| Filename | Latest commit message | Latest commit date |
|---|---|---|
a053a96add
Went looking for why `X=$(echo hi)` hangs every shell. Did not find it. Found
two other things, and built the instrument that rules out the largest suspect.
**The signal return trampoline was ABI-blind.** deliver_signals() manufactures
a return address for the handler -- seven bytes on the user stack reading
`mov eax, 15 ; syscall`. Fifteen is *Linux's* rt_sigreturn, which is right for
anything musl-linked, and that is every port and every shell. For a first-party
binary it is native syscall 15, which is `open`. So a handler in any cmd/
program ran, returned into the trampoline, called open() with whatever the
handler had left in its registers, got -ENOENT, and carried on executing the
stack bytes after the trampoline.
pid 14 sigtest: trap 14 err 4 rip 0x46ca7 addr 0xfffffffffffffffe
rax=fffffffffffffffe ... rsp=46ca0
ustack: 46e30 46ca0 50f0000000fb8 0 0 0
rip is rsp+7 -- one past a seven-byte trampoline -- and the third word of the
stack is the trampoline's own bytes. It emits the number for the process's ABI
now; syscall_map is the thing that says which numbering this process speaks.
**SIG_BLOCK, SIG_UNBLOCK and SIG_SETMASK were not defined anywhere.**
sys_sigprocmask branched on bare 0, 1 and 2 with the names in comments, so
anything outside the kernel had to spell the number and hope it had the right
one. Defined in posix.h, used in the kernel.
**cmd/sigtest** asserts the SIGCHLD/sigsuspend contract every shell is built
on, and it is written so a permissive stub cannot pass: a blocked SIGCHLD stays
pending, sigsuspend delivers an *already pending* signal without spinning, the
handler runs exactly once, the mask is restored, the child is still reapable,
and a signal arriving mid-wait also wakes it. Eight checks, all green. The
kernel's half of that contract is now proven rather than assumed, which is what
lets the remaining bug be pursued somewhere else.
Along with it, `rt_sigsuspend` in lib/usys.S -- the syscall existed and the
first-party library simply never exposed it.
On the hang itself: it is not job control, not SMP, not zsh (mksh does it too),
and not any value the kernel returns -- a full syscall trace is in
docs/history/kernel.md section 7, which also records what the contradiction
narrows to. That section had said "root cause not yet isolated" with three
suspects; all three are now eliminated, and the note says what to do next
instead of what to guess.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
|
||
| .. | ||
| kernel.md | ||
| moving-to-linux.md | ||
| README.md | ||
| schfs.md | ||
History
Why SchOS is the way it is. Bugs whose cause was nowhere near their symptom, and the few write-ups that have nowhere better to live.
| kernel.md | The expensive ones. Boot, SMP, signals, ABI assumptions, /proc, input. |
| schfs.md | How the filesystem was built, and what each phase cost. |
| moving-to-linux.md | The Windows-to-Fedora move. |
What belongs in here
A bug whose cause is not visible from the code that fixed it.
That is the whole test. If reading the fix explains the problem, the fix is the documentation and nothing needs writing down. If the fix looks arbitrary — a constant moved by eight, a field reordered, a check inverted — then the strangeness is load-bearing and the next person to touch it deserves to know why before they change it back.
Every entry here is a thing that looked like a different problem than it was.
What does not belong
- A changelog.
git logis the changelog. - A bug that was found and fixed in an hour. Cost is the filter.
- How something works. That is ../architecture/, written in the present tense for somebody who does not care what it used to be.
- Anything still open. An unfinished investigation goes in ../plan/ or in the code as a comment. This directory is past tense.
How to write one
Symptom first, then diagnosis, then the fix, then the transferable part.
The transferable part is the reason the entry exists. __thread being wrong for
per-CPU data is worth more than the specific null dereference it caused;
"a layout constant that several artifacts must agree on wants a check that stops
the build, not a comment asking people to remember" is worth more than the
bootloader offset that taught it.
Say how it was found, when the technique was the hard part. A hardware
watchpoint through QEMU's gdb stub named an instruction on the first run after
three rounds of cprintf had narrowed it to nothing — that is reusable, and the
bug is not.
Do not clean up the embarrassing part. The near-miss where a change passed
every assertion green without having been applied at all is one of the most
useful entries in this directory, and it only works because it admits that a
grep returning three hits was read as confirmation without counting what they
were.