| Filename | Latest commit message | Latest commit date |
|---|---|---|
1e52cb591b
Boot died straight after "exiting boot services" with a KVM internal error,
RIP=0x801a5dc5 and RBX=0x80000000 -- the framebuffer base. The bytes at RIP were
0x0C0E13 and 0xD1D5DC: SCH_BG and a grey from the splash's metal gradient. The
machine was executing the picture of itself starting up.
The hand-off to the kernel writes rbx and did not say so:
"mov %1, %%rbx\n\t" <- writes rbx
"jmp *%2\n\t"
: : "r"(PML4_ADDR), "r"(fb), "r"(entry)
: "memory"); <- rbx not declared clobbered
With rbx absent from the clobber list the compiler may allocate an input there,
and clang 21 allocated `entry`:
movq %rax, %cr3
movq %rcx, %rbx <- the framebuffer, into rbx
jmpq *%rbx <- %2 was rbx, and now holds the framebuffer
Declaring "rbx" forbids the allocation. Verified in the generated assembly
rather than by reasoning: jmpq *%rbx became jmpq *%r14, and the machine now
boots through to schinit: ready.
This had been latent since the loader was written. It worked only because every
compiler that had built it happened to choose a different register, and it
surfaced the first time the binary was relinked with a different clang -- which
only happened because the previous commit fixed the Makefile dependency that had
been leaving the loader stale. A stale artifact hides the bug the fresh one
reveals.
It is also the third time this project has been broken by a register the code
depends on but never asks for: docs/history/kernel.md section 4 (the BIOS
loader passing the framebuffer in EAX by luck) and section 8 (%fs:0 used as
scratch when the ABI reserves it). Written up as section 7b, with the one-line
recipe that settles all three -- read the generated assembly.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VQ7Qx8E1q1M1bbCq8QLHS2
|
||
| .. | ||
| kernel.md | ||
| moving-to-linux.md | ||
| README.md | ||
| schfs.md | ||
History
Why SchOS is the way it is. Bugs whose cause was nowhere near their symptom, and the few write-ups that have nowhere better to live.
| kernel.md | The expensive ones. Boot, SMP, signals, ABI assumptions, /proc, input. |
| schfs.md | How the filesystem was built, and what each phase cost. |
| moving-to-linux.md | The Windows-to-Fedora move. |
What belongs in here
A bug whose cause is not visible from the code that fixed it.
That is the whole test. If reading the fix explains the problem, the fix is the documentation and nothing needs writing down. If the fix looks arbitrary — a constant moved by eight, a field reordered, a check inverted — then the strangeness is load-bearing and the next person to touch it deserves to know why before they change it back.
Every entry here is a thing that looked like a different problem than it was.
What does not belong
- A changelog.
git logis the changelog. - A bug that was found and fixed in an hour. Cost is the filter.
- How something works. That is ../architecture/, written in the present tense for somebody who does not care what it used to be.
- Anything still open. An unfinished investigation goes in ../plan/ or in the code as a comment. This directory is past tense.
How to write one
Symptom first, then diagnosis, then the fix, then the transferable part.
The transferable part is the reason the entry exists. __thread being wrong for
per-CPU data is worth more than the specific null dereference it caused;
"a layout constant that several artifacts must agree on wants a check that stops
the build, not a comment asking people to remember" is worth more than the
bootloader offset that taught it.
Say how it was found, when the technique was the hard part. A hardware
watchpoint through QEMU's gdb stub named an instruction on the first run after
three rounds of cprintf had narrowed it to nothing — that is reusable, and the
bug is not.
Do not clean up the embarrassing part. The near-miss where a change passed
every assertion green without having been applied at all is one of the most
useful entries in this directory, and it only works because it admits that a
grep returning three hits was read as confirmation without counting what they
were.