Commit Graph

663 Commits

Author SHA1 Message Date
Alexander Boettcher
675d31587c base: increase retry in expanding_pd_session 2018-05-30 13:36:27 +02:00
Alexander Boettcher
e6d20aba93 base: support to attach RAM dataspaces readonly
Fixes #1633
2018-05-30 13:36:27 +02:00
Christian Helmuth
cbfec0deed ldso: check ctors sections of shared-object deps
The sole existence of shared-object dependencies lead to fatal
static-constructor errors before. Now, ldso checks if the ctors section
of objects in the init list are non-empty before whining.

Issue #2759
2018-05-30 12:26:18 +02:00
Johannes Kliemann
1261c18ce9 ada: runtime and library support
The Ada runtime can now be set with the ADA_RTS variable. The ada
library builds a (currently) minimal runtime from the gcc sources that
come with Genode (to stay consistent with the used compiler) and sets
the runtime path accordingly. It is build as a shared library ada.lib.so
which needs to be added to the build files.

I split the existing Ada test into program and library, and moved it
to libports as it depends on the runtime library residing in this
repository too.

Fixes #2748
2018-04-19 12:38:54 +02:00
Christian Helmuth
92edcb17e5 Warn on redundant call to exec_static_constructors() 2018-04-10 11:20:43 +02:00
Martin Stein
abf9557bb5 AVL node/tree: make non-copyable
AVL trees can't be copied with the default copy constructor as the
parent pointer of the first item of both of the resulting trees would
point to the original tree. Copying an AVL node, however, generally
violates the integrity of the corresponding tree. The copy constructor
of Avl_tree is used in some places but in those places it can be
replaced easily. So, this commit deletes the copy constructor of
Avl_node_base which makes Avl_node and Avl_tree non-copyable.

Issue #2654
2018-02-09 13:34:23 +01:00
Norman Feske
e0e9b3b32e init: close all sessions of exited children
With this patch, init responds to the exit of a child by closing all
sessions of the child. E.g., if a child is a GUI application, its
nitpicker session is closed at the time of exit, not at the time when
the start node disappears from init's configuration.

Since this change requires a modification of the 'Genode::Child' class,
it takes the chance to make the child-destruction less brutal. The
new version ensures that all threads of the destructed subsystem are
destructed before other sessions, in particular PD sessions. This
eliminates spurious page-fault warnings during the child destruction.

On Fiasco.OC, closing the CPU session of a thread while being called by
the thread causes a deadlock. Hence, we skip the eager destruction of
CPU sessions on this kernel.

Related to issue #2659
2018-02-09 13:31:27 +01:00
Alexander Boettcher
9fc4ee5f6c base: free up all meta-data of trace subjects
Issue #2638
2018-02-09 13:26:02 +01:00
Norman Feske
eba9c15746 Follow practices suggested by "Effective C++"
The patch adjust the code of the base, base-<kernel>, and os repository.
To adapt existing components to fix violations of the best practices
suggested by "Effective C++" as reported by the -Weffc++ compiler
argument. The changes follow the patterns outlined below:

* A class with virtual functions can no longer publicly inherit base
  classed without a vtable. The inherited object may either be moved
  to a member variable, or inherited privately. The latter would be
  used for classes that inherit 'List::Element' or 'Avl_node'. In order
  to enable the 'List' and 'Avl_tree' to access the meta data, the
  'List' must become a friend.

* Instead of adding a virtual destructor to abstract base classes,
  we inherit the new 'Interface' class, which contains a virtual
  destructor. This way, single-line abstract base classes can stay
  as compact as they are now. The 'Interface' utility resides in
  base/include/util/interface.h.

* With the new warnings enabled, all member variables must be explicitly
  initialized. Basic types may be initialized with '='. All other types
  are initialized with braces '{ ... }' or as class initializers. If
  basic types and non-basic types appear in a row, it is nice to only
  use the brace syntax (also for basic types) and align the braces.

* If a class contains pointers as members, it must now also provide a
  copy constructor and assignment operator. In the most cases, one
  would make them private, effectively disallowing the objects to be
  copied. Unfortunately, this warning cannot be fixed be inheriting
  our existing 'Noncopyable' class (the compiler fails to detect that
  the inheriting class cannot be copied and still gives the error).
  For now, we have to manually add declarations for both the copy
  constructor and assignment operator as private class members. Those
  declarations should be prepended with a comment like this:

        /*
         * Noncopyable
         */
        Thread(Thread const &);
        Thread &operator = (Thread const &);

  In the future, we should revisit these places and try to replace
  the pointers with references. In the presence of at least one
  reference member, the compiler would no longer implicitly generate
  a copy constructor. So we could remove the manual declaration.

Issue #465
2018-01-17 12:14:35 +01:00
Norman Feske
7e3334ca02 core: make region-map verbosity configurable
With this patch, diagnostic messages generated by core's region-map
handling are printed only if the PD session is created with 'diag'
mode enabled.
2017-12-21 15:01:50 +01:00
Alexander Boettcher
15cc6d688f core: add support to export log output as ROM
Issue #2207
2017-12-21 15:01:46 +01:00
Alexander Boettcher
dd463d3014 base: signal ref count independent of signal count 2017-12-21 15:01:40 +01:00
Alexander Boettcher
9e34ba1458 core: release signal context in signal_ep thread
otherwise the Signal_source_component::_signal_queue gets corrupted.

Issue #2584
2017-12-21 15:01:39 +01:00
Alexander Boettcher
bf74c1694d base: catch ipc error in signal proxy
actually do what the comments says ...

Issue #2584
2017-12-21 15:01:39 +01:00
Alexander Boettcher
a38ec2854a base: fix lock issue in signal context destruction
Issue #2584
2017-12-21 15:01:39 +01:00
Martin Stein
b812179e82 signal: fix race in Signal_receiver pending_signal
In the past, we had the lock of the context we found for the rest of the scope
of pending_signal. Now we use for_each_locked to find the context and the
lock is released as soon as we return from for_each_locked. Thus, we need to
lock the context again before returning it to avoid that the copy constructor
during the return reads values that are currently changing.

Fixes #2532
2017-12-21 15:01:34 +01:00
Norman Feske
44977e3519 base: increase initial stack size on x86_64 2017-11-30 11:23:12 +01:00
Alexander Boettcher
19fe5da9be core: use separate signal ep
Fixes #2584
2017-11-30 11:23:11 +01:00
Alexander Boettcher
8bc4389411 core: support to serve signals by another ep
Issue #2584
2017-11-30 11:23:11 +01:00
Alexander Boettcher
9c6de44f98 core: use core mem allocator in Pd_session
Fixes #2563
2017-11-30 11:23:05 +01:00
Martin Stein
8e80c05be7 signal: organize signal contexts as ring list
Ref #2532
2017-11-30 11:23:02 +01:00
Christian Helmuth
b1c9db8a0d libc: dispatch pending signals at selective points 2017-11-24 09:02:03 +01:00
Christian Helmuth
1b4128d3d9 Adapt sub_rm test to current Linux 32-bit
As noted above the former enum for the local-attachment address we
discovered address clashes on current Linux installations, esp. 32-bit
runtime on 64-bit Linux. The local_attach_addr is now configurable in
the run script and the memory maps heuristics were removed.
2017-11-06 13:57:23 +01:00
Alexander Boettcher
db329b02b5 base: enable executable memory fault handling
Fixes #1723
2017-11-01 08:39:48 +01:00
Alexander Boettcher
03b8e70d3f rm_fault: add fault test for exec access violation
Issue #1723
2017-10-20 11:45:21 +02:00
Alexander Boettcher
e3d9f41496 base: provide dst fault address for write fault
Issue #1723
2017-10-20 11:45:20 +02:00
Alexander Boettcher
e6dcdcf277 base: attach executable memory as such
- tracing policy

Issue #1723
2017-10-19 13:47:03 +02:00
Stefan Kalkowski
4e97a6511b hw: switch page-tables only when necessary
* Instead of always re-load page-tables when a thread context is switched
  only do this when another user PD's thread is the next target,
  core-threads are always executed within the last PD's page-table set
* remove the concept of the mode transition
* instead map the exception vector once in bootstrap code into kernel's
  memory segment
* when a new page directory is constructed for a user PD, copy over the
  top-level kernel segment entries on RISCV and X86, on ARM we use a designated
  page directory register for the kernel segment
* transfer the current CPU id from bootstrap to core/kernel in a register
  to ease first stack address calculation
* align cpu context member of threads and vms, because of x86 constraints
  regarding the stack-pointer loading
* introduce Align_at template for members with alignment constraints
* let the x86 hardware do part of the context saving in ISS, by passing
  the thread context into the TSS before leaving to user-land
* use one exception vector for all ARM platforms including Arm_v6

Fix #2091
2017-10-19 13:31:18 +02:00
Christian Helmuth
0da420c104 Limit max string length in log session for okl4
This commit also adds a test to test-log.
2017-10-19 13:31:16 +02:00
Martin Stein
b811ef4331 signal: fix starvation by fast signal contexts
In the past, a signal context, that was chosen for handling by
'Signal_receiver::pending_signal and always triggered again before
the next call of 'pending_signal', caused all other contexts behind
in the list to starve. This was the case because 'pending_signal'
always took the first pending context in its context list.

We avoid this problem now by handling pending signals in a round-robin
fashion instead.

Ref #2532
2017-10-19 13:29:42 +02:00
Johannes Kliemann
d3f5a369a7 ada: implemented add in ada
Fixes #2515
2017-10-05 17:39:55 +02:00
Alexander Boettcher
675e2f062a base: increase stack of entrypoint thread in core
Issue #2514
2017-10-05 17:39:55 +02:00
Alexander Boettcher
830f6934f9 base: add support to unconstrain virtual space
Issue #2507.
2017-08-30 09:59:57 +02:00
Alexander Boettcher
cf2886dc8f core: avoid freeing memory of unknown state
This should actually never happen. However if it happens, be a bit robuster
and don't provide the memory for re-use (which causes tons of other trouble
afterwards).

Issue #2505
2017-08-28 16:49:51 +02:00
Alexander Boettcher
a63eb3cc37 base: don't free initial slab in destructor
Issue #2505
2017-08-28 16:49:46 +02:00
Stefan Kalkowski
ea46c462a4 base: make stack area base specifiable for core
When running core as the kernel inside every component, a separate
stack area for core is needed that is different from the user-land
component's one.

Ref #2091
2017-08-28 16:49:46 +02:00
Alexander Boettcher
430bde3636 core: remove unmap from rm_client
The flush/unmap of memory is tied to an address space and not to a thread.
Move the handling from the Rm_client to the Adress_space class.

Issue #2209
2017-08-28 16:49:44 +02:00
Alexander Boettcher
c2950e13eb core: serve parent and core service by one ep
Fixes #2484
2017-08-28 16:49:43 +02:00
Alexander Boettcher
b1a27b417b core: fix deadlock in signal delivery
Acquire Signal_context objects locks via Object_pool::apply() in the
context of the entrpyoint thread, instead in the context of the calling
thread.

Fixes #2485
2017-08-28 16:49:43 +02:00
Norman Feske
556fec24b1 core-linux: avoid block-for-signal assertion
This patch removes the assertion about the unexpected call of
'block_for_signal' within core. On Linux, this call is actually
expected because of the handling of SIGCHLD signals by core.
2017-08-28 16:49:41 +02:00
Christian Prochaska
b3e039d0b1 base: name initial thread according to child policy
Fixes #2494
2017-08-28 16:49:37 +02:00
Martin Stein
27a608a20a core: ignore boot modules with size 0
A boot module with size 0 previously made Core crash with a page fault in
Region_map_component::attach. This patch prevents the creation of ROM-FS
entries for such modules.

Ref #2490
2017-08-28 16:49:36 +02:00
Martin Stein
23f35370a2 core: generic ROM module initialization
For most base platforms (except linux and sel4), the initialization of
boot modules is the same. Thus, merge this default implementation in the
new unit base/src/core/platform_rom_modules.cc.

Ref #2490
2017-08-28 16:49:36 +02:00
Martin Stein
64377f4b80 core, region map: handle failing metadata assign
In Region_map_component::attach, storing the metadata for a region may
throw an exception. Catch it and throw an Invalid_dataspace exception.

Ref #2490
2017-08-28 16:49:36 +02:00
Martin Stein
0778a0f700 core, region map: more descriptive variable name
In the implementation of Region_map_component::attach
rename variable 'r' 'attach_at'.

Ref #2490
2017-08-28 16:49:36 +02:00
Sebastian Sumpf
48134c2a0b ldso/cxx: show symbols names of undefined references
Fixes #2482
2017-08-18 10:24:48 +02:00
Alexander Boettcher
5aab244ce3 sub_rm.run: use config rom for steering test
instead of compile time config enums.
2017-08-18 10:24:47 +02:00
Alexander Boettcher
fe4bdde687 nova: implement Pd_session::map
- factor out Rm_client::pager lambda code into utility
  Region_map_component::create_map_item
- use utility to find/lookup physical addresses to be mapped eagerly

Issue #2209
2017-08-18 10:24:46 +02:00
Alexander Boettcher
58e4f6cf9d core: add map method to pd_session interface
The method can be used to trigger the eager insertion of page frames into
page tables. Intention: to be used for memory used for DMA.

Issue #2209
2017-08-18 10:24:46 +02:00
Christian Helmuth
132748a783 Fix location setting in affinity test
This fixes a regression introduced by me in
16914bddc8.
2017-08-17 11:04:22 +02:00
Alexander Boettcher
0743ea87ed rm_fault.run: check for write faults on ROM
Issue #2451
2017-08-17 11:04:21 +02:00
Alexander Boettcher
c22b60f0c4 base: add initial r0 register to crt0.s for arm
Issue #2451
2017-08-17 11:04:21 +02:00
Alexander Boettcher
51dcf5f7f8 core: destruct platform_pd before ram_ds_factory
Platform_pd "_pd" uses a allocator for, which relies on the mapped RAM
dataspace within core. Unfortunately the RAM dataspaces are already freed up
during _ram_ds_factory destruction, which may lead to trouble if accessed
afterwards.

Issue #2451
2017-08-17 11:04:19 +02:00
Christian Helmuth
c18dffa9fa base: align metadata allocation in heap at 16 byte
Issue #754
2017-06-29 12:00:03 +02:00
Norman Feske
f95bfddc09 base: simplify handling of session-creation errors
This patch decouples the error handling of the quota transfers
and the actual session creation. In the previous version, an error in
the 'initiate_request' phase would leave the local scope via an
exception without disarming the transfer guard objects. This way,
the guard destructors would attempt the returning of session quota in
addition to the explicit call of '_revert_quota_and_destroy' as done in
the error handling of the 'initiate_request' operation.

In the presence of a session-creation error in the 'initiate_request'
phase, session quota would eventually be returned twice. This patch
removes the intertwined error handling of both phases in a way that the
guards of the first phase (quota transfer) are no longer present in the
second phase (initiate_request).
2017-06-29 11:59:52 +02:00
Norman Feske
f278024e44 core: prevent transfer of static PD session quota
This patch makes sure that the initial PD session limit (as defined by
the client-provided session quota) is preserved over the entire lifetime
of the PD session. That means, it cannot be transferred to other PD
sessions. Otherwise, it may be impossive to hand back all the static
session quota to the PD-session client at session-destruction time
because parts of the initial quota would no longer belong to the
session.

Note that the initial limit can still be used for allocations within the
PD session as those allocations are automatically reverted at
session-destruction time.
2017-06-29 11:59:52 +02:00
Christian Helmuth
019528ee6a Disable lock tests on platforms without priorities
The implementations of the lock and C++ guards tests depend on
thread-execution priorities, which produces false negatives of the whole
thread test on platforms without priority support.
2017-06-29 11:59:49 +02:00
Christian Helmuth
d5b85da8de Prevent warning about tiny stack in weak_ptr test 2017-06-19 12:35:57 +02:00
Stefan Kalkowski
a004462096 hw: fix capability accounting of kernel/core
The recently implemented capability resource trading scheme unfortunately
broke the automated capability memory upgrade mechanism needed by base-hw
kernel/core. This commit splits the capability memory upgrade mechanism
from the PD session ram_quota upgrade, and moves that functionality
into a separate Pd_session::Native_pd interface.

Ref #2398
2017-06-19 12:35:55 +02:00
Stefan Kalkowski
6f8dc9054a base: setup parent upgrade mechanism eagerly
Fix #2447
2017-06-19 12:35:55 +02:00
Alexander Boettcher
77fe0c882b base: check ownership of thread in cpu_session
Fixes #1431
2017-06-08 11:33:06 +02:00
Christian Helmuth
5e1fb42b54 Fix warnings in ADA example 2017-06-02 15:58:22 +02:00
Christian Helmuth
8bd0efced6 Remove obsolete RAM/CAP services from run scripts
Adapted launchpad and also the rm_fault and resource_request tests.

Issue #2407
2017-05-31 13:16:22 +02:00
Christian Helmuth
e00bd3e45b core: remove PD capability from thread object 2017-05-31 13:16:20 +02:00
Christian Helmuth
ea48f1f1cc core: remove warning about possibly leaking resources
Too many false positives...

Issue #2398
2017-05-31 13:16:20 +02:00
Christian Prochaska
16deaa9a72 timed_semaphore: fix deprecated warning
Fixes #2429
2017-05-31 13:16:19 +02:00
Emery Hemingway
419da32ee3 lib/ldso: coalesce RPC calls for ROM dataspaces
A dataspace capability request to a ROM service may invalidate any
previously issued dataspace. Therefor no requests should be made while a
session dataspace is mapped. Reducing calls to the session also improves
performance where servicing a ROM request has a significant cost.

Fix #2418
2017-05-31 13:16:16 +02:00
Norman Feske
53253ba422 base: add reinit functionality to 'Env'
The 'reinit' and 'reinit_main_thread' methods are needed to implement
fork in Noux. Until now, they were provided by the 'Deprecated_env'
only.
2017-05-31 13:16:14 +02:00
Norman Feske
0167d5af50 Integrate core's RAM service into the PD service
Fixes #2407
2017-05-31 13:16:14 +02:00
Norman Feske
5a3a1c704b base: use 'Ram_allocator' as stack-area back end
The 'Stack_area_ram_session' is now a 'Stack_area_ram_allocator', which
simplifies the code and remove a dependency from the 'Ram_session'
interface, which we want to remove after all.

Issue #2407
2017-05-31 13:16:13 +02:00
Norman Feske
963a6c37a0 core: equip signal-context slab with initial block
By supplying a statically allocated initial block to the slab allocator
for signal contexts, we become able to construct a 'Signal_broker' (the
back end for the PD's signalling API) without any dynamic memory
allocation. This is a precondition for using the PD as meta-data
allocator for its contained signal broker (meta data allocations must
not happen before the PD construction is complete).

Issue #2407
2017-05-31 13:16:13 +02:00
Norman Feske
a96919632e core: unify Pd_session_component across kernels
Issue #2407
2017-05-31 13:16:13 +02:00
Norman Feske
4773707495 core: split RAM dataspace factory from RAM service
By separating the session-interface concerns from the mechanics of the
dataspace creation, the code becomes simpler to follow, and the RAM
session can be more easily merged with the PD session in a subsequent
step.

Issue #2407
2017-05-31 13:16:12 +02:00
Norman Feske
65225a94b1 core: simplify initialization
This patch removes the 'Core_parent' and 'Core_pd_session', and reduces
the 'Core_env'.
2017-05-31 13:16:12 +02:00
Norman Feske
a1df4fee44 base: restructure signal-submit initialization
This patch allows core's 'Signal_transmitter' implementation to sidestep
the 'Env::Pd' interface and thereby adhere to a stricter layering within
core. The 'Signal_transmitter' now uses - on kernels that depend on it -
a dedicated (and fairly freestanding) RPC proxy mechanism for signal
deliver, instead of channeling signals through the 'Pd_session::submit'
RPC function.
2017-05-31 13:16:12 +02:00
Alexander Boettcher
6d79d03380 heap: align allocations to 16 byte addresses
Issue #754
2017-05-31 13:16:11 +02:00
Norman Feske
2c6729768d base: consider exception during child construction
This patch make sure that a once managed parent RPC object will always be
dissolved if an exception during the remaining child construction
occurs. The original version would miss the dissolve call if one of the
subsequent members throws an exception at construction time.
2017-05-31 13:16:10 +02:00
Norman Feske
4d442bca30 Streamline exception types
This patch reduces the number of exception types by facilitating
globally defined exceptions for common usage patterns shared by most
services. In particular, RPC functions that demand a session-resource
upgrade not longer reflect this condition via a session-specific
exception but via the 'Out_of_ram' or 'Out_of_caps' types.

Furthermore, the 'Parent::Service_denied', 'Parent::Unavailable',
'Root::Invalid_args', 'Root::Unavailable', 'Service::Invalid_args',
'Service::Unavailable', and 'Local_service::Factory::Denied' types have
been replaced by the single 'Service_denied' exception type defined in
'session/session.h'.

This consolidation eases the error handling (there are fewer exceptions
to handle), alleviates the need to convert exceptions along the
session-creation call chain, and avoids possible aliasing problems
(catching the wrong type with the same name but living in a different
scope).
2017-05-31 13:16:07 +02:00
Norman Feske
1f4f119b1e Capability quota accounting and trading
This patch mirrors the accounting and trading scheme that Genode employs
for physical memory to the accounting of capability allocations.

Capability quotas must now be explicitly assigned to subsystems by
specifying a 'caps=<amount>' attribute to init's start nodes.
Analogously to RAM quotas, cap quotas can be traded between clients and
servers as part of the session protocol. The capability budget of each
component is maintained by the component's corresponding PD session at
core.

At the current stage, the accounting is applied to RPC capabilities,
signal-context capabilities, and dataspace capabilities. Capabilities
that are dynamically allocated via core's CPU and TRACE service are not
yet covered. Also, the capabilities allocated by resource multiplexers
outside of core (like nitpicker) must be accounted by the respective
servers, which is not covered yet.

If a component runs out of capabilities, core's PD service prints a
warning to the log. To observe the consumption of capabilities per
component in detail, the PD service is equipped with a diagnostic
mode, which can be enabled via the 'diag' attribute in the target
node of init's routing rules. E.g., the following route enables the
diagnostic mode for the PD session of the "timer" component:

  <default-route>
    <service name="PD" unscoped_label="timer">
      <parent diag="yes"/>
    </service>
    ...
  </default-route>

For subsystems based on a sub-init instance, init can be configured
to report the capability-quota information of its subsystems by
adding the attribute 'child_caps="yes"' to init's '<report>'
config node. Init's own capability quota can be reported by adding
the attribute 'init_caps="yes"'.

Fixes #2398
2017-05-31 13:16:06 +02:00
Norman Feske
e44f65f3b2 core: RAM service based on 'Session_object'
This patch reworks the implementation of core's RAM service to make use
of the 'Session_object' and to remove the distinction between the
"metadata" quota and the managed RAM quota. With the new implementation,
the session implicitly allocates its metadata from its own account. So
there is not need to handle 'Out_of_metadata' and 'Quota_exceeded' via
different exceptions. Instead, the new version solely uses the
'Out_of_ram' exception.

Furthermore, the 'Allocator::Out_of_memory' exception has become an alias
for 'Out_of_ram', which simplifies the error handling.

Issue #2398
2017-05-31 13:16:06 +02:00
Norman Feske
aea5d03691 base: add Child_policy::Route::Diag flag
The 'diag' flag can be defined by a target node of a route in init's
configuration. It is propagated as session argument to the server, which
may evaluate the flag to enable diagnostic output for the corresponding
session.

Issue #2398
2017-05-31 13:16:06 +02:00
Norman Feske
3670f7735d base: use 'Quota_transfer::Account' for 'Service'
This patch makes use of the new 'Quota_transfer::Account' by the service
types in base/service.h and uses 'Quota_transfer' objects in
base/child.cc and init/server.cc.

Furthermore, it decouples the notion of an 'Async_service' from
'Child_service'. Init's 'Routed_service' is no longer a 'Child_service'
but is based on the new 'Async_service' instead.

With this patch in place, quota transfers do no longer implicitly use
'Ram_session_client' objects. So transfers can in principle originate
from component-local 'Ram_session_component' objects, e.g., as used by
noux. Therefore, this patch removes a strumbling block for turning noux
into a single threaded component in the future.

Issue #2398
2017-05-31 13:16:06 +02:00
Norman Feske
5c43074bc6 core: simplify core_env.h
Issue #2398
2017-05-31 13:16:05 +02:00
Norman Feske
6609aafb05 Replace Quota_exceeded by Insufficient_ram_quota
This patch replaces the 'Parent::Quota_exceeded',
'Service::Quota_exceeded', and 'Root::Quota_exceeded' exceptions
by the single 'Insufficient_ram_quota' exception type.

Furthermore, the 'Parent' interface distinguished now between
'Out_of_ram' (the child's RAM is exhausted) from
'Insufficient_ram_quota' (the child's RAM donation does not suffice to
establish the session).

This eliminates ambiguities and removes the need to convert exception
types along the path of the session creation.

Issue #2398
2017-05-31 13:16:05 +02:00
Norman Feske
eea493a8ca base: safeguard entrypoint against double manage
This patch adds sanity checks to the RPC entrypoint that detect attempts
to manage or dissolve the same RPC object twice. This is not always a
bug. I.e., if RPC objects are implemented in the modern way where the
object manages/dissolves itself. As the generic framework code (in
particular root/component.h) cannot rely on this pattern, it has to
call manage/dissolve for session objects anyway. For modern session
objects, this double attempt would result in a serious error (double
insertion into the object pool's AVL tree).

Issue #2398
2017-05-31 13:16:05 +02:00
Norman Feske
843dd179d7 base: remove int return types from 'Ram_session'
This patch replaces the existing C-style error codes with C++
exceptions.

Fixes #895
2017-05-31 13:16:04 +02:00
Norman Feske
58f44d39c5 base: use 'Ram_quota' in 'Ram_session' args
This patch replaces the former use of size_t with the use of the
'Ram_quota' type to improve type safety (in particular to avoid
accidentally mixing up RAM quotas with cap quotas).

Issue #2398
2017-05-31 13:16:04 +02:00
Norman Feske
ff68d77c7d base: new 'Ram_allocator' interface
The 'Ram_allocator' interface contains the subset of the RAM session
interface that is needed to satisfy the needs of the 'Heap' and
'Sliced_heap'. Its small size makes it ideal for intercepting memory
allocations as done by the new 'Constrained_ram_allocator' wrapper
class, which is meant to replace the existing 'base/allocator_guard.h'
and 'os/ram_session_guard.h'.

Issue #2398
2017-05-31 13:16:04 +02:00
Norman Feske
c1b981ede4 Annotate session interfaces with CAP_QUOTA
The new 'CAP_QUOTA' enum value denotes the capability quota to be
transferred from the client to the server at session-creation time.

Issue #2398
2017-05-31 13:16:04 +02:00
Norman Feske
bc82cce72b core: add Platform::max_caps()
This method returns the kernel-specific system-global limit of the total
number of capabilities.

Issue #2398
2017-05-31 13:16:03 +02:00
Norman Feske
67481fdfc3 base: support exceptions during _new_slab_block
With the introduction of the 'Out_of_caps' exception type, the slab
needs to consider exceptions during the call of '_new_slab_block' by
reverting the 'nested' state.
2017-05-31 13:16:03 +02:00
Christian Helmuth
f41d8d6b14 core: fix compiler warnings 2017-05-31 13:16:01 +02:00
Christian Helmuth
1d99e7ede9 base: classify signals as I/O and application level
Fixes #2363
2017-05-31 13:15:58 +02:00
Norman Feske
cd5a03758f base: fix bool retval check in heap
Thanks to gcc 6.3 for reporting!
2017-05-31 13:15:55 +02:00
Norman Feske
11aadd4ce8 base: fix gcc-6.3 warning (check null ref)
The check that triggers the warning was solely in place for diagnostic
purposes. We can remove it.
2017-05-31 13:15:55 +02:00
Norman Feske
8e7aa54493 base: drop session states of vanished clients
For asynchronously provided sessions, the parent has to maintain the
session state as long as the server hasn't explicitly responded to a
close request. For this reason, the lifetime of such session states is
bound to the server, not the client.

When the server responds to a close request, the session state gets
freed. The 'session_response' implementation does not immediately
destroy the session state but delegates the destruction to a client-side
callback, which thereby also notifies the client. However, the code did
not consider the case where the client has completely vanished at
session-response time. In this case, we need to drop the session state
immediately.

Fixes #2391
2017-05-31 13:15:52 +02:00
Christian Prochaska
78a9cbf82d Trace::Logger: workaround for compiling with GCC 6
Issue #2375
2017-05-31 13:15:50 +02:00
Christian Prochaska
58f2088d3e gcc: update to version 6.3.0
Issue #2372
2017-05-31 13:15:49 +02:00
Norman Feske
e2fb49ae39 core: avoid using BASE_DIR in vpath
When building core from a source archive, we don't want to incorporate
any source codes from BASE_DIR.
2017-05-02 15:29:03 +02:00
Norman Feske
8f27babf16 mk: strip binaries at <build-dir>/bin/
The <build-dir>/bin/ directory used to contain symbolic links to the
unstripped build results. However, since the upcoming depot tool
extracts the content of binary archives from bin/, the resulting
archives would contain overly large unstripped binaries, which is
undesired. On the other hand, always stripping the build results is not
a good option either because we rely of symbol information during
debugging.

This patch changes the installation of build results such that a new
'debug/' directory is populated besides the existing 'bin/' directory.
The debug directory contains symbolic links to the unstripped build
results whereas the bin directory contains stripped binaries that are
palatable for packaging (depot tool) and for assembling boot images (run
tool).
2017-05-02 15:29:03 +02:00
Norman Feske
8c4a2a48ca core: install core-<kernel>.o at bin/
By installing the core object to bin/, we follow the same convention as
for regular binaries. This, in turn, enables us to ship core in a
regular binary archive. The patch also adjusts the run tool to pick up
the core object from bin/ for the final linking stage.
2017-05-02 15:29:02 +02:00
Alexander Boettcher
1c79ba4182 slab: detect corrupted slab and invalid frees
and report about that.

Fixes #2350
2017-05-02 15:28:54 +02:00
Christian Helmuth
b35df4578b Check Registered base class provides virtual destructor
The base class of Registered must provide a virtual destructor to enable
safe deletion with just a base class pointer. This requirement can be
lifted by using Registered_no_delete in places where the deletion
property is not needed.

Fixes #2331
2017-03-24 16:20:04 +01:00
Christian Helmuth
cb43e04691 ldso: defer execution of static constructors
Ldso now does not automatically execute static constructors of the
binary and shared libraries the binary depends on. If static
construction is required (e.g., if a shared library with constructor is
used or a compilation unit contains global statics) the component needs
to execute the constructors explicitly in Component::construct() via
Genode::Env::exec_static_constructors().

In the case of libc components this is done by the libc startup code
(i.e., the Component::construct() implementation in the libc).

The loading of shared objects at runtime is not affected by this change
and constructors of those objects are executed immediately.

Fixes #2332
2017-03-24 16:20:04 +01:00
Norman Feske
48d1141917 core: improve formatting of allocator dumps
This patch uses the 'Hex_range' and 'Number_of_bytes' utilities to make
the formatted output of 'Allocator_avl_base' better readable.
2017-03-24 16:19:58 +01:00
Norman Feske
d227db4574 base: destruction order of binary/linker ROMs
This patch destructs the environment sessions for the binary and the
dynamic linker along with the other environment sessions to avoid a
warning about reverting quota that occurs when attempting to close
these sessions too late.
2017-03-24 16:19:57 +01:00
Alexander Boettcher
391339a4bb base: handle race in Genode::Registry class
The race may happen when element objects get destructed by another thread then
the thread handling the for_each loop. In this case it may happen that the
object is already destructed (left the ~Element destructor) but the thread
handling the loop touches the invalid memory afterwards (the Element lock).

detected during issue #2299

Fixes #2320
2017-03-15 12:32:28 +01:00
Alexander Boettcher
bed28dfe49 base: extend cxa guards to support threads on various priorities
Fixes #2299
2017-03-15 12:32:23 +01:00
Alexander Boettcher
16e6533a0a base: extend thread test to test cxa guards
with various priorities.

Showcases issue #2299
2017-03-15 12:24:45 +01:00
Alexander Boettcher
25ac3cdd86 base: handle twice Lock::lock calls correctly
to avoid loosing threads in the applicants list if lock owner calls 'twice'
Lock::lock().

Fixes #2300
2017-03-15 12:24:42 +01:00
Alexander Boettcher
8102b78d22 base: extend thread test to test locks
Showcase issue #2300
2017-03-15 12:24:42 +01:00
Christian Helmuth
40f319e9e9 Terminate if pure virtual function is called
Fixes #2229
2017-03-15 12:24:41 +01:00
Norman Feske
226ff08304 core: increase stack size of init-child entrypoint
With the commit "init: session-label rewriting", the stack usage
increased due to the handling of session-label strings as local
variables. The stack overrun occurred in the vmm scenario on
base-hw.
2017-02-28 13:00:44 +01:00
Martin Stein
56cafb3b57 hw: fix race in signal dispatching
There was a race when the component entrypoint wanted to do
'wait_and_dispatch_one_signal'. In this function it raises a flag for
the signal proxy thread to notice that the entrypoint also wants to
block for signals. When the flag is set and the signal proxy wakes up
with a new signal, it tried to cancel the blocking of the entrypoint.
However, if the entrypoint had not reached the signal blocking at this
point, the cancel blocking failed without a solution. Now, the new
Kernel::cancel_next_signal_blocking call solves the problem by storing a
request to cancel the next signal blocking of a thread immediately
without blocking itself.

Ref #2284
2017-02-28 13:00:41 +01:00
Norman Feske
29b8d609c9 Adjust file headers to refer to the AGPLv3 2017-02-28 12:59:29 +01:00
Sebastian Sumpf
35d2d582a4 base: free 'Cpu_free_component' from EP construction fails
It can happen that when Cpu_free_component is constructed the insertion
of the object through 'manage' succeeds for the EP put not for the pager
EP, which in turn raises an Out_of_meta_data exception. Because we are
within the constructor, the descstructor is not called, leading to a
dangling object pool entry for the EP.

issue #2289
2017-02-28 12:59:28 +01:00
Norman Feske
7d9f68493a base: support for multi-staged child startup
This patch enhances the 'Child' and 'Child_policy' with the ability to
separate the different steps of bootstrapping children. If the
'Child_policy::initiate_env_sessions()' returns false, the child's
environment sessions remain unrouted at construction time. This way,
child objects for many children can be initialized to a state that
allows the children to represent services for other children. Therefore,
session routing can be applied before any child executes.

At this stage, the environment RAM sessions of all children can be
created. Note that this step still has the limitation that RAM sessions
are generally expected to be provided by either the parent or a local
service.

Once all children are equipped with RAM, they can in principle receive
session-quota donations. Hence, all other environment sessions can now
be arbitrarily routed and initiated.

Once the environment of a child is complete, the child's process and
initial thread is created.
2017-02-28 12:59:23 +01:00
Norman Feske
9cba459958 base: remove Child::heap
This patch improves the accounting for the backing store of
session-state meta data. Originally, the session state used to be
allocated by a child-local heap partition fed from the child's RAM
session. However, whereas this approach was somehow practical from a
runtime's (parent's) point of view, the child component could not count
on the quota in its own RAM session. I.e., if the Child::heap grew at
the parent side, the child's RAM session would magically diminish. This
caused two problems. First, it violates assumptions of components like
init that carefully manage their RAM resources (and giving most of them
away their children). Second, if a child transfers most of its RAM
session quota to another RAM session (like init does), the child's RAM
session may actually not allow the parent's heap to grow, which is a
very difficult error condition to deal with.

In the new version, there is no Child::heap anymore. Instead, session
states are allocated from the runtime's RAM session. In order to let
children pay for these costs, the parent withdraws the local session
costs from the session quota donated from the child when the child
initiates a new session. Hence, in principle, all components on the
route of the session request take a small bite from the session quota to
pay for their local book keeping

Consequently, the session quota that ends up at the server may become
depleted more or less, depending on the route. In the case where the
remaining quota is insufficient for the server, the server responds with
'QUOTA_EXCEEDED'. Since this behavior must generally be expected, this
patch equips the client-side 'Env::session' implementation with the
ability to re-issue session requests with successively growing quota
donations.

For several of core's services (ROM, IO_MEM, IRQ), the default session
quota has now increased by 2 KiB, which should suffice for session
requests to up to 3 hops as is the common case for most run scripts. For
longer routes, the retry mechanism as described above comes into effect.
For the time being, we give a warning whenever the server-side quota
check triggers the retry mechanism. The warning may eventually be
removed at a later stage.
2017-02-28 12:59:23 +01:00
Norman Feske
9d683a56a0 base: add Child_policy::session_state_changed()
This method is a hook to enable a runtime to respond to state changes.
In particular, in init this hook is used to trigger the generation of a
new state report, if configured.

Furthermore, the patch introduces the 'generate_client_side_info' and
'generate_server_side_info' methods to the 'Session_state', which
generates an XML representation of the session states to appear in
reports produced by init.

Issue #2246
2017-02-28 12:59:22 +01:00
Norman Feske
c0af463b81 base: Add Child_policy::Route
The new return value of 'resolve_session_request' allows the child
policy to define the label used as the policy selector at the server.

Because this patch introduces the distinction of the child-provided
label from the label as presented to the server along with the session
request, the latter is now handled as a dedicated 'Session_state'
argument.

Issue #2248
2017-02-28 12:59:20 +01:00
Norman Feske
8e6306e8e3 base: tolerate nested signal handling (but warn) 2017-02-27 15:37:50 +01:00
Sebastian Sumpf
b66716d278 base: entrypoint 'wait_and_dispatch_one_signal'
There existed a race when 'wait_and_dispatch_one_signal' is called form
a RPC context, because the 'signal_proxy' or 'main' will block and the
signal semaphore, when the EP then calls 'wait_and_dispatch_one_signal',
the signal proxy is woken up ands sends an RPC to the EP, leading to a
dead lock if no further signal arrive, because the EP will then remain
blocked in the signal semaphore.

Therefore, for this case, the signal proxy will now perform a semaphore
up operation and does not perform an RPC if the EP is within
'wait_and_dispatch_one_signal'.
2017-02-27 15:37:50 +01:00
Stefan Kalkowski
786a81c846 core: unify log() initialization between kernels
* initialize the log environment implicitly for core
* removing the redundant lock
* unify between base-hw and all others

Ref #2092
2017-02-07 19:20:29 +01:00
Josef Söntgen
f26532803f core: use proper size in Trace-Policies Tslab
Issue #2260.
2017-02-07 11:12:26 +01:00
Christian Prochaska
a1b4e905ab Signal_receiver::wait_for_signal(): check for pending signal before blocking
Fixes #2267
2017-02-07 11:12:23 +01:00
Christian Helmuth
ce3d10465e Mark warnings from the signal dispatcher as such 2017-01-31 14:58:36 +01:00
Christian Helmuth
7386c4e1d1 More robust handling of suspend in entrypoint
First, calls to manage and dissolve signal contexts now check if the
signal receiver was constructed. There is a small window during suspend
where it is destructed before reconstructed again.

Last, we ensure that processing of incoming signal was deblocked by the
suspend signal before entering the suspend operation. This way we ensure
already queued signal are handled.
2017-01-31 14:58:36 +01:00
Alexander Boettcher
dd5592cc50 Fix String(Hex()) usage
- additional add test casye to log.run

Fixes #2265
2017-01-31 12:02:21 +01:00
Norman Feske
cd3a5852d6 Warn about the use of deprecated headers
This commit enables compile-time warnings displayed whenever a deprecated
API header is included, and adjusts the existing #include directives
accordingly.

Issue #1987
2017-01-31 12:01:18 +01:00
Martin Stein
ed62199957 test/reconstructible: move to base
The test uses only stuff from the base repo.

Ref #1987
2017-01-31 12:01:15 +01:00
Martin Stein
d1134644cc test/synced_interface: move to base
The test uses only stuff from the base repo.

Ref #1987
2017-01-31 12:01:15 +01:00
Alexander Boettcher
f52c44647f core: replace misleading avl warning in detach
If the detach address is not the beginning of the region, one gets:

"virtual void Genode::Allocator_avl_base::free(void*): given
 address (0x180e0) is not the block start address (0x18000)"

Instead, print an explicit warning in front of the detach call.
2017-01-31 12:01:12 +01:00
Norman Feske
e43da51bd6 base: handle dangling env sessions in ~Child
This commit addresses the situation where an environment session
outlives the session-providing service. In this case, the env session
got already invaidated at the destruction time of the server. However,
the underlying session-state structure continues to exist until the
client is destructed. During the eventual destruction of such a dangling
environment session, we have to be careful not to interact with the
no-longer existing service.

Ref #2197
2017-01-20 16:47:01 +01:00
Norman Feske
21458e6efa base: destruction of env-session-providing child
This patch addresses the corner case of destructing a child that
provides an enviroment session to another child. Before this patch,
this situation could result in an infinite loop.

The problem was introduced as a side effect of issue #2197 "base: apply
routing policy to environment sessions".
2017-01-20 16:47:00 +01:00
Christian Prochaska
7948a7261b ldso: constrain second linker symbol relocation pass on x86_64
Handle only GLOB_DAT relocations in the second relocation pass, like it is
done on x86_32 and ARM.

Fixes #2219
2017-01-20 16:46:55 +01:00
Norman Feske
a7f40b24ca Warn about the use of deprecated env() function
This patch enables warnings if one of the deprecate functions that rely
in the implicit use of the global Genode::env() accessor are called.

For the time being, some places within the base framework continue
to rely on the global function while omitting the warning by calling
'env_deprecated' instead of 'env'.

Issue #1987
2017-01-13 13:07:13 +01:00
Stefan Kalkowski
aa004cf211 base: transition to new API for tests (ref #1987) 2017-01-13 13:07:07 +01:00
Norman Feske
4da52517c1 Simpify startup of dynamically linked binaries
This patch removes the component_entry_point library, which used to
proved a hook for the libc to intercept the call of the
'Component::construct' function. The mechansim has several shortcomings
(see the discussion in the associated issue) and was complex. So we
eventually discarded the approach in favor of the explicit handling of
the startup.

A regular Genode component provides a 'Component::construct' function,
which is determined by the dynamic linker via a symbol lookup.
For the time being, the dynamic linker falls back to looking up a 'main'
function if no 'Component::construct' function could be found.

The libc provides an implementation of 'Component::construct', which
sets up the libc's task handling and finally call the function
'Libc::Component::construct' from the context of the appllication task.
This function is expected to be provided by the libc-using application.
Consequently, Genode components that use the libc have to implement the
'Libc::Component::construct' function.

The new 'posix' library provides an implementation of
'Libc::Component::construct' that calls a main function. Hence, POSIX
programs that merely use the POSIX API merely have to add 'posix' to the
'LIBS' declaration in their 'target.mk' file. Their execution starts at
'main'.

Issue #2199
2017-01-13 13:06:52 +01:00
Sebastian Sumpf
6e14aa4364 ldso: mark functions used during self relocation
These functions are marked as always inline through the 'SELF_RELOC' macro. This
became necessary because on riscv functions calls are performed through the
global offset table, which is not initialized at this point.

Fixes #2203
2017-01-13 13:05:45 +01:00
Norman Feske
9ea4a491d6 ld: generate symbol map from base/lib/symbols/ld
This patch removes the manually maintained symbol map from the dynamic
linker. This way, the symbol map stays in sync with the ABI and - more
importantly - no longer uses wildcards. So the symbols exported by the
dynamic linker are strictly limited by the ABI.

Issue #2190
2016-12-23 16:53:17 +01:00
Norman Feske
0d295f75a1 base: apply routing policy to environment sessions
This patch changes the child-construction procedure to allow the routing
of environment sessions to arbitrary servers, not only to the parent.
In particular, it restores the ability to route the LOG session of the
child to a LOG service provided by a child of init. In principle, it
becomes possible to also route the immediate child's PD, CPU, and RAM
environment sessions in arbitrary ways, which simplifies scenarios that
intercept those sessions, e.g., the CPU sampler.

Note that the latter ability should be used with great caution because
init needs to interact with these sessions to create/destruct the child.
Normally, the sessions are provided by the parent. So init is safe at
all times. If they are routed to a child however, init will naturally
become dependent on this particular child. For the LOG session, this is
actually not a problem because even though the parent creates the LOG
session as part of the child's environment, it never interacts with the
session directly.

Fixes #2197
2016-12-23 16:52:08 +01:00
Norman Feske
c450ddcb3d Disambiguate kernel-specific file names
This patch removes possible ambiguities with respect to the naming of
kernel-dependent binaries and libraries. It also removes the use of
kernel-specific global side effects from the build system. The reach of
kernel-specific peculiarities has thereby become limited to the actual
users of the respective 'syscall-<kernel>' libraries.

Kernel-specific build artifacts are no longer generated at magic places
within the build directory (like okl4's includes, or the L4 build
directories of L4/Fiasco and Fiasco.OC, or the build directories of
various kernels). Instead, such artifacts have been largely moved to the
libcache. E.g., the former '<build-dir>/l4/' build directory for the L4
build system resides at '<build-dir>/var/libcache/syscall-foc/build/'.
This way, the location is unique to the kernel. Note that various tools
are still generated somewhat arbitrarily under '<build-dir>/tool/' as
there is no proper formalism for building host tools yet.

As the result of this work, it has become possible to use a joint Genode
build directory that is usable with all kernels of a given hardware
platform. E.g., on x86_32, one can now seamlessly switch between linux,
nova, sel4, okl4, fiasco, foc, and pistachio without rebuilding any
components except for core, the kernel, the dynamic linker, and the timer
driver. At the current stage, such a build directory must still be
created manually. A change of the 'create_builddir' tool will follow to
make this feature easily available.

This patch also simplifies various 'run/boot_dir' plugins by removing
the option for an externally hosted kernel. This option remained unused
for many years now.

Issue #2190
2016-12-23 16:51:32 +01:00
Norman Feske
3865ee7ccc foc: move base/thread_state.h to include/foc/
The header is foc-specific. It used to shadow the generic one provided
by the base repository, which contradicts with the kernel-agnostic
Genode API. Hence, it had to be moved to a foc-specific location.
2016-12-23 16:51:12 +01:00
Alexander Boettcher
e4a1904456 core: fix deadlock in region_map destruction
Introduced by:

commit 99fbb23ec5
Author: Alexander Boettcher <alexander.boettcher@genode-labs.com>
Date:   Fri Sep 9 17:49:34 2016 +0200

    core: use weak_ptr for Rm_faulter and Region_map

    Issue #2086
2016-12-14 11:22:30 +01:00
Norman Feske
ccffbb0dfc Build dynamically linked executables by default
Fixes #2184
2016-12-14 11:22:27 +01:00
Norman Feske
d882277ce3 base: let ldso use the default stack size 2016-12-14 11:19:38 +01:00
Norman Feske
4e4cdacab3 base: trim main-thread size to 4/8 KiB
The main thread does no longer execute application code. It is solely
responsible for the initialization of the component's entrypoint and for
retrieving asynchronous notifications. Since the stack usage is no
longer dependent on application-specific code, we can significantly
shrink it to reduce the memory footprint of components. In the worst
case - should the stack overrun - we would observe a page fault because
the stack is placed in the stack area, surrounded by guard pages.
2016-12-14 11:19:38 +01:00
Norman Feske
cc98cef770 genode_rel.ld: add .gcc_except_table to RO segment
By moving .gcc_except_table section to the read-only ELF segment, this
patch reduces the size of the dynamically allocated data/bss segment.
2016-12-14 11:19:37 +01:00
Norman Feske
a387d68c2c base: use a default stack size of 64 KiB
This patch replaces the former machine-word-dependent default stack size
by the fixed value of 64 KiB which should suffice for components on both
32 and 64 bit. Previously, the default stack size on 64 bit was 128 KiB,
which is wasteful. If a component needs more stack than 64 KiB, it can
specify a custon stack size by implementing 'Component::stack_size'.
2016-12-14 11:19:37 +01:00
Norman Feske
28f5688dcf base: reduce size of initial stack from 32K to 4K
The initial stack is solely used to initialize the Genode environment
along with the application stack located in the stack area. It never
executes application code. Hence, we can make it small. To check that it
is not dimensioned too small, the patch introduces a sanity check right
before switching to the application stack.
2016-12-02 15:20:31 +01:00
Norman Feske
92460cdab7 base: remove initial heap chunk from heap
This change reduces the BSS segment by 32 KiB (on 64 bit).
2016-12-02 15:20:31 +01:00
Norman Feske
25a7ea3d40 base: rename 'Volatile_object' to 'Reconstructible'
Fixes #2151
2016-12-01 17:46:50 +01:00
Christian Helmuth
53271d8c5f Use default component stack size where appropriate 2016-11-30 13:38:06 +01:00
Norman Feske
6a24d70120 Fix clang compile errors
Thanks Keiko Nakata for reporting!

Fixes #2164
2016-11-30 13:37:07 +01:00
Norman Feske
5a1cef6381 Make label prefixing more strict
This patch unconditionally applies the labeling of sessions and thereby
removes the most common use case of 'Child_policy::filter_session_args'.
Furthermore, the patch removes an ambiguity of the session labels of
sessions created by the parent of behalf of its child, e.g., the PD
session created as part of 'Child' now has the label "<child-name>"
whereas an unlabeled PD-session request originating from the child
has the label "<child-name> -> ". This way, the routing-policy of
'Child_policy::resolve_session_request' can differentiate both cases.

As a consequence, the stricter labeling must now be considered wherever
a precise label was specified as a key for a session route or a server-
side policy selection. The simplest way to adapt those cases is to use a
'label_prefix' instead of the 'label' attribute. Alternatively, the
'label' attribute may used by appending " -> " (note the whitespace).

Fixes #2171
2016-11-30 13:37:07 +01:00
Alexander Boettcher
c83eb515f9 base: sanity check for slab element allocation
Issue #1039
2016-11-30 13:37:06 +01:00
Alexander Boettcher
b8f9f92731 base: remove allocation warning in heap
The heap typically first tries to allocate larger chunks than necessary, and
if it fails the actual minimal one. The first attempt already triggers warnings
which are not critical at all. If the second (critical) allocation fails,
then there are additionally checks and warnings already in place.

Issue #1039
2016-11-30 13:37:06 +01:00
Norman Feske
5ba245f476 base: minor style fixes 2016-11-30 13:37:06 +01:00
Alexander Boettcher
03f0f38567 cxx: avoid warnings about cxx exception memory
Avoids warnings like

Warning: 2 dangling allocations at allocator destruction time

during noux process destruction.
2016-11-30 13:37:05 +01:00
Alexander Boettcher
3c4372210e core: remove redundant datastructure
Avl allocator provides a method to lookup any element, which is sufficient
to find all regions to destruct.

Issue #2173
2016-11-30 13:37:04 +01:00
Martin Stein
82443ddee6 thread test: handle capability ref-count overflow
Triggered by the create-as-many-threads test as it tries to
create as many threads as possible.

Ref #2120
2016-11-30 13:37:04 +01:00
Martin Stein
99f18a2fe6 core: handle cap-ref-cnt overflow in create_thread
The code in Core's Cpu_session_component::create_thread might throw a
capability refernce-count overflow if one creates many threads, which would
kill core if not handled.

Ref #2120
2016-11-30 13:37:04 +01:00
Martin Stein
288c2c50ba base: throw exception on cap-ref-count overflow
Ref #2120
2016-11-30 13:37:04 +01:00
Norman Feske
cfdbccc5c2 Remove blocking calls from root and parent RPCs
This is a redesign of the root and parent interfaces to eliminate
blocking RPC calls.

- New session representation at the parent (base/session_state.h)
- base-internal root proxy mechanism as migration path
- Redesign of base/service.h
- Removes ancient 'Connection::KEEP_OPEN' feature
- Interface change of 'Child', 'Child_policy', 'Slave', 'Slave_policy'
- New 'Slave::Connection'
- Changed child-construction procedure to be compatible with the
  non-blocking parent interface and to be easier to use
- The child's initial LOG session, its binary ROM session, and the
  linker ROM session have become part of the child's envirenment.
- Session upgrading must now be performed via 'env.upgrade' instead
  of performing a sole RPC call the parent. To make RAM upgrades
  easier, the 'Connection' provides a new 'upgrade_ram' method.

Issue #2120
2016-11-25 16:06:42 +01:00
Norman Feske
baf61df0fd base: new 'Registry' data structure
This data structure is meant as a safe alternative for a list wherever
the list is solely used to remember objects and iterate through them in
an unspecified order. One use case is the 'Service_registry'.
2016-11-25 15:30:58 +01:00
Alexander Boettcher
81f0cacf66 core: prefer RAM allocation in high memory
We preserve lower RAM for device drivers with physical memory
constraints. If no physical RAM constraint exists, the allocations above
3G (32-bit) or 4G (64-bit) are preferred.
2016-11-25 15:30:57 +01:00
Christian Helmuth
f75f199947 ldso: initialize ELF object before relocating
This fixes a regression on Ubuntu 16.04 (resp. Linux systems with recent
kernel versions) and address-space randomization originating from an
uninitialized relocation base of 0.
2016-11-25 15:27:28 +01:00
Stefan Kalkowski
f60cf697d2 core: simplify Rom_module and Rom_fs
* replace print_fs with Output::print equivalent
* use Avl_tree::for_each instead of own implementation
* extend constness

Ref #2159
2016-11-08 15:45:21 +01:00
Stefan Kalkowski
e1ec39e476 base: replace dump utilities in Allocator_avl
Replace 'dump()' debug utilities within Allocator_avl with Output::print
equivalents, and use the new Avl_tree::for_each utility to simplify
the implementation.

Ref #2159
2016-11-08 15:44:55 +01:00
Emery Hemingway
eff90d759f remove global namespacing from internal base headers
Making the Genode namespace global can cause name collisions on
base-linux.

Fix #2158
2016-11-08 15:26:33 +01:00
Norman Feske
784e728727 Clean ldso from using deprecated APIs
Issue #1987
2016-11-08 15:26:32 +01:00
Norman Feske
b9280678fb base-linux: fix race in region_map_mmap
This patch fixes a race condition triggered by the thread test running
on Linux inside VirtualBox. The 'test_stack_alloc' sporadically produced
one of two errors: A segfault in the 'Thread::deinit_platform_thread' on
the attempt to access the 'native_thread' of the to-be-destructed thread
(this data structure is located on the thread's stack). Or, an error
message about a region conflict within the stack area.

The problem was that two instances of 'Region_map_mmap' issued a
sequence of munmap and mmap each. Even though each instance locked the
attach/detach operations, the lock was held per instance. In a situation
where two instances performed attach/detach operations in parallel, the
syscall sequences could interfere with each other.

In the test scenario, the two region-map instances are the test's
address space and the stack area. When creating a thread, the thread's
trace-control dataspace is attached at an arbitrary place (picked by
the Linux kernel) within the address space whereas the stack is attached
at the stack area. The problem is the following sequence:

Thread A wants to destruct a thread:
1. Remove stack from stack area
   (issue unmap syscall)
2. Preserve virtual address range that was occupied from the stack
   so that Linux won't use it
   (issue mmap syscall)

Thread B wants to construct a thread:
1. Request trace-control dataspace from CPU session
2. Attach trace-control dataspace to address space at a location
   picked by the Linux kernel
   (issue mmap syscall)

The problem occurs when thread B's second step is executed in between
the steps 1 and 2 of thread A and the Linux kernel picks the
just-unmapped address as the location for the new trace-control mapping.
Now, the trace control dataspace is mapped at the virtual address that
was designated for the stack of the to-be-created thread, and the
attempt to map the real stack fails.

The patch fixes the problem by replacing the former region-map-local
locks by a component-global lock.

Furthermore, it cleans up core's implementation of the support function
for the region-map-mmap implementation, eliminating the temporary
unlocking of the region-map lock during RPC.
2016-11-08 15:26:30 +01:00
Norman Feske
afed9cfd95 base: let string accept multiple arguments
Issue #2064
2016-11-08 15:26:30 +01:00
Stefan Kalkowski
7e1692d997 core: unify handling of boot modules
Instead of solving the problem to deliver ROM modules to core while booting
differently for the several kernels (multi-boot, elfweaver, core re-linking),
this commit unifies the approaches. It always builds core as a library, and
after all binaries are built from a run-script, the run-tool will link an
ELF image out of the core-library and all boot modules. Thereby, core can
access its ROM modules directly.

This approach now works for all kernels except Linux.

With this solution, there is no [build_dir]/bin/core binary available anymore.
For debugging purposes you will find a core binary without boot modules, but
with debug symbols under [run_dir].core.

Fix #2095
2016-11-08 15:26:27 +01:00
Stefan Kalkowski
2a2e5c2df4 base-*: remove usage of printf
base generic code:
  * Remove unused verbosity code from mmio framework
  * Remove escape sequence end heuristic from LOG
  * replace Core_console with Core_log (no format specifiers)
  * move test/printf to test/log
  * remove `printf()` tests from the log test
  * check for exact match of the log test output
base-fiasco:
  * remove unused Fiasco::print_l4_threadid function
base-nova:
  * remove unused hexdump utility from core
base-hw:
  * remove unused Kernel::Thread::_print_* debug utilities
  * always print resource summary of core during startup
  * remove Kernel::Ipc_node::pd_label (not used anymore)
base*:
  * Turn `printf`,`PWRN`, etc. calls into their log equivalents

Ref #1987
Fix #2119
2016-10-21 12:39:36 +02:00
Alexander Boettcher
c99729093a base: fix race in multiple lock.unlock() calls
Fixes #2122
2016-10-21 12:39:34 +02:00
Alexander Boettcher
3449985fdf base: avoid deadlock in region_map destruction
Fixes #2115
2016-10-21 12:39:33 +02:00
Christian Prochaska
3a1f852318 base: don't use the 'size' argument in 'Heap::free()'
The Heap reports that 'free()' does not rely on a valid 'size' argument,
so it should not use it.

Fixes #2113
2016-10-21 12:39:32 +02:00
Stefan Kalkowski
3f6e148621 base: remove obsolete _prog_img_data symbol
Fix #2099
2016-10-21 12:39:31 +02:00
Norman Feske
e370e08e01 Define Genode::size_t as unsigned long
Fixes #2105
2016-10-21 12:39:29 +02:00
Alexander Boettcher
99fbb23ec5 core: use weak_ptr for Rm_faulter and Region_map
Fixes #2086
2016-09-14 11:53:04 +02:00
Stefan Kalkowski
2147c42ec6 base: unify page-fault notification for kernels
* Enable page-fault messages for regions not directly managed by core
* Unify output given when a page-fault occurs related to those regions

Fix #2082
2016-09-09 11:49:34 +02:00
Christian Helmuth
5a92c9b6eb Increase stack size of mp_server test 2016-09-09 11:48:43 +02:00
Norman Feske
fac69eff48 core: handle out-of-memory in RM service
This patch adds the missing exception handling for depleted RM session
quotas. If core runs out of session quota while creating a new region
map, it now reflects this condition as a Region_map::Out_of_metadata
exception to the RM client. Thanks to Denis Huber for reporting the
issue!
2016-08-29 17:29:37 +02:00
Norman Feske
a845bdafeb core: fix regression in sig context ownership test
This patch fixes a problem similar to issue #2065 but for the freeing of
signal contexts.
2016-08-29 17:29:33 +02:00
Norman Feske
8d1cf08b1a core: fix regression in dataspace ownership test
This patch revives our ds_ownership test from 2012, which just revealed
a regression in core where the dataspace-free operation of the RAM
service would unconditionally destroy dataspace objects from foreign
sessions. The patch fixes the bug and adds an updated version of the
test to the autopilot.

Fixes #2065
2016-08-29 17:29:33 +02:00
Alexander Boettcher
9c098752b0 core: fix memory mapping calc. for big regions
Fixes #2063
2016-08-29 17:29:32 +02:00
Norman Feske
17c79a9e23 base: avoid use of deprecated base/printf.h
Besides adapting the components to the use of base/log.h, the patch
cleans up a few base headers, i.e., it removes unused includes from
root/component.h, specifically base/heap.h and
ram_session/ram_session.h. Hence, components that relied on the implicit
inclusion of those headers have to manually include those headers now.

While adjusting the log messages, I repeatedly stumbled over the problem
that printing char * arguments is ambiguous. It is unclear whether to
print the argument as pointer or null-terminated string. To overcome
this problem, the patch introduces a new type 'Cstring' that allows the
caller to express that the argument should be handled as null-terminated
string. As a nice side effect, with this type in place, the optional len
argument of the 'String' class could be removed. Instead of supplying a
pair of (char const *, size_t), the constructor accepts a 'Cstring'.
This, in turn, clears the way let the 'String' constructor use the new
output mechanism to assemble a string from multiple arguments (and
thereby getting rid of snprintf within Genode in the near future).

To enforce the explicit resolution of the char * ambiguity, the 'char *'
overload of the 'print' function is marked as deleted.

Issue #1987
2016-08-29 17:27:10 +02:00
Christian Prochaska
a5d3aa8373 base: increase label length limit of core LOG session
Fixes #2061
2016-08-29 17:27:10 +02:00
Norman Feske
26a4534a37 base: helper for hex-formatted output of ranges 2016-08-29 17:27:09 +02:00
Johannes Schlatow
acd2a40076 base: print() functions for floating point types
Fixes #2055
2016-08-29 17:23:19 +02:00
Alexander Boettcher
b5ff552460 base: extend core_mem_alloc free by phys_addr
required by base-sel4 to turn used page frames back to untyped memory

Issue #2044
2016-08-10 11:07:52 +02:00
Alexander Boettcher
e89b28ca1b sel4: add signal support
Fixes #1716
Issue #2044
2016-08-10 11:07:51 +02:00
Alexander Boettcher
8b505306ed core: name initial threads not just "name"
to make debugging more comfortable

Issue #2044
2016-08-10 11:07:50 +02:00
Alexander Boettcher
cb675a12d8 base: factor out irq parsing into helper header
to be used by sel4 in the next commit

Issue #2044
2016-08-10 11:07:50 +02:00
Alexander Boettcher
464181b01d base: refactor io_port session implementation
Split port API implementation into separate io_port_session_support.cc file,
so that base-sel4 may implement this part alternatively.

Issue #2044
2016-08-10 11:07:50 +02:00
Alexander Boettcher
027e89f91a base: catch uncaught exceptions of threads
and show some message about. On sel4 sometimes exceptions are thrown and no
message is shown, it just seems to hang. With this patch at least you get
an idea that something bad happened.

Issue #2044
2016-08-10 11:07:50 +02:00
Norman Feske
62d65d00e0 Remove signal-source headers from public API
Those headers implement a platform-specific mechanism. They are never
used by components directly.

This patch also cleans up a few other remaining platform-specific
artifact such as the Fiasco.OC-specific assert.h.

Issue #1993
2016-07-15 11:38:25 +02:00
Emery Hemingway
2b8c1af9e0 remove 'filename' from ROM sesion args
Conveying the ROM filename as the final label element simplifies
routing policy and session construction.

Annotations by nfeske:

This commit also changes the ROM session to use base/log.h instead of
base/printf.h, which produced build error of VirtualBox because the
vbox headers have a '#define Log', which collides with the content of
base/log.h. Hence, this commit has to take precautions to resolve this
conflict.

The commit alse refines the previous session-label change by adding a
new 'Session_label::prefix' method and removing the use of 'char const *'
from this part of the API.

Fixes #1787
2016-07-11 13:24:36 +02:00
Emery Hemingway
f8337b511b Move Session_label from os to base
Session_label constructor now takes a bare string rather than a
serialized argument buffer.
Replace all instances of previous constructor with 'label_from_args'
function.

Issue #1787
2016-07-11 13:09:24 +02:00
Norman Feske
88b358c5ef Unification of native_capability.h
This patch establishes the sole use of generic headers across all
kernels. The common 'native_capability.h' is based on the version of
base-sel4. All traditional L4 kernels and Linux use the same
implementation of the capability-lifetime management. On base-hw, NOVA,
Fiasco.OC, and seL4, custom implementations (based on their original
mechanisms) are used, with the potential to unify them further in the
future.

This change achieves binary compatibility of dynamically linked programs
across all kernels.

Furthermore, the patch introduces a Native_capability::print method,
which allows the easy output of the kernel-specific capability
representation using the base/log.h API.

Issue #1993
2016-07-11 13:07:37 +02:00
Norman Feske
d71f0a9606 Cleanup of parent-cap handling
This patch alleviates the need for a Native_capability::Dst at the API
level. The former use case of this type as argument to
Deprecated_env::reinit uses the opaque Native_capability::Raw type
instead. The 'Raw' type contains the portion of the capability that is
transferred as-is when delegating the capability (i.e., when installing
the parent capability into a new component, or when installing a new
parent capability into a new forked Noux process). This information can
be retrieved via the new Native_capability::raw method.

Furthermore, this patch moves the functions for retriving the parent
capability to base/internal/parent_cap.h, which is meant to be
implemented in platform-specific ways. It replaces the former set of
startup/internal/_main_parent_cap.h headers.

Issue #1993
2016-07-11 13:05:27 +02:00
Norman Feske
f7bdd383e2 Remove base/native_types.h headers
Issue #1993
2016-07-11 12:06:50 +02:00
Christian Prochaska
29a12ab9a2 base: add 'Thread::mystack() function
The static 'Thread::mystack()' function returns the stack boundaries of
the calling thread. It is useful when a thread uses a diffent stack than
the primary one.

Fixes #2037
2016-07-11 12:06:05 +02:00
Norman Feske
2030ae678e Supplement base/log.h with raw output function
This patch introduces the Genode::raw function that prints output
directly via a low-level kernel mechanism, if available.

On base-linux, it replaces the former 'raw_write_str' function.
On base-hw, it replaces the former kernel/log.h interface.

Fixes #2012
2016-06-22 12:21:42 +02:00
Stefan Kalkowski
1e5c08bb1a base: invert hex value padding to correct meaning
Fix #1996
2016-06-06 09:38:29 +02:00
Josef Söntgen
941a71346a base: add print method for unsigned long long
Fixes #1991.
2016-06-04 13:45:27 +02:00
Alexander Boettcher
5c10653d8a slab: throw exception if initial allocation fails
Issue #1983
2016-05-31 12:02:04 +02:00
Sebastian Sumpf
ee05fb9259 base: Remove dynamic segment check from Elf_binary
Don't check for supported segment types of dynamic binaries, it is to
restrictive. If something goes wrong the dynamic linker will throw an error.
2016-05-23 15:52:51 +02:00
Christian Prochaska
44648bb5c7 tool_chain/cxx: use '__cxa_demangle()' for exception names
Fixes #1976
2016-05-23 15:52:50 +02:00
Christian Prochaska
2cde1d36c1 base: changes for GDB monitor
- add a new function 'binary_ready_hook_for_gdb()' in ldso. GDB can set a
  breakpoint at this function to know when ldso has loaded the binary
  into memory.
- get the thread state from the NOVA kernel immediately on 'pause()'

Fixes #1968
2016-05-23 15:52:49 +02:00
Norman Feske
807be83b1b Remove inconsistent use of 'is_' prefix
Fixes #1963
2016-05-23 15:52:39 +02:00
Norman Feske
a99989af40 Separation of thread operations from CPU session
This patch moves the thread operations from the 'Cpu_session'
to the 'Cpu_thread' interface.

A noteworthy semantic change is the meaning of the former
'exception_handler' function, which used to define both, the default
exception handler or a thread-specific signal handler. Now, the
'Cpu_session::exception_sigh' function defines the CPU-session-wide
default handler whereas the 'Cpu_thread::exception_sigh' function
defines the thread-specific one.

To retain the ability to create 'Child' objects without invoking a
capability, the child's initial thread must be created outside the
'Child::Process'. It is now represented by the 'Child::Initial_thread',
which is passed as argument to the 'Child' constructor.

Fixes #1939
2016-05-23 15:52:39 +02:00
Christian Helmuth
3ba61a2ddf Move rust support to libports
Issue #1899
2016-05-23 15:52:38 +02:00
Norman Feske
3361651e9e base: remove dependency from deprecated config lib
Issue #1959
2016-05-23 15:52:37 +02:00
Christian Helmuth
16914bddc8 Implement affinity test as component
This enables the use of the current Thread API to set thread affinity on
construction.
2016-05-23 15:52:36 +02:00
Norman Feske
f6dec901bb base: remove Component::name from API
It turns out that the name function does not have much use in practice
except for naming the thread of the component's initial entrypoint. For
dynamically linked components, this thread is created by the dynamic
linker. It is named "ep" in these cases. Considering that we will
eventually turn all regular components into dynamically linked
executables, the additional information provided by the
Component::name() function remains unused. So it is better to not bother
the component developers with adding boilerplate code.
2016-05-23 15:49:56 +02:00
Waylon Cude
1e95af5bab Fixed linking and memory allocation for rust
Now rlibs are actually linked to programs. Target files have been
modified to not generate code that requires compiler-rt. Added a target
for libstd-rust, but it's very broken right now. Moved alloc_system to
the libports folder because either a memory allocator needs to be
written in rust or posix_memalign needs to be implemented. Changed
liblibc to use freebsd as the OS instead of netbsd. Added a library with
unwind dummy functions.

Rust relies on atomic builtins, which are not implemented in libgcc for
ARM. One was implemented in rust, which was sufficient to get the
current rust test to run. Rust libs were added into the group of libs
for the linker so order no longer matters. The raspberry pi now uses an
armv6 target.
2016-05-23 15:49:56 +02:00
Norman Feske
fd401bdf53 Thread API cleanup
This patch cleans up the thread API and comes with the following
noteworthy changes:

- Introduced Cpu_session::Weight type that replaces a formerly used
  plain integer value to prevent the accidental mix-up of
  arguments.
- The enum definition of Cpu_session::DEFAULT_WEIGHT moved to
  Cpu_session::Weight::DEFAULT_WEIGHT
- New Thread constructor that takes a 'Env &' as first argument.
  The original constructors are now marked as deprecated. For the
  common use case where the default 'Weight' and 'Affinity' are
  used, a shortcut is provided. In the long term, those two
  constructors should be the only ones to remain.
- The former 'Thread<>' class template has been renamed to
  'Thread_deprecated'.
- The former 'Thread_base' class is now called 'Thread'.
- The new 'name()' accessor returns the thread's name as 'Name'
  object as centrally defined via 'Cpu_session::Name'. It is meant to
  replace the old-fashioned 'name' method that takes a buffer and size
  as arguments.
- Adaptation of the thread test to the new API

Issue #1954
2016-05-23 15:49:55 +02:00
Norman Feske
1f395ae780 base: new interface for textual output
Issue #1942
2016-05-09 13:25:01 +02:00
Norman Feske
dc8690ae37 Modularize base-internal headers
Issue #1952
2016-05-09 13:24:39 +02:00
Norman Feske
40a5af42eb Clean up base-library structure
This patch moves the base library from src/base to src/lib/base,
flattens the library-internal directory structure, and moves the common
parts of the library-description files to base/lib/mk/base.inc and
base/lib/mk/base-common.inc.

Furthermore, the patch fixes a few cosmetic issues (whitespace and
comments only) that I encountered while browsing the result.

Fixes #1952
2016-05-09 13:24:11 +02:00
Norman Feske
b8cd56cb90 Tweak slab allocators to use whole pages
Most slab allocators in core use a sliced heap as backing store. Since
sliced-heap allocations are performed at page-granularity, it is
sensible to dimension the slab blocks to fill whole pages.
2016-05-09 13:10:53 +02:00
Norman Feske
ba0545de07 Clean up 'Sliced_heap'
This patch cleans up the implementation of the sliced heap, adds a
constructor that takes references instead of pointers, and adds the
function 'meta_data_size' to determine the meta-data overhead per block.
The latter can be used to dimension slab allocators such that slab
blocks use whole pages.
2016-05-09 13:10:53 +02:00
Norman Feske
4f69772ecc Replace 'Env' interface with modern one
The original 'Env' interface as returned by 'Genode::env()' has been
renamed to 'Env_deprecated' and moved to deprecated/env.h. The new version
of base/env.h contains the interface passed to modern components that
use the component API via base/component.h.

Issue #1832
2016-05-09 13:10:52 +02:00
Norman Feske
7274ca997d Remove Genode::Process from API
This patch makes the former 'Process' class private to the 'Child'
class and changes the constructor of the 'Child' in a way that
principally enables the implementation of single-threaded runtime
environments that virtualize the CPU, PD, and RAM services. The
new interfaces has become free from side effects. I.e., instead
of implicitly using Genode::env()->rm_session(), it takes the reference
to the local region map as argument. Also, the handling of the dynamic
linker via global variables is gone. Now, the linker binary must be
provided as constructor argument.

Fixes #1949
2016-05-09 13:10:52 +02:00
Norman Feske
b49e588c1c Assign threads to PD at its creation time
This patch replaces the former 'Pd_session::bind_thread' function by a
PD-capability argument of the 'Cpu_session::create_thread' function, and
removes the ancient thread-start protocol via 'Rm_session::add_client' and
'Cpu_session::set_pager'. Threads are now bound to PDs at their creation
time and implicitly paged according to the address space of the PD.

Note the API change:

This patch changes the signature of the 'Child' and 'Process' constructors.
There is a new 'address_space' argument, which represents the region map
representing the child's address space. It is supplied separately to the
PD session capability (which principally can be invoked to obtain the
PD's address space) to allow the population of the address space
without relying on an 'Pd_session::address_space' RPC call.
Furthermore, a new (optional) env_pd argument allows the explicit
overriding of the PD capability handed out to the child as part of its
environment. It can be used to intercept the interaction of the child
with its PD session at core. This is used by Noux.

Issue #1938
2016-05-09 13:10:52 +02:00
Norman Feske
511acad507 Consolidate RM service into PD session
This patch integrates three region maps into each PD session to
reduce the session overhead and to simplify the PD creation procedure.
Please refer to the issue cited below for an elaborative discussion.

Note the API change:

With this patch, the semantics of core's RM service have changed. Now,
the service is merely a tool for creating and destroying managed
dataspaces, which are rarely needed. Regular components no longer need a
RM session. For this reason, the corresponding argument for the
'Process' and 'Child' constructors has been removed.

The former interface of the 'Rm_session' is not named 'Region_map'. As a
minor refinement, the 'Fault_type' enum values are now part of the
'Region_map::State' struct.

Issue #1938
2016-05-09 13:10:51 +02:00
Norman Feske
e20bbe7002 base: remove integer return codes from PD-session
The return code of assign_parent remained unused. So this patch
removes it.

The bind_thread function fails only due to platform-specific limitations
such as the exhaustion of ID name spaces, which cannot be sensibly
handled by the PD-session client. If occurred, such conditions used to
be reflected by integer return codes that were used for diagnostic
messages only. The patch removes the return codes and leaves the
diagnostic output to core.

Fixes #1842
2016-05-09 13:09:56 +02:00
Martin Stein
cba6f5f298 base: no exit handler for libc stdout log console
We don't want Genode environment objects that register their destructor
for program exit as it is mostly unnecessary and easily produces
dangling pointers. Thus, use unmanaged_singleton instead of the static
keyword.

Fixes #1941
2016-04-25 10:48:02 +02:00
Christian Helmuth
7a64e0bb80 ldso: dump link map of loaded shared objects
Also log the link-map information of shared objects loaded after startup
if 'ld_verbose' is configured.
2016-04-25 10:48:01 +02:00
Martin Stein
9508f397a2 ldso: use get_page_size_log2 instead of "12"
Ref #1941
2016-04-25 10:48:01 +02:00
Martin Stein
a96130f20b base: get rid of alloc align default value
When using the Allocator interface, one can't tell which alignment
resulting allocations fulfill. However, at least on ARM, given the
architectural alignment requirements of ARM memory accesses, one wants
memory allocations (what allocators are for in most cases) to be word
aligned automatically. Previously, at least the AVL allocator simply
called alloc_aligned without defining align in its alloc implementation.
This led to unaligned access faults (the default was 0) when using the
AVL allocator as Allocator (as done in the metadata management of a SLAB
of an AVL that uses the AVL as backing store). To avoid such pitfalls
in the future, we force users of alloc_aligned to always specify align
(why use alloc_aligned without align anyway).

Ref #1941
2016-04-25 10:48:01 +02:00
Norman Feske
05e09a6116 Improve warning message 2016-04-25 10:48:00 +02:00
Norman Feske
f186587cab Unify ipc_msgbuf.h across base platforms
Besides unifying the Msgbuf_base classes across all platforms, this
patch merges the Ipc_marshaller functionality into Msgbuf_base, which
leads to several further simplifications. For example, this patch
eventually moves the Native_connection_state and removes all state
from the former Ipc_server to the actual server loop, which not only
makes the flow of control and information much more obvious, but is
also more flexible. I.e., on NOVA, we don't even have the notion of
reply-and-wait. Now, we are no longer forced to pretend otherwise.

Issue #1832
2016-04-25 10:47:59 +02:00
Norman Feske
0c299c5e08 base: separate native CPU from CPU session
This patch unifies the CPU session interface across all platforms. The
former differences are moved to respective "native-CPU" interfaces.

NOVA is not covered by the patch and still relies on a custom version of
the core-internal 'cpu_session_component.h'. However, this will soon be
removed once the ongoing rework of pause/single-step on NOVA is
completed.

Fixes #1922
2016-04-25 10:47:57 +02:00
Norman Feske
e9dec93f4b base: optimized slab allocator
This patch changes the organization of the slab blocks within the slab
allocator. Originally, blocks were kept in a list sorted by the number
of free entries. However, it turned out that the maintenance of this
invariant involves a lot of overhead in the presence of a large number
of blocks. The new implementation manages blocks within a ring in no
particular order and maintains a pointer to the block where the next
allocation is attempted. This alleviates the need for sorting blocks
when allocating and deallocating.

Fixes #1908
2016-04-25 10:47:56 +02:00
Norman Feske
fbc35cb796 base: hide slab implementation details from API
Issue #1908
2016-04-25 10:47:56 +02:00
Norman Feske
db5969e6cc Stress test for the slab allocator
Issue #1908
2016-04-25 10:47:55 +02:00
Norman Feske
7cf40a0971 allocator_avl: hand back meta data when destructed
This patch ensures that the 'Allocator_avl' releases all memory obtained
from the meta-data allocator at destruction time. If allocations are
still dangling, it produces a warning, hinting at possible memory leaks.
Finally, it properly reverts all 'add_range' operations.
2016-04-25 10:47:55 +02:00
Norman Feske
ed37c2ecff core: use copy of region metadata in detach
This patch fixes a use-after-free problem raised by the recent ability of
the slab allocator to dynamically release empty slab blocks. The
Rm_session_component::detach function used to rely on the assumption
that the region metadata co-located with the allocator metadata of the
'_map' would stay intact even after a 'free' if the region.
2016-04-25 10:47:55 +02:00
Norman Feske
8971bb25ce heap: release ds pool meta data when destructed
This patch makes sure that the dataspace pool is flushed before
destructing the heap-local allocator-avl instance. With the original
destruction order, the allocator would still contain dangling
allocations on the account of the dataspace pool when destructed. In
practice, this caused no problem because the underlying backing store is
eventually freed on the destruction of the pool. But it triggers a
runtime warning of the allocator since it has become more strict with
regard to dangling allocations.
2016-04-25 10:47:55 +02:00
Norman Feske
051e84c4b4 Move server API concept to base framework
This commit introduces the new `Component` interface in the form of the
headers base/component.h and base/entrypoint.h. The os/server.h API
has become merely a compatibilty wrapper and will eventually be removed.
The same holds true for os/signal_rpc_dispatcher.h. The mechanism has
moved to base/signal.h and is now called 'Signal_handler'.

Since the patch shuffles headers around, please do a 'make clean' in the
build directory.

Issue #1832
2016-04-11 11:51:46 +02:00
Christian Helmuth
0cacd41823 base: forward arguments in unmanaged_singleton
This enables the use of reference types for constructor arguments.
2016-04-11 11:51:44 +02:00
Christian Prochaska
146c694513 Reduce the maximum LOG session string length
The maximum possible string length is defined by the platform with the
lowest maximum IPC payload size (currently OKL4).

Fixes #1919
2016-04-11 11:51:43 +02:00
Norman Feske
cda07b7da0 base: simplification of the IPC code
This commit replaces the stateful 'Ipc_client' type with the plain
function 'ipc_call' that takes all the needed state as arguments.
The stateful 'Ipc_server' class is retained but it moved from the public
API to the internal ipc_server.h header. The kernel-specific
implementations were cleaned up and simplified. E.g., the 'wait'
function does no longer exist. The badge and exception code are no
longer carried in the message buffers but are handled in kernel-specific
ways.

Issue #610
Issue #1832
2016-04-11 11:51:42 +02:00
Norman Feske
47878bd3e1 Remove 'Ipc_istream' and 'Ipc_ostream' from API
Fixes #610
2016-04-11 11:51:42 +02:00
Norman Feske
4cdfb9bc2f base: remove 'Native_connection_state' from API
Issue #1832
2016-04-11 11:51:42 +02:00
Norman Feske
da5d182ad3 base: remove 'Native_thread' from public API
Issue #1832
2016-04-11 11:51:42 +02:00
Norman Feske
9b0eb720b0 base: remove 'Native_utcb' from public API
Fixes #1905
2016-03-17 17:02:04 +01:00
Waylon Cude
28117fee12 Added rust support
Rust relies on atomic builtins, which are not implemented in libgcc for
ARM. One is implemented in rust, which is sufficient to get the
current rust test to run.

Issue #1899
2016-03-17 17:02:04 +01:00
Norman Feske
76db3b9c06 base: retire 'Native_config'
This commit moves the parameters of the stack area to the base-internal
header 'stack_area.h'.

Issue #1832
2016-03-08 17:00:54 +01:00
Josef Söntgen
2490e399dc ldso: check binary pointer before lookup
Check if the binary pointer is valid before attempting to lookup the
symbol. Shared objects with unresolved symbols and missing depencies,
e.g a library that references 'errno' but is not linked against libc,
will now produce an error message when they are loaded by the dynamic
linker.

Fixes #1904.
2016-03-08 17:07:36 +01:00
Emery Hemingway
f46a504bb6 use Arg_string::set_arg_string to set session labels
Issue #1861
2016-03-07 16:10:32 +01:00
Christian Helmuth
688e86ab68 core: increase initial quota to 224K 2016-03-07 12:34:47 +01:00
Norman Feske
7f73e5e879 base: hide internals of the Thread API
This patch moves details about the stack allocation and organization
the base-internal headers. Thereby, I replaced the notion of "thread
contexts" by "stacks" as this term is much more intuitive. The fact that
we place thread-specific information at the bottom of the stack is not
worth introducing new terminology.

Issue #1832
2016-03-07 12:34:46 +01:00
Norman Feske
3473955212 base-linux/nova: unify include/rm_session/client.h
By moving the stub implementation to rm_session_client.cc, we can use
the generic base/include/rm_session/client.h for base-linux and
base-nova and merely use platform-specific implementations.

Issue #1832
2016-03-07 12:34:45 +01:00
Norman Feske
6e7f7bdad4 base: move crt0.h and elf.h to base/internal
Those headers remained unused outside the internal framework. So it is
better to remove them from the public API.

Issue #1832
2016-03-07 12:34:45 +01:00
Norman Feske
2e701f9afa base: update include guards
This patch cleans up the include guards, assisted by the
tool/fix_include_ifndef script.
2016-03-07 12:34:45 +01:00
Norman Feske
e6729316ff base: uniform base-internal header structure
This patch establishes a common organization of header files
internal to the base framework. The internal headers are located at
'<repository>/src/include/base/internal/'. This structure has been
choosen to make the nature of those headers immediately clear when
included:

  #include <base/internal/lock_helper.h>

Issue #1832
2016-03-07 12:34:45 +01:00
Norman Feske
be496c6dc1 base: remove kernel-specific base/sleep.h
With this patch, the platform differences reside solely in the
implementation of the base library.

Issue #1832
2016-03-07 12:34:44 +01:00
Norman Feske
62b1c55399 Integrate CAP session into PD session
This patch integrates the functionality of the former CAP session into
the PD session and unifies the approch of supplementing the generic PD
session with kernel-specific functionality. The latter is achieved by
the new 'Native_pd' interface. The kernel-specific interface can be
obtained via the Pd_session::native_pd accessor function. The
kernel-specific interfaces are named Nova_native_pd, Foc_native_pd, and
Linux_native_pd.

The latter change allowed for to deduplication of the
pd_session_component code among the various base platforms.

To retain API compatibility, we keep the 'Cap_session' and
'Cap_connection' around. But those classes have become mere wrappers
around the PD session interface.

Issue #1841
2016-03-07 12:34:44 +01:00
Norman Feske
b1910cdd54 Integrate SIGNAL session into PD session
This patch removes the SIGNAL service from core and moves its
functionality to the PD session. Furthermore, it unifies the PD service
implementation and terminology across the various base platforms.

Issue #1841
2016-03-07 12:34:44 +01:00
Sebastian Sumpf
d17134baef ldso: Support for RISC-V
issue #1880
2016-02-26 11:36:51 +01:00
Sebastian Sumpf
d424134073 cxx: Simplify C++ exception wrapper functions
The wrapper functions (e.g., 'Unwind_*' and friends) now have the same signature
as the original function in 'libgcc', reside in a separate C file which is
archived to cxx.lib.a. In supc++.o we prefix the wrapped functions with '_cxx_'.

This also enables support for riscv.

related to #1880
2016-02-16 14:38:02 +01:00
Sebastian Sumpf
bfe5208e0e base: Align heap/slab allocation to machine word size
required by riscv

related to #1880
2016-02-16 14:38:02 +01:00
Christian Helmuth
2a698ffd5f signal: prevent submission of contexts w/o receiver
This prevents a sporadic null-pointer dereference in the nic_loopback
test, which occurred once in 100 runs. I'm not sure if there's still a
race window (we may investigate) with context dissolve.
2016-01-26 16:20:47 +01:00
Sebastian Sumpf
41b9f6bd03 ldso: Make truly self relocatable
On Linux the linker can now be loaded at arbitrary addresses, this became
necessary for newer kernel versions. The 'linux_arm' target is not supported.

Issue #1728
2015-12-10 13:16:25 +01:00
Alexander Boettcher
e49a5ee19f base: make reference ram cap part of child policy
Issue #1539
2015-11-27 12:18:54 +01:00
Sebastian Sumpf
0c3dfbad65 base-hw: use signal context list for pending signals
'block_for_signal' and 'pending_signal' now set pending flag in signal context
in order to determine pending signal. The context list is also used by the
'Signal_receiver' during destruction.

Fixes #1738
2015-11-27 12:18:50 +01:00
Alexander Boettcher
c7df65e1da base: invalidate thread cap if task creation fails
Issue #1778
2015-11-18 12:22:09 +01:00
Norman Feske
82991ba378 base: fix warning in console.cc 2015-11-04 13:49:01 +01:00
Alexander Boettcher
f42f946f3b base: support parsing multiboot for phys. memory
Issue #1741
2015-11-04 14:09:27 +01:00
Alexander Boettcher
7ea5884ffc base: use mmio framework for multiboot handling
Issue #1741
2015-11-04 14:09:26 +01:00
Alexander Boettcher
f9fbe34644 base: avoid detaching not attached trace_control 2015-10-28 15:06:23 +01:00
Sebastian Sumpf
2b429ee84c base: Dispatch server signal in entry point
Currently, when a signal arrives in the main thread, the signal dispatcher is
retrieved and called from the main thread, the dispatcher uses a proxy object
that in turn sends an RPC to the entry point. This becomes a problem when the
entry point destroys the dispatcher object, before the dispatch function has
been called by the main thread. Therefore, the main thread should simply send an
RPC to the entry point upon signal arrival and the dispatching should be handled
solely by the entry point.

Issue #1738
2015-10-28 15:06:22 +01:00
Alexander Boettcher
2e62543fdb nova: use remote revoke
Fixes #1733
2015-10-09 16:38:48 +02:00
Alexander Boettcher
286edaed68 base: detect and stop self de-structing threads
Issue #1687
2015-10-06 12:18:51 +02:00
Stefan Kalkowski
b585583ec7 core: do not destroy in object pool's apply scope
Destroying an object within the scope of a lambda/functor executed
in the object pool's apply function leads potentially to memory corruption.
Within the scope the corresponding object is locked and unlocked when
leaving the scope. Therefore, it is illegal to free the object's memory meanwhile.
This commit eliminates several places in core that destroyed wrongly in
the object pool's scope.

Fix #1713
2015-09-30 12:20:40 +02:00
Stefan Kalkowski
ccb968ff7d safeguard the synchronized allocator template
* Move the Synced_interface from os -> base
* Align the naming of "synchronized" helpers to "Synced_*"
* Move Synced_range_allocator to core's private headers
* Remove the raw() and lock() members from Synced_allocator and
  Synced_range_allocator, and re-use the Synced_interface for them
* Make core's Mapped_mem_allocator a friend class of Synced_range_allocator
  to enable the needed "unsafe" access of its physical and virtual allocators

Fix #1697
2015-09-30 12:20:39 +02:00
Alexander Boettcher
9b21c88bc6 base: handle unsupported printf commands better
The commit consumes the argument of a unsupported printf command.

Without the commit - a subsequent command uses the argument of the preceding
command, which may cause memory corruption or page faults for sequences using
string commands, e.g.

Genode::printf("%#x %s\n", 0x20, "Test");

'#' is not supported by Genode::printf. In this scenario a pagefault at
address 0x20 is caused.

Fixes #1701
2015-09-30 12:20:38 +02:00
Stefan Kalkowski
ed52d5a211 Introduce 'spec' subdirectories to outline aspects
Instead of holding SPEC-variable dependent files and directories inline
within the repository structure, move them into 'spec' subdirectories
at the corresponding levels, e.g.:

  repos/base/include/spec
  repos/base/mk/spec
  repos/base/lib/mk/spec
  repos/base/src/core/spec
  ...

Moreover, this commit removes the 'platform' directories. That term was
used in an overloaded sense. All SPEC-relative 'platform' directories are
now named 'spec'. Other files, like for instance those related to the
kernel/architecture specific startup library, where moved from 'platform'
directories to explicit, more meaningful places like e.g.: 'src/lib/startup'.

Fix #1673
2015-09-16 13:58:50 +02:00
Stefan Kalkowski
acc46f70b7 codezero: remove support from Genode (fix #1668) 2015-09-09 15:14:29 +02:00
Stefan Kalkowski
458b4d6fc4 base: redesign object pool using lambda interface
Instead of returning pointers to locked objects via a lookup function,
the new object pool implementation restricts object access to
functors resp. lambda expressions that are applied to the objects
within the pool itself.

Fix #884
Fix #1658
2015-09-09 15:14:28 +02:00
Alexander Boettcher
6e481127ce hw: increase stack size for thread test
Stack size of cpu helper is insufficient if a exception is thrown during
'test_create_as_many_threads()'

Related to #1652
2015-09-09 15:14:27 +02:00
Adrian-Ken Rueegsegger
c2ff0ae9d4 Minor cleanup fixes
- Fix spelling errors
- Remove extra semicolons
- Remove extra spaces

Fixes #1650
2015-08-21 11:00:59 +02:00
Stefan Kalkowski
eafe5e81e3 core: unify and simplify paging code (Fix #1641)
For most platforms except of NOVA a distinction between pager entrypoint
and pager activation is not needed, and only exists due to historical
reasons. Moreover, the pager thread's execution path is almost identical
between most platforms excluding NOVA, HW, and Fisco.OC. Therefore,
this commit unifies the pager loop for the other platforms, and removes
the pager activation class.
2015-08-21 10:58:59 +02:00
Alexander Boettcher
626b0a68f3 base: increase base-control size for 32bit
It is insufficient for creating threads up to the maximum supported limit
(256 by now).

Issue #1601
2015-08-21 10:58:58 +02:00
Alexander Boettcher
9081653c96 Extend thread test
Issue #1601
2015-08-21 10:58:58 +02:00
Alexander Boettcher
fe4e0702d4 base: contain chunk_size heap consumption
Increase internal chunk size of heap only if an allocation succeeded
beforehand. Otherwise the chunk size increases with every unsuccessful
invocation and a upgrade of the used ram session will be insufficient and of
no use at all.

Fixes #1632
2015-07-21 09:36:46 +02:00
Martin Stein
c6f73d365a unmanaged singleton: allow private constructors
Introduces a class Unmanaged_singleton_constructor that can be declared as
friend to be able to call unmanaged_singleton on classes with a private
constructor. Enables the appliance of the singleton pattern.

Ref #1625
2015-07-21 09:30:12 +02:00
Stefan Kalkowski
0f05fa6fd4 base: resolve dead lock in weak pointer templates
This commit eliminates the mutual interlaced taking of destruction lock,
list lock and weak pointer locks that could lead to a dead-lock situation
when a lock pointer was tried to construct while a weak object is in
destruction progress.
Now, all weak pointers are invalidated and dequeued at the very
beginning of the weak object's destruction. Moreover, before a weak pointer
gets invalidated during destruction of a weak object, it gets dequeued, and
the list lock is freed again to avoid the former dead-lock.

Fix #1607
2015-07-21 09:30:04 +02:00
Josef Söntgen
7e40f5f587 base: use proper Cpu_session when tracing threads
Up to now it was not possible to trace threads that use a different
Cpu_session rather than env()->cpu_session() (as done by VirtualBox).
This problem is now solved by setting the Cpu_session explicitly when
creating the event logger and attaching the trace control area when
creating the thread.

Fixes #1618.
2015-07-21 09:28:26 +02:00
Alexander Boettcher
c42e770384 detach ds from all rm sessions before destruction
Fixes #1617
2015-07-21 09:28:24 +02:00
Norman Feske
0cd93c64aa ldso: add lx_environ to symbol map
This symbol must be exported to build dynamically-linked executables on
the lx_hybrid_x86 base platform.
2015-07-07 19:48:07 +02:00
Stefan Kalkowski
c951c30d8a base: extend weak pointer test (Ref #1607)
Add a test where a locked pointer shall be taken during object destruction.
Moreover, extend the run-script so it runs on different platforms with
"real" timers.
2015-07-07 19:48:06 +02:00
Emery Hemingway
46b7227ef0 cxx: notify parent on abort() (in main thread)
Fixes #1605
2015-07-01 15:09:32 +02:00
Stefan Kalkowski
691df908aa core: remove Rm_member from RM session component
Rm_member does not fulfill a useful role, but makes understanding of
the RM session component more difficult.

Ref #956
2015-07-01 14:46:17 +02:00
Stefan Kalkowski
2a351215f4 base: remove pager code from public API
Fix #1593
2015-07-01 14:46:15 +02:00
Norman Feske
5d678dba9e core: throw Trace::Out_of_metadata in subjects()
While importing trace sources as trace subjects into a TRACE session,
the session quota might become depleted. The TRACE session already keeps
track of the session quota via an allocator guard but the 'subjects' RPC
function missed to handle the out-of-memory condition. This patch
reflects the error condition as an 'Out_of_metadata' exception to the
TRACE client. It also contains an extension of the trace test to
exercise the corner case.
2015-06-22 14:43:39 +02:00
Alexander Boettcher
705257cf22 cxx: show thread name in event of abort
Issue #1591
2015-06-22 14:43:39 +02:00
Norman Feske
a23ac5f569 base/nova: add idle threads to trace sources
Issue #813
2015-06-22 14:43:39 +02:00
Norman Feske
959572968d core: provide thread exec times via TRACE service
This patch enable clients of core's TRACE service to obtain the
execution times of trace subjects (i.e., threads). The execution time is
delivered as part of the 'Subject_info' structure.

Right now, the feature is available solely on NOVA. On all other base
platforms, the returned execution times are 0.

Issue #813
2015-06-22 14:43:38 +02:00
Christian Prochaska
4cae6c0d12 cxx: report names of uncaught exceptions again
Fixes #1582
2015-06-22 14:43:37 +02:00
Stefan Kalkowski
409ac1468e core: implement core allocator's free (ref #1573) 2015-06-22 14:43:35 +02:00
Norman Feske
4f927f651b core: handle IRQ sessions by separate entrypoint
Fixes #1572
2015-06-22 14:43:34 +02:00
Norman Feske
ef9c745e42 ldso: add memcpy and memset to symbol.map
On ARM, the compiler generates calls to memcpy and memset. Most
dynamically linked programs use the libc, which provides these
functions. However, if a dynamically linked program does not use the
libc (e.g., noux/minimal or the new version of cli_monitor), those
symbols remain unresolved. By adding them to ldso's symbol.map, the
dynamic linker will resolve them with the functions of the cxx
library, which is part of the dynamic linker.

Issue #1561
2015-06-09 11:00:11 +02:00
Stefan Kalkowski
28804e2bfb base: remove cap_integrity test (fix #1536) 2015-05-26 09:40:04 +02:00
Stefan Kalkowski
217f62b89d base: move retry template function to util header
Ref #1443
2015-05-26 09:40:03 +02:00
Stefan Kalkowski
64bfe233d7 base: make CAP session upgradeable
* Introduce 'Out_of_metadata' exception for capability allocation

Ref #1443
2015-05-26 09:40:02 +02:00
Stefan Kalkowski
73c3a81e0b base: make PD session upgradeable
Ref #1443
2015-05-26 09:40:02 +02:00
Alexander Boettcher
e84284c0cd base: remove shared irq from core
Cleanup commit after all relevant drivers got adapted to use the x86 platform
driver (pci_drv).

Issue #1471
2015-05-26 09:39:47 +02:00
Alexander Boettcher
3783db66e2 base: implement detach for core context_area
Required to destroy threads within in core. Used when IRQs get reused on
platforms where every IRQ needs a thread in core.

Issue #1471
2015-05-26 09:39:47 +02:00
Christian Prochaska
3a378bb970 libc_noux: remove dependency on 'platform_env.h'
Currently, libc_noux includes the 'base/src/base/env/platform_env.h' file
to be able to reinitialize the environment using the 'Platform_env'
interface. For base-linux, a special version of this file exists and the
inclusion of the generic version in libc_noux causes GCC 4.9 to make wrong
assumptions about the memory layout of the 'Env' object returned by
'Genode::env()'.

This commit moves the reinitialization functions to the 'Env' interface to
avoid the need to include the 'platform_env.h' file in libc_noux.

Fixes #1510
2015-05-26 09:39:47 +02:00
Norman Feske
4736488d99 core: change order of _export_ds and _clear_ds
On seL4, we need to convert untyped memory to page frames before being
able to use it as normal memory. There already exists the hook function
'_export_ds' that is principally suitable for such tasks. It is
currently solely used on Linux where we have to create a file for each
dataspace. To make the hook useful also for seL4, we need to call
_export_ds prior _clear_ds. Otherwise, we would try to clear memory that
is still untyped.
2015-05-20 17:52:57 +02:00
Alexander Boettcher
d998df3b7f base: extend irq session to support MSIs
Works on base-nova and base-foc, the other kernels have no MSI support.

Issue #1216
2015-05-20 17:39:14 +02:00
Norman Feske
c1cb3a6642 Increase initial block for cxx malloc
This patch avoids the attempt to extend the cxx-local heap during the
startup phase of an application. Originally, the static part of the cxx
was merely 100 bytes, which did not suffice to run the minimalistic test
roottask on seL4.
2015-05-06 11:32:06 +02:00
Norman Feske
89e987b22e base/x86_32: preserve EBX value in crt0 2015-05-06 11:32:06 +02:00
Christian Helmuth
98def2488a thread: move Thread_base::myself() to separate file
The thread library (thread.cc) in base-foc shared 95% of the code with
the generic implementation except myself(). Therefore, its
implementation is now separated from the other generic sources into
myself.cc, which allows base-foc to use a foc-specific primitive to
enable our base libraries in L4Linux.

Issue #1491
2015-05-06 10:55:17 +02:00
Martin Stein
c9272937e7 CPU session: apply quota via relative weightings
Physical CPU quota was previously given to a thread on construction only
by directly specifying a percentage of the quota of the according CPU
session. Now, a new thread is given a weighting that can be any value.
The physical counter-value of such a weighting depends on the weightings
of the other threads at the CPU session. Thus, the physical quota of all
threads of a CPU session must be updated when a weighting is added or
removed. This is each time the session creates or destroys a thread.

This commit also adapts the "cpu_quota" test in base-hw accordingly.

Ref #1464
2015-05-06 10:55:16 +02:00
Josef Söntgen
2c39c75e1c base: remove Irq_connection::wait_for_irq() 2015-04-23 16:48:00 +02:00
Alexander Boettcher
faa25e1df6 base: make irq_session asynchronous
second step

options: factor out common parts of irq_session_component.cc
options: use on foc arm no proxy threads

Fixes #1456
2015-04-23 16:47:58 +02:00
Alexander Boettcher
e2cbc7c5b3 base: unify some irq_session headers
remove repos/base-*/include/irq_session headers and use only a unification
from   repos/base/include/irq_session

first step

Issue #1456
2015-04-23 16:47:57 +02:00
Norman Feske
eaab23c012 base: const-correctness of Allocator interface
This patch adds const qualifiers to the functions Allocator::consumed,
Allocator::overhead, Allocator::avail, and Range_allocator::valid_addr.

Fixes #1481
2015-04-17 16:13:22 +02:00
Stefan Kalkowski
b949489641 base: remove local capability from generic base
* Instead of using local capabilities within core's context area implementation
  for stack allocation/attachment, simply do both operations while stack gets
  attached, thereby getting rid of the local capabilities in generic code
* In base-hw the UTCB of core's main thread gets mapped directly instead of
  constructing a dataspace component out of it and hand over its local
  capability
* Remove local capability implementation from all platforms except Linux

Ref #1443
2015-04-17 16:13:20 +02:00
Stefan Kalkowski
a168c9d6ce core: remove global capability id counter
The global capability ID counter is not used by NOVA and Fiasco.OC
and in the future not needed by base-hw too. Thereby, remove the static
counter variable from the generic code base and add it where appropriated.

Ref #1443
2015-04-17 16:13:19 +02:00
Stefan Kalkowski
358380046c base: assign allocator and quota to platform pd
Enable platform specific allocations and ram quota accounting for
protection domains. Needed to allocate object identity references
in the base-hw kernel when delegating capabilities via IPC.
Moreover, it can be used to account translation table entries in the
future.

Ref #1443
2015-04-17 16:13:19 +02:00
Christian Prochaska
0fd53c7fe4 Extract numeric string arguments with the correct signedness
There are lots of places where a numeric argument of an argument string
gets extraced as signed long value and then assigned to an unsigned long
variable. If the value in the string was negative, it would not be
detected as invalid (and replaced by the default value), but become a
positive bogus value.

With this patch, numeric values which are supposed to be unsigned get
extracted with the 'ulong_value()' function, which returns the default
value for negative numbers.

Fixes #1472
2015-04-13 14:18:15 +02:00
Norman Feske
ea9c2199e8 base: extend emergency dataspace size
The emergency dataspace is used to accommodate the corner case where
a signal context capability is created while issuing the first
resource request. Normally, the attempt to upgrade the signal-session
quota under such a constrained situation would fail. By freeing the
emergency dataspace in this situation, we regain enough quota to
upgrade the signal session.

This is a follow up commit for "base: Raise RAM quota of signal session
to 16K" and fixes the resource_request test on 64-bit platforms.
2015-04-09 16:04:46 +02:00
Norman Feske
0d74435448 base: remove Genode::parent_cap from the API
Components interact with their environments using the Genode::Env class
instead of directly using the parent capability.
2015-04-09 16:04:45 +02:00
Alexander Boettcher
096d72de90 base: check result of bind_thread
Related to #1418
Issue #111
2015-03-27 11:53:12 +01:00
Alexander Boettcher
1f8fad8fa1 base: refactor signal_transmitter::submit
Move it to platform specific .cc file, so that it may get re-implemented
platform specifically if needed.

Issue #1446
2015-03-19 09:32:52 +01:00
Sebastian Sumpf
36e01b720e ldso: Refactor dynamic linker
Issue #1349
2015-03-19 08:57:22 +01:00
Norman Feske
99e7f26b99 Remove base/include/base/errno.h, fix #1450 2015-03-19 08:57:20 +01:00
Stefan Kalkowski
657646e76e hw: adjust core bootstrap to fit generic process
* Introduce hw-specific crt0 for core that calls e.g.: init_main_thread
* re-map core's main thread UTCB to fit the right context area location
* switch core's main thread's stack to fit the right context area location

Fix #1440
2015-03-19 08:57:19 +01:00
Martin Stein
726e6b3e5d signal: fix infinite loop
Fixes #1433
2015-03-13 12:17:25 +01:00
Alexander Boettcher
d7b88afb68 base: propagate bind_thread result of pd_session
Issue #1418
2015-03-13 12:17:23 +01:00
Alexander Boettcher
a31378476d nova: use in core one pager per CPU
Fixes #1394
2015-02-27 11:40:58 +01:00
Alexander Boettcher
8c66a4b1be base: support phys range specifier in ram_session
Fixes #696
2015-02-16 13:40:38 +01:00
Alexander Boettcher
95ff5ba11d base: support range restriction in allocator
Issue #696
2015-02-16 13:40:38 +01:00
Norman Feske
a0abb093ed Remove output-section fill from linker scripts
The linker scripts use to fill alignment gaps within the text section
with the magic value 0x90909090, which correponds to the opcodes of four
nop instructions on x86. This patch removes this value because it
apparently solves no problem. If, for some reason (e.g., due to a dangling
pointer) a thread executes instructions within alignment paddings, NOP
instructions are not any better than any other instruction. The program
will eventually execute the instructions after the padding, which is
most likely fatal. It would be more reasonable to fill the padding with
the opcode of an illegal instruction so that such an error can be
immediately detected. That said, I cannot remember a single instance,
where the fill value has helped us during debugging.

Even if the mechanism served a purpose on x86, it is still better to
remove it because it does not equally work on the other architectures
where the linker scripts are used. I.e., on ARM, the opcode 0x90909090
is not a NOP instruction.
2015-01-20 11:25:59 +01:00
Alexander Boettcher
336018b493 base: append label per line properly (log service)
If newlines are in the string send to the core log service, they don't get
the label properly appended before each output. The messages then look like
they are coming from core.

Fixes #1368
2015-01-20 11:23:51 +01:00
Sebastian Sumpf
1a26f33469 ldso: shared-object lock and ctor test
This has to be used during shared object creation and destruction because global
lists are manipulated. We cannot use the 'Elf_object::lock' here because there
may be jump-slot relocations during object initialization.

Fixes #1350
2015-01-09 11:31:21 +01:00
Martin Stein
5783ba4b1f base: let context area RM session be expanding
Fixes #1331.
2014-12-19 13:58:48 +01:00
Christian Helmuth
727ac4bc0c Put entry point at start of binary on x86 platforms
Related to #881.
2014-12-19 13:58:47 +01:00
Alexander Boettcher
9c0ced0a85 ldso: add __L4_ThreadSwitch to ldso symbol.map
This wasn't necessary before because we built an l4 library for
Pistachio and linked it against each application. With the new linker,
we compile the required files from within Genode and create a syscall
library that is only linked to ldso. If a program uses system calls
directly, for example, DDE kit's spinlock implementation, the required
symbols must be made globally accessible.

Fixes #1306
2014-12-01 16:32:35 +01:00
Martin Stein
8f9355b360 thread API & CPU session: accounting of CPU quota
In the init configuration one can configure the donation of CPU time via
'resource' tags that have the attribute 'name' set to "CPU" and the
attribute 'quantum' set to the percentage of CPU quota that init shall
donate. The pattern is the same as when donating RAM quota.

! <start name="test">
!   <resource name="CPU" quantum="75"/>
! </start>

This would cause init to try donating 75% of its CPU quota to the child
"test".  Init and core do not preserve CPU quota for their own
requirements by default as it is done with RAM quota.

The CPU quota that a process owns can be applied through the thread
constructor. The constructor has been enhanced by an argument that
indicates the percentage of the programs CPU quota that shall be granted
to the new thread. So 'Thread(33, "test")' would cause the backing CPU
session to try to grant 33% of the programs CPU quota to the thread
"test". By now, the CPU quota of a thread can't be altered after
construction. Constructing a thread with CPU quota 0 doesn't mean the
thread gets never scheduled but that the thread has no guaranty to receive
CPU time. Such threads have to live with excess CPU time.

Threads that already existed in the official repositories of Genode were
adapted in the way that they receive a quota of 0.

This commit also provides a run test 'cpu_quota' in base-hw (the only
kernel that applies the CPU-quota scheme currently). The test basically
runs three threads with different physical CPU quota. The threads simply
count for 30 seconds each and the test then checks wether the counter
values relate to the CPU-quota distribution.

fix #1275
2014-11-28 12:02:37 +01:00
Sebastian Sumpf
038a7999bf ldso: Disallow recursive initialization
Do not support the global construction from of objects from within a global
constructor of another object. This can happen if, for example, dlopen is called
from a global constructor. The construction will be post-boned until the current
constructor has finished.
2014-11-28 12:02:37 +01:00
Martin Stein
ec6c19a487 base: memory barriers in lock implementations
The memory barrier prevents the compiler from changing the program order
of memory accesses in such a way that accesses to the guarded resource
get outside the guarded stage. As cmpxchg() defines the start of the
guarded stage it also represents an effective memory barrier.

On x86, the architecture ensures to not reorder writes with older reads,
writes to memory with other writes (except in cases that are not
relevant for our locks), or read/write instructions with I/O
instructions, locked instructions, and serializing instructions.

However on ARM, the architectural memory model allows not only that
memory accesses take local effect in another order as their program
order but also that different observers (components that can access
memory like data-busses, TLBs and branch predictors) observe these
effects each in another order. Thus, a correct program order isn't
sufficient for a correct observation order. An additional architectural
preservation of the memory barrier is needed to achieve this.

Fixes #692
2014-11-28 12:02:34 +01:00
Sebastian Sumpf
5a821d4c92 base: Genode's dynamic linker
Issue #1280
2014-11-12 14:44:15 +01:00