Kernel

这几天改 FreeBSD 的 coretemp(4) 遇到了一个问题。直接使用 rdmsr 的话，如果那个 MSR 不存在，则会触发 #GP(0)，不了解 CPU 型号的情况下直接去杵肯定是不行的。后来翻了一下 cpuctl(4) 的代码发现 FreeBSD 上也有 rdmsr_safe。它的实现并不复杂（ sys/amd64/amd64/support.S）：

总算是发公告了，可以说具体的事情了。

FreeBSD昨天发布了2项安全公告和1项Errata Notice：SA-09:13.pipe、SA-09:14.devfs和EN-09:05.null。两个安全公告修正的是同一类问题，也就是我们常说的多线程程序中的竞态条件（Race Condition）；EN-09:05.null则是增加了一个使这类问题不再那么容易被利用达到特权提升目的的功能，但默认并不启用。

现代操作系统中，抢占式调度是一个很有意思的话题。

教科书对于抢占式调度的定义比较简单—-抢占式调度中，任务切换动作可以由于优先级变化而触发，而并非仅限于时间片用完或主动放弃CPU（当然，一般而言我们并不认为中断处理是一次严格意义上的抢占操作）。

从直觉上看，抢占式调度必然增加潜在的上下文切换次数，并因为增加了这些开销而降低系统吞吐量。那么，为什么要引入抢占式调度呢？

今天Ken Smith正式宣布了FreeBSD 7.0(目前是7.0-CURRENT)代码冻结的开始。代码冻结是-CURRENT到-STABLE开发线转换的重要步骤，按目前的进度，7.0-RELEASE将会在今年9月左右正式发布。

经历了两年多的开发，FreeBSD 7.0-RELEASE将是FreeBSD开发团队采取新改进的发布流程发布的第一个发行版本。在过去几年中，FreeBSD的奇数版本(3.x, 5.x)系列由于引入了过多革命性的更改，而使得其发布一再延期；过早地划定-STABLE，曾经给FreeBSD 3.x系列带来了深远的不利影响；而延期两年将5.x系列标注为-STABLE，则令这个-CURRENT分支容纳了太多的大规模变动，导致这个系列中包含了许多不够成熟的代码。

Today, Jeff Roberson has committed his version 2.0 ULE scheduler. This new version has addressed several design issues as well as several bugs.

The new scheduler has adopted a circular queue, instead of the double-queue structure which is also found in the Linux O(1) scheduler. The latter has lead to difficulty implementing nice correctly.

For uniprocessor case, ULE is now faster.

MP algorithm has been simplified a bit.

A lot of bugfixes, etc.

To quote the original commit message:

ULE 2.0:

• Remove the double queue mechanism for timeshare threads. It was slow due to excess cache lines in play, caused suboptimal scheduling behavior with niced and other non-interactive processes, complicated priority lending, etc.
• Use a circular queue with a floating starting index for timeshare threads. Enforces fairness by moving the insertion point closer to threads with worse priorities over time.
• Give interactive timeshare threads real-time user-space priorities and place them on the realtime/ithd queue.
• Select non-interactive timeshare thread priorities based on their cpu utilization over the last 10 seconds combined with the nice value. This gives us more sane priorities and behavior in a loaded system as compared to the old method of using the interactivity score. The interactive score quickly hit a ceiling if threads were non-interactive and penalized new hog threads.
• Use one slice size for all threads. The slice is not currently dynamically set to adjust scheduling behavior of different threads.
• Add some new sysctls for scheduling parameters.

Bug fixes/Clean up:

• Fix zeroing of td_sched after initialization in sched_fork_thread() caused by recent ksegrp removal.
• Fix KSE interactivity issues related to frequent forking and exiting of kse threads. We simply disable the penalty for thread creation and exit for kse threads.
• Cleanup the cpu estimator by using tickincr here as well. Keep ticks and ltick/ftick in the same frequency. Previously ticks were stathz and others were hz.
• Lots of new and updated comments.
• Many many others.

Tested on: up x86/amd64, 8way amd64.

今天，John Birrell同学commit了一个不大不小的patchset—-将KSE变为内核选项。具体说来，在-CURRENT上，KSE不再是一个必选项了。

KSE是FreeBSD 5.0-CURRENT时的一个非常重要的技术探索，它是对由华盛顿大学THOMAS E. ANDERSON等人提出的调度器激活概念的一个实现。

对于M:N线程来说，调度器激活是一项十分先进的概念。在这个模型中，内核并不需要了解用户态线程的细节，而用户态线程也并不是由内核直接调度，相反，这些线程被绑定到一系列"调度实体"上，内核能够看到这些调度实体，并在上下文切换时激活用户态的线程调度器。由于减少了内核-用户态的上下文切换操作，因此理论上这一模型能够获得更好的性能。

说说这周发生的事情。

这周初步解决了困扰很久的ssh密码扫描蠕虫的问题。习惯上我是上来就禁止口令登录的，所以这种扫描(据蜘蛛说，这是一种叫做scanssh的虫子，不过我手头没有蜜罐资源，所以也就没有捕捉样本)没什么用，不过这种虫子讨厌的地方在于它能够花费几个小时的时间去穷举你的口令，而且是不同的帐号，这会产生几百KB的日志。

To quote Matthew Dillon:

While I hope to avoid any destabilization, I am fiddling with some pretty hairy code in the VM system so this is a head’s up! I have successfully implemented a basic MAP_VPAGETABLE feature that allows a mmap()’d section of memory to be governed by a virtual page table. Basically the backing store for the mmap()’d space is the ‘physical memory’ used to map the space, and the mapping of the space is then governed by a ‘page table’ stored in that physical memory. (It is only physical memory from the point of view of the virtual kernel, not the real kernel of course). The mapping will store a physical page directory offset to tell the VM system where the page table is.

在 FreeBSD 开发手册 中，有一部分内容介绍了关于系统调用。里面有这样一段话：

Linux is a UNIX like system. However, its kernel uses the same system-call convention of passing parameters in registers MS-DOS does. As with the UNIX convention, the function number is placed in EAX. The parameters, however, are not passed on the stack but in EBX, ECX, EDX, ESI, EDI, EBP:

open:
　　mov eax, 5
　　mov ebx, path
　　mov ecx, flags
　　mov edx, mode
　　int 80h

This convention has a great disadvantage over the UNIX way, at least as far as assembly language programming is concerned: Every time you make a kernel call you must push the registers, then pop them later. This makes your code bulkier and slower. Nevertheless, FreeBSD gives you a choice.

可能有人会问了，为什么说 UNIX way (将参数压栈) 更好呢？

今天复习了一次……

第一，你需要源代码编译出来的包含调试符号的目标代码。
第二，backtrace中的内容要尽可能完整。