Commit Graph

1055 Commits

Author SHA1 Message Date
Alexander Boettcher
0c24e1efdc vm_session: extensions
- support to create multiple vCPUs
- support to implement Vm_session methods client side within base library
- adjust muen specific virtualbox4 version to compile/link

Issue #3111
2019-02-19 11:08:17 +01:00
Emery Hemingway
38ab456c78 Remove pointers from Genode::Fifo interface
Replace methods of Genode::Fifo returning pointers with methods which
call lambdas with references.

Ref #3135
2019-02-19 11:08:17 +01:00
Stefan Kalkowski
161f39f7af imx6q_sabrelite: enable sd_card_drv 2019-02-19 11:08:17 +01:00
Stefan Kalkowski
da502dd036 muen: disable SMP test on Muen 2019-02-19 11:08:17 +01:00
Alexander Senier
5ccae43552 Rename Ada runtime to SPARK runtime
The minimal-footprint Ada runtime for implementing library-like
functionality in SPARK is now called "spark" runtime.

The full Ada runtime for entire components written in Ada and using the
libc as glue to the underlying system will move to the world repository
as "ada" runtime.

Issue #3144
2019-02-19 11:08:17 +01:00
Alexander Senier
3b41e02ea5 Create make dependencies using ali2dep 2019-02-19 10:50:51 +01:00
Alexander Senier
80a607ee0c Abandon gnatmake and generate elaboration code 2019-02-19 10:50:51 +01:00
Christian Helmuth
271e2398f9 depot: update recipe hashes 2019-02-12 14:24:12 +01:00
Norman Feske
bcb24e316c base: fix warnings reported by LLVM analyzer
The warnings were false positives though.
2019-02-12 10:33:14 +01:00
Norman Feske
6b289a1423 base/core: use references instead of pointers
This patch replaces the former prominent use of pointers by references
wherever feasible. This has the following benefits:

* The contract between caller and callee becomes more obvious. When
  passing a reference, the contract says that the argument cannot be
  a null pointer. The caller is responsible to ensure that. Therefore,
  the use of reference eliminates the need to add defensive null-pointer
  checks at the callee site, which sometimes merely exist to be on the
  safe side. The bottom line is that the code becomes easier to follow.

* Reference members must be initialized via an object initializer,
  which promotes a programming style that avoids intermediate object-
  construction states. Within core, there are still a few pointers
  as member variables left though. E.g., caused by the late association
  of 'Platform_thread' objects with their 'Platform_pd' objects.

* If no pointers are present as member variables, we don't need to
  manually provide declarations of a private copy constructor and
  an assignment operator to avoid -Weffc++ errors "class ... has
  pointer data members [-Werror=effc++]".

This patch also changes a few system bindings on NOVA and Fiasco.OC,
e.g., the return value of the global 'cap_map' accessor has become a
reference. Hence, the patch touches a few places outside of core.

Fixes #3135
2019-02-12 10:33:13 +01:00
Norman Feske
f9373b4430 base: new Allocator_avl::construct_metadata method
The new method allows for the construction of a meta-data object inside
the reserved space of the allocator's meta data. It thereby alleviates
the need to copy the meta data object (via the assignment operator) as
done by the traditional 'metadata' setter method. This, in turn, allows
one to use non-copyable objects (like objects with constant member
variables) as meta data.
2019-02-12 10:33:12 +01:00
Norman Feske
437e6c5653 core: make ASSERT_NEVER_CALLED a single statement
This way, the macro can be used as a body of an if statement with no
curly braces.
2019-02-12 10:33:12 +01:00
Norman Feske
3a169d3a78 depot: update recipe hashes 2019-01-30 13:55:20 +01:00
Norman Feske
237d2bff3a base: fix deadlock during signal-context dissolve
This patch moves the removal of the signal context from the
'_platform_finish_dissolve' to the '_platform_begin_dissolve'
method. This is needed because the removal involves taking
the signal-registry lock. The latter must adhere the same
locking order as the code path used for signal delivery.

Fixes #3109
2019-01-30 13:55:19 +01:00
Martin Stein
f3dfe88477 build system: show full paths on ADA errors
Add '-gnatef' to the default 'CUSTOM_ADA_OPT' in generic.mk to ensure that, on
compile errors, the full source path is shown.
2019-01-30 13:49:55 +01:00
Christian Prochaska
4b805ccde9 base: move 'Buffered_output' class into public header
Fixes #3128
2019-01-30 13:49:55 +01:00
Norman Feske
5f1f67153b Xml_node: safe alternatives to unsafe accessors
Issue #3125
2019-01-30 13:49:54 +01:00
Norman Feske
fdbf30fc4c Xml_node: replace value(T *out) by value(T &out)
Promote the use of references instead of pointers.

Issue #1987
2019-01-30 13:49:54 +01:00
Norman Feske
af146e7dcd Remove base/timed_semaphore.h from API
The former 'Genode::Timed_semaphore' mechanism is moved to the private
part of the two remaining users, namely dde_rump and the libc. Note
there are now two private copies of 'timed_semaphore.h'. This should be
regarded as an interim step until the use of this mechanism is removed
from both users.

This patch also cleans up the mechanism from legacy Genode API calls and
global side effects (alarm-thread singleton). The test/timed_semaphore
is now located at the libports repository as it now tests a mechanism of
the libc. The former timed_semaphore library is no more.

Fixes #3121
2019-01-30 13:35:29 +01:00
Alexander Boettcher
9a2bdf8798 vm_session: move from base-hw to base
Issue #3111
2019-01-30 13:35:28 +01:00
Stefan Kalkowski
b765cef359 replace Wandboard by i.MX6 reference board
Instead of using the Wandboard Quad, the reference hardware from NXP
i.MX6 Quad Sabrelite will be used by Fiasco.OC, sel4 and hw by default.
2019-01-30 13:35:28 +01:00
Stefan Kalkowski
c65860ee53 enable i.MX6 Quad Sabrelite board for hw and foc 2019-01-30 13:35:28 +01:00
Stefan Kalkowski
6b4d76739e base: remove Signal_receiver::pending() method
Fix #1864
2019-01-30 13:35:28 +01:00
Norman Feske
ed65267bc5 depot: update recipe hashes 2019-01-14 12:34:41 +01:00
Norman Feske
97e3d05f37 base-foc: fix placement of utcb area stack area
This commit ensures that UTCB areas of PDs are positioned relative to
the stack areas of regular components, not the one of core.

Fixes #3108
2019-01-14 12:34:41 +01:00
Norman Feske
bf62d6b896 Move timer from os to base repository
Since the timer and timeout handling is part of the base library (the
dynamic linker), it belongs to the base repository.

Besides moving the timer and its related infrastructure (alarm, timeout
libs, tests) to the base repository, this patch also moves the timer
from the 'drivers' subdirectory directly to 'src' and disamibuates the
timer's build locations for the various kernels. Otherwise the different
timer implementations could interfere with each other when using one
build directory with multiple kernels.

Note that this patch changes the include paths for the former os/timer,
os/alarm.h, os/duration.h, and os/timed_semaphore.h to base/.

Issue #3101
2019-01-14 12:33:57 +01:00
Christian Helmuth
21a61cd583 depot: update recipe hashes 2019-01-07 12:43:37 +01:00
Norman Feske
cd29ca3c40 base: add List_model::apply_first
The new 'apply_first' method enables users of the list model to manually
traverse the list model via the 'Element::next' method instead of
iterating via 'for_each'. This is needed in situations where the
list-model elements are visited via recursion, not via a loop.

Issue #3094
2019-01-07 12:33:56 +01:00
Stefan Kalkowski
7f1692b3ca core: support unmap of managed dataspace generally
This commit solves several issues:

* correct calculation of overlap region when detaching regions
  in managed dataspaces
* prevent unmap of Fiasco.OC's core log buffer
* calculate the core-local address of regions in managed dataspaces
  if possible at all and use it to unmap on kernels where this is
  needed

Fix #976
Fix #3082
2019-01-07 12:33:56 +01:00
Christian Prochaska
a5547e5b1d base: improve floating point output
Fixes #2876
2019-01-07 12:33:54 +01:00
Sebastian Sumpf
3347d08b79 ldso: cleanup if loading of 'Shared_object' fails
This can happen, for example, during 'dlopen' if unresolved symbols are
present.

* Unload already loaded shared libraries
* Delete dependencies
* Flush initializer list (ctors)

fixes #3073
2019-01-07 12:33:54 +01:00
Christian Prochaska
9c8e76b190 base: 'sanitizer' test
Issue #3072
2019-01-07 12:33:54 +01:00
Christian Prochaska
5569d2ddc2 mk: add 'SANITIZE_UNDEFINED' option
'SANITIZE_UNDEFINED = yes' in 'target.mk' adds the '-fsanitize=undefined'
compiler flag and links the program with libubsan and libsanitizer_common.

Issue #3072
2019-01-07 12:33:54 +01:00
Christian Prochaska
97d8bea5ec gcov: print selected annotated source files only
Fixes #3070
2019-01-07 12:25:46 +01:00
Alexander Boettcher
67fd3333e2 base: avoid null pointer reference warning
Issue #3022
2019-01-07 12:25:45 +01:00
Alexander Boettcher
1ec0619b3e base: avoid warnings in fifo.h
error: member 'Element' found in multiple base classes of different types

Issue #3022
2019-01-07 12:25:45 +01:00
Alexander Boettcher
c2d54aaede base: avoid null pointer warning in avl tree
Issue #3022
2019-01-07 12:25:45 +01:00
Alexander Boettcher
7536b665f1 core: avoid null pointer reference warning
Issue #3022
2019-01-07 12:25:44 +01:00
Martin Stein
79ca4e1718 init: show args on "denied env session" error
It can be hard to resolve "denied env session" errors when you don't have the
session label.
2019-01-07 12:25:43 +01:00
Martin Stein
7f959a06f6 depot_autopilot: tune for multi-platform support
Issue #3027
2019-01-07 12:25:43 +01:00
Emery Hemingway
8cb8082206 Remove Nim support from toolchain
Nim components are best build externally using the Nimble tools and a
Genode SDK.

See https://github.com/ehmry/nim-genode

Fix #2949
2019-01-07 12:25:42 +01:00
Emery Hemingway
9c7d5b2a66 Implement print and min/max for Microseconds and Milliseconds
Ref #3050
2019-01-07 12:25:42 +01:00
Christian Helmuth
11eecdc7bd depot: update recipe hashes 2018-11-29 11:54:31 +01:00
Stefan Kalkowski
34480c9269 test-rm_fault: use ld.lib.so to test read-only mem
Due to the changing environment this test is executed (like depot_autopilot)
the binary test-rm_fault used to check ROM dataspace's read-only property
does not suit anymore. This commit changes the binary to ld.lib.so that is
normally still provided as a ROM dataspace.

Ref #3027
2018-11-29 11:54:31 +01:00
Johannes Kliemann
db162477a4 ada: fix exception handling
Fixes #3061
2018-11-29 11:54:31 +01:00
Stefan Kalkowski
d7fa4cfb8b hw: enable eager FPU context switch for ARM
* Add an ieee754 FPU test
* Remove simple fpu test

Fix #2822
2018-11-29 11:54:31 +01:00
Johannes Schlatow
4e375ec6df zynq: move RAM size to board defs 2018-11-29 11:46:02 +01:00
Christian Prochaska
fe322b8e82 test-xml_generator: enable code coverage analysis
Issue #3048
2018-11-29 11:46:01 +01:00
Christian Prochaska
1f985dec38 mk: add 'COVERAGE' option
'COVERAGE=yes' in 'target.mk' adds gcov-specific compiler flags and links the
program with libgcov.

Issue #3048
2018-11-29 11:46:01 +01:00
Martin Stein
c405ec19ce pkg/test-rm_fault: event "Error: could modify ROM" 2018-11-27 11:36:36 +01:00
Martin Stein
abd3855161 test/rm_nested: fix EP double dissolve
Fixes #3045
2018-11-27 11:36:35 +01:00
Stefan Kalkowski
a062ba6dd2 base: add tlb shootdown test metric to smp test
Fix #3041
2018-11-27 11:36:35 +01:00
Stefan Kalkowski
36fe50ebad base: unify mp_server and affinity test
* remove outdated cpufreq test for Arndale
* execute new SMP test on hardware not in Qemu in nightly tests

Ref #3041
2018-11-27 11:36:35 +01:00
Norman Feske
19d7a488de init: health monitoring of child components
Fixes #3039
2018-11-27 11:36:34 +01:00
Stefan Kalkowski
d56a7beadc hw: increase cpu frequency on Wandboard Quad
Ref #1807
2018-11-16 15:17:06 +01:00
Christian Helmuth
70e7499e48 depot: update recipe hashes 2018-11-16 15:07:53 +01:00
Martin Stein
2d041ac0fc depot_autopilot: evaluate sets of test packages 2018-11-16 15:07:53 +01:00
Martin Stein
146f45f3d4 Archive recipes for autopilot tests 2018-11-16 15:07:53 +01:00
Martin Stein
a1ff3cc317 base-foc: recipes for ARMv7a platforms
* In base-foc/recipes/src/ replace base-foc with base-foc-pc
* To base-foc/recipes/src add base-foc-arndale, base-foc-pbxa9
* Ensure that the correct base-foc recipe is choosen by the run module
  'boot_dir/foc'
2018-11-16 14:37:47 +01:00
Martin Stein
4e29c1ca40 test/xml_node: move to base 2018-11-16 14:37:19 +01:00
Martin Stein
ed1cec2efa test/xml_generator: move to base 2018-11-16 14:37:19 +01:00
Martin Stein
510d7644fa test/weak_ptr: move to os/ as it uses a timer 2018-11-16 14:37:19 +01:00
Martin Stein
0b8ea50589 test/slab: move to os/ as it uses timer driver 2018-11-16 14:37:19 +01:00
Martin Stein
0eef5b506c test-util_mmio: rename test-mmio 2018-11-16 14:37:19 +01:00
Martin Stein
590dc1ac59 test/util_mmio: simplify success conditions 2018-11-16 14:37:19 +01:00
Martin Stein
f439cf0de1 test/rm_nested: destroy all objects before finish
Explicit destruction of test objects (esp. RM connection) tests for
regressions in the service life-time implementation.

Issue #3012
2018-11-16 14:37:19 +01:00
Martin Stein
5e8c53f61c base_types.xsd: allow session labels of length 0 2018-11-16 14:37:19 +01:00
Alexander Boettcher
f53a56982c clang: use template keyword on template methods
avoids tons of warnings

Issue #3022
2018-11-16 14:37:18 +01:00
Alexander Boettcher
886619f63e base: set parent info in child_process solely once
clang:
 warning: Value stored to 'parent_info' is never read

Issue #3022
2018-11-16 14:37:18 +01:00
Alexander Boettcher
f7364d8463 base: avoid warnings in list.h
clang:

error: member 'Element' found in multiple base classes of different types

Issue #3022
2018-11-16 14:37:18 +01:00
Alexander Boettcher
fc0dbc3f70 base: avoid null pointer warnings
warning: Called C++ object pointer is null

Issue #3022
2018-11-16 14:37:18 +01:00
Alexander Boettcher
17f7147ac1 base: avoid warnings about shift operations
clang:
 warning: The result of the '<<' expression is undefined
2018-11-16 14:37:18 +01:00
Alexander Boettcher
4b62f091a9 base: fix accessibility of enum in bit_array.h
avoids warning by clang:

error: 'BITS_PER_WORD' is a private member of 'Genode::Bit_array_base'

Issue #3022
2018-11-16 14:37:18 +01:00
Christian Helmuth
0867da28a2 depot: update recipe hashes 2018-10-29 09:36:23 +01:00
Emery Hemingway
3958ea50a0 Allocator_avl: apply_any method
Provide an `apply_any` method for accessing any member of the allocator,
this is provided for destructing members of the allocator.

Ref #2996
2018-10-29 09:36:22 +01:00
Alexander Boettcher
5446c52c43 base: make Entrypoint placeable on specific cpu
Fixes #3008
2018-10-29 09:36:22 +01:00
Johannes Kliemann
c2d85ff554 Ada: allow separate GCC for gnatmake
Fixes #3011
2018-10-29 09:36:22 +01:00
Alexander Boettcher
b8cc468f02 base: support assignment of invalid weak_ptr
This fixes the region-map component implementation in core, which uses a
'Genode::Weak_ptr<Genode::Region_map_component> _faulting_region_map'
member. This member is assigned a valid weak_ptr or an invalid weak_ptr
according to the state machine.

Fixes #3012
2018-10-29 09:36:22 +01:00
Norman Feske
7d641d5f1f base: add Reconstructible::conditional method
The new 'conditional' method simplifies the typical use case for
'Constructible' objects where the constructed/destructed state depends
on a configuration parameter. The method alleviates the need to
re-implement the logic again and again.

The patch also removes the 'Reconstructible' constructor arguments
because they are unused.

Fixes #3006
2018-10-29 09:36:21 +01:00
Martin Stein
364f69edad Xml_generator: fix and test missing '\0'
Ensure that a '\0' always appears at the end of the ouput of the XML
generator.  Previously, exceptions during the Node(...) constructor
might have prevented this. This commit also extends the xml_generator
test to drive a harder test on exceptions in the Xml_generator.

Issue #2953
2018-10-29 09:36:20 +01:00
Martin Stein
85d589a49c Xml_generator: fix exception handling in Node(...)
When the functor provided to the Node constructor throws an exception,
do revert all changes in reverse order. Previously, the changes made
to the parent node were not considered by the exception handler which
caused unnecessary characters to remain in the out buffer for each
reverted node.

Issue #2953
2018-10-29 09:36:20 +01:00
Sebastian Sumpf
0cc87d3c85 ldso: check for DYNAMIC segment in ELF files
If the DYNAMIC segment cannot be located the ELF file may be statically
linked. In this case an error is raised.

Fixes #3000
2018-10-01 10:41:46 +02:00
Christian Helmuth
5dcf06d208 depot: update recipe hashes 2018-09-13 15:21:26 +02:00
Martin Stein
cc4a72243d print_lines: fix bugs in line length calculation
1) The loop for determining the line length read from a character offset
   before checking whether the offset is smaller than the given string
   length. This could have caused access outside the string buffer.

2) The routine for determining the line length first seeked for the
   offset of the last real character of the line and than added one for
   getting the length but only if the following character was '\n'. This
   has to be done for any other line-terminating character too. The only
   case where you don't want to do this is when the end of the whole
   string is reached.

Issue #2967
2018-09-13 15:21:11 +02:00
Alexander Boettcher
4d228e22cb core: destruct pd::_ram_quota after regions
Fixes #2966
2018-09-13 14:54:21 +02:00
Stefan Kalkowski
b02f483841 dde_linux: usb host controller driver version 4.16 2018-08-30 09:24:45 +02:00
Norman Feske
c270e4fb30 base: exception safety during registry iteration
This patch fixes a problem in the non-const 'for_each' method of the
'Registry' data structure. If an exception was thrown from within the
functor of the 'for_each' operation, the not yet processed items of the
registry were dropped from the registry, which is not expected.
2018-08-28 17:10:54 +02:00
Norman Feske
1aba1fe8b1 heap: diagnostic message on alloc(0) 2018-08-28 17:10:53 +02:00
Martin Stein
99b8e062d7 */config.xsd: fix session-policy declarations
Issue #2908
2018-08-28 16:48:47 +02:00
Martin Stein
d2a36c5958 base: define generic config XSD types globally
The new base/xsd/config.inc defines generic XSD types such as 'Boolean' or
'Session_label'. It can be included in config XSD files by using:

! <xs:include schemaLocation="file://${GENODE_CONFIG_INC}"/>

The string ${GENODE_CONFIG_INC} is replaced by the run tool with the
above mentionened file path.

Issue #2897
2018-08-28 16:48:47 +02:00
Alexander Boettcher
cf3ff17c50 hw/x86: enable SMP support
Fixes #2929
2018-08-28 16:48:44 +02:00
Alexander Boettcher
eb62d9cc04 dde_linux: update intel_fb to 4.16.3
Fixes #2736
2018-08-28 16:18:33 +02:00
Christian Helmuth
f4ea50c6ff depot: update recipe hashes 2018-08-08 10:59:04 +02:00
Alexander Senier
ddee65722f Ada: do not use default directories for gnatmake 2018-08-08 10:59:02 +02:00
Norman Feske
ac0562ec18 base: avoid Pd_session::Invalid_session condition
By adding a sanity check for the validity of the PD session targeted by
a transfer_quota operation, the corner case of an incomplete PD session
of a child can no longer trigger an 'Invalid_session' exception.
2018-08-02 14:36:44 +02:00
Norman Feske
4b46abf813 base: rm first-class support for static binaries
This patch removes the detection of statically linked executables from
the base framework. It thereby fixes the corner cases encountered with
Sculpt when obtaining the binaries of the runtime from the depot_rom
service that is hosted within the runtime.

Statically linked binaries and hybrid Linux/Genode (lx_hybrid) binaries
can still be started by relabeling the ROM-session route of "ld.lib.so"
to the binary name, pretending that the binary is the dynamic linker.
This can be achieved via init's label rewriting mechanism:

  <route>
    <service name="ROM" unscoped_label="ld.lib.so">
      <parent label="test-platform"/> </service>
  </route>

However, as this is quite cryptic and would need to be applied for all
lx_hybrid components, the patch adds a shortcut to init's configuration.
One can simply add the 'ld="no"' attribute to the <start> node of the
corresponding component:

  <start name="test-platform" ld="no"/>

Fixes #2866
2018-08-02 14:36:38 +02:00
Martin Stein
fbe9d26c47 trace: initialize trace control in Thread::start
Previously, the trace control of a thread was initialized in its
constructor (which is generic for all components). This has the
disadvantage that the CPU-session-pointer member of the thread might not
be valid at this point. And it cannot be replaced by using the
"deprecated_env" CPU session neither as constructing the deprecated
environment in causes troubles in Core. But as the trace control
shouldn't be needed in Core anyway, the initialization can be moved to
the Thread::start implementation of non-core components. This code
already takes care of the CPU session pointer.

Fixes #2901
2018-08-02 14:36:35 +02:00
Christian Helmuth
b485caf33c depot: update recipe hashes 2018-07-03 09:40:11 +02:00
Norman Feske
39e6dd3d25 core: destruction order of PD session members
This patch addresses a corner case revealed by the resource_request test
on seL4 after changing the child-destruction handling with commit "base:
close PD on 'close_all_sessions'". During the destruction of the PD
session, the backing store (session-local RAM dataspace factory) of the
signal broker's slab was destroyed before destructing the signal broker.
Instantiating the signal broker after the RAM dataspace factory fixes
the destruction order.
2018-07-03 09:39:35 +02:00
Christian Prochaska
1d3ec6f0ae Test successive thread creation and destruction
Fixes #2887
2018-07-03 09:39:34 +02:00
Norman Feske
a3858bff3c base: handle cancelation of session creation
This patch improves the handling of the corner case where a client
vanishes while a session request is in flight (CREATE_REQUESTED but
not yet AVAILABLE). This corner case could be sporadically observed with
the init_loop test on base-linux.

In the original version, the session would eventually be delivered but
never picked up by anyone. Such a stale session still uses resources that
should better be released. In the new version, the parent checks for the
liveliness of the client whenever a session is delivered. If there is no
client of the session, a close request is immediately issued to the
server. The session state must be preserved until the close requests has
been answered.
2018-07-03 09:39:32 +02:00
Norman Feske
ddff89d43e base: close PD on 'close_all_sessions'
This patch moves the closing of a child's PD session from the 'Child'
destructor to the 'close_all_sessions' method. This way, the child's
PD quota is immediately returned as soon as init flags a child as
'abandoned', which removes jitter from init's RAM-state reports.

The patch is supposed to make the 'init_loop.run' test much happier.
2018-07-03 09:39:32 +02:00
Christian Helmuth
8d1d57fbdf Tweak run scripts for sel4 (caps, timeout) 2018-07-03 09:39:32 +02:00
Norman Feske
a9183da87b base: create-after-close session-request order
This patch ensures that session-create requests are handled after close
requests, which solves the corner case where one single-session server
receives a close and create request at the same time. E.g., when
expanding a partition with Sculpt, the gpt-write tool is removed and
part_blk is started (to execute resize2fs on top) in one step. Both
interact with the USB-block driver, which is a single-session server.

Fixes #2877
2018-06-29 10:44:58 +02:00
Emery Hemingway
98f1d83194 Automatic session quota upgrades for RM connections
Fix #2838
2018-06-29 10:44:54 +02:00
Martin Stein
fc90c5f8f0 session_label: make typedef String public
Internally, Genode::Session_label has a typedef from String<capacity()> to
String. To have this typedef public is especially useful when reading a
label from an XML node. This can then be written as

! Session_label label = node.attribute_value("label", Session_label::String());

instead of

! Session_label label = node.attribute_value("label", String<160>());

which would be less generic (Session_label cannot be used directly as there
is no appropriate ascii_to implementation).

Issue #2840
2018-06-29 10:40:14 +02:00
Christian Helmuth
246bacd9da depot: update recipe hashes 2018-06-13 13:52:12 +02:00
Alexander Boettcher
ef482513c4 base: reset unfinished xml nodes in xml_generator
Fixes #2855
2018-06-13 13:50:35 +02:00
Norman Feske
81613afa03 base: fix quota transfer to async env services
Whenever an environment session was provided by an asynchronous service,
e.g., the depot_rom of the sculpt scenario, the session quota was not
transferred to the server at session-creation time. This resulted in a
slow depletion of the server's quota over time. This patch ensures that
the delivery of session quota is consistent with the information
reported to the server as session argument.
2018-06-12 12:11:47 +02:00
Norman Feske
578bec11ac base: fix quota reversing when clients vanish
The 'Child::_revert_quota_and_destroy' assumes to be called from the
client's context, which is normally the case when destroying sessions.
However, if a client's session outlives the client (because the
asynchronous close request to the server is still pending), the session
cleanup is performed in the context of the server. Here, the
'session_response' implementation wrongly called
'_revert_quota_and_destroy' to the effect that the session quota was
withdrawn from the server (good) but subsequently transferred back to
the server (bad). The patch replaces the call of
'_revert_quota_and_destroy' with only the first - correct - part of the
transaction.
2018-06-12 12:11:46 +02:00
Alexander Boettcher
193e14a489 grub2: avoid switching modes
to reduce flickering during boot

Issue #2778
2018-06-12 12:11:44 +02:00
Christian Helmuth
bd86efe5fe depot: update recipe hashes 2018-05-31 14:02:21 +02:00
Alexander Boettcher
4979221152 tool: support to use graphical grub2 2018-05-31 13:51:23 +02:00
Alexander Boettcher
e285ecb76c core: avoid freeing wrong regions during attach
In case of an Alloc_return error, don't free the address at 0. If this
is a managed dataspace, there could be valid attachments which then gets
lost.

Make decreasing alignment search working. Continue with lower alignment
restrictions in case the optimal alignment wish can't be fulfilled.
2018-05-31 12:28:16 +02:00
Alexander Boettcher
30d004ab64 base: extend rm_nested test 2018-05-31 12:28:16 +02:00
Alexander Boettcher
30c69e73b3 core: restrict mapping size recursively on regions 2018-05-31 12:28:15 +02:00
Alexander Boettcher
0ef7e58ef9 platform_drv.inc: support acpi_drv and acpica
Issue #2816
2018-05-30 13:36:31 +02:00
Norman Feske
7b6b3a4535 base: fix destruction of async env sessions
When an environment session is provided by a async service such as a
sibling component, the session metadata must be preserved until end of
the lifetime of the session at the server has been acknowledged by the
server. Since the session meta data of env sessions are always part of
the 'Child' object, the destruction of this object must be deferred
until this point.
2018-05-30 13:36:30 +02:00
Alexander Boettcher
675d31587c base: increase retry in expanding_pd_session 2018-05-30 13:36:27 +02:00
Alexander Boettcher
e6d20aba93 base: support to attach RAM dataspaces readonly
Fixes #1633
2018-05-30 13:36:27 +02:00
Norman Feske
24e6b677bd util/list_model.h: graceful handling of duplicates
This patch makes the 'List_model' utility robust against duplicated
occurrences of node IDs in the supplied XML data. If two or more XML
nodes correspond to the same model element, the existing element is
updated with the information of the subsequent XML nodes.
2018-05-30 13:36:18 +02:00
Alexander Boettcher
d450573681 run: image/disk for UEFI & BIOS legacy boot
Fixes #2778
2018-05-30 13:36:14 +02:00
Martin Stein
2bd163533b string.h: ascii_to for unsigned char
Issue #2795
2018-05-30 13:36:11 +02:00
Norman Feske
bf0ef1b8eb base: remove unused argument name in list_model.h
Needed to use the utility with -Weffc++.
2018-05-30 13:36:09 +02:00
Alexander Boettcher
25f2c44874 run: use GPT for image/disk BIOS legacy
Issue #2778

The "create_grub2" script functionality is moved to the g2fg contrib sources
and also the GRUB2 head image (tool/grub2-head.img). The head image is now
partitioned as GPT and bootable in BIOS legacy mode.
2018-05-30 13:36:08 +02:00
Christian Helmuth
cbfec0deed ldso: check ctors sections of shared-object deps
The sole existence of shared-object dependencies lead to fatal
static-constructor errors before. Now, ldso checks if the ctors section
of objects in the init list are non-empty before whining.

Issue #2759
2018-05-30 12:26:18 +02:00
Christian Helmuth
3b7d6394d7 depot: update recipe hashes 2018-05-03 15:32:01 +02:00
Stefan Kalkowski
68015a6e9d base: remove cortex* compiler flags (fix #2787) 2018-05-03 15:32:01 +02:00
Johannes Schlatow
9fc3344ee8 trace/buffer: keep "last" entry on wraps
When the former trace buffer implementation wrapped, the last entry
according to commit order couldn't be detected anymore. Now, the last
committed entry is always followed by an entry with length 0.

As a downside of this, there are now two meanings of "last" entry: It
means either that the entry marks the empty padding after the entry with
the highest memory address or that it actually marks the end of the
buffer according to commit order. This is an example state of the buffer
with the two types of "last" entry:

                           last                                     last
+-------------+------------+---+---------+-------------+------------+---+-------+
| len3  data3 | len4 data4 | 0 | empty   | len1  data1 | len2 data2 | 0 | empty |
+-------------+------------+---+---------+-------------+------------+---+-------+

If the entry with the highest memory address fits perfectly, the first
type of "last" entry is not needed:

                                  last
+------------+--------------------+---+-------+-------------+-------------------+
| len3 data3 | len4         data4 | 0 | empty | len1  data1 | len2        data2 |
+------------+--------------------+---+-------+-------------+-------------------+

If the buffer didn't wrap so far, there is only one "last" entry that
has both meanings:

                                                      last
+--------------------------+------------+-------------+---+---------------------+
| len1               data1 | len2 data2 | len3  data3 | 0 | empty               |
+--------------------------+------------+-------------+---+---------------------+

Issue #2735

Co-authored-by: Martin Stein <martin.stein@genode-labs.com>
2018-05-03 15:31:54 +02:00
Johannes Kliemann
c02ef3ec94 ada: compile runtime bodies, customizable tools
This is a follow-up commit for "ada: runtime and library support".

Issue #2748
2018-05-03 15:31:21 +02:00
Christian Helmuth
47569458d4 depot: update recipe hashes 2018-04-19 12:39:20 +02:00
Johannes Kliemann
1261c18ce9 ada: runtime and library support
The Ada runtime can now be set with the ADA_RTS variable. The ada
library builds a (currently) minimal runtime from the gcc sources that
come with Genode (to stay consistent with the used compiler) and sets
the runtime path accordingly. It is build as a shared library ada.lib.so
which needs to be added to the build files.

I split the existing Ada test into program and library, and moved it
to libports as it depends on the runtime library residing in this
repository too.

Fixes #2748
2018-04-19 12:38:54 +02:00
Norman Feske
cb78516bf1 os: add tests to autopilot
Since the autopilot has become able to use the depot, futher tests can
be enabled by default.
2018-04-19 12:38:53 +02:00
Stefan Kalkowski
ad99688853 imx53_qsb: enable automated network tests
Fix #2749
2018-04-19 12:38:24 +02:00
Stefan Kalkowski
f653be1ebc gpio_drv: add support for i.MX6
Fix #2750
2018-04-19 12:38:24 +02:00
Josef Söntgen
372e426ec7 platform_drv: recognize PCIe NVMe controller
Issue #2747.
2018-04-10 13:56:22 +02:00
Christian Helmuth
d54f95d497 depot: update recipe hashes 2018-04-10 13:03:26 +02:00
Christian Helmuth
92edcb17e5 Warn on redundant call to exec_static_constructors() 2018-04-10 11:20:43 +02:00
Martin Stein
38dbd59d8a timeout: become independent of the Alarm framework
Integrate the code of the Alarm framework directly into the Timeout
framework.  The former Alarm-framework methods are all private to the
corresponding classes of the Timeout framework and get prefixed with
'_alarm__'. The latter avoids name clashes and makes it easier to
simplify the code later.

Issue #2704
2018-04-10 11:11:54 +02:00
Martin Stein
ff7c378ff9 bit_allocator: alloc specific block of bits
Method to try to allocate specific bits of the Bit_allocator_dynamic.

Ref #2670
2018-03-29 15:16:11 +02:00
Martin Stein
8c65219c96 util/string: add ascii_to for unsigned short
Ref #2670
2018-03-29 15:09:05 +02:00
Martin Stein
eb11e077fc list_model: fix missing include
Ref #2670
2018-03-29 15:07:15 +02:00
Alexander Boettcher
4b826d10ef grub2: update to fix boots without using bender
Fixes #2727
2018-03-29 14:59:05 +02:00
Reto Buerki
47724c68c2 platform_drv/x86: Switch to ECAM/MMCONF
Switch port I/O based PCI config space access to memory-mapped IO.  The
base address of the PCI configuration space is acquired by mapping the
ACPI ROM and reading the first <bdf> node. An exception is thrown if the
first <bdf> node is not for PCI domain zero or if multiple <bdf> nodes
exist. This is to reduce complexity and also because multiple PCI
domains are rare.

The PCI configuration space is accessed via I/O mem dataspace which is
created in the platform_drv root and then passed on to the PCI session,
device components and finally to the actual PCI config access instances.

The memory access code is implemented in a way to make it work with Muen
subject monitor (SM) device emulation and also general x86 targets. On
Muen, the simplified device emulation code (which works also for Linux)
always returns 0xffff in EAX to indicate a non-existing device.
Therefore, EAX is enforced in the assembly templates.

Fixes #2547
2018-03-29 14:59:04 +02:00
Christian Helmuth
1f7b5e75bf depot: update recipe hashes 2018-03-08 12:05:10 +01:00
Emery Hemingway
ed1c87c8d6 Xml_generator support for floating point values
Ref #2702
2018-03-08 12:05:08 +01:00
Christian Helmuth
a8f186c7d4 depot: update recipe hashes 2018-02-28 11:05:05 +01:00
Christian Helmuth
d72517e673 Remove replenish error message from quota guard 2018-02-28 11:05:04 +01:00
Stefan Kalkowski
9f945a782f run: enable Wandquad board for network tests
Ref #2665
2018-02-28 11:04:57 +01:00
Norman Feske
8d09d02b85 depot: update recipe hashes 2018-02-09 13:34:24 +01:00
Martin Stein
abf9557bb5 AVL node/tree: make non-copyable
AVL trees can't be copied with the default copy constructor as the
parent pointer of the first item of both of the resulting trees would
point to the original tree. Copying an AVL node, however, generally
violates the integrity of the corresponding tree. The copy constructor
of Avl_tree is used in some places but in those places it can be
replaced easily. So, this commit deletes the copy constructor of
Avl_node_base which makes Avl_node and Avl_tree non-copyable.

Issue #2654
2018-02-09 13:34:23 +01:00
Emery Hemingway
79a433ae77 Fix Nim release mode
Append "-d:release" to NIM_OPTS, not NIM_ARGS in the 'release' spec.
Compiling for a release removes some runtime assertions.

Fix #2662
2018-02-09 13:34:23 +01:00
Stefan Kalkowski
28f7568e82 run: always return driver names in platform.inc
On platforms without nic or audio driver support, the corresponding
functions to return the correct names should return a meaningful
name instead of an empty list. Otherwise, in an erroneous run-script
that calls those functions to append names to the boot modules
the whole 'bin' directory is appended instead, which leads to big
image files or errors when linking the boot modules to core.
2018-02-09 13:34:22 +01:00
Martin Stein
c10554851d trace_session: fix exception list in 'trace' RPC
Trace_session::trace might throw Nonexistant_subject which was neither
documented nor declared in the RPC interface.

Issue #2654
2018-02-09 13:34:19 +01:00
Martin Stein
c68d551c41 base/trace/buffer.h: fix circular #include
Previously, base/trace/buffer.h included base/thread.h which includes
base/trace/logger.h which includes base/trace/buffer.h.

Removed the base/thread.h include in base/trace/buffer.h as it is not
needed.

Issue #2654
2018-02-09 13:34:19 +01:00
Johannes Schlatow
bfe0031304 base-hw: enable SMP support for Zynq-7000 boards
Issue #2641
2018-02-09 13:34:19 +01:00
Norman Feske
10f1616c28 base: add util/list_model.h
The new 'List_model' utility helps with the implementation of
component-internal data models created and updated from XML.

Fixes #2653
2018-02-09 13:34:17 +01:00
Alexander Boettcher
a9a8c65f53 base: remove debug message from Allocator_guard 2018-02-09 13:34:15 +01:00
Norman Feske
e0e9b3b32e init: close all sessions of exited children
With this patch, init responds to the exit of a child by closing all
sessions of the child. E.g., if a child is a GUI application, its
nitpicker session is closed at the time of exit, not at the time when
the start node disappears from init's configuration.

Since this change requires a modification of the 'Genode::Child' class,
it takes the chance to make the child-destruction less brutal. The
new version ensures that all threads of the destructed subsystem are
destructed before other sessions, in particular PD sessions. This
eliminates spurious page-fault warnings during the child destruction.

On Fiasco.OC, closing the CPU session of a thread while being called by
the thread causes a deadlock. Hence, we skip the eager destruction of
CPU sessions on this kernel.

Related to issue #2659
2018-02-09 13:31:27 +01:00
Alexander Boettcher
9fc4ee5f6c base: free up all meta-data of trace subjects
Issue #2638
2018-02-09 13:26:02 +01:00
Martin Stein
26f65f4996 Xml_node: fix bug in Xml_node::decoded_content
Previously, the dst_len value was not decreased after each character that was
written to the dst buffer. This way, if the content length was greater than
dst_len, decoded_content wrote to memory out of bounds.

Issue #2644
2018-02-09 13:26:02 +01:00
Martin Stein
84e476facb Xml_node: do not consider '0' in decoded_content
Do not leave space for a terminating '0' at the end of the dst buffer in
decoded_content as the method does not write this '0'. The caller of the
method shall take care of it instead.

Issue #2644
2018-02-09 13:26:01 +01:00
Christian Helmuth
6013889028 depot: update recipe hashes 2018-01-17 12:14:44 +01:00
Norman Feske
80ef5fa73c Enable use of 'check_abi' in build system
This patch invokes the 'check_abi' tool for each shared library that
implements an ABI.

Issue #2639
2018-01-17 12:14:42 +01:00
Christian Helmuth
b7fffb1b24 abi: remove duplicates and internal symbols, fix sizes
The most important part of this patch are symbol-size changes, which
potentially lead to data corruption.

Issue #2639
2018-01-17 12:14:42 +01:00
Norman Feske
c30299feca Increase default warning level
This patch enables the warnings -Wextra, -Weffc++, and -Werror for
compiling Genode components. It thereby helps us to detect bugs like
uninitialized member variables or missing virtual destructors at compile
time. The warning level is defined via the new 'CC_CXX_WARN_STRICT'
variable. For targets that compile 3rd-party code where this warning
level is not applicable, the variable may be explictly set to an empty
value in the corresponding build-description file.

Issue #465
2018-01-17 12:14:35 +01:00
Norman Feske
eba9c15746 Follow practices suggested by "Effective C++"
The patch adjust the code of the base, base-<kernel>, and os repository.
To adapt existing components to fix violations of the best practices
suggested by "Effective C++" as reported by the -Weffc++ compiler
argument. The changes follow the patterns outlined below:

* A class with virtual functions can no longer publicly inherit base
  classed without a vtable. The inherited object may either be moved
  to a member variable, or inherited privately. The latter would be
  used for classes that inherit 'List::Element' or 'Avl_node'. In order
  to enable the 'List' and 'Avl_tree' to access the meta data, the
  'List' must become a friend.

* Instead of adding a virtual destructor to abstract base classes,
  we inherit the new 'Interface' class, which contains a virtual
  destructor. This way, single-line abstract base classes can stay
  as compact as they are now. The 'Interface' utility resides in
  base/include/util/interface.h.

* With the new warnings enabled, all member variables must be explicitly
  initialized. Basic types may be initialized with '='. All other types
  are initialized with braces '{ ... }' or as class initializers. If
  basic types and non-basic types appear in a row, it is nice to only
  use the brace syntax (also for basic types) and align the braces.

* If a class contains pointers as members, it must now also provide a
  copy constructor and assignment operator. In the most cases, one
  would make them private, effectively disallowing the objects to be
  copied. Unfortunately, this warning cannot be fixed be inheriting
  our existing 'Noncopyable' class (the compiler fails to detect that
  the inheriting class cannot be copied and still gives the error).
  For now, we have to manually add declarations for both the copy
  constructor and assignment operator as private class members. Those
  declarations should be prepended with a comment like this:

        /*
         * Noncopyable
         */
        Thread(Thread const &);
        Thread &operator = (Thread const &);

  In the future, we should revisit these places and try to replace
  the pointers with references. In the presence of at least one
  reference member, the compiler would no longer implicitly generate
  a copy constructor. So we could remove the manual declaration.

Issue #465
2018-01-17 12:14:35 +01:00
Norman Feske
2a33d9aa76 pthread: prevent copy of Genode::Thread object
This patch also adjusts virtualbox because it relies on pthread-internal
interfaces.

Fixes #2630
2018-01-17 12:14:34 +01:00
Christian Helmuth
553cf556af depot: update recipe hashes 2017-12-21 15:01:56 +01:00
Emery Hemingway
ed89f2f7f0 Add millisecond accessor to Genode::Duration value object
Add a 'trunc_to_plain_ms' method to Gende::Duration to make
millisecond-accurate timing safer and more convenient.

Ref #2335
2017-12-21 15:01:51 +01:00
Norman Feske
7e3334ca02 core: make region-map verbosity configurable
With this patch, diagnostic messages generated by core's region-map
handling are printed only if the PD session is created with 'diag'
mode enabled.
2017-12-21 15:01:50 +01:00
Alexander Boettcher
15cc6d688f core: add support to export log output as ROM
Issue #2207
2017-12-21 15:01:46 +01:00
Alexander Boettcher
dd463d3014 base: signal ref count independent of signal count 2017-12-21 15:01:40 +01:00
Alexander Boettcher
9e34ba1458 core: release signal context in signal_ep thread
otherwise the Signal_source_component::_signal_queue gets corrupted.

Issue #2584
2017-12-21 15:01:39 +01:00
Alexander Boettcher
bf74c1694d base: catch ipc error in signal proxy
actually do what the comments says ...

Issue #2584
2017-12-21 15:01:39 +01:00
Alexander Boettcher
a38ec2854a base: fix lock issue in signal context destruction
Issue #2584
2017-12-21 15:01:39 +01:00
Martin Stein
fb2398dbf2 run: target-specific config schemata
The run tool now by default checks configurations with target-specific
XML schemata. Each component may define a config schema file in its
target.mk via the CONFIG_XSD variable. When the run tool has checked an
configuration of an init instance, it additionally goes through the
start nodes of the config. For each start node it checks whether there
is an XSD file that matches. If so, the run tool also checks the config
of the start node (if existant). This is done recursively. I.e., also
the child configs of a sub-init of a sub-init of the top-level init
receive a config check.

Issue #2600
2017-12-21 15:01:36 +01:00
Martin Stein
b812179e82 signal: fix race in Signal_receiver pending_signal
In the past, we had the lock of the context we found for the rest of the scope
of pending_signal. Now we use for_each_locked to find the context and the
lock is released as soon as we return from for_each_locked. Thus, we need to
lock the context again before returning it to avoid that the copy constructor
during the return reads values that are currently changing.

Fixes #2532
2017-12-21 15:01:34 +01:00
Christian Helmuth
25ca29002e depot: update recipe hashes 2017-11-30 11:24:49 +01:00
Norman Feske
44977e3519 base: increase initial stack size on x86_64 2017-11-30 11:23:12 +01:00
Alexander Boettcher
19fe5da9be core: use separate signal ep
Fixes #2584
2017-11-30 11:23:11 +01:00
Alexander Boettcher
8bc4389411 core: support to serve signals by another ep
Issue #2584
2017-11-30 11:23:11 +01:00
Martin Stein
e87f63944f timeout: replace Duration operators by methods
void += (Microseconds) -> void add(Microseconds)
void += (Milliseconds) -> void add(Milliseconds)
bool < (Duration)      -> bool less_than(Duration)

Issue #2581
2017-11-30 11:23:09 +01:00
Martin Stein
26bcd439f7 timeout: fix bug in duration + duration testing
The += operator contained bugs. We now also do some tests on the Duration
type at the beginning of the timeout test.

Fixes #2581
2017-11-30 11:23:09 +01:00
Alexander Boettcher
f4aff87e25 make _timer_ticks_to_us 64bit safe
fixes PIT running to fast on seL4 x86_64
2017-11-30 11:23:07 +01:00
Emery Hemingway
caba2d3021 Enforce use of a custom Nim compiler
Use a custom Nim compiler at '/usr/local/genode-nim' that can be built
with a makefile at 'tool/tool_chain_nim'.

Fix #2545
2017-11-30 11:23:06 +01:00
Alexander Boettcher
9c6de44f98 core: use core mem allocator in Pd_session
Fixes #2563
2017-11-30 11:23:05 +01:00
Martin Stein
8e80c05be7 signal: organize signal contexts as ring list
Ref #2532
2017-11-30 11:23:02 +01:00
Alexander Boettcher
44adc3c404 tool: use grub2 instead of grub1 for iso boot
Fixes #2526
2017-11-30 11:23:01 +01:00
Alexander Boettcher
7ff6e96623 base: avoid pagefault if session creation failed 2017-11-24 09:07:32 +01:00
Christian Helmuth
b1c9db8a0d libc: dispatch pending signals at selective points 2017-11-24 09:02:03 +01:00
Christian Helmuth
491be000ca depot: update recipe hashes 2017-11-09 12:19:59 +01:00
Christian Helmuth
1b4128d3d9 Adapt sub_rm test to current Linux 32-bit
As noted above the former enum for the local-attachment address we
discovered address clashes on current Linux installations, esp. 32-bit
runtime on 64-bit Linux. The local_attach_addr is now configurable in
the run script and the memory maps heuristics were removed.
2017-11-06 13:57:23 +01:00
Alexander Boettcher
9655ebbefe sel4: enable nx bit handling for ARM
Issue #1723
2017-11-01 08:39:49 +01:00
Alexander Boettcher
4dd5e6b266 hw: enable nx bit handling for arm 2017-11-01 08:39:49 +01:00
Alexander Boettcher
aa1d5a7dd1 hw: enable nx bit handling for x86_64
Issue #1723
2017-11-01 08:39:48 +01:00
Alexander Boettcher
8ea584b1d2 foc: enable nx bit handling for x86_64 and arm
Issue #1723
2017-11-01 08:39:48 +01:00
Alexander Boettcher
f2c3225ab6 nova: enable nx bit handling for x86_64
Issue #1723
2017-11-01 08:39:48 +01:00
Alexander Boettcher
db329b02b5 base: enable executable memory fault handling
Fixes #1723
2017-11-01 08:39:48 +01:00
Alexander Boettcher
03b8e70d3f rm_fault: add fault test for exec access violation
Issue #1723
2017-10-20 11:45:21 +02:00
Alexander Boettcher
e3d9f41496 base: provide dst fault address for write fault
Issue #1723
2017-10-20 11:45:20 +02:00
Alexander Boettcher
e6dcdcf277 base: attach executable memory as such
- tracing policy

Issue #1723
2017-10-19 13:47:03 +02:00
Christian Helmuth
ee4ee6a8ac depot: update recipe hashes 2017-10-19 13:31:18 +02:00
Stefan Kalkowski
4e97a6511b hw: switch page-tables only when necessary
* Instead of always re-load page-tables when a thread context is switched
  only do this when another user PD's thread is the next target,
  core-threads are always executed within the last PD's page-table set
* remove the concept of the mode transition
* instead map the exception vector once in bootstrap code into kernel's
  memory segment
* when a new page directory is constructed for a user PD, copy over the
  top-level kernel segment entries on RISCV and X86, on ARM we use a designated
  page directory register for the kernel segment
* transfer the current CPU id from bootstrap to core/kernel in a register
  to ease first stack address calculation
* align cpu context member of threads and vms, because of x86 constraints
  regarding the stack-pointer loading
* introduce Align_at template for members with alignment constraints
* let the x86 hardware do part of the context saving in ISS, by passing
  the thread context into the TSS before leaving to user-land
* use one exception vector for all ARM platforms including Arm_v6

Fix #2091
2017-10-19 13:31:18 +02:00
Stefan Kalkowski
ca60e24ad9 hw: run core threads in privileged mode
* introduce new syscall (core-only) to create privileged threads
* take the privilege level of the thread into account
  when doing a context switch
* map kernel segment as accessable for privileged code only

Ref #2091
2017-10-19 13:31:17 +02:00
Stefan Kalkowski
42db1e112b hw: introduce kernel/user address space split
* introduces central memory map for core/kernel
* on 32-bit platforms the kernel/core starts at 0x80000000
* on 64-bit platforms the kernel/core starts at 0xffffffc000000000
* mark kernel/core mappings as global ones (tagged TLB)
* move the exception vector to begin of core's binary,
  thereby bootstrap knows from where to map it appropriately
* do not map boot modules into core anymore
* constrain core's virtual heap memory area
* differentiate in between user's and core's main thread's UTCB,
  which now resides inside the kernel segment

Ref #2091
2017-10-19 13:31:17 +02:00
Christian Helmuth
0da420c104 Limit max string length in log session for okl4
This commit also adds a test to test-log.
2017-10-19 13:31:16 +02:00
Martin Stein
b811ef4331 signal: fix starvation by fast signal contexts
In the past, a signal context, that was chosen for handling by
'Signal_receiver::pending_signal and always triggered again before
the next call of 'pending_signal', caused all other contexts behind
in the list to starve. This was the case because 'pending_signal'
always took the first pending context in its context list.

We avoid this problem now by handling pending signals in a round-robin
fashion instead.

Ref #2532
2017-10-19 13:29:42 +02:00
Christian Helmuth
28004bc9e6 timer: limit rate of handling timeouts
Ensure that the timer does not handle timeouts again within 1000
microseconds after the last handling of timeouts. This makes denial of
service attacks harder. This commit does not limit the rate of timeout
signals handled inside the timer but it causes the timer to do it less
often. If a client continuously installs a very small timeout at the
timer it still causes a signal to be submitted to the timer each time
and some extra CPU time to be spent in the internal handling method. But
only every 1000 microseconds this internal handling causes user timeouts
to trigger.

If we would want to limit also the call of the internal handling method
to ensure that CPU time is spent beside the RPCs only every 1000
microseconds, things would get more complex. For instance, on NOVA
Time_source::schedule_timeout(0) must be called each time a new timeout
gets installed and becomes head of the scheduling queue. We cannot
simply overwrite the already running timeout with the new one.

Ref #2490
2017-10-05 17:40:05 +02:00
Christian Helmuth
170b532892 Support read-only data symbols in ABI
This also adapts existing symbol files
2017-10-05 17:40:04 +02:00
Norman Feske
bea305aec5 depot: avoid rule aliaing in api/base content.mk
This patch merges two similar rules, which create content at 'include'
into a single rule. This prevents a possible race condition when
creating archives in parallel.
2017-10-05 17:40:01 +02:00
Christian Helmuth
ddfd3c0d7e linux: stack-area handling with recent Linux kernels
We moved the stack-area segment 128 MiB behind text and data to comply
with assumptions in the kernel ELF loader.

This commit also reenables static binaries on linux and removes the
unused stack_area.stdlib.ld script.

Fixes #2521
2017-10-05 17:40:00 +02:00
Norman Feske
1d56c3d3aa base: remove non-critical quota messages
In nested scenarios like driver_manager.run, the initial session quota
for IO_PORT, IO_PORT, and IRQ sessions is expectedly insufficient.
However, the condition is properly handled by re-attemping the request
with a slightly increased quota. Still, core prints a warning each time
the request is denied for quota reasons, which spams the log. This patch
removes the non-critical message.
2017-10-05 17:39:57 +02:00
Emery Hemingway
b20b14de27 support for Nim {.compile.} pragma for C sources
Inject bundled C files into build recipes with the Nim {.compile.}
pragma.

Fix #2516
2017-10-05 17:39:56 +02:00
Johannes Kliemann
d3f5a369a7 ada: implemented add in ada
Fixes #2515
2017-10-05 17:39:55 +02:00
Alexander Boettcher
675e2f062a base: increase stack of entrypoint thread in core
Issue #2514
2017-10-05 17:39:55 +02:00
Christian Helmuth
2ed904faab depot: update recipe hashes 2017-08-30 12:41:43 +02:00
Sebastian Sumpf
991a5a5622 ldso: export symbols required by RISC-V
issue #2423
2017-08-30 09:59:59 +02:00
Alexander Boettcher
830f6934f9 base: add support to unconstrain virtual space
Issue #2507.
2017-08-30 09:59:57 +02:00
Alexander Boettcher
cf2886dc8f core: avoid freeing memory of unknown state
This should actually never happen. However if it happens, be a bit robuster
and don't provide the memory for re-use (which causes tons of other trouble
afterwards).

Issue #2505
2017-08-28 16:49:51 +02:00
Josef Söntgen
404a82d5ee register_set: do not shift when ITEM_WIDTH is 64
Issue #2507.
2017-08-28 16:49:50 +02:00
Martin Stein
d9073a1848 timer/util: generic TIMER_MIN_TICKS_PER_MS
Ref #2400
2017-08-28 16:49:50 +02:00
Martin Stein
399e1586be timer: generic timer_ticks_to_us implementation
There are hardware timers whose frequency can't be expressed as
ticks-per-microsecond integer-value because only a ticks-per-millisecond
integer-value is precise enough. We don't want to use expensive
floating-point values here but nonetheless want to translate from ticks
to time with microseconds precision. Thus, we split the input in two and
translate both parts separately. This way, we can raise precision by
shifting the values to their optimal bit position. Afterwards, the results
are shifted back and merged together again.

As this algorithm is not so trivial anymore and used by at least three
timer drivers (base-hw/x86_64, base-hw/cortex_a9, timer/pit), move it to a
generic header to avoid redundancy.

Ref #2400
2017-08-28 16:49:49 +02:00
Christian Prochaska
ee352abc56 run: add Xen support
When building Genode on a Linux system running in a Xen Dom0, the 'xen'
run target can run a Genode scenario in a Xen DomU.

Usage: in build/x86_*/etc/build.conf, define:

RUN_OPT = --include boot_dir/$(KERNEL) --include image/iso --include power_on/xen --include log/xen --include power_off/xen

The Xen DomU runs in HVM mode and loads Genode from an ISO image. Serial
log output is printed to the console and graphical output is shown in an
SDL window.

The Xen DomU ist managed using the 'xl' command line tool and it is
possible to add configuration options in the 'xen_args' variable in a run
script. Common options are:

- disabling the graphical output:

  append xen_args { sdl="0" }

- configuring a network device:

  append xen_args { vif=\["model=e1000,mac=02:00:00:00:01:01,bridge=xenbr0"\] }

- configuring USB input devices:

  append xen_args { usbdevice=\["mouse","keyboard"\] }

Note: the 'xl' tool requires super-user permissions and interactive
password input can be troublesome in combination with 'expect' and is not
practical for automatic tests. For this reason, the current implementation
assumes that no password input is needed when running 'sudo xl', which can
be achieved by creating a file '/etc/sudoers.d/xl' with the content
'user ALL=(root) NOPASSWD: /usr/sbin/xl'
(where 'user' is the Linux user name).

Fixes #2504
2017-08-28 16:49:48 +02:00
Alexander Boettcher
a63eb3cc37 base: don't free initial slab in destructor
Issue #2505
2017-08-28 16:49:46 +02:00
Stefan Kalkowski
ea46c462a4 base: make stack area base specifiable for core
When running core as the kernel inside every component, a separate
stack area for core is needed that is different from the user-land
component's one.

Ref #2091
2017-08-28 16:49:46 +02:00
Stefan Kalkowski
3906568908 util: make bit array and allocator copyable
Ref #2091
2017-08-28 16:49:46 +02:00
Alexander Boettcher
430bde3636 core: remove unmap from rm_client
The flush/unmap of memory is tied to an address space and not to a thread.
Move the handling from the Rm_client to the Adress_space class.

Issue #2209
2017-08-28 16:49:44 +02:00
Alexander Boettcher
c2950e13eb core: serve parent and core service by one ep
Fixes #2484
2017-08-28 16:49:43 +02:00
Alexander Boettcher
b1a27b417b core: fix deadlock in signal delivery
Acquire Signal_context objects locks via Object_pool::apply() in the
context of the entrpyoint thread, instead in the context of the calling
thread.

Fixes #2485
2017-08-28 16:49:43 +02:00
Emery Hemingway
1e9ad9e3d9 Nim toolchain improvements
- Fix fatal exception handling so that stack traces are dumped
- Add 'include/nim' directories to Nim module search path
- Enable release optimizations for release builds

Fix #2493
2017-08-28 16:49:42 +02:00
Norman Feske
556fec24b1 core-linux: avoid block-for-signal assertion
This patch removes the assertion about the unexpected call of
'block_for_signal' within core. On Linux, this call is actually
expected because of the handling of SIGCHLD signals by core.
2017-08-28 16:49:41 +02:00
Christian Prochaska
b3e039d0b1 base: name initial thread according to child policy
Fixes #2494
2017-08-28 16:49:37 +02:00
Martin Stein
27a608a20a core: ignore boot modules with size 0
A boot module with size 0 previously made Core crash with a page fault in
Region_map_component::attach. This patch prevents the creation of ROM-FS
entries for such modules.

Ref #2490
2017-08-28 16:49:36 +02:00
Martin Stein
23f35370a2 core: generic ROM module initialization
For most base platforms (except linux and sel4), the initialization of
boot modules is the same. Thus, merge this default implementation in the
new unit base/src/core/platform_rom_modules.cc.

Ref #2490
2017-08-28 16:49:36 +02:00
Martin Stein
64377f4b80 core, region map: handle failing metadata assign
In Region_map_component::attach, storing the metadata for a region may
throw an exception. Catch it and throw an Invalid_dataspace exception.

Ref #2490
2017-08-28 16:49:36 +02:00
Martin Stein
b2624be2ad allocator avl: exception if metadata assign fails
The Allocator_avl_tpl::metadata method (assigning variant) may fail
silently. Change this to make debugging easier.

Ref #2490
2017-08-28 16:49:36 +02:00
Martin Stein
0778a0f700 core, region map: more descriptive variable name
In the implementation of Region_map_component::attach
rename variable 'r' 'attach_at'.

Ref #2490
2017-08-28 16:49:36 +02:00
Christian Helmuth
8b073f46df depot: update recipe hashes 2017-08-18 10:25:28 +02:00
Sebastian Sumpf
48134c2a0b ldso/cxx: show symbols names of undefined references
Fixes #2482
2017-08-18 10:24:48 +02:00
Alexander Senier
23db75deff global.mk: Make build messages configurable
This is helpful for disabling messages in etc/tools.conf by
setting it to e.g.

   MSG_LINK = @true ""

This results in much shorter and less cluttered logs in automatic
builds.
2017-08-18 10:24:47 +02:00
Alexander Boettcher
4020766105 sel4: adapt timeouts of run scripts
Issue #2451
2017-08-18 10:24:47 +02:00
Alexander Boettcher
5aab244ce3 sub_rm.run: use config rom for steering test
instead of compile time config enums.
2017-08-18 10:24:47 +02:00
Alexander Boettcher
69e71147ef platform_drv: replace nova specific device_pd
by using generic Pd_session::map instead for eager memory mappings of DMA
memory.

Issue #2209
2017-08-18 10:24:47 +02:00
Alexander Boettcher
fe4bdde687 nova: implement Pd_session::map
- factor out Rm_client::pager lambda code into utility
  Region_map_component::create_map_item
- use utility to find/lookup physical addresses to be mapped eagerly

Issue #2209
2017-08-18 10:24:46 +02:00
Alexander Boettcher
58e4f6cf9d core: add map method to pd_session interface
The method can be used to trigger the eager insertion of page frames into
page tables. Intention: to be used for memory used for DMA.

Issue #2209
2017-08-18 10:24:46 +02:00
Alexander Boettcher
0ddda79511 sel4: add priority support
Issue #2451
2017-08-17 11:04:24 +02:00
Alexander Boettcher
7a8e0e59af sel4: enable smp for x86
Issue #2451
2017-08-17 11:04:24 +02:00
Christian Helmuth
132748a783 Fix location setting in affinity test
This fixes a regression introduced by me in
16914bddc8.
2017-08-17 11:04:22 +02:00
Alexander Boettcher
0743ea87ed rm_fault.run: check for write faults on ROM
Issue #2451
2017-08-17 11:04:21 +02:00
Alexander Boettcher
da5441292a sel4: add Wandboard Quad (iMX6) support
Issue #2451
2017-08-17 11:04:21 +02:00
Alexander Boettcher
c22b60f0c4 base: add initial r0 register to crt0.s for arm
Issue #2451
2017-08-17 11:04:21 +02:00
Alexander Boettcher
51dcf5f7f8 core: destruct platform_pd before ram_ds_factory
Platform_pd "_pd" uses a allocator for, which relies on the mapped RAM
dataspace within core. Unfortunately the RAM dataspaces are already freed up
during _ram_ds_factory destruction, which may lead to trouble if accessed
afterwards.

Issue #2451
2017-08-17 11:04:19 +02:00
Alexander Boettcher
a717e92186 base: set CPP to our custom genode-cpp
Issue #2451
2017-08-17 11:04:18 +02:00
Christian Prochaska
6a43f3c11a file system: use Id_space instead of Node_handle_registry
Fixes #2436
2017-08-17 10:59:43 +02:00
Norman Feske
0d1be4abe2 depot: update recipe hashes 2017-06-29 12:00:04 +02:00
Christian Helmuth
c18dffa9fa base: align metadata allocation in heap at 16 byte
Issue #754
2017-06-29 12:00:03 +02:00
Norman Feske
d2b21d294e base/mk: streamline spec includes for ARM
This patch sets the -march complile flag in spec/arm_v7a.mk, which
enables us to build depot archives for the 'arm_v7a' architecture.

It also removes copy-pasted comments that offer no valuable insights but
contain grammar errors.
2017-06-29 12:00:01 +02:00
Christian Helmuth
4d11b7e5a8 sd_card: move defs from wand_quad to imx6 header 2017-06-29 11:59:57 +02:00
Norman Feske
f95bfddc09 base: simplify handling of session-creation errors
This patch decouples the error handling of the quota transfers
and the actual session creation. In the previous version, an error in
the 'initiate_request' phase would leave the local scope via an
exception without disarming the transfer guard objects. This way,
the guard destructors would attempt the returning of session quota in
addition to the explicit call of '_revert_quota_and_destroy' as done in
the error handling of the 'initiate_request' operation.

In the presence of a session-creation error in the 'initiate_request'
phase, session quota would eventually be returned twice. This patch
removes the intertwined error handling of both phases in a way that the
guards of the first phase (quota transfer) are no longer present in the
second phase (initiate_request).
2017-06-29 11:59:52 +02:00
Norman Feske
f278024e44 core: prevent transfer of static PD session quota
This patch makes sure that the initial PD session limit (as defined by
the client-provided session quota) is preserved over the entire lifetime
of the PD session. That means, it cannot be transferred to other PD
sessions. Otherwise, it may be impossive to hand back all the static
session quota to the PD-session client at session-destruction time
because parts of the initial quota would no longer belong to the
session.

Note that the initial limit can still be used for allocations within the
PD session as those allocations are automatically reverted at
session-destruction time.
2017-06-29 11:59:52 +02:00
Alexander Boettcher
238df4dd58 core: add information about infos provided by core
Issue #2242
2017-06-29 11:59:52 +02:00
Alexander Boettcher
04b2919a1a acpi_drv: use platform_info for rsdt/xsdt lookup
Issue #2242
2017-06-29 11:59:50 +02:00
Christian Helmuth
019528ee6a Disable lock tests on platforms without priorities
The implementations of the lock and C++ guards tests depend on
thread-execution priorities, which produces false negatives of the whole
thread test on platforms without priority support.
2017-06-29 11:59:49 +02:00
Christian Helmuth
d5b85da8de Prevent warning about tiny stack in weak_ptr test 2017-06-19 12:35:57 +02:00
Stefan Kalkowski
a004462096 hw: fix capability accounting of kernel/core
The recently implemented capability resource trading scheme unfortunately
broke the automated capability memory upgrade mechanism needed by base-hw
kernel/core. This commit splits the capability memory upgrade mechanism
from the PD session ram_quota upgrade, and moves that functionality
into a separate Pd_session::Native_pd interface.

Ref #2398
2017-06-19 12:35:55 +02:00
Stefan Kalkowski
6f8dc9054a base: setup parent upgrade mechanism eagerly
Fix #2447
2017-06-19 12:35:55 +02:00
Alexander Boettcher
0f227d5d24 run: adjust virtualbox cap quotas to fit native hw 2017-06-08 11:33:31 +02:00
Alexander Boettcher
77fe0c882b base: check ownership of thread in cpu_session
Fixes #1431
2017-06-08 11:33:06 +02:00
Christian Helmuth
5e1fb42b54 Fix warnings in ADA example 2017-06-02 15:58:22 +02:00
Christian Helmuth
892ede515f depot: update recipe hashes 2017-05-31 16:18:01 +02:00
Norman Feske
7bb8e332a9 depot: adjust base recipe to removed headers
This patch updates the recipes for the base-<kernel> archives to the
recently removed os/config.h and os/timeout.h headers.
2017-05-31 13:16:25 +02:00
Sebastian Sumpf
c3cf7f3c3a riscv: ISA-1.9.1 and GCC-6.3.0 adaptions
Adds 1.9.1 support to base-hw

Note:
* the kernel timer is not working
* dynamic linking is currently not supported
2017-05-31 13:16:24 +02:00
Christian Helmuth
8bd0efced6 Remove obsolete RAM/CAP services from run scripts
Adapted launchpad and also the rm_fault and resource_request tests.

Issue #2407
2017-05-31 13:16:22 +02:00
Stefan Kalkowski
632ef28463 os: removal of deprecated os/config.h (fix #2431) 2017-05-31 13:16:22 +02:00
Norman Feske
adb26b5216 API documentation refinements 2017-05-31 13:16:21 +02:00
Christian Helmuth
e00bd3e45b core: remove PD capability from thread object 2017-05-31 13:16:20 +02:00
Christian Helmuth
ea48f1f1cc core: remove warning about possibly leaking resources
Too many false positives...

Issue #2398
2017-05-31 13:16:20 +02:00
Christian Prochaska
16deaa9a72 timed_semaphore: fix deprecated warning
Fixes #2429
2017-05-31 13:16:19 +02:00
Stefan Kalkowski
0fb672b493 run: use default Qemu memory size for x86
Fix #2428
2017-05-31 13:16:19 +02:00
Emery Hemingway
419da32ee3 lib/ldso: coalesce RPC calls for ROM dataspaces
A dataspace capability request to a ROM service may invalidate any
previously issued dataspace. Therefor no requests should be made while a
session dataspace is mapped. Reducing calls to the session also improves
performance where servicing a ROM request has a significant cost.

Fix #2418
2017-05-31 13:16:16 +02:00
Emery Hemingway
5f27c7b9eb initial Nim compiler and standard library support
https://nim-lang.org/

Fix #1879
2017-05-31 13:16:16 +02:00
Norman Feske
53253ba422 base: add reinit functionality to 'Env'
The 'reinit' and 'reinit_main_thread' methods are needed to implement
fork in Noux. Until now, they were provided by the 'Deprecated_env'
only.
2017-05-31 13:16:14 +02:00
Norman Feske
0167d5af50 Integrate core's RAM service into the PD service
Fixes #2407
2017-05-31 13:16:14 +02:00
Norman Feske
5a3a1c704b base: use 'Ram_allocator' as stack-area back end
The 'Stack_area_ram_session' is now a 'Stack_area_ram_allocator', which
simplifies the code and remove a dependency from the 'Ram_session'
interface, which we want to remove after all.

Issue #2407
2017-05-31 13:16:13 +02:00
Norman Feske
963a6c37a0 core: equip signal-context slab with initial block
By supplying a statically allocated initial block to the slab allocator
for signal contexts, we become able to construct a 'Signal_broker' (the
back end for the PD's signalling API) without any dynamic memory
allocation. This is a precondition for using the PD as meta-data
allocator for its contained signal broker (meta data allocations must
not happen before the PD construction is complete).

Issue #2407
2017-05-31 13:16:13 +02:00
Norman Feske
a96919632e core: unify Pd_session_component across kernels
Issue #2407
2017-05-31 13:16:13 +02:00
Norman Feske
4773707495 core: split RAM dataspace factory from RAM service
By separating the session-interface concerns from the mechanics of the
dataspace creation, the code becomes simpler to follow, and the RAM
session can be more easily merged with the PD session in a subsequent
step.

Issue #2407
2017-05-31 13:16:12 +02:00
Norman Feske
65225a94b1 core: simplify initialization
This patch removes the 'Core_parent' and 'Core_pd_session', and reduces
the 'Core_env'.
2017-05-31 13:16:12 +02:00
Norman Feske
a1df4fee44 base: restructure signal-submit initialization
This patch allows core's 'Signal_transmitter' implementation to sidestep
the 'Env::Pd' interface and thereby adhere to a stricter layering within
core. The 'Signal_transmitter' now uses - on kernels that depend on it -
a dedicated (and fairly freestanding) RPC proxy mechanism for signal
deliver, instead of channeling signals through the 'Pd_session::submit'
RPC function.
2017-05-31 13:16:12 +02:00
Martin Stein
c70fed29f7 os/timer: interpolate time via timestamps
Previously, the Genode::Timer::curr_time always used the
Timer_session::elapsed_ms RPC as back end.  Now, Genode::Timer reads
this remote time only in a periodic fashion independently from the calls
to Genode::Timer::curr_time. If now one calls Genode::Timer::curr_time,
the function takes the last read remote time value and adapts it using
the timestamp difference since the remote-time read. The conversion
factor from timestamps to time is estimated on every remote-time read
using the last read remote-time value and the timestamp difference since
the last remote time read.

This commit also re-works the timeout test. The test now has two stages.
In the first stage, it tests fast polling of the
Genode::Timer::curr_time. This stage checks the error between locally
interpolated and timer-driver time as well as wether the locally
interpolated time is monotone and sufficiently homogeneous. In the
second stage several periodic and one-shot timeouts are scheduled at
once. This stage checks if the timeouts trigger sufficiently precise.

This commit adds the new Kernel::time syscall to base-hw. The syscall is
solely used by the Genode::Timer on base-hw as substitute for the
timestamp. This is because on ARM, the timestamp function uses the ARM
performance counter that stops counting when the WFI (wait for
interrupt) instruction is active. This instruction, however is used by
the base-hw idle contexts that get active when no user thread needs to
be scheduled.  Thus, the ARM performance counter is not a good choice for
time interpolation and we use the kernel internal time instead.

With this commit, the timeout library becomes a basic library. That means
that it is linked against the LDSO which then provides it to the program it
serves. Furthermore, you can't use the timeout library anymore without the
LDSO because through the kernel-dependent LDSO make-files we can achieve a
kernel-dependent timeout implementation.

This commit introduces a structured Duration type that shall successively
replace the use of Microseconds, Milliseconds, and integer types for duration
values.

Open issues:

* The timeout test fails on Raspberry PI because of precision errors in the
  first stage. However, this does not render the framework unusable in general
  on the RPI but merely is an issue when speaking of microseconds precision.

* If we run on ARM with another Kernel than HW the timestamp speed may
  continuously vary from almost 0 up to CPU speed. The Timer, however,
  only uses interpolation if the timestamp speed remained stable (12.5%
  tolerance) for at least 3 observation periods. Currently, one period is
  100ms, so its 300ms. As long as this is not the case,
  Timer_session::elapsed_ms is called instead.

  Anyway, it might happen that the CPU load was stable for some time so
  interpolation becomes active and now the timestamp speed drops. In the
  worst case, we would now have 100ms of slowed down time. The bad thing
  about it would be, that this also affects the timeout of the period.
  Thus, it might "freeze" the local time for more than 100ms.

  On the other hand, if the timestamp speed suddenly raises after some
  stable time, interpolated time can get too fast. This would shorten the
  period but nonetheless may result in drifting away into the far future.
  Now we would have the problem that we can't deliver the real time
  anymore until it has caught up because the output of Timer::curr_time
  shall be monotone. So, effectively local time might "freeze" again for
  more than 100ms.

  It would be a solution to not use the Trace::timestamp on ARM w/o HW but
  a function whose return value causes the Timer to never use
  interpolation because of its stability policy.

Fixes #2400
2017-05-31 13:16:11 +02:00
Alexander Boettcher
6d79d03380 heap: align allocations to 16 byte addresses
Issue #754
2017-05-31 13:16:11 +02:00
Norman Feske
2c6729768d base: consider exception during child construction
This patch make sure that a once managed parent RPC object will always be
dissolved if an exception during the remaining child construction
occurs. The original version would miss the dissolve call if one of the
subsequent members throws an exception at construction time.
2017-05-31 13:16:10 +02:00
Stefan Kalkowski
b58b69515c Remove UART specific SPEC identifiers (Ref #2403) 2017-05-31 13:16:10 +02:00
Norman Feske
433fc6a7f1 base: let 'Local_service' catch all exceptions
This patch eases the debugging of situations where a session-object
constructor wrongly throws an exception type not specified in the
'Local_service::Factory' interface.
2017-05-31 13:16:07 +02:00
Norman Feske
4d442bca30 Streamline exception types
This patch reduces the number of exception types by facilitating
globally defined exceptions for common usage patterns shared by most
services. In particular, RPC functions that demand a session-resource
upgrade not longer reflect this condition via a session-specific
exception but via the 'Out_of_ram' or 'Out_of_caps' types.

Furthermore, the 'Parent::Service_denied', 'Parent::Unavailable',
'Root::Invalid_args', 'Root::Unavailable', 'Service::Invalid_args',
'Service::Unavailable', and 'Local_service::Factory::Denied' types have
been replaced by the single 'Service_denied' exception type defined in
'session/session.h'.

This consolidation eases the error handling (there are fewer exceptions
to handle), alleviates the need to convert exceptions along the
session-creation call chain, and avoids possible aliasing problems
(catching the wrong type with the same name but living in a different
scope).
2017-05-31 13:16:07 +02:00
Norman Feske
1f4f119b1e Capability quota accounting and trading
This patch mirrors the accounting and trading scheme that Genode employs
for physical memory to the accounting of capability allocations.

Capability quotas must now be explicitly assigned to subsystems by
specifying a 'caps=<amount>' attribute to init's start nodes.
Analogously to RAM quotas, cap quotas can be traded between clients and
servers as part of the session protocol. The capability budget of each
component is maintained by the component's corresponding PD session at
core.

At the current stage, the accounting is applied to RPC capabilities,
signal-context capabilities, and dataspace capabilities. Capabilities
that are dynamically allocated via core's CPU and TRACE service are not
yet covered. Also, the capabilities allocated by resource multiplexers
outside of core (like nitpicker) must be accounted by the respective
servers, which is not covered yet.

If a component runs out of capabilities, core's PD service prints a
warning to the log. To observe the consumption of capabilities per
component in detail, the PD service is equipped with a diagnostic
mode, which can be enabled via the 'diag' attribute in the target
node of init's routing rules. E.g., the following route enables the
diagnostic mode for the PD session of the "timer" component:

  <default-route>
    <service name="PD" unscoped_label="timer">
      <parent diag="yes"/>
    </service>
    ...
  </default-route>

For subsystems based on a sub-init instance, init can be configured
to report the capability-quota information of its subsystems by
adding the attribute 'child_caps="yes"' to init's '<report>'
config node. Init's own capability quota can be reported by adding
the attribute 'init_caps="yes"'.

Fixes #2398
2017-05-31 13:16:06 +02:00
Norman Feske
773e08976d Assign cap quotas in run scripts and recipes
Issue #2398
2017-05-31 13:16:06 +02:00
Norman Feske
e44f65f3b2 core: RAM service based on 'Session_object'
This patch reworks the implementation of core's RAM service to make use
of the 'Session_object' and to remove the distinction between the
"metadata" quota and the managed RAM quota. With the new implementation,
the session implicitly allocates its metadata from its own account. So
there is not need to handle 'Out_of_metadata' and 'Quota_exceeded' via
different exceptions. Instead, the new version solely uses the
'Out_of_ram' exception.

Furthermore, the 'Allocator::Out_of_memory' exception has become an alias
for 'Out_of_ram', which simplifies the error handling.

Issue #2398
2017-05-31 13:16:06 +02:00
Norman Feske
028e633af4 base: add 'Session_object' class
The 'Session_object' unifies several aspects of server-component
implementations:

* It keeps track of session quotas and is equipped with standardized
  interfaces (Quota_guard) to upgrade (and in the future potentially
  downgrade) session quotas in a uniform way.

* It follows the pattern of modern RPC objects / signal handlers that
  manage/dissolve themselves at the entrypoint given as constructor
  argument. Thereby, the relationship with its entrypoint is always
  coupled with the lifetime of the session-component object.

* It stores the session label, which was previously done manually by
  most but not all server-component implementations.

* It stores the session 'diag' flag.

* It is equipped with output methods 'diag', 'error', and 'warning'.
  All messages printed from the context of a session component is
  automatically prefixed with the session type and client label.
  Messages passed via 'diag' are only printed if the 'diag' flag of
  the session is set.

Issue #2398
2017-05-31 13:16:06 +02:00