Commit Graph

257 Commits

Author SHA1 Message Date
Stefan Kalkowski
685add4774 Use OO-means to copy capabilities (fix #182)
Whenever Native_capability or its derivation Capaility is memcpy'd no copy-
constructor/assignment-operator is used and thereby implementation of
reference-counting gets impossible for these objects. Use object-oriented
means like e.g. copy-constructor instead.
2012-05-09 20:50:56 +02:00
Christian Prochaska
cf9610a958 Implement RAM accounting 2012-05-02 16:54:18 +02:00
Christian Prochaska
4c4d4e5c63 Fix printing of signed numbers
If any operand of the '?' operator is of an unsigned type, the result
is unsigned by default. Thanks to Julian Stecklina for finding
this out.

Fixes #189.
2012-04-23 15:35:01 +02:00
Martin Stein
3236395e6a Check ownership when freeing RAM dataspaces 2012-04-20 18:39:48 +02:00
Martin Stein
d6f956e37e Test for enforcing dataspace ownership 2012-04-20 18:38:44 +02:00
Christian Prochaska
7a369bc74d Add an 'executable' flag to 'Rm_session::attach()'
With this patch clients of the RM service can state if they want a mapping
to be executable or not. This allows dataspaces to be mapped as
non-executable on Linux by default and as executable only if needed.

Partially fixes #176.
2012-04-20 11:21:19 +02:00
Norman Feske
9a00ad7ae3 Support for dynamic ROM sessions, fix #170
This patch introduces support for ROM sessions that update their
provided data during the lifetime of the session. The 'Rom_session'
interface had been extended with the new 'release()' and 'sigh()'
functions, which are needed to support the new protocol. All ROM
services have been updated to the new interface.

Furthermore, the patch changes the child policy of init
with regard to the handling of configuration files. The 'Init::Child'
used to always provide the ROM dataspace with the child's config file
via a locally implemented ROM service. However, for dynamic ROM
sessions, we need to establish a session to the real supplier of the ROM
data. This is achieved by using a new 'Child_policy_redirect_rom_file'
policy to handle the 'configfile' rather than handling the 'configfile'
case entirely within 'Child_config'.

To see the new facility in action, the new 'os/run/dynamic_config.run'
script provides a simple scenario. The config file of the test program
is provided by a service, which generates and updates the config data
at regular intervals.

In addition, new support has been added to let slaves use dynamic
reconfiguration. By using the new 'Child_policy_dynamic_rom_file', the
configuration of a slave can be changed dynamically at runtime via the
new 'configure()' function.

The config is provided as plain null-terminated string (instead of a
dataspace capability) because we need to buffer the config data anyway.
So there is no benefit of using a dataspace. For buffering configuration
data, a 'Ram_session' must be supplied. If no 'Ram_session' is specified
at construction time of a 'Slave_policy', no config is supplied to the
slave (which is still a common case).

An example for dynamically reconfiguring a slave is provided by
'os/run/dynamic_config_slave.run'.
2012-04-05 11:25:26 +02:00
Norman Feske
f150b00c0d Spelling fix 2012-04-04 17:03:34 +02:00
Christian Prochaska
d6caa73c13 Fix a compile error reported by GCC 4.7.0 2012-03-30 19:55:56 +02:00
Ivan Loskutov
fa4935627a Fix error for 7th argument call_member 2012-03-30 19:55:55 +02:00
Ivan Loskutov
59221f9c17 Fix misprint 2012-03-30 19:47:35 +02:00
Norman Feske
37bf298b37 Move 'test/cap_integrity/foc' to 'base-foc' 2012-03-28 16:28:15 +02:00
Norman Feske
d6e30c19de Replace 'Native_capability::copy_to' by accessor
The 'copy_to' function turned out to be not flexible enough to
accommodate the Noux fork mechanism. This patch removes the function,
adds an accessor for the capability destination and a compound type
'Native_capability::Raw' to be used wherever plain capability
information must be communicated.
2012-03-28 09:58:51 +02:00
Stefan Kalkowski
c1e6657f49 Rewrite cap_integrity test for Fiasco.OC (fix #161)
By commit d287b9d893 the Native_capability
class changed fundamentally in the Fiasco.OC platform code of Genode. Thereby
the cap_integrity test got incompatible with it. This commit introduces a
separate test implementation for Fiasco.OC that does semantically the same
like the old test. Please refer to issue #161.
2012-03-23 14:34:58 +01:00
Stefan Kalkowski
bb90a2d41d Let cap_integrity test be more expressive
By using the `compare_output_to` method from the run tool instead of using
regexp in the cap_integrity run-script, the test outputs the undesired lines
instead of just signaling that the test failed.
2012-03-23 14:34:09 +01:00
Norman Feske
48739422ac Validate liveliness of signal contexts
We cannot trust signal imprints received with signals to represent valid
pointers to signal contexts. After a signal context has been dissolved
from its receiver, a signal corresponding to the context might still be
in flight. Hence, we need a facility to check received signal imprints
against the list of valid contexts at reception time. The new
'Signal_context_registry' is a very simple attempt to create such a
facility.
2012-03-21 21:37:15 +01:00
Stefan Kalkowski
e34adf883c Introduce design pattern for uncopyable objects.
Introduce a new Noncopyable class, one can derive from to mark a class of
objects to be uncopyable. This way the compiler can check for any violations
for you.
2012-03-16 18:24:52 +01:00
Stefan Kalkowski
ae8cf5f44d Rename tid() to dst() in Native_capability.
As suggested by Norman in the discussion of issue #145, this commit
renames the tid() accessor in Native_capability to dst().
2012-03-10 15:52:19 +01:00
Stefan Kalkowski
42b7c01685 Unify policy name for Native_capability_tpl.
This commit unifies the policy name for the template argument for
Native_capability_tpl to Cap_dst_policy, like suggested by Norman in the
discussion resulting from issue #145. Moreover, it takes the memcpy
operation for copying a Native_capability out of the template, which is
included by a significant bunch of files, and separates it in a library,
analog to the suggestion in issue #145.
2012-03-10 15:52:13 +01:00
Norman Feske
35384faa7a Follow-up tweaks for issue #145
Because we use to pass a policy class to 'Native_capability_tpl'
we can pass the dst type as part of the policy instead of as
a separate template argument. This patch also adds documentation
of the POLICY interface as expected by 'Native_capability_tpl'.
2012-03-08 19:28:32 +01:00
Stefan Kalkowski
c9c21ad39c Merge Native_capability implementations (fix #145).
This patch unifies the Native_capability classes for the different kernel
platforms by introducing an appropriate template, and eliminating naming
differences. Please refer issue #145.
2012-03-08 18:42:39 +01:00
Stefan Kalkowski
9992efed03 Don't memcpy the parent capability. Fix #144.
To give the platform developer more freedom in how the Native_capability
class is internally implemented (e.g. turning it into a smart-pointer),
this patch removes the memcpy operation, when transfering the parent-capability
to a new process from the generic code, and let the implementation of the
platform-specific Native_capability decide how the transfer has to be done.
Please refer to issue #144.
2012-03-08 18:41:38 +01:00
Stefan Kalkowski
fa377f0df5 Make local capability interface explicit. Fix #139.
Introduce a factory-, and dereference method for local capabilities. These are
capabilities that reference objects of services, which are known to be used
protection-domain internally only. To support the new Capability class methods
a protected constructor and accessor to the local object's pointer is needed
in the platform's capability base-classes. For further discussion details please
refer issue #139.
2012-03-08 18:40:48 +01:00
Norman Feske
56586ae7b0 Add 'base/src/test/ada', fix #146 2012-03-08 12:32:08 +01:00
Christian Prochaska
0bf6a24d61 Add 'select_from_repositories' in 'dep_lib.mk'
Fixes #142.
2012-03-06 17:09:54 +01:00
Norman Feske
e4cb3ed929 Follow-up for spin-lock unification, ref #123 2012-03-01 10:57:05 +01:00
Stefan Kalkowski
319813a59b Merge spin-lock implementations
Separate spin-lock implementation from lock-implementation and put it into a
non-public header, so it can be re-used by the DDE kit's and Fiasco.OC's
capability-allocator spin lock. Fixes issue #123.
2012-02-29 15:41:17 +01:00
Norman Feske
3e41ff7f23 Minor coding style fix
The 'detail' tag is not conform to the coding style. Tools may stumble
over it.
2012-02-28 08:50:15 +01:00
Sebastian Sumpf
b6e355b841 Io_mem_session, fix #128
Free unaligned ranges correctly in range allocator
2012-02-26 13:36:43 +01:00
Martin Stein
bf7a5c2b69 Review doc and style for release. ref #69 2012-02-23 10:42:12 +01:00
Martin Stein
70ae53fe3c Simplify interface of the MMIO framework, ref #69
Parameterize register and bitfield templates to always take their
bitwidth instead of the according types or width exponents as arguments.
2012-02-23 10:42:12 +01:00
Martin Stein
7044b264e6 Beautify class names in 'register.h' and 'mmio.h'
Replace 'Reg_array' in 'Genode::Mmio' by 'Register_array' and 'Subreg'
in 'Genode::Register', 'Genode::Mmio::Register'and
'Genode::Mmio::Register_array' by 'Bitfield'.

Update and beautify comments in the according headers and test programs.
2012-02-23 10:42:12 +01:00
Martin Stein
e1285335ab Replace 'Subreg_array' with 'Reg_array'.
'Reg_array' contains items whose width can be the width of the register
storage type at a max. Nethertheless they can be smaller and iterate all
subregs that are covered by the item width. The array uses as much
successive instances of its storage type as needed.

The test 'run/util_mmio' also tests these new features heavily.
2012-02-23 10:42:12 +01:00
Martin Stein
01bb7536dd Complement test for MMIO framework
The run script 'run/util_mmio.run' runs a test over basic
functionalities of 'Mmio::Register' and 'Mmio::Register::Subreg'. The
test covers the functions 'read' and 'bits', 'set', 'clear' and 'get'.

Inline function in 'Mmio::Register::Subreg' whose definition otherwise
looks ugly.
2012-02-23 10:42:12 +01:00
Martin Stein
9329b91aca Extract more generic parts from 'Genode::Mmio'
To accommodate CPU registers, which have a structured layout but don't
depend on a region base address, this patch introduces the generic
'Genode::Register' and 'Genode::Subreg' to 'register.h'.
'Mmio::Register' and 'Mmio::Subreg' inherit from them.
2012-02-23 10:42:11 +01:00
Martin Stein
1f75ebe9e5 First version of generic MMIO access framework
The MMIO access framework consists of an abstraction for a contiguous
MMIO area with a base address set dynamically. Within this class 'Mmio'
are declarations for 'Register' and 'Subreg'. These two can be
parameterized statically via template parameters to create arbitrary
MMIO structures.

Whereas 'Register' relies to a POD like subregion of 'Mmio', 'Subreg'
relies to a MMIO region within a specific 'Register' and therefore is
smaller or equal then the storage type of its superior 'Register'.

Furthermore with 'Reg_array' and 'Subreg_array', there exists the
possibility to handle arrays of uniform contiguous registers or subregs
by index. 'Subreg_array' therefore abstracts from the width boundary of
its superior 'Register' and handles a steady distance between its
members in addition. Both also check array size limits.

Related to issue #69.
2012-02-23 10:42:11 +01:00
Norman Feske
396a9ee273 Hook for re-establishing default LOG session 2012-02-23 10:42:11 +01:00
Norman Feske
3ddf7d2b1b Let reload_parent_cap take the new cap as agument 2012-02-23 10:42:03 +01:00
Norman Feske
decfe7c4bb Let process lib deal with fork semantics
The startup procedure of forked processes differs from Genode's
normal process creation by omitting all steps related to ELF loading
and the start of the main thread. To let the process lib support this
distinction, an invalid ELF-binary capability is handled as valid
argument now.
2012-02-22 15:56:45 +01:00
Norman Feske
759af6d9c1 Accessor to obtain parent cap of child
This is needed for the fork support of Noux.
2012-02-22 15:56:45 +01:00
Norman Feske
e4cefe58d5 Make Child's reference RAM session configurable
The 'Child' framework used to perform the transfer of session quota
using 'env()->ram_session()' as hard-wired reference account. When
locally virtualizing the RAM session supplied to the 'Child', this
policy does not work. When closing a session, core would try to transfer
session quota to the virtualized RAM service, which is of course not
possible. This patch makes the reference RAM session configable via the
'Child_policy' interface.
2012-02-22 15:56:45 +01:00
Norman Feske
f3fcb5f56f Facility for reinitializing Platform_env
The new function 'Platform_env::reload_parent_cap' triggers a reload
of the parent capability and its respective resources. It is needed
during the bootstrap of a new process forked from an existing Noux
process.
2012-02-22 15:56:45 +01:00
Alexandre Bique
42c21e4582 Console: don't use buf for '-' and '0' padding
As buf is not sized depending on the padding, if a huge padding is put
in buf then we could see an overflow.
2012-02-16 09:11:39 +01:00
Alexandre Bique
a3266f8ec7 Log console: flush sooner rather than later 2012-02-16 09:11:13 +01:00
Christian Prochaska
e6f6defaca Test capability integrity
The test application tries to print a message using init's own LOG
session without permission.

This patch fixes #106.
2012-02-15 09:26:21 +01:00
Julian Stecklina
9508cc0ed5 Fixed wrong sign extension in printf on 64 bit
This patch fixes printf errors caused by sign extension of values that
were supposed to be unsigned. Fixes #6. Also handles the case where
sizeof(long long) != sizeof(long).
2012-02-14 16:44:43 +01:00
Norman Feske
dc4f6871c3 Make argument types of min and max more flexible 2012-02-14 16:44:42 +01:00
Norman Feske
210eb98598 Support const RPC functions with no arguments
Until now, the RPC framework did not support const RPC functions. Rather
than being a limitation inherent to the concept, const RPC functions
plainly did not exist. So supporting them was not deemed too important.
However, there are uses of RPC interfaces that would benefit from a way
to declare an RPC function as const. Candidates are functions like
'Framebuffer::Session::mode()' and 'Input::Session::is_pending()'.

This patch clears the way towards declaring such functions as const.
Even though the patch is simple enough, the thorough support for
const-qualified RPC functions would double the number of overloads for
the 'call_member' function template (in 'base/include/util/meta.h'). For
this reason, the patch does support const getter functions with no
arguments only. This appears to be the most common use of such
functions.
2012-01-27 16:54:05 +01:00
Norman Feske
a107c89a8e Exceptions at construction time of dynamic objects
This patch implements the support needed to handle exceptions that occur
during the construction of objects dynamically allocated via the
'Allocator' interface. In this case, the compiler automatically invokes
a special delete operator that takes the allocator type (as supplied to
'new') as second argument. The implementation of this delete operator
has been added to the 'cxx' library. Because the operator delete is
called without the size of the object, we can use only those allocators
that ignore the size argument of the free function and print a warning
otherwise. The added 'Allocator::need_size_for_free()' function is used
to distinguish safe and unsafe allocators.
2012-01-26 21:19:30 +01:00
Martin Stein
2313393e88 Remove support for '%b' in 'printf'. ref #76
Also adapt according buffer sizes in 'Format_command'.
2012-01-25 13:09:44 +01:00
Norman Feske
b1b59fe8a6 Support for building all libs via 'make lib'
Normally, the build system creates libraries as mere side effects of
building targets. There is no way to explicitly trigger the build of
libraries only. However, in some circumstances (for example for testing
the thorough build of all libraries) a mechanism for explicitly building
libraries would be convenient. This patch implements this feature. It
consists of two changes.

The new pseudo target at 'base/src/lib/target.mk' gathers all libraries
that are available in all repositories specified for the build directory
and makes its target depend on them. This way, by building 'lib', all
libraries would be traversed. However, in the (likely) situation that
those libraries include one or more invalid libraries (libraries with
unsatisfied build requirements), the build system would skip the target.

Hence, the second change introduces a new condition 'FORCE_BUILD_LIBS'
to the build system. By setting this variable to 'yes' in the 'target.mk'
file, we let the build system to traverse library dependencies for
all valid libraries regardless of the presence of any invalid library.
2012-01-24 18:56:35 +01:00
Norman Feske
91f59690c4 Handle corner case in nested RM handling
When using an ELF image as returned from the iso9660 server, such an
image is represented as a managed dataspace composed of various portions
of one RAM dataspace, each portion attached with a different offset.
Now, when mapping the text segment of the ELF image (usually starting at
0x1000 within the image), the code mapped at 0x1000 may correspond to
any offset within the RAM dataspace used by the iso9660 server. In
particular, the src-fault address (the one within the RAM dataspace) may
be higher than dst-fault address (somewhere just above 0x1000 where a
page-fault occurred). Thereby, 'curr_rm_base' may become negative
during the reverse lookup of 'Rm_client::pager'. This corner case used
to let the 'Fault_area::constrain' function return an invalid fault
area, and thereby let the reverse lookup fail. The improved version
explicitly checks for the address overflow condition and tries to
constrain the dst fault address to the largest possible log2 page within
the positive address range.
2012-01-23 21:04:57 +01:00
Norman Feske
08ce32215d Bump year in copyright headers to 2012 2012-01-03 15:35:05 +01:00
Genode Labs
d1891e8a27 Merge final fixes from internal repositories 2011-12-23 14:04:29 +01:00
Norman Feske
3d5cfde313 Signal accounting in the explicit-reply path
Properly account signal count in the explicit-reply path (when source-
client gets immediately unblocked by 'signal_session_component::submit').
This patch prevents the delivery of superfluous signals with num == 0.
2011-12-22 17:20:45 +01:00
Norman Feske
defd6a9b58 Use POSIX threads in Linux/Genode hybrids
- Let hybrid Linux/Genode programs use POSIX threads for the
  implementation of the Thread API.
- Prevent linkage of cxx library to hybrid Linux/Genode programs because
  the cxx functionality is covered by glibc.
2011-12-22 17:17:44 +01:00
Genode Labs
da4e1feaa5 Imported Genode release 11.11 2011-12-22 16:19:25 +01:00