2011-12-22 15:19:25 +00:00
|
|
|
/*
|
|
|
|
* \brief Protection domain (PD) session interface
|
|
|
|
* \author Christian Helmuth
|
2016-01-14 12:22:00 +00:00
|
|
|
* \author Norman Feske
|
2011-12-22 15:19:25 +00:00
|
|
|
* \date 2006-06-27
|
|
|
|
*/
|
|
|
|
|
|
|
|
/*
|
2017-02-20 12:23:52 +00:00
|
|
|
* Copyright (C) 2006-2017 Genode Labs GmbH
|
2011-12-22 15:19:25 +00:00
|
|
|
*
|
|
|
|
* This file is part of the Genode OS framework, which is distributed
|
2017-02-20 12:23:52 +00:00
|
|
|
* under the terms of the GNU Affero General Public License version 3.
|
2011-12-22 15:19:25 +00:00
|
|
|
*/
|
|
|
|
|
|
|
|
#ifndef _INCLUDE__PD_SESSION__PD_SESSION_H_
|
|
|
|
#define _INCLUDE__PD_SESSION__PD_SESSION_H_
|
|
|
|
|
2016-01-14 12:22:00 +00:00
|
|
|
#include <base/exception.h>
|
2020-07-10 11:04:12 +00:00
|
|
|
#include <cpu/cpu_state.h>
|
2011-12-22 15:19:25 +00:00
|
|
|
#include <session/session.h>
|
2016-04-15 13:19:22 +00:00
|
|
|
#include <region_map/region_map.h>
|
2017-05-11 18:03:28 +00:00
|
|
|
#include <base/ram_allocator.h>
|
2011-12-22 15:19:25 +00:00
|
|
|
|
2016-01-14 12:22:00 +00:00
|
|
|
namespace Genode {
|
|
|
|
struct Pd_session;
|
2016-11-06 13:26:34 +00:00
|
|
|
struct Pd_session_client;
|
2016-01-14 12:22:00 +00:00
|
|
|
struct Parent;
|
|
|
|
struct Signal_context;
|
|
|
|
}
|
2015-03-04 20:12:14 +00:00
|
|
|
|
|
|
|
|
2017-05-11 18:03:28 +00:00
|
|
|
struct Genode::Pd_session : Session, Ram_allocator
|
2015-03-04 20:12:14 +00:00
|
|
|
{
|
2017-05-24 12:41:19 +00:00
|
|
|
/**
|
|
|
|
* \noapi
|
|
|
|
*/
|
2015-03-04 20:12:14 +00:00
|
|
|
static const char *service_name() { return "PD"; }
|
|
|
|
|
2017-05-07 20:03:25 +00:00
|
|
|
/*
|
|
|
|
* A PD session consumes a dataspace capability for the session-object
|
|
|
|
* allocation, a capability for the 'Native_pd' RPC interface, its
|
|
|
|
* session capability, and the RPC capabilities for the 3 contained
|
|
|
|
* region maps.
|
2017-05-11 18:03:28 +00:00
|
|
|
*
|
|
|
|
* Furthermore, we account for the dataspace capabilities allocated during
|
|
|
|
* the component bootstrapping.
|
2017-05-07 20:03:25 +00:00
|
|
|
*/
|
2017-05-11 18:03:28 +00:00
|
|
|
enum { CAP_QUOTA = 6 + 7 };
|
2017-05-07 20:03:25 +00:00
|
|
|
|
2016-11-06 13:26:34 +00:00
|
|
|
typedef Pd_session_client Client;
|
|
|
|
|
2015-03-04 20:12:14 +00:00
|
|
|
virtual ~Pd_session() { }
|
|
|
|
|
|
|
|
/**
|
|
|
|
* Assign parent to protection domain
|
|
|
|
*
|
|
|
|
* \param parent capability of parent interface
|
|
|
|
*/
|
2016-04-14 14:29:07 +00:00
|
|
|
virtual void assign_parent(Capability<Parent> parent) = 0;
|
2016-01-14 12:22:00 +00:00
|
|
|
|
|
|
|
/**
|
|
|
|
* Assign PCI device to PD
|
|
|
|
*
|
|
|
|
* The specified address has to refer to the locally mapped PCI
|
|
|
|
* configuration space of the device.
|
|
|
|
*
|
|
|
|
* This function is solely used on the NOVA kernel.
|
|
|
|
*/
|
|
|
|
virtual bool assign_pci(addr_t pci_config_memory_address, uint16_t bdf) = 0;
|
|
|
|
|
2017-08-02 15:30:49 +00:00
|
|
|
/**
|
|
|
|
* Trigger eager insertion of page frames to page table within
|
|
|
|
* specified virtual range.
|
|
|
|
*
|
|
|
|
* If the used kernel don't support this feature, the operation will
|
|
|
|
* silently ignore the request.
|
|
|
|
*
|
|
|
|
* \param virt virtual address within the address space to start
|
|
|
|
* \param size the virtual size of the region
|
|
|
|
*
|
|
|
|
* \throw Out_of_ram
|
|
|
|
* \throw Out_of_caps
|
|
|
|
*/
|
|
|
|
virtual void map(addr_t virt, addr_t size) = 0;
|
2016-01-14 12:22:00 +00:00
|
|
|
|
|
|
|
/********************************
|
|
|
|
** Support for the signal API **
|
|
|
|
********************************/
|
|
|
|
|
|
|
|
typedef Capability<Signal_source> Signal_source_capability;
|
|
|
|
|
Capability quota accounting and trading
This patch mirrors the accounting and trading scheme that Genode employs
for physical memory to the accounting of capability allocations.
Capability quotas must now be explicitly assigned to subsystems by
specifying a 'caps=<amount>' attribute to init's start nodes.
Analogously to RAM quotas, cap quotas can be traded between clients and
servers as part of the session protocol. The capability budget of each
component is maintained by the component's corresponding PD session at
core.
At the current stage, the accounting is applied to RPC capabilities,
signal-context capabilities, and dataspace capabilities. Capabilities
that are dynamically allocated via core's CPU and TRACE service are not
yet covered. Also, the capabilities allocated by resource multiplexers
outside of core (like nitpicker) must be accounted by the respective
servers, which is not covered yet.
If a component runs out of capabilities, core's PD service prints a
warning to the log. To observe the consumption of capabilities per
component in detail, the PD service is equipped with a diagnostic
mode, which can be enabled via the 'diag' attribute in the target
node of init's routing rules. E.g., the following route enables the
diagnostic mode for the PD session of the "timer" component:
<default-route>
<service name="PD" unscoped_label="timer">
<parent diag="yes"/>
</service>
...
</default-route>
For subsystems based on a sub-init instance, init can be configured
to report the capability-quota information of its subsystems by
adding the attribute 'child_caps="yes"' to init's '<report>'
config node. Init's own capability quota can be reported by adding
the attribute 'init_caps="yes"'.
Fixes #2398
2017-05-08 19:35:43 +00:00
|
|
|
class Invalid_session : public Exception { };
|
|
|
|
class Undefined_ref_account : public Exception { };
|
2016-01-14 12:22:00 +00:00
|
|
|
class Invalid_signal_source : public Exception { };
|
|
|
|
|
|
|
|
/**
|
|
|
|
* Create a new signal source
|
|
|
|
*
|
|
|
|
* \return a cap that acts as reference to the created source
|
|
|
|
*
|
|
|
|
* The signal source provides an interface to wait for incoming signals.
|
|
|
|
*
|
Capability quota accounting and trading
This patch mirrors the accounting and trading scheme that Genode employs
for physical memory to the accounting of capability allocations.
Capability quotas must now be explicitly assigned to subsystems by
specifying a 'caps=<amount>' attribute to init's start nodes.
Analogously to RAM quotas, cap quotas can be traded between clients and
servers as part of the session protocol. The capability budget of each
component is maintained by the component's corresponding PD session at
core.
At the current stage, the accounting is applied to RPC capabilities,
signal-context capabilities, and dataspace capabilities. Capabilities
that are dynamically allocated via core's CPU and TRACE service are not
yet covered. Also, the capabilities allocated by resource multiplexers
outside of core (like nitpicker) must be accounted by the respective
servers, which is not covered yet.
If a component runs out of capabilities, core's PD service prints a
warning to the log. To observe the consumption of capabilities per
component in detail, the PD service is equipped with a diagnostic
mode, which can be enabled via the 'diag' attribute in the target
node of init's routing rules. E.g., the following route enables the
diagnostic mode for the PD session of the "timer" component:
<default-route>
<service name="PD" unscoped_label="timer">
<parent diag="yes"/>
</service>
...
</default-route>
For subsystems based on a sub-init instance, init can be configured
to report the capability-quota information of its subsystems by
adding the attribute 'child_caps="yes"' to init's '<report>'
config node. Init's own capability quota can be reported by adding
the attribute 'init_caps="yes"'.
Fixes #2398
2017-05-08 19:35:43 +00:00
|
|
|
* \throw Out_of_ram
|
|
|
|
* \throw Out_of_caps
|
2016-01-14 12:22:00 +00:00
|
|
|
*/
|
|
|
|
virtual Signal_source_capability alloc_signal_source() = 0;
|
|
|
|
|
|
|
|
/**
|
|
|
|
* Free a signal source
|
|
|
|
*
|
|
|
|
* \param cap capability of the signal source to destroy
|
|
|
|
*/
|
|
|
|
virtual void free_signal_source(Signal_source_capability cap) = 0;
|
|
|
|
|
|
|
|
/**
|
|
|
|
* Allocate signal context
|
|
|
|
*
|
|
|
|
* \param source signal source that shall provide the new context
|
|
|
|
*
|
|
|
|
*
|
|
|
|
* \param imprint opaque value that gets delivered with signals
|
|
|
|
* originating from the allocated signal-context capability
|
|
|
|
* \return new signal-context capability
|
|
|
|
*
|
Capability quota accounting and trading
This patch mirrors the accounting and trading scheme that Genode employs
for physical memory to the accounting of capability allocations.
Capability quotas must now be explicitly assigned to subsystems by
specifying a 'caps=<amount>' attribute to init's start nodes.
Analogously to RAM quotas, cap quotas can be traded between clients and
servers as part of the session protocol. The capability budget of each
component is maintained by the component's corresponding PD session at
core.
At the current stage, the accounting is applied to RPC capabilities,
signal-context capabilities, and dataspace capabilities. Capabilities
that are dynamically allocated via core's CPU and TRACE service are not
yet covered. Also, the capabilities allocated by resource multiplexers
outside of core (like nitpicker) must be accounted by the respective
servers, which is not covered yet.
If a component runs out of capabilities, core's PD service prints a
warning to the log. To observe the consumption of capabilities per
component in detail, the PD service is equipped with a diagnostic
mode, which can be enabled via the 'diag' attribute in the target
node of init's routing rules. E.g., the following route enables the
diagnostic mode for the PD session of the "timer" component:
<default-route>
<service name="PD" unscoped_label="timer">
<parent diag="yes"/>
</service>
...
</default-route>
For subsystems based on a sub-init instance, init can be configured
to report the capability-quota information of its subsystems by
adding the attribute 'child_caps="yes"' to init's '<report>'
config node. Init's own capability quota can be reported by adding
the attribute 'init_caps="yes"'.
Fixes #2398
2017-05-08 19:35:43 +00:00
|
|
|
* \throw Out_of_ram
|
|
|
|
* \throw Out_of_caps
|
2016-01-14 12:22:00 +00:00
|
|
|
* \throw Invalid_signal_source
|
|
|
|
*/
|
|
|
|
virtual Capability<Signal_context>
|
|
|
|
alloc_context(Signal_source_capability source, unsigned long imprint) = 0;
|
|
|
|
|
|
|
|
/**
|
|
|
|
* Free signal-context
|
|
|
|
*
|
|
|
|
* \param cap capability of signal-context to release
|
|
|
|
*/
|
|
|
|
virtual void free_context(Capability<Signal_context> cap) = 0;
|
|
|
|
|
|
|
|
/**
|
|
|
|
* Submit signals to the specified signal context
|
|
|
|
*
|
|
|
|
* \param context signal destination
|
|
|
|
* \param cnt number of signals to submit at once
|
|
|
|
*
|
|
|
|
* The 'context' argument does not necessarily belong to this PD session.
|
|
|
|
* Normally, it is a capability obtained from a potentially untrusted
|
|
|
|
* component. Because we cannot trust this capability, signals are not
|
|
|
|
* submitted by invoking 'cap' directly but by using it as argument to our
|
|
|
|
* trusted PD-session interface. Otherwise, a potential signal receiver
|
|
|
|
* could supply a capability with a blocking interface to compromise the
|
|
|
|
* nonblocking behaviour of the signal submission.
|
|
|
|
*/
|
|
|
|
virtual void submit(Capability<Signal_context> context, unsigned cnt = 1) = 0;
|
|
|
|
|
|
|
|
|
|
|
|
/***********************************
|
|
|
|
** Support for the RPC framework **
|
|
|
|
***********************************/
|
2015-03-04 20:12:14 +00:00
|
|
|
|
2016-01-19 19:24:22 +00:00
|
|
|
/**
|
|
|
|
* Allocate new RPC-object capability
|
|
|
|
*
|
|
|
|
* \param ep entry point that will use this capability
|
|
|
|
*
|
Capability quota accounting and trading
This patch mirrors the accounting and trading scheme that Genode employs
for physical memory to the accounting of capability allocations.
Capability quotas must now be explicitly assigned to subsystems by
specifying a 'caps=<amount>' attribute to init's start nodes.
Analogously to RAM quotas, cap quotas can be traded between clients and
servers as part of the session protocol. The capability budget of each
component is maintained by the component's corresponding PD session at
core.
At the current stage, the accounting is applied to RPC capabilities,
signal-context capabilities, and dataspace capabilities. Capabilities
that are dynamically allocated via core's CPU and TRACE service are not
yet covered. Also, the capabilities allocated by resource multiplexers
outside of core (like nitpicker) must be accounted by the respective
servers, which is not covered yet.
If a component runs out of capabilities, core's PD service prints a
warning to the log. To observe the consumption of capabilities per
component in detail, the PD service is equipped with a diagnostic
mode, which can be enabled via the 'diag' attribute in the target
node of init's routing rules. E.g., the following route enables the
diagnostic mode for the PD session of the "timer" component:
<default-route>
<service name="PD" unscoped_label="timer">
<parent diag="yes"/>
</service>
...
</default-route>
For subsystems based on a sub-init instance, init can be configured
to report the capability-quota information of its subsystems by
adding the attribute 'child_caps="yes"' to init's '<report>'
config node. Init's own capability quota can be reported by adding
the attribute 'init_caps="yes"'.
Fixes #2398
2017-05-08 19:35:43 +00:00
|
|
|
* \throw Out_of_ram if meta-data backing store is exhausted
|
|
|
|
* \throw Out_of_caps if 'cap_quota' is exceeded
|
2016-01-19 19:24:22 +00:00
|
|
|
*
|
|
|
|
* \return new RPC capability
|
|
|
|
*/
|
|
|
|
virtual Native_capability alloc_rpc_cap(Native_capability ep) = 0;
|
|
|
|
|
|
|
|
/**
|
|
|
|
* Free RPC-object capability
|
|
|
|
*
|
|
|
|
* \param cap capability to free
|
|
|
|
*/
|
|
|
|
virtual void free_rpc_cap(Native_capability cap) = 0;
|
|
|
|
|
|
|
|
|
2016-04-15 13:19:22 +00:00
|
|
|
/**************************************
|
|
|
|
** Virtual address-space management **
|
|
|
|
**************************************/
|
|
|
|
|
2020-08-20 16:51:01 +00:00
|
|
|
enum { LINKER_AREA_SIZE = 256*1024*1024UL };
|
2016-04-15 13:19:22 +00:00
|
|
|
|
|
|
|
/**
|
|
|
|
* Return region map of the PD's virtual address space
|
|
|
|
*/
|
|
|
|
virtual Capability<Region_map> address_space() = 0;
|
|
|
|
|
|
|
|
/**
|
|
|
|
* Return region map of the PD's stack area
|
|
|
|
*/
|
|
|
|
virtual Capability<Region_map> stack_area() = 0;
|
|
|
|
|
|
|
|
/**
|
|
|
|
* Return region map of the PD's linker area
|
|
|
|
*/
|
|
|
|
virtual Capability<Region_map> linker_area() = 0;
|
|
|
|
|
|
|
|
|
Capability quota accounting and trading
This patch mirrors the accounting and trading scheme that Genode employs
for physical memory to the accounting of capability allocations.
Capability quotas must now be explicitly assigned to subsystems by
specifying a 'caps=<amount>' attribute to init's start nodes.
Analogously to RAM quotas, cap quotas can be traded between clients and
servers as part of the session protocol. The capability budget of each
component is maintained by the component's corresponding PD session at
core.
At the current stage, the accounting is applied to RPC capabilities,
signal-context capabilities, and dataspace capabilities. Capabilities
that are dynamically allocated via core's CPU and TRACE service are not
yet covered. Also, the capabilities allocated by resource multiplexers
outside of core (like nitpicker) must be accounted by the respective
servers, which is not covered yet.
If a component runs out of capabilities, core's PD service prints a
warning to the log. To observe the consumption of capabilities per
component in detail, the PD service is equipped with a diagnostic
mode, which can be enabled via the 'diag' attribute in the target
node of init's routing rules. E.g., the following route enables the
diagnostic mode for the PD session of the "timer" component:
<default-route>
<service name="PD" unscoped_label="timer">
<parent diag="yes"/>
</service>
...
</default-route>
For subsystems based on a sub-init instance, init can be configured
to report the capability-quota information of its subsystems by
adding the attribute 'child_caps="yes"' to init's '<report>'
config node. Init's own capability quota can be reported by adding
the attribute 'init_caps="yes"'.
Fixes #2398
2017-05-08 19:35:43 +00:00
|
|
|
/*******************************************
|
|
|
|
** Accounting for capability allocations **
|
|
|
|
*******************************************/
|
|
|
|
|
|
|
|
/**
|
|
|
|
* Define reference account for the PD session
|
|
|
|
*
|
|
|
|
* \throw Invalid_session
|
|
|
|
*/
|
|
|
|
virtual void ref_account(Capability<Pd_session>) = 0;
|
|
|
|
|
|
|
|
/**
|
|
|
|
* Transfer capability quota to another PD session
|
|
|
|
*
|
2017-05-11 18:03:28 +00:00
|
|
|
* \param to receiver of quota donation
|
|
|
|
* \param amount amount of quota to donate
|
Capability quota accounting and trading
This patch mirrors the accounting and trading scheme that Genode employs
for physical memory to the accounting of capability allocations.
Capability quotas must now be explicitly assigned to subsystems by
specifying a 'caps=<amount>' attribute to init's start nodes.
Analogously to RAM quotas, cap quotas can be traded between clients and
servers as part of the session protocol. The capability budget of each
component is maintained by the component's corresponding PD session at
core.
At the current stage, the accounting is applied to RPC capabilities,
signal-context capabilities, and dataspace capabilities. Capabilities
that are dynamically allocated via core's CPU and TRACE service are not
yet covered. Also, the capabilities allocated by resource multiplexers
outside of core (like nitpicker) must be accounted by the respective
servers, which is not covered yet.
If a component runs out of capabilities, core's PD service prints a
warning to the log. To observe the consumption of capabilities per
component in detail, the PD service is equipped with a diagnostic
mode, which can be enabled via the 'diag' attribute in the target
node of init's routing rules. E.g., the following route enables the
diagnostic mode for the PD session of the "timer" component:
<default-route>
<service name="PD" unscoped_label="timer">
<parent diag="yes"/>
</service>
...
</default-route>
For subsystems based on a sub-init instance, init can be configured
to report the capability-quota information of its subsystems by
adding the attribute 'child_caps="yes"' to init's '<report>'
config node. Init's own capability quota can be reported by adding
the attribute 'init_caps="yes"'.
Fixes #2398
2017-05-08 19:35:43 +00:00
|
|
|
*
|
|
|
|
* \throw Out_of_caps
|
|
|
|
* \throw Invalid_session
|
|
|
|
* \throw Undefined_ref_account
|
|
|
|
*
|
|
|
|
* Quota can only be transfered if the specified PD session is either the
|
|
|
|
* reference account for this session or vice versa.
|
|
|
|
*/
|
2017-05-11 18:03:28 +00:00
|
|
|
virtual void transfer_quota(Capability<Pd_session> to, Cap_quota amount) = 0;
|
Capability quota accounting and trading
This patch mirrors the accounting and trading scheme that Genode employs
for physical memory to the accounting of capability allocations.
Capability quotas must now be explicitly assigned to subsystems by
specifying a 'caps=<amount>' attribute to init's start nodes.
Analogously to RAM quotas, cap quotas can be traded between clients and
servers as part of the session protocol. The capability budget of each
component is maintained by the component's corresponding PD session at
core.
At the current stage, the accounting is applied to RPC capabilities,
signal-context capabilities, and dataspace capabilities. Capabilities
that are dynamically allocated via core's CPU and TRACE service are not
yet covered. Also, the capabilities allocated by resource multiplexers
outside of core (like nitpicker) must be accounted by the respective
servers, which is not covered yet.
If a component runs out of capabilities, core's PD service prints a
warning to the log. To observe the consumption of capabilities per
component in detail, the PD service is equipped with a diagnostic
mode, which can be enabled via the 'diag' attribute in the target
node of init's routing rules. E.g., the following route enables the
diagnostic mode for the PD session of the "timer" component:
<default-route>
<service name="PD" unscoped_label="timer">
<parent diag="yes"/>
</service>
...
</default-route>
For subsystems based on a sub-init instance, init can be configured
to report the capability-quota information of its subsystems by
adding the attribute 'child_caps="yes"' to init's '<report>'
config node. Init's own capability quota can be reported by adding
the attribute 'init_caps="yes"'.
Fixes #2398
2017-05-08 19:35:43 +00:00
|
|
|
|
|
|
|
/**
|
|
|
|
* Return current capability-quota limit
|
|
|
|
*/
|
|
|
|
virtual Cap_quota cap_quota() const = 0;
|
|
|
|
|
|
|
|
/**
|
|
|
|
* Return number of capabilities allocated from the session
|
|
|
|
*/
|
|
|
|
virtual Cap_quota used_caps() const = 0;
|
|
|
|
|
2017-05-24 12:41:19 +00:00
|
|
|
/**
|
|
|
|
* Return amount of available capabilities
|
|
|
|
*/
|
Capability quota accounting and trading
This patch mirrors the accounting and trading scheme that Genode employs
for physical memory to the accounting of capability allocations.
Capability quotas must now be explicitly assigned to subsystems by
specifying a 'caps=<amount>' attribute to init's start nodes.
Analogously to RAM quotas, cap quotas can be traded between clients and
servers as part of the session protocol. The capability budget of each
component is maintained by the component's corresponding PD session at
core.
At the current stage, the accounting is applied to RPC capabilities,
signal-context capabilities, and dataspace capabilities. Capabilities
that are dynamically allocated via core's CPU and TRACE service are not
yet covered. Also, the capabilities allocated by resource multiplexers
outside of core (like nitpicker) must be accounted by the respective
servers, which is not covered yet.
If a component runs out of capabilities, core's PD service prints a
warning to the log. To observe the consumption of capabilities per
component in detail, the PD service is equipped with a diagnostic
mode, which can be enabled via the 'diag' attribute in the target
node of init's routing rules. E.g., the following route enables the
diagnostic mode for the PD session of the "timer" component:
<default-route>
<service name="PD" unscoped_label="timer">
<parent diag="yes"/>
</service>
...
</default-route>
For subsystems based on a sub-init instance, init can be configured
to report the capability-quota information of its subsystems by
adding the attribute 'child_caps="yes"' to init's '<report>'
config node. Init's own capability quota can be reported by adding
the attribute 'init_caps="yes"'.
Fixes #2398
2017-05-08 19:35:43 +00:00
|
|
|
Cap_quota avail_caps() const
|
|
|
|
{
|
|
|
|
return Cap_quota { cap_quota().value - used_caps().value };
|
|
|
|
}
|
|
|
|
|
|
|
|
|
2017-05-11 18:03:28 +00:00
|
|
|
/***********************************
|
|
|
|
** RAM allocation and accounting **
|
|
|
|
***********************************/
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Note that the 'Pd_session' inherits the 'Ram_allocator' interface,
|
|
|
|
* which comprises the actual allocation and deallocation operations.
|
|
|
|
*/
|
|
|
|
|
|
|
|
/**
|
|
|
|
* Transfer quota to another RAM session
|
|
|
|
*
|
|
|
|
* \param to receiver of quota donation
|
|
|
|
* \param amount amount of quota to donate
|
|
|
|
*
|
|
|
|
* \throw Out_of_ram
|
|
|
|
* \throw Invalid_session
|
|
|
|
* \throw Undefined_ref_account
|
|
|
|
*
|
|
|
|
* Quota can only be transfered if the specified PD session is either the
|
|
|
|
* reference account for this session or vice versa.
|
|
|
|
*/
|
|
|
|
virtual void transfer_quota(Capability<Pd_session> to, Ram_quota amount) = 0;
|
|
|
|
|
|
|
|
/**
|
|
|
|
* Return current quota limit
|
|
|
|
*/
|
|
|
|
virtual Ram_quota ram_quota() const = 0;
|
|
|
|
|
|
|
|
/**
|
|
|
|
* Return used quota
|
|
|
|
*/
|
|
|
|
virtual Ram_quota used_ram() const = 0;
|
|
|
|
|
|
|
|
/**
|
|
|
|
* Return amount of available quota
|
|
|
|
*/
|
|
|
|
Ram_quota avail_ram() const { return { ram_quota().value - used_ram().value }; }
|
|
|
|
|
|
|
|
|
2016-01-19 19:24:22 +00:00
|
|
|
/*****************************************
|
|
|
|
** Access to kernel-specific interface **
|
|
|
|
*****************************************/
|
|
|
|
|
|
|
|
/**
|
|
|
|
* Common base class of kernel-specific PD interfaces
|
|
|
|
*/
|
Follow practices suggested by "Effective C++"
The patch adjust the code of the base, base-<kernel>, and os repository.
To adapt existing components to fix violations of the best practices
suggested by "Effective C++" as reported by the -Weffc++ compiler
argument. The changes follow the patterns outlined below:
* A class with virtual functions can no longer publicly inherit base
classed without a vtable. The inherited object may either be moved
to a member variable, or inherited privately. The latter would be
used for classes that inherit 'List::Element' or 'Avl_node'. In order
to enable the 'List' and 'Avl_tree' to access the meta data, the
'List' must become a friend.
* Instead of adding a virtual destructor to abstract base classes,
we inherit the new 'Interface' class, which contains a virtual
destructor. This way, single-line abstract base classes can stay
as compact as they are now. The 'Interface' utility resides in
base/include/util/interface.h.
* With the new warnings enabled, all member variables must be explicitly
initialized. Basic types may be initialized with '='. All other types
are initialized with braces '{ ... }' or as class initializers. If
basic types and non-basic types appear in a row, it is nice to only
use the brace syntax (also for basic types) and align the braces.
* If a class contains pointers as members, it must now also provide a
copy constructor and assignment operator. In the most cases, one
would make them private, effectively disallowing the objects to be
copied. Unfortunately, this warning cannot be fixed be inheriting
our existing 'Noncopyable' class (the compiler fails to detect that
the inheriting class cannot be copied and still gives the error).
For now, we have to manually add declarations for both the copy
constructor and assignment operator as private class members. Those
declarations should be prepended with a comment like this:
/*
* Noncopyable
*/
Thread(Thread const &);
Thread &operator = (Thread const &);
In the future, we should revisit these places and try to replace
the pointers with references. In the presence of at least one
reference member, the compiler would no longer implicitly generate
a copy constructor. So we could remove the manual declaration.
Issue #465
2017-12-21 14:42:15 +00:00
|
|
|
struct Native_pd : Interface { };
|
2016-01-19 19:24:22 +00:00
|
|
|
|
|
|
|
/**
|
|
|
|
* Return capability to kernel-specific PD operations
|
|
|
|
*/
|
|
|
|
virtual Capability<Native_pd> native_pd() = 0;
|
|
|
|
|
2015-03-04 20:12:14 +00:00
|
|
|
|
2020-07-10 11:04:12 +00:00
|
|
|
/*******************************************
|
|
|
|
** Access to system management interface **
|
|
|
|
*******************************************/
|
|
|
|
|
|
|
|
using Managing_system_state = Cpu_state;
|
|
|
|
|
|
|
|
/**
|
|
|
|
* Call privileged system management functionality of kernel or firmware
|
|
|
|
*/
|
|
|
|
virtual Managing_system_state managing_system(Managing_system_state const &) = 0;
|
|
|
|
|
|
|
|
|
2015-03-04 20:12:14 +00:00
|
|
|
/*********************
|
|
|
|
** RPC declaration **
|
|
|
|
*********************/
|
|
|
|
|
2016-04-14 14:29:07 +00:00
|
|
|
GENODE_RPC(Rpc_assign_parent, void, assign_parent, Capability<Parent>);
|
2016-01-14 12:22:00 +00:00
|
|
|
GENODE_RPC(Rpc_assign_pci, bool, assign_pci, addr_t, uint16_t);
|
2017-08-02 15:30:49 +00:00
|
|
|
GENODE_RPC_THROW(Rpc_map, void, map,
|
|
|
|
GENODE_TYPE_LIST(Out_of_ram, Out_of_caps),
|
|
|
|
addr_t, addr_t);
|
2016-01-14 12:22:00 +00:00
|
|
|
|
|
|
|
GENODE_RPC_THROW(Rpc_alloc_signal_source, Signal_source_capability,
|
Capability quota accounting and trading
This patch mirrors the accounting and trading scheme that Genode employs
for physical memory to the accounting of capability allocations.
Capability quotas must now be explicitly assigned to subsystems by
specifying a 'caps=<amount>' attribute to init's start nodes.
Analogously to RAM quotas, cap quotas can be traded between clients and
servers as part of the session protocol. The capability budget of each
component is maintained by the component's corresponding PD session at
core.
At the current stage, the accounting is applied to RPC capabilities,
signal-context capabilities, and dataspace capabilities. Capabilities
that are dynamically allocated via core's CPU and TRACE service are not
yet covered. Also, the capabilities allocated by resource multiplexers
outside of core (like nitpicker) must be accounted by the respective
servers, which is not covered yet.
If a component runs out of capabilities, core's PD service prints a
warning to the log. To observe the consumption of capabilities per
component in detail, the PD service is equipped with a diagnostic
mode, which can be enabled via the 'diag' attribute in the target
node of init's routing rules. E.g., the following route enables the
diagnostic mode for the PD session of the "timer" component:
<default-route>
<service name="PD" unscoped_label="timer">
<parent diag="yes"/>
</service>
...
</default-route>
For subsystems based on a sub-init instance, init can be configured
to report the capability-quota information of its subsystems by
adding the attribute 'child_caps="yes"' to init's '<report>'
config node. Init's own capability quota can be reported by adding
the attribute 'init_caps="yes"'.
Fixes #2398
2017-05-08 19:35:43 +00:00
|
|
|
alloc_signal_source,
|
|
|
|
GENODE_TYPE_LIST(Out_of_ram, Out_of_caps));
|
2016-01-14 12:22:00 +00:00
|
|
|
GENODE_RPC(Rpc_free_signal_source, void, free_signal_source, Signal_source_capability);
|
|
|
|
GENODE_RPC_THROW(Rpc_alloc_context, Capability<Signal_context>, alloc_context,
|
Capability quota accounting and trading
This patch mirrors the accounting and trading scheme that Genode employs
for physical memory to the accounting of capability allocations.
Capability quotas must now be explicitly assigned to subsystems by
specifying a 'caps=<amount>' attribute to init's start nodes.
Analogously to RAM quotas, cap quotas can be traded between clients and
servers as part of the session protocol. The capability budget of each
component is maintained by the component's corresponding PD session at
core.
At the current stage, the accounting is applied to RPC capabilities,
signal-context capabilities, and dataspace capabilities. Capabilities
that are dynamically allocated via core's CPU and TRACE service are not
yet covered. Also, the capabilities allocated by resource multiplexers
outside of core (like nitpicker) must be accounted by the respective
servers, which is not covered yet.
If a component runs out of capabilities, core's PD service prints a
warning to the log. To observe the consumption of capabilities per
component in detail, the PD service is equipped with a diagnostic
mode, which can be enabled via the 'diag' attribute in the target
node of init's routing rules. E.g., the following route enables the
diagnostic mode for the PD session of the "timer" component:
<default-route>
<service name="PD" unscoped_label="timer">
<parent diag="yes"/>
</service>
...
</default-route>
For subsystems based on a sub-init instance, init can be configured
to report the capability-quota information of its subsystems by
adding the attribute 'child_caps="yes"' to init's '<report>'
config node. Init's own capability quota can be reported by adding
the attribute 'init_caps="yes"'.
Fixes #2398
2017-05-08 19:35:43 +00:00
|
|
|
GENODE_TYPE_LIST(Out_of_ram, Out_of_caps, Invalid_signal_source),
|
2016-01-14 12:22:00 +00:00
|
|
|
Signal_source_capability, unsigned long);
|
|
|
|
GENODE_RPC(Rpc_free_context, void, free_context,
|
|
|
|
Capability<Signal_context>);
|
|
|
|
GENODE_RPC(Rpc_submit, void, submit, Capability<Signal_context>, unsigned);
|
|
|
|
|
2016-01-19 19:24:22 +00:00
|
|
|
GENODE_RPC_THROW(Rpc_alloc_rpc_cap, Native_capability, alloc_rpc_cap,
|
Capability quota accounting and trading
This patch mirrors the accounting and trading scheme that Genode employs
for physical memory to the accounting of capability allocations.
Capability quotas must now be explicitly assigned to subsystems by
specifying a 'caps=<amount>' attribute to init's start nodes.
Analogously to RAM quotas, cap quotas can be traded between clients and
servers as part of the session protocol. The capability budget of each
component is maintained by the component's corresponding PD session at
core.
At the current stage, the accounting is applied to RPC capabilities,
signal-context capabilities, and dataspace capabilities. Capabilities
that are dynamically allocated via core's CPU and TRACE service are not
yet covered. Also, the capabilities allocated by resource multiplexers
outside of core (like nitpicker) must be accounted by the respective
servers, which is not covered yet.
If a component runs out of capabilities, core's PD service prints a
warning to the log. To observe the consumption of capabilities per
component in detail, the PD service is equipped with a diagnostic
mode, which can be enabled via the 'diag' attribute in the target
node of init's routing rules. E.g., the following route enables the
diagnostic mode for the PD session of the "timer" component:
<default-route>
<service name="PD" unscoped_label="timer">
<parent diag="yes"/>
</service>
...
</default-route>
For subsystems based on a sub-init instance, init can be configured
to report the capability-quota information of its subsystems by
adding the attribute 'child_caps="yes"' to init's '<report>'
config node. Init's own capability quota can be reported by adding
the attribute 'init_caps="yes"'.
Fixes #2398
2017-05-08 19:35:43 +00:00
|
|
|
GENODE_TYPE_LIST(Out_of_ram, Out_of_caps), Native_capability);
|
2016-01-19 19:24:22 +00:00
|
|
|
GENODE_RPC(Rpc_free_rpc_cap, void, free_rpc_cap, Native_capability);
|
2015-03-04 20:12:14 +00:00
|
|
|
|
2016-04-15 13:19:22 +00:00
|
|
|
GENODE_RPC(Rpc_address_space, Capability<Region_map>, address_space);
|
|
|
|
GENODE_RPC(Rpc_stack_area, Capability<Region_map>, stack_area);
|
|
|
|
GENODE_RPC(Rpc_linker_area, Capability<Region_map>, linker_area);
|
|
|
|
|
Capability quota accounting and trading
This patch mirrors the accounting and trading scheme that Genode employs
for physical memory to the accounting of capability allocations.
Capability quotas must now be explicitly assigned to subsystems by
specifying a 'caps=<amount>' attribute to init's start nodes.
Analogously to RAM quotas, cap quotas can be traded between clients and
servers as part of the session protocol. The capability budget of each
component is maintained by the component's corresponding PD session at
core.
At the current stage, the accounting is applied to RPC capabilities,
signal-context capabilities, and dataspace capabilities. Capabilities
that are dynamically allocated via core's CPU and TRACE service are not
yet covered. Also, the capabilities allocated by resource multiplexers
outside of core (like nitpicker) must be accounted by the respective
servers, which is not covered yet.
If a component runs out of capabilities, core's PD service prints a
warning to the log. To observe the consumption of capabilities per
component in detail, the PD service is equipped with a diagnostic
mode, which can be enabled via the 'diag' attribute in the target
node of init's routing rules. E.g., the following route enables the
diagnostic mode for the PD session of the "timer" component:
<default-route>
<service name="PD" unscoped_label="timer">
<parent diag="yes"/>
</service>
...
</default-route>
For subsystems based on a sub-init instance, init can be configured
to report the capability-quota information of its subsystems by
adding the attribute 'child_caps="yes"' to init's '<report>'
config node. Init's own capability quota can be reported by adding
the attribute 'init_caps="yes"'.
Fixes #2398
2017-05-08 19:35:43 +00:00
|
|
|
GENODE_RPC_THROW(Rpc_ref_account, void, ref_account,
|
|
|
|
GENODE_TYPE_LIST(Invalid_session), Capability<Pd_session>);
|
|
|
|
GENODE_RPC_THROW(Rpc_transfer_cap_quota, void, transfer_quota,
|
|
|
|
GENODE_TYPE_LIST(Out_of_caps, Invalid_session, Undefined_ref_account),
|
|
|
|
Capability<Pd_session>, Cap_quota);
|
|
|
|
GENODE_RPC(Rpc_cap_quota, Cap_quota, cap_quota);
|
|
|
|
GENODE_RPC(Rpc_used_caps, Cap_quota, used_caps);
|
|
|
|
|
2017-05-11 18:03:28 +00:00
|
|
|
GENODE_RPC_THROW(Rpc_alloc, Ram_dataspace_capability, alloc,
|
|
|
|
GENODE_TYPE_LIST(Out_of_ram, Out_of_caps, Undefined_ref_account),
|
|
|
|
size_t, Cache_attribute);
|
|
|
|
GENODE_RPC(Rpc_free, void, free, Ram_dataspace_capability);
|
|
|
|
GENODE_RPC_THROW(Rpc_transfer_ram_quota, void, transfer_quota,
|
|
|
|
GENODE_TYPE_LIST(Out_of_ram, Invalid_session, Undefined_ref_account),
|
|
|
|
Capability<Pd_session>, Ram_quota);
|
|
|
|
GENODE_RPC(Rpc_ram_quota, Ram_quota, ram_quota);
|
|
|
|
GENODE_RPC(Rpc_used_ram, Ram_quota, used_ram);
|
|
|
|
|
2016-01-19 19:24:22 +00:00
|
|
|
GENODE_RPC(Rpc_native_pd, Capability<Native_pd>, native_pd);
|
|
|
|
|
2020-07-10 11:04:12 +00:00
|
|
|
GENODE_RPC(Rpc_managing_system, Managing_system_state, managing_system,
|
|
|
|
Managing_system_state const &);
|
|
|
|
|
2017-08-02 15:30:49 +00:00
|
|
|
GENODE_RPC_INTERFACE(Rpc_assign_parent, Rpc_assign_pci, Rpc_map,
|
2016-05-11 15:23:51 +00:00
|
|
|
Rpc_alloc_signal_source, Rpc_free_signal_source,
|
|
|
|
Rpc_alloc_context, Rpc_free_context, Rpc_submit,
|
|
|
|
Rpc_alloc_rpc_cap, Rpc_free_rpc_cap, Rpc_address_space,
|
Capability quota accounting and trading
This patch mirrors the accounting and trading scheme that Genode employs
for physical memory to the accounting of capability allocations.
Capability quotas must now be explicitly assigned to subsystems by
specifying a 'caps=<amount>' attribute to init's start nodes.
Analogously to RAM quotas, cap quotas can be traded between clients and
servers as part of the session protocol. The capability budget of each
component is maintained by the component's corresponding PD session at
core.
At the current stage, the accounting is applied to RPC capabilities,
signal-context capabilities, and dataspace capabilities. Capabilities
that are dynamically allocated via core's CPU and TRACE service are not
yet covered. Also, the capabilities allocated by resource multiplexers
outside of core (like nitpicker) must be accounted by the respective
servers, which is not covered yet.
If a component runs out of capabilities, core's PD service prints a
warning to the log. To observe the consumption of capabilities per
component in detail, the PD service is equipped with a diagnostic
mode, which can be enabled via the 'diag' attribute in the target
node of init's routing rules. E.g., the following route enables the
diagnostic mode for the PD session of the "timer" component:
<default-route>
<service name="PD" unscoped_label="timer">
<parent diag="yes"/>
</service>
...
</default-route>
For subsystems based on a sub-init instance, init can be configured
to report the capability-quota information of its subsystems by
adding the attribute 'child_caps="yes"' to init's '<report>'
config node. Init's own capability quota can be reported by adding
the attribute 'init_caps="yes"'.
Fixes #2398
2017-05-08 19:35:43 +00:00
|
|
|
Rpc_stack_area, Rpc_linker_area, Rpc_ref_account,
|
|
|
|
Rpc_transfer_cap_quota, Rpc_cap_quota, Rpc_used_caps,
|
2017-05-11 18:03:28 +00:00
|
|
|
Rpc_alloc, Rpc_free,
|
|
|
|
Rpc_transfer_ram_quota, Rpc_ram_quota, Rpc_used_ram,
|
2020-07-10 11:04:12 +00:00
|
|
|
Rpc_native_pd, Rpc_managing_system);
|
2015-03-04 20:12:14 +00:00
|
|
|
};
|
2011-12-22 15:19:25 +00:00
|
|
|
|
|
|
|
#endif /* _INCLUDE__PD_SESSION__PD_SESSION_H_ */
|