[Host/Signals] Deliver caught signals before retrying waits - #1129
Open
brandonpayton wants to merge 1 commit into
Open
[Host/Signals] Deliver caught signals before retrying waits#1129brandonpayton wants to merge 1 commit into
brandonpayton wants to merge 1 commit into
Conversation
Treat CH_SIG as channel-owned state after the kernel dequeues a caught signal. A blocking host retry now completes with EINTR before it can re-park, so libc can run the handler instead of losing the only signal record. Keep public nonblocking EAGAIN outcomes intact and narrowly restart accept and accept4 when SA_RESTART applies. Cover the shared retry state machine, pending connect, and the real fork/SIGCHLD/accept guest path.
brandonpayton
added a commit
that referenced
this pull request
Aug 12, 2026
Treat CH_SIG as channel-owned state after the kernel dequeues a caught signal. A blocked host retry now completes with EINTR before it can re-park, so libc can run the handler without losing the only signal record. Forward-port #1129 onto ABI 43 exact retry ownership. Host-generated events now enter through an additive kernel export instead of borrowing the target task's occupied syscall channel. Preserve public nonblocking EAGAIN, SA_RESTART policy, and Node/browser parity. Validation: - 1,500 native kernel tests - 177 focused blocking-retry and signal tests - real accept/SIGCHLD guest in Node.js - real accept/SIGCHLD guest in Chromium, Firefox, and WebKit - ABI snapshot, host typecheck, and documentation build (cherry picked from commit 997fc7b)
brandonpayton
added a commit
that referenced
this pull request
Aug 17, 2026
Treat CH_SIG as channel-owned state after the kernel dequeues a caught signal. A blocked host retry now completes with EINTR before it can re-park, so libc can run the handler without losing the only signal record. Forward-port #1129 onto ABI 43 exact retry ownership. Host-generated events now enter through an additive kernel export instead of borrowing the target task's occupied syscall channel. Preserve public nonblocking EAGAIN, SA_RESTART policy, and Node/browser parity. Validation: - 1,500 native kernel tests - 177 focused blocking-retry and signal tests - real accept/SIGCHLD guest in Node.js - real accept/SIGCHLD guest in Chromium, Firefox, and WebKit - ABI snapshot, host typecheck, and documentation build (cherry picked from commit 997fc7b)
brandonpayton
added a commit
that referenced
this pull request
Aug 17, 2026
Treat CH_SIG as channel-owned state after the kernel dequeues a caught signal. A blocked host retry now completes with EINTR before it can re-park, so libc can run the handler without losing the only signal record. Forward-port #1129 onto ABI 43 exact retry ownership. Host-generated events now enter through an additive kernel export instead of borrowing the target task's occupied syscall channel. Preserve public nonblocking EAGAIN, SA_RESTART policy, and Node/browser parity. Validation: - 1,500 native kernel tests - 177 focused blocking-retry and signal tests - real accept/SIGCHLD guest in Node.js - real accept/SIGCHLD guest in Chromium, Firefox, and WebKit - ABI snapshot, host typecheck, and documentation build (cherry picked from commit 997fc7b) (cherry picked from commit 775903e)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
A caught signal can arrive while the host is retrying a blocking
syscall. Rust dequeues that signal into the process channel before the
host inspects the kernel's internal
EAGAINresult.The old retry path could park the same channel again. The guest could
not run the handler until the mailbox completed, and the next retry
could clear the channel's only signal record. In the WordPress mail
path, msmtpd lost
SIGCHLD, retained zombie session children, filledits 16-session limit, and stopped greeting new clients.
The hard part is that
EAGAINhas two meanings at this boundary. It canbe a public result from a nonblocking operation, or an internal request
for the host to keep waiting. Signal delivery must interrupt only the
latter.
What changed
CH_SIGrecord as channel-owned until libc consumesit.
EINTRwith thatrecord intact so libc can run the handler.
EAGAINfor nonblocking descriptors,MSG_DONTWAIT, and zero-time waits.acceptandaccept4only when the caughthandler uses
SA_RESTART. Those calls are safe to resubmit becausethe interrupted attempt did not remove a connection from the queue.
The state machine lives in shared
CentralizedKernelWorkercode, soNode.js and browser hosts use the same behavior.
Validation
scripts/dev-shell.sh bash scripts/build-musl.shscripts/dev-shell.sh npm --prefix host run buildSIGCHLDwhile blockedin
accept, and verifies both observableEINTRandSA_RESTART.scripts/dev-shell.sh bash scripts/check-abi-version.shThe ABI snapshot remains unchanged.
The local Sortix signal/process run reached all 56 cases but protected
main's stale program-package projection rejected every case beforeguest startup. Browser execution was not run locally; CI remains the
browser evidence for this shared host-runtime change.