genode/repos/base/src/test/rm_fault/main.cc

244 lines
6.1 KiB
C++
Raw Normal View History

2011-12-22 16:19:25 +01:00
/*
* \brief Test program for raising and handling region-manager faults
* \author Norman Feske
* \date 2008-09-24
*
* This program starts itself as child. When started, it first determines
* wheather it is parent or child by requesting a RM session. Because the
* program blocks all session-creation calls for the RM service, each program
* instance can determine its parent or child role by the checking the result
* of the session creation.
2011-12-22 16:19:25 +01:00
*/
/*
* Copyright (C) 2008-2017 Genode Labs GmbH
2011-12-22 16:19:25 +01:00
*
* This file is part of the Genode OS framework, which is distributed
* under the terms of the GNU Affero General Public License version 3.
2011-12-22 16:19:25 +01:00
*/
#include <base/component.h>
#include <base/log.h>
2011-12-22 16:19:25 +01:00
#include <base/child.h>
#include <rm_session/connection.h>
#include <base/attached_ram_dataspace.h>
2011-12-22 16:19:25 +01:00
using namespace Genode;
2011-12-22 16:19:25 +01:00
/***********
** Child **
***********/
enum { MANAGED_ADDR = 0x10000000 };
void read_at(addr_t addr)
{
log("perform read operation at ", Hex(addr));
2011-12-22 16:19:25 +01:00
int value = *(int *)addr;
log("read value ", Hex(value));
2011-12-22 16:19:25 +01:00
}
void modify(addr_t addr)
{
log("modify memory at ", Hex(addr), " to ", Hex(++(*(int *)addr)));
2011-12-22 16:19:25 +01:00
}
void main_child()
{
log("child role started");
2011-12-22 16:19:25 +01:00
/* perform illegal access */
read_at(MANAGED_ADDR);
while (true)
modify(MANAGED_ADDR);
log("--- child role of region-manager fault test finished ---");
2011-12-22 16:19:25 +01:00
}
/************
** Parent **
************/
class Test_child_policy : public Child_policy
2011-12-22 16:19:25 +01:00
{
public:
2011-12-22 16:19:25 +01:00
typedef Registered<Genode::Parent_service> Parent_service;
typedef Registry<Parent_service> Parent_services;
private:
2011-12-22 16:19:25 +01:00
Env &_env;
Parent_services &_parent_services;
Signal_context_capability const _fault_handler_sigh;
2011-12-22 16:19:25 +01:00
public:
/**
* Constructor
*/
Test_child_policy(Env &env, Parent_services &parent_services,
Signal_context_capability fault_handler_sigh)
2011-12-22 16:19:25 +01:00
:
_env(env),
_parent_services(parent_services),
_fault_handler_sigh(fault_handler_sigh)
{ }
2011-12-22 16:19:25 +01:00
/****************************
** Child-policy interface **
****************************/
Name name() const override { return "rmchild"; }
Binary_name binary_name() const override { return "test-rm_fault"; }
2011-12-22 16:19:25 +01:00
Capability quota accounting and trading This patch mirrors the accounting and trading scheme that Genode employs for physical memory to the accounting of capability allocations. Capability quotas must now be explicitly assigned to subsystems by specifying a 'caps=<amount>' attribute to init's start nodes. Analogously to RAM quotas, cap quotas can be traded between clients and servers as part of the session protocol. The capability budget of each component is maintained by the component's corresponding PD session at core. At the current stage, the accounting is applied to RPC capabilities, signal-context capabilities, and dataspace capabilities. Capabilities that are dynamically allocated via core's CPU and TRACE service are not yet covered. Also, the capabilities allocated by resource multiplexers outside of core (like nitpicker) must be accounted by the respective servers, which is not covered yet. If a component runs out of capabilities, core's PD service prints a warning to the log. To observe the consumption of capabilities per component in detail, the PD service is equipped with a diagnostic mode, which can be enabled via the 'diag' attribute in the target node of init's routing rules. E.g., the following route enables the diagnostic mode for the PD session of the "timer" component: <default-route> <service name="PD" unscoped_label="timer"> <parent diag="yes"/> </service> ... </default-route> For subsystems based on a sub-init instance, init can be configured to report the capability-quota information of its subsystems by adding the attribute 'child_caps="yes"' to init's '<report>' config node. Init's own capability quota can be reported by adding the attribute 'init_caps="yes"'. Fixes #2398
2017-05-08 21:35:43 +02:00
Pd_session &ref_pd() override { return _env.pd(); }
Pd_session_capability ref_pd_cap() const override { return _env.pd_session_cap(); }
Capability quota accounting and trading This patch mirrors the accounting and trading scheme that Genode employs for physical memory to the accounting of capability allocations. Capability quotas must now be explicitly assigned to subsystems by specifying a 'caps=<amount>' attribute to init's start nodes. Analogously to RAM quotas, cap quotas can be traded between clients and servers as part of the session protocol. The capability budget of each component is maintained by the component's corresponding PD session at core. At the current stage, the accounting is applied to RPC capabilities, signal-context capabilities, and dataspace capabilities. Capabilities that are dynamically allocated via core's CPU and TRACE service are not yet covered. Also, the capabilities allocated by resource multiplexers outside of core (like nitpicker) must be accounted by the respective servers, which is not covered yet. If a component runs out of capabilities, core's PD service prints a warning to the log. To observe the consumption of capabilities per component in detail, the PD service is equipped with a diagnostic mode, which can be enabled via the 'diag' attribute in the target node of init's routing rules. E.g., the following route enables the diagnostic mode for the PD session of the "timer" component: <default-route> <service name="PD" unscoped_label="timer"> <parent diag="yes"/> </service> ... </default-route> For subsystems based on a sub-init instance, init can be configured to report the capability-quota information of its subsystems by adding the attribute 'child_caps="yes"' to init's '<report>' config node. Init's own capability quota can be reported by adding the attribute 'init_caps="yes"'. Fixes #2398
2017-05-08 21:35:43 +02:00
Ram_session &ref_ram() override { return _env.ram(); }
Ram_session_capability ref_ram_cap() const override { return _env.ram_session_cap(); }
void init(Ram_session &session, Ram_session_capability cap) override
{
enum { CHILD_QUOTA = 1*1024*1024 };
session.ref_account(_env.ram_session_cap());
_env.ram().transfer_quota(cap, Ram_quota{CHILD_QUOTA});
}
void init(Pd_session &session, Pd_session_capability cap) override
2011-12-22 16:19:25 +01:00
{
Capability quota accounting and trading This patch mirrors the accounting and trading scheme that Genode employs for physical memory to the accounting of capability allocations. Capability quotas must now be explicitly assigned to subsystems by specifying a 'caps=<amount>' attribute to init's start nodes. Analogously to RAM quotas, cap quotas can be traded between clients and servers as part of the session protocol. The capability budget of each component is maintained by the component's corresponding PD session at core. At the current stage, the accounting is applied to RPC capabilities, signal-context capabilities, and dataspace capabilities. Capabilities that are dynamically allocated via core's CPU and TRACE service are not yet covered. Also, the capabilities allocated by resource multiplexers outside of core (like nitpicker) must be accounted by the respective servers, which is not covered yet. If a component runs out of capabilities, core's PD service prints a warning to the log. To observe the consumption of capabilities per component in detail, the PD service is equipped with a diagnostic mode, which can be enabled via the 'diag' attribute in the target node of init's routing rules. E.g., the following route enables the diagnostic mode for the PD session of the "timer" component: <default-route> <service name="PD" unscoped_label="timer"> <parent diag="yes"/> </service> ... </default-route> For subsystems based on a sub-init instance, init can be configured to report the capability-quota information of its subsystems by adding the attribute 'child_caps="yes"' to init's '<report>' config node. Init's own capability quota can be reported by adding the attribute 'init_caps="yes"'. Fixes #2398
2017-05-08 21:35:43 +02:00
session.ref_account(_env.pd_session_cap());
_env.pd().transfer_quota(cap, Cap_quota{20});
Region_map_client address_space(session.address_space());
address_space.fault_handler(_fault_handler_sigh);
}
Service &resolve_session_request(Service::Name const &service_name,
Session_state::Args const &args) override
{
Service *service = nullptr;
_parent_services.for_each([&] (Service &s) {
if (!service && service_name == s.name())
service = &s; });
if (!service)
throw Service_denied();
return *service;
2011-12-22 16:19:25 +01:00
}
};
struct Main_parent
2011-12-22 16:19:25 +01:00
{
Env &_env;
2011-12-22 16:19:25 +01:00
Signal_handler<Main_parent> _fault_handler {
_env.ep(), *this, &Main_parent::_handle_fault };
2011-12-22 16:19:25 +01:00
Heap _heap { _env.ram(), _env.rm() };
2011-12-22 16:19:25 +01:00
/* parent services */
struct Parent_services : Test_child_policy::Parent_services
{
Allocator &alloc;
2011-12-22 16:19:25 +01:00
Parent_services(Allocator &alloc) : alloc(alloc)
{
static const char *names[] = {
"RAM", "PD", "CPU", "ROM", "LOG", 0 };
for (unsigned i = 0; names[i]; i++)
new (alloc) Test_child_policy::Parent_service(*this, names[i]);
}
~Parent_services()
{
for_each([&] (Test_child_policy::Parent_service &s) { destroy(alloc, &s); });
}
} _parent_services { _heap };
2011-12-22 16:19:25 +01:00
/* create child */
Test_child_policy _child_policy { _env, _parent_services, _fault_handler };
Child _child { _env.rm(), _env.ep().rpc_ep(), _child_policy };
Region_map_client _address_space { _child.pd().address_space() };
2011-12-22 16:19:25 +01:00
/* dataspace used for creating shared memory between parent and child */
Attached_ram_dataspace _ds { _env.ram(), _env.rm(), 4096 };
2011-12-22 16:19:25 +01:00
unsigned _fault_cnt = 0;
2011-12-22 16:19:25 +01:00
long volatile &_child_value() { return *_ds.local_addr<long volatile>(); }
void _handle_fault()
{
if (_fault_cnt++ == 4) {
log("--- parent role of region-manager fault test finished ---");
_env.parent().exit(0);
}
2011-12-22 16:19:25 +01:00
log("received region-map fault signal, request fault state");
Region_map::State state = _address_space.state();
2011-12-22 16:19:25 +01:00
char const *state_name =
state.type == Region_map::State::READ_FAULT ? "READ_FAULT" :
state.type == Region_map::State::WRITE_FAULT ? "WRITE_FAULT" :
state.type == Region_map::State::EXEC_FAULT ? "EXEC_FAULT" : "READY";
log("rm session state is ", state_name, ", pf_addr=", Hex(state.addr));
2011-12-22 16:19:25 +01:00
/* ignore spuriuous fault signal */
if (state.type == Region_map::State::READY) {
log("ignoring spurious fault signal");
return;
2011-12-22 16:19:25 +01:00
}
addr_t child_virt_addr = state.addr & ~(4096 - 1);
/* allocate dataspace to resolve the fault */
log("attach dataspace to the child at ", Hex(child_virt_addr));
_child_value() = 0x1234;
2011-12-22 16:19:25 +01:00
_address_space.attach_at(_ds.cap(), child_virt_addr);
2011-12-22 16:19:25 +01:00
/* poll until our child modifies the dataspace content */
while (_child_value() == 0x1234);
2011-12-22 16:19:25 +01:00
log("child modified dataspace content, new value is ",
Hex(_child_value()));
2011-12-22 16:19:25 +01:00
log("revoke dataspace from child");
_address_space.detach((void *)child_virt_addr);
2011-12-22 16:19:25 +01:00
}
Main_parent(Env &env) : _env(env) { }
};
2011-12-22 16:19:25 +01:00
void Component::construct(Env &env)
2011-12-22 16:19:25 +01:00
{
log("--- region-manager fault test ---");
2011-12-22 16:19:25 +01:00
try {
/*
* Distinguish parent from child by requesting an service that is only
* available to the parent.
*/
Rm_connection rm(env);
static Main_parent parent(env);
log("-- parent role started --");
}
catch (Service_denied) {
2011-12-22 16:19:25 +01:00
main_child();
}
}