PiROS — User Acceptance Tests

Manual acceptance steps for the programs and the admin list builder. Each case lists Do and Expect. Type at the serial console; under emulation, wait a few seconds for the login: prompt.

Setup

./build.sh                      # build + boot (or ./build.sh --build then boot manually)

Users: root/rootpw, bob/bobpw, mary/marypw. To start from a clean slate, rm dist/data.img before building (wipes all persistent /data and installed programs).

A. Core tools (as bob)

B. Editor (prano)

C. Scripting (psh)

$a = 5; $b = 10;
echo $a + $b; echo "\n";
$who = "psh";
echo "hello $who\n";

D. Publishing (cross-user)

E. Admin — managing permission lists (as root)

The admin toolkit manages lists (e.g. which programs a group may use, or which users are in a group). Today the lists are stored per-user data; wiring a saved list into actual kernel grants is the next step, so this validates the management workflow.

list_build keys: ↑/↓ or k/j move · Space toggle · Enter → Save? [Y/N] · Y save · X cancel.

F. Access control & isolation

G. Persistence

H. Shell & scripting extras

I. Directories & the shared /mnt volume

J. Networking & CLI tools (as bob)

(Outbound needs QEMU's user-net, which ./build.sh sets up.)

K. Runtime administration (as root)

Root mints users/grants live, signed by the box's machine key. New identities activate on the next boot (the record is written immediately).

L. Services — background daemons (as root) ⭐

Services are root-managed background processes. sshd is a privileged kernel-hosted service (it runs each session's shell as the authenticated user); tintin (HTTP), nemo (FTP), queequeg (SQL) are sandboxed ring-3 processes running as their own no-login service user. Only root can start/stop them; the console stays usable while they run.

SSH service (reach it from another Mac terminal; ./build.sh forwards host :2222): | # | Do | Expect | |---|----|--------| | L1 | root rootpw, admin service start sshd | started service 'sshd' (task 1) + sshd: listening on :2222 | | L2 | ps | rows for console and a kernel task (sshd); sockets 1/8 | | L3 | echo still-here (at the console, while sshd runs) | prints — console is not blocked | | L4 | from a Mac terminal: ssh -p 2222 bob@localhost (password bobpw), then whoami, exit | bob; the remote shell runs as bob | | L4a | leave L4's bob session open; from a second Mac terminal ssh -p 2222 mary@localhost (marypw), then whoami | mary — the second session connects immediately (no head-of-line wait); both are live at once | | L4b | run a command in each session at once (bob ls files, mary whoami); at the console ps | both shells respond concurrently; ps shows one worker task per live SSH session (per-connection workers, capped at MAX_TASKS = 8) | | L5 | admin service list | sshd (running) [kernel-hosted] | | L6 | admin service stop sshd, then ps | sshd gone from ps |

HTTP service (tintin) — a sandboxed ring-3 service. First create + provision it: | # | Do | Expect | |---|----|--------| | L7 | admin service create tintin, then quit and reboot | created service 'tintin'… (activates after reboot) | | L8 | root rootpw, mkdir services/tintin/files/default, mkdir services/tintin/files/default/www | root manages the service's own store | | L9 | echo hello-web > files/idx, cp files/idx services/tintin/files/default/www/index.html | seeds the web root in tintin's store | | L10 | admin service start tintin, ps | a process row, user tintin | | L11 | from a Mac terminal (forward host :80 → guest :80, or run tintin on a forwarded port): curl http://localhost:8080/ | hello-web with Server: tintin | | L12 | su bob bobpw, cat services/tintin/files/default/www/index.html | denied (services/ is root-only) |

(nemo/queequeg follow the same pattern: admin service create <name> → reboot → admin service start <name>. FTP passive data + SQL need their ports forwarded; the control/query channels work over one forward.)

L. Real-hardware regression: ring-3 services bind + console doesn't drop SSH ⭐ RELEASE-ONLY

Run these on real hardware / the cloud VM (KVM), NOT under QEMU-TCG. This class of bug is invisible under TCG: it was a preemption-timer livelock that only triggers when the LAPIC uses TSC-deadline mode (real HW). Fixed in fix/tsc-deadline-preempt-livelock (LAPIC initial-count). These steps confirm the fix held on the actual silicon.

If L18 regresses even when L14–L17 pass, it is the separate NIC-polling gap (the NIC is polled only from inside accept/recv/send — no idle poller), not the timer bug; capture it and hand back to Dell.

M. Diagnostics — watching resources & crashes (as root)

Notes

• list_build items can't contain commas (CSV is the interchange format).
• Interactive tools redraw the screen with ANSI escapes — best viewed in a real terminal.
• Services activate after a reboot from admin service create (like users). syslog is root-only.
• Known PoC limits: exited/stopped processes leak their frames + a socket (no reclaim yet); when fully idle the scheduler busy-yields (no hlt). Watch these in syslog/ps.
• To reset everything: rm dist/data.img and rebuild.