<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN">
<HTML
><HEAD
><TITLE
>Racing Timers: A Kernel Pastime</TITLE
><META
NAME="GENERATOR"
CONTENT="Modular DocBook HTML Stylesheet Version 1.7"><LINK
REL="HOME"
TITLE="Unreliable Guide To Locking"
HREF="book1.html"><LINK
REL="UP"
TITLE="Common Techniques"
HREF="c196.html"><LINK
REL="PREVIOUS"
TITLE="The Fucked Up Sparc"
HREF="x348.html"><LINK
REL="NEXT"
TITLE="Further reading"
HREF="c374.html"></HEAD
><BODY
CLASS="SECT1"
BGCOLOR="#FFFFFF"
TEXT="#000000"
LINK="#0000FF"
VLINK="#840084"
ALINK="#0000FF"
><DIV
CLASS="NAVHEADER"
><TABLE
SUMMARY="Header navigation table"
WIDTH="100%"
BORDER="0"
CELLPADDING="0"
CELLSPACING="0"
><TR
><TH
COLSPAN="3"
ALIGN="center"
>Unreliable Guide To Locking</TH
></TR
><TR
><TD
WIDTH="10%"
ALIGN="left"
VALIGN="bottom"
><A
HREF="x348.html"
ACCESSKEY="P"
><<< Previous</A
></TD
><TD
WIDTH="80%"
ALIGN="center"
VALIGN="bottom"
>Common Techniques</TD
><TD
WIDTH="10%"
ALIGN="right"
VALIGN="bottom"
><A
HREF="c374.html"
ACCESSKEY="N"
>Next >>></A
></TD
></TR
></TABLE
><HR
ALIGN="LEFT"
WIDTH="100%"></DIV
><DIV
CLASS="SECT1"
><H1
CLASS="SECT1"
><A
NAME="RACING-TIMERS"
></A
>Racing Timers: A Kernel Pastime</H1
><P
> Timers can produce their own special problems with races.
Consider a collection of objects (list, hash, etc) where each
object has a timer which is due to destroy it.
</P
><P
> If you want to destroy the entire collection (say on module
removal), you might do the following:
</P
><TABLE
BORDER="0"
BGCOLOR="#E0E0E0"
WIDTH="100%"
><TR
><TD
><PRE
CLASS="PROGRAMLISTING"
> /* THIS CODE BAD BAD BAD BAD: IF IT WAS ANY WORSE IT WOULD USE
HUNGARIAN NOTATION */
spin_lock_bh(&list_lock);
while (list) {
struct foo *next = list->next;
del_timer(&list->timer);
kfree(list);
list = next;
}
spin_unlock_bh(&list_lock);
</PRE
></TD
></TR
></TABLE
><P
> Sooner or later, this will crash on SMP, because a timer can
have just gone off before the <TT
CLASS="FUNCTION"
>spin_lock_bh()</TT
>,
and it will only get the lock after we
<TT
CLASS="FUNCTION"
>spin_unlock_bh()</TT
>, and then try to free
the element (which has already been freed!).
</P
><P
> This can be avoided by checking the result of
<TT
CLASS="FUNCTION"
>del_timer()</TT
>: if it returns
<SPAN
CLASS="RETURNVALUE"
>1</SPAN
>, the timer has been deleted.
If <SPAN
CLASS="RETURNVALUE"
>0</SPAN
>, it means (in this
case) that it is currently running, so we can do:
</P
><TABLE
BORDER="0"
BGCOLOR="#E0E0E0"
WIDTH="100%"
><TR
><TD
><PRE
CLASS="PROGRAMLISTING"
> retry:
spin_lock_bh(&list_lock);
while (list) {
struct foo *next = list->next;
if (!del_timer(&list->timer)) {
/* Give timer a chance to delete this */
spin_unlock_bh(&list_lock);
goto retry;
}
kfree(list);
list = next;
}
spin_unlock_bh(&list_lock);
</PRE
></TD
></TR
></TABLE
><P
> Another common problem is deleting timers which restart
themselves (by calling <TT
CLASS="FUNCTION"
>add_timer()</TT
> at the end
of their timer function). Because this is a fairly common case
which is prone to races, you can put a call to
<TT
CLASS="FUNCTION"
>timer_exit()</TT
> at the very end of your timer function,
and user <TT
CLASS="FUNCTION"
>del_timer_sync()</TT
>
(<TT
CLASS="FILENAME"
>include/linux/timer.h</TT
>)
to handle this case. It returns the number of times the timer
had to be deleted before we finally stopped it from adding itself back
in.
</P
></DIV
><DIV
CLASS="NAVFOOTER"
><HR
ALIGN="LEFT"
WIDTH="100%"><TABLE
SUMMARY="Footer navigation table"
WIDTH="100%"
BORDER="0"
CELLPADDING="0"
CELLSPACING="0"
><TR
><TD
WIDTH="33%"
ALIGN="left"
VALIGN="top"
><A
HREF="x348.html"
ACCESSKEY="P"
><<< Previous</A
></TD
><TD
WIDTH="34%"
ALIGN="center"
VALIGN="top"
><A
HREF="book1.html"
ACCESSKEY="H"
>Home</A
></TD
><TD
WIDTH="33%"
ALIGN="right"
VALIGN="top"
><A
HREF="c374.html"
ACCESSKEY="N"
>Next >>></A
></TD
></TR
><TR
><TD
WIDTH="33%"
ALIGN="left"
VALIGN="top"
>The Fucked Up Sparc</TD
><TD
WIDTH="34%"
ALIGN="center"
VALIGN="top"
><A
HREF="c196.html"
ACCESSKEY="U"
>Up</A
></TD
><TD
WIDTH="33%"
ALIGN="right"
VALIGN="top"
>Further reading</TD
></TR
></TABLE
></DIV
></BODY
></HTML
>
