kernel/proc.c

Headers

The usual kernel headers. kernel/spinlock.h must come before kernel/proc.h, because struct proc contains a struct spinlock.

The global tables

• cpus: one struct cpu per hart, indexed by hart ID.
• proc: the process table, a fixed array of NPROC (64) slots. xv6 never allocates a struct proc dynamically; a “new process” is a free slot being reused, so there can never be more than 64 processes.
• initproc: the first process, which runs /init. Orphaned children are handed to it (reparent).
• nextpid and pid_lock: the counter that hands out PIDs, and the lock that protects it (allocpid).

All of these except nextpid are in .bss and start zeroed, so every slot starts with state == UNUSED (0). nextpid is initialized to 1 and lives in .data.

Declarations of things defined elsewhere

forkret and freeproc are used before their definitions further down. trampoline is the label at the start of kernel/trampoline.S. Declaring it as a char array lets C code use its address (trampoline alone is the address of the first byte) without pretending there is a C object there.

wait_lock, and the first lock-ordering rule

wait_lock protects every process’s parent field, and is the condition lock for kwait's sleep. The comment’s two remarks mean:

• “wakeups of wait()ing parents are not lost”: kexit wakes its parent and becomes a ZOMBIE inside one wait_lock critical section, and kwait checks for zombies and registers to sleep inside another. So the parent can never check (finding no zombie) and then miss the child’s wakeup. See kwait below.
• “must be acquired before any p->lock”: this is the global lock order. kexit and kwait hold wait_lock and then take p->locks. If any code held a p->lock and then waited for wait_lock, two CPUs could deadlock. This is why kfork releases the child’s lock before taking wait_lock (line 294).

proc_mapstacks(): a kernel stack for every slot

Called once at boot by kvmmake (kernel/vm.c:50), while the kernel page table is being built. For each of the 64 slots it allocates one 4096-byte page with kalloc and maps it at KSTACK(i), high in the kernel’s address space, readable and writable but not executable and not accessible from user mode.

KSTACK spaces the stacks two pages apart (TRAMPOLINE - (i+1)*2*PGSIZE), and only one page of each pair is mapped. The unmapped page below each stack is a guard page: a kernel stack overflow hits it and causes a page fault and a kernel panic, instead of silent corruption (though kernelvec’s attempts to handle the fault can still write a few words into the next stack first; see The stacks of xv6).

These stacks are permanent. A slot keeps its kernel stack for the whole time the system runs; freeing a process never frees it. A new process in a reused slot runs on the same page and starts at its top.

The stacks exist only in the kernel page table; no user page table maps them, which is why uservec must switch to the kernel page table before using one. Physically the 64 pages are ordinary pages from kalloc, side by side (in one boot of this build, 0x87f99000 for slot 0 down to 0x87f5a000 for slot 63); the guard gaps exist only among the virtual addresses. This function itself runs on hart 0’s boot stack (The stacks of xv6).

procinit(): initialize the process table

Called once from main on hart 0, before any process exists. It names and initializes the two global locks and each slot’s p->lock, marks every slot UNUSED, and records each slot’s kernel stack address, which never changes after this. No locks are needed: no other hart is running kernel code yet (they wait for started in main).

cpuid(): which hart am I on?

Returns the hart ID that start put in tp (kernel/start.c:48); the trap code keeps tp correct while user code runs.

The comment’s warning is about time, not about tp: the answer is only useful while the code cannot move to a different CPU. With interrupts on, a timer interrupt right after this function returns could make the process yield, and it might resume on a different hart, still holding the old ID.

mycpu(): this hart's struct cpu

&cpus[id]. The build computes it as cpus + (id << 7), since struct cpu is 128 bytes. Same warning as cpuid: callers keep interrupts off for as long as they use the pointer (push_off, acquire and the scheduler all do).

myproc(): the process running on this CPU

Reads c->proc with interrupts off (push_off/pop_off), so the process cannot be moved to another CPU between mycpu and the read.

Unlike mycpu's result, the returned pointer stays correct after interrupts come back on: if the process later moves to another CPU, it is still the same struct proc. That is why almost all kernel code calls myproc freely. It returns 0 when called from the scheduler or during boot, when no process is running.

allocpid(): the next process ID

Two CPUs running kfork at the same moment could otherwise both read the same nextpid and hand out the same PID (a race condition), so the read and the increment happen under pid_lock. The critical section takes no other lock, so pid_lock can safely be taken while holding a p->lock, as allocproc does.

allocproc(): find a free slot

Scans the table for an UNUSED slot. Each slot’s lock is held while its state is checked, because another CPU may be claiming or freeing slots at the same time. If the lock were not held, two CPUs could both see the same slot as UNUSED and both take it.

Only one slot lock is held at a time: a used slot’s lock is released before moving on. On finding a free slot the code jumps to found still holding its lock, so no other CPU can claim it. If the scan ends without finding one, all 64 slots are in use and allocproc returns 0; fork then fails.

Claim the slot

With the slot’s lock held: give it a new PID (process ID) and mark it USED, meaning “taken, but not ready to run”. The scheduler only runs RUNNABLE processes, so a USED process cannot be scheduled while it is being built.

The trapframe page

Every process needs a page for its trapframe. If kalloc finds no free page, freeproc undoes the work so far (it sets the slot back to UNUSED), the lock is released, and allocproc returns 0.

The page table

proc_pagetable creates a user page table that maps only the trampoline page and this trapframe; there is no user memory yet. kfork will copy the parent’s memory into it, and for the first process kexec replaces it with one holding /init. On failure, the same cleanup as above (and freeproc frees the trapframe page).

Make the new process start in forkret

This is how a process that has never run gets its first turn on a CPU. The scheduler starts a process with swtch(&c->context, &p->context), and swtch ends with ret, which jumps to context.ra. So:

• context.ra = forkret: the first ret lands at the start of forkret, as if forkret had been called.
• context.sp = p->kstack + PGSIZE: forkret runs on the top of this process’s own empty kernel stack (stacks grow down, so the top is the end of the page).

The other saved registers are zeroed by the memset; a function starting from scratch does not depend on them. The slot is returned with p->lock still held, as the comment on line 107 promises.

freeproc(): return a slot to UNUSED

Frees what allocproc and the process’s life allocated: the trapframe page, the user memory and page table (proc_freepagetable). Then it resets the fields that identify the process and marks the slot UNUSED, so allocproc can reuse it. Clearing pid matters: kkill finds processes by PID, and a stale PID on a free slot must not match.

Callers: kwait, on a zombie child; allocproc and kfork, to undo a half-built process. In every case p->lock is held, as the comment requires, and the process cannot be running (it is either a zombie that has switched away for good or one that never ran).

Some fields are not touched here because they were already handled: ofile and cwd by kexit, parent by kwait. kstack is permanent, and context is reinitialized by allocproc.

proc_pagetable(): an empty user page table

Builds the page table every process starts with, used by allocproc and by kexec (which builds a whole new one for the new program). uvmcreate allocates one zeroed page-table page, meaning no mappings yet.

Map the trampoline

The trampoline page page holds the code (uservec, userret) that switches between user and kernel page tables. It must be mapped at the same virtual address, TRAMPOLINE (the highest page), in the kernel’s page table and in every user page table, so that the instruction after csrw satp is still mapped after the switch.

It maps the physical page that holds the kernel’s own copy of that code, readable and executable. Without PTE_U user code cannot touch it; only supervisor mode, on its way into or out of the kernel, executes it. If mappages fails, the page-table pages allocated so far are freed and 0 returned.

Map the trapframe

The process’s trapframe page goes at TRAPFRAME, one page below the trampoline, readable and writable, again without PTE_U. uservec saves user registers there before it has switched to the kernel page table, so it must be reachable through the user page table.

On failure, the trampoline mapping is removed first (without freeing the page, which belongs to the kernel), because uvmfree refuses to free page-table pages that still contain mappings: freewalk panics on a leaf.

proc_freepagetable(): free a user address space

The reverse of proc_pagetable plus everything added since. First unmap the trampoline and trapframe pages without freeing them (the last argument 0): the trampoline is kernel code shared by everyone, and the trapframe page is freed by freeproc (or, in kexec, kept for the new image). Then uvmfree frees the user memory in [0, sz) and the page-table pages themselves. The two unmaps must come first because freewalk panics if it finds a mapping still present.

userinit(): the first process

Called once by main on hart 0. It creates process 1, but gives it no user memory at all: there is no built-in user program image in this version of xv6. The process’s first act, in forkret, is to load /init from the disk with kexec, which cannot be done here because reading the disk requires sleeping, and main is not a process.

allocproc cannot fail here (the table is empty and memory is plentiful), so the result is not checked. namei("/") returns a reference to the root directory’s inode without reading the disk: for the path "/" it only calls iget, which fills in an in-memory slot. That matters, because p->lock is held and no disk I/O may happen while holding a spinlock.

Setting RUNNABLE under p->lock publishes the process; once the lock is released any CPU’s scheduler may pick it.

growproc(): change the size of user memory

Called from sys_sbrk when memory must be allocated right away (SBRK_EAGER) or when it shrinks (n < 0). The default lazy sbrk does not come here; it only raises p->sz and lets vmfault allocate pages when they are first touched.

• Growing: refuse to grow into TRAPFRAME, where the trapframe and trampoline pages live, then let uvmalloc allocate zeroed pages and map them readable, writable and user-accessible. On failure it has already undone its partial work.
• Shrinking: uvmdealloc unmaps and frees the pages above the new size. (If n is more negative than the size, the unsigned sum wraps to a huge value and uvmdealloc leaves the size unchanged.)

No lock: sz and pagetable belong to this process, and only it changes them.

kfork(): get a slot for the child

The kernel side of fork, called from sys_fork. It creates a child that is a copy of the calling process and returns the child’s PID to the parent; the child, when it first runs, returns 0 from the same fork call.

allocproc returns the child np in state USED with np->lock held. Nothing can run the child until it becomes RUNNABLE at the end.

Copy user memory

uvmcopy gives the child its own copy of every page of the parent’s memory below p->sz (pages not yet allocated by lazy sbrk are skipped), with the same permissions. If memory runs out, uvmcopy frees what it copied, and freeproc and release throw away the half-built child.

Holding np->lock during this copy is not needed for the copy itself (the child is USED and invisible to the scheduler); it is simply still held from allocproc.

Copy the registers, and make fork return 0 in the child

The struct assignment copies all 288 bytes of the parent’s trapframe: every user register as it was when the parent executed ecall, including epc, which usertrap has already advanced past the ecall. So the child will resume at the same place as the parent, just after the call to fork.

The only difference is a0, the register that carries a system call’s return value: 0 for the child. The parent gets the child’s PID, because syscall stores kfork's return value in the parent’s a0.

Share open files and the working directory

The child gets the same open files as the parent. filedup does not copy a file; it increments the open file’s reference count, so parent and child share it, read offset included. That sharing is what makes shell pipelines and redirection work. In the same way idup adds a reference to the current directory’s inode. Finally the child inherits the parent’s name, for procdump.

Publish the child

The order here is driven by locks:

1. Read np->pid while still holding np->lock.
2. Release np->lock before taking wait_lock: the lock order is wait_lock first, then p->lock. Holding np->lock while waiting for wait_lock could deadlock against a kexit on another CPU, whose wakeup acquires every p->lock, np->lock included, while holding wait_lock.
3. Set np->parent under wait_lock, which protects every parent field.
4. Only then make the child RUNNABLE, under np->lock.

Step 4 must come after step 3. Once RUNNABLE, the child may run on another CPU at once, and might even call exit immediately; kexit reads p->parent to wake the parent, so the link must already exist.

reparent(): give orphans to init

When a process exits, its children (running or already zombies) still need someone to kwait for them, or their slots would never be freed. reparent makes initproc their parent, and /init loops calling wait forever (user/init.c) to collect them.

The caller must hold wait_lock, which protects every parent field read and written here. wakeup(initproc) wakes init in case it is sleeping in kwait (whose channel is init’s own struct proc) and the new child is already a zombie that no other wakeup would announce. Calling wakeup while holding wait_lock respects the lock order: wakeup takes p->locks.

kexit(): release files and the working directory

The kernel side of exit, called from sys_exit, and from usertrap for a killed process. It never returns.

initproc must never exit: it is where orphans go, and its wait loop is what frees them.

The first part releases resources that need no locks, because they belong to this process: every open file (fileclose drops a reference and, for the last one, closes the pipe, device or inode), then the current directory. iput may write to disk (if this was the last reference to a file that has been deleted), so it runs inside a file-system transaction, begin_op to end_op. These calls may sleep, which is why no spinlock is held yet.

kexit(): become a zombie and switch away for good

Every step from here on happens under wait_lock:

1. reparent the children to init.
2. Wake the parent, which may be sleeping in kwait on the channel p->parent.
3. Take this process’s own p->lock (correct order: wait_lock first), record the exit status and set ZOMBIE.
4. Release wait_lock and call sched, which requires holding exactly p->lock.

Waking the parent (step 2) before becoming a zombie (step 3) looks backwards but is safe: the parent needs wait_lock to look at its children again, and it cannot get it until step 4. If wait_lock were released before step 3, the parent could look, find no zombie, and go back to sleep, and this process’s only wakeup would be lost.

p->lock stays held into sched and is released by the scheduler only after swtch has finished saving this process’s registers. A parent in kwait must take that lock to look at the zombie, so it cannot free the slot (and let it be reused, kernel stack and all) while this process is still running on it.

The process’s memory and page table are not freed here; the parent’s kwait does that in freeproc. sched never returns to a zombie, so the panic on line 364 is only a safety net.

kwait(): wait for a child to exit

The kernel side of wait, called from sys_wait. addr is a user address at which to store the child’s exit status, or 0 if the caller does not want it.

The whole function runs with wait_lock held, except while sleeping. That lock protects the parent fields being scanned, and it is the condition lock for the sleep: kexit holds it while waking the parent and becoming a zombie.

Scan for children, and reap a zombie

For every slot whose parent is this process (a read protected by wait_lock):

• Take the child’s pp->lock, which protects its state. The comment’s “isn’t still in exit() or swtch()” refers to the hand-off described in kexit: a child that has set ZOMBIE still holds its lock until it has switched away, so acquiring it here waits until the child is truly gone from its CPU. Taking pp->lock while holding wait_lock follows the lock order.
• If the child is a ZOMBIE: copy its exit status to user memory (if requested), clear its parent and free the slot with freeproc. Return its PID.

copyout runs while two spinlocks are held. That is allowed because it never sleeps (for a lazily allocated page it may allocate one with kalloc, which only takes another spinlock). If it fails, wait returns -1 and the zombie stays, to be collected by a later wait.

Clearing pp->parent matters: freeproc leaves parent alone, so without this line the free slot would still look like this process’s child, havekids would stay 1, and a later wait with no real children would sleep forever.

Give up if there is nothing to wait for

Without any children, no exit will ever come, so return -1 instead of sleeping forever. Also give up if this process has been killed (killed takes p->lock, which is allowed while holding wait_lock); it should go back towards user space, where usertrap makes it exit.

Sleep until a child exits

The sleep and wakeup pattern, with wait_lock as the condition lock and this process’s own struct proc address as the channel. That is the channel kexit wakes (wakeup(p->parent)) and reparent wakes for init (wakeup(initproc)).

sleep_prepare registers on the channel while wait_lock is still held. Any child that exits after the scan above must take wait_lock to call wakeup, so its wakeup comes after the registration and cannot be lost: either it clears p->chan before sleep (which then returns at once) or it makes the sleeping process RUNNABLE. After waking, retake wait_lock and scan again.

scheduler(): each CPU's endless loop

Every hart calls scheduler at the end of main and never leaves it. The scheduler is a thread of its own, running on the hart’s boot stack, with its registers saved in c->context while a process runs.

c is computed once: the scheduler thread never moves to another CPU. c->proc = 0 records that no process is running yet.

Let pending interrupts in, briefly

Each pass of the loop opens a short window with interrupts enabled, then closes it.

• Why enable them at all? The scheduler holds no locks here. If every process is sleeping, they wait for an interrupt (a disk read completing, a key press, a timer tick) whose handler will call wakeup. With interrupts permanently off, those handlers would never run and nothing would ever become runnable. (The comment’s “most recent process may have had interrupts turned off” refers to the state the CPU is in after a process switches back.)
• Why turn them off again? To close the race with wfi below. If interrupts were on while the loop found nothing to run, a device interrupt could arrive after the scan but before wfi, make a process RUNNABLE, and be finished; wfi would then wait for the next interrupt (at worst this hart’s next timer tick, about 0.1 s later) while a process sat ready to run. With interrupts off, an interrupt that arrives in that gap stays pending, wfi does not stop the hart (a pending enabled interrupt wakes wfi even while SIE is 0), and the next intr_on() handles it.

The build has csrsi sstatus,2 immediately followed by csrci sstatus,2; a pending interrupt is taken between the two.

Run every RUNNABLE process once

The scan visits every slot in order, so in one pass each RUNNABLE process gets one turn: simple round-robin.

For each slot it takes p->lock to read state reliably. If the process is RUNNABLE:

1. Mark it RUNNING and record it in c->proc (so myproc finds it).
2. swtch saves the scheduler’s registers in c->context and loads the process’s. The process now runs, still holding p->lock, which the scheduler acquired.
3. Eventually the process calls sched (from yield, sleep or kexit), holding p->lock again, and swtch returns here.
4. Clear c->proc, note that something ran, and release p->lock.

This “lock hand-off” is the key idea. p->lock is held during both halves of every switch, so another CPU cannot see the process as RUNNABLE and start running it while this CPU is still on its kernel stack, between setting the state and saving the registers. The lock is acquired by one thread and released by another, which is fine because holding checks the CPU, and both threads are on the same CPU at that moment.

Nothing to run, so pause the hart

If a whole pass found nothing runnable, wfi lets the hart idle until an interrupt is pending, instead of rescanning the table millions of times a second. When wfi finishes, the loop starts over and intr_on() lets the pending interrupt be handled. If something did run, the loop goes straight into another pass.

sched(): the only way back to the scheduler

Every process that gives up the CPU goes through here. The caller must hold p->lock (and no other lock) and must already have changed p->state away from RUNNING.

The comment’s point about intena: push_off records in struct cpu whether interrupts were on before the outermost lock was taken. But that fact belongs to this process’s code path, which took p->lock with interrupts on or off. While the process is switched out, other code on this CPU overwrites cpu->intena, and the process may resume on another CPU anyway. So sched keeps its own copy across the switch. Ideally both noff and intena would live in struct proc, but locks are also taken when no process exists (in the scheduler, during boot), so they stay per-CPU. noff does not need saving: it is exactly 1 on both sides of every switch.

Four sanity checks

Each check catches a bug that would otherwise corrupt the system silently:

• Not holding p->lock: the scheduler would release a lock nobody acquired, and another CPU could start running this process while it is still on this one.
• noff != 1, meaning another spinlock is held: that lock would stay locked for as long as this process is switched out, and anything else that needs it would spin. (It also keeps the intena bookkeeping valid.)
• state == RUNNING: the caller forgot to change the state. The scheduler looks only for RUNNABLE, so the process would never run again.
• Interrupts on: with p->lock held they must be off. This would mean someone enabled them inside a critical section.

Switch to the scheduler, and later come back

swtch saves this process’s registers in p->context and resumes the scheduler thread right after its call to swtch (line 453). For this process, the call to swtch returns only when some scheduler picks it again, possibly much later and possibly on a different CPU.

That is why line 496 calls mycpu again rather than reusing a pointer from before the switch: the process may now be on another hart. (In the build the local intena lives in the callee-saved register s3, which swtch saved and restored.)

yield(): give up the CPU, stay runnable

Called on a timer interrupt, from usertrap (kernel/trap.c:86) and from kerneltrap (kernel/trap.c:158). This is what makes scheduling preemptive: a process that never makes a system call still loses the CPU every tick.

Take p->lock, mark the process RUNNABLE (any CPU may now pick it, but not before scheduler releases this lock after the switch), and call sched. When sched returns, the process has been chosen again; the p->lock released on line 507 is the one the new scheduler acquired before switching back to it.

forkret(): a new process's first instructions

Every new process starts here, not in the middle of sched like a process that has run before, because allocproc set context.ra to forkret.

The scheduler acquired p->lock before switching here. A process that resumes in sched releases it in yield or sleep; a new process has to release it itself, first thing. Interrupts stay off after the release: the scheduler’s acquire found them off, so intena is 0.

userret is the label in kernel/trampoline.S where the return to user space begins.

The first process loads /init

Only the first process ever to run forkret does this: process 1, from userinit. first is a static local variable, so it keeps its value between calls; after the first call it is 0 for everyone. No lock is needed, because when process 1 runs this code no other process exists yet.

fsinit reads the file system’s superblock and recovers the log (crash recovery), and reclaims inodes left orphaned by a crash (ireclaim), which can write the disk. It reads the disk, and waiting for the disk means calling sleep, which needs a current process. That is why it runs here and not in main, as the comment says.

Then kexec (exec) replaces process 1’s empty address space with the program /init. (char *[]){"/init", 0} is a C99 compound literal: an unnamed array of two char * values, "/init" and a null pointer, used as argc and argv (program arguments). kexec returns argc (here 1) or -1, and the value is stored in the trapframe’s a0, where main(argc, argv) in /init will find its first argument; kexec already put argv in a1. Without /init the system cannot do anything useful, so failure is a panic.

Jump to user space

The same exit path as the end of a system call (usertrap returning into userret), done by hand:

• prepare_return turns interrupts off, points stvec at uservec, fills in the trapframe’s kernel_* fields, and sets up sstatus and sepc so that sret enters user mode at trapframe->epc.
• satp is the value that selects this process’s page table (MAKE_SATP).
• userret is linked at an address in the kernel image, but it must run from the trampoline page page, because it switches to the user page table, where only the trampoline mapping of this code exists. So the address is translated: TRAMPOLINE + (userret - trampoline).
• The last line casts that number to a pointer to a function taking one uint64 and calls it, which puts satp in a0 as userret expects. userret ends in sret and never returns.

For a forked child, epc and all registers are the parent’s, except a0 = 0: the child “returns” from fork with 0.

sleep_prepare(): register on a wait channel

The first half of sleep and wakeup. It records the channel (any address that the sleeper and the waker agree on, such as &ticks or a buffer’s address) in p->chan. In the usual pattern the caller holds the lock that protects the condition it is waiting for, and calls this before releasing it. uartwrite uses a variant without a condition lock: it registers first and then tests the device; a wakeup arriving after the registration clears p->chan, so sleep returns at once.

p->lock is taken because wakeup, running on another CPU or in an interrupt handler, reads and clears p->chan under that lock.

Channel 0 is forbidden because p->chan == 0 means “not waiting”, and sleep would treat the registration as already woken.

sleep(): give up the CPU unless already woken

The second half. If p->chan is still set, no wakeup for this channel has happened since sleep_prepare: mark the process SLEEPING and switch to the scheduler. If it is 0, the wakeup already came (between the caller’s release of its condition lock and this point), so return at once. This is xv6’s answer to the lost-wakeup problem: the wakeup is remembered in p->chan even when the process was not yet asleep.

The check and the state change happen under p->lock, and wakeup needs that lock too, so no wakeup can slip in between them. p->lock stays held into sched and is released by the scheduler only after the switch, so a wakeup cannot make the process RUNNABLE (and let another CPU run it) while it is still on this CPU.

When sched returns, the process has been woken and picked to run. It releases the p->lock that the scheduler acquired for it. The caller then re-checks its condition.

p->chan is not always 0 when a process stops waiting. kkill makes a sleeper RUNNABLE without clearing it, and some callers register and then find they do not need to sleep (uartwrite). The stale value is harmless: every sleep is preceded by a fresh sleep_prepare, and a later wakeup on the old channel only clears it.

wakeup(): wake every process waiting on a channel

Visits every slot, taking each p->lock in turn, and for every process registered on chan:

• clears p->chan, which tells a process that has registered but not yet called sleep that its wakeup has come;
• if it is already SLEEPING, makes it RUNNABLE.

The comment on lines 587–588 says “set it back to RUNNING”; that is wrong. The code sets RUNNABLE: the process becomes eligible to run, and a scheduler will later make it RUNNING.

Callers usually hold the condition lock (for example clockintr holds tickslock around ticks++ and wakeup(&ticks)). That is why the rule is condition lock first, p->lock second, matching sleep_prepare. The caller must not hold any p->lock: the loop acquires every slot’s lock, so it would panic on its own lock (acquire's re-acquire check) or risk deadlock on another’s.

Wakeups are not targeted: everyone on the channel wakes, and each must re-check its condition. The cost is one pass over all 64 slots per wakeup.

kkill(): mark a process as killed

The kernel side of kill, from sys_kill. It does not stop the victim directly (the victim may be running on another CPU, or in the middle of a kernel operation that must finish). It only sets killed and, if the victim is sleeping, makes it runnable so that it gets a chance to notice.

The victim checks the flag with killed and exits at safe points:

• in usertrap, when entering the kernel for a system call and before returning to user space (kernel/trap.c:57, kernel/trap.c:81);
• in sleep loops that can wait indefinitely, such as reading the console or a pipe, sys_pause and kwait, which return an error when killed.

Sleeps that end on their own (disk I/O, acquiresleep) do not check: their loop re-checks the condition and sleeps again, and the process exits later.

PID 0 is rejected because every free slot has pid 0 (freeproc); without the check, kill(0) would set killed on an unused slot, and since allocproc does not clear killed, the next process created in that slot would start out killed. The search holds one slot lock at a time, because pid, killed and state are all protected by p->lock.

setkilled() and killed(): the flag, under the lock

killed is written by kkill on whatever CPU runs kill, and read by the victim on its own CPU, so both sides take p->lock. The lock makes the read see a definite, current value, consistent with the ordering that acquire/release provide.

setkilled is used by usertrap when a user program causes an unexpected exception (for example an illegal instruction): the process is marked and exits a few lines later (kernel/trap.c:81).

either_copyout(): copy to user or kernel memory

Some kernel functions copy data to a destination that may be either in user memory or in kernel memory, depending on who called them. readi is the main example: for a read system call the destination is a user address; for kexec reading a program’s headers, or for a directory lookup, it is a kernel buffer.

user_dst says which. A user address must go through copyout, which translates it with the process’s page table, checks that it is writable user memory (allocating a lazily-allocated page if needed, which is why it receives p->sz) and returns -1 for a bad address. A kernel address can be used directly with memmove. (The comment calls the flag usr_dst; the parameter is user_dst.)

either_copyin(): copy from user or kernel memory

The mirror image, used by writei and consolewrite: the source is a user address (copyin, with the same checks) or a kernel address (memmove). The comment’s usr_src is the parameter user_src.

procdump(): print the process table, for debugging

Typing Ctrl-P on the console calls this from consoleintr (kernel/console.c:152). It prints one line per used slot: PID, state and name.

It deliberately takes no locks. If the machine is stuck because some CPU holds a p->lock forever, a procdump that tried to acquire it would hang too, and you would learn nothing. The price is that a line may mix values from before and after a concurrent change.

states uses designated initializers: [SLEEPING] = "sleep " puts that string at index SLEEPING (2), whatever order the lines are written in. The strings are padded to six characters so the columns line up. The clang-format comments only tell the code formatter to leave this table’s alignment alone.

One line per process

Free slots are skipped. The state name is looked up only if p->state is a valid index with a string; NELEM gives the array’s length. Since this code reads without a lock, it guards against a garbage value instead of trusting it.