
# the reporter's test-kill produces (docs/device-manager.md).
|
|
{"name": "device-list",
|
|
"smp": 4,
|
|
"timeout": 150,
|
|
"expect": r"device-list: \d+ devices[\s\S]*"
|
|
r"device-list: subscribed[\s\S]*"
|
|
r"device-manager: test mode: killing the reporter[\s\S]*"
|
|
r"device-list: removed \(device[\s\S]*"
|
|
r"device-list: added \(device",
|
|
"fail": r"DANOS-TEST-RESULT: FAIL"},
|
|
# M18.1: the device manager's hello + restart policy — xHCI hellos clean and
|
|
# stays; crash-test faults, is restarted with backoff (re-claiming its device
|
|
# each time), and hits the crash-loop cap (docs/device-manager.md).
|
|
{"name": "driver-restart",
|
|
"smp": 4,
|
|
"timeout": 150,
|
|
"expect": r"usb-xhci-bus: hello acknowledged[\s\S]*"
|
|
r"device-manager: restarting crash-test[\s\S]*"
|
|
r"device-manager: crash-test is failing repeatedly",
|
|
"fail": r"DANOS-TEST-RESULT: FAIL"},
|
|
# The initial_ramdisk: the loader ferries a bundle of user binaries; the kernel parses
|
|
# it and spawns each as a ring-3 process (here the VFS-server stub heartbeats).
|
|
{"name": "initial-ramdisk",
|
|
"timeout": 60, # the acpi service's boot-time SCI setup can push the marker past 30s under load
|
|
"expect": r"DANOS-TEST-RESULT: PASS",
|
|
"fail": r"DANOS-TEST-RESULT: FAIL"},
|
|
# The user-space VFS: a client opens/writes/reads a file through the rt file
|
|
# API, which IPCs the VFS server process; the round trip must match.
|
|
{"name": "vfs",
|
|
"expect": r"DANOS-TEST-RESULT: PASS",
|
|
"fail": r"DANOS-TEST-RESULT: FAIL"},
|
|
# The input service: a synthetic keyboard source publishes events, the service
|
|
# broadcasts them over the async ipc_send primitive, and a subscriber (which joined by
|
|
# passing its endpoint as a capability) receives them — source -> service -> subscriber.
|
|
{"name": "input",
|
|
"expect": r"DANOS-TEST-RESULT: PASS",
|
|
"fail": r"DANOS-TEST-RESULT: FAIL"},
|
|
# Device manager: a ring-3 service enumerates /system/devices, matches the PCI host
|
|
# bridge to pci-bus, and spawns it — end-to-end proof of discover -> match -> spawn
|
|
# -> driver-up (the spawned pci-bus logs "<N> functions found").
|
|
{"name": "device-manager",
|
|
"expect": r"DANOS-TEST-RESULT: PASS",
|
|
"fail": r"DANOS-TEST-RESULT: FAIL"},
|
|
# device_register containment (in-kernel): registering a child whose MMIO window
|
|
# escapes its parent's grant is refused (NotContained) — else dev_register would map
|
|
# arbitrary physical memory — while an identical re-register stays idempotent.
|
|
{"name": "containment",
|
|
"expect": r"DANOS-TEST-RESULT: PASS",
|
|
"fail": r"DANOS-TEST-RESULT: FAIL"},
|
|
# IRQ teardown: an exiting driver's line is masked and its slot cleared (so no
|
|
# ISR notifies a freed endpoint), and a sibling owner sharing that endpoint
|
|
# keeps its own binding. A long-running driver never reaches this teardown path.
|
|
{"name": "irqfree",
|
|
"expect": r"DANOS-TEST-RESULT: PASS",
|
|
"fail": r"DANOS-TEST-RESULT: FAIL"},
|
|
# The MMIO-grant teardown fix: a device-granted frame must not be reclaimed
|
|
# as RAM when its address space is destroyed.
|
|
{"name": "iopass",
|
|
"expect": r"DANOS-TEST-RESULT: PASS",
|
|
"fail": r"DANOS-TEST-RESULT: FAIL"},
|
|
# The ACPI power path succeeds by QEMU *exiting* (S5 off / reset), so match the
|
|
# pre-transition marker; the FAIL line only appears if the transition didn't take.
|
|
# Soft-off (S5) is owned by the ring-3 acpi service now (see orderly-shutdown);
|
|
# the kernel keeps only reboot (FADT reset register, no AML).
|
|
{"name": "reboot",
|
|
"expect": r"DANOS-POWER: attempting reboot",
|
|
"fail": r"DANOS-TEST-RESULT: FAIL"},
|
|
]
|
|
|
|
TIMEOUT = 30 # seconds per case
|
|
|
|
|
|
def build(arch, case):
|
|
# -Dserial: the harness asserts on markers the kernel writes to serial0, so the
|
|
# serial log sink must be compiled in. It is off by default (a flashed real-
|
|
# hardware image keeps its log in RAM instead; see build.zig / serial.zig).
|
|
cmd = ["zig", "build", f"-Dtest-case={case}", "-Dserial=true"] + arch["zig_flags"]
|
|
r = subprocess.run(cmd, cwd=REPO, capture_output=True, text=True)
|
|
if r.returncode != 0:
|
|
return r.stderr.strip() or r.stdout.strip()
|
|
return None
|
|
|
|
|
|
def resolve_firmware(arch):
|
|
"""Collapse the ovmf_code/ovmf_vars candidate lists to the first path that
|
|
exists on this machine. Mutates `arch` in place; idempotent (a resolved
|
|
string is left untouched). Exits with a clear message if none is found."""
|
|
for key, label in (("ovmf_code", "OVMF_CODE"), ("ovmf_vars", "OVMF_VARS")):
|
|
val = arch[key]
|
|
if isinstance(val, str):
|
|
continue # already resolved on a previous call
|
|
for cand in val:
|
|
if os.path.exists(cand):
|
|
arch[key] = cand
|
|
break
|
|
else:
|
|
sys.exit(f"error: no {label} firmware image found; looked in:\n "
|
|
+ "\n ".join(val)
|
|
+ "\nInstall OVMF (edk2-ovmf / ovmf) or add its path above.")
|
|
|
|
|
|
def qmp_send(path, command):
|
|
"""One QMP command: connect, capabilities handshake, execute. Raises on any
|
|
failure — the caller retries until the guest's socket is ready. This is how
|
|
a case injects a host-side event (system_powerdown = the ACPI power button)
|
|
into the running guest (docs/power.md)."""
|
|
sock = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
|
|
sock.settimeout(5)
|
|
try:
|
|
sock.connect(path)
|
|
stream = sock.makefile("rw")
|
|
stream.readline() # the QMP greeting
|
|
stream.write(json.dumps({"execute": "qmp_capabilities"}) + "\n")
|
|
stream.flush()
|
|
stream.readline() # {"return": {}}
|
|
stream.write(json.dumps({"execute": command}) + "\n")
|
|
stream.flush()
|
|
stream.readline()
|
|
finally:
|
|
sock.close()
|
|
|
|
|
|
def run_case(arch, case):
|
|
# A case's kernel build defaults to its name; `build_case` decouples the two
|
|
# so a case can reuse another's kernel (e.g. usb-boot reuses smoke's).
|
|
err = build(arch, case.get("build_case", case["name"]))
|
|
if err:
|
|
return False, "build failed:\n" + err
|
|
|
|
# The bootable FAT32 USB image the build produced (tools/make-fat-image.py),
|
|
# presented to the guest as a usb-storage device (see qemu_args).
|
|
boot_volume = os.path.join(REPO, "zig-out", "danos-usb.img")
|
|
vars_fd = os.path.join(WORK, "vars.fd")
|
|
shutil.copy(arch["ovmf_vars"], vars_fd)
|
|
serial = os.path.join(WORK, "serial.log")
|
|
if os.path.exists(serial):
|
|
os.remove(serial)
|
|
|
|
expect = re.compile(case["expect"])
|
|
fail = re.compile(case["fail"]) if case.get("fail") else None
|
|
|
|
cmd = [arch["qemu"]] + arch["qemu_args"](arch, boot_volume, vars_fd, serial)
|
|
if case.get("smp"): # some cases need more than one core (e.g. parallelism)
|
|
cmd += ["-smp", str(case["smp"])]
|
|
if case.get("mem"): # a case that boots the whole system at once needs more than the 128M floor
|
|
cmd[cmd.index("-m") + 1] = case["mem"]
|
|
if case.get("qemu_extra"): # extra qemu args, e.g. -device intel-iommu for the IOMMU case
|
|
cmd += case["qemu_extra"]
|
|
# A QMP control socket, always present (additive): how a case's `qmp_after`
|
|
# hook injects host-side events into the guest mid-run. Kept under a short temp
|
|
# dir, not WORK: a unix socket path is capped at ~104 bytes (sun_path), and a
|
|
# deep worktree path (e.g. .claude/worktrees/<name>/zig-out/qemu-test/qmp.sock)
|
|
# blows that limit on macOS, so QEMU fails to bind and exits before booting.
|
|
qmp_path = os.path.join(tempfile.gettempdir(), f"danos-qmp-{os.getpid()}.sock")
|
|
if os.path.exists(qmp_path):
|
|
os.remove(qmp_path)
|
|
cmd += ["-qmp", f"unix:{qmp_path},server,nowait"]
|
|
qmp_after = case.get("qmp_after") # {"delay": seconds, "command": "..."}
|
|
qmp_sent = False
|
|
started = time.monotonic()
|
|
qemu = subprocess.Popen(cmd, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
|
|
try:
|
|
timeout = case.get("timeout", TIMEOUT)
|
|
deadline = time.monotonic() + timeout
|
|
while time.monotonic() < deadline:
|
|
time.sleep(0.2)
|
|
if qmp_after and not qmp_sent and time.monotonic() - started >= qmp_after["delay"]:
|
|
try:
|
|
qmp_send(qmp_path, qmp_after["command"])
|
|
qmp_sent = True
|
|
except OSError:
|
|
pass # socket not up yet; retry next tick
|
|
text = ""
|
|
if os.path.exists(serial):
|
|
with open(serial, "r", errors="replace") as f:
|
|
text = f.read()
|
|
if fail and fail.search(text):
|
|
return False, "hit failure marker"
|
|
if expect.search(text):
|
|
if qmp_after and not qmp_sent:
|
|
continue # the hook must deliver before the case may pass
|
|
return True, "matched " + repr(case["expect"])
|
|
if qemu.poll() is not None: # QEMU exited on its own
|
|
if expect.search(text):
|
|
return True, "matched " + repr(case["expect"])
|
|
return False, "QEMU exited before matching (triple fault?)"
|
|
return False, f"timed out after {timeout}s without matching {case['expect']!r}"
|
|
finally:
|
|
if qemu.poll() is None:
|
|
qemu.terminate()
|
|
try:
|
|
qemu.wait(timeout=5)
|
|
except subprocess.TimeoutExpired:
|
|
qemu.kill()
|
|
|
|
|
|
def main():
|
|
ap = argparse.ArgumentParser()
|
|
ap.add_argument("--arch", default="x86_64", choices=sorted(ARCHES))
|
|
ap.add_argument("cases", nargs="*", help="case names to run (default: all)")
|
|
args = ap.parse_args()
|
|
|
|
arch = ARCHES[args.arch]
|
|
if not shutil.which(arch["qemu"]):
|
|
print(f"error: {arch['qemu']} not found on PATH", file=sys.stderr)
|
|
return 2
|
|
resolve_firmware(arch)
|
|
|
|
selected = [c for c in CASES if not args.cases or c["name"] in args.cases]
|
|
os.makedirs(WORK, exist_ok=True)
|
|
|
|
print(f"danos qemu tests arch={args.arch} cases={len(selected)}\n")
|
|
failures = 0
|
|
for case in selected:
|
|
print(f" {case['name']:<12} ... ", end="", flush=True)
|
|
ok, detail = run_case(arch, case)
|
|
if not ok:
|
|
# Keep the evidence: serial.log is otherwise overwritten by the
|
|
# next case, and an intermittent failure's log is unrecoverable.
|
|
source = os.path.join(WORK, "serial.log")
|
|
if os.path.exists(source):
|
|
shutil.copy(source, os.path.join(WORK, f"{case['name']}-failed-serial.log"))
|
|
print(("PASS" if ok else "FAIL") + f" ({detail})")
|
|
if not ok:
|
|
failures += 1
|
|
|
|
print()
|
|
total = len(selected)
|
|
print(f"{total - failures}/{total} passed")
|
|
return 1 if failures else 0
|
|
|
|
|
|
if __name__ == "__main__":
|
|
sys.exit(main())
|