Kernel: Fix most of mutex + block race conditions

All block functions now take an optional mutex parameter that is
atomically unlocked instead of having the user unlock it before hand.
This prevents a ton of race conditions everywhere in the code!

kernel/kernel/ACPI/ACPI.cpp

@@ -963,7 +963,7 @@ acpi_release_global_lock:
 
 			// FIXME: this can cause missing of event if it happens between
 			//        reading the status and blocking
-			m_event_thread_blocker.block_with_timeout_ms(100);
+			m_event_thread_blocker.block_with_timeout_ms(100, nullptr);
 			continue;
 
 handle_event:

kernel/kernel/Epoll.cpp

@@ -1,5 +1,6 @@
 #include <kernel/Epoll.h>
 #include <kernel/Lock/LockGuard.h>
+#include <kernel/Lock/SpinLockAsMutex.h>
 #include <kernel/Timer/Timer.h>
 
 namespace Kernel
@@ -45,10 +46,12 @@ namespace Kernel
 					TRY(inode->add_epoll(this));
 				it->value.add_fd(fd, event);
 
-				auto processing_it = m_processing_events.find(inode);
-				if (processing_it == m_processing_events.end())
-					processing_it = MUST(m_processing_events.insert(inode, 0));
-				processing_it->value |= event.events;
+				SpinLockGuard _(m_ready_lock);
+				auto ready_it = m_ready_events.find(inode);
+				if (ready_it == m_ready_events.end())
+					ready_it = MUST(m_ready_events.insert(inode, 0));
+				ready_it->value |= event.events;
+				m_thread_blocker.unblock();
 
 				return {};
 			}
@@ -61,10 +64,12 @@ namespace Kernel
 
 				it->value.events[fd] = event;
 
-				auto processing_it = m_processing_events.find(inode);
-				if (processing_it == m_processing_events.end())
-					processing_it = MUST(m_processing_events.insert(inode, 0));
-				processing_it->value |= event.events;
+				SpinLockGuard _(m_ready_lock);
+				auto ready_it = m_ready_events.find(inode);
+				if (ready_it == m_ready_events.end())
+					ready_it = MUST(m_ready_events.insert(inode, 0));
+				ready_it->value |= event.events;
+				m_thread_blocker.unblock();
 
 				return {};
 			}
@@ -196,8 +201,14 @@ namespace Kernel
 			const uint64_t current_ns = SystemTimer::get().ns_since_boot();
 			if (current_ns >= waketime_ns)
 				break;
+
+			SpinLockGuard guard(m_ready_lock);
+			if (!m_ready_events.empty())
+				continue;
+
+			SpinLockGuardAsMutex smutex(guard);
 			const uint64_t timeout_ns = BAN::Math::min<uint64_t>(100'000'000, waketime_ns - current_ns);
-			TRY(Thread::current().block_or_eintr_or_timeout_ns(m_thread_blocker, timeout_ns, false));
+			TRY(Thread::current().block_or_eintr_or_timeout_ns(m_thread_blocker, timeout_ns, false, &smutex));
 		}
 
 		return event_count;

kernel/kernel/FS/DevFS/FileSystem.cpp

@@ -46,54 +46,54 @@ namespace Kernel
 	void DevFileSystem::initialize_device_updater()
 	{
 		Process::create_kernel(
-			[](void*)
+			[](void* _devfs)
 			{
+				auto* devfs = static_cast<DevFileSystem*>(_devfs);
 				while (true)
 				{
 					{
-						LockGuard _(s_instance->m_device_lock);
-						for (auto& device : s_instance->m_devices)
+						LockGuard _(devfs->m_device_lock);
+						for (auto& device : devfs->m_devices)
 							device->update();
 					}
 					SystemTimer::get().sleep_ms(10);
 				}
-			}, nullptr
+			}, s_instance
 		);
 
 		auto* sync_process = Process::create_kernel();
 
 		sync_process->add_thread(MUST(Thread::create_kernel(
-			[](void*)
+			[](void* _devfs)
 			{
+				auto* devfs = static_cast<DevFileSystem*>(_devfs);
 				while (true)
 				{
-					LockGuard _(s_instance->m_device_lock);
-					while (!s_instance->m_should_sync)
-					{
-						LockFreeGuard _(s_instance->m_device_lock);
-						s_instance->m_sync_thread_blocker.block_indefinite();
-					}
+					LockGuard _(devfs->m_device_lock);
+					while (!devfs->m_should_sync)
+						devfs->m_sync_thread_blocker.block_indefinite(&devfs->m_device_lock);
 
-					for (auto& device : s_instance->m_devices)
+					for (auto& device : devfs->m_devices)
 						if (device->is_storage_device())
 							if (auto ret = static_cast<StorageDevice*>(device.ptr())->sync_disk_cache(); ret.is_error())
 								dwarnln("disk sync: {}", ret.error());
 
-					s_instance->m_should_sync = false;
-					s_instance->m_sync_done.unblock();
+					devfs->m_should_sync = false;
+					devfs->m_sync_done.unblock();
 				}
-			}, nullptr, sync_process
+			}, s_instance, sync_process
 		)));
 
 		sync_process->add_thread(MUST(Kernel::Thread::create_kernel(
-			[](void*)
+			[](void* _devfs)
 			{
+				auto* devfs = static_cast<DevFileSystem*>(_devfs);
 				while (true)
 				{
 					SystemTimer::get().sleep_ms(10'000);
-					s_instance->initiate_sync(false);
+					devfs->initiate_sync(false);
 				}
-			}, nullptr, sync_process
+			}, s_instance, sync_process
 		)));
 
 		sync_process->register_to_scheduler();
@@ -101,13 +101,11 @@ namespace Kernel
 
 	void DevFileSystem::initiate_sync(bool should_block)
 	{
-		{
-			LockGuard _(m_device_lock);
-			m_should_sync = true;
-			m_sync_thread_blocker.unblock();
-		}
-		if (should_block)
-			m_sync_done.block_indefinite();
+		LockGuard _(m_device_lock);
+		m_should_sync = true;
+		m_sync_thread_blocker.unblock();
+		while (should_block && m_should_sync)
+			m_sync_done.block_indefinite(&m_device_lock);
 	}
 
 	void DevFileSystem::add_device(BAN::RefPtr<Device> device)

kernel/kernel/FS/Inode.cpp

@@ -278,14 +278,14 @@ namespace Kernel
 
 	BAN::ErrorOr<void> Inode::add_epoll(class Epoll* epoll)
 	{
-		LockGuard _(m_epoll_mutex);
+		SpinLockGuard _(m_epoll_lock);
 		TRY(m_epolls.push_back(epoll));
 		return {};
 	}
 
 	void Inode::del_epoll(class Epoll* epoll)
 	{
-		LockGuard _(m_epoll_mutex);
+		SpinLockGuard _(m_epoll_lock);
 		for (auto it = m_epolls.begin(); it != m_epolls.end(); it++)
 		{
 			if (*it != epoll)
@@ -297,7 +297,7 @@ namespace Kernel
 
 	void Inode::epoll_notify(uint32_t event)
 	{
-		LockGuard _(m_epoll_mutex);
+		SpinLockGuard _(m_epoll_lock);
 		for (auto* epoll : m_epolls)
 			epoll->notify(this, event);
 	}

kernel/kernel/FS/Pipe.cpp

@@ -44,6 +44,8 @@ namespace Kernel
 
 	void Pipe::on_close(int status_flags)
 	{
+		LockGuard _(m_mutex);
+
 		if (status_flags & O_WRONLY)
 		{
 			auto old_writing_count = m_writing_count.fetch_sub(1);
@@ -71,8 +73,7 @@ namespace Kernel
 		{
 			if (m_writing_count == 0)
 				return 0;
-			LockFreeGuard lock_free(m_mutex);
-			TRY(Thread::current().block_or_eintr_or_timeout_ms(m_thread_blocker, 100, false));
+			TRY(Thread::current().block_or_eintr_indefinite(m_thread_blocker, &m_mutex));
 		}
 
 		const size_t to_copy = BAN::Math::min<size_t>(buffer.size(), m_buffer_size);
@@ -108,8 +109,7 @@ namespace Kernel
 				Thread::current().add_signal(SIGPIPE);
 				return BAN::Error::from_errno(EPIPE);
 			}
-			LockFreeGuard lock_free(m_mutex);
-			TRY(Thread::current().block_or_eintr_or_timeout_ms(m_thread_blocker, 100, false));
+			TRY(Thread::current().block_or_eintr_indefinite(m_thread_blocker, &m_mutex));
 		}
 
 		const size_t to_copy = BAN::Math::min(buffer.size(), m_buffer.size() - m_buffer_size);

kernel/kernel/FS/ProcFS/FileSystem.cpp

@@ -1,6 +1,5 @@
 #include <kernel/FS/ProcFS/FileSystem.h>
 #include <kernel/FS/ProcFS/Inode.h>
-#include <kernel/Lock/LockGuard.h>
 
 namespace Kernel
 {

kernel/kernel/Input/InputDevice.cpp

@@ -1,7 +1,7 @@
 #include <kernel/Device/DeviceNumbers.h>
 #include <kernel/FS/DevFS/FileSystem.h>
 #include <kernel/Input/InputDevice.h>
-#include <kernel/Lock/LockGuard.h>
+#include <kernel/Lock/SpinLockAsMutex.h>
 
 #include <LibInput/KeyEvent.h>
 #include <LibInput/MouseEvent.h>
@@ -181,23 +181,18 @@ namespace Kernel
 		if (buffer.size() < m_event_size)
 			return BAN::Error::from_errno(ENOBUFS);
 
-		auto state = m_event_lock.lock();
+		SpinLockGuard guard(m_event_lock);
 		while (m_event_count == 0)
 		{
-			m_event_lock.unlock(state);
-			{
-				LockFreeGuard _(m_mutex);
-				TRY(Thread::current().block_or_eintr_indefinite(m_event_thread_blocker));
-			}
-			state = m_event_lock.lock();
+			// FIXME: should m_mutex be unlocked?
+			SpinLockGuardAsMutex smutex(guard);
+			TRY(Thread::current().block_or_eintr_indefinite(m_event_thread_blocker, &smutex));
 		}
 
 		memcpy(buffer.data(), &m_event_buffer[m_event_tail * m_event_size], m_event_size);
 		m_event_tail = (m_event_tail + 1) % m_max_event_count;
 		m_event_count--;
 
-		m_event_lock.unlock(state);
-
 		return m_event_size;
 	}
 
@@ -256,8 +251,8 @@ namespace Kernel
 					return bytes;
 			}
 
-			LockFreeGuard _(m_mutex);
-			TRY(Thread::current().block_or_eintr_indefinite(m_thread_blocker));
+			// FIXME: race condition as notify doesn't lock mutex
+			TRY(Thread::current().block_or_eintr_indefinite(m_thread_blocker, &m_mutex));
 		}
 	}
 
@@ -308,8 +303,8 @@ namespace Kernel
 					return bytes;
 			}
 
-			LockFreeGuard _(m_mutex);
-			TRY(Thread::current().block_or_eintr_indefinite(m_thread_blocker));
+			// FIXME: race condition as notify doesn't lock mutex
+			TRY(Thread::current().block_or_eintr_indefinite(m_thread_blocker, &m_mutex));
 		}
 	}
 

kernel/kernel/Memory/MemoryBackedRegion.cpp

@@ -1,4 +1,3 @@
-#include <kernel/Lock/LockGuard.h>
 #include <kernel/Memory/Heap.h>
 #include <kernel/Memory/MemoryBackedRegion.h>
 

kernel/kernel/Memory/MemoryRegion.cpp

@@ -1,3 +1,4 @@
+#include <kernel/Lock/LockGuard.h>
 #include <kernel/Memory/MemoryRegion.h>
 
 namespace Kernel
@@ -59,4 +60,24 @@ namespace Kernel
 		return ret;
 	}
 
+	void MemoryRegion::pin()
+	{
+		LockGuard _(m_pinned_mutex);
+		m_pinned_count++;
+	}
+
+	void MemoryRegion::unpin()
+	{
+		LockGuard _(m_pinned_mutex);
+		if (--m_pinned_count == 0)
+			m_pinned_blocker.unblock();
+	}
+
+	void MemoryRegion::wait_not_pinned()
+	{
+		LockGuard _(m_pinned_mutex);
+		while (m_pinned_count)
+			m_pinned_blocker.block_with_timeout_ms(100, &m_pinned_mutex);
+	}
+
 }

kernel/kernel/Memory/VirtualRange.cpp

@@ -1,4 +1,3 @@
-#include <kernel/Lock/LockGuard.h>
 #include <kernel/Memory/Heap.h>
 #include <kernel/Memory/VirtualRange.h>
 

kernel/kernel/Networking/ARPTable.cpp

@@ -1,3 +1,4 @@
+#include <kernel/Lock/SpinLockAsMutex.h>
 #include <kernel/Networking/ARPTable.h>
 #include <kernel/Scheduler.h>
 #include <kernel/Timer/Timer.h>
@@ -158,16 +159,15 @@ namespace Kernel
 		for (;;)
 		{
 			PendingArpPacket pending = ({
-				auto state = m_pending_lock.lock();
+				SpinLockGuard guard(m_pending_lock);
 				while (m_pending_packets.empty())
 				{
-					m_pending_lock.unlock(state);
-					m_pending_thread_blocker.block_with_timeout_ms(100);
-					state = m_pending_lock.lock();
+					SpinLockGuardAsMutex smutex(guard);
+					m_pending_thread_blocker.block_indefinite(&smutex);
 				}
+
 				auto packet = m_pending_packets.front();
 				m_pending_packets.pop();
-				m_pending_lock.unlock(state);
 
 				packet;
 			});

kernel/kernel/Networking/IPv4Layer.cpp

@@ -1,5 +1,6 @@
 #include <kernel/Memory/Heap.h>
 #include <kernel/Memory/PageTable.h>
+#include <kernel/Lock/SpinLockAsMutex.h>
 #include <kernel/Networking/ICMP.h>
 #include <kernel/Networking/IPv4Layer.h>
 #include <kernel/Networking/NetworkManager.h>
@@ -331,16 +332,15 @@ namespace Kernel
 		for (;;)
 		{
 			PendingIPv4Packet pending = ({
-				auto state = m_pending_lock.lock();
+				SpinLockGuard guard(m_pending_lock);
 				while (m_pending_packets.empty())
 				{
-					m_pending_lock.unlock(state);
-					m_pending_thread_blocker.block_with_timeout_ms(100);
-					state = m_pending_lock.lock();
+					SpinLockGuardAsMutex smutex(guard);
+					m_pending_thread_blocker.block_indefinite(&smutex);
 				}
+
 				auto packet = m_pending_packets.front();
 				m_pending_packets.pop();
-				m_pending_lock.unlock(state);
 
 				packet;
 			});

kernel/kernel/Networking/RTL8169/RTL8169.cpp

@@ -1,3 +1,4 @@
+#include <kernel/Lock/SpinLockAsMutex.h>
 #include <kernel/Networking/NetworkManager.h>
 #include <kernel/Networking/RTL8169/Definitions.h>
 #include <kernel/Networking/RTL8169/RTL8169.h>
@@ -205,13 +206,18 @@ namespace Kernel
 			return BAN::Error::from_errno(EADDRNOTAVAIL);
 
 		auto state = m_lock.lock();
+
 		const uint32_t tx_current = m_tx_current;
 		m_tx_current = (m_tx_current + 1) % m_tx_descriptor_count;
-		m_lock.unlock(state);
 
 		auto& descriptor = reinterpret_cast<volatile RTL8169Descriptor*>(m_tx_descriptor_region->vaddr())[tx_current];
 		while (descriptor.command & RTL8169_DESC_CMD_OWN)
-			m_thread_blocker.block_with_timeout_ms(100);
+		{
+			SpinLockAsMutex smutex(m_lock, state);
+			m_thread_blocker.block_indefinite(&smutex);
+		}
+
+		m_lock.unlock(state);
 
 		auto* tx_buffer = reinterpret_cast<uint8_t*>(m_tx_buffer_region->vaddr() + tx_current * buffer_size);
 
@@ -246,7 +252,10 @@ namespace Kernel
 		}
 
 		if (interrupt_status & RTL8169_IR_TOK)
+		{
+			SpinLockGuard _(m_lock);
 			m_thread_blocker.unblock();
+		}
 
 		if (interrupt_status & RTL8169_IR_RER)
 			dwarnln("Rx error");

kernel/kernel/Networking/TCPSocket.cpp

@@ -73,10 +73,7 @@ namespace Kernel
 			return BAN::Error::from_errno(EINVAL);
 
 		while (m_pending_connections.empty())
-		{
-			LockFreeGuard _(m_mutex);
-			TRY(Thread::current().block_or_eintr_or_timeout_ms(m_thread_blocker, 100, false));
-		}
+			TRY(Thread::current().block_or_eintr_indefinite(m_thread_blocker, &m_mutex));
 
 		auto connection = m_pending_connections.front();
 		m_pending_connections.pop();
@@ -111,12 +108,7 @@ namespace Kernel
 
 		const uint64_t wake_time_ms = SystemTimer::get().ms_since_boot() + 5000;
 		while (!return_inode->m_has_connected)
-		{
-			if (SystemTimer::get().ms_since_boot() >= wake_time_ms)
-				return BAN::Error::from_errno(ECONNABORTED);
-			LockFreeGuard free(m_mutex);
-			TRY(Thread::current().block_or_eintr_or_waketime_ms(return_inode->m_thread_blocker, wake_time_ms, true));
-		}
+			TRY(Thread::current().block_or_eintr_or_waketime_ms(return_inode->m_thread_blocker, wake_time_ms, true, &m_mutex));
 
 		if (address)
 		{
@@ -168,12 +160,7 @@ namespace Kernel
 
 		const uint64_t wake_time_ms = SystemTimer::get().ms_since_boot() + 5000;
 		while (!m_has_connected)
-		{
-			if (SystemTimer::get().ms_since_boot() >= wake_time_ms)
-				return BAN::Error::from_errno(ECONNREFUSED);
-			LockFreeGuard free(m_mutex);
-			TRY(Thread::current().block_or_eintr_or_waketime_ms(m_thread_blocker, wake_time_ms, true));
-		}
+			TRY(Thread::current().block_or_eintr_or_waketime_ms(m_thread_blocker, wake_time_ms, true, &m_mutex));
 
 		return {};
 	}
@@ -208,8 +195,7 @@ namespace Kernel
 		{
 			if (m_state != State::Established)
 				return return_with_maybe_zero();
-			LockFreeGuard free(m_mutex);
-			TRY(Thread::current().block_or_eintr_or_timeout_ms(m_thread_blocker, 100, false));
+			TRY(Thread::current().block_or_eintr_indefinite(m_thread_blocker, &m_mutex));
 		}
 
 		const uint32_t to_recv = BAN::Math::min<uint32_t>(buffer.size(), m_recv_window.data_size);
@@ -239,8 +225,7 @@ namespace Kernel
 		{
 			if (m_state != State::Established)
 				return return_with_maybe_zero();
-			LockFreeGuard free(m_mutex);
-			TRY(Thread::current().block_or_eintr_or_timeout_ms(m_thread_blocker, 100, false));
+			TRY(Thread::current().block_or_eintr_indefinite(m_thread_blocker, &m_mutex));
 		}
 
 		const size_t to_send = BAN::Math::min<size_t>(message.size(), m_send_window.buffer->size() - m_send_window.data_size);
@@ -519,8 +504,10 @@ namespace Kernel
 					}
 					auto socket = it->value;
 
-					LockFreeGuard _(m_mutex);
+					m_mutex.unlock();
 					socket->receive_packet(buffer, sender, sender_len);
+					m_mutex.lock();
+
 					return;
 				}
 				break;
@@ -660,116 +647,114 @@ namespace Kernel
 		BAN::RefPtr<TCPSocket> keep_alive { this };
 		this->unref();
 
+		LockGuard _(m_mutex);
+
 		while (m_process)
 		{
 			const uint64_t current_ms = SystemTimer::get().ms_since_boot();
 
+			if (m_state == State::TimeWait && current_ms >= m_time_wait_start_ms + 30'000)
 			{
-				LockGuard _(m_mutex);
+				set_connection_as_closed();
+				continue;
+			}
 
-				if (m_state == State::TimeWait && current_ms >= m_time_wait_start_ms + 30'000)
+			// This is the last instance
+			if (ref_count() == 1)
+			{
+				if (m_state == State::Listen)
 				{
 					set_connection_as_closed();
 					continue;
 				}
-
-				// This is the last instance
-				if (ref_count() == 1)
+				if (m_state == State::Established)
 				{
-					if (m_state == State::Listen)
-					{
-						set_connection_as_closed();
-						continue;
-					}
-					if (m_state == State::Established)
-					{
-						m_next_flags = FIN | ACK;
-						m_next_state = State::FinWait1;
-					}
-				}
-
-				if (m_next_flags)
-				{
-					ASSERT(m_connection_info.has_value());
-					auto* target_address = reinterpret_cast<const sockaddr*>(&m_connection_info->address);
-					auto target_address_len = m_connection_info->address_len;
-					if (auto ret = m_network_layer.sendto(*this, {}, target_address, target_address_len); ret.is_error())
-						dwarnln("{}", ret.error());
-					const bool hungup_before = has_hungup_impl();
-					m_state = m_next_state;
-					if (m_state == State::Established)
-						m_has_connected = true;
-					if (!hungup_before && has_hungup_impl())
-						epoll_notify(EPOLLHUP);
-					continue;
-				}
-
-				if (m_send_window.data_size > 0 && m_send_window.current_ack - m_send_window.has_ghost_byte > m_send_window.start_seq)
-				{
-					uint32_t acknowledged_bytes = m_send_window.current_ack - m_send_window.start_seq - m_send_window.has_ghost_byte;
-					ASSERT(acknowledged_bytes <= m_send_window.data_size);
-
-					m_send_window.data_size -= acknowledged_bytes;
-					m_send_window.start_seq += acknowledged_bytes;
-
-					if (m_send_window.data_size > 0)
-					{
-						auto* send_buffer = reinterpret_cast<uint8_t*>(m_send_window.buffer->vaddr());
-						memmove(send_buffer, send_buffer + acknowledged_bytes, m_send_window.data_size);
-					}
-
-					m_send_window.sent_size -= acknowledged_bytes;
-
-					epoll_notify(EPOLLOUT);
-
-					dprintln_if(DEBUG_TCP, "Target acknowledged {} bytes", acknowledged_bytes);
-
-					continue;
-				}
-
-				const bool should_retransmit = m_send_window.data_size > 0 && current_ms >= m_send_window.last_send_ms + retransmit_timeout_ms;
-
-				if (m_send_window.data_size > m_send_window.sent_size || should_retransmit)
-				{
-					ASSERT(m_connection_info.has_value());
-					auto* target_address = reinterpret_cast<const sockaddr*>(&m_connection_info->address);
-					auto target_address_len = m_connection_info->address_len;
-
-					const uint32_t send_base = should_retransmit ? 0 : m_send_window.sent_size;
-
-					const uint32_t total_send = BAN::Math::min<uint32_t>(m_send_window.data_size - send_base, m_send_window.scaled_size());
-
-					m_send_window.current_seq = m_send_window.start_seq;
-
-					auto* send_buffer = reinterpret_cast<const uint8_t*>(m_send_window.buffer->vaddr() + send_base);
-					for (uint32_t i = 0; i < total_send;)
-					{
-						const uint32_t to_send = BAN::Math::min(total_send - i, m_send_window.mss);
-
-						auto message = BAN::ConstByteSpan(send_buffer + i, to_send);
-
-						m_next_flags = ACK;
-						if (auto ret = m_network_layer.sendto(*this, message, target_address, target_address_len); ret.is_error())
-						{
-							dwarnln("{}", ret.error());
-							break;
-						}
-
-						dprintln_if(DEBUG_TCP, "Sent {} bytes", to_send);
-
-						m_send_window.sent_size += to_send;
-						m_send_window.current_seq += to_send;
-						i += to_send;
-					}
-
-					m_send_window.last_send_ms = current_ms;
-
-					continue;
+					m_next_flags = FIN | ACK;
+					m_next_state = State::FinWait1;
 				}
 			}
 
+			if (m_next_flags)
+			{
+				ASSERT(m_connection_info.has_value());
+				auto* target_address = reinterpret_cast<const sockaddr*>(&m_connection_info->address);
+				auto target_address_len = m_connection_info->address_len;
+				if (auto ret = m_network_layer.sendto(*this, {}, target_address, target_address_len); ret.is_error())
+					dwarnln("{}", ret.error());
+				const bool hungup_before = has_hungup_impl();
+				m_state = m_next_state;
+				if (m_state == State::Established)
+					m_has_connected = true;
+				if (!hungup_before && has_hungup_impl())
+					epoll_notify(EPOLLHUP);
+				continue;
+			}
+
+			if (m_send_window.data_size > 0 && m_send_window.current_ack - m_send_window.has_ghost_byte > m_send_window.start_seq)
+			{
+				uint32_t acknowledged_bytes = m_send_window.current_ack - m_send_window.start_seq - m_send_window.has_ghost_byte;
+				ASSERT(acknowledged_bytes <= m_send_window.data_size);
+
+				m_send_window.data_size -= acknowledged_bytes;
+				m_send_window.start_seq += acknowledged_bytes;
+
+				if (m_send_window.data_size > 0)
+				{
+					auto* send_buffer = reinterpret_cast<uint8_t*>(m_send_window.buffer->vaddr());
+					memmove(send_buffer, send_buffer + acknowledged_bytes, m_send_window.data_size);
+				}
+
+				m_send_window.sent_size -= acknowledged_bytes;
+
+				epoll_notify(EPOLLOUT);
+
+				dprintln_if(DEBUG_TCP, "Target acknowledged {} bytes", acknowledged_bytes);
+
+				continue;
+			}
+
+			const bool should_retransmit = m_send_window.data_size > 0 && current_ms >= m_send_window.last_send_ms + retransmit_timeout_ms;
+
+			if (m_send_window.data_size > m_send_window.sent_size || should_retransmit)
+			{
+				ASSERT(m_connection_info.has_value());
+				auto* target_address = reinterpret_cast<const sockaddr*>(&m_connection_info->address);
+				auto target_address_len = m_connection_info->address_len;
+
+				const uint32_t send_base = should_retransmit ? 0 : m_send_window.sent_size;
+
+				const uint32_t total_send = BAN::Math::min<uint32_t>(m_send_window.data_size - send_base, m_send_window.scaled_size());
+
+				m_send_window.current_seq = m_send_window.start_seq;
+
+				auto* send_buffer = reinterpret_cast<const uint8_t*>(m_send_window.buffer->vaddr() + send_base);
+				for (uint32_t i = 0; i < total_send;)
+				{
+					const uint32_t to_send = BAN::Math::min(total_send - i, m_send_window.mss);
+
+					auto message = BAN::ConstByteSpan(send_buffer + i, to_send);
+
+					m_next_flags = ACK;
+					if (auto ret = m_network_layer.sendto(*this, message, target_address, target_address_len); ret.is_error())
+					{
+						dwarnln("{}", ret.error());
+						break;
+					}
+
+					dprintln_if(DEBUG_TCP, "Sent {} bytes", to_send);
+
+					m_send_window.sent_size += to_send;
+					m_send_window.current_seq += to_send;
+					i += to_send;
+				}
+
+				m_send_window.last_send_ms = current_ms;
+
+				continue;
+			}
+
 			m_thread_blocker.unblock();
-			m_thread_blocker.block_with_wake_time_ms(current_ms + retransmit_timeout_ms);
+			m_thread_blocker.block_with_wake_time_ms(current_ms + retransmit_timeout_ms, &m_mutex);
 		}
 
 		m_thread_blocker.unblock();

kernel/kernel/Networking/UDPSocket.cpp

@@ -1,3 +1,4 @@
+#include <kernel/Lock/SpinLockAsMutex.h>
 #include <kernel/Memory/Heap.h>
 #include <kernel/Networking/UDPSocket.h>
 #include <kernel/Thread.h>
@@ -93,12 +94,12 @@ namespace Kernel
 		}
 		ASSERT(m_port != PORT_NONE);
 
-		auto state = m_packet_lock.lock();
+		SpinLockGuard guard(m_packet_lock);
+
 		while (m_packets.empty())
 		{
-			m_packet_lock.unlock(state);
-			TRY(Thread::current().block_or_eintr_indefinite(m_packet_thread_blocker));
-			state = m_packet_lock.lock();
+			SpinLockGuardAsMutex smutex(guard);
+			TRY(Thread::current().block_or_eintr_indefinite(m_packet_thread_blocker, &smutex));
 		}
 
 		auto packet_info = m_packets.front();
@@ -120,8 +121,6 @@ namespace Kernel
 
 		m_packet_total_size -= packet_info.packet_size;
 
-		m_packet_lock.unlock(state);
-
 		if (address && address_len)
 		{
 			if (*address_len > (socklen_t)sizeof(sockaddr_storage))

kernel/kernel/Networking/UNIX/Socket.cpp

@@ -1,5 +1,6 @@
 #include <BAN/HashMap.h>
 #include <kernel/FS/VirtualFileSystem.h>
+#include <kernel/Lock/SpinLockAsMutex.h>
 #include <kernel/Networking/NetworkManager.h>
 #include <kernel/Networking/UNIX/Socket.h>
 #include <kernel/Scheduler.h>
@@ -16,6 +17,8 @@ namespace Kernel
 
 	static constexpr size_t s_packet_buffer_size = 10 * PAGE_SIZE;
 
+	// FIXME: why is this using spinlocks instead of mutexes??
+
 	BAN::ErrorOr<BAN::RefPtr<UnixDomainSocket>> UnixDomainSocket::create(Socket::Type socket_type, const Socket::Info& info)
 	{
 		auto socket = TRY(BAN::RefPtr<UnixDomainSocket>::create(socket_type, info));
@@ -91,13 +94,16 @@ namespace Kernel
 		if (!connection_info.listening)
 			return BAN::Error::from_errno(EINVAL);
 
-		while (connection_info.pending_connections.empty())
-			TRY(Thread::current().block_or_eintr_indefinite(connection_info.pending_thread_blocker));
 
 		BAN::RefPtr<UnixDomainSocket> pending;
 
 		{
-			SpinLockGuard _(connection_info.pending_lock);
+			SpinLockGuard guard(connection_info.pending_lock);
+
+			SpinLockGuardAsMutex smutex(guard);
+			while (connection_info.pending_connections.empty())
+				TRY(Thread::current().block_or_eintr_indefinite(connection_info.pending_thread_blocker, &smutex));
+
 			pending = connection_info.pending_connections.front();
 			connection_info.pending_connections.pop();
 			connection_info.pending_thread_blocker.unblock();
@@ -176,16 +182,18 @@ namespace Kernel
 		for (;;)
 		{
 			auto& target_info = target->m_info.get<ConnectionInfo>();
+
+			SpinLockGuard guard(target_info.pending_lock);
+
+			if (target_info.pending_connections.size() < target_info.pending_connections.capacity())
 			{
-				SpinLockGuard _(target_info.pending_lock);
-				if (target_info.pending_connections.size() < target_info.pending_connections.capacity())
-				{
-					MUST(target_info.pending_connections.push(this));
-					target_info.pending_thread_blocker.unblock();
-					break;
-				}
+				MUST(target_info.pending_connections.push(this));
+				target_info.pending_thread_blocker.unblock();
+				break;
 			}
-			TRY(Thread::current().block_or_eintr_indefinite(target_info.pending_thread_blocker));
+
+			SpinLockGuardAsMutex smutex(guard);
+			TRY(Thread::current().block_or_eintr_indefinite(target_info.pending_thread_blocker, &smutex));
 		}
 
 		target->epoll_notify(EPOLLIN);
@@ -269,9 +277,8 @@ namespace Kernel
 		auto state = m_packet_lock.lock();
 		while (m_packet_sizes.full() || m_packet_size_total + packet.size() > s_packet_buffer_size)
 		{
-			m_packet_lock.unlock(state);
-			TRY(Thread::current().block_or_eintr_indefinite(m_packet_thread_blocker));
-			state = m_packet_lock.lock();
+			SpinLockAsMutex smutex(m_packet_lock, state);
+			TRY(Thread::current().block_or_eintr_indefinite(m_packet_thread_blocker, &smutex));
 		}
 
 		uint8_t* packet_buffer = reinterpret_cast<uint8_t*>(m_packet_buffer->vaddr() + m_packet_size_total);
@@ -405,9 +412,8 @@ namespace Kernel
 				}
 			}
 
-			m_packet_lock.unlock(state);
-			TRY(Thread::current().block_or_eintr_indefinite(m_packet_thread_blocker));
-			state = m_packet_lock.lock();
+			SpinLockAsMutex smutex(m_packet_lock, state);
+			TRY(Thread::current().block_or_eintr_indefinite(m_packet_thread_blocker, &smutex));
 		}
 
 		uint8_t* packet_buffer = reinterpret_cast<uint8_t*>(m_packet_buffer->vaddr());

kernel/kernel/Process.cpp

@@ -279,6 +279,8 @@ namespace Kernel
 					if (parent.pid() != m_parent)
 						return BAN::Iteration::Continue;
 
+					LockGuard _(parent.m_process_lock);
+
 					for (auto& child : parent.m_child_exit_statuses)
 					{
 						if (child.pid != pid())
@@ -767,13 +769,13 @@ namespace Kernel
 				return child.pid == pid;
 			};
 
+		LockGuard _(m_process_lock);
+
 		for (;;)
 		{
 			pid_t exited_pid = 0;
 			int exit_code = 0;
 			{
-				SpinLockGuard _(m_child_exit_lock);
-
 				bool found = false;
 				for (auto& child : m_child_exit_statuses)
 				{
@@ -796,7 +798,6 @@ namespace Kernel
 			{
 				if (stat_loc)
 				{
-					LockGuard _(m_process_lock);
 					TRY(validate_pointer_access(stat_loc, sizeof(stat_loc), true));
 					*stat_loc = exit_code;
 				}
@@ -810,7 +811,7 @@ namespace Kernel
 			if (options & WNOHANG)
 				return 0;
 
-			m_child_exit_blocker.block_indefinite();
+			m_child_exit_blocker.block_indefinite(&m_process_lock);
 		}
 	}
 
@@ -2609,11 +2610,7 @@ namespace Kernel
 
 		for (;;)
 		{
-			{
-				LockFreeGuard _(m_process_lock);
-				m_pthread_exit_blocker.block_with_timeout_ms(100);
-			}
-
+			TRY(Thread::current().block_or_eintr_indefinite(m_pthread_exit_blocker, &m_process_lock));
 			if (wait_thread())
 				return 0;
 		}

kernel/kernel/Scheduler.cpp

@@ -1,6 +1,7 @@
 #include <BAN/Optional.h>
 #include <BAN/Sort.h>
 #include <kernel/InterruptController.h>
+#include <kernel/Lock/Mutex.h>
 #include <kernel/Process.h>
 #include <kernel/Scheduler.h>
 #include <kernel/Thread.h>
@@ -599,7 +600,7 @@ namespace Kernel
 		return {};
 	}
 
-	void Scheduler::block_current_thread(ThreadBlocker* blocker, uint64_t wake_time_ns)
+	void Scheduler::block_current_thread(ThreadBlocker* blocker, uint64_t wake_time_ns, BaseMutex* mutex)
 	{
 		auto state = Processor::get_interrupt_state();
 		Processor::set_interrupt_state(InterruptState::Disabled);
@@ -612,9 +613,23 @@ namespace Kernel
 		if (blocker)
 			blocker->add_thread_to_block_queue(m_current);
 		update_most_loaded_node_queue(m_current, &m_block_queue);
+
+		uint32_t lock_depth = 0;
+		if (mutex != nullptr)
+		{
+			ASSERT(mutex->is_locked() && mutex->locker() == m_current->thread->tid());
+			lock_depth = mutex->lock_depth();
+		}
+
+		for (uint32_t i = 0; i < lock_depth; i++)
+			mutex->unlock();
+
 		Processor::yield();
 
 		Processor::set_interrupt_state(state);
+
+		for (uint32_t i = 0; i < lock_depth; i++)
+			mutex->lock();
 	}
 
 	void Scheduler::unblock_thread(Thread* thread)

kernel/kernel/Storage/DiskCache.cpp

@@ -1,5 +1,4 @@
 #include <kernel/BootInfo.h>
-#include <kernel/Lock/LockGuard.h>
 #include <kernel/Memory/Heap.h>
 #include <kernel/Memory/PageTable.h>
 #include <kernel/Storage/DiskCache.h>

kernel/kernel/Storage/NVMe/Queue.cpp

@@ -1,4 +1,4 @@
-#include <kernel/Lock/LockGuard.h>
+#include <kernel/Lock/SpinLockAsMutex.h>
 #include <kernel/Storage/NVMe/Queue.h>
 #include <kernel/Thread.h>
 #include <kernel/Timer/Timer.h>
@@ -72,7 +72,7 @@ namespace Kernel
 		//        scheduler has put the current thread blocking.
 		//        EINTR should also be handled here.
 		while (!(m_done_mask & cid_mask) && SystemTimer::get().ms_since_boot() < start_time_ms + s_nvme_command_timeout_ms)
-			m_thread_blocker.block_with_wake_time_ms(start_time_ms + s_nvme_command_timeout_ms);
+			m_thread_blocker.block_with_wake_time_ms(start_time_ms + s_nvme_command_timeout_ms, nullptr);
 
 		if (m_done_mask & cid_mask)
 		{
@@ -87,12 +87,12 @@ namespace Kernel
 
 	uint16_t NVMeQueue::reserve_cid()
 	{
-		auto state = m_lock.lock();
+		SpinLockGuard guard(m_lock);
+
 		while (~m_used_mask == 0)
 		{
-			m_lock.unlock(state);
-			m_thread_blocker.block_with_timeout_ms(s_nvme_command_timeout_ms);
-			state = m_lock.lock();
+			SpinLockGuardAsMutex smutex(guard);
+			m_thread_blocker.block_with_timeout_ms(s_nvme_command_timeout_ms, &smutex);
 		}
 
 		uint16_t cid = 0;
@@ -104,7 +104,6 @@ namespace Kernel
 
 		m_used_mask |= (size_t)1 << cid;
 
-		m_lock.unlock(state);
 		return cid;
 	}
 

kernel/kernel/Terminal/PseudoTerminal.cpp

@@ -1,5 +1,6 @@
 #include <kernel/Device/DeviceNumbers.h>
 #include <kernel/FS/DevFS/FileSystem.h>
+#include <kernel/Lock/SpinLockAsMutex.h>
 #include <kernel/Terminal/PseudoTerminal.h>
 
 #include <BAN/ScopeGuard.h>
@@ -88,17 +89,15 @@ namespace Kernel
 
 	bool PseudoTerminalMaster::putchar(uint8_t ch)
 	{
-		{
-			SpinLockGuard _(m_buffer_lock);
+		SpinLockGuard _(m_buffer_lock);
 
-			if (m_buffer_size >= m_buffer->size())
-				return false;
+		if (m_buffer_size >= m_buffer->size())
+			return false;
 
-			reinterpret_cast<uint8_t*>(m_buffer->vaddr())[(m_buffer_tail + m_buffer_size) % m_buffer->size()] = ch;
-			m_buffer_size++;
+		reinterpret_cast<uint8_t*>(m_buffer->vaddr())[(m_buffer_tail + m_buffer_size) % m_buffer->size()] = ch;
+		m_buffer_size++;
 
-			m_buffer_blocker.unblock();
-		}
+		m_buffer_blocker.unblock();
 
 		epoll_notify(EPOLLIN);
 
@@ -107,13 +106,12 @@ namespace Kernel
 
 	BAN::ErrorOr<size_t> PseudoTerminalMaster::read_impl(off_t, BAN::ByteSpan buffer)
 	{
-		auto state = m_buffer_lock.lock();
+		SpinLockGuard guard(m_buffer_lock);
 
 		while (m_buffer_size == 0)
 		{
-			m_buffer_lock.unlock(state);
-			TRY(Thread::current().block_or_eintr_indefinite(m_buffer_blocker));
-			m_buffer_lock.lock();
+			SpinLockGuardAsMutex smutex(guard);
+			TRY(Thread::current().block_or_eintr_indefinite(m_buffer_blocker, &smutex));
 		}
 
 		const size_t to_copy = BAN::Math::min(buffer.size(), m_buffer_size);
@@ -132,8 +130,6 @@ namespace Kernel
 		m_buffer_size -= to_copy;
 		m_buffer_tail = (m_buffer_tail + to_copy) % m_buffer->size();
 
-		m_buffer_lock.unlock(state);
-
 		epoll_notify(EPOLLOUT);
 
 		return to_copy;

kernel/kernel/Terminal/TTY.cpp

@@ -92,6 +92,8 @@ namespace Kernel
 		if (flags & ~(TTY_FLAG_ENABLE_INPUT | TTY_FLAG_ENABLE_OUTPUT))
 			return BAN::Error::from_errno(EINVAL);
 
+		LockGuard _(m_mutex);
+
 		switch (command)
 		{
 			case TTY_CMD_SET:
@@ -129,12 +131,16 @@ namespace Kernel
 
 		while (true)
 		{
-			while (!TTY::current()->m_tty_ctrl.receive_input)
-				TTY::current()->m_tty_ctrl.thread_blocker.block_indefinite();
+			{
+				LockGuard _(TTY::current()->m_mutex);
+				while (!TTY::current()->m_tty_ctrl.receive_input)
+					TTY::current()->m_tty_ctrl.thread_blocker.block_indefinite(&TTY::current()->m_mutex);
+			}
 
 			while (TTY::current()->m_tty_ctrl.receive_input)
 			{
 				LockGuard _(keyboard_inode->m_mutex);
+
 				if (!keyboard_inode->can_read())
 				{
 					SystemTimer::get().sleep_ms(1);
@@ -395,10 +401,7 @@ namespace Kernel
 	BAN::ErrorOr<size_t> TTY::read_impl(off_t, BAN::ByteSpan buffer)
 	{
 		while (!m_output.flush)
-		{
-			LockFreeGuard _(m_mutex);
-			TRY(Thread::current().block_or_eintr_indefinite(m_output.thread_blocker));
-		}
+			TRY(Thread::current().block_or_eintr_indefinite(m_output.thread_blocker, &m_mutex));
 
 		if (m_output.bytes == 0)
 		{

kernel/kernel/Thread.cpp

@@ -581,27 +581,27 @@ namespace Kernel
 		return {};
 	}
 
-	BAN::ErrorOr<void> Thread::block_or_eintr_indefinite(ThreadBlocker& thread_blocker)
+	BAN::ErrorOr<void> Thread::block_or_eintr_indefinite(ThreadBlocker& thread_blocker, BaseMutex* mutex)
 	{
 		if (is_interrupted_by_signal())
 			return BAN::Error::from_errno(EINTR);
-		thread_blocker.block_indefinite();
+		thread_blocker.block_indefinite(mutex);
 		if (is_interrupted_by_signal())
 			return BAN::Error::from_errno(EINTR);
 		return {};
 	}
 
-	BAN::ErrorOr<void> Thread::block_or_eintr_or_timeout_ns(ThreadBlocker& thread_blocker, uint64_t timeout_ns, bool etimedout)
+	BAN::ErrorOr<void> Thread::block_or_eintr_or_timeout_ns(ThreadBlocker& thread_blocker, uint64_t timeout_ns, bool etimedout, BaseMutex* mutex)
 	{
 		const uint64_t wake_time_ns = SystemTimer::get().ns_since_boot() + timeout_ns;
-		return block_or_eintr_or_waketime_ns(thread_blocker, wake_time_ns, etimedout);
+		return block_or_eintr_or_waketime_ns(thread_blocker, wake_time_ns, etimedout, mutex);
 	}
 
-	BAN::ErrorOr<void> Thread::block_or_eintr_or_waketime_ns(ThreadBlocker& thread_blocker, uint64_t wake_time_ns, bool etimedout)
+	BAN::ErrorOr<void> Thread::block_or_eintr_or_waketime_ns(ThreadBlocker& thread_blocker, uint64_t wake_time_ns, bool etimedout, BaseMutex* mutex)
 	{
 		if (is_interrupted_by_signal())
 			return BAN::Error::from_errno(EINTR);
-		thread_blocker.block_with_wake_time_ns(wake_time_ns);
+		thread_blocker.block_with_wake_time_ns(wake_time_ns, mutex);
 		if (is_interrupted_by_signal())
 			return BAN::Error::from_errno(EINTR);
 		if (etimedout && SystemTimer::get().ms_since_boot() >= wake_time_ns)

kernel/kernel/ThreadBlocker.cpp

@@ -5,19 +5,19 @@
 namespace Kernel
 {
 
-	void ThreadBlocker::block_indefinite()
+	void ThreadBlocker::block_indefinite(BaseMutex* mutex)
 	{
-		Processor::scheduler().block_current_thread(this, static_cast<uint64_t>(-1));
+		Processor::scheduler().block_current_thread(this, static_cast<uint64_t>(-1), mutex);
 	}
 
-	void ThreadBlocker::block_with_timeout_ns(uint64_t timeout_ns)
+	void ThreadBlocker::block_with_timeout_ns(uint64_t timeout_ns, BaseMutex* mutex)
 	{
-		Processor::scheduler().block_current_thread(this, SystemTimer::get().ns_since_boot() + timeout_ns);
+		Processor::scheduler().block_current_thread(this, SystemTimer::get().ns_since_boot() + timeout_ns, mutex);
 	}
 
-	void ThreadBlocker::block_with_wake_time_ns(uint64_t wake_time_ns)
+	void ThreadBlocker::block_with_wake_time_ns(uint64_t wake_time_ns, BaseMutex* mutex)
 	{
-		Processor::scheduler().block_current_thread(this, wake_time_ns);
+		Processor::scheduler().block_current_thread(this, wake_time_ns, mutex);
 	}
 
 	void ThreadBlocker::unblock()

kernel/kernel/Timer/Timer.cpp

@@ -83,9 +83,7 @@ namespace Kernel
 	{
 		if (ns == 0)
 			return;
-
-		const uint64_t wake_time_ns = ns_since_boot() + ns;
-		Processor::scheduler().block_current_thread(nullptr, wake_time_ns);
+		Processor::scheduler().block_current_thread(nullptr, ns_since_boot() + ns, nullptr);
 	}
 
 	timespec SystemTimer::real_time() const

kernel/kernel/USB/Hub/HubDriver.cpp

@@ -269,7 +269,8 @@ namespace Kernel
 						m_is_init_done = true;
 					}
 
-					m_changed_port_blocker.block_with_timeout_ms(100);
+					// FIXME: race condition
+					m_changed_port_blocker.block_with_timeout_ms(100, nullptr);
 					continue;
 				}
 

kernel/kernel/USB/XHCI/Controller.cpp

@@ -322,7 +322,8 @@ namespace Kernel
 						m_ports_initialized = true;
 					}
 
-					m_port_thread_blocker.block_with_timeout_ms(100);
+					// FIXME: prevent race condition
+					m_port_thread_blocker.block_with_timeout_ms(100, nullptr);
 					expected = true;
 				}
 			}