[TUHS] V6 networking & alarm syscall

Paul Ruizendaal pnr at planet.nl
Sat Jan 12 21:13:24 AEST 2019


> / uses the system sleep call rather than the standard C library
> / sleep (sleep (III)) because there is a critical race in the
> / C library implementation which could result in the process
> / pausing forever. This is a horrible bug in the UNIX process
> / control mechanism.
> 
> Quoted without comment from me!

Intriguing comment. I think your v6+ system probably has a lot of
PWB stuff in there. The libc source for sleep() in stock V6 is:

.globl	_sleep
sleep = 35.

_sleep:
	mov	r5,-(sp)
	mov	sp,r5
	mov	4(r5),r0
	sys	sleep
	mov	(sp)+,r5
	rts	pc

The PWB version uses something alarm/pause based, but apparently
gets it wrong:

.globl	_sleep
alarm = 27.
pause = 29.
rti = 2

_sleep:
	mov	r5,-(sp)
	mov	sp,r5
	sys	signal; 14.; 1f
	mov	4(r5),r0
	sys	alarm
	sys	pause
	clr	r0
	sys	alarm
	mov	(sp)+,r5
	rts	pc

1:
	rti

I think the race occurs when an interrupt arrives between the sys alarm
and the sys pause lines, and the handler calls sleep again.

sleep() in the V7 libc is a much more elaborate C routine.

When I first read the race condition comment, I thought the issue would
be like that of write:

_write:
	mov	r5,-(sp)
	mov	sp,r5
	mov	4(r5),r0
	mov	6(r5),0f
	mov	8(r5),0f+2
	sys	0; 9f
	bec	1f
	jmp	cerror
1:
	mov	(sp)+,r5
	rts	pc
.data
9:
	sys	write; 0:..; ..

This pattern appears in several V6 sys call routines, and would
not be safe when used in a context with signal based multi-
threading.





More information about the TUHS mailing list