Note this requires companion changes to the build glue.
Change-Id: I5876d3c8b50f373d21d42cf30dbb7031654fb709
GitOrigin-RevId: 963f05fb3c018ad2d509ef68ef37bf83d924337e
- copyrights in code
- more README (mostly copied from manifest/README)
Change-Id: If7c4293bbd52102a9e8039176be4460206aea12f
GitOrigin-RevId: 5d9c70fa5c357c38ae5f1ef601eb06a8039f6974
Previously we put the return code and fault PC (if any) at the very end
of the TCM. This was always intended to be temporary. The return
information has instead been placed at the beginning of the model_output
section.
Minor changes:
* Running_model tracks the image_id instead of an index.
* Re-ordered ImageSizes members to match layout in memory.
* Rename unpacked_size to in_memory_size to match rest of MlCoordinator
* Fix fake-vec-core to match kata-vec-core
Change-Id: I33ceb59cb36312b60992a6ada49605ffa3b2fa78
GitOrigin-RevId: 5cf399e2c609e0b4ca83101714881b02eb09b94e
This CL handles the integration of the Image Manager, which comes
concurrent with the necessary WMMU changes needed by the Image Manager.
The ML Coordinator now calls into Image Manager to make space, commit
images, and set the WMMU.
The MlCoordinator now first verifies that an image is valid by first making a pass through the section headers. It stores the two sizes that we're interested in per image: how big it is packed on flash, and how big it is unpacked in memory.
Known issues:
b/241799340: Refactor BundleImage to support unit testing
The writes to DMEM via the kata-vec-core crate was meant to be in image_manager.rs, but this interfered with the ability to run unit tests. We can refactor BundleImage to make this work.
b/241799866: Improve heap management
Right now I clear all of the "temporary data section" (bss, stack,
heap), but I suspect only the heap needs to be cleared. This needs more effort to check that that's correct, and track those locations.
Minor changes:
ImageId is used instead of (String, String) in the component.
Change-Id: I1505c6474fc60205323ce3bb13610fdac3702b89
GitOrigin-RevId: 5df9938a6cbd7ca5510ce8fcb500ce471f42b2cb
* changes:
kata: LSC: rustfmt with global rustfmt.toml
kata: update global rustfmt flags
kata: Promote rustfmt.toml to all kata crates
GitOrigin-RevId: 452e66fa7231f39cff81dc2fbe37ad1a1fc62fb9
At the moment, the scheduler is wasting 50% of its time in an idle thread for
the application sandbox domain. Until we can figure out how to use these domains
more effectively, we'll reduce to a single domain.
Bug: 238811077
Change-Id: If40d01d5c94e31cc8d522dd5f906f857e363cc42
GitOrigin-RevId: 911f6fe046c61b8ce7e9ba00f8de0ec872997ec3
This updates the kernel configs to setup two domains instead of one,
and also defines a bare-bones domain scheduler that simply round-
robins through the domains.
Bug: 238811077
Change-Id: Ibb49f10265c38dc26235fc246f6147b306055bcb
GitOrigin-RevId: 6b17211d8866bec9207f78dc61c4840c6da9537d
Add support to output the contents of the top-level CNode of a CAmkES
service or KataOS application to the serial console. This is dependent
on kernel support that is enabled with CONFIG_PRINTING. Applications
must be running; otherwise there is no CSpace to dump.
Specific changes:
- add a "capscan" shell command
- add capscan method to each CAmkES interface
- add capscan_bundle method to the ProcessControlInterface
- add Camkes::capscan() to dump the top-level CNode
- add ProcessManager support to dump the CNode for a bundle
TODO: fix syscall wrapper error return
Change-Id: If6ca222decdb4c40a1d3a63e69792eb3feb30f6a
GitOrigin-RevId: 504c0182ccccf287b5d58cd8e33981c11d7539d7
- Use seL4_Untyped_Describe to get an accurate view of each
UntypedMemory slab being managed; this makes mstats reflect
rootserver allocations.
- Track memory allocated before we run as "overhead" (was meant to
track fragmentation but was always zero).
- Add an "mdebug" command to describe each managed memory slab;
this is useful to see whether the kernel's view of memory use is
consistent with MemoryManager.
Change-Id: I53b2738c430ad3356ecd16a1cad29ca92dc74beb
GitOrigin-RevId: 2ad43f9b7760c722a6590ea049a3814c8dcccba7
Fallout from rootserver memory reclamation work:
- add CDL_Object::next_free_slot
- add CONFIG_NOISY_UNTYPEDS feature for spammy debug msgs
- add CONFIG_NOISY_CREATE_OBJECT msgs
- assert if bootinfo/untyped_cnode setup is wrong instead of
logging msgs and then failing later
- bury ugly BIT usage in is_obj_inside_untyped
- revise handoff_cap api for future use in memory reclamation
- remove some unneeded type coercions
- streamline printing seL4_CPath's
- simplify get_object & get_asid
Change-Id: Ib2c3d717dd41b307cb7afd4821dee4b6be173d57
GitOrigin-RevId: 99f4b79e1df257d373accf96190a77a65ba3305f
capdl-loader-app duplicated the TCB & CNode caps. The only possible
reason to do this is if a cap is Move'd (e.g. when constructing the
CSpace for each component) and then later referenced. But this does
not appear to happen so remove in prep for memory reclamation changes.
Change-Id: I8c9bd1f4f2fa1535da330f782ba978b460b0cf00
GitOrigin-RevId: 7d950dee814705b13b95831b39b7626d4210599b
Enabling CONFIG_NOISY_UNTYPEDS causes the UntypedMemory slabs received
at boot to be logged to the console.
Change-Id: Ieceedbe17b09c4bb72a2e40e44daa041990019af
GitOrigin-RevId: b5f598cac4302e24b501a8df0c6e0c194b27b991
The ML Coordinator will validate the cpio model and collect the fsize
and msizes for each section. It will then pass that information along
with a Boxed version of the bundle_image, which implements the
kata_io::Read trait.
This CL adds the lower level (vec-core) function that writes to the TCM and
calls these functions from the image_manager.
Complete integration of the image_manager is pending splitting the ELF
image into all 6 sections.
Change-Id: I7a5706c588867b4aee04109e2a9edeca071d2ca8
GitOrigin-RevId: 89df1c81bade3ec4508f643a8ba83cae6a3e1f60
For now we treat the image as one big block. A follow up CL will break
it into individual sections like text, model_output, etc.
Change-Id: I86006fc18c940f04f4d15ec032f9196c01255170
GitOrigin-RevId: 7f36043202bca8994f62ced3338b4ba4b1ef922a
kata-os-common prevents unit testing, so we need to split up
functionality so that other logic can be unit tested. To this end this
CL adds:
kata-ml-shared: structs used in other crates that don't require
kata-os-common
kata-ml-support: logic like image manager that is unit testable
Image Manager is responsible for managing the images loaded onto the
VC's TCM. It tracks pointers into the TCM, which image is loaded where,
and unloads images when space needs to be made.
Change-Id: Icdda9a284b4de7448e8661bb8647e9e6d39e652e
GitOrigin-RevId: cfb65a1dd29d1279aa8ab6c9bf41d5f20206ef68
Looks like stuff from when the mailbox test code was in the driver got
left behind; remove it.
Change-Id: I379a58e1fd46895436ed49f780e643efbed81aea
GitOrigin-RevId: 1783642a34ed4f23e7d6703e5e6d041785c1ee4a
Set the per-component static heap size to 8KB. The heap is only used by
CAmkES RPC for marhsaling dynamic array & string parameters. We mostly
use the former and no more than 4KB at a time so 8KB should be fine until
we can redirect C use to the Rust heap allocator (or replace the C code).
BUG=224069025
Change-Id: I600854c5cb41ed268087f4b2294b70c3384973c2
GitOrigin-RevId: 177a353e6873f2c048cf4b446114534d9dcffc94
With the newer rustc we can switch to the stable version of bitvec;
this includes some api changes.
Change-Id: I9a7af5c2699f9bdebedc06ee68f5e3b7b71b9d75
GitOrigin-RevId: 44d44f930e8b35830d819949b6203c584fea2be3
Bug: 233102476
Writing >CIRCULAR_BUFFER_CAPACITY bytes to the uart will hang because
of a missing unlock of the tx_mutex.
While here add a shell test command that was used to debug the issue
(but don't enable it by default).
Change-Id: I3e35001a653fe2659fb1534e4100727b69f662a1
GitOrigin-RevId: 550b35c88328dcbd1f87dd8e0209b1faabf7f931
Add features to control the log level used before reaching the shell
prompt (where the "loglevel" command can be used to control log
filtering). The default log level is Info. LOG_DEBUG forces it to
Debug. LOG_TRACE forces it to Trace (max).
Change-Id: Ic55eaf3cd08fc101c53319b5a45a2c7de6f94a66
GitOrigin-RevId: 5500ac5d65186773d5304a75d03295e09b2e9a63
Now that there's MemoryManager integration for zmodem uploads we no longer
need an outsized heap; make it 16KB for now (likely can be smaller).
Change-Id: I3b991ef794c0e718934d055e41aef9abc48b1d6b
GitOrigin-RevId: 7145b14fca96f59ff76497be29da6b1f447c15b0
Using cap_identify only works on Debug builds; instead print the CDL
cap type.
Change-Id: Ie338877ca12e404f412a7c9b170e1897bfd5d0df
GitOrigin-RevId: fe8a143353b43f18a1b6606b88ef0ba1799adcb8
Change the fake to behave as the real impl will for LoadModel &
LoadApplication: return a deep copy of the saved package contents as
would happen if the data were pulled from flash. Match this behaviour in
the kata-shell SecurityCoordinator test commands and the MlCoordinator
by taking ownership of the received objects and free'ing them when no
longer needed.
With these changes one can install a bundle and repeatedly load_application
without leaking any memory, capabilities, or slots in the toplevel CNode
of the caller (DebugConsole in this case).
Likewise doing install of a model, test_mlexecute, and then uninstall
of the model's bundle returns all resources.
Specific changes:
- correctly release resources in kata-shell load_application & load_model
- correct release of bundle_frames in seL4BundleImpl::stop
- release resources in MlCoordinator::load_model
- connect the MemoryInterface to the MlCoordinator so it can return memory
- setup two copyregions in the SecurityCoordinator to do the deep copy
- add ObjdDescBundle::cptr_iter for iterating over the set of seL4_CPtr's
- hack kata_frame_alloc_in_cnode to split requests according to the
kernel's config on the max Retype count
- while here switch test_mailbox to use one of the copyregions
TODO:
- deep_copy allocates all frames at once which requires a band-aid;
either hide that in MemoryManager or maybe allocate a page at a time
Change-Id: Ia425976b31ea7a32b1d0e4affc3a0ef9ba966c87
GitOrigin-RevId: 31d5bc99b569a5eab9c33c7e1014793bfe57161e
Move the container slot release up as it logically belongs with the
seL4BundleImpl construction. This makes clear it's unrelated to the
actual start operation.
Change-Id: Idda2a4a829fe6fae2a4d1dbe99aff495ef10b3b8
GitOrigin-RevId: ba2cdc9f4bfb54cfbeca11888bd31cd5657d0182
Add Camkes::set_reply_cap and Camkes:set_reply_cap_release to attach
an seL4 capability to a reply message. The latter ensures the attached
capability is deleted after the seL4 rpc reply is done (this happens
inside the CAmkES C code).
Change-Id: I42fad2e70e6c02fcc0de5ab9a460c5a773041900
GitOrigin-RevId: 7f59e75b10697501a217f943672a40ff67f48229
Add Camkes::set_request_cap to attach an seL4 capability to an outbound
ipc message. The return value is an RAII wrapper that cleans up state
and must be held until after the CAmkES rpc call completes
Change-Id: I0672c59e0b5e43e39c9ea3fb16809270a33f51ef
GitOrigin-RevId: 56be13a2c05fcc1b4a1aa5c8e0eab47bcd0f2345
In particular this exports the CAP_RELEASE flag so there is a single
source for it's definition and KataOS-specific support in the CAmkES
templates is enabled only for KataOS components.
Specific changes:
- adds cbindgen-generated CamkesBindings.h
- adds include of CamkesBindings.h in component cbindgen files
- add a dep on cbindgen.toml in all Makefiles
- update generated interface files
Change-Id: Ib6239d3ac0036b7a04bb36afccf25a05737b0e56
GitOrigin-RevId: af10117fa253f0c7c67969a5852ced9d992c6274
CSpaceSlot: :delete deletes any seL4 capability in the slot.
Change-Id: Id59d0b27f231c83d146b2380939ea581363fb9b3
GitOrigin-RevId: 0469f75f5e14366444f2e9e4f6c3db9fc69e2f23
Add debug msgs gated by a new "TRACE_OPS" feature. Messages are prefixed
by the Camkes component name since each component may have an allocator.
Change-Id: Id278bd489a0bedd532f5508c3ebe0101fc749f2c
GitOrigin-RevId: f09b0093eac1fd21ac2523808ee3d67a444abeb3
Move the CopyRegion support to kata-os-common. CopyRegion wraps a
CAmkES copyregion virtual memory window to support virtual access to
physical page frames. There is RAII cleanup to clear any virtual mapping.
Embedding a CopyRegion in struct that may be cloned is not recommeded
(at least for now).
Change-Id: I7fd465fafa4a5d1de9a7e565ecb62c38a3b7e81a
GitOrigin-RevId: f58e973b1c47ec05e48bfedcb9cd5e75b71c212a
