Commit graph

64 commits

Author SHA1 Message Date
rsc af7366c945 interrupts during system calls
"It just works."
2007-09-27 21:37:45 +00:00
rsc ab08960f64 Final word on the locking fiasco?
Change pushcli / popcli so that they can never turn on
interrupts unexpectedly.  That is, if interrupts are on,
then pushcli(); popcli(); turns them off and back on, but
if they are off to begin with, then pushcli(); popcli(); is
a no-op.

I think our fundamental mistake was having a primitive
(release and then popcli nee spllo) that could turn
interrupts on at unexpected moments instead of being
explicit about when we want to start allowing interrupts.

With the new semantics, all the manual fiddling of ncli
to force interrupts off in certain sections goes away.
In return, we must explicitly mark the places where
we want to enable interrupts unconditionally, by calling sti().
There is only one: inside the scheduler loop.
2007-09-27 21:25:37 +00:00
rsc 3807c1f20b rename splhi/spllo to pushcli/popcli 2007-09-27 20:09:40 +00:00
rsc 8c8b748a2f now spllo is okay 2007-09-27 19:35:25 +00:00
rsc c8919e6537 kernel SMP interruptibility fixes.
Last year, right before I sent xv6 to the printer, I changed the
SETGATE calls so that interrupts would be disabled on entry to
interrupt handlers, and I added the nlock++ / nlock-- in trap()
so that interrupts would stay disabled while the hw handlers
(but not the syscall handler) did their work.  I did this because
the kernel was otherwise causing Bochs to triple-fault in SMP
mode, and time was short.

Robert observed yesterday that something was keeping the SMP
preemption user test from working.  It turned out that when I
simplified the lapic code I swapped the order of two register
writes that I didn't realize were order dependent.  I fixed that
and then since I had everything paged in kept going and tried
to figure out why you can't leave interrupts on during interrupt
handlers.  There are a few issues.

First, there must be some way to keep interrupts from "stacking
up" and overflowing the stack.  Keeping interrupts off the whole
time solves this problem -- even if the clock tick handler runs
long enough that the next clock tick is waiting when it finishes,
keeping interrupts off means that the handler runs all the way
through the "iret" before the next handler begins.  This is not
really a problem unless you are putting too many prints in trap
-- if the OS is doing its job right, the handlers should run
quickly and not stack up.

Second, if xv6 had page faults, then it would be important to
keep interrupts disabled between the start of the interrupt and
the time that cr2 was read, to avoid a scenario like:

   p1 page faults [cr2 set to faulting address]
   p1 starts executing trapasm.S
   clock interrupt, p1 preempted, p2 starts executing
   p2 page faults [cr2 set to another faulting address]
   p2 starts, finishes fault handler
   p1 rescheduled, reads cr2, sees wrong fault address

Alternately p1 could be rescheduled on the other cpu, in which
case it would still see the wrong cr2.  That said, I think cr2
is the only interrupt state that isn't pushed onto the interrupt
stack atomically at fault time, and xv6 doesn't care.  (This isn't
entirely hypothetical -- I debugged this problem on Plan 9.)

Third, and this is the big one, it is not safe to call cpu()
unless interrupts are disabled.  If interrupts are enabled then
there is no guarantee that, between the time cpu() looks up the
cpu id and the time that it the result gets used, the process
has not been rescheduled to the other cpu.  For example, the
very commonly-used expression curproc[cpu()] (aka the macro cp)
can end up referring to the wrong proc: the code stores the
result of cpu() in %eax, gets rescheduled to the other cpu at
just the wrong instant, and then reads curproc[%eax].

We use curproc[cpu()] to get the current process a LOT.  In that
particular case, if we arranged for the current curproc entry
to be addressed by %fs:0 and just use a different %fs on each
CPU, then we could safely get at curproc even with interrupts
disabled, since the read of %fs would be atomic with the read
of %fs:0.  Alternately, we could have a curproc() function that
disables interrupts while computing curproc[cpu()].  I've done
that last one.

Even in the current kernel, with interrupts off on entry to trap,
interrupts are enabled inside release if there are no locks held.
Also, the scheduler's idle loop must be interruptible at times
so that the clock and disk interrupts (which might make processes
runnable) can be handled.

In addition to the rampant use of curproc[cpu()], this little
snippet from acquire is wrong on smp:

  if(cpus[cpu()].nlock == 0)
    cli();
  cpus[cpu()].nlock++;

because if interrupts are off then we might call cpu(), get
rescheduled to a different cpu, look at cpus[oldcpu].nlock, and
wrongly decide not to disable interrupts on the new cpu.  The
fix is to always call cli().  But this is wrong too:

  if(holding(lock))
    panic("acquire");
  cli();
  cpus[cpu()].nlock++;

because holding looks at cpu().  The fix is:

  cli();
  if(holding(lock))
    panic("acquire");
  cpus[cpu()].nlock++;

I've done that, and I changed cpu() to complain the first time
it gets called with interrupts disabled.  (It gets called too
much to complain every time.)

I added new functions splhi and spllo that are like acquire and
release but without the locking:

  void
  splhi(void)
  {
    cli();
    cpus[cpu()].nsplhi++;
  }

  void
  spllo(void)
  {
    if(--cpus[cpu()].nsplhi == 0)
      sti();
  }

and I've used those to protect other sections of code that refer
to cpu() when interrupts would otherwise be disabled (basically
just curproc and setupsegs).  I also use them in acquire/release
and got rid of nlock.

I'm not thrilled with the names, but I think the concept -- a
counted cli/sti -- is sound.  Having them also replaces the
nlock++/nlock-- in trap.c and main.c, which is nice.


Final note: it's still not safe to enable interrupts in
the middle of trap() between lapic_eoi and returning
to user space.  I don't understand why, but we get a
fault on pop %es because 0x10 is a bad segment
descriptor (!) and then the fault faults trying to go into
a new interrupt because 0x8 is a bad segment descriptor too!
Triple fault.  I haven't debugged this yet.
2007-09-27 12:58:42 +00:00
rsc fbaa7b428e various comment and print tweaks 2007-09-26 23:32:00 +00:00
rtm 355073ea9e oops, interrupts on in syscall traps doesn't work after all 2007-09-25 16:15:05 +00:00
rtm 3eda2714e6 tell SETGATE to leave interrupts on for T_SYSCALL
panic if unknown fault with CPL=0 (i.e. in kernel)
2007-09-25 15:23:44 +00:00
rsc 5573c8f296 delete proc_ on proc_exit, proc_wait, proc_kill 2007-08-28 19:14:43 +00:00
rsc e4d6a21165 more consistent spacing 2007-08-28 18:32:08 +00:00
rsc c1b100e930 nits 2007-08-28 18:23:48 +00:00
rsc 4c917f6df2 do not call proc_exit until lock dropped 2007-08-28 04:20:13 +00:00
rsc 558ab49f13 delete unnecessary #include lines 2007-08-27 23:26:33 +00:00
rsc efc12b8e61 Replace yield system call with sleep. 2007-08-27 13:34:35 +00:00
rsc eaea18cb9c PDF at http://am.lcs.mit.edu/~rsc/xv6.pdf
Various changes made while offline.

 + bwrite sector argument is redundant; use b->sector.
 + reformatting of files for nicer PDF page breaks
 + distinguish between locked, unlocked inodes in type signatures
 + change FD_FILE to FD_INODE
 + move userinit (nee proc0init) to proc.c
 + move ROOTDEV to param.h
 + always parenthesize sizeof argument
2007-08-22 06:01:32 +00:00
rsc f1f8dd91bc formatting 2007-08-14 18:42:34 +00:00
rsc 8139713c46 add note 2007-08-10 17:19:15 +00:00
rsc dca5b5ca2e avoid assignments in declarations 2007-08-10 17:17:42 +00:00
rsc b6095304b7 Make cp a magic symbol. 2007-08-10 16:37:27 +00:00
rsc b6dc6187f7 add DPL_USER constant 2007-08-08 09:02:42 +00:00
rsc 7366e042d9 save process name for debugging 2007-08-08 08:38:11 +00:00
rsc e936743429 tweak 2006-09-08 15:34:04 +00:00
rsc cd12eea3c7 make trap fit on one page 2006-09-08 14:29:58 +00:00
rsc 0b75a8e8be no recursive interrupts 2006-09-07 16:53:16 +00:00
rsc 31085bb416 more comments 2006-09-07 14:12:30 +00:00
rsc 0cfc7290e8 wrap long lines 2006-09-06 19:08:14 +00:00
rsc f552738889 no /* */ comments 2006-09-06 17:50:20 +00:00
rsc 9e9bcaf143 standardize various * conventions 2006-09-06 17:27:19 +00:00
rsc a650c606fe spacing fixes: no tabs, 2-space indents (for rtm) 2006-09-06 17:04:06 +00:00
kaashoek a81e02133a a few nits 2006-09-04 12:41:27 +00:00
kaashoek 97c74a3a64 nits 2006-09-03 18:32:58 +00:00
rtm 3b95801add i broke sbrk, fix it 2006-08-29 17:01:40 +00:00
rtm 2b19190c13 clean up stale error checks and panics
delete unused functions
a few comments
2006-08-29 14:45:45 +00:00
kaashoek 74493bf446 kill user process when it generates an unhandled trap (e.g., 13)
fix bug in test code of malloc
2006-08-25 00:43:17 +00:00
kaashoek 8787cd01df chdir
cd in shell
nits in mkdir, ls, etc.
2006-08-19 23:41:34 +00:00
rtm ceb0e42796 proc[0] can sleep(), at least after it gets to main00()
proc[0] calls iget(rootdev, 1) before forking init
2006-08-16 01:56:00 +00:00
rtm 350e63f7a9 no more proc[] entry per cpu for idle loop
each cpu[] has its own gdt and tss
no per-proc gdt or tss, re-write cpu's in scheduler (you win, cliff)
main0() switches to cpu[0].mpstack
2006-08-15 22:18:20 +00:00
rtm 5be0039ce9 interrupts could be recursive since lapic_eoi() called before rti
so fast interrupts overflow the kernel stack
fix: cli() before lapic_eoi()
2006-08-10 22:08:14 +00:00
rtm 8a8be1b8c3 low-level keyboard input (not hooked up to /dev yet)
fix acquire() to cli() *before* incrementing nlock
make T_SYSCALL a trap gate, not an interrupt gate
sadly, various crashes if you hold down a keyboard key...
2006-08-10 02:07:10 +00:00
rtm 0e84a0ec6e fix race in holding() check in acquire()
give cpu1 a TSS and gdt for when it enters scheduler()
and a pseudo proc[] entry for each cpu
cpu0 waits for each other cpu to start up
read() for files
2006-08-08 19:58:06 +00:00
rsc b5f17007f4 standarize on unix-like lowercase struct names 2006-07-17 01:58:13 +00:00
rsc b5ee516575 add uint and standardize on typedefs instead of unsigned 2006-07-17 01:52:13 +00:00
rsc ee9c7f3bfc goodbye PushRegs 2006-07-17 01:36:39 +00:00
rsc c54c79267f nitpicks 2006-07-17 01:25:22 +00:00
rsc 564f787e91 Eliminate annoying Pseudodesc structure.
Eliminate unnecessary parts of mmu.h.
2006-07-16 16:55:52 +00:00
rsc ef2bd07ae4 standardize on not using foo_ prefix in struct foo 2006-07-16 15:41:47 +00:00
rsc 72fef4f855 Don't kill process when inside kernel. 2006-07-16 02:09:45 +00:00
rsc 6f2b626d28 remove non-idiomatic increment/decrement 2006-07-16 01:52:22 +00:00
rsc 65bd8e139a New scheduler.
Removed cli and sti stack in favor of tracking
number of locks held on each CPU and explicit
conditionals in spinlock.c.
2006-07-16 01:15:28 +00:00
rtm 46bbd72f3e no more recursive locks
wakeup1() assumes you hold proc_table_lock
sleep(chan, lock) provides atomic sleep-and-release to wait for condition
ugly code in swtch/scheduler to implement new sleep
fix lots of bugs in pipes, wait, and exit
fix bugs if timer interrupt goes off in schedule()
console locks per line, not per byte
2006-07-15 12:03:57 +00:00