Minix/minix
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Rewrite of boot process

Browse Source 
KERNEL CHANGES:
- The kernel only knows about privileges of kernel tasks and the root system
process (now RS).
- Kernel tasks and the root system process are the only processes that are made
schedulable by the kernel at startup. All the other processes in the boot image
don't get their privileges set at startup and are inhibited from running by the
RTS_NO_PRIV flag.
- Removed the assumption on the ordering of processes in the boot image table.
System processes can now appear in any order in the boot image table.
- Privilege ids can now be assigned both statically or dynamically. The kernel
assigns static privilege ids to kernel tasks and the root system process. Each
id is directly derived from the process number.
- User processes now all share the static privilege id of the root user
process (now INIT).
- sys_privctl split: we have more calls now to let RS set privileges for system
processes. SYS_PRIV_ALLOW / SYS_PRIV_DISALLOW are only used to flip the
RTS_NO_PRIV flag and allow / disallow a process from running. SYS_PRIV_SET_SYS /
SYS_PRIV_SET_USER are used to set privileges for a system / user process.
- boot image table flags split: PROC_FULLVM is the only flag that has been
moved out of the privilege flags and is still maintained in the boot image
table. All the other privilege flags are out of the kernel now.

RS CHANGES:
- RS is the only user-space process who gets to run right after in-kernel
startup.
- RS uses the boot image table from the kernel and three additional boot image
info table (priv table, sys table, dev table) to complete the initialization
of the system.
- RS checks that the entries in the priv table match the entries in the boot
image table to make sure that every process in the boot image gets schedulable.
- RS only uses static privilege ids to set privileges for system services in
the boot image.
- RS includes basic memory management support to allocate the boot image buffer
dynamically during initialization. The buffer shall contain the executable
image of all the system services we would like to restart after a crash.
- First step towards decoupling between resource provisioning and resource
requirements in RS: RS must know what resources it needs to restart a process
and what resources it has currently available. This is useful to tradeoff
reliability and resource consumption. When required resources are missing, the
process cannot be restarted. In that case, in the future, a system flag will
tell RS what to do. For example, if CORE_PROC is set, RS should trigger a
system-wide panic because the system can no longer function correctly without
a core system process.

PM CHANGES:
- The process tree built at initialization time is changed to have INIT as root
with pid 0, RS child of INIT and all the system services children of RS. This
is required to make RS in control of all the system services.
- PM no longer registers labels for system services in the boot image. This is
now part of RS's initialization process.
This commit is contained in:
Cristiano Giuffrida
2009-12-11 00:08:19 +00:00
parent af80fd2789
commit f4574783dc
33 changed files with 1483 additions and 374 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
kernel/const.h
View File

@@ -8,9 +8,6 @@
#include "config.h"
#include "debug.h"
/* Map a process number to a privilege structure id. */
#define s_nr_to_id(n) (NR_TASKS + (n) + 1)
/* Translate a pointer to a field in a structure to a pointer to the structure
* itself. So it translates '&struct_ptr->field' back to 'struct_ptr'.
*/

83
kernel/main.c
View File

@@ -73,7 +73,8 @@ PUBLIC void main()
ktsb = (reg_t) t_stack;
for (i=0; i < NR_BOOT_PROCS; ++i) {
int ci;
int schedulable_proc, proc_nr;
int ipc_to_m, kcalls;
bitchunk_t fv;
ip = &image[i]; /* process' attributes */
@@ -84,35 +85,57 @@ PUBLIC void main()
rp->p_quantum_size = ip->quantum; /* quantum size in ticks */
rp->p_ticks_left = ip->quantum; /* current credit */
strncpy(rp->p_name, ip->proc_name, P_NAME_LEN); /* set process name */
(void) get_priv(rp, (ip->flags & SYS_PROC)); /* assign structure */
priv(rp)->s_flags = ip->flags; /* process flags */
priv(rp)->s_trap_mask = ip->trap_mask; /* allowed traps */
/* Warn about violations of the boot image table order consistency. */
if (priv_id(rp) != s_nr_to_id(ip->proc_nr) && (ip->flags & SYS_PROC))
kprintf("Warning: boot image table has wrong process order\n");
/* Initialize call mask bitmap from unordered set.
* A single SYS_ALL_CALLS is a special case - it
* means all calls are allowed.
/* See if this process is immediately schedulable.
* In that case, set its privileges now and allow it to run.
* Only kernel tasks and the root system process get to run immediately.
* All the other system processes are inhibited from running by the
* RTS_NO_PRIV flag. They can only be scheduled once the root system
* process has set their privileges.
*/
if(ip->nr_k_calls == 1 && ip->k_calls[0] == SYS_ALL_CALLS)
fv = ~0; /* fill call mask */
else
fv = 0; /* clear call mask */
proc_nr = proc_nr(rp);
schedulable_proc = (iskerneln(proc_nr) || isrootsysn(proc_nr));
if(schedulable_proc) {
/* Assign privilege structure. Force a static privilege id. */
(void) get_priv(rp, static_priv_id(proc_nr));
for(ci = 0; ci < CALL_MASK_SIZE; ci++) /* fill or clear call mask */
priv(rp)->s_k_call_mask[ci] = fv;
if(!fv) /* not all full? enter calls bit by bit */
for(ci = 0; ci < ip->nr_k_calls; ci++)
SET_BIT(priv(rp)->s_k_call_mask,
ip->k_calls[ci]-KERNEL_CALL);
/* Priviliges for kernel tasks. */
if(iskerneln(proc_nr)) {
/* Privilege flags. */
priv(rp)->s_flags = (proc_nr == IDLE ? IDL_F : TSK_F);
/* Allowed traps. */
priv(rp)->s_trap_mask = (proc_nr == CLOCK
|| proc_nr == SYSTEM ? CSK_T : TSK_T);
ipc_to_m = TSK_M; /* allowed targets */
kcalls = TSK_KC; /* allowed kernel calls */
}
/* Priviliges for the root system process. */
else if(isrootsysn(proc_nr)) {
priv(rp)->s_flags= RSYS_F; /* privilege flags */
priv(rp)->s_trap_mask= RSYS_T; /* allowed traps */
ipc_to_m = RSYS_M; /* allowed targets */
kcalls = RSYS_KC; /* allowed kernel calls */
}
for (j = 0; j < NR_SYS_PROCS && j < BITCHUNK_BITS; j++)
if (ip->ipc_to & (1 << j))
set_sendto_bit(rp, j); /* restrict targets */
/* Fill in target mask. */
for (j=0; j < NR_SYS_PROCS; j++) {
if (ipc_to_m & (1 << j))
set_sendto_bit(rp, j);
else
unset_sendto_bit(rp, j);
}
if (iskerneln(proc_nr(rp))) { /* part of the kernel? */
/* Fill in kernel call mask. */
for(j = 0; j < CALL_MASK_SIZE; j++) {
priv(rp)->s_k_call_mask[j] = (kcalls == NO_C ? 0 : (~0));
}
}
else {
/* Don't let the process run for now. */
RTS_SET(rp, RTS_NO_PRIV);
}
if (iskerneln(proc_nr)) { /* part of the kernel? */
if (ip->stksize > 0) { /* HARDWARE stack size is 0 */
rp->p_priv->s_stack_guard = (reg_t *) ktsb;
*rp->p_priv->s_stack_guard = STACK_GUARD;
@@ -121,7 +144,7 @@ PUBLIC void main()
rp->p_reg.sp = ktsb; /* this task's initial stack ptr */
hdrindex = 0; /* all use the first a.out header */
} else {
hdrindex = 1 + i-NR_TASKS; /* servers, drivers, INIT */
hdrindex = 1 + i-NR_TASKS; /* system/user processes */
}
/* Architecture-specific way to find out aout header of this
@@ -153,12 +176,12 @@ PUBLIC void main()
* access I/O; this is not allowed to less-privileged processes
*/
rp->p_reg.pc = (reg_t) ip->initial_pc;
rp->p_reg.psw = (iskernelp(rp)) ? INIT_TASK_PSW : INIT_PSW;
rp->p_reg.psw = (iskerneln(proc_nr)) ? INIT_TASK_PSW : INIT_PSW;
/* Initialize the server stack pointer. Take it down one word
* to give crtso.s something to use as "argc".
*/
if (isusern(proc_nr(rp))) { /* user-space process? */
if (isusern(proc_nr)) { /* user-space process? */
rp->p_reg.sp = (rp->p_memmap[S].mem_vir +
rp->p_memmap[S].mem_len) << CLICK_SHIFT;
rp->p_reg.sp -= sizeof(reg_t);
@@ -171,9 +194,9 @@ PUBLIC void main()
* PT up and manage it. VM will signal the kernel when it has
* done this; until then, don't let it run.
*/
if(priv(rp)->s_flags & PROC_FULLVM)
if(ip->flags & PROC_FULLVM)
RTS_SET(rp, RTS_VMINHIBIT);
/* Set ready. The HARDWARE task is never ready. */
if (rp->p_nr == HARDWARE) RTS_SET(rp, RTS_PROC_STOP);
/* IDLE task is never put on a run queue as it is never ready to run */

61
kernel/priv.h
View File

@@ -9,7 +9,8 @@
* between common and privileged process fields and is very space efficient.
*
* Changes:
* Jul 01, 2005 Created. (Jorrit N. Herder)
* Nov 22, 2009 rewrite of privilege management (Cristiano Giuffrida)
* Jul 01, 2005 Created. (Jorrit N. Herder)
*/
#include <minix/com.h>
#include "const.h"
@@ -65,9 +66,18 @@ struct priv {
/* Guard word for task stacks. */
#define STACK_GUARD ((reg_t) (sizeof(reg_t) == 2 ? 0xBEEF : 0xDEADBEEF))
/* Static privilege id definitions. */
#define NR_STATIC_PRIV_IDS NR_BOOT_PROCS
#define is_static_priv_id(id) (id >= 0 && id < NR_STATIC_PRIV_IDS)
#define static_priv_id(n) (NR_TASKS + (n))
/* Magic system structure table addresses. */
#define BEG_PRIV_ADDR (&priv[0])
#define END_PRIV_ADDR (&priv[NR_SYS_PROCS])
#define BEG_PRIV_ADDR (&priv[0])
#define END_PRIV_ADDR (&priv[NR_SYS_PROCS])
#define BEG_STATIC_PRIV_ADDR BEG_PRIV_ADDR
#define END_STATIC_PRIV_ADDR (BEG_STATIC_PRIV_ADDR + NR_STATIC_PRIV_IDS)
#define BEG_DYN_PRIV_ADDR END_STATIC_PRIV_ADDR
#define END_DYN_PRIV_ADDR END_PRIV_ADDR
#define priv_addr(i) (ppriv_addr)[(i)]
#define priv_id(rp) ((rp)->p_priv->s_id)
@@ -78,6 +88,10 @@ struct priv {
#define may_send_to(rp, nr) (get_sys_bit(priv(rp)->s_ipc_to, nr_to_id(nr)))
/* Privilege management shorthands. */
#define spi_to(n) (1 << (static_priv_id(n)))
#define unset_usr_to(m) ((m) & ~(1 << USER_PRIV_ID))
/* The system structures table and pointers to individual table slots. The
* pointers allow faster access because now a process entry can be found by
* indexing the psys_addr array, while accessing an element i requires a
@@ -86,10 +100,14 @@ struct priv {
EXTERN struct priv priv[NR_SYS_PROCS]; /* system properties table */
EXTERN struct priv *ppriv_addr[NR_SYS_PROCS]; /* direct slot pointers */
/* Unprivileged user processes all share the same privilege structure.
/* Unprivileged user processes all share the privilege structure of the
* root user process.
* This id must be fixed because it is used to check send mask entries.
*/
#define USER_PRIV_ID 0
#define USER_PRIV_ID static_priv_id(ROOT_USR_PROC_NR)
/* Specifies a null privilege id.
*/
#define NULL_PRIV_ID -1
/* Make sure the system can boot. The following sanity check verifies that
* the system privileges table is large enough for the number of processes
@@ -99,4 +117,37 @@ EXTERN struct priv *ppriv_addr[NR_SYS_PROCS]; /* direct slot pointers */
#error NR_SYS_PROCS must be larger than NR_BOOT_PROCS
#endif
/*
* Privileges masks used by the kernel.
*/
#define IDL_F (SYS_PROC | BILLABLE) /* idle task is not preemptible as we
* don't want it to interfere with the
* timer tick interrupt handler code.
* Unlike other processes idle task is
* handled in a special way and is
* preempted always if timer tick occurs
* and there is another runnable process
*/
#define TSK_F (SYS_PROC) /* other kernel tasks */
#define RSYS_F (SYS_PROC | PREEMPTIBLE) /* root system proc */
#define DEF_SYS_F (RSYS_F | DYN_PRIV_ID) /* default sys proc */
/* allowed traps */
#define CSK_T (1 << RECEIVE) /* clock and system */
#define TSK_T 0 /* other kernel tasks */
#define RSYS_T (~0) /* root system proc */
#define DEF_SYS_T RSYS_T /* default sys proc */
/* allowed targets */
#define TSK_M 0 /* all kernel tasks */
#define RSYS_M (~0) /* root system proc */
#define DEF_SYS_M unset_usr_to(RSYS_M) /* default sys proc */
/* allowed kernel calls */
#define NO_C 0 /* no calls allowed */
#define ALL_C 1 /* all calls allowed */
#define TSK_KC NO_C /* all kernel tasks */
#define RSYS_KC ALL_C /* root system proc */
#define DEF_SYS_KC RSYS_KC /* default sys proc */
#endif /* PRIV_H */

2
kernel/proc.c
View File

@@ -824,7 +824,7 @@ endpoint_t dst_e; /* which process to notify */
}
/* Destination is not ready to receive the notification. Add it to the
* bit map with pending notifications. Note the indirectness: the system id
* bit map with pending notifications. Note the indirectness: the privilege id
* instead of the process number is used in the pending bit map.
*/
src_id = priv(caller_ptr)->s_id;

2
kernel/proc.h
View File

@@ -250,6 +250,8 @@ struct proc {
#define iskerneln(n) ((n) < 0)
#define isuserp(p) isusern((p) >= BEG_USER_ADDR)
#define isusern(n) ((n) >= 0)
#define isrootsysp(p) isrootsysn((p)->p_nr)
#define isrootsysn(n) ((n) == ROOT_SYS_PROC_NR)
#ifndef __ASSEMBLY__

65
kernel/system.c
View File

@@ -22,6 +22,7 @@
* clear_endpoint: remove a process' ability to send and receive messages
*
* Changes:
* Nov 22, 2009 get_priv supports static priv ids (Cristiano Giuffrida)
* Aug 04, 2005 check if system call is allowed (Jorrit N. Herder)
* Jul 20, 2005 send signal to services with message (Jorrit N. Herder)
* Jan 15, 2005 new, generalized virtual copy function (Jorrit N. Herder)
@@ -238,32 +239,36 @@ PRIVATE void initialize(void)
/*===========================================================================*
* get_priv *
*===========================================================================*/
PUBLIC int get_priv(rc, proc_type)
PUBLIC int get_priv(rc, priv_id)
register struct proc *rc; /* new (child) process pointer */
int proc_type; /* system or user process flag */
int priv_id; /* privilege id */
{
/* Get a privilege structure. All user processes share the same privilege
* structure. System processes get their own privilege structure.
/* Allocate a new privilege structure for a system process. Privilege ids
* can be assigned either statically or dynamically.
*/
register struct priv *sp; /* privilege structure */
register struct priv *sp; /* privilege structure */
if (proc_type == SYS_PROC) { /* find a new slot */
for (sp = BEG_PRIV_ADDR; sp < END_PRIV_ADDR; ++sp)
if (sp->s_proc_nr == NONE && sp->s_id != USER_PRIV_ID) break;
if (sp >= END_PRIV_ADDR) return(ENOSPC);
rc->p_priv = sp; /* assign new slot */
rc->p_priv->s_proc_nr = proc_nr(rc); /* set association */
rc->p_priv->s_flags = SYS_PROC; /* mark as privileged */
/* Clear some fields */
sp->s_asyntab= -1;
sp->s_asynsize= 0;
} else {
rc->p_priv = &priv[USER_PRIV_ID]; /* use shared slot */
rc->p_priv->s_proc_nr = INIT_PROC_NR; /* set association */
/* s_flags of this shared structure are to be once at system startup. */
if(priv_id == NULL_PRIV_ID) { /* allocate slot dynamically */
for (sp = BEG_DYN_PRIV_ADDR; sp < END_DYN_PRIV_ADDR; ++sp)
if (sp->s_proc_nr == NONE) break;
if (sp >= END_DYN_PRIV_ADDR) return(ENOSPC);
}
else { /* allocate slot from id */
if(!is_static_priv_id(priv_id)) {
return EINVAL; /* invalid static priv id */
}
if(priv[priv_id].s_proc_nr != NONE) {
return EBUSY; /* slot already in use */
}
sp = &priv[priv_id];
}
rc->p_priv = sp; /* assign new slot */
rc->p_priv->s_proc_nr = proc_nr(rc); /* set association */
/* Clear some fields */
sp->s_asyntab= -1;
sp->s_asynsize= 0;
return(OK);
}
@@ -275,22 +280,24 @@ PUBLIC void set_sendto_bit(struct proc *rp, int id)
/* Allow a process to send messages to the process(es) associated with the
* system privilege structure with the given ID.
*/
struct proc *rrp; /* receiver process */
/* Disallow the process from sending to a system privilege structure with no
/* Disallow the process from sending to a process privilege structure with no
* associated process, and disallow the process from sending to itself.
*/
if (id_to_nr(id) == NONE || priv_id(rp) == id)
if (id_to_nr(id) == NONE || priv_id(rp) == id) {
unset_sys_bit(priv(rp)->s_ipc_to, id);
return;
}
set_sys_bit(priv(rp)->s_ipc_to, id);
/* The process that this process can now send to, must be able to reply.
* Therefore, its send mask should be updated as well.
/* The process that this process can now send to, must be able to reply (or
* vice versa). Therefore, its send mask should be updated as well. Ignore
* receivers that don't support traps other than RECEIVE, they can't reply
* or send messages anyway.
*/
rrp = proc_addr(id_to_nr(id));
if (!iskernelp(rrp))
set_sys_bit(priv(rrp)->s_ipc_to, priv_id(rp));
if (priv_addr(id)->s_trap_mask & ~((1 << RECEIVE)))
set_sys_bit(priv_addr(id)->s_ipc_to, priv_id(rp));
}
/*===========================================================================*

31
kernel/system/do_getinfo.c
View File

@@ -10,6 +10,7 @@
*/
#include <string.h>
#include <minix/endpoint.h>
#include "../system.h"
#include "../vm.h"
@@ -31,6 +32,7 @@ register message *m_ptr; /* pointer to request message */
int proc_nr, nr_e, nr, r;
struct proc *caller;
int wipe_rnd_bin = -1;
struct exec e_hdr;
caller = proc_addr(who_p);
@@ -84,6 +86,14 @@ register message *m_ptr; /* pointer to request message */
src_vir = (vir_bytes) proc_addr(nr);
break;
}
case GET_PRIV: {
nr_e = (m_ptr->I_VAL_LEN2_E == SELF) ?
who_e : m_ptr->I_VAL_LEN2_E;
if(!isokendpt(nr_e, &nr)) return EINVAL; /* validate request */
length = sizeof(struct priv);
src_vir = (vir_bytes) priv_addr(nr_to_id(nr));
break;
}
case GET_WHOAMI: {
int len;
/* GET_WHOAMI uses m3 and only uses the message contents for info. */
@@ -146,11 +156,6 @@ register message *m_ptr; /* pointer to request message */
src_vir = (vir_bytes) irq_actids;
break;
}
case GET_PRIVID: {
if (!isokendpt(m_ptr->I_VAL_LEN2_E, &proc_nr))
return EINVAL;
return proc_addr(proc_nr)->p_priv->s_id;
}
case GET_IDLETSC: {
#ifdef CONFIG_IDLE_TSC
length = sizeof(idle_tsc);
@@ -161,6 +166,22 @@ register message *m_ptr; /* pointer to request message */
return(EINVAL);
#endif
}
case GET_AOUTHEADER: {
int hdrindex, index = m_ptr->I_VAL_LEN2_E;
if(index < 0 || index >= NR_BOOT_PROCS) {
return EINVAL;
}
if (iskerneln(_ENDPOINT_P(image[index].endpoint))) {
hdrindex = 0;
} else {
hdrindex = 1 + index-NR_TASKS;
}
arch_get_aout_headers(hdrindex, &e_hdr);
length = sizeof(e_hdr);
src_vir = (vir_bytes) &e_hdr;
break;
}
default:
kprintf("do_getinfo: invalid request %d\n", m_ptr->I_REQUEST);
return(EINVAL);

173
kernel/system/do_privctl.c
View File

@@ -14,8 +14,6 @@
#if USE_PRIVCTL
#define FILLED_MASK (~0)
/*===========================================================================*
* do_privctl *
*===========================================================================*/
@@ -29,6 +27,7 @@ message *m_ptr; /* pointer to request message */
register struct proc *rp;
int proc_nr;
int priv_id;
int ipc_to_m, kcalls;
int i, r;
struct io_range io_range;
struct mem_range mem_range;
@@ -48,16 +47,49 @@ message *m_ptr; /* pointer to request message */
switch(m_ptr->CTL_REQUEST)
{
case SYS_PRIV_INIT:
case SYS_PRIV_ALLOW:
/* Allow process to run. Make sure its privilege structure has already
* been set.
*/
if (!RTS_ISSET(rp, RTS_NO_PRIV) || priv(rp)->s_proc_nr == NONE) {
return(EPERM);
}
RTS_LOCK_UNSET(rp, RTS_NO_PRIV);
return(OK);
case SYS_PRIV_DISALLOW:
/* Disallow process from running. */
if (RTS_ISSET(rp, RTS_NO_PRIV)) return(EPERM);
RTS_LOCK_SET(rp, RTS_NO_PRIV);
return(OK);
case SYS_PRIV_SET_SYS:
/* Set a privilege structure of a blocked system process. */
if (! RTS_ISSET(rp, RTS_NO_PRIV)) return(EPERM);
/* Check whether a static or dynamic privilege id must be allocated. */
priv_id = NULL_PRIV_ID;
if (m_ptr->CTL_ARG_PTR)
{
/* Copy privilege structure from caller */
if((r=data_copy(who_e, (vir_bytes) m_ptr->CTL_ARG_PTR,
SYSTEM, (vir_bytes) &priv, sizeof(priv))) != OK)
return r;
/* See if the caller wants to assign a static privilege id. */
if(!(priv.s_flags & DYN_PRIV_ID)) {
priv_id = priv.s_id;
}
}
/* Make sure this process has its own privileges structure. This may
* fail, since there are only a limited number of system processes.
* Then copy the privileges from the caller and restore some defaults.
* Then copy privileges from the caller and restore some defaults.
*/
if ((i=get_priv(rp, SYS_PROC)) != OK)
if ((i=get_priv(rp, priv_id)) != OK)
{
kprintf("do_privctl: out of priv structures\n");
kprintf("do_privctl: unable to allocate priv_id %d: %d\n",
priv_id, i);
return(i);
}
priv_id = priv(rp)->s_id; /* backup privilege id */
@@ -70,88 +102,109 @@ message *m_ptr; /* pointer to request message */
priv(rp)->s_int_pending = 0; /* - interrupts */
sigemptyset(&priv(rp)->s_sig_pending); /* - signals */
/* Now update the process' privileges as requested. */
rp->p_priv->s_trap_mask = FILLED_MASK;
/* Set a default send mask. */
for (i=0; i < NR_SYS_PROCS; i++) {
if (i != USER_PRIV_ID)
set_sendto_bit(rp, i);
else
unset_sendto_bit(rp, i);
/* Set defaults for privilege bitmaps. */
priv(rp)->s_flags= DEF_SYS_F; /* privilege flags */
priv(rp)->s_trap_mask= DEF_SYS_T; /* allowed traps */
ipc_to_m = DEF_SYS_M; /* allowed targets */
kcalls = DEF_SYS_KC; /* allowed kernel calls */
for(i = 0; i < CALL_MASK_SIZE; i++) {
priv(rp)->s_k_call_mask[i] = (kcalls == NO_C ? 0 : (~0));
}
/* No I/O resources, no memory resources, no IRQs, no grant table */
/* Set defaults for resources: no I/O resources, no memory resources,
* no IRQs, no grant table
*/
priv(rp)->s_nr_io_range= 0;
priv(rp)->s_nr_mem_range= 0;
priv(rp)->s_nr_irq= 0;
priv(rp)->s_grant_table= 0;
priv(rp)->s_grant_entries= 0;
/* Override defaults if the caller has supplied a privilege structure. */
if (m_ptr->CTL_ARG_PTR)
{
/* Copy privilege structure from caller */
if((r=data_copy(who_e, (vir_bytes) m_ptr->CTL_ARG_PTR,
SYSTEM, (vir_bytes) &priv, sizeof(priv))) != OK)
return r;
/* Copy the call mask */
for (i= 0; i<CALL_MASK_SIZE; i++)
priv(rp)->s_k_call_mask[i]= priv.s_k_call_mask[i];
/* Copy s_flags. */
priv(rp)->s_flags = priv.s_flags;
/* Copy IRQs */
if (priv.s_nr_irq < 0 || priv.s_nr_irq > NR_IRQ)
return EINVAL;
priv(rp)->s_nr_irq= priv.s_nr_irq;
for (i= 0; i<priv.s_nr_irq; i++)
{
priv(rp)->s_irq_tab[i]= priv.s_irq_tab[i];
if(priv.s_flags & CHECK_IRQ) {
if (priv.s_nr_irq < 0 || priv.s_nr_irq > NR_IRQ)
return EINVAL;
priv(rp)->s_nr_irq= priv.s_nr_irq;
for (i= 0; i<priv.s_nr_irq; i++)
{
priv(rp)->s_irq_tab[i]= priv.s_irq_tab[i];
#if 0
kprintf("do_privctl: adding IRQ %d for %d\n",
priv(rp)->s_irq_tab[i], rp->p_endpoint);
kprintf("do_privctl: adding IRQ %d for %d\n",
priv(rp)->s_irq_tab[i], rp->p_endpoint);
#endif
}
}
priv(rp)->s_flags |= CHECK_IRQ; /* Check requests for IRQs */
/* Copy I/O ranges */
if (priv.s_nr_io_range < 0 || priv.s_nr_io_range > NR_IO_RANGE)
return EINVAL;
priv(rp)->s_nr_io_range= priv.s_nr_io_range;
for (i= 0; i<priv.s_nr_io_range; i++)
{
priv(rp)->s_io_tab[i]= priv.s_io_tab[i];
if(priv.s_flags & CHECK_IO_PORT) {
if (priv.s_nr_io_range < 0 || priv.s_nr_io_range > NR_IO_RANGE)
return EINVAL;
priv(rp)->s_nr_io_range= priv.s_nr_io_range;
for (i= 0; i<priv.s_nr_io_range; i++)
{
priv(rp)->s_io_tab[i]= priv.s_io_tab[i];
#if 0
kprintf("do_privctl: adding I/O range [%x..%x] for %d\n",
priv(rp)->s_io_tab[i].ior_base,
priv(rp)->s_io_tab[i].ior_limit,
rp->p_endpoint);
kprintf("do_privctl: adding I/O range [%x..%x] for %d\n",
priv(rp)->s_io_tab[i].ior_base,
priv(rp)->s_io_tab[i].ior_limit,
rp->p_endpoint);
#endif
}
}
/* Check requests for IRQs */
priv(rp)->s_flags |= CHECK_IO_PORT;
/* Copy memory ranges */
if(priv.s_flags & CHECK_MEM) {
if (priv.s_nr_mem_range < 0 || priv.s_nr_mem_range > NR_MEM_RANGE)
return EINVAL;
priv(rp)->s_nr_mem_range= priv.s_nr_mem_range;
for (i= 0; i<priv.s_nr_mem_range; i++)
{
priv(rp)->s_mem_tab[i]= priv.s_mem_tab[i];
#if 0
kprintf("do_privctl: adding mem range [%x..%x] for %d\n",
priv(rp)->s_mem_tab[i].mr_base,
priv(rp)->s_mem_tab[i].mr_limit,
rp->p_endpoint);
#endif
}
}
/* Copy trap mask. */
priv(rp)->s_trap_mask = priv.s_trap_mask;
/* Copy target mask. */
memcpy(&ipc_to_m, &priv.s_ipc_to, sizeof(ipc_to_m));
/* Copy kernel call mask. */
memcpy(priv(rp)->s_k_call_mask, priv.s_k_call_mask,
sizeof(priv(rp)->s_k_call_mask));
/* Set a custom send mask. */
for (i=0; i < NR_SYS_PROCS; i++) {
if (get_sys_bit(priv.s_ipc_to, i))
set_sendto_bit(rp, i);
else
unset_sendto_bit(rp, i);
}
}
/* Done. Privileges have been set. Allow process to run again. */
RTS_LOCK_UNSET(rp, RTS_NO_PRIV);
/* Fill in target mask. */
for (i=0; i < NR_SYS_PROCS; i++) {
if (ipc_to_m & (1 << i))
set_sendto_bit(rp, i);
else
unset_sendto_bit(rp, i);
}
return(OK);
case SYS_PRIV_USER:
/* Make this process an ordinary user process. */
case SYS_PRIV_SET_USER:
/* Set a privilege structure of a blocked user process. */
if (!RTS_ISSET(rp, RTS_NO_PRIV)) return(EPERM);
if ((i=get_priv(rp, 0)) != OK) return(i);
RTS_LOCK_UNSET(rp, RTS_NO_PRIV);
/* Link the process to the privilege structure of the root user
* process all the user processes share.
*/
priv(rp) = priv_addr(USER_PRIV_ID);
return(OK);
case SYS_PRIV_ADD_IO:

101
kernel/table.c
View File

@@ -22,6 +22,7 @@
* include 'boot_image' (this file) and 'idt' and 'gdt' (protect.c).
*
* Changes:
* Nov 22, 2009 rewrite of privilege management (Cristiano Giuffrida)
* Aug 02, 2005 set privileges and minimal boot image (Jorrit N. Herder)
* Oct 17, 2004 updated above and tasktab comments (Jorrit N. Herder)
* May 01, 2004 changed struct for system image (Jorrit N. Herder)
@@ -43,97 +44,37 @@
/* Stack space for all the task stacks. Declared as (char *) to align it. */
#define TOT_STACK_SPACE (IDL_S + HRD_S + (2 * TSK_S))
PUBLIC char *t_stack[TOT_STACK_SPACE / sizeof(char *)];
/* Define flags for the various process types. */
#define IDL_F (SYS_PROC | BILLABLE) /* idle task is not preemptible as we
* don't want it to interfere with the
* timer tick interrupt handler code.
* Unlike other processes idle task is
* handled in a special way and is
* preempted always if timer tick occurs
* and there is another runnable process
*/
#define TSK_F (SYS_PROC) /* kernel tasks */
#define SRV_F (SYS_PROC | PREEMPTIBLE) /* system services */
#define VM_F (SYS_PROC) /* vm */
#define USR_F (BILLABLE | PREEMPTIBLE | PROC_FULLVM) /* user processes */
#define SVM_F (SRV_F | PROC_FULLVM) /* servers with VM */
/* Define system call traps for the various process types. These call masks
* determine what system call traps a process is allowed to make.
*/
#define TSK_T (1 << RECEIVE) /* clock and system */
#define SRV_T (~0) /* system services */
#define USR_T ((1 << SENDREC)) /* user processes */
/* Send masks determine to whom processes can send messages or notifications.
* The values here are used for the processes in the boot image. We rely on
* the boot image table itself to match the order of the process numbers, so
* that the send mask that is defined here can be interpreted properly.
* Privilege structure 0 is shared by user processes.
*/
#define s(n) (1 << (s_nr_to_id(n)))
#define SRV_M (~0)
#define SYS_M (~0)
#define USR_M (s(PM_PROC_NR) | s(FS_PROC_NR) | s(RS_PROC_NR) | s(VM_PROC_NR))
#define DRV_M (USR_M | s(SYSTEM) | s(DS_PROC_NR) | s(LOG_PROC_NR) | s(TTY_PROC_NR))
/* Define kernel calls that processes are allowed to make. This is not looking
* very nice, but we need to define the access rights on a per call basis.
* Note that the reincarnation server has all bits on, because it should
* be allowed to distribute rights to services that it starts.
*
* Calls are unordered lists, converted by the kernel to bitmasks
* once at runtime.
*/
#define FS_C SYS_KILL, SYS_VIRCOPY, SYS_SAFECOPYFROM, SYS_SAFECOPYTO, \
SYS_VIRVCOPY, SYS_UMAP, SYS_GETINFO, SYS_EXIT, SYS_TIMES, SYS_SETALARM, \
SYS_PRIVCTL, SYS_TRACE , SYS_SETGRANT, SYS_PROFBUF, SYS_SYSCTL
#define DRV_C FS_C, SYS_SEGCTL, SYS_IRQCTL, SYS_INT86, SYS_DEVIO, \
SYS_SDEVIO, SYS_VDEVIO, SYS_SETGRANT, SYS_PROFBUF, SYS_SYSCTL
PRIVATE int
fs_c[] = { FS_C },
pm_c[] = { SYS_ALL_CALLS },
rs_c[] = { SYS_ALL_CALLS },
ds_c[] = { SYS_ALL_CALLS },
vm_c[] = { SYS_ALL_CALLS },
drv_c[] = { DRV_C },
usr_c[] = { SYS_SYSCTL },
tty_c[] = { DRV_C, SYS_PHYSCOPY, SYS_ABORT, SYS_IOPENABLE,
SYS_READBIOS },
mem_c[] = { DRV_C, SYS_PHYSCOPY, SYS_PHYSVCOPY, SYS_IOPENABLE };
/* Define boot process flags. */
#define BVM_F (PROC_FULLVM) /* boot processes with VM */
/* The system image table lists all programs that are part of the boot image.
* The order of the entries here MUST agree with the order of the programs
* in the boot image and all kernel tasks must come first. Furthermore, the
* order of the entries MUST agree with their process numbers. See above.
* in the boot image and all kernel tasks must come first.
*
* Each entry provides the process number, flags, quantum size, scheduling
* queue, allowed traps, ipc mask, and a name for the process table. The
* initial program counter and stack size is also provided for kernel tasks.
* queue, and a name for the process table. The initial program counter and
* stack size is also provided for kernel tasks.
*
* Note: the quantum size must be positive in all cases!
*/
#define c(calls) calls, (sizeof(calls) / sizeof((calls)[0]))
#define no_c { 0 }, 0
PUBLIC struct boot_image image[] = {
/* process nr, pc,flags, qs, queue, stack, traps, ipcto, call, name */
{IDLE, NULL,IDL_F, 0, 0, IDL_S, 0, 0, no_c,"idle" },
{CLOCK,clock_task,TSK_F, 8, TASK_Q, TSK_S, TSK_T, 0, no_c,"clock" },
{SYSTEM, sys_task,TSK_F, 8, TASK_Q, TSK_S, TSK_T, 0, no_c,"system"},
{HARDWARE, 0,TSK_F, 8, TASK_Q, HRD_S, 0, 0, no_c,"kernel"},
{PM_PROC_NR, 0,SRV_F, 32, 4, 0, SRV_T, SRV_M, c(pm_c),"pm" },
{FS_PROC_NR, 0,SRV_F, 32, 5, 0, SRV_T, SRV_M, c(fs_c),"vfs" },
{RS_PROC_NR, 0,SVM_F, 4, 4, 0, SRV_T, SYS_M, c(rs_c),"rs" },
{MEM_PROC_NR, 0,SVM_F, 4, 3, 0, SRV_T, SYS_M,c(mem_c),"memory"},
{LOG_PROC_NR, 0,SRV_F, 4, 2, 0, SRV_T, SYS_M,c(drv_c),"log" },
{TTY_PROC_NR, 0,SVM_F, 4, 1, 0, SRV_T, SYS_M,c(tty_c),"tty" },
{DS_PROC_NR, 0,SVM_F, 4, 4, 0, SRV_T, SYS_M, c(ds_c),"ds" },
{MFS_PROC_NR, 0,SVM_F, 32, 5, 0, SRV_T, SRV_M, c(fs_c),"mfs" },
{VM_PROC_NR, 0,VM_F, 32, 2, 0, SRV_T, SRV_M, c(vm_c),"vm" },
{INIT_PROC_NR, 0,USR_F, 8, USER_Q, 0, USR_T, USR_M, c(usr_c),"init" },
/* process nr, pc, flags, qs, queue, stack, name */
{IDLE, NULL, 0, 0, 0, IDL_S, "idle" },
{CLOCK,clock_task, 0, 8, TASK_Q, TSK_S, "clock" },
{SYSTEM, sys_task, 0, 8, TASK_Q, TSK_S, "system"},
{HARDWARE, 0, 0, 8, TASK_Q, HRD_S, "kernel"},
{PM_PROC_NR, 0, 0, 32, 4, 0, "pm" },
{FS_PROC_NR, 0, 0, 32, 5, 0, "vfs" },
{RS_PROC_NR, 0, 0, 4, 4, 0, "rs" },
{MEM_PROC_NR, 0, BVM_F, 4, 3, 0, "memory"},
{LOG_PROC_NR, 0, BVM_F, 4, 2, 0, "log" },
{TTY_PROC_NR, 0, BVM_F, 4, 1, 0, "tty" },
{DS_PROC_NR, 0, BVM_F, 4, 4, 0, "ds" },
{MFS_PROC_NR, 0, BVM_F, 32, 5, 0, "mfs" },
{VM_PROC_NR, 0, 0, 32, 2, 0, "vm" },
{INIT_PROC_NR, 0, BVM_F, 8, USER_Q, 0, "init" },
};
/* Verify the size of the system image table at compile time. Also verify that

4
kernel/type.h
View File

@@ -20,10 +20,6 @@ struct boot_image {
unsigned char quantum; /* quantum (tick count) */
int priority; /* scheduling priority */
int stksize; /* stack size for tasks */
short trap_mask; /* allowed system call traps */
bitchunk_t ipc_to; /* send mask protection */
int *k_calls; /* kern. call protection */
int nr_k_calls;
char proc_name[P_NAME_LEN]; /* name in process table */
endpoint_t endpoint; /* endpoint number when started */
};