Commit Graph

87 Commits

Author SHA1 Message Date
Alexander Boettcher
2726740d6b NOVA: enable specifying a receive index for IPC
Extend Native_capability type to hold a specific selector index where the to
be received cap during a IPC should be mapped to. This feature is required to
place created caps by the cap_session at specific indexes. This feature is
used by Vancouver to setup the virtualization exception portals (created by
the cap_session) at the intended indexes.
2012-08-09 11:09:42 +02:00
Alexander Boettcher
f68482f87a NOVA: add support to cpu_session to create vCPUs
Extend base-nova specific cpu_session to create also vCPUs.
2012-08-09 11:09:42 +02:00
Alexander Boettcher
4342d0d234 NOVA: let thread die if SM cap is invalid
Patch prevents following bugs:

* In sleep_forever the thread return from semaphore down if cap is revoked
  during destruction of a thread. This causes an endless loop consuming time
  not available for other threads.
* In lock_helper and cap_sel_alloc the thread return from the lock() method
  even if the semaphore down call failed because of an revoked semaphore.

  This lead to the situation that a thread subject to de-construction returns
  from the lock method, but not holding the lock, entering the critical section
  and modifying state inside the critical section. Another thread in parallel
  already in the critical section or entering the critical section also
  modifies the state. This lead to curious bugs ...
* thread_nova, thread_start, irq_session
  Detect early bugs if the SM is gone unexpectedly where it should never
  happen.
2012-08-09 11:09:42 +02:00
Alexander Boettcher
e3a7d2220d NOVA: Use everywhere same value for a invalid cap 2012-08-09 11:09:42 +02:00
Alexander Boettcher
e44648e1ab NOVA: remove pd selector from non Core code
Pd selector isn't used beside core anymore - remove all occurrences inside base
code.
2012-08-09 11:09:41 +02:00
Alexander Boettcher
b6ea5714d7 NOVA: create sm solely in core
Any kernel objects are now created solely by core - namely pt, ec, sm and sc.
2012-08-09 11:09:41 +02:00
Alexander Boettcher
5620eca7b9 NOVA: force to map cap in pd_session::assing_pd 2012-08-09 11:09:41 +02:00
Alexander Boettcher
4155585267 NOVA: Adjust native_capability type
It now can hold a right bit used during IPC to demote rights of the to be
transfered capability.

The local_name field in the native_capability type is not needed anymore
in NOVA. Simplify the class, remove it from constructors and adapt all
invocations in base-nova.

Unfortunately local_name in struct Raw is still used in generic base code
(process.cc, reload_parent_cap.cc), however has no effect in base-nova.
2012-08-09 11:09:41 +02:00
Alexander Boettcher
7550f243ad NOVA: use cap_session to allocate portals 2012-08-09 11:09:41 +02:00
Alexander Boettcher
0a89d8dbb4 NOVA: extend cpu_session for base-nova 2012-08-09 11:09:40 +02:00
Alexander Boettcher
cb859a4785 NOVA: extend cap session for base-nova 2012-08-09 11:09:40 +02:00
Alexander Boettcher
ddd4b9633d NOVA: add rights mask and enums for kernel errors 2012-08-09 11:09:40 +02:00
Alexander Boettcher
755ed3dc90 NOVA: Use solely unsigned types for selectors 2012-08-09 11:09:40 +02:00
Alexander Boettcher
998ebfc01b NOVA: Fix cleanup of received capabilities, #268
MsgBuf has to keep the number of received capabilities in order
to free/know correctly unused and unwanted capabilities. Explicitly
call rcv_msg->post_ipc to store this information in a MsgBuf.

Don't reset rcv_msg in ipc.cc, since this is used during
un-marshalling of caps in ipc.h afterwards. The MsgBuf is reseted when its
de-constructor is called.
2012-08-09 10:24:01 +02:00
Alexander Boettcher
e829288069 NOVA: remove global unique ids for user objects
With this patch solely the local ids are used, no global unique ids
are transfered anymore during IPC.

demo.run, signal.run, noux_tool_chain.run works up to the same
point as before the patches for issue #268.

Fixes #268
2012-08-09 10:24:01 +02:00
Alexander Boettcher
2b161b7aff NOVA: use translate feature of kernel, issue #268
Kernel patch:
Introduce a transfer item type to express that a cap should be translated
and if this fails to map it instead.

It would be possible without this combined transfer item type however
with additional overhead. In this case Genode/NOVA would
have to map and translate all caps used as parameter in IPC. It would look
like this:
* If the map and translation succeed, the cap at the new cap index
  would have to be revoked. Then the translated cap index can be used.
* If the map succeeds and the translation fails then the mapped cap index
  can be used.
* It would become complicated when multiple caps are mapped and translated
  and only some of the translation succeed. In such cases Genode would have
  to figure out the right relation of translated/mapped and not
  translated/mapped caps. It would require to make some assumption about the
  order how translated/mapped caps are reported at the UTCB by the kernel.
All the points above lead to the decision to create a separate transfer item
type for that.

Genode:
Most the times the translation succeeds, mapping of caps happens either
seldom. This takes now a bit the pressure of not enough aligned receive
cap windows as described in issue #247.

The patch mainly adds adjustments to handle the
translated and mapped caps correctly especially during freeing of the
receive window (don't free translated cap indexes).

Fixes #268
2012-08-09 10:24:00 +02:00
Alexander Boettcher
44ef8912d6 Add a bit array and bit allocator, issue #247
Add a allocator using bit maps to maintain used/unused caps.
It supports the allocation of 2^n aligned caps solely and
freeing of caps.

Fixes #247
2012-08-09 10:23:55 +02:00
Alexander Boettcher
4960370602 NOVA: fix some enum *_MASK to fit for 32 as 64 bit
The BASE_MASK and QUANTUM_MASK fitted only for 32 bit, for 64 bit
they are bigger. Adjust them to fit for both architectures.
2012-07-23 14:05:58 +02:00
Alexander Boettcher
1d6a00f01a Cleanup: cap allocation
Allocate exc_pt_sel inside Thread_base object
instead of pager object, since it is a thread
specific characteristic.

Same for freeing of the thread capabilities:
- ec, sc, rs, exc_pt_sel is thread specific
and has nothing to do in server nor pager object.
2012-07-04 14:56:46 +02:00
Alexander Boettcher
1a94c3b623 Fix: thread identifier comparator
The invalid thread is specified as 0,0,-1 (ec cap, sc cap, sem cap).
The main thread is specified as 0,0,0.

The comparator identified "tid_main == tid_invalid" as equal,
which is obviously wrong.

The patch compares at least ec and sem cap.
2012-07-04 14:56:46 +02:00
Alexander Boettcher
cd886bff6a Move semaphore op codes to generic syscall 2012-07-04 14:56:45 +02:00
Alexander Boettcher
a4cac757e2 NOVA: Use right syscall function for ec_ctrl 2012-06-22 11:38:14 +02:00
Alexander Boettcher
0bf642ff9a Establish mappings during reply, #248
Caller thread sends echo thread mapping information. Echo thread
establish during reply the mappings.

Fixes #248
2012-06-20 19:44:08 +02:00
Alexander Boettcher
9ebbf9c9f2 Check that typed item fits on UTCB, issue #248
Check that there is enough room for a typed item on the
UTCB. Otherwise deny to add the item and return false.
Enable explicitly a return unused warning to get the right
attention.
2012-06-20 19:44:08 +02:00
Alexander Boettcher
0c2adf7ddd Msg_words are 16 bit, adjust bit mask. 2012-06-20 19:44:08 +02:00
Alexander Boettcher
67864d35f1 Structures must be dense packed, issue #248
Take care that utcb, hip, crd structure are dense packed by compiler.
2012-06-20 19:44:07 +02:00
Alexander Boettcher
4534d656a8 NOVA: Improve stability of process destruction
The UTCB of the thread cleaning up thread objects has been unmapped.
However the UTCB of the destroyed thread must be unmapped.

Objects must explicitly be made unreachable before cleaning up. The
server and pager objects must be unreachable before they can be freed.
Both object types are threads. Revoking the thread(EC) cap on NOVA
doesn't mean that the thread stops executing. All portals pointing to a
thread are still reachable by clients even if the last EC cap is gone in
user land. So it must be taken care that no portals are pointing anymore
to a thread when the associated objects are getting destroyed. This
commit handles this.

Additionally, even if the last portal is gone - there can be still an
ongoing request handled by such server/pager object/threads. For each
such object an additional portal is created. This object is called
'cleanup portal' and is only local to the object. After all portals are
revoked the cleanup portal is called. When the call returns we know that
nobody is anymore handled by the object since all remotely available
portals are gone.

Fixes #20
2012-06-20 19:44:07 +02:00
Alexander Boettcher
ae6257dce1 Use NOVA microkernel from github, add 64bit
Use git to get recent kernels from github. Adjust NOVA patch to compile
with recent github version. Patch and use makefile of NOVA microkernel
to avoid duplicated (and outdated) makefile in Genode

Furthermore, this patch adds support for using NOVA on x86_64. The
generic part of the syscall bindings has been moved to
'base-nova/include/nova/syscall-generic.h'. The 32/64-bit specific
parts are located at 'base-nova/include/32bit/nova/syscalls.h' and
'base-nova/include/64bit/nova/syscalls.h' respectively.

On x86_64, the run environment boots qemu using the Pulsar boot loader
because GRUB legacy does not support booting 64bit ELF executables.

In addition to the NOVA-specific changes in base-nova, this patch
rectifies compile-time warnings or build errors in the 'ports' and
'libports' repositories that are related to NOVA x86_64 (i.e., Vancouver
builds for 32bit only and needed an adaptation to NOVAs changed
bindings)

Fixes #233, fixes #234
2012-06-20 19:44:07 +02:00
Sebastian Sumpf
bbce38cb36 Do not marshal invalid capabilities on NOVA/x86
We send a local name of ~0L instead, if this is encountered during the
unmarshalling we generate an invalid 'Native_capability' (Fixes #148).
2012-03-13 16:32:23 +01:00
Stefan Kalkowski
ae8cf5f44d Rename tid() to dst() in Native_capability.
As suggested by Norman in the discussion of issue #145, this commit
renames the tid() accessor in Native_capability to dst().
2012-03-10 15:52:19 +01:00
Stefan Kalkowski
42b7c01685 Unify policy name for Native_capability_tpl.
This commit unifies the policy name for the template argument for
Native_capability_tpl to Cap_dst_policy, like suggested by Norman in the
discussion resulting from issue #145. Moreover, it takes the memcpy
operation for copying a Native_capability out of the template, which is
included by a significant bunch of files, and separates it in a library,
analog to the suggestion in issue #145.
2012-03-10 15:52:13 +01:00
Norman Feske
35384faa7a Follow-up tweaks for issue #145
Because we use to pass a policy class to 'Native_capability_tpl'
we can pass the dst type as part of the policy instead of as
a separate template argument. This patch also adds documentation
of the POLICY interface as expected by 'Native_capability_tpl'.
2012-03-08 19:28:32 +01:00
Stefan Kalkowski
c9c21ad39c Merge Native_capability implementations (fix #145).
This patch unifies the Native_capability classes for the different kernel
platforms by introducing an appropriate template, and eliminating naming
differences. Please refer issue #145.
2012-03-08 18:42:39 +01:00
Stefan Kalkowski
9992efed03 Don't memcpy the parent capability. Fix #144.
To give the platform developer more freedom in how the Native_capability
class is internally implemented (e.g. turning it into a smart-pointer),
this patch removes the memcpy operation, when transfering the parent-capability
to a new process from the generic code, and let the implementation of the
platform-specific Native_capability decide how the transfer has to be done.
Please refer to issue #144.
2012-03-08 18:41:38 +01:00
Stefan Kalkowski
fa377f0df5 Make local capability interface explicit. Fix #139.
Introduce a factory-, and dereference method for local capabilities. These are
capabilities that reference objects of services, which are known to be used
protection-domain internally only. To support the new Capability class methods
a protected constructor and accessor to the local object's pointer is needed
in the platform's capability base-classes. For further discussion details please
refer issue #139.
2012-03-08 18:40:48 +01:00
Norman Feske
08ce32215d Bump year in copyright headers to 2012 2012-01-03 15:35:05 +01:00
Genode Labs
da4e1feaa5 Imported Genode release 11.11 2011-12-22 16:19:25 +01:00