xv6-65oo2/spinlock.c

146 lines
3 KiB
C
Raw Normal View History

2006-09-07 14:12:30 +00:00
// Mutual exclusion spin locks.
#include "types.h"
2007-08-27 23:26:33 +00:00
#include "param.h"
#include "memlayout.h"
#include "spinlock.h"
2019-05-31 13:45:59 +00:00
#include "riscv.h"
#include "defs.h"
void
2009-07-12 02:26:51 +00:00
initlock(struct spinlock *lk, char *name)
{
2009-07-12 02:26:51 +00:00
lk->name = name;
lk->locked = 0;
lk->cpu = 0;
}
2019-05-31 13:45:59 +00:00
void
acquire(struct spinlock *lk)
{
lk->locked = 1;
lk->cpu = mycpu();
}
void
release(struct spinlock *lk)
{
lk->locked = 0;
lk->cpu = 0;
}
int
holding(struct spinlock *lk)
{
return lk->locked && lk->cpu == mycpu();
}
#if 0
// Acquire the lock.
// Loops (spins) until the lock is acquired.
// Holding a lock for a long time may cause
// other CPUs to waste time spinning to acquire it.
2006-07-11 01:07:40 +00:00
void
2009-07-12 02:26:51 +00:00
acquire(struct spinlock *lk)
{
pushcli(); // disable interrupts to avoid deadlock.
2009-07-12 02:26:51 +00:00
if(holding(lk))
panic("acquire");
2006-07-17 05:00:25 +00:00
// The xchg is atomic.
2009-07-12 02:26:51 +00:00
while(xchg(&lk->locked, 1) != 0)
;
2006-09-07 16:53:49 +00:00
// Tell the C compiler and the processor to not move loads or stores
// past this point, to ensure that the critical section's memory
// references happen after the lock is acquired.
__sync_synchronize();
2019-05-31 13:45:59 +00:00
// Record info about lock acquisition for holding() and debugging.
lk->cpu = mycpu();
2009-07-12 02:26:51 +00:00
getcallerpcs(&lk, lk->pcs);
}
2006-09-07 14:12:30 +00:00
// Release the lock.
void
2009-07-12 02:26:51 +00:00
release(struct spinlock *lk)
{
2009-07-12 02:26:51 +00:00
if(!holding(lk))
panic("release");
2006-07-17 05:00:25 +00:00
2009-07-12 02:26:51 +00:00
lk->pcs[0] = 0;
lk->cpu = 0;
2006-09-07 16:53:49 +00:00
// Tell the C compiler and the processor to not move loads or stores
// past this point, to ensure that all the stores in the critical
// section are visible to other cores before the lock is released.
// Both the C compiler and the hardware may re-order loads and
2016-09-15 16:01:52 +00:00
// stores; __sync_synchronize() tells them both not to.
__sync_synchronize();
// Release the lock, equivalent to lk->locked = 0.
// This code can't use a C assignment, since it might
2016-09-14 17:01:53 +00:00
// not be atomic. A real OS would use C atomics here.
asm volatile("movl $0, %0" : "+m" (lk->locked) : );
2007-09-27 20:09:40 +00:00
popcli();
}
// Record the current call stack in pcs[] by following the %ebp chain.
void
Checkpoint port of xv6 to x86-64. Passed usertests on 2 processors a few times. The x86-64 doesn't just add two levels to page tables to support 64 bit addresses, but is a different processor. For example, calling conventions, system calls, and segmentation are different from 32-bit x86. Segmentation is basically gone, but gs/fs in combination with MSRs can be used to hold a per-core pointer. In general, x86-64 is more straightforward than 32-bit x86. The port uses code from sv6 and the xv6 "rsc-amd64" branch. A summary of the changes is as follows: - Booting: switch to grub instead of xv6's bootloader (pass -kernel to qemu), because xv6's boot loader doesn't understand 64bit ELF files. And, we don't care anymore about booting. - Makefile: use -m64 instead of -m32 flag for gcc, delete boot loader, xv6.img, bochs, and memfs. For now dont' use -O2, since usertests with -O2 is bigger than MAXFILE! - Update gdb.tmpl to be for i386 or x86-64 - Console/printf: use stdarg.h and treat 64-bit addresses different from ints (32-bit) - Update elfhdr to be 64 bit - entry.S/entryother.S: add code to switch to 64-bit mode: build a simple page table in 32-bit mode before switching to 64-bit mode, share code for entering boot processor and APs, and tweak boot gdt. The boot gdt is the gdt that the kernel proper also uses. (In 64-bit mode, the gdt/segmentation and task state mostly disappear.) - exec.c: fix passing argv (64-bit now instead of 32-bit). - initcode.c: use syscall instead of int. - kernel.ld: load kernel very high, in top terabyte. 64 bits is a lot of address space! - proc.c: initial return is through new syscall path instead of trapret. - proc.h: update struct cpu to have some scratch space since syscall saves less state than int, update struct context to reflect x86-64 calling conventions. - swtch: simplify for x86-64 calling conventions. - syscall: add fetcharg to handle x86-64 calling convetions (6 arguments are passed through registers), and fetchaddr to read a 64-bit value from user space. - sysfile: update to handle pointers from user space (e.g., sys_exec), which are 64 bits. - trap.c: no special trap vector for sys calls, because x86-64 has a different plan for system calls. - trapasm: one plan for syscalls and one plan for traps (interrupt and exceptions). On x86-64, the kernel is responsible for switching user/kernel stacks. To do, xv6 keeps some scratch space in the cpu structure, and uses MSR GS_KERN_BASE to point to the core's cpu structure (using swapgs). - types.h: add uint64, and change pde_t to uint64 - usertests: exit() when fork fails, which helped in tracking down one of the bugs in the switch from 32-bit to 64-bit - vectors: update to make them 64 bits - vm.c: use bootgdt in kernel too, program MSRs for syscalls and core-local state (for swapgs), walk 4 levels in walkpgdir, add DEVSPACETOP, use task segment to set kernel stack for interrupts (but simpler than in 32-bit mode), add an extra argument to freevm (size of user part of address space) to avoid checking all entries till KERNBASE (there are MANY TB before the top 1TB). - x86: update trapframe to have 64-bit entries, which is what the processor pushes on syscalls and traps. simplify lgdt and lidt, using struct desctr, which needs the gcc directives packed and aligned. TODO: - use int32 instead of int? - simplify curproc(). xv6 has per-cpu state again, but this time it must have it. - avoid repetition in walkpgdir - fix validateint() in usertests.c - fix bugs (e.g., observed one a case of entering kernel with invalid gs or proc
2018-09-23 12:24:42 +00:00
getcallerpcs(void *v, uint64 pcs[])
{
Checkpoint port of xv6 to x86-64. Passed usertests on 2 processors a few times. The x86-64 doesn't just add two levels to page tables to support 64 bit addresses, but is a different processor. For example, calling conventions, system calls, and segmentation are different from 32-bit x86. Segmentation is basically gone, but gs/fs in combination with MSRs can be used to hold a per-core pointer. In general, x86-64 is more straightforward than 32-bit x86. The port uses code from sv6 and the xv6 "rsc-amd64" branch. A summary of the changes is as follows: - Booting: switch to grub instead of xv6's bootloader (pass -kernel to qemu), because xv6's boot loader doesn't understand 64bit ELF files. And, we don't care anymore about booting. - Makefile: use -m64 instead of -m32 flag for gcc, delete boot loader, xv6.img, bochs, and memfs. For now dont' use -O2, since usertests with -O2 is bigger than MAXFILE! - Update gdb.tmpl to be for i386 or x86-64 - Console/printf: use stdarg.h and treat 64-bit addresses different from ints (32-bit) - Update elfhdr to be 64 bit - entry.S/entryother.S: add code to switch to 64-bit mode: build a simple page table in 32-bit mode before switching to 64-bit mode, share code for entering boot processor and APs, and tweak boot gdt. The boot gdt is the gdt that the kernel proper also uses. (In 64-bit mode, the gdt/segmentation and task state mostly disappear.) - exec.c: fix passing argv (64-bit now instead of 32-bit). - initcode.c: use syscall instead of int. - kernel.ld: load kernel very high, in top terabyte. 64 bits is a lot of address space! - proc.c: initial return is through new syscall path instead of trapret. - proc.h: update struct cpu to have some scratch space since syscall saves less state than int, update struct context to reflect x86-64 calling conventions. - swtch: simplify for x86-64 calling conventions. - syscall: add fetcharg to handle x86-64 calling convetions (6 arguments are passed through registers), and fetchaddr to read a 64-bit value from user space. - sysfile: update to handle pointers from user space (e.g., sys_exec), which are 64 bits. - trap.c: no special trap vector for sys calls, because x86-64 has a different plan for system calls. - trapasm: one plan for syscalls and one plan for traps (interrupt and exceptions). On x86-64, the kernel is responsible for switching user/kernel stacks. To do, xv6 keeps some scratch space in the cpu structure, and uses MSR GS_KERN_BASE to point to the core's cpu structure (using swapgs). - types.h: add uint64, and change pde_t to uint64 - usertests: exit() when fork fails, which helped in tracking down one of the bugs in the switch from 32-bit to 64-bit - vectors: update to make them 64 bits - vm.c: use bootgdt in kernel too, program MSRs for syscalls and core-local state (for swapgs), walk 4 levels in walkpgdir, add DEVSPACETOP, use task segment to set kernel stack for interrupts (but simpler than in 32-bit mode), add an extra argument to freevm (size of user part of address space) to avoid checking all entries till KERNBASE (there are MANY TB before the top 1TB). - x86: update trapframe to have 64-bit entries, which is what the processor pushes on syscalls and traps. simplify lgdt and lidt, using struct desctr, which needs the gcc directives packed and aligned. TODO: - use int32 instead of int? - simplify curproc(). xv6 has per-cpu state again, but this time it must have it. - avoid repetition in walkpgdir - fix validateint() in usertests.c - fix bugs (e.g., observed one a case of entering kernel with invalid gs or proc
2018-09-23 12:24:42 +00:00
uint64 *ebp;
int i;
Checkpoint port of xv6 to x86-64. Passed usertests on 2 processors a few times. The x86-64 doesn't just add two levels to page tables to support 64 bit addresses, but is a different processor. For example, calling conventions, system calls, and segmentation are different from 32-bit x86. Segmentation is basically gone, but gs/fs in combination with MSRs can be used to hold a per-core pointer. In general, x86-64 is more straightforward than 32-bit x86. The port uses code from sv6 and the xv6 "rsc-amd64" branch. A summary of the changes is as follows: - Booting: switch to grub instead of xv6's bootloader (pass -kernel to qemu), because xv6's boot loader doesn't understand 64bit ELF files. And, we don't care anymore about booting. - Makefile: use -m64 instead of -m32 flag for gcc, delete boot loader, xv6.img, bochs, and memfs. For now dont' use -O2, since usertests with -O2 is bigger than MAXFILE! - Update gdb.tmpl to be for i386 or x86-64 - Console/printf: use stdarg.h and treat 64-bit addresses different from ints (32-bit) - Update elfhdr to be 64 bit - entry.S/entryother.S: add code to switch to 64-bit mode: build a simple page table in 32-bit mode before switching to 64-bit mode, share code for entering boot processor and APs, and tweak boot gdt. The boot gdt is the gdt that the kernel proper also uses. (In 64-bit mode, the gdt/segmentation and task state mostly disappear.) - exec.c: fix passing argv (64-bit now instead of 32-bit). - initcode.c: use syscall instead of int. - kernel.ld: load kernel very high, in top terabyte. 64 bits is a lot of address space! - proc.c: initial return is through new syscall path instead of trapret. - proc.h: update struct cpu to have some scratch space since syscall saves less state than int, update struct context to reflect x86-64 calling conventions. - swtch: simplify for x86-64 calling conventions. - syscall: add fetcharg to handle x86-64 calling convetions (6 arguments are passed through registers), and fetchaddr to read a 64-bit value from user space. - sysfile: update to handle pointers from user space (e.g., sys_exec), which are 64 bits. - trap.c: no special trap vector for sys calls, because x86-64 has a different plan for system calls. - trapasm: one plan for syscalls and one plan for traps (interrupt and exceptions). On x86-64, the kernel is responsible for switching user/kernel stacks. To do, xv6 keeps some scratch space in the cpu structure, and uses MSR GS_KERN_BASE to point to the core's cpu structure (using swapgs). - types.h: add uint64, and change pde_t to uint64 - usertests: exit() when fork fails, which helped in tracking down one of the bugs in the switch from 32-bit to 64-bit - vectors: update to make them 64 bits - vm.c: use bootgdt in kernel too, program MSRs for syscalls and core-local state (for swapgs), walk 4 levels in walkpgdir, add DEVSPACETOP, use task segment to set kernel stack for interrupts (but simpler than in 32-bit mode), add an extra argument to freevm (size of user part of address space) to avoid checking all entries till KERNBASE (there are MANY TB before the top 1TB). - x86: update trapframe to have 64-bit entries, which is what the processor pushes on syscalls and traps. simplify lgdt and lidt, using struct desctr, which needs the gcc directives packed and aligned. TODO: - use int32 instead of int? - simplify curproc(). xv6 has per-cpu state again, but this time it must have it. - avoid repetition in walkpgdir - fix validateint() in usertests.c - fix bugs (e.g., observed one a case of entering kernel with invalid gs or proc
2018-09-23 12:24:42 +00:00
asm volatile("mov %%rbp, %0" : "=r" (ebp));
for(i = 0; i < 10; i++){
Checkpoint port of xv6 to x86-64. Passed usertests on 2 processors a few times. The x86-64 doesn't just add two levels to page tables to support 64 bit addresses, but is a different processor. For example, calling conventions, system calls, and segmentation are different from 32-bit x86. Segmentation is basically gone, but gs/fs in combination with MSRs can be used to hold a per-core pointer. In general, x86-64 is more straightforward than 32-bit x86. The port uses code from sv6 and the xv6 "rsc-amd64" branch. A summary of the changes is as follows: - Booting: switch to grub instead of xv6's bootloader (pass -kernel to qemu), because xv6's boot loader doesn't understand 64bit ELF files. And, we don't care anymore about booting. - Makefile: use -m64 instead of -m32 flag for gcc, delete boot loader, xv6.img, bochs, and memfs. For now dont' use -O2, since usertests with -O2 is bigger than MAXFILE! - Update gdb.tmpl to be for i386 or x86-64 - Console/printf: use stdarg.h and treat 64-bit addresses different from ints (32-bit) - Update elfhdr to be 64 bit - entry.S/entryother.S: add code to switch to 64-bit mode: build a simple page table in 32-bit mode before switching to 64-bit mode, share code for entering boot processor and APs, and tweak boot gdt. The boot gdt is the gdt that the kernel proper also uses. (In 64-bit mode, the gdt/segmentation and task state mostly disappear.) - exec.c: fix passing argv (64-bit now instead of 32-bit). - initcode.c: use syscall instead of int. - kernel.ld: load kernel very high, in top terabyte. 64 bits is a lot of address space! - proc.c: initial return is through new syscall path instead of trapret. - proc.h: update struct cpu to have some scratch space since syscall saves less state than int, update struct context to reflect x86-64 calling conventions. - swtch: simplify for x86-64 calling conventions. - syscall: add fetcharg to handle x86-64 calling convetions (6 arguments are passed through registers), and fetchaddr to read a 64-bit value from user space. - sysfile: update to handle pointers from user space (e.g., sys_exec), which are 64 bits. - trap.c: no special trap vector for sys calls, because x86-64 has a different plan for system calls. - trapasm: one plan for syscalls and one plan for traps (interrupt and exceptions). On x86-64, the kernel is responsible for switching user/kernel stacks. To do, xv6 keeps some scratch space in the cpu structure, and uses MSR GS_KERN_BASE to point to the core's cpu structure (using swapgs). - types.h: add uint64, and change pde_t to uint64 - usertests: exit() when fork fails, which helped in tracking down one of the bugs in the switch from 32-bit to 64-bit - vectors: update to make them 64 bits - vm.c: use bootgdt in kernel too, program MSRs for syscalls and core-local state (for swapgs), walk 4 levels in walkpgdir, add DEVSPACETOP, use task segment to set kernel stack for interrupts (but simpler than in 32-bit mode), add an extra argument to freevm (size of user part of address space) to avoid checking all entries till KERNBASE (there are MANY TB before the top 1TB). - x86: update trapframe to have 64-bit entries, which is what the processor pushes on syscalls and traps. simplify lgdt and lidt, using struct desctr, which needs the gcc directives packed and aligned. TODO: - use int32 instead of int? - simplify curproc(). xv6 has per-cpu state again, but this time it must have it. - avoid repetition in walkpgdir - fix validateint() in usertests.c - fix bugs (e.g., observed one a case of entering kernel with invalid gs or proc
2018-09-23 12:24:42 +00:00
if(ebp == 0 || ebp < (uint64*)KERNBASE || ebp == (uint64*)0xffffffff)
break;
pcs[i] = ebp[1]; // saved %eip
Checkpoint port of xv6 to x86-64. Passed usertests on 2 processors a few times. The x86-64 doesn't just add two levels to page tables to support 64 bit addresses, but is a different processor. For example, calling conventions, system calls, and segmentation are different from 32-bit x86. Segmentation is basically gone, but gs/fs in combination with MSRs can be used to hold a per-core pointer. In general, x86-64 is more straightforward than 32-bit x86. The port uses code from sv6 and the xv6 "rsc-amd64" branch. A summary of the changes is as follows: - Booting: switch to grub instead of xv6's bootloader (pass -kernel to qemu), because xv6's boot loader doesn't understand 64bit ELF files. And, we don't care anymore about booting. - Makefile: use -m64 instead of -m32 flag for gcc, delete boot loader, xv6.img, bochs, and memfs. For now dont' use -O2, since usertests with -O2 is bigger than MAXFILE! - Update gdb.tmpl to be for i386 or x86-64 - Console/printf: use stdarg.h and treat 64-bit addresses different from ints (32-bit) - Update elfhdr to be 64 bit - entry.S/entryother.S: add code to switch to 64-bit mode: build a simple page table in 32-bit mode before switching to 64-bit mode, share code for entering boot processor and APs, and tweak boot gdt. The boot gdt is the gdt that the kernel proper also uses. (In 64-bit mode, the gdt/segmentation and task state mostly disappear.) - exec.c: fix passing argv (64-bit now instead of 32-bit). - initcode.c: use syscall instead of int. - kernel.ld: load kernel very high, in top terabyte. 64 bits is a lot of address space! - proc.c: initial return is through new syscall path instead of trapret. - proc.h: update struct cpu to have some scratch space since syscall saves less state than int, update struct context to reflect x86-64 calling conventions. - swtch: simplify for x86-64 calling conventions. - syscall: add fetcharg to handle x86-64 calling convetions (6 arguments are passed through registers), and fetchaddr to read a 64-bit value from user space. - sysfile: update to handle pointers from user space (e.g., sys_exec), which are 64 bits. - trap.c: no special trap vector for sys calls, because x86-64 has a different plan for system calls. - trapasm: one plan for syscalls and one plan for traps (interrupt and exceptions). On x86-64, the kernel is responsible for switching user/kernel stacks. To do, xv6 keeps some scratch space in the cpu structure, and uses MSR GS_KERN_BASE to point to the core's cpu structure (using swapgs). - types.h: add uint64, and change pde_t to uint64 - usertests: exit() when fork fails, which helped in tracking down one of the bugs in the switch from 32-bit to 64-bit - vectors: update to make them 64 bits - vm.c: use bootgdt in kernel too, program MSRs for syscalls and core-local state (for swapgs), walk 4 levels in walkpgdir, add DEVSPACETOP, use task segment to set kernel stack for interrupts (but simpler than in 32-bit mode), add an extra argument to freevm (size of user part of address space) to avoid checking all entries till KERNBASE (there are MANY TB before the top 1TB). - x86: update trapframe to have 64-bit entries, which is what the processor pushes on syscalls and traps. simplify lgdt and lidt, using struct desctr, which needs the gcc directives packed and aligned. TODO: - use int32 instead of int? - simplify curproc(). xv6 has per-cpu state again, but this time it must have it. - avoid repetition in walkpgdir - fix validateint() in usertests.c - fix bugs (e.g., observed one a case of entering kernel with invalid gs or proc
2018-09-23 12:24:42 +00:00
ebp = (uint64*)ebp[0]; // saved %ebp
}
for(; i < 10; i++)
pcs[i] = 0;
}
// Check whether this cpu is holding the lock.
int
2019-05-31 13:45:59 +00:00
holding(struct spinlock *lk)
{
int r;
pushcli();
2019-05-31 13:45:59 +00:00
r = lk->locked && lk->cpu == mycpu();
popcli();
return r;
}
kernel SMP interruptibility fixes. Last year, right before I sent xv6 to the printer, I changed the SETGATE calls so that interrupts would be disabled on entry to interrupt handlers, and I added the nlock++ / nlock-- in trap() so that interrupts would stay disabled while the hw handlers (but not the syscall handler) did their work. I did this because the kernel was otherwise causing Bochs to triple-fault in SMP mode, and time was short. Robert observed yesterday that something was keeping the SMP preemption user test from working. It turned out that when I simplified the lapic code I swapped the order of two register writes that I didn't realize were order dependent. I fixed that and then since I had everything paged in kept going and tried to figure out why you can't leave interrupts on during interrupt handlers. There are a few issues. First, there must be some way to keep interrupts from "stacking up" and overflowing the stack. Keeping interrupts off the whole time solves this problem -- even if the clock tick handler runs long enough that the next clock tick is waiting when it finishes, keeping interrupts off means that the handler runs all the way through the "iret" before the next handler begins. This is not really a problem unless you are putting too many prints in trap -- if the OS is doing its job right, the handlers should run quickly and not stack up. Second, if xv6 had page faults, then it would be important to keep interrupts disabled between the start of the interrupt and the time that cr2 was read, to avoid a scenario like: p1 page faults [cr2 set to faulting address] p1 starts executing trapasm.S clock interrupt, p1 preempted, p2 starts executing p2 page faults [cr2 set to another faulting address] p2 starts, finishes fault handler p1 rescheduled, reads cr2, sees wrong fault address Alternately p1 could be rescheduled on the other cpu, in which case it would still see the wrong cr2. That said, I think cr2 is the only interrupt state that isn't pushed onto the interrupt stack atomically at fault time, and xv6 doesn't care. (This isn't entirely hypothetical -- I debugged this problem on Plan 9.) Third, and this is the big one, it is not safe to call cpu() unless interrupts are disabled. If interrupts are enabled then there is no guarantee that, between the time cpu() looks up the cpu id and the time that it the result gets used, the process has not been rescheduled to the other cpu. For example, the very commonly-used expression curproc[cpu()] (aka the macro cp) can end up referring to the wrong proc: the code stores the result of cpu() in %eax, gets rescheduled to the other cpu at just the wrong instant, and then reads curproc[%eax]. We use curproc[cpu()] to get the current process a LOT. In that particular case, if we arranged for the current curproc entry to be addressed by %fs:0 and just use a different %fs on each CPU, then we could safely get at curproc even with interrupts disabled, since the read of %fs would be atomic with the read of %fs:0. Alternately, we could have a curproc() function that disables interrupts while computing curproc[cpu()]. I've done that last one. Even in the current kernel, with interrupts off on entry to trap, interrupts are enabled inside release if there are no locks held. Also, the scheduler's idle loop must be interruptible at times so that the clock and disk interrupts (which might make processes runnable) can be handled. In addition to the rampant use of curproc[cpu()], this little snippet from acquire is wrong on smp: if(cpus[cpu()].nlock == 0) cli(); cpus[cpu()].nlock++; because if interrupts are off then we might call cpu(), get rescheduled to a different cpu, look at cpus[oldcpu].nlock, and wrongly decide not to disable interrupts on the new cpu. The fix is to always call cli(). But this is wrong too: if(holding(lock)) panic("acquire"); cli(); cpus[cpu()].nlock++; because holding looks at cpu(). The fix is: cli(); if(holding(lock)) panic("acquire"); cpus[cpu()].nlock++; I've done that, and I changed cpu() to complain the first time it gets called with interrupts disabled. (It gets called too much to complain every time.) I added new functions splhi and spllo that are like acquire and release but without the locking: void splhi(void) { cli(); cpus[cpu()].nsplhi++; } void spllo(void) { if(--cpus[cpu()].nsplhi == 0) sti(); } and I've used those to protect other sections of code that refer to cpu() when interrupts would otherwise be disabled (basically just curproc and setupsegs). I also use them in acquire/release and got rid of nlock. I'm not thrilled with the names, but I think the concept -- a counted cli/sti -- is sound. Having them also replaces the nlock++/nlock-- in trap.c and main.c, which is nice. Final note: it's still not safe to enable interrupts in the middle of trap() between lapic_eoi and returning to user space. I don't understand why, but we get a fault on pop %es because 0x10 is a bad segment descriptor (!) and then the fault faults trying to go into a new interrupt because 0x8 is a bad segment descriptor too! Triple fault. I haven't debugged this yet.
2007-09-27 12:58:42 +00:00
// Pushcli/popcli are like cli/sti except that they are matched:
// it takes two popcli to undo two pushcli. Also, if interrupts
// are off, then pushcli, popcli leaves them off.
kernel SMP interruptibility fixes. Last year, right before I sent xv6 to the printer, I changed the SETGATE calls so that interrupts would be disabled on entry to interrupt handlers, and I added the nlock++ / nlock-- in trap() so that interrupts would stay disabled while the hw handlers (but not the syscall handler) did their work. I did this because the kernel was otherwise causing Bochs to triple-fault in SMP mode, and time was short. Robert observed yesterday that something was keeping the SMP preemption user test from working. It turned out that when I simplified the lapic code I swapped the order of two register writes that I didn't realize were order dependent. I fixed that and then since I had everything paged in kept going and tried to figure out why you can't leave interrupts on during interrupt handlers. There are a few issues. First, there must be some way to keep interrupts from "stacking up" and overflowing the stack. Keeping interrupts off the whole time solves this problem -- even if the clock tick handler runs long enough that the next clock tick is waiting when it finishes, keeping interrupts off means that the handler runs all the way through the "iret" before the next handler begins. This is not really a problem unless you are putting too many prints in trap -- if the OS is doing its job right, the handlers should run quickly and not stack up. Second, if xv6 had page faults, then it would be important to keep interrupts disabled between the start of the interrupt and the time that cr2 was read, to avoid a scenario like: p1 page faults [cr2 set to faulting address] p1 starts executing trapasm.S clock interrupt, p1 preempted, p2 starts executing p2 page faults [cr2 set to another faulting address] p2 starts, finishes fault handler p1 rescheduled, reads cr2, sees wrong fault address Alternately p1 could be rescheduled on the other cpu, in which case it would still see the wrong cr2. That said, I think cr2 is the only interrupt state that isn't pushed onto the interrupt stack atomically at fault time, and xv6 doesn't care. (This isn't entirely hypothetical -- I debugged this problem on Plan 9.) Third, and this is the big one, it is not safe to call cpu() unless interrupts are disabled. If interrupts are enabled then there is no guarantee that, between the time cpu() looks up the cpu id and the time that it the result gets used, the process has not been rescheduled to the other cpu. For example, the very commonly-used expression curproc[cpu()] (aka the macro cp) can end up referring to the wrong proc: the code stores the result of cpu() in %eax, gets rescheduled to the other cpu at just the wrong instant, and then reads curproc[%eax]. We use curproc[cpu()] to get the current process a LOT. In that particular case, if we arranged for the current curproc entry to be addressed by %fs:0 and just use a different %fs on each CPU, then we could safely get at curproc even with interrupts disabled, since the read of %fs would be atomic with the read of %fs:0. Alternately, we could have a curproc() function that disables interrupts while computing curproc[cpu()]. I've done that last one. Even in the current kernel, with interrupts off on entry to trap, interrupts are enabled inside release if there are no locks held. Also, the scheduler's idle loop must be interruptible at times so that the clock and disk interrupts (which might make processes runnable) can be handled. In addition to the rampant use of curproc[cpu()], this little snippet from acquire is wrong on smp: if(cpus[cpu()].nlock == 0) cli(); cpus[cpu()].nlock++; because if interrupts are off then we might call cpu(), get rescheduled to a different cpu, look at cpus[oldcpu].nlock, and wrongly decide not to disable interrupts on the new cpu. The fix is to always call cli(). But this is wrong too: if(holding(lock)) panic("acquire"); cli(); cpus[cpu()].nlock++; because holding looks at cpu(). The fix is: cli(); if(holding(lock)) panic("acquire"); cpus[cpu()].nlock++; I've done that, and I changed cpu() to complain the first time it gets called with interrupts disabled. (It gets called too much to complain every time.) I added new functions splhi and spllo that are like acquire and release but without the locking: void splhi(void) { cli(); cpus[cpu()].nsplhi++; } void spllo(void) { if(--cpus[cpu()].nsplhi == 0) sti(); } and I've used those to protect other sections of code that refer to cpu() when interrupts would otherwise be disabled (basically just curproc and setupsegs). I also use them in acquire/release and got rid of nlock. I'm not thrilled with the names, but I think the concept -- a counted cli/sti -- is sound. Having them also replaces the nlock++/nlock-- in trap.c and main.c, which is nice. Final note: it's still not safe to enable interrupts in the middle of trap() between lapic_eoi and returning to user space. I don't understand why, but we get a fault on pop %es because 0x10 is a bad segment descriptor (!) and then the fault faults trying to go into a new interrupt because 0x8 is a bad segment descriptor too! Triple fault. I haven't debugged this yet.
2007-09-27 12:58:42 +00:00
void
2007-09-27 20:09:40 +00:00
pushcli(void)
kernel SMP interruptibility fixes. Last year, right before I sent xv6 to the printer, I changed the SETGATE calls so that interrupts would be disabled on entry to interrupt handlers, and I added the nlock++ / nlock-- in trap() so that interrupts would stay disabled while the hw handlers (but not the syscall handler) did their work. I did this because the kernel was otherwise causing Bochs to triple-fault in SMP mode, and time was short. Robert observed yesterday that something was keeping the SMP preemption user test from working. It turned out that when I simplified the lapic code I swapped the order of two register writes that I didn't realize were order dependent. I fixed that and then since I had everything paged in kept going and tried to figure out why you can't leave interrupts on during interrupt handlers. There are a few issues. First, there must be some way to keep interrupts from "stacking up" and overflowing the stack. Keeping interrupts off the whole time solves this problem -- even if the clock tick handler runs long enough that the next clock tick is waiting when it finishes, keeping interrupts off means that the handler runs all the way through the "iret" before the next handler begins. This is not really a problem unless you are putting too many prints in trap -- if the OS is doing its job right, the handlers should run quickly and not stack up. Second, if xv6 had page faults, then it would be important to keep interrupts disabled between the start of the interrupt and the time that cr2 was read, to avoid a scenario like: p1 page faults [cr2 set to faulting address] p1 starts executing trapasm.S clock interrupt, p1 preempted, p2 starts executing p2 page faults [cr2 set to another faulting address] p2 starts, finishes fault handler p1 rescheduled, reads cr2, sees wrong fault address Alternately p1 could be rescheduled on the other cpu, in which case it would still see the wrong cr2. That said, I think cr2 is the only interrupt state that isn't pushed onto the interrupt stack atomically at fault time, and xv6 doesn't care. (This isn't entirely hypothetical -- I debugged this problem on Plan 9.) Third, and this is the big one, it is not safe to call cpu() unless interrupts are disabled. If interrupts are enabled then there is no guarantee that, between the time cpu() looks up the cpu id and the time that it the result gets used, the process has not been rescheduled to the other cpu. For example, the very commonly-used expression curproc[cpu()] (aka the macro cp) can end up referring to the wrong proc: the code stores the result of cpu() in %eax, gets rescheduled to the other cpu at just the wrong instant, and then reads curproc[%eax]. We use curproc[cpu()] to get the current process a LOT. In that particular case, if we arranged for the current curproc entry to be addressed by %fs:0 and just use a different %fs on each CPU, then we could safely get at curproc even with interrupts disabled, since the read of %fs would be atomic with the read of %fs:0. Alternately, we could have a curproc() function that disables interrupts while computing curproc[cpu()]. I've done that last one. Even in the current kernel, with interrupts off on entry to trap, interrupts are enabled inside release if there are no locks held. Also, the scheduler's idle loop must be interruptible at times so that the clock and disk interrupts (which might make processes runnable) can be handled. In addition to the rampant use of curproc[cpu()], this little snippet from acquire is wrong on smp: if(cpus[cpu()].nlock == 0) cli(); cpus[cpu()].nlock++; because if interrupts are off then we might call cpu(), get rescheduled to a different cpu, look at cpus[oldcpu].nlock, and wrongly decide not to disable interrupts on the new cpu. The fix is to always call cli(). But this is wrong too: if(holding(lock)) panic("acquire"); cli(); cpus[cpu()].nlock++; because holding looks at cpu(). The fix is: cli(); if(holding(lock)) panic("acquire"); cpus[cpu()].nlock++; I've done that, and I changed cpu() to complain the first time it gets called with interrupts disabled. (It gets called too much to complain every time.) I added new functions splhi and spllo that are like acquire and release but without the locking: void splhi(void) { cli(); cpus[cpu()].nsplhi++; } void spllo(void) { if(--cpus[cpu()].nsplhi == 0) sti(); } and I've used those to protect other sections of code that refer to cpu() when interrupts would otherwise be disabled (basically just curproc and setupsegs). I also use them in acquire/release and got rid of nlock. I'm not thrilled with the names, but I think the concept -- a counted cli/sti -- is sound. Having them also replaces the nlock++/nlock-- in trap.c and main.c, which is nice. Final note: it's still not safe to enable interrupts in the middle of trap() between lapic_eoi and returning to user space. I don't understand why, but we get a fault on pop %es because 0x10 is a bad segment descriptor (!) and then the fault faults trying to go into a new interrupt because 0x8 is a bad segment descriptor too! Triple fault. I haven't debugged this yet.
2007-09-27 12:58:42 +00:00
{
int eflags;
eflags = readeflags();
kernel SMP interruptibility fixes. Last year, right before I sent xv6 to the printer, I changed the SETGATE calls so that interrupts would be disabled on entry to interrupt handlers, and I added the nlock++ / nlock-- in trap() so that interrupts would stay disabled while the hw handlers (but not the syscall handler) did their work. I did this because the kernel was otherwise causing Bochs to triple-fault in SMP mode, and time was short. Robert observed yesterday that something was keeping the SMP preemption user test from working. It turned out that when I simplified the lapic code I swapped the order of two register writes that I didn't realize were order dependent. I fixed that and then since I had everything paged in kept going and tried to figure out why you can't leave interrupts on during interrupt handlers. There are a few issues. First, there must be some way to keep interrupts from "stacking up" and overflowing the stack. Keeping interrupts off the whole time solves this problem -- even if the clock tick handler runs long enough that the next clock tick is waiting when it finishes, keeping interrupts off means that the handler runs all the way through the "iret" before the next handler begins. This is not really a problem unless you are putting too many prints in trap -- if the OS is doing its job right, the handlers should run quickly and not stack up. Second, if xv6 had page faults, then it would be important to keep interrupts disabled between the start of the interrupt and the time that cr2 was read, to avoid a scenario like: p1 page faults [cr2 set to faulting address] p1 starts executing trapasm.S clock interrupt, p1 preempted, p2 starts executing p2 page faults [cr2 set to another faulting address] p2 starts, finishes fault handler p1 rescheduled, reads cr2, sees wrong fault address Alternately p1 could be rescheduled on the other cpu, in which case it would still see the wrong cr2. That said, I think cr2 is the only interrupt state that isn't pushed onto the interrupt stack atomically at fault time, and xv6 doesn't care. (This isn't entirely hypothetical -- I debugged this problem on Plan 9.) Third, and this is the big one, it is not safe to call cpu() unless interrupts are disabled. If interrupts are enabled then there is no guarantee that, between the time cpu() looks up the cpu id and the time that it the result gets used, the process has not been rescheduled to the other cpu. For example, the very commonly-used expression curproc[cpu()] (aka the macro cp) can end up referring to the wrong proc: the code stores the result of cpu() in %eax, gets rescheduled to the other cpu at just the wrong instant, and then reads curproc[%eax]. We use curproc[cpu()] to get the current process a LOT. In that particular case, if we arranged for the current curproc entry to be addressed by %fs:0 and just use a different %fs on each CPU, then we could safely get at curproc even with interrupts disabled, since the read of %fs would be atomic with the read of %fs:0. Alternately, we could have a curproc() function that disables interrupts while computing curproc[cpu()]. I've done that last one. Even in the current kernel, with interrupts off on entry to trap, interrupts are enabled inside release if there are no locks held. Also, the scheduler's idle loop must be interruptible at times so that the clock and disk interrupts (which might make processes runnable) can be handled. In addition to the rampant use of curproc[cpu()], this little snippet from acquire is wrong on smp: if(cpus[cpu()].nlock == 0) cli(); cpus[cpu()].nlock++; because if interrupts are off then we might call cpu(), get rescheduled to a different cpu, look at cpus[oldcpu].nlock, and wrongly decide not to disable interrupts on the new cpu. The fix is to always call cli(). But this is wrong too: if(holding(lock)) panic("acquire"); cli(); cpus[cpu()].nlock++; because holding looks at cpu(). The fix is: cli(); if(holding(lock)) panic("acquire"); cpus[cpu()].nlock++; I've done that, and I changed cpu() to complain the first time it gets called with interrupts disabled. (It gets called too much to complain every time.) I added new functions splhi and spllo that are like acquire and release but without the locking: void splhi(void) { cli(); cpus[cpu()].nsplhi++; } void spllo(void) { if(--cpus[cpu()].nsplhi == 0) sti(); } and I've used those to protect other sections of code that refer to cpu() when interrupts would otherwise be disabled (basically just curproc and setupsegs). I also use them in acquire/release and got rid of nlock. I'm not thrilled with the names, but I think the concept -- a counted cli/sti -- is sound. Having them also replaces the nlock++/nlock-- in trap.c and main.c, which is nice. Final note: it's still not safe to enable interrupts in the middle of trap() between lapic_eoi and returning to user space. I don't understand why, but we get a fault on pop %es because 0x10 is a bad segment descriptor (!) and then the fault faults trying to go into a new interrupt because 0x8 is a bad segment descriptor too! Triple fault. I haven't debugged this yet.
2007-09-27 12:58:42 +00:00
cli();
if(mycpu()->ncli == 0)
mycpu()->intena = eflags & FL_IF;
mycpu()->ncli += 1;
kernel SMP interruptibility fixes. Last year, right before I sent xv6 to the printer, I changed the SETGATE calls so that interrupts would be disabled on entry to interrupt handlers, and I added the nlock++ / nlock-- in trap() so that interrupts would stay disabled while the hw handlers (but not the syscall handler) did their work. I did this because the kernel was otherwise causing Bochs to triple-fault in SMP mode, and time was short. Robert observed yesterday that something was keeping the SMP preemption user test from working. It turned out that when I simplified the lapic code I swapped the order of two register writes that I didn't realize were order dependent. I fixed that and then since I had everything paged in kept going and tried to figure out why you can't leave interrupts on during interrupt handlers. There are a few issues. First, there must be some way to keep interrupts from "stacking up" and overflowing the stack. Keeping interrupts off the whole time solves this problem -- even if the clock tick handler runs long enough that the next clock tick is waiting when it finishes, keeping interrupts off means that the handler runs all the way through the "iret" before the next handler begins. This is not really a problem unless you are putting too many prints in trap -- if the OS is doing its job right, the handlers should run quickly and not stack up. Second, if xv6 had page faults, then it would be important to keep interrupts disabled between the start of the interrupt and the time that cr2 was read, to avoid a scenario like: p1 page faults [cr2 set to faulting address] p1 starts executing trapasm.S clock interrupt, p1 preempted, p2 starts executing p2 page faults [cr2 set to another faulting address] p2 starts, finishes fault handler p1 rescheduled, reads cr2, sees wrong fault address Alternately p1 could be rescheduled on the other cpu, in which case it would still see the wrong cr2. That said, I think cr2 is the only interrupt state that isn't pushed onto the interrupt stack atomically at fault time, and xv6 doesn't care. (This isn't entirely hypothetical -- I debugged this problem on Plan 9.) Third, and this is the big one, it is not safe to call cpu() unless interrupts are disabled. If interrupts are enabled then there is no guarantee that, between the time cpu() looks up the cpu id and the time that it the result gets used, the process has not been rescheduled to the other cpu. For example, the very commonly-used expression curproc[cpu()] (aka the macro cp) can end up referring to the wrong proc: the code stores the result of cpu() in %eax, gets rescheduled to the other cpu at just the wrong instant, and then reads curproc[%eax]. We use curproc[cpu()] to get the current process a LOT. In that particular case, if we arranged for the current curproc entry to be addressed by %fs:0 and just use a different %fs on each CPU, then we could safely get at curproc even with interrupts disabled, since the read of %fs would be atomic with the read of %fs:0. Alternately, we could have a curproc() function that disables interrupts while computing curproc[cpu()]. I've done that last one. Even in the current kernel, with interrupts off on entry to trap, interrupts are enabled inside release if there are no locks held. Also, the scheduler's idle loop must be interruptible at times so that the clock and disk interrupts (which might make processes runnable) can be handled. In addition to the rampant use of curproc[cpu()], this little snippet from acquire is wrong on smp: if(cpus[cpu()].nlock == 0) cli(); cpus[cpu()].nlock++; because if interrupts are off then we might call cpu(), get rescheduled to a different cpu, look at cpus[oldcpu].nlock, and wrongly decide not to disable interrupts on the new cpu. The fix is to always call cli(). But this is wrong too: if(holding(lock)) panic("acquire"); cli(); cpus[cpu()].nlock++; because holding looks at cpu(). The fix is: cli(); if(holding(lock)) panic("acquire"); cpus[cpu()].nlock++; I've done that, and I changed cpu() to complain the first time it gets called with interrupts disabled. (It gets called too much to complain every time.) I added new functions splhi and spllo that are like acquire and release but without the locking: void splhi(void) { cli(); cpus[cpu()].nsplhi++; } void spllo(void) { if(--cpus[cpu()].nsplhi == 0) sti(); } and I've used those to protect other sections of code that refer to cpu() when interrupts would otherwise be disabled (basically just curproc and setupsegs). I also use them in acquire/release and got rid of nlock. I'm not thrilled with the names, but I think the concept -- a counted cli/sti -- is sound. Having them also replaces the nlock++/nlock-- in trap.c and main.c, which is nice. Final note: it's still not safe to enable interrupts in the middle of trap() between lapic_eoi and returning to user space. I don't understand why, but we get a fault on pop %es because 0x10 is a bad segment descriptor (!) and then the fault faults trying to go into a new interrupt because 0x8 is a bad segment descriptor too! Triple fault. I haven't debugged this yet.
2007-09-27 12:58:42 +00:00
}
void
2007-09-27 20:09:40 +00:00
popcli(void)
kernel SMP interruptibility fixes. Last year, right before I sent xv6 to the printer, I changed the SETGATE calls so that interrupts would be disabled on entry to interrupt handlers, and I added the nlock++ / nlock-- in trap() so that interrupts would stay disabled while the hw handlers (but not the syscall handler) did their work. I did this because the kernel was otherwise causing Bochs to triple-fault in SMP mode, and time was short. Robert observed yesterday that something was keeping the SMP preemption user test from working. It turned out that when I simplified the lapic code I swapped the order of two register writes that I didn't realize were order dependent. I fixed that and then since I had everything paged in kept going and tried to figure out why you can't leave interrupts on during interrupt handlers. There are a few issues. First, there must be some way to keep interrupts from "stacking up" and overflowing the stack. Keeping interrupts off the whole time solves this problem -- even if the clock tick handler runs long enough that the next clock tick is waiting when it finishes, keeping interrupts off means that the handler runs all the way through the "iret" before the next handler begins. This is not really a problem unless you are putting too many prints in trap -- if the OS is doing its job right, the handlers should run quickly and not stack up. Second, if xv6 had page faults, then it would be important to keep interrupts disabled between the start of the interrupt and the time that cr2 was read, to avoid a scenario like: p1 page faults [cr2 set to faulting address] p1 starts executing trapasm.S clock interrupt, p1 preempted, p2 starts executing p2 page faults [cr2 set to another faulting address] p2 starts, finishes fault handler p1 rescheduled, reads cr2, sees wrong fault address Alternately p1 could be rescheduled on the other cpu, in which case it would still see the wrong cr2. That said, I think cr2 is the only interrupt state that isn't pushed onto the interrupt stack atomically at fault time, and xv6 doesn't care. (This isn't entirely hypothetical -- I debugged this problem on Plan 9.) Third, and this is the big one, it is not safe to call cpu() unless interrupts are disabled. If interrupts are enabled then there is no guarantee that, between the time cpu() looks up the cpu id and the time that it the result gets used, the process has not been rescheduled to the other cpu. For example, the very commonly-used expression curproc[cpu()] (aka the macro cp) can end up referring to the wrong proc: the code stores the result of cpu() in %eax, gets rescheduled to the other cpu at just the wrong instant, and then reads curproc[%eax]. We use curproc[cpu()] to get the current process a LOT. In that particular case, if we arranged for the current curproc entry to be addressed by %fs:0 and just use a different %fs on each CPU, then we could safely get at curproc even with interrupts disabled, since the read of %fs would be atomic with the read of %fs:0. Alternately, we could have a curproc() function that disables interrupts while computing curproc[cpu()]. I've done that last one. Even in the current kernel, with interrupts off on entry to trap, interrupts are enabled inside release if there are no locks held. Also, the scheduler's idle loop must be interruptible at times so that the clock and disk interrupts (which might make processes runnable) can be handled. In addition to the rampant use of curproc[cpu()], this little snippet from acquire is wrong on smp: if(cpus[cpu()].nlock == 0) cli(); cpus[cpu()].nlock++; because if interrupts are off then we might call cpu(), get rescheduled to a different cpu, look at cpus[oldcpu].nlock, and wrongly decide not to disable interrupts on the new cpu. The fix is to always call cli(). But this is wrong too: if(holding(lock)) panic("acquire"); cli(); cpus[cpu()].nlock++; because holding looks at cpu(). The fix is: cli(); if(holding(lock)) panic("acquire"); cpus[cpu()].nlock++; I've done that, and I changed cpu() to complain the first time it gets called with interrupts disabled. (It gets called too much to complain every time.) I added new functions splhi and spllo that are like acquire and release but without the locking: void splhi(void) { cli(); cpus[cpu()].nsplhi++; } void spllo(void) { if(--cpus[cpu()].nsplhi == 0) sti(); } and I've used those to protect other sections of code that refer to cpu() when interrupts would otherwise be disabled (basically just curproc and setupsegs). I also use them in acquire/release and got rid of nlock. I'm not thrilled with the names, but I think the concept -- a counted cli/sti -- is sound. Having them also replaces the nlock++/nlock-- in trap.c and main.c, which is nice. Final note: it's still not safe to enable interrupts in the middle of trap() between lapic_eoi and returning to user space. I don't understand why, but we get a fault on pop %es because 0x10 is a bad segment descriptor (!) and then the fault faults trying to go into a new interrupt because 0x8 is a bad segment descriptor too! Triple fault. I haven't debugged this yet.
2007-09-27 12:58:42 +00:00
{
if(readeflags()&FL_IF)
2007-09-27 20:09:40 +00:00
panic("popcli - interruptible");
if(--mycpu()->ncli < 0)
2007-09-27 20:09:40 +00:00
panic("popcli");
if(mycpu()->ncli == 0 && mycpu()->intena)
kernel SMP interruptibility fixes. Last year, right before I sent xv6 to the printer, I changed the SETGATE calls so that interrupts would be disabled on entry to interrupt handlers, and I added the nlock++ / nlock-- in trap() so that interrupts would stay disabled while the hw handlers (but not the syscall handler) did their work. I did this because the kernel was otherwise causing Bochs to triple-fault in SMP mode, and time was short. Robert observed yesterday that something was keeping the SMP preemption user test from working. It turned out that when I simplified the lapic code I swapped the order of two register writes that I didn't realize were order dependent. I fixed that and then since I had everything paged in kept going and tried to figure out why you can't leave interrupts on during interrupt handlers. There are a few issues. First, there must be some way to keep interrupts from "stacking up" and overflowing the stack. Keeping interrupts off the whole time solves this problem -- even if the clock tick handler runs long enough that the next clock tick is waiting when it finishes, keeping interrupts off means that the handler runs all the way through the "iret" before the next handler begins. This is not really a problem unless you are putting too many prints in trap -- if the OS is doing its job right, the handlers should run quickly and not stack up. Second, if xv6 had page faults, then it would be important to keep interrupts disabled between the start of the interrupt and the time that cr2 was read, to avoid a scenario like: p1 page faults [cr2 set to faulting address] p1 starts executing trapasm.S clock interrupt, p1 preempted, p2 starts executing p2 page faults [cr2 set to another faulting address] p2 starts, finishes fault handler p1 rescheduled, reads cr2, sees wrong fault address Alternately p1 could be rescheduled on the other cpu, in which case it would still see the wrong cr2. That said, I think cr2 is the only interrupt state that isn't pushed onto the interrupt stack atomically at fault time, and xv6 doesn't care. (This isn't entirely hypothetical -- I debugged this problem on Plan 9.) Third, and this is the big one, it is not safe to call cpu() unless interrupts are disabled. If interrupts are enabled then there is no guarantee that, between the time cpu() looks up the cpu id and the time that it the result gets used, the process has not been rescheduled to the other cpu. For example, the very commonly-used expression curproc[cpu()] (aka the macro cp) can end up referring to the wrong proc: the code stores the result of cpu() in %eax, gets rescheduled to the other cpu at just the wrong instant, and then reads curproc[%eax]. We use curproc[cpu()] to get the current process a LOT. In that particular case, if we arranged for the current curproc entry to be addressed by %fs:0 and just use a different %fs on each CPU, then we could safely get at curproc even with interrupts disabled, since the read of %fs would be atomic with the read of %fs:0. Alternately, we could have a curproc() function that disables interrupts while computing curproc[cpu()]. I've done that last one. Even in the current kernel, with interrupts off on entry to trap, interrupts are enabled inside release if there are no locks held. Also, the scheduler's idle loop must be interruptible at times so that the clock and disk interrupts (which might make processes runnable) can be handled. In addition to the rampant use of curproc[cpu()], this little snippet from acquire is wrong on smp: if(cpus[cpu()].nlock == 0) cli(); cpus[cpu()].nlock++; because if interrupts are off then we might call cpu(), get rescheduled to a different cpu, look at cpus[oldcpu].nlock, and wrongly decide not to disable interrupts on the new cpu. The fix is to always call cli(). But this is wrong too: if(holding(lock)) panic("acquire"); cli(); cpus[cpu()].nlock++; because holding looks at cpu(). The fix is: cli(); if(holding(lock)) panic("acquire"); cpus[cpu()].nlock++; I've done that, and I changed cpu() to complain the first time it gets called with interrupts disabled. (It gets called too much to complain every time.) I added new functions splhi and spllo that are like acquire and release but without the locking: void splhi(void) { cli(); cpus[cpu()].nsplhi++; } void spllo(void) { if(--cpus[cpu()].nsplhi == 0) sti(); } and I've used those to protect other sections of code that refer to cpu() when interrupts would otherwise be disabled (basically just curproc and setupsegs). I also use them in acquire/release and got rid of nlock. I'm not thrilled with the names, but I think the concept -- a counted cli/sti -- is sound. Having them also replaces the nlock++/nlock-- in trap.c and main.c, which is nice. Final note: it's still not safe to enable interrupts in the middle of trap() between lapic_eoi and returning to user space. I don't understand why, but we get a fault on pop %es because 0x10 is a bad segment descriptor (!) and then the fault faults trying to go into a new interrupt because 0x8 is a bad segment descriptor too! Triple fault. I haven't debugged this yet.
2007-09-27 12:58:42 +00:00
sti();
}
2019-05-31 13:45:59 +00:00
#endif