Gabriel Kaszewski
8d2c40cb1e
- FrameTable: per-frame owner/use, replaces PagePool + ProcessMemory - Quota per process, page tables charged to owner - Regions for shared mem + device MMIO, torn down w/ owner - Platform: create/destroy AS, map/unmap, zero_frame; drop translate_va - RequestPages/ReleasePages/MapPage(move) checked vs kernel records - user window 0x1000..32MiB, private pts by construction - boot loader + device setup go through kernel api - kernel built in place, boot allocator bounded - isolation tests, randomized invariant test, FrameTable kani proofs - fixes: inflated release, unmapped release, dst va unchecked, heap overflow, unbounded pt alloc, unzeroed frames, double free
67 lines
2.4 KiB
Rust
67 lines
2.4 KiB
Rust
#![no_std]
|
|
|
|
use types::{
|
|
address::{EntryPoint, PhysicalAddress, StackPointer, VirtualAddress},
|
|
id::{CoreId, IrqId, ProcessId},
|
|
mapping::PagePerms,
|
|
time::{Ticks, TimerDuration},
|
|
};
|
|
|
|
/// Supplies frames for page tables while the platform builds an address
|
|
/// space. The kernel charges each frame to the address space's owner.
|
|
pub trait FrameSource {
|
|
fn alloc_table_frame(&mut self) -> Option<PhysicalAddress>;
|
|
}
|
|
|
|
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
|
|
pub enum MapError {
|
|
/// The frame source refused to supply a page-table frame.
|
|
OutOfFrames,
|
|
/// The address is outside the user window or not page aligned.
|
|
InvalidAddress,
|
|
/// The process has no address space.
|
|
NoAddressSpace,
|
|
}
|
|
|
|
/// The kernel's contract with an architecture. The kernel decides what is
|
|
/// mapped where; the platform only applies those decisions to hardware.
|
|
pub trait Platform {
|
|
/// User mappings live in `[USER_VA_START, USER_VA_END)`. The platform
|
|
/// guarantees nothing else is mapped in that window in any address
|
|
/// space, so page tables covering it are private to each process.
|
|
const USER_VA_START: usize;
|
|
const USER_VA_END: usize;
|
|
|
|
fn create_address_space(
|
|
&mut self,
|
|
process: ProcessId,
|
|
frames: &mut dyn FrameSource,
|
|
) -> Result<(), MapError>;
|
|
/// Forgets the address space. The kernel frees its frames afterwards,
|
|
/// so the platform must stop using them before returning.
|
|
fn destroy_address_space(&mut self, process: ProcessId);
|
|
fn map_page(
|
|
&mut self,
|
|
process: ProcessId,
|
|
va: VirtualAddress,
|
|
pa: PhysicalAddress,
|
|
perms: PagePerms,
|
|
frames: &mut dyn FrameSource,
|
|
) -> Result<(), MapError>;
|
|
/// Removes the mapping at `va` and flushes it from the TLB.
|
|
fn unmap_page(&mut self, process: ProcessId, va: VirtualAddress);
|
|
/// Fills a frame with zeros before it is handed to a process.
|
|
fn zero_frame(&mut self, pa: PhysicalAddress);
|
|
|
|
fn enable_user_mode(&mut self, entry: EntryPoint, stack: StackPointer) -> !;
|
|
fn set_timer(&mut self, duration: TimerDuration);
|
|
fn current_ticks(&self) -> Ticks;
|
|
fn mask_irq(&mut self, irq: IrqId);
|
|
fn unmask_irq(&mut self, irq: IrqId);
|
|
fn send_ipi(&mut self, target: CoreId);
|
|
fn core_id(&self) -> CoreId;
|
|
fn num_cores(&self) -> u8;
|
|
fn halt(&self) -> !;
|
|
fn debug_putchar(&self, byte: u8);
|
|
}
|