81 lines
3.9 KiB
Zig
81 lines
3.9 KiB
Zig
//! The big kernel lock (BKL) — the coarse mutual exclusion that lets more than one
|
|
//! CPU run kernel code safely.
|
|
//!
|
|
//! Until SMP, the kernel's mutual exclusion *was* the interrupt flag: a critical
|
|
//! section did `cli`, and since only one core existed, nothing else could touch
|
|
//! kernel state (the discipline in docs/scheduling.md). That invariant dies the
|
|
//! instant a second core runs kernel code — `cli` on one core does nothing to
|
|
//! another. So the kernel's shared state (the scheduler queues, IPC channels) is
|
|
//! guarded by a spinlock, and the lock is **always held with local interrupts
|
|
//! disabled**, so a core's own timer interrupt can't re-enter the kernel and
|
|
//! deadlock against the lock it already holds.
|
|
//!
|
|
//! This is deliberately *one coarse lock*, not many fine ones: it's philosophically
|
|
//! aligned with a tiny kernel and it keeps the single-core correctness model
|
|
//! (docs/scheduling.md) largely intact — one lock around kernel entry instead of
|
|
//! rethinking every critical section. It's the first-design choice seL4 makes and
|
|
//! docs/smp.md endorses; per-core run queues + fine-grained locking come later, if
|
|
//! contention ever bites. Because the kernel does little, the lock is held briefly.
|
|
//!
|
|
//! **The hand-off rule.** The lock is held *across* a context switch and released
|
|
//! by whichever task resumes, not by the one that switched away. A task that blocks
|
|
//! or yields calls `enter`, mutates the queues, `schedule()`s — switching to another
|
|
//! task *with the lock still held* — and only calls `leave` once it is eventually
|
|
//! resumed and its critical section runs to the end. So every call into `schedule()`
|
|
//! (and thus `switch_context`) happens with the lock held, and every task resumes
|
|
//! from a switch holding it. A freshly-spawned task has no `enter`/`leave` frame to
|
|
//! resume into, so `task_trampoline` releases the lock explicitly on its behalf via
|
|
//! `releaseForFreshTask` before running the task body.
|
|
|
|
const std = @import("std");
|
|
const architecture = @import("architecture");
|
|
|
|
/// 0 = free, 1 = held. A single global lock for the whole kernel.
|
|
var held = std.atomic.Value(u32).init(0);
|
|
|
|
/// Enter the kernel: disable interrupts on this core, then spin until we own the
|
|
/// lock. Returns the caller's prior interrupt flags for `leave` to restore.
|
|
/// Interrupts stay off for the whole critical section so this core's timer tick
|
|
/// can't try to re-acquire the lock we're holding.
|
|
pub fn enter() u64 {
|
|
const flags = architecture.saveInterrupts();
|
|
acquire();
|
|
return flags;
|
|
}
|
|
|
|
/// Release the lock and restore the interrupt flags `enter` returned (re-enabling
|
|
/// interrupts only if they were on beforehand). The normal exit for a critical
|
|
/// section reached from task context (`yield`, `sleep`, `wait`, `wake`, IPC).
|
|
pub fn leave(flags: u64) void {
|
|
release();
|
|
architecture.restoreInterrupts(flags);
|
|
}
|
|
|
|
/// Release the lock but leave interrupts as they are. The exit for a critical
|
|
/// section running inside an interrupt handler (the timer `tick`): the handler's
|
|
/// `iretq` is what restores the interrupted context's flags, so restoring them
|
|
/// here too would open a nested-interrupt window before the return. Release only.
|
|
pub fn leaveIsr() void {
|
|
release();
|
|
}
|
|
|
|
/// Release the lock on behalf of a freshly-spawned task. Such a task is switched to
|
|
/// (with the lock held) but has no `enter`/`leave` frame of its own to release
|
|
/// through — `task_trampoline` calls this before running the task body. Interrupts
|
|
/// are enabled separately by the trampoline. Exported for the assembly trampoline.
|
|
export fn releaseForFreshTask() callconv(.c) void {
|
|
release();
|
|
}
|
|
|
|
fn acquire() void {
|
|
// Test-and-test-and-set: try once, then spin read-only until the lock looks
|
|
// free before retrying the (bus-locked) swap — cheaper on the coherency fabric.
|
|
while (held.swap(1, .acquire) != 0) {
|
|
while (held.load(.monotonic) != 0) architecture.cpuRelax();
|
|
}
|
|
}
|
|
|
|
fn release() void {
|
|
held.store(0, .release);
|
|
}
|