nexoniarz/SchOS
nexoniarz/SchOS
Watch
1
0
Fork
You've already forked SchOS
 0
Code Issues Pull requests Projects Releases 1 Packages Wiki Activity Actions

smp: every stack on every AP was misaligned by eight

Browse source 
`jmp mpenter`.

x86-64 requires rsp to be 16-byte aligned immediately before a `call`, so a
function starts with rsp ending in 8 -- the return address -- and its
`push %rbp; mov %rsp,%rbp` prologue leaves %rbp 16-byte aligned. Compilers
build on that: an aligned vector store to a frame slot is `movaps`, and
`movaps` to a misaligned address is #GP.

entry64mp loaded the AP's stack pointer, which is page-aligned, and *jumped*.
Nothing pushed a return address, so %rbp came out eight bytes off -- on every
frame, on every application processor, for the life of the machine.

It cost nothing for as long as no function an AP ran needed an aligned vector
store. Then the console's glyph path started returning a small struct by value
(the cell-as-a-surface change), clang spilled it with movaps, and CPU 1 took a
#GP the instant it announced itself on a verbose boot:

    unexpected trap 13 from cpu 1 rip ffff800000120a3b <draw_glyph_px+0x1cb>

    120a37: 0f 10 45 90    movups -0x70(%rbp), %xmm0
    120a3b: 0f 29 45 b0    movaps %xmm0, -0x50(%rbp)   <- #GP

movups on the line above loads fine; movaps stores and faults. The
displacement is a multiple of 16, so what is misaligned is %rbp itself, which
is a fact about how the function was entered.

`call mpenter`, not `jmp`. Eight bytes for an ABI the whole toolchain assumes.

**It was hiding behind a second bug.** The first report was not a #GP at all:

    Stop code     ACQUIRE
          #2  cprintf+0xae
          #3  trap+0x2c4

trap() reported the fault with cprintf(), cprintf() takes the console lock,
and the faulting code was already holding it -- on a verbose boot every
character is drawn under that lock. acquire() panicked about a lock its own
call chain owned, and the trap number, the faulting address and the registers
were all lost. A kernel-mode trap ends in panic() a dozen lines later anyway,
so the console goes into panic mode *before* the report rather than during it.

**And a third, in the same boot.** The console reported "JetBrains Mono, 8x16
cells" -- a name from one font and metrics from another. The built-in bitmap
became a provider like any other in the previous commit, so draw_glyph_px()
installs it lazily on the first glyph; on a verbose boot that happens before
gfx_font_init() runs, which then returned early because a font was already
installed. The console spent the whole boot in the fallback while claiming not
to be. "A font is installed" and "a typeface was chosen" had been the same test
and quietly stopped being; they are two flags now.

Verified: verbose boot reaches a shell twice running with no traps and no
panics, and reports 10x21 cells -- the real typeface -- where it reported 8x16
before. Both supported configurations quiet: one boot each, no traps, no
panics, socktest and memfdtest green.

Written up as section 22 of docs/history/kernel.md, because the interesting
part is not the missing eight bytes but that three separate faults had to be
peeled off in order before the first one could be seen.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
Nexoniarz 2026-09-23 19:37:35 +02:00
commit 26e5d89c73
4 changed files with 120 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

20
kernel/dev/gfx.c
View file

@ -61,6 +61,17 @@ static int cell_h = BITMAP_H;
// The typeface. Null only until the first glyph is drawn, which fills it in
// with the built-in bitmap; gfx_font_init() replaces that with a real face
// when there is one.
// Whether the font in `cfont` is the built-in bitmap standing in, or a real
// typeface that was chosen.
//
// The distinction was implicit in `cfont == 0` until the built-in became a
// provider like any other, and losing it cost a boot: draw_glyph_px() installs
// the fallback lazily, a verbose boot draws before gfx_font_init() runs, and
// gfx_font_init() then saw a font already installed and returned without
// loading anything. The console stayed 8x16 for the whole boot while reporting
// itself as JetBrains Mono.
static int cfont_is_builtin;
static struct ttf consttf;
static struct font *cfont;
static int cfont_baseline;
@ -318,6 +329,7 @@ draw_glyph_px(int x, int y, uint32 cp, uint32 fg, uint32 bg)
if (!cfont) {
cfont = font_builtin();
cfont_baseline = cfont->ops->baseline(cfont);
cfont_is_builtin = 1;
}
// Background first. A terminal cell owns its rectangle, and leaving the old
@ -366,7 +378,10 @@ gfx_font_init(void)
uint32 len = (uint32)(_binary_consfont_end - _binary_consfont_start);
struct glyph gl;
if (cfont)
// A built-in font standing in is not a font having been chosen. Returning
// here on that basis is what kept the bitmap on screen for an entire
// verbose boot.
if (cfont && !cfont_is_builtin)
return;
// A typeface off the boot volume, if the loader found one.
@ -430,6 +445,7 @@ gfx_font_init(void)
cell_h = h;
cfont_baseline = f->ops->baseline(f);
cfont = f;
cfont_is_builtin = 0;
}
// **Nothing here prints.** gfx_font_init() runs before vt_init(), because
@ -443,7 +459,7 @@ gfx_font_init(void)
int
gfx_font_ready(void)
{
return cfont != 0;
return cfont != 0 && !cfont_is_builtin;
}
void