using the DUART means we don't get console input on the kernel
(because the DUART is incapable of this) but it's a decent compromise
I think because the DUART is fast and efficient, and mostly we want
it to capture kps?
Eventually we'll need an input mode but for now, this will get us
moving.
Mark `MemoryRange::as_slice()` and `MemoryRange::as_slice_mut()` as
unsafe.
This is due to the fact that not all representable types can be cast to
an arbitrary value. For example, if Process A sends random values to
Process B, then Process B casts the memory to a slice of `bool`, then
any values that are not 0 or 1 are undefined.
Because these functions can leak UB into the program, they are marked as
unsafe.
This patch adds `unsafe {}` blocks to all instances where this function
is called. Additionally, all instances have been checked to verify that
they do not cast to any invalid types -- most use `u8` or `u32`.
Additionally, the long-deprecated `MemoryRange::from_parts()` call was
removed, since that causes UB without being marked as unsafe.
Signed-off-by: Sean Cross <sean@xobs.io>
With Rust 1.71.0, mut detection has changed slightly, and it is more
aggressive about warning when things do not need to be mutable.
Remove these from the `services` file.
Signed-off-by: Sean Cross <sean@xobs.io>
SUpport debugging when interrupt handlers go awry, such as when they
blow out their own stack.
Do this by creating a dummy sentinal of 255 for interrupt handlers.
Signed-off-by: Sean Cross <sean@xobs.io>
When an interrupt handler panics, restore the system and allow it to
continue. This will help to debug IRQ handlers that panic for one reason
or another, such as infinite recursion.
Signed-off-by: Sean Cross <sean@xobs.io>
- make the "base" field no longer public. It is accessible, but only
through an `unsafe` method, because, it is unsafe.
- add accessors to offest/mask fields. Because, it's not at all
unsafe to access these, and it can be useful for bit-ops that are
not part of the generic set of UTRA.
- add Arc to AtomicCSR, and require `std` for AtomicCSR types.
This should not break anything, I checked inside @foundation-devices
keyOS and they don't seem to be using AtomicCSR anywhere.
The Arc makes it a bit safer to clone the AtomicCSR base pointer
and share it between threads, but it will have an impact on performance.
The USB stack (which requires AtomicCSR) was regression testing and the
impact seems minimal.
Recall that the main purpose of AtomicCSR is to provide a CSR accessor
that does not require a mutable reference to the base object. This
can make certain Rust idioms a bit cleaner. We wrap the base accessor
in Arc+Atomic to try and improve the safety of throwing the borrow
checker under the bus, but it's still not perfect because hardware
mutable state can have side-effects within hardware itself that cannot
be modeled or checked by Rust's borrow checker.
Instead of always doing bytewise accesses, support 2- and 4-byte access.
Additionally, recognize when multiple 4-byte reads are required.
Note that an additional optimization may be made here in the future to
prevent having to check every address, but this is left for a future
optimization.
Signed-off-by: Sean Cross <sean@xobs.io>
Instead of remapping the page to allow the kernel to access a process'
memory, simply set the SUM bit. This makes it no longer an error for the
kernel to access userspace.
Keep setting the `W` bit when we poke, to allow for updating program
memory with breakpoints.
Signed-off-by: Sean Cross <sean@xobs.io>
Previously, we were creating a fake interrupt that was a "user software
interrupt". Update this to be a "supervisor external interrupt" to fix
hardware resume.
Signed-off-by: Sean Cross <sean@xobs.io>
Debug handling was not correct, and didn't work at all. Additionally,
interrupt masking didn't work.
Fix these problems.
Signed-off-by: Sean Cross <sean@xobs.io>
Implement the basics required to get "extended mode" working. This is
waiting on upstream to fix issues, but should allow us to attach to
processes once it works.
Signed-off-by: Sean Cross <sean@xobs.io>
When debugging an invalid process (e.g. not yet run, terminated, etc.)
return an error rather than silently continuing.
Signed-off-by: Sean Cross <sean@xobs.io>
Disable IRQs during destruction, but only if constructed with
`GdbUart::new()`. This allows characters to buffer when the GDB bridge
is destroyed while avoiding the double-free error we were getting from
creating a new UART in the IRQ handler.
Signed-off-by: Sean Cross <sean@xobs.io>
This adds a basic gdb server. Currently, it is possible to list
processes and inspect memory and threads. It is not yet possible to
actually interact with code (e.g. no breakpoints and no single
stepping).
Signed-off-by: Sean Cross <sean@xobs.io>
Add an initial reimplementation of the gdb-stub using the gdbstub
backing crate.
This supports process enumeration and basic thread investigation.
Processes will pause when the debugger is inspecting them. Memory and
registers can be investigated. Threads can be listed and selected.
It does not yet support breakpoints.
Signed-off-by: Sean Cross <sean@xobs.io>
Previously, `disable_irq()` would unconditionally mask an interrupt in
the `sim` register. However, when interrupts are disabled this register
is zero, and we really should be updating `SIM_BACKING`.
Consult the state of the interrupt handler and update the appropriate
field as necessary.
Signed-off-by: Sean Cross <sean@xobs.io>
This function never failed. Make it infallible so that it matches the
same calling convention as `enable_irq()`
Signed-off-by: Sean Cross <sean@xobs.io>
