From owner-cvs-src@FreeBSD.ORG  Fri Sep 17 04:38:06 2004
Return-Path: <owner-cvs-src@FreeBSD.ORG>
Delivered-To: cvs-src@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP
	id 1619216A4CE; Fri, 17 Sep 2004 04:38:06 +0000 (GMT)
Received: from gw.catspoiler.org (217-ip-163.nccn.net [209.79.217.163])
	by mx1.FreeBSD.org (Postfix) with ESMTP
	id CA80D43D5C; Fri, 17 Sep 2004 04:38:05 +0000 (GMT)
	(envelope-from truckman@FreeBSD.org)
Received: from FreeBSD.org (mousie.catspoiler.org [192.168.101.2])
	by gw.catspoiler.org (8.12.11/8.12.11) with ESMTP id i8H4btEo062532;
	Thu, 16 Sep 2004 21:37:59 -0700 (PDT)
	(envelope-from truckman@FreeBSD.org)
Message-Id: <200409170437.i8H4btEo062532@gw.catspoiler.org>
Date: Thu, 16 Sep 2004 21:37:55 -0700 (PDT)
From: Don Lewis <truckman@FreeBSD.org>
To: wollman@khavrinen.lcs.mit.edu
In-Reply-To: <200409162225.i8GMPFFs010481@khavrinen.lcs.mit.edu>
MIME-Version: 1.0
Content-Type: TEXT/plain; charset=us-ascii
cc: cvs-src@FreeBSD.org
cc: src-committers@FreeBSD.org
cc: cvs-all@FreeBSD.org
cc: nate@root.org
Subject: Re: cvs commit: src/sys/dev/md md.c
X-BeenThere: cvs-src@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: CVS commit messages for the src tree <cvs-src.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/cvs-src>,
	<mailto:cvs-src-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/cvs-src>
List-Post: <mailto:cvs-src@freebsd.org>
List-Help: <mailto:cvs-src-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/cvs-src>,
	<mailto:cvs-src-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Fri, 17 Sep 2004 04:38:06 -0000

On 16 Sep, Garrett Wollman wrote:
> <<On Thu, 16 Sep 2004 15:15:15 -0700, Nate Lawson <nate@root.org> said:
> 
>> You should be checking the work condition in thread 2 while holding the 
>> mutex but before going to sleep.  Adding work to the queue happens in 
>> thread 1 where you write "..." and that is done with the mutex held so 
>> there is no race.  The full diagram with this detail included is:
> 
> Of course, getting this right is complicated enough that we have an
> entire abstraction to assist.
> 
>> thread1               thread2
>> -----------------------------
>> mtx_lock(mtx)
>> add work to queue
>> mtx_unlock(mtx)
>>                        mtx_lock(mtx)
>> wakeup(ptr)
>>                        check queue for work item
>>                        if (!work item)
>>                            msleep(ptr, mtx)
>>                        else
>>                            dequeue work item and loop
> 
> mtx_lock(mtx)
> add work to queue
> cv_signal(worktodo)
> mtx_unlock(mtx)
> 			mtx_lock(mtx)
> 			for (;;) {
> 				check queue for work item
> 				if (!work item)
> 					cv_wait(cv, mtx)
> 				else {
> 					dequeue work item
> 					do work
> 				}
> 			}
> 			mtx_unlock(mtx)

It looks to me like there is a race condition in the cv_wait()
implementation.

        			cvp->cv_waiters++;
        			DROP_GIANT();
        			mtx_unlock(mp);
mtx_lock()
...
if (cvp->cv_waiters > 0) {
	cvp->cv_waiters--;
	sleepq_signal();
}
        			sleepq_add(...);
        			sleepq_wait(cvp);


Also, doesn't this potentially have the same problem with extra context
switches that Nate mentioned earlier?