Skip to content

GitLab

X
xcap-capability-linux
Commit 6085bcd5 authored by Anton Burtsev's avatar Anton Burtsev Committed by Vikram Narayanan
Browse files
Options

Kicked out Muktesh's code, wrote my own stub 

-- Mine is primitive but works, Muktesh will have to come
   back and rewrite
-- Cspace is an array, only insert and lookup are supported
parent 0de25ed1
Hide whitespace changes
Inline Side-by-side
Showing with 103 additions and 1129 deletions
drivers/lcd/ipc-ping-pong/sender.c
View file @ 6085bcd5
......@@ -15,9 +15,10 @@
#include <linux/fs.h>
#include <asm/uaccess.h>
#include <linux/kthread.h>
#include <linux/slab.h>
#include <lcd/lcd.h>
#include <lcd/cap-internal.h>
#include <lcd/cap.h>
MODULE_LICENSE("GPL");
MODULE_DESCRIPTION("LCD ping-pong IPC test (sender)");
......@@ -26,7 +27,8 @@ struct sync_ipc *rvp;
int lcd_ping_pong_init_sender(void) {
int ret;
capability_t rvp_cap;
capability_t rvp_cap = 0;
struct cnode *cnode;
ret = lcd_enter();
if (ret) {
......@@ -40,13 +42,18 @@ int lcd_ping_pong_init_sender(void) {
return -ENOMEM;
};
rvp_cap = lcd_cap_create_capability(&current->cspace, (void*)rvp, 0);
if(rvp_cap == 0) {
cnode = lcd_cnode_lookup(&current->cspace, rvp_cap);
if(cnode == 0) {
printk(KERN_ERR "Failed to create capability\n");
kfree(rvp);
return -ENOMEM;
};
cnode->type = LCD_TYPE_SYNC_EP;
cnode->object = rvp;
lcd_cnode_release(cnode);
current->utcb->boot_info.boot_rvp = rvp_cap;
return 0;
};
......@@ -54,8 +61,8 @@ int lcd_ping_pong_init_sender(void) {
int lcd_ping_pong_init_receiver(void)
{
int ret;
struct sync_ipc *rvp;
capability_t rvp_cap;
capability_t rvp_cap = 0;
struct cnode *cnode;
ret = lcd_enter();
if (ret) {
......@@ -65,13 +72,18 @@ int lcd_ping_pong_init_receiver(void)
BUG_ON(rvp == NULL);
rvp_cap = lcd_cap_create_capability(&current->cspace, (void*)rvp, 0);
if(rvp_cap == 0) {
cnode = lcd_cnode_lookup(&current->cspace, rvp_cap);
if(cnode == 0) {
printk(KERN_ERR "Failed to create capability\n");
kfree(rvp);
return -ENOMEM;
};
cnode->type = LCD_TYPE_SYNC_EP;
cnode->object = rvp;
lcd_cnode_release(cnode);
current->utcb->boot_info.boot_rvp = rvp_cap;
return 0;
};
......
include/lcd/cap-internal.h deleted 100644 → 0
View file @ 0de25ed1
#ifndef __LCD_CAP_INTERNAL_H__
#define __LCD_CAP_INTERNAL_H__
#include <linux/types.h>
#include <linux/module.h>
#include <linux/kernel.h>
//#include <linux/sched.h>
#include <linux/mm.h>
#include <linux/slab.h>
#include <linux/fs.h>
#include <linux/log2.h>
#include <linux/delay.h>
#include <linux/kfifo.h>
#include <asm/page.h>
#include <lcd/cap.h>
#define MAX_SLOTS (PAGE_SIZE/sizeof(struct cte))
#define CNODE_SLOTS_PER_CNODE 64
#define CNODE_SLOTS_START (MAX_SLOTS - CNODE_SLOTS_PER_CNODE)
#define CNODE_INDEX_BITS (ilog2(MAX_SLOTS))
#define CAP_ID_SIZE (sizeof(capability_t) * 8)
#define MAX_DEPTH ((CAP_ID_SIZE + 1)/CNODE_INDEX_BITS)
#define SAFE_EXIT_IF_ALLOC_FAILED(ptr, label) \
if (ptr == NULL) \
{ \
goto label; \
} \
#define ASSERT(condition, expr) \
if(!(condition)) \
{ \
printk("\nAssertion Failed at: %d\n",__LINE__); \
panic(#expr); \
}
#define LCD_PANIC(expr) \
panic(#expr);
/* caps with fixed slot potitions in the root CNode */
enum
{
LCD_CapNull = 0, /* null cap */
//LCD_CapInitThreadTCB = 1, /* initial thread's TCB cap */
//LCD_CapInitThreadPD = 2, /* initial thread' page directory */
//LCD_CapIRQControl = 3, /* global IRQ controller */
//LCD_CapInitThreadIPCBuffer = 4, /* initial thread's IPC buffer frame cap */
LCD_CapFirstFreeSlot
};
#define CAPRIGHTS_READ (1 << 0)
#define CAPRIGHTS_WRITE (1 << 1)
#define CAPRIGHTS_EXECUTE (1 << 2)
#define CAPRIGHTS_GRANT (1 << 3)
#define CAPRIGHTS_NUM 4
#define CAPRIGHTS_ALL ((1 << CAPRIGHTS_NUM) - 1)
#define CAPRIGHTS_RW (CAPRIGHTS_READ | CAPRIGHTS_WRITE)
#define CAPRIGHTS_RWX (CAPRIGHTS_RW | CAPRIGHTS_EXECUTE)
#define CAPRIGHTS_NORIGHTS 0
int lcd_cap_init(void);
int lcd_cap_exit(void);
////////////////////////////////////////////////////////////////////////////////////////////
/* Helper Functions */
////////////////////////////////////////////////////////////////////////////////////////////
static inline int lcd_get_bits_at_level(capability_t id, int level)
{
int bits = 0;
id = id << ((MAX_DEPTH - level - 1) * CNODE_INDEX_BITS);
id = id >> ((MAX_DEPTH - 1) * CNODE_INDEX_BITS);
bits = (int) id;
return bits;
}
static inline void lcd_clear_bits_at_level(capability_t *id, int level)
{
capability_t mask = (~0);
// clear all higher order bits.
mask = mask << ((MAX_DEPTH - 1) * CNODE_INDEX_BITS);
// clear lower order bits
mask = mask >> ((MAX_DEPTH - 1) * CNODE_INDEX_BITS);
// get the mask to appropriate position
mask = mask << (level * CNODE_INDEX_BITS);
mask = ~mask;
*id = (*id) & mask;
}
static inline void lcd_set_bits_at_level(struct cte *cnode, capability_t *cid, int free_slot)
{
int level = cnode->cnode.table_level;
capability_t id = free_slot;
*cid = cnode->cnode.cnode_id;
lcd_clear_bits_at_level(cid, level);
id = id << (level * CNODE_INDEX_BITS);
*cid = *cid | id;
}
struct cte * lcd_cap_reserve_slot(struct cte *cnode, capability_t *cid, int free_slot);
bool lcd_cap_initialize_freelist(struct cap_space *cspace, struct cte *cnode, bool bFirstCNode);
capability_t lcd_cap_lookup_freeslot(struct cap_space *cspace, struct cte **cap);
void lcd_cap_update_cdt(struct task_struct *tcb);
bool lcd_cap_delete_internal(struct cte *cap, bool *last_reference);
bool lcd_cap_delete_internal_lockless(struct cte *cap, bool *last_reference);
////////////////////////////////////////////////////////////////////////////////////////////
/* External Interface */
////////////////////////////////////////////////////////////////////////////////////////////
// creates a cspace for a thread. should be called during lcd/thread creation.
// expects the following objects as input with the rights for those objects:
// ****(LCD_CapInitThreadTCB is compulsory)
// Input:
// objects: array of pointers where each pointer is as follows:
// objects[index] Index within input array Comments
// LCD_CapNull 0 Should be a NULL entry in objects array
// ****LCD_CapInitThreadTCB 1 Pointer to task_struct of thread.
// LCD_CapInitThreadPD 2 Pointer to the page directory of process.
// LCD_CapIRQControl 3 ?? will be used later.
// LCD_CapInitThreadIPCBuffer 4 Pointer to the IPC buffer which will be used.
// total number of object pointers expected in array is equal to LCD_CapFirstFreeSlot.
// Put a NULL pointer for entries which the thread is not expected to have.
// e.g. if the thread does not need an IPC buffer then objects[4] should be NULL.
// pointer to the cspace is also added to the TCB of the caller.
// Output:
// pointer to the newly created cspace.
int lcd_cap_init_cspace(struct cap_space *cspace);
// will be used to access the object on which a method is to be invoked.
// the returned value is a pointer to the entry in the table where the capability
// maps. This contains the handle to the object which can be used by the invoked method.
// Input:
// tcb: pointer to the thread control block of the thread which invokes method.
// cid: capability identifier of the object on which the method is to be invoked.
// keep_locked: whether or not to keep the semaphore protecting cdt locked.
// Output:
// pointer to the capability table entry if the cid is valid else NULL is returned.
struct cte * lcd_cap_lookup_capability(struct cap_space *cspace, capability_t cid, bool keep_locked);
// creates a new capability, inserts it into cspace of caller and
// returns the capability identifier.
// it is unclear who will have the right to perform this operation.
// Input:
// ptcb: pointer to the task_struct of the thread which intends to create the capability.
// hobject: pointer to the underlying kernel object for which capability is being created.
// crights: the rights associated with the capability for the object.
// Output:
// capability identifier within the cspace of the thread which intended to create this capability.
// 0 = Failure
capability_t lcd_cap_create_capability(struct cap_space *cspace, void * hobject, lcd_cap_rights crights);
// will be used to grant a capability to another thread
// returns the address of the capability within the cspace of the receiver thread.
// a logical AND of the input parameter crights and the rights on the capability
// being granted will decide the final rights the granted capability will have.
// Input:
// src_tcb: pointer to the task_struct of the thread which internds to grant the capability.
// src_cid: capability identifier of the capability being granted.
// dst_tcb: pointer to the task_struct of the receiver thread.
// crights: the rights on the capability to be granted to the receiver.
capability_t lcd_cap_grant_capability(struct cap_space *src_space, capability_t src_cid, struct cap_space *dst_space, lcd_cap_rights crights);
// will be called to delete a particular capability in the calling threads
// cspace. threads have right to delete capabilities in their own cspace.
// Input:
// ptcb: pointer to the task_struct of the thread intending to delete a capability.
// cid : capability identifier of the capability to be deleted.
// Output:
// 0 = Success
// Any other value indicates failure.
uint32_t lcd_cap_delete_capability(struct cap_space *cspace, capability_t cid);
// will be called to delete the capability and all its children.
// the children can be present in cspace belonging to different threads.
// as such the thread owning the parent capability has a right to delete
// a capability which is its child or was derieved from it.
// Input:
// ptcb: pointer to the task_struct of the thread which is invoking this revoke operation.
// cid : the capability identifier of the capability being revoked.
// Ouptput:
// 0 = Success
// Any other value indicates failure.
uint32_t lcd_cap_revoke_capability(struct cap_space *cspace, capability_t cid);
// should be called when the thread exits.
// this is extremely heavy function which updates the CDT for all capabilities present
// in the cspace of the exiting thread.
// Input:
// ptcb: pointer to the task_struct of the thread which is getting terminated.
void lcd_cap_destroy_cspace(struct cap_space *cspace);
// will be used to get the rights available with a capability.
// Input:
// ptcb: pointer to the task_struct of the thread in whose cspace the capability resides.
// cid : capability identifier of the capability whose rights are being queried.
// rights: The rights will be saved in this variable.
// Output:
// Return Value: 0 = Success, Any other value indicates failure.
// The rights associated with the capability will be saved in the rights ouput paramter.
uint32_t lcd_cap_get_rights(struct cap_space *cspace, capability_t cid, lcd_cap_rights *rights);
// will be used to craete a copy of the capability identified by cid within the same cspace
// the rights of the copied capability could be modified using the rights parameter.
// Input:
// tcb: pointer to the thread control block whose cspace has the capability to be copied.
// cid: the capability identifier of the capability to be copied.
// rights: the new rights for the copied capability, the final rights the capability will
// be the Logical AND of the original rights and the parameter rights.
// Output:
// the capability identifier for the copied capability is returned.
// 0 indicates failure.
capability_t lcd_cap_mint_capability(struct cap_space *cspace, capability_t cid, lcd_cap_rights rights);
#endif // __LCD_CAP_H__
include/lcd/cap.h
View file @ 6085bcd5
/* Author: Anton Burtsev
* Copyright: University of Utah */
#ifndef __LCD_CAP_H__
#define __LCD_CAP_H__
#include <linux/types.h>
#include <linux/semaphore.h>
#include <uapi/linux/lcd-cap.h>
typedef uint32_t lcd_cnode; // a pointer to the cnode
typedef uint32_t lcd_cnode_entry; // a pointer to an entry within a cnode
typedef uint64_t lcd_tcb; // a pointer/handle to the thread contrl block
typedef uint16_t lcd_cap_rights; // holds the rights associated with a capability.
typedef uint16_t lcd_cap_type;
enum __lcd_cap_type
enum lcd_cap_type
{
lcd_type_invalid,
lcd_type_free,
lcd_type_capability,
lcd_type_cnode,
lcd_type_endpoint,
lcd_type_separator
LCD_TYPE_INVALID,
LCD_TYPE_FREE,
LCD_TYPE_SYNC_EP,
};
struct cap_derivation_tree
{
struct cte *cap;
struct semaphore *sem_cdt;
struct cap_derivation_tree *next;
struct cap_derivation_tree *prev;
struct cap_derivation_tree *parent_ptr;
struct cap_derivation_tree *child_ptr;
struct cnode {
enum lcd_cap_type type;
void *object;
};
struct capability_internal
{
void *hobject; // a pointer to a kernel object
struct cap_derivation_tree *cdt_node; // list of domain ids to whom this
//capability is granted
lcd_cap_rights crights; // specifies the rights the domain has over this capability
struct cspace {
spinlock_t lock;
struct cnode *cnode;
};
struct cte;
struct cap_node
{
capability_t cnode_id;
struct cte *table; /* points to another cnode table */
uint16_t table_level;
};
int lcd_cap_init(void);
int lcd_cap_exit(void);
struct free_slot_t
{
int next_free_cap_slot;
int next_free_cnode_slot;
struct cap_space *cspace;
};
struct cte // capability table entry
{
union
{
struct cap_node cnode;
struct capability_internal cap;
struct free_slot_t slot;
};
lcd_cap_type ctetype;
uint16_t index;
};
struct cap_space
{
struct cte root_cnode;
struct semaphore sem_cspace;
};
void lcd_cnode_release(struct cnode *cnode);
int lcd_init_cspace(struct cspace *cspace);
int lcd_cnode_insert(struct cspace *cspace, capability_t cap, struct cnode *cnode);
struct cnode *lcd_cnode_lookup(struct cspace *cspace, capability_t cap);
#endif
include/linux/sched.h
View file @ 6085bcd5
......@@ -1469,7 +1469,7 @@ struct task_struct {
unsigned int flags; /* per process flags, defined below */
unsigned int ptrace;
#ifdef CONFIG_HAVE_LCD
struct cap_space cspace;
struct cspace cspace;
struct list_head sync_rendezvous;
struct utcb *utcb;
#endif
......
virt/lcd-domains/cap.c
View file @ 6085bcd5
/*
* Author: Anton Burtsev <aburtsev@flux.utah.edu>
* Copyright: University of Utah
*/
#include <linux/slab.h>
#include <lcd/cap-internal.h>
#include <lcd/cap.h>
struct kmem_cache *cte_cache;
struct kmem_cache *cdt_cache;
#define LCD_MAX_CAPS 32
struct kmem_cache *cnode_cache;
struct kmem_cache *cdtnode_cache;
int lcd_cap_init(void){
cte_cache = KMEM_CACHE(cte, 0);
if(!cte_cache){
printk(KERN_ERR "Failed to allocate cte slab\n");
cnode_cache = KMEM_CACHE(cnode, 0);
if(!cnode_cache){
printk(KERN_ERR "Failed to allocate cnode slab\n");
return -ENOMEM;
};
cdt_cache = KMEM_CACHE(cap_derivation_tree, 0);
if(!cdt_cache){
printk(KERN_ERR "Failed to allocate cte slab\n");
return -ENOMEM;
};
//cdtnode_cache = KMEM_CACHE(cap_derivation_tree, 0);
//if(!cdt_cache){
// printk(KERN_ERR "Failed to allocate cte slab\n");
// return -ENOMEM;
//};
return 0;
};
int lcd_cap_exit(void) {
if (cte_cache)
kmem_cache_destroy(cte_cache);
if (cdt_cache)
kmem_cache_destroy(cdt_cache);
return 0;
}
// this function will not lock any semaphore.
// assumption is that cdt and cspace are already locked.
bool lcd_cap_delete_internal_lockless(struct cte *cap, bool *last_reference)
{
struct cte *table;
struct cap_derivation_tree *p_cdt, *cdt, *c_cdt, *prev_cdt = NULL;
*last_reference = false;
BUG_ON(cap != NULL);
cdt = cap->cap.cdt_node;
p_cdt = cdt->parent_ptr;
c_cdt = cdt->child_ptr;
if (p_cdt == NULL && c_cdt == NULL && cdt->next == NULL && cdt->prev == NULL)
*last_reference = true;
// update parent pointer
while (c_cdt != NULL)
{
prev_cdt = c_cdt;
c_cdt->parent_ptr = p_cdt;
c_cdt = c_cdt->next;
}
c_cdt = cdt->child_ptr;
// update sibling pointers
if (c_cdt == NULL)
{
if (cdt->prev != NULL)
{
cdt->prev->next = cdt->next;
}
if (cdt->next != NULL)
{
cdt->next->prev = cdt->prev;
}
}
else
{
if (cdt->prev != NULL)
{
cdt->prev->next = c_cdt;
c_cdt->prev = cdt->prev;
cdt->prev = NULL;
}
if (cdt->next != NULL)
{
prev_cdt->next = cdt->next;
cdt->next->prev = c_cdt;
cdt->next = NULL;
}
}
// update child pointer
if (p_cdt->child_ptr == cdt)
{
if (c_cdt != NULL)
{
p_cdt->child_ptr = c_cdt;
}
else
{
p_cdt->child_ptr = cdt->next;
}
}
// delete the capability
kmem_cache_free(cdt_cache, cdt);
cap->ctetype = lcd_type_free;
table = cap - cap->index;
cap->slot.next_free_cap_slot = table[0].slot.next_free_cap_slot;
table[0].slot.next_free_cap_slot = cap->index;
return true;
}
bool lcd_cap_delete_internal(struct cte *cap, bool *last_reference)
{
struct cap_space *cspace;
struct cte *node;
bool done = false;
BUG_ON(cap == NULL);
if(last_reference == NULL)
return false;
*last_reference = false;
node = cap - cap->index;
if (node[0].ctetype != lcd_type_free)
return false;
cspace = node[0].slot.cspace;
if (cspace == NULL)
return false;
while (!done)
{
// lock the cspace
if (down_trylock(&(cspace->sem_cspace)) == 0)
{
lcd_cap_delete_internal_lockless(cap, last_reference);
done = true;
}
else
{
msleep_interruptible(1);
}
}
return true;
}
uint32_t lcd_cap_delete_capability(struct cap_space *cspace, capability_t cid)
{
struct cte *cap;
bool last_reference = false;
struct semaphore *sem_cdt_backup;
BUG_ON(cid == 0);
cap = lcd_cap_lookup_capability(cspace, cid, true);
if (cap == NULL)
{
LCD_PANIC("lcd_cap_delete_capability: Capability not found\n");
return -1;
}
sem_cdt_backup = cap->cap.cdt_node->sem_cdt;
lcd_cap_delete_internal(cap, &last_reference);
up(sem_cdt_backup);
if (last_reference == true)
{
// TBD: this is the place where we free the object associated with teh capability.
// for now we just release the sem_cdt semaphore.
kfree(sem_cdt_backup);
}
if (cnode_cache)
kmem_cache_destroy(cnode_cache);
//if (cdt_cache)
// kmem_cache_destroy(cdt_cache);
return 0;
}
uint32_t lcd_cap_revoke_capability(struct cap_space *cspace, capability_t cid)
{
struct cte *cap;
struct cap_derivation_tree *cdt, *c_cdt;
struct kfifo cap_q;
struct semaphore *sem_cdt_backup;
int size = sizeof(struct cte);
bool dummy = false, last_reference = false;
BUG_ON(cid == 0);
int lcd_init_cspace(struct cspace *cspace) {
if (kfifo_alloc(&cap_q, sizeof(struct cte) * 512, GFP_KERNEL) != 0)
{
LCD_PANIC("lcd_cap_revoke_capability: Fifo allocation failed, aborting\n");
return -1;
}
cap = lcd_cap_lookup_capability(cspace, cid, true);
if (cap == NULL)
{
LCD_PANIC("lcd_cap_revoke_capability: Capability not found\n");
return -1;
}
cdt = cap->cap.cdt_node;
sem_cdt_backup = cap->cap.cdt_node->sem_cdt;
if (cdt->parent_ptr == NULL && cdt->next == NULL && cdt->prev == NULL)
last_reference = true;
kfifo_in(&cap_q, cap, size);
while (!kfifo_is_empty(&cap_q))
{
kfifo_out(&cap_q, cap, size);
if (cap == NULL || cap->ctetype != lcd_type_capability)
continue;
cdt = cap->cap.cdt_node;
c_cdt = cdt->child_ptr;
while (c_cdt != NULL)
{
kfifo_in(&cap_q, c_cdt->cap, size);
c_cdt = c_cdt->next;
}
lcd_cap_delete_internal(cap, &dummy);
}
up(sem_cdt_backup);
// with revoke the entire tree is deleted. Now if the root of the tree had not parent,
// or no siblings then this was the true last_reference so we now remove the cdt semaphore.
if (last_reference)
{
kfree(sem_cdt_backup);
}
return 0;
}