feat(kernel): per-process budgets (pages, endpoints, notifs, regions) carved from creator, returned on death; init owns pool

crates/adapter-riscv/src/boot/loader.rs

@@ -2,6 +2,7 @@ use crate::hw::uart::Uart;
 use crate::hw::virtio_blk::VirtioBlk;
 use crate::{boot_fs, mmu};
 use types::address::VirtualAddress;
+use types::budget::Limits;
 use types::id::{ProcessId, ThreadId};
 use types::mapping::PagePerms;
 
@@ -52,14 +53,38 @@ pub fn load_init(uart: &Uart, blk: &mut VirtioBlk) -> LoadedProcess {
     LoadedProcess { pid, tid }
 }
 
+/// The servers boot loads, their budgets carved from init's.
+pub const STORAGE: Limits = Limits {
+    pages: 256,
+    endpoints: 2,
+    notifications: 2,
+    // A buffer per client (8) and the disk's DMA.
+    regions: 12,
+};
+/// The framebuffer alone is ~1000 pages at 1280x800.
+pub const DISPLAY: Limits = Limits {
+    pages: 1280,
+    endpoints: 2,
+    notifications: 2,
+    regions: 4,
+};
+pub const INPUT: Limits = Limits {
+    pages: 64,
+    endpoints: 2,
+    notifications: 2,
+    regions: 4,
+};
+
 pub fn load_server(
     uart: &Uart,
     blk: &mut VirtioBlk,
+    init: ProcessId,
     filename: &[u8],
     label: &str,
+    limits: Limits,
 ) -> LoadedProcess {
     let pid = kern()
-        .create_process_internal()
+        .create_process_internal(init, limits)
         .unwrap_or_else(|| crate::halt(uart, "process create failed"));
     let entry = load_elf(uart, blk, pid, filename);
     let tid = kern()

crates/adapter-riscv/src/devices/mod.rs

@@ -1,4 +1,4 @@
-// Boot-time userspace setup: the display's page quota and init's BootInfo page.
+// Boot-time userspace setup: init's BootInfo page.
 
 use crate::hw::uart::Uart;
 use types::address::VirtualAddress;
@@ -6,20 +6,10 @@ use types::bootinfo::{BOOT_INFO_VA, BootDevice, BootInfo, MAGIC, MAX_BOOT_DEVICE
 use types::id::ProcessId;
 use types::mapping::PagePerms;
 
-/// The framebuffer alone is ~1000 pages at 1280x800.
-const DISPLAY_PAGE_LIMIT: usize = 2048;
-
 fn kern() -> &'static mut kernel::Kernel<crate::platform::RiscVPlatform> {
     unsafe { &mut *crate::kernel_ptr() }
 }
 
-/// Lets the display server hold a framebuffer.
-pub(crate) fn display_quota(uart: &Uart, display: ProcessId) {
-    kern()
-        .set_page_limit(display, DISPLAY_PAGE_LIMIT)
-        .unwrap_or_else(|_| crate::halt(uart, "display quota"));
-}
-
 /// Tells init, in a read-only page at BOOT_INFO_VA, which of its slots hold
 /// each board device's capabilities.
 pub(crate) fn boot_info(

crates/adapter-riscv/src/main.rs

@@ -40,15 +40,29 @@ extern "C" fn kmain(hart: usize) -> ! {
         boot::hardware::probe_block_device(&uart).unwrap_or_else(|| halt(&uart, "no block device"));
 
     let init = boot::loader::load_init(&uart, &mut blk);
-    let storage = boot::loader::load_server(&uart, &mut blk, b"storage.elf", "storage");
-    let display = boot::loader::load_server(&uart, &mut blk, b"display.elf", "display");
-    let input = boot::loader::load_server(&uart, &mut blk, b"input.elf", "input");
+    use boot::loader::{DISPLAY, INPUT, STORAGE, load_server};
+    let storage = load_server(
+        &uart,
+        &mut blk,
+        init.pid,
+        b"storage.elf",
+        "storage",
+        STORAGE,
+    );
+    let display = load_server(
+        &uart,
+        &mut blk,
+        init.pid,
+        b"display.elf",
+        "display",
+        DISPLAY,
+    );
+    let input = load_server(&uart, &mut blk, init.pid, b"input.elf", "input", INPUT);
 
     let board = board::devices().unwrap_or_else(|| halt(&uart, "bad board table"));
     kern_mut()
         .register_board(init.pid, &board)
         .unwrap_or_else(|_| halt(&uart, "board registration failed"));
-    devices::display_quota(&uart, display.pid);
     boot::caps::grant_all(&uart, init.pid, storage.pid, display.pid, input.pid);
     // Last, so the servers' fixed slots stay where they expect them.
     boot::caps::grant_console(&uart, &[storage, display, input]);