ack/doc/v7bugs.doc

.\" $Header$
.wh 0 hd
.wh 60 fo
.de hd
'sp 5
..
.de fo
'bp
..
.nr e 0 1
.de ER
.br
.ne 20
.sp 2
.in 5n
.ti -5n
ERROR \\n+e:
..
.de PS
.sp
.nf
.in +5n
..
.de PE
.sp
.fi
.in -5n
..
.sp 3
.ce
UNIX version 7 bugs
.sp 3
This document describes the UNIX version 7 errors fixed at the
Vrije Universiteit, Amsterdam.
Several of these are discovered at the VU.
Others are quoted from a list of bugs distributed by BellLabs.
.sp
For each error the differences between the original and modified
source files are given,
as well as a test program.
.ER
C optimizer bug for unsigned comparison
.sp
The following C program caused an IOT trap, while it should not
(compile with 'cc -O prog.c'):
.PS
unsigned	i = 0;

main() {
	register j;

	j = -1;
	if (i > 40000)
		abort();
}
.PE
BellLabs suggests to make the following patch in c21.c:
.PS
/* modified /usr/src/cmd/c/c21.c */

189		if (r==0) {
190	/* next 2 lines replaced as indicated by
191	 * Bell Labs bug distribution ( v7optbug )
192			p->back->back->forw = p->forw;
193			p->forw->back = p->back->back;
194	  End of lines changed */
195			if (p->forw->op==CBR
196			  || p->forw->op==SXT
197			  || p->forw->op==CFCC) {
198				p->back->forw = p->forw;
199				p->forw->back = p->back;
200			} else {
201				p->back->back->forw = p->forw;
202				p->forw->back = p->back->back;
203			}
204	/* End of new lines */
205			decref(p->ref);
206			p = p->back->back;
207			nchange++;
208		} else if (r>0) {
.PE
Use the previous program to test before and after the modification.
.ER
The loader fails for large data or text portions
.sp
The loader 'ld' produces a "local symbol botch" error
for the following C program.
.PS
int	big1[10000] = {
	1
};
int	big2[10000] = {
	2
};

main() {
	printf("loader is fine\\n");
}
.PE
We have made the following fix:
.PS
/* original /usr/src/cmd/ld.c */

113	struct {
114		int	fmagic;
115		int	tsize;
116		int	dsize;
117		int	bsize;
118		int	ssize;
119		int	entry;
120		int	pad;
121		int	relflg;
122	} filhdr;

/* modified /usr/src/cmd/ld.c */

113	/*
114	 * The original Version 7 loader had problems loading large
115	 * text or data portions.
116	 * Why not include <a.out.h> ???
117	 * then they would be declared unsigned
118	 */
119	struct {
120		int	fmagic;
121		unsigned	tsize;		/* not int !!! */
122		unsigned	dsize;		/* not int !!! */
123		unsigned	bsize;		/* not int !!! */
124		unsigned	ssize;		/* not int !!! */
125		unsigned	entry;		/* not int !!! */
126		unsigned	pad;		/* not int !!! */
127		unsigned	relflg;		/* not int !!! */
128	} filhdr;
.PE
.ER
Floating point registers
.sp
When a program is swapped to disk if it needs more memory,
then the floating point registers were not saved, so that
it may have different registers when it is restarted.
A small assembly program demonstrates this for the status register.
If the error is not fixed, then the program generates an IOT error.
A "memory fault" is generated if all is fine.
.PS
start:	ldfps	$7400
1:	stfps	r0
	mov	r0,-(sp)
	cmp	r0,$7400
	beq	1b
	4
.PE
Some digging into the kernel is required to fix it.
The following patch will do:
.PS
/* original /usr/sys/sys/slp.c */

563		a2 = malloc(coremap, newsize);
564		if(a2 == NULL) {
565			xswap(p, 1, n);
566			p->p_flag |= SSWAP;
567			qswtch();
568			/* no return */
569		}

/* modified /usr/sys/sys/slp.c */

590		a2 = malloc(coremap, newsize);
591		if(a2 == NULL) {
592	#ifdef FPBUG
593			/*
594			 * copy floating point register and status,
595			 * but only if you must switch processes
596			 */
597			if(u.u_fpsaved == 0) {
598				savfp(&u.u_fps);
599				u.u_fpsaved = 1;
600			}
601	#endif
602			xswap(p, 1, n);
603			p->p_flag |= SSWAP;
604			qswtch();
605			/* no return */
606		}
.PE
.ER
Floating point registers.
.sp
A similar problem arises when a process forks.
The child will have random floating point registers as is
demonstrated by the following assembly language program.
The child process will die by an IOT trap and the father prints
the message "child failed".
.PS
exit	= 1.
fork	= 2.
write	= 4.
wait	= 7.

start:	ldfps	$7400
	sys	fork
	br	child
	sys	wait
	tst	r1
	bne	bad
	stfps	r2
	cmp	r2,$7400
	beq	start
	4
child:	stfps	r2
	cmp	r2,$7400
	beq	ex
	4
bad:	clr	r0
	sys	write;mess;13.
ex:	clr	r0
	sys	exit

	.data
mess:	<child failed\\n>
.PE
The same file slp.c should be patched as follows:
.PS
/* original /usr/sys/sys/slp.c */

499		/*
500		 * When the resume is executed for the new process,
501		 * here's where it will resume.
502		 */
503		if (save(u.u_ssav)) {
504			sureg();
505			return(1);
506		}
507		a2 = malloc(coremap, n);
508		/*
509		 * If there is not enough core for the
510		 * new process, swap out the current process to generate the
511		 * copy.
512		 */

/* modified /usr/sys/sys/slp.c */

519		/*
520		 * When the resume is executed for the new process,
521		 * here's where it will resume.
522		 */
523		if (save(u.u_ssav)) {
524			sureg();
525			return(1);
526		}
527	#ifdef FPBUG
528		/* copy the floating point registers and status to child */
529		if(u.u_fpsaved == 0) {
530			savfp(&u.u_fps);
531			u.u_fpsaved = 1;
532		}
533	#endif
534		a2 = malloc(coremap, n);
535		/*
536		 * If there is not enough core for the
537		 * new process, swap out the current process to generate the
538		 * copy.
539		 */
.PE
.ER
/usr/src/libc/v6/stat.c
.sp
Some system calls are changed from version 6 to version 7.
A library of system call entries, that make a version 6 UNIX look like
a version 7 system, is provided to run some
useful version 7 utilities, like 'tar', on UNIX-6.
The entry for 'stat' contained two bugs:
the 24-bit file size was incorrectly converted to 32 bits
(sign extension of bit 15)
and the uid/gid fields suffered from sign extension.
.sp
Transferring files from version 6 to version 7 using 'tar'
will fail for all files for which
.sp
	( (size & 0100000) != 0 )
.sp
These two errors are fixed if stat.c is modified as follows:
.PS
/* original /usr/src/libc/v6/stat.c */

11		char  os_size0;
12		short os_size1;
13		short os_addr[8];

49		buf->st_nlink = osbuf.os_nlinks;
50		buf->st_uid = osbuf.os_uid;
51		buf->st_gid = osbuf.os_gid;
52		buf->st_rdev = 0;

/* modified /usr/src/libc/v6/stat.c */

11		char  os_size0;
12		unsigned os_size1;
13		short os_addr[8];

49		buf->st_nlink = osbuf.os_nlinks;
50		buf->st_uid = osbuf.os_uid & 0377;
51		buf->st_gid = osbuf.os_gid & 0377;
52		buf->st_rdev = 0;
.PE