Stage MC-0b: real kernel spinlocks; sf_mutex no longer a no-op (FABRIC-3.10.8 §3.2)
- New spinlock primitive (spinlock.h/.c): CAS on an owner word (core+1), interrupts masked while any lock is held (state kept in the per-core block, so release order doesn't matter). Recursion, release-not-held, held-at-switch and destroyed-while-held are counted and logged, never silent. Locks are no-ops until the boot core's block is installed (riscv64's monolithic early boot prints before sk_percpu_boot_init()). - Kernel locks in a documented order: hermes, switch, registry, doe, log, console, heap, vmm, pmm. sf_mutex (dict_lock/tuning_lock) uses the same lock word. - Hermes: public functions over *_locked internals; never held across the drain's vm_interpret_kind(); switch notifications after dropping the lock; event payload moved off static storage. Switch table and registry never call out while held (slot/entry copied under the lock). - No lock crosses a switch: checked at context switch (leave, resume) and the idle point. - Probe (removed): every lock balances on all three ISAs; 0 held at switch over 7.5M-51M checks; 0 recursions, 0 bad releases. - Standard sequence on amd64/aarch64/riscv64: hashes and G byte-identical to MC-0a, MINT/WIREBIND/USE ok, conservation true, 0 idle growth. - Block subsystem split out as MC-0b2 (Captain Bob's ruling). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
Robert Allan James
co-authored by
Claude Opus 5.5
Claude Opus 5.5
parent
8409e376cf
commit
5bc7b4dee7
@@ -62,6 +62,7 @@ Everything that would break if two cores ran kernel or VM code at the same momen
|
||||
|---|---|---|
|
||||
| **MC-0a** | **The per-core block, on one core.** A per-core structure reached through each ISA's per-CPU register (GS base / `TPIDR_EL1` / `tp`), set up for core 0 at boot. `g_switch_current_vm` moves into it. | Standard sequence unchanged. A probe reads the per-core pointer from a normal kernel path and from an interrupt handler, and gets core 0's block both times on all three ISAs. |
|
||||
| **MC-0b** | **Real spinlocks.** A kernel spinlock primitive (atomic exchange, interrupts masked while held on the owning core). `sf_mutex_*` stop being no-ops. The §1 kernel locks are added. | Standard sequence unchanged. A probe counts every lock's acquisitions and releases through a boot and the standard sequence: counts balance, and no lock is held across a context switch or on return to the idle point. |
|
||||
| **MC-0b2** | **The block subsystem's lock** (split from MC-0b, Captain Bob 2026-09-25). The vendored `block_subsystem.c` calls its own public functions in cycles (`blk_set_meta` → migration check → relocate → `blk_set_meta`), so it is refactored into locking public functions over unlocked internals, under `__STARKERNEL__`. | Standard sequence unchanged. The MC-0b probe, extended to the block lock: counts balance, 0 recursions. |
|
||||
| **MC-0c** | **Shared VM code made per-VM or atomic** (§1, second table). The dictionary lookup index moves into `VM`. | The `dict_hash` set unchanged (the index is not hashed). A probe: two VMs searched alternately never rebuild each other's index. Standard sequence. |
|
||||
| **MC-0d** | **Stadium's dispatch path partitioned** (§1). | Standard sequence; conservation holds (`stadium_conserved()` on every VM, the ledger audit). A probe proves the dispatch path takes no shared lock. |
|
||||
| **MC-1** | **Bring up the extra cores and park them halted**, per ISA: amd64 (MADT, INIT-SIPI-SIPI, a position-independent trampoline below 1 MiB), aarch64 (DTB `/cpus`, PSCI `CPU_ON`), riscv64 (DTB harts, SBI HSM `hart_start`). QEMU gets `-smp 2`. | The boot reports each core online with its own per-core block; the extra cores sit halted (0 idle growth, no spin); the standard sequence unchanged. |
|
||||
@@ -115,3 +116,88 @@ Everything that would break if two cores ran kernel or VM code at the same momen
|
||||
- The `dict_hash` values (Hera `0x00340a8b2c842eb7`, Hestia `0x78bf28439e4a643f`, Artemis `0x66886d174d5f3b5a`) are identical across ISAs and unchanged from O-C.
|
||||
- The ledger line matches across ISAs: held=2048, pulled=258048, returned=255263, consumed=737, conserved=true.
|
||||
- No stop condition was hit. **MC-0a done.**
|
||||
|
||||
### 3.2 MC-0b — real spinlocks (2026-09-25)
|
||||
|
||||
**The primitive** (`include/starkernel/spinlock.h`, `src/starkernel/hal/spinlock.c`, new).
|
||||
- One lock word per lock: 0 = free, `core_id + 1` = held.
|
||||
- Taken by compare-and-swap. The atomics are inline on every ISA (`nm -u` is empty on all three ELFs).
|
||||
- Interrupts stay masked on the owning core while it holds any lock.
|
||||
- The mask state lives in the per-core block, not in the lock (`lock_depth`, `saved_irq` in `sk_percpu_t`):
|
||||
- the first lock taken saves the interrupt state and masks;
|
||||
- the last lock released restores it;
|
||||
- so release order doesn't matter.
|
||||
- **The rule: no lock crosses a switch or reaches the idle point.** Each of these sites checks it and counts any violation:
|
||||
- `sk_vm_context_switch()`, when leaving and on resume;
|
||||
- `sk_vm_idle_point()`.
|
||||
- Failures are counted and logged at the idle point (`LOCK:` lines, LOG_ERROR):
|
||||
- **recursion** (a core takes a lock it already holds): let through, so the core doesn't hang, and counted. It is never legitimate, because on one core "the owner is me" can't tell a nested call from a second VM on the same core;
|
||||
- release of a lock not held;
|
||||
- a lock held at a switch or idle point;
|
||||
- a VM mutex destroyed while held.
|
||||
- The locks are no-ops until the boot core's block is installed (`sk_percpu_ready`). This was found during the probe runs:
|
||||
- riscv64 is built monolithic, and its `arch_early_init()` prints through the console before `sk_percpu_boot_init()`;
|
||||
- the first lock therefore read `tp` while it still held the firmware's value, and the load hit OpenSBI memory (`stval` = `tp`+8, a firmware load access fault);
|
||||
- early boot is one core with interrupts off, so skipping the locks there is correct.
|
||||
|
||||
That crashed run's log was deleted as flawed.
|
||||
- `sf_mutex_*` (the vendored VM's `dict_lock` and `tuning_lock`, `shim.c`) now use the same lock word. They are no longer no-ops.
|
||||
|
||||
**The kernel locks, in acquisition order** (spinlock.h; MC-3's deadlock freedom rests on this order):
|
||||
1. `hermes`
|
||||
2. `switch`
|
||||
3. `registry`
|
||||
4. `doe`
|
||||
5. `log`
|
||||
6. `console`
|
||||
7. `heap`
|
||||
8. `vmm`
|
||||
9. `pmm`
|
||||
|
||||
Stadium's lock comes with MC-0d, below Hermes. Stadium today runs inside `dict_lock` (`vm_core.c`'s heat bump calls `stadium_word_dispatch()`); MC-0d's order must account for that.
|
||||
|
||||
| Lock | Covers | Shape |
|
||||
|---|---|---|
|
||||
| heap | `kmalloc`/`kfree`, stats, censuses | `kmalloc()` delegates to `kmalloc_aligned()`, and only the latter locks |
|
||||
| vmm | page-table walks | `*_locked` bodies. The map-conflict print moved outside the lock (the console lock sits above it). Takes `pmm` for table pages |
|
||||
| pmm | bitmap | `pmm_alloc_page()`/`pmm_free_page()` delegate to the contiguous forms |
|
||||
| console | output path and line state (name, line start, pending line close, the framebuffer terminal) | A string goes out under one hold. Unlocked on purpose: `console_get_vm_name()` (the prefix provider calls it under the lock), the boot-time `console_fb_init()`/`console_fb_enable_ttf()` (they log), and input |
|
||||
| log, doe | control-block read-modify-write plus the slot write | `*_locked` bodies |
|
||||
| registry | node list, entry copies, single-field writes | Never held while calling out. KILL and reap take it only for their reads and final writes. A birth fills its embryo unlocked (private until LIVE). `kill_all_nonmama` (cold-reset path) walks unlocked |
|
||||
| switch | slot table, stamps, decision-due flag, counters | Never held while calling out. The decision, the Stage H floor and the reap sweep copy one slot under the lock (`slot_copy()`) and judge it outside |
|
||||
| hermes | arena, ledger, channels, queues, event counters | Public functions lock over `*_locked` statics. Never held across `vm_interpret_kind()` (the drain) or a policy word. The switch notifications after a send go out once the lock is dropped (the floor reads Hermes queues back). Publish and event walk members one copied member at a time. `sk_hermes_event()`'s static payload moved onto the stack |
|
||||
|
||||
The block subsystem is **split out as MC-0b2** (Captain Bob, 2026-09-25), because its internal call cycles need a locked/unlocked refactor of vendored code. See §2.
|
||||
|
||||
**Probe** (temporary, removed before commit). A `MC0B-PROBE` word in Hera's and every child's vocabulary printed every counter, snapshotted before printing:
|
||||
- each lock's acquisitions and releases, and its owner;
|
||||
- the VM mutexes (the core total minus the kernel locks);
|
||||
- the core-0 total and its depth;
|
||||
- the number of switch/idle checks and violations;
|
||||
- recursions, bad releases and destroyed-while-held.
|
||||
|
||||
It ran at Hera's prompt (after O-A's G, PREC and LOAD), and again on rajames after MINT, WIREBIND, `USE` and `1 2 + .`. The table shows the final (rajames) reading:
|
||||
|
||||
| ISA | log | total acquired = released | depth | switch/idle checks | held at switch | recursions / bad releases / destroyed held |
|
||||
|---|---|---|---|---|---|---|
|
||||
| amd64 | `logs/20260925-150735` | 1,503,458,645 | 0 | 51,137,748 | 0 | 0 / 0 / 0 |
|
||||
| aarch64 | `logs/20260925-152109` | 235,854,532 | 0 | 7,565,646 | 0 | 0 / 0 / 0 |
|
||||
| riscv64 | `logs/20260925-155048` | 566,894,806 | 0 | 19,029,507 | 0 | 0 / 0 / 0 |
|
||||
|
||||
- Every lock balances individually on every ISA, at both readings.
|
||||
- The amd64 and aarch64 probe runs predate the `sk_percpu_ready` guard. That guard only changes behaviour before `sk_percpu_boot_init()`, and the acceptance runs below are on the final code.
|
||||
- The riscv64 `vblk_io timed out` count, which the advisor flagged (defect 3 sits in the region now masked), is 2 in the probe run, the same as MC-0a's acceptance run. It is 0 in this stage's acceptance run.
|
||||
|
||||
**Finding, for MC-3.** Hera's input-poll idle loop runs the switch decision without pause, and every pass takes the registry, switch and Hermes locks once per slot. That is the hundreds of millions of acquisitions above (amd64: registry 379 M, switch 858 M, Hermes 266 M). It is harmless on one core. With several cores, core 0 spinning through these same locks would contend with every worker's claim. MC-3 should settle how that loop waits before cores share these locks.
|
||||
|
||||
**Standard sequence** (clean build, with the probe reverted; checked against the saved stage diff, which differs only by the guard added after it).
|
||||
|
||||
| ISA | log | O-A (G, PREC, LOAD) | M7.1a hash | MINT / WIREBIND / USE / `1 2 + .` | idle growth | UNKNOWN / faults |
|
||||
|---|---|---|---|---|---|---|
|
||||
| amd64 | `logs/20260925-160434` | A=40 B=40, HHH, ok | `0x99b01134c3d3049c` | all ok, `3` | 0 B / 20 s | 0 / 0 |
|
||||
| aarch64 | `logs/20260925-161720` | A=40 B=40, HHH, ok | `0x99b01134c3d3049c` | all ok, `3` | 0 B / 20 s | 0 / 0 |
|
||||
| riscv64 | `logs/20260925-163024` | A=40 B=40, HHH, ok | `0x99b01134c3d3049c` | all ok, `3` | 0 B / 20 s | 0 / 0 |
|
||||
|
||||
- The G string is byte-identical to MC-0a on all three ISAs, so masking interrupts under the locks didn't move the interleave.
|
||||
- The `dict_hash` set and the ledger line are unchanged from MC-0a.
|
||||
- No stop condition was hit. **MC-0b done** (the block subsystem follows as MC-0b2).
|
||||
|
||||
Reference in New Issue
Block a user