these are just sync'd to the asm.S and checked in.
Eventually, we should migrate that .S file into using
in-line assembly macros, but now that I look at it, I remember
why it hasn't been done yet -- there are some fancy conditionals
used to enable compatibility with different architectures that
I don't know off the top of my head how to translate into
in-line assembly syntax.
a lot of re-import warnings have cropped up. While I appreciate
their studiousness on this, the problem is that removing some
of these exports in the API crate could mean that future users
who want access to some API features that aren't used in this
configuration are now unaccessible.
I think it's not a huge problem at the moment, just spam-cleaning
the warnings because there are too many to deal with carefully
at the moment.
When enumerating processes, the `find_process()` process didn't consult
whether a process was actually free. This resulted in a crash,
particularly when attaching a debugger to a crashed process.
Signed-off-by: Sean Cross <sean@xobs.io>
This command ensures memory is all owned by the correct process and is
unique in its ownership.
It takes a long time to run, so ensure the watchdog timer is disabled.
Signed-off-by: Sean Cross <sean@xobs.io>
Add a function to ensure mappings are unique across the whole system.
This takes a very long time and can crash if the watchdog timer isn't
paused.
Signed-off-by: Sean Cross <sean@xobs.io>
The phys_to_virt function can be used to determine what physical address
page is mapped to a virtual address page.
This throws an error when a page is mapped twice, which shouldn't
happen.
Signed-off-by: Sean Cross <sean@xobs.io>
The kernel stack offset should be aligned to 16 bytes. Previously it was
aligned to 8 bytes. It's unclear if this was the cause of any issues,
but it is best practice to keep things aligned to 16 bytes.
As part of this, key the atomic instructions off of the CPP macro
presence of atomic instructions.
Signed-off-by: Sean Cross <sean@xobs.io>
Fix memory zeroing when requesting a physical pointer. Previously, only
the first 25% of a page was zeroed due to a bug when casting between
*mut u8 and *mut usize.
This now uses `write_volatile` to ensure the memory clear isn't
optimized out, and uses `usize` pointers everywhere.
Signed-off-by: Sean Cross <sean@xobs.io>
The register set should be cleared already, however it is possible
(though remote) that register values are not cleared when a thread is
created.
Ordinarily threads are zeroed when destroyed, but this makes sure
they're zeroed upon creation as well.
Signed-off-by: Sean Cross <sean@xobs.io>
While it would be nice if we stopped the PLLs as we do on hardware,
Renode does not yet have the ability to issue the `wfi` instruction from
a peripheral write.
As such, directly call `wfi()` on Renode similar to how Cramium
operates.
Signed-off-by: Sean Cross <sean@xobs.io>
using the DUART means we don't get console input on the kernel
(because the DUART is incapable of this) but it's a decent compromise
I think because the DUART is fast and efficient, and mostly we want
it to capture kps?
Eventually we'll need an input mode but for now, this will get us
moving.
Mark `MemoryRange::as_slice()` and `MemoryRange::as_slice_mut()` as
unsafe.
This is due to the fact that not all representable types can be cast to
an arbitrary value. For example, if Process A sends random values to
Process B, then Process B casts the memory to a slice of `bool`, then
any values that are not 0 or 1 are undefined.
Because these functions can leak UB into the program, they are marked as
unsafe.
This patch adds `unsafe {}` blocks to all instances where this function
is called. Additionally, all instances have been checked to verify that
they do not cast to any invalid types -- most use `u8` or `u32`.
Additionally, the long-deprecated `MemoryRange::from_parts()` call was
removed, since that causes UB without being marked as unsafe.
Signed-off-by: Sean Cross <sean@xobs.io>
With Rust 1.71.0, mut detection has changed slightly, and it is more
aggressive about warning when things do not need to be mutable.
Remove these from the `services` file.
Signed-off-by: Sean Cross <sean@xobs.io>
SUpport debugging when interrupt handlers go awry, such as when they
blow out their own stack.
Do this by creating a dummy sentinal of 255 for interrupt handlers.
Signed-off-by: Sean Cross <sean@xobs.io>
When an interrupt handler panics, restore the system and allow it to
continue. This will help to debug IRQ handlers that panic for one reason
or another, such as infinite recursion.
Signed-off-by: Sean Cross <sean@xobs.io>
This changes the process.inner.pid to the correct PID. Before, it was
simply 1. This lead to problems, for example when sending messages
where an assert checks to make sure that the current PID and the
process PID are the same. Now, you can send messages from a new process.
- make the "base" field no longer public. It is accessible, but only
through an `unsafe` method, because, it is unsafe.
- add accessors to offest/mask fields. Because, it's not at all
unsafe to access these, and it can be useful for bit-ops that are
not part of the generic set of UTRA.
- add Arc to AtomicCSR, and require `std` for AtomicCSR types.
This should not break anything, I checked inside @foundation-devices
keyOS and they don't seem to be using AtomicCSR anywhere.
The Arc makes it a bit safer to clone the AtomicCSR base pointer
and share it between threads, but it will have an impact on performance.
The USB stack (which requires AtomicCSR) was regression testing and the
impact seems minimal.
Recall that the main purpose of AtomicCSR is to provide a CSR accessor
that does not require a mutable reference to the base object. This
can make certain Rust idioms a bit cleaner. We wrap the base accessor
in Arc+Atomic to try and improve the safety of throwing the borrow
checker under the bus, but it's still not perfect because hardware
mutable state can have side-effects within hardware itself that cannot
be modeled or checked by Rust's borrow checker.
