ehmry/genode
ehmry
/
genode
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity
genode/repos/base-linux/src/core/include/pd_session_component.h

113 lines
2.9 KiB
C
Raw Normal View History

Imported Genode release 11.11
2011-12-22 16:19:25 +01:00
/*
Linux: move process creation into core Genode used to create new processes by directly forking from the respective Genode parent using the process library. The forking process created a PD session at core merely for propagating the PID of the new process into core (for later destruction). This traditional mechanisms has the following disadvantages: First, the PID reported by the creating process to core cannot easily be validated by core. Therefore core has to trust the PD client to not specify a PID of an existing process, which would happen to be killed once the PD session gets destructed. This problem is documented by issue #318. Second, there is no way for a Genode process to detect the failure of its any grandchildren. The immediate parent of a faulting process could use the SIGCHLD-and-waitpid mechanism to observe its children but this mechanism does not work transitively. By performing the process creation exclusively within core, all Genode processes become immediate child processes of core. Hence, core can respond to failures of any of those processes and reflect such conditions via core's session interfaces. Furthermore, the PID associated to a PD session is locally known within core and cannot be forged anymore. In fact, there is actually no need at all to make processes aware of any PIDs of other processes. Please note that this patch breaks the 'chroot' mechanism that comes in the form of the 'os/src/app/chroot' program. Because all processes are forked from core, a chroot'ed process could sneak outside its chroot environment by just creating a new Genode process. To address this issue, the chroot mechanism must be added to core.
2012-08-15 19:14:05 +02:00
* \brief Linux-specific PD session
Imported Genode release 11.11
2011-12-22 16:19:25 +01:00
* \author Norman Feske
Linux: move process creation into core Genode used to create new processes by directly forking from the respective Genode parent using the process library. The forking process created a PD session at core merely for propagating the PID of the new process into core (for later destruction). This traditional mechanisms has the following disadvantages: First, the PID reported by the creating process to core cannot easily be validated by core. Therefore core has to trust the PD client to not specify a PID of an existing process, which would happen to be killed once the PD session gets destructed. This problem is documented by issue #318. Second, there is no way for a Genode process to detect the failure of its any grandchildren. The immediate parent of a faulting process could use the SIGCHLD-and-waitpid mechanism to observe its children but this mechanism does not work transitively. By performing the process creation exclusively within core, all Genode processes become immediate child processes of core. Hence, core can respond to failures of any of those processes and reflect such conditions via core's session interfaces. Furthermore, the PID associated to a PD session is locally known within core and cannot be forged anymore. In fact, there is actually no need at all to make processes aware of any PIDs of other processes. Please note that this patch breaks the 'chroot' mechanism that comes in the form of the 'os/src/app/chroot' program. Because all processes are forked from core, a chroot'ed process could sneak outside its chroot environment by just creating a new Genode process. To address this issue, the chroot mechanism must be added to core.
2012-08-15 19:14:05 +02:00
* \date 2012-08-15
Imported Genode release 11.11
2011-12-22 16:19:25 +01:00
*/
/*
Update copyright headers to 2013
2013-01-10 21:44:47 +01:00
* Copyright (C) 2012-2013 Genode Labs GmbH
Imported Genode release 11.11
2011-12-22 16:19:25 +01:00
*
* This file is part of the Genode OS framework, which is distributed
* under the terms of the GNU General Public License version 2.
*/
Linux: move process creation into core Genode used to create new processes by directly forking from the respective Genode parent using the process library. The forking process created a PD session at core merely for propagating the PID of the new process into core (for later destruction). This traditional mechanisms has the following disadvantages: First, the PID reported by the creating process to core cannot easily be validated by core. Therefore core has to trust the PD client to not specify a PID of an existing process, which would happen to be killed once the PD session gets destructed. This problem is documented by issue #318. Second, there is no way for a Genode process to detect the failure of its any grandchildren. The immediate parent of a faulting process could use the SIGCHLD-and-waitpid mechanism to observe its children but this mechanism does not work transitively. By performing the process creation exclusively within core, all Genode processes become immediate child processes of core. Hence, core can respond to failures of any of those processes and reflect such conditions via core's session interfaces. Furthermore, the PID associated to a PD session is locally known within core and cannot be forged anymore. In fact, there is actually no need at all to make processes aware of any PIDs of other processes. Please note that this patch breaks the 'chroot' mechanism that comes in the form of the 'os/src/app/chroot' program. Because all processes are forked from core, a chroot'ed process could sneak outside its chroot environment by just creating a new Genode process. To address this issue, the chroot mechanism must be added to core.
2012-08-15 19:14:05 +02:00
#ifndef _CORE__INCLUDE__PD_SESSION_COMPONENT_H_
#define _CORE__INCLUDE__PD_SESSION_COMPONENT_H_
Imported Genode release 11.11
2011-12-22 16:19:25 +01:00
/* Genode includes */
base: assign allocator and quota to platform pd Enable platform specific allocations and ram quota accounting for protection domains. Needed to allocate object identity references in the base-hw kernel when delegating capabilities via IPC. Moreover, it can be used to account translation table entries in the future. Ref #1443
2015-04-09 15:33:20 +02:00
#include <base/allocator.h>
Imported Genode release 11.11
2011-12-22 16:19:25 +01:00
#include <base/rpc_server.h>
Linux: move process creation into core Genode used to create new processes by directly forking from the respective Genode parent using the process library. The forking process created a PD session at core merely for propagating the PID of the new process into core (for later destruction). This traditional mechanisms has the following disadvantages: First, the PID reported by the creating process to core cannot easily be validated by core. Therefore core has to trust the PD client to not specify a PID of an existing process, which would happen to be killed once the PD session gets destructed. This problem is documented by issue #318. Second, there is no way for a Genode process to detect the failure of its any grandchildren. The immediate parent of a faulting process could use the SIGCHLD-and-waitpid mechanism to observe its children but this mechanism does not work transitively. By performing the process creation exclusively within core, all Genode processes become immediate child processes of core. Hence, core can respond to failures of any of those processes and reflect such conditions via core's session interfaces. Furthermore, the PID associated to a PD session is locally known within core and cannot be forged anymore. In fact, there is actually no need at all to make processes aware of any PIDs of other processes. Please note that this patch breaks the 'chroot' mechanism that comes in the form of the 'os/src/app/chroot' program. Because all processes are forked from core, a chroot'ed process could sneak outside its chroot environment by just creating a new Genode process. To address this issue, the chroot mechanism must be added to core.
2012-08-15 19:14:05 +02:00
#include <linux_pd_session/linux_pd_session.h>
Imported Genode release 11.11
2011-12-22 16:19:25 +01:00
Linux: move process creation into core Genode used to create new processes by directly forking from the respective Genode parent using the process library. The forking process created a PD session at core merely for propagating the PID of the new process into core (for later destruction). This traditional mechanisms has the following disadvantages: First, the PID reported by the creating process to core cannot easily be validated by core. Therefore core has to trust the PD client to not specify a PID of an existing process, which would happen to be killed once the PD session gets destructed. This problem is documented by issue #318. Second, there is no way for a Genode process to detect the failure of its any grandchildren. The immediate parent of a faulting process could use the SIGCHLD-and-waitpid mechanism to observe its children but this mechanism does not work transitively. By performing the process creation exclusively within core, all Genode processes become immediate child processes of core. Hence, core can respond to failures of any of those processes and reflect such conditions via core's session interfaces. Furthermore, the PID associated to a PD session is locally known within core and cannot be forged anymore. In fact, there is actually no need at all to make processes aware of any PIDs of other processes. Please note that this patch breaks the 'chroot' mechanism that comes in the form of the 'os/src/app/chroot' program. Because all processes are forked from core, a chroot'ed process could sneak outside its chroot environment by just creating a new Genode process. To address this issue, the chroot mechanism must be added to core.
2012-08-15 19:14:05 +02:00
/* core includes */
#include <platform_pd.h>
Integrate SIGNAL session into PD session This patch removes the SIGNAL service from core and moves its functionality to the PD session. Furthermore, it unifies the PD service implementation and terminology across the various base platforms. Issue #1841
2016-01-14 13:22:00 +01:00
#include <signal_broker.h>
Imported Genode release 11.11
2011-12-22 16:19:25 +01:00
namespace Genode {
base: redesign object pool using lambda interface Instead of returning pointers to locked objects via a lookup function, the new object pool implementation restricts object access to functors resp. lambda expressions that are applied to the objects within the pool itself. Fix #884 Fix #1658
2015-08-10 13:34:16 +02:00
class Dataspace_component;
Integrate SIGNAL session into PD session This patch removes the SIGNAL service from core and moves its functionality to the PD session. Furthermore, it unifies the PD service implementation and terminology across the various base platforms. Issue #1841
2016-01-14 13:22:00 +01:00
class Pd_session_component;
class Parent;
}
Imported Genode release 11.11
2011-12-22 16:19:25 +01:00
Propagate process labels to PD sessions On Linux, we use the session label for naming the corresponding Linux process. When looking up the processes via 'ps', the Genode process hierarchy becomes immediately visible.
2012-10-11 20:57:10 +02:00
Integrate SIGNAL session into PD session This patch removes the SIGNAL service from core and moves its functionality to the PD session. Furthermore, it unifies the PD service implementation and terminology across the various base platforms. Issue #1841
2016-01-14 13:22:00 +01:00
class Genode::Pd_session_component : public Rpc_object<Linux_pd_session, Pd_session_component>
{
private:
Imported Genode release 11.11
2011-12-22 16:19:25 +01:00
Integrate SIGNAL session into PD session This patch removes the SIGNAL service from core and moves its functionality to the PD session. Furthermore, it unifies the PD service implementation and terminology across the various base platforms. Issue #1841
2016-01-14 13:22:00 +01:00
enum { LABEL_MAX_LEN = 1024 };
enum { ROOT_PATH_MAX_LEN = 512 };
base: redesign object pool using lambda interface Instead of returning pointers to locked objects via a lookup function, the new object pool implementation restricts object access to functors resp. lambda expressions that are applied to the objects within the pool itself. Fix #884 Fix #1658
2015-08-10 13:34:16 +02:00
Integrate SIGNAL session into PD session This patch removes the SIGNAL service from core and moves its functionality to the PD session. Furthermore, it unifies the PD service implementation and terminology across the various base platforms. Issue #1841
2016-01-14 13:22:00 +01:00
unsigned long _pid;
char _label[LABEL_MAX_LEN];
char _root[ROOT_PATH_MAX_LEN];
unsigned _uid;
unsigned _gid;
Capability<Parent> _parent;
Rpc_entrypoint &_ds_ep;
Signal_broker _signal_broker;
Imported Genode release 11.11
2011-12-22 16:19:25 +01:00
Integrate SIGNAL session into PD session This patch removes the SIGNAL service from core and moves its functionality to the PD session. Furthermore, it unifies the PD service implementation and terminology across the various base platforms. Issue #1841
2016-01-14 13:22:00 +01:00
void _start(Dataspace_component *ds);
Imported Genode release 11.11
2011-12-22 16:19:25 +01:00
Integrate SIGNAL session into PD session This patch removes the SIGNAL service from core and moves its functionality to the PD session. Furthermore, it unifies the PD service implementation and terminology across the various base platforms. Issue #1841
2016-01-14 13:22:00 +01:00
public:
Imported Genode release 11.11
2011-12-22 16:19:25 +01:00
Integrate SIGNAL session into PD session This patch removes the SIGNAL service from core and moves its functionality to the PD session. Furthermore, it unifies the PD service implementation and terminology across the various base platforms. Issue #1841
2016-01-14 13:22:00 +01:00
/**
* Constructor
*
* \param ds_ep entrypoint where the dataspaces are managed
* \param receiver_ep entrypoint holding signal-receiver component
* objects
* \param context_ep global pool of all signal contexts
* \param md_alloc meta-data allocator
* \param args additional session arguments
*/
Pd_session_component(Rpc_entrypoint &ds_ep,
Rpc_entrypoint &receiver_ep,
Rpc_entrypoint &context_ep,
Allocator &md_alloc,
const char *args);
base: make PD session upgradeable Ref #1443
2015-05-05 08:50:16 +02:00
Integrate SIGNAL session into PD session This patch removes the SIGNAL service from core and moves its functionality to the PD session. Furthermore, it unifies the PD service implementation and terminology across the various base platforms. Issue #1841
2016-01-14 13:22:00 +01:00
~Pd_session_component();
Imported Genode release 11.11
2011-12-22 16:19:25 +01:00
Integrate SIGNAL session into PD session This patch removes the SIGNAL service from core and moves its functionality to the PD session. Furthermore, it unifies the PD service implementation and terminology across the various base platforms. Issue #1841
2016-01-14 13:22:00 +01:00
/**
* Register quota donation at allocator guard
*/
void upgrade_ram_quota(size_t ram_quota) { }
Imported Genode release 11.11
2011-12-22 16:19:25 +01:00
Linux: move process creation into core Genode used to create new processes by directly forking from the respective Genode parent using the process library. The forking process created a PD session at core merely for propagating the PID of the new process into core (for later destruction). This traditional mechanisms has the following disadvantages: First, the PID reported by the creating process to core cannot easily be validated by core. Therefore core has to trust the PD client to not specify a PID of an existing process, which would happen to be killed once the PD session gets destructed. This problem is documented by issue #318. Second, there is no way for a Genode process to detect the failure of its any grandchildren. The immediate parent of a faulting process could use the SIGCHLD-and-waitpid mechanism to observe its children but this mechanism does not work transitively. By performing the process creation exclusively within core, all Genode processes become immediate child processes of core. Hence, core can respond to failures of any of those processes and reflect such conditions via core's session interfaces. Furthermore, the PID associated to a PD session is locally known within core and cannot be forged anymore. In fact, there is actually no need at all to make processes aware of any PIDs of other processes. Please note that this patch breaks the 'chroot' mechanism that comes in the form of the 'os/src/app/chroot' program. Because all processes are forked from core, a chroot'ed process could sneak outside its chroot environment by just creating a new Genode process. To address this issue, the chroot mechanism must be added to core.
2012-08-15 19:14:05 +02:00
Integrate SIGNAL session into PD session This patch removes the SIGNAL service from core and moves its functionality to the PD session. Furthermore, it unifies the PD service implementation and terminology across the various base platforms. Issue #1841
2016-01-14 13:22:00 +01:00
/**************************
** PD session interface **
**************************/
Linux: move process creation into core Genode used to create new processes by directly forking from the respective Genode parent using the process library. The forking process created a PD session at core merely for propagating the PID of the new process into core (for later destruction). This traditional mechanisms has the following disadvantages: First, the PID reported by the creating process to core cannot easily be validated by core. Therefore core has to trust the PD client to not specify a PID of an existing process, which would happen to be killed once the PD session gets destructed. This problem is documented by issue #318. Second, there is no way for a Genode process to detect the failure of its any grandchildren. The immediate parent of a faulting process could use the SIGCHLD-and-waitpid mechanism to observe its children but this mechanism does not work transitively. By performing the process creation exclusively within core, all Genode processes become immediate child processes of core. Hence, core can respond to failures of any of those processes and reflect such conditions via core's session interfaces. Furthermore, the PID associated to a PD session is locally known within core and cannot be forged anymore. In fact, there is actually no need at all to make processes aware of any PIDs of other processes. Please note that this patch breaks the 'chroot' mechanism that comes in the form of the 'os/src/app/chroot' program. Because all processes are forked from core, a chroot'ed process could sneak outside its chroot environment by just creating a new Genode process. To address this issue, the chroot mechanism must be added to core.
2012-08-15 19:14:05 +02:00
Integrate SIGNAL session into PD session This patch removes the SIGNAL service from core and moves its functionality to the PD session. Furthermore, it unifies the PD service implementation and terminology across the various base platforms. Issue #1841
2016-01-14 13:22:00 +01:00
int bind_thread(Thread_capability);
int assign_parent(Capability<Parent>);
bool assign_pci(addr_t, uint16_t) { return false; }
Imported Genode release 11.11
2011-12-22 16:19:25 +01:00
Integrate SIGNAL session into PD session This patch removes the SIGNAL service from core and moves its functionality to the PD session. Furthermore, it unifies the PD service implementation and terminology across the various base platforms. Issue #1841
2016-01-14 13:22:00 +01:00
Signal_source_capability alloc_signal_source() override {
return _signal_broker.alloc_signal_source(); }
void free_signal_source(Signal_source_capability cap) override {
_signal_broker.free_signal_source(cap); }
Signal_context_capability
alloc_context(Signal_source_capability sig_rec_cap, unsigned long imprint) override
{
return _signal_broker.alloc_context(sig_rec_cap, imprint);
}
void free_context(Signal_context_capability cap) override {
_signal_broker.free_context(cap); }
void submit(Signal_context_capability cap, unsigned n) override {
_signal_broker.submit(cap, n); }
/******************************
** Linux-specific extension **
******************************/
void start(Capability<Dataspace> binary);
};
Imported Genode release 11.11
2011-12-22 16:19:25 +01:00
Linux: move process creation into core Genode used to create new processes by directly forking from the respective Genode parent using the process library. The forking process created a PD session at core merely for propagating the PID of the new process into core (for later destruction). This traditional mechanisms has the following disadvantages: First, the PID reported by the creating process to core cannot easily be validated by core. Therefore core has to trust the PD client to not specify a PID of an existing process, which would happen to be killed once the PD session gets destructed. This problem is documented by issue #318. Second, there is no way for a Genode process to detect the failure of its any grandchildren. The immediate parent of a faulting process could use the SIGCHLD-and-waitpid mechanism to observe its children but this mechanism does not work transitively. By performing the process creation exclusively within core, all Genode processes become immediate child processes of core. Hence, core can respond to failures of any of those processes and reflect such conditions via core's session interfaces. Furthermore, the PID associated to a PD session is locally known within core and cannot be forged anymore. In fact, there is actually no need at all to make processes aware of any PIDs of other processes. Please note that this patch breaks the 'chroot' mechanism that comes in the form of the 'os/src/app/chroot' program. Because all processes are forked from core, a chroot'ed process could sneak outside its chroot environment by just creating a new Genode process. To address this issue, the chroot mechanism must be added to core.
2012-08-15 19:14:05 +02:00
#endif /* _CORE__INCLUDE__PD_SESSION_COMPONENT_H_ */