Use z_user_to_copy() instead of directly writing to the user provided
pointer to validate that the user has write permission to underlying
memory location.
It is important to verify the memory not only for reads, but also for
writes, as otherwise the function can be abused by usermode code to
write to privileged read/write, unprivileged read-only memory partition.
Signed-off-by: Tomasz Moń <tomasz.mon@nordicsemi.no>
Kconfig options have to be prefixed with :kconfig:option: in order to
appear as links in generated html output.
Signed-off-by: Tomasz Moń <tomasz.mon@nordicsemi.no>
The `ARCH` init level was added to solve a specific problem, call init
code (SYS_INIT/devices) before `z_cstart` in the `intel_adsp` platform.
The documentation claims it runs before `z_cstart`, but this is only
true if the SoC/arch takes care of calling:
```c
z_sys_init_run_level(_SYS_INIT_LEVEL_ARCH);
```
Which is only true for `intel_adsp` nowadays. So in practice, we now
have a platform specific init level. This patch proposes to do things in
a slightly different way. First, level name is renamed to `EARLY`, to
emphasize it runs in the early stage of the boot process. Then, it is
handled by the Kernel (inside `z_cstart()` before calling
`arch_kernel_init()`). This means that any platform can now use this
level. For `intel_adsp`, there should be no changes, other than
`gcov_static_init()` will be called before (I assume this will allow to
obtain coverage for code called in EARLY?).
Signed-off-by: Gerard Marull-Paretas <gerard.marull@nordicsemi.no>
document new initialization level ARCH, used to init drivers/services
very early in the ARCH code and before z_cstart().
Signed-off-by: Anas Nashif <anas.nashif@intel.com>
If a semaphore is contested, it is possible that the semaphore will no
longer be available when k_sem_take() is called, not k_sem_give().
Fix few typos and explicitly mention poll events instead of "they".
Signed-off-by: Tomasz Moń <tomasz.mon@nordicsemi.no>
The commit c844bd87b3 removed the support
for passing a memory block (allocated in a memory pool) as message
data, but did not update the relevant documentation.
This commit removes any references to the memory block support, which
was removed in the v2.5.0 release, in the mailbox API documentation.
Signed-off-by: Stephanos Ioannidis <stephanos.ioannidis@nordicsemi.no>
Currently, to compute the 'item' size in a ring buffer, we have
`SIZE32_OF`.
Several issues with this:
- `SIZE32_OF` only works on variables, not types, due to an extra
parenthesis pair. Indeed, `sizeof((int))` is not valid C, whereas
`sizeof((my_var))` is.
- `SIZE32_OF` is not a proper public API
- `SIZE32_OF` rounds down if the argument size is not a multiple
of 4 bytes.
Thus, we introduce a proper `RING_BUF_ITEM_SIZEOF`, fixing the
aforementioned issues.
Signed-off-by: Henri Xavier <datacomos@huawei.com>
The pipes implementation has been updated to allow ISRs to both
send and receive data to/from pipes provided the K_NO_WAIT timeout
option is used.
Signed-off-by: Peter Mitsis <peter.mitsis@intel.com>
Updates the priority inheritance description to better explain what
happens during priority inheritance and warn of the consequences of
not following best-practices.
Signed-off-by: Peter Mitsis <peter.mitsis@intel.com>
Move scripts needed by the build system and not designed to be run
individually or standalone into the build subfolder.
Signed-off-by: Anas Nashif <anas.nashif@intel.com>
Move scripts needed by the build system and not designed to be run
individually or standalone into the build subfolder.
Signed-off-by: Anas Nashif <anas.nashif@intel.com>
Currently the device MMIO APIs is only able to map single DT-defined
regions and also the _NAMED variant is assuming that each DT-defined
device has only one single region to map.
This is a limitation and a problem when in the DT are defined devices
with multiple regions that need to be mapped.
This patch is trying to overcome this limitation by introducing the
DEVICE_MMIO_NAMED_ROM_INIT_BY_NAME macro that leveraged the 'reg-names'
DT property to map multiple regions defined by a single device.
So for example in the DT we can have a device like:
driver@c4000000 {
reg = <0xc4000000 0x1000>, <0xc4001000 0x1000>;
reg-names = "region0", "region1";
};
and then we can use DEVICE_MMIO_NAMED_ROM_INIT_BY_NAME doing:
struct driver_config config = {
DEVICE_MMIO_NAMED_ROM_INIT_BY_NAME(region0, DT_DRV_INST(0)),
DEVICE_MMIO_NAMED_ROM_INIT_BY_NAME(region1, DT_DRV_INST(0)),
};
Signed-off-by: Carlo Caione <ccaione@baylibre.com>
This commit adds the sections describing how the dynamic memory
management is handled to the C language support and standard library
documentations.
Signed-off-by: Stephanos Ioannidis <root@stephanos.io>
The kernel documentation listed the memory management API pages under
two different sections: 'Kernel/Kernel Services' and
'Kernel/Memory Management' -- this creates unnecessary confusion and
makes it hard to look up all supported kernel memory management APIs.
This commit relocates the memory management API pages under
'Kernel/Kernel Services' to 'Kernel/Memory Management' so that all
memory management APIs provided by the kernel are described in one
unified section.
The link to the 'Kernel/Memory Management' index page is still left in
the 'Kernel Services' page because it may still be helpful to look at
it as part of the services provided by the Zephyr kernel -- it is just
more substantial than the rest and deserves more visibility.
Signed-off-by: Stephanos Ioannidis <root@stephanos.io>
This commit adds the 'Language Support' sub-category under the
'Developing with Zephyr' category with programming language support-
related documentations.
The contents of the 'C standard library' page have been relocated to
the 'C Language Support' page, and the contents of the 'C++ Support for
Applications' page have been relocated to the 'C++ Language Support'
page.
Signed-off-by: Stephanos Ioannidis <root@stephanos.io>
This commit adds a dedicated page for the Zephyr SDK under the
'Toolchains' sub-category under 'Developing with Zephyr'.
The content of this page is based on the Zephyr SDK installation
instruction from the 'Getting Started Guide'.
Signed-off-by: Stephanos Ioannidis <root@stephanos.io>
Moves the 'Flushing a Pipe' code example to the correct location
and section and re-adds the 'Suggested Uses' text missing
compared to v2.7.
Signed-off-by: Archie Atkinson <archie.atkinson@chiaro.co.uk>
At some recent point, directory <zephyr-root>/include was moved to
<zephyr-root>/include/zephyr. However, links from documentation to
Zephyr source on Github were not updated. Update them now.
Signed-off-by: Aleksandar Markovic <aleksandar.markovic.sa@gmail.com>
Updates the threads documentation to clarify the distinction between
ready and running states.
Fixes 44255
Signed-off-by: Peter Mitsis <peter.mitsis@intel.com>
Move this section under the kernel and alongside other core and low
level features that are tied to the kernel.
Signed-off-by: Anas Nashif <anas.nashif@intel.com>
Move this section under the kernel and alongside other core and low
level features that are tied to the kernel.
Signed-off-by: Anas Nashif <anas.nashif@intel.com>
Move this section under the kernel and alongside other core and low
level features that are tied to the kernel.
Signed-off-by: Anas Nashif <anas.nashif@intel.com>
Move this section under the kernel and alongside other core and low
level features that are tied to the kernel.
Signed-off-by: Anas Nashif <anas.nashif@intel.com>
Move this section under the kernel and alongside other core and low
level features that are tied to the kernel.
Signed-off-by: Anas Nashif <anas.nashif@intel.com>
Move this section under the kernel and alongside other core and low
level features that are tied to the kernel.
Signed-off-by: Anas Nashif <anas.nashif@intel.com>
Move the kernel documentation up and make it a main chapter. Right now
it is hidden very low in the structure under references.
Signed-off-by: Anas Nashif <anas.nashif@intel.com>
Move guides and APIs into separate directories and cleanup naming
introducing index files rather than named section files.
Signed-off-by: Anas Nashif <anas.nashif@intel.com>
There are no longer per-partition initialization functions.
Instead, we iterate over all of them at boot to set up the
derived k_mem_partitions properly.
Some ARC-specific hacks that should never have been applied
have been removed from the userspace test.
Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
The public APIs for application shared memory are now
properly documented and conform to zephyr naming
conventions.
Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
The app shared memory macros for declaring domains provide
no value, despite the stated intentions.
Just declare memory domains using the standard APIs for it.
To support this, symbols declared for app shared memory
partitions now are struct k_mem_partition, which can be
passed to the k_mem_domain APIs as normal, instead of the
app_region structs which are of no interest to the end
user.
Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
Instead of having kernel APIs documentated in a separate page, move the
API references to the object pages and have everything in one place.
Remove the intermediate category page and list all section under the
kernel directly.
Signed-off-by: Anas Nashif <anas.nashif@intel.com>
Put the kernel overview at the top level of the kernel documentation and
make it visible immediatly when browsing the kernel docs.
Signed-off-by: Anas Nashif <anas.nashif@intel.com>
There is an effort underway to make most of the Zephyr build script's
reentrant. Meaning, the build scripts can be executed multiple times
during the same CMake invocation.
Reentrancy enables several use-cases, the motivating one is the
ability to build several Zephyr executables, or images, for instance a
bootloader and an application.
For build scripts to be reentrant they cannot be directly referencing
global variables, like target names, but must instead reference
variables, which can vary from entry to entry.
Therefore, in this patch, we replace global targets with variables.
Signed-off-by: Sebastian Bøe <sebastian.boe@nordicsemi.no>
With the new theme we are able to have more section in the top level.
Move things around and expose the most important sections in the top
table of content.
Signed-off-by: Anas Nashif <anas.nashif@intel.com>
In general driver system calls are implemented at a subsystem
layer. However, some drivers may have capabilities specific to
the hardware not covered by the subsystem API. Such drivers may
want to define their own system calls.
This macro makes it simple to validate in the driver-specific
system call handlers that not only does the untrusted device
pointer correspond to the expected subsystem, initialization
state, and caller permissions, but also that the device object
is an instance of a specific driver (and not just any driver in
that subsystem).
Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
Update interrupts.rst with information on how to use dynamic
interrupts. As they are used in the same way as IRQ_CONNECT(),
not much needs to be written.
Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
Application shared memory API uses 'appmem_' prefix for
its functions and macros. This commit updates the respective
documentation to align with the API convention.
Signed-off-by: Ioannis Glaropoulos <Ioannis.Glaropoulos@nordicsemi.no>
k_poll_signal was being used by both, struct and function. Besides
this being extremely error prone it is also a MISRA-C violation.
Changing the function to contain a verb, since it performs an action
and the struct will be a noun. This pattern must be formalized and
followed and across the project.
MISRA-C rules 5.7 and 5.9
Signed-off-by: Flavio Ceolin <flavio.ceolin@intel.com>
The phrase "object must have _k_object_init() on it at some point"
visibly misses "called".
Signed-off-by: Paul Sokolovsky <paul.sokolovsky@linaro.org>
Fixing a few minor typo fixes in kernel/mem_domain.c
and the respective documentation section.
Signed-off-by: Ioannis Glaropoulos <Ioannis.Glaropoulos@nordicsemi.no>
Extended ring buffer to allow storing raw bytes in it. API has been
extended keeping 'data item' mode untouched.
Signed-off-by: Krzysztof Chruscinski <krzysztof.chruscinski@nordicsemi.no>
Deprecate API prefixed with sys_ring_buf_ and rename it
to ring_buf_item_ since this API is not a typical ring buffer
but ring buffer of data items (metadata + 32bit words).
Signed-off-by: Krzysztof Chruscinski <krzysztof.chruscinski@nordicsemi.no>
Make the multi-level interrupts diagram more clear by saying:
- the "-" means an interrupt slot
- all interrupt slots are numbered from 0 starting from right most
- alphabets denote devices
- add an example chain for device D
Signed-off-by: Yasushi SHOJI <y-shoji@ispace-inc.com>
Summary: revised attempt at addressing issue 6290. The
following provides an alternative to using
CONFIG_APPLICATION_MEMORY by compartmentalizing data into
Memory Domains. Dependent on MPU limitations, supports
compartmentalized Memory Domains for 1...N logical
applications. This is considered an initial attempt at
designing flexible compartmentalized Memory Domains for
multiple logical applications and, with the provided python
script and edited CMakeLists.txt, provides support for power
of 2 aligned MPU architectures.
Overview: The current patch uses qualifiers to group data into
subsections. The qualifier usage allows for dynamic subsection
creation and affords the developer a large amount of flexibility
in the grouping, naming, and size of the resulting partitions and
domains that are built on these subsections. By additional macro
calls, functions are created that help calculate the size,
address, and permissions for the subsections and enable the
developer to control application data in specified partitions and
memory domains.
Background: Initial attempts focused on creating a single
section in the linker script that then contained internally
grouped variables/data to allow MPU/MMU alignment and protection.
This did not provide additional functionality beyond
CONFIG_APPLICATION_MEMORY as we were unable to reliably group
data or determine their grouping via exported linker symbols.
Thus, the resulting decision was made to dynamically create
subsections using the current qualifier method. An attempt to
group the data by object file was tested, but found that this
broke applications such as ztest where two object files are
created: ztest and main. This also creates an issue of grouping
the two object files together in the same memory domain while
also allowing for compartmenting other data among threads.
Because it is not possible to know a) the name of the partition
and thus the symbol in the linker, b) the size of all the data
in the subsection, nor c) the overall number of partitions
created by the developer, it was not feasible to align the
subsections at compile time without using dynamically generated
linker script for MPU architectures requiring power of 2
alignment.
In order to provide support for MPU architectures that require a
power of 2 alignment, a python script is run at build prior to
when linker_priv_stacks.cmd is generated. This script scans the
built object files for all possible partitions and the names given
to them. It then generates a linker file (app_smem.ld) that is
included in the main linker.ld file. This app_smem.ld allows the
compiler and linker to then create each subsection and align to
the next power of 2.
Usage:
- Requires: app_memory/app_memdomain.h .
- _app_dmem(id) marks a variable to be placed into a data
section for memory partition id.
- _app_bmem(id) marks a variable to be placed into a bss
section for memory partition id.
- These are seen in the linker.map as "data_smem_id" and
"data_smem_idb".
- To create a k_mem_partition, call the macro
app_mem_partition(part0) where "part0" is the name then used to
refer to that partition. This macro only creates a function and
necessary data structures for the later "initialization".
- To create a memory domain for the partition, the macro
app_mem_domain(dom0) is called where "dom0" is the name then
used for the memory domain.
- To initialize the partition (effectively adding the partition
to a linked list), init_part_part0() is called. This is followed
by init_app_memory(), which walks all partitions in the linked
list and calculates the sizes for each partition.
- Once the partition is initialized, the domain can be
initialized with init_domain_dom0(part0) which initializes the
domain with partition part0.
- After the domain has been initialized, the current thread
can be added using add_thread_dom0(k_current_get()).
- The code used in ztests ans kernel/init has been added under
a conditional #ifdef to isolate the code from other tests.
The userspace test CMakeLists.txt file has commands to insert
the CONFIG_APP_SHARED_MEM definition into the required build
targets.
Example:
/* create partition at top of file outside functions */
app_mem_partition(part0);
/* create domain */
app_mem_domain(dom0);
_app_dmem(dom0) int var1;
_app_bmem(dom0) static volatile int var2;
int main()
{
init_part_part0();
init_app_memory();
init_domain_dom0(part0);
add_thread_dom0(k_current_get());
...
}
- If multiple partitions are being created, a variadic
preprocessor macro can be used as provided in
app_macro_support.h:
FOR_EACH(app_mem_partition, part0, part1, part2);
or, for multiple domains, similarly:
FOR_EACH(app_mem_domain, dom0, dom1);
Similarly, the init_part_* can also be used in the macro:
FOR_EACH(init_part, part0, part1, part2);
Testing:
- This has been successfully tested on qemu_x86 and the
ARM frdm_k64f board. It compiles and builds power of 2
aligned subsections for the linker script on the 96b_carbon
boards. These power of 2 alignments have been checked by
hand and are viewable in the zephyr.map file that is
produced during build. However, due to a shortage of
available MPU regions on the 96b_carbon board, we are unable
to test this.
- When run on the 96b_carbon board, the test suite will
enter execution, but each individaul test will fail due to
an MPU FAULT. This is expected as the required number of
MPU regions exceeds the number allowed due to the static
allocation. As the MPU driver does not detect this issue,
the fault occurs because the data being accessed has been
placed outside the active MPU region.
- This now compiles successfully for the ARC boards
em_starterkit_em7d and em_starterkit_em7d_v22. However,
as we lack ARC hardware to run this build on, we are unable
to test this build.
Current known issues:
1) While the script and edited CMakeLists.txt creates the
ability to align to the next power of 2, this does not
address the shortage of available MPU regions on certain
devices (e.g. 96b_carbon). In testing the APB and PPB
regions were commented out.
2) checkpatch.pl lists several issues regarding the
following:
a) Complex macros. The FOR_EACH macros as defined in
app_macro_support.h are listed as complex macros needing
parentheses. Adding parentheses breaks their
functionality, and we have otherwise been unable to
resolve the reported error.
b) __aligned() preferred. The _app_dmem_pad() and
_app_bmem_pad() macros give warnings that __aligned()
is preferred. Prior iterations had this implementation,
which resulted in errors due to "complex macros".
c) Trailing semicolon. The macro init_part(name) has
a trailing semicolon as the semicolon is needed for the
inlined macro call that is generated when this macro
expands.
Update: updated to alternative CONFIG_APPLCATION_MEMORY.
Added config option CONFIG_APP_SHARED_MEM to enable a new section
app_smem to contain the shared memory component. This commit
seperates the Kconfig definition from the definition used for the
conditional code. The change is in response to changes in the
way the build system treats definitions. The python script used
to generate a linker script for app_smem was also midified to
simplify the alignment directives. A default linker script
app_smem.ld was added to remove the conditional includes dependency
on CONFIG_APP_SHARED_MEM. By addining the default linker script
the prebuild stages link properly prior to the python script running
Signed-off-by: Joshua Domagalski <jedomag@tycho.nsa.gov>
Signed-off-by: Shawn Mosley <smmosle@tycho.nsa.gov>
This patch adds a set of priorities at the (numerically) lowest end of
the range which have "meta-irq" behavior. Runnable threads at these
priorities will always be scheduled before threads at lower
priorities, EVEN IF those threads are otherwise cooperative and/or
have taken a scheduler lock.
Making such a thread runnable in any way thus has the effect of
"interrupting" the current task and running the meta-irq thread
synchronously, like an exception or system call. The intent is to use
these priorities to implement "interrupt bottom half" or "tasklet"
behavior, allowing driver subsystems to return from interrupt context
but be guaranteed that user code will not be executed (on the current
CPU) until the remaining work is finished.
As this breaks the "promise" of non-preemptibility granted by the
current API for cooperative threads, this tool probably shouldn't be
used from application code.
Signed-off-by: Andy Ross <andrew.j.ross@intel.com>
User mode may now use queue objects. Instead of embedding the kernel's
linked list information directly in the data item, a container struct
is allocated from the caller's resource pool which is then added to
the queue. The new sflist type is now used to store a flag indicating
whether a data item needs to be freed when removed from the queue.
FIFO/LIFOs are derived from k_queues and have had allocator functions
added.
Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
Similar to what has been done with pipes and message queues,
user mode can't be trusted to provide a buffer for the kernel
to use. Remove k_stack_init() as a syscall and offer
k_stack_alloc_init() which allocates a buffer from the caller's
resource pool.
Fixes#7285
Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
Dynamic kernel objects no longer is hard-coded to use the kernel
heap. Instead, objects will now be drawn from the calling thread's
resource pool.
Since we now have a reference counting mechanism, if an object
loses all its references and it was dynamically allocated, it will
be automatically freed.
A parallel dlist is added for efficient iteration over the set of
all dynamic objects, allowing deletion during iteration.
Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
Some kernel APIs may need to allocate memory in order to function
correctly, especially if they are exposed to userspace where
buffers provided by user code cannot be trusted.
Instead of simply drawing from the system heap, specific pools
may instead be assigned to threads, and any requests made on
behalf of the calling thread will draw heap memory from that pool.
Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
Forthcoming patches will dual-purpose an object's permission
bitfield as also reference tracking for kernel objects, used to
handle automatic freeing of resources.
We do not want to allow user thread A to revoke thread B's access
to some object O if B is in the middle of an API call using O.
However we do want to allow threads to revoke their own access to
an object, so introduce a new API and syscall for that.
Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
This works like k_malloc() but allows the user to designate
a specific memory pool to use instead of the kernel heap.
Test coverage provided by existing tests for k_malloc(), which is
now derived from this API.
Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
Adding a new kernel object type or driver subsystem requires changes
in various different places. This patch makes it easier to create
those devices by generating as much as possible in compile time.
No behavior change.
Signed-off-by: Leandro Pereira <leandro.pereira@intel.com>
Driver APIs might not implement all operations, making it possible for
a user thread to get the kernel to execute a function at 0x00000000.
Perform runtime checks in all the driver handlers, checking if they're
capable of performing the requested operation.
Fixes#6907.
Signed-off-by: Leandro Pereira <leandro.pereira@intel.com>
The only difference between this call and k_thread_abort() (beyond
some minor performance deltas) is that "cancel" will act as a noop in
cases where the thread has begun execution and will return an error.
"Abort" always succeeds, of course. That is inherently racy when used
as a "stop the thread" API: there's no way in general (or at all in
SMP situations) to know that you're calling this function "early
enough" to catch the thread before it starts.
Effectively, all k_thread_cancel() gives you that k_thread_abort()
doesn't is an indication about whether or not a thread has started.
There are many other ways to get that information that don't require
dangerous kernel APIs.
Deprecate this function. Zephyr's own code never used it except for
its own unit test.
Signed-off-by: Andy Ross <andrew.j.ross@intel.com>
Add the missing 'max_num_pending_alerts' argument to the
K_ALERT_DEFINE used in the "Signaling an Alert" code example.
Signed-off-by: Stig Bjørlykke <stig.bjorlykke@nordicsemi.no>
This patch adds documentation on the design and implementation of stack
objects for architectures which utilize MPU backed stack and memory
protection.
Signed-off-by: Andy Gross <andy.gross@linaro.org>
Remove thread from memory domain API (k_mem_domain_remove_thread())has
only one argument which is thread ID as per the implementation whereas
documentation says there has to be two arguments, memory domain and
thread ID.Memory domain argument is not required as a thread belongs
to single memory domain at any point in time. Also memory domain
initialisation function (k_mem_domain_init()) should accept only 3
arguments i.e, memory domain name, number of parts and array of
pointers to the memory domain, instead of 4.
Signed-off-by: Spoorthi K <spoorthi.k@intel.com>
In a scenario where a platform harbours multiple interrupts to the
extent the core cannot support it, an interrupt controller is added
as an additional level of interrupt. It typically combines several
sources of interrupt into one line that is then routed to the parent
controller.
Signed-off-by: Rajavardhan Gundi <rajavardhan.gundi@intel.com>
The expected order for heading levels in our ReST documents is # for H1,
* for H2, = for H3, and - for H4. Some documents snuck in without
following this guideline.
Signed-off-by: David B. Kinder <david.b.kinder@intel.com>
The existing docs immediately dive into the details without providing
the user with any kind of high level overview or description of the
threat model.
Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
This commit fixes
https://github.com/zephyrproject-rtos/zephyr/issues/5008.
It does so by splitting up gen_syscalls.py into two scripts with a
json metadata file to communicate syscall metadata between them. The
parsing script parses header files from include/ and writes syscall
metadata to a file if the contents changed. The generation script
reads from the json file and generates syscall code.
The build system DAG now looks like this:
always_rebuild -> json -> syscalls -> offset.o
The script for generating json will do so only if the content changes,
this ensures that the entire DAG does not always do a full rebuild.
Signed-off-by: Sebastian Bøe <sebastian.boe@nordicsemi.no>
This gives more detail on how system calls with large argument
lists, or large return value types should be handled.
Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
This initial batch of documentation describes policies and
mechanism related to kernel objects and system calls.
Some details on porting user mode to a new arch have been
provided in the architecture porting guide.
Thread documentation updated with some user mode consideration.
This is not the final documentation, more to come in subsequent
patches.
Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
doc/kernel/overview/changes.rst contains information about changes from
kernel release 1.5 ("Version 1 Kernel") to the combined "Version 2
Kernel" and doc/porting/application.rst talked about how to change
applications using Version 1 interfaces to the Version 2 interface.
This information remains in the online tagged versions of the
documentation, but it's time to remove this from the current
documentation set. (Also removing example porting code.)
Fixes issue #1524
Signed-off-by: David B. Kinder <david.b.kinder@intel.com>
Add the following application-facing memory domain APIs:
k_mem_domain_init() - to initialize a memory domain
k_mem_domain_destroy() - to destroy a memory domain
k_mem_domain_add_partition() - to add a partition into a domain
k_mem_domain_remove_partition() - to remove a partition from a domain
k_mem_domain_add_thread() - to add a thread into a domain
k_mem_domain_remove_thread() - to remove a thread from a domain
A memory domain would contain some number of memory partitions.
A memory partition is a memory region (might be RAM, peripheral
registers, flash...) with specific attributes (access permission,
e.g. privileged read/write, unprivileged read-only, execute never...).
Memory partitions would be defined by set of MPU regions or MMU tables
underneath.
A thread could only belong to a single memory domain any point in time
but a memory domain could contain multiple threads.
Threads in the same memory domain would have the same access permission
to the memory partitions belong to the memory domain.
The memory domain APIs are used by unprivileged threads to share data
to the threads in the same memory and protect sensitive data from
threads outside their domain. It is not only for improving the security
but also useful for debugging (unexpected access would cause exception).
Jira: ZEP-2281
Signed-off-by: Chunlin Han <chunlin.han@linaro.org>
fixed error introduced in application.rst (v1.8) along with a general
spelling check pass including consistent spelling of "runtime" and
hyphenated words with "pre-"
Signed-off-by: David B. Kinder <david.b.kinder@intel.com>
New top-level dts/ folder and description added.
Fixed error in bullet list in subsys/ description (needed
a blank like before the list.
Alphabetized folder list (subsys/ was listed after tests/)
Signed-off-by: David B. Kinder <david.b.kinder@intel.com>
Upcoming memory protection features will be placing some additional
constraints on kernel objects:
- They need to reside in memory owned by the kernel and not the
application
- Certain kernel object validation schemes will require some run-time
initialization of all kernel objects before they can be used.
Per Ben these initializer macros were never intended to be public. It is
not forbidden to use them, but doing so requires care: the memory being
initialized must reside in kernel space, and extra runtime
initialization steps may need to be peformed before they are fully
usable as kernel objects. In particular, kernel subsystems or drivers
whose objects are already in kernel memory may still need to use these
macros if they define kernel objects as members of a larger data
structure.
It is intended that application developers instead use the
K_<object>_DEFINE macros, which will automatically put the object in the
right memory and add them to a section which can be iterated over at
boot to complete initiailization.
There was no K_WORK_DEFINE() macro for creating struct k_work objects,
this is now added.
k_poll_event and k_poll_signal are intended to be instatiated from
application memory and have not been changed.
Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
This patch amounts to a mostly complete rewrite of the k_mem_pool
allocator, which had been the source of historical complaints vs. the
one easily available in newlib. The basic design of the allocator is
unchanged (it's still a 4-way buddy allocator), but the implementation
has made different choices throughout. Major changes:
Space efficiency: The old implementation required ~2.66 bytes per
"smallest block" in overhead, plus 16 bytes per log4 "level" of the
allocation tree, plus a global tracking struct of 32 bytes and a very
surprising 12 byte overhead (in struct k_mem_block) per active
allocation on top of the returned data pointer. This new allocator
uses a simple bit array as the only per-block storage and places the
free list into the freed blocks themselves, requiring only ~1.33 bits
per smallest block, 12 bytes per level, 32 byte globally and only 4
bytes of per-allocation bookeeping. And it puts more of the generated
tree into BSS, slightly reducing binary sizes for non-trivial pool
sizes (even as the code size itself has increased a tiny bit).
IRQ safe: atomic operations on the store have been cut down to be at
most "4 bit sets and dlist operations" (i.e. a few dozen
instructions), reducing latency significantly and allowing us to lock
against interrupts cleanly from all APIs. Allocations and frees can
be done from ISRs now without limitation (well, obviously you can't
sleep, so "timeout" must be K_NO_WAIT).
Deterministic performance: there is no more "defragmentation" step
that must be manually managed. Block coalescing is done synchronously
at free time and takes constant time (strictly log4(num_levels)), as
the detection of four free "partner bits" is just a simple shift and
mask operation.
Cleaner behavior with odd sizes. The old code assumed that the
specified maximum size would be a power of four multiple of the
minimum size, making use of non-standard buffer sizes problematic.
This implementation re-aligns the sub-blocks at each level and can
handle situations wehre alignment restrictions mean fewer than 4x will
be available. If you want precise layout control, you can still
specify the sizes rigorously. It just doesn't break if you don't.
More portable: the original implementation made use of GNU assembler
macros embedded inline within C __asm__ statements. Not all
toolchains are actually backed by a GNU assembler even when the
support the GNU assembly syntax. This is pure C, albeit with some
hairy macros to expand the compile-time-computed values.
Related changes that had to be rolled into this patch for bisectability:
* The new allocator has a firm minimum block size of 8 bytes (to store
the dlist_node_t). It will "work" with smaller requested min_size
values, but obviously makes no firm promises about layout or how
many will be available. Unfortunately many of the tests were
written with very small 4-byte minimum sizes and to assume exactly
how many they could allocate. Bump the sizes to match the allocator
minimum.
* The mbox and pipes API made use of the internals of k_mem_block and
had to be ported to the new scheme. Blocks no longer store a
backpointer to the pool that allocated them (it's an integer ID in a
bitfield) , so if you want to "nullify" them you have to use the
data pointer.
* test_mbox_api had a bug were it was prematurely freeing k_mem_blocks
that it sent through the mailbox. This worked in the old allocator
because the memory wouldn't be touched when freed, but now we stuff
list pointers in there and the bug was exposed.
* Remove test_mpool_options: the options (related to defragmentation
behavior) tested no longer exist.
Signed-off-by: Andy Ross <andrew.j.ross@intel.com>
Unline k_thread_spawn(), the struct k_thread can live anywhere and not
in the thread's stack region. This will be useful for memory protection
scenarios where private kernel structures for a thread are not
accessible by that thread, or we want to allow the thread to use all the
stack space we gave it.
This requires a change to the internal _new_thread() API as we need to
provide a separate pointer for the k_thread.
By default, we still create internal threads with the k_thread in stack
memory. Forthcoming patches will change this, but we first need to make
it easier to define k_thread memory of variable size depending on
whether we need to store coprocessor state or not.
Change-Id: I533bbcf317833ba67a771b356b6bbc6596bf60f5
Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
More general spelling fixes, and cleaning up stray UTF-8 characters
such as curly-quotes, em- and en-dashes. Use replacement strings
for |reg| and |trade|.
Signed-off-by: David B. Kinder <david.b.kinder@intel.com>
Version 1 kernel (release 1.5 and earlier) is far enough from memory now
to remove the "version 2" wording in the kernel documentation and just
call it "the kernel".
Signed-off-by: David B. Kinder <david.b.kinder@intel.com>
Convert code to use u{8,16,32,64}_t and s{8,16,32,64}_t instead of C99
integer types.
Jira: ZEP-2051
Change-Id: I731cc91517436685836023cbda34f894586a54bc
Signed-off-by: Kumar Gala <kumar.gala@linaro.org>
fix :file: reference to include/misc/ring_buffer.h
Change-Id: I0d7b32150ef66757fb6e5328c0e1b1bc6b9f3e55
Signed-off-by: David B. Kinder <david.b.kinder@intel.com>
A recent mailing list question asked for clarify about
the duration and period parameters for starting a timer.
Change-Id: I9bf8dd93dbbb9bbb94c95c2d7072f446ea1d6b01
Signed-off-by: David B. Kinder <david.b.kinder@intel.com>
Put them in order where they are most likely to be useful.
Change-Id: Ia9c358a096556a9838b2b69311e10aba3b9ca587
Signed-off-by: Benjamin Walsh <walsh.benj@gmail.com>
Promote a glossary.rst up into the doc/ folder, merge wiki
glossary entries (and remove from the wiki), and format use
the .. glossary directive to allow references by using the
:term: role (using :term:`ISR` will make a link to the
glossary entry for ISR)
Jira: ZEP-1321
Change-Id: Ie1461037ab456371604594488f01df9f21284561
Signed-off-by: David B. Kinder <david.b.kinder@intel.com>
These interrupts are for ISRs that need the lowest possible latency.
They do not take parameters and are installed directly in the interrupt
vector table.
Issue: ZEP-1038
Change-Id: I7583e9191dd32d9253ad933181d2103a6e191dea
Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
Merge build system and application primer into one and put
all in one file to make it easier to follow.
Jira: ZEP-686
Change-Id: I64ec7ef7a6aa2ad80496ca0ee3ddc3d7fe09a5d7
Signed-off-by: Anas Nashif <anas.nashif@intel.com>
The shell is not a kernel feature, it is more of a subsystem.
Change-Id: Iaba60b2086ddfe77af427d70b8fc8d06a8bebe14
Signed-off-by: Anas Nashif <anas.nashif@intel.com>
Ability to use Zephyr shell by multiple modules simultaneously, each
module for its own usage.
Old shell implementation enabled the user to call only one module
commands, not all of the modules simultaneously.
Change-Id: I0ef8fa2fd190b7490c44fe91d1016363258302c9
Signed-off-by: Yael Avramovich <yael.avramovich@intel.com>
Signed-off-by: Anas Nashif <anas.nashif@intel.com>
Documentation is using an incorrect name for the macro available to
allocate memory maps.
Change-Id: Ic2a93d3851219cb91f3c9c01e2aa19e38913abdd
Signed-off-by: Rohit Grover <rohit.grover@arm.com>
Replaced the term "platform" with "board" or "SoC" depending
on context as per, ZEP-534.
Change-Id: I14c13d4eed429fe6e41e2221d6ff6afe97e942eb
Signed-off-by: Evan Couzens <evanx.couzens@intel.com>
The x86 architecture is no longer the only one that supports hardware
floating point operations.
Change-Id: Ib23e032f00661bab87a20872651b284580b8e7e5
Signed-off-by: Peter Mitsis <peter.mitsis@windriver.com>
This line was missed when the task IRQ APIs were deprecated
by commit a83f895dd5.
Change-Id: I0135eebb2f7bd0991364fdaab8a0a1fd6981d50d
Signed-off-by: Allan Stephens <allan.stephens@windriver.com>
Incorporates the brief discussion of device driver support into
the Device Drivers document, so that the driver material is all
in one place. (Also converts a few unprintable characters in the
latter document to spaces, since they appear to have been used
by accident.)
Removes the empty discussion of networking support, to avoid
duplicating stuff already covered in the Networking document.
Change-Id: Ia5b8a92ade72a0634ee142afb45928016442d7dd
Signed-off-by: Allan Stephens <allan.stephens@windriver.com>
Relocates material that outlines the structure of a Zephyr application
so that it appears at the beginning of the "Application Development
Primer". (i.e. The primer now tells the reader the file structure of
an application, then explains how to create these files.)
Revises the description of the MDEF file to make it a bulleted item
(like the other file types are) and improve readability.
Change-Id: I9f003b8317257c927bea752da55cc434f957592c
Signed-off-by: Allan Stephens <allan.stephens@windriver.com>
Relocates material that describes the most fundamental terms used
in Zephyr documentation so that it appears in the "Introducing Zephyr"
document. (i.e. Ensures that the terms are defined before they are
used in the "Getting Started Guide" that follows.)
Transforms the material into a definition list to make it easier
for readers to locate and understand the mateial. Revises the text
to give it a consistent look-and-feel.
Change-Id: I0187d99b1bdac37397a4c907d57bc1f24d7698e7
Signed-off-by: Allan Stephens <allan.stephens@windriver.com>
Per:
commit a83f895
Author: Andrew Boie <andrew.p.boie@intel.com>
Commit: Benjamin Walsh <benjamin.walsh@windriver.com>
microkernel: deprecate task IRQs
This mechanism does not add enough value to the kernel to be worth
maintaining it. Drivers that need deferred processing of interrupts
can simply define their own task and have the interrupt handler
release an event that the task waits on.
The API is marked as deprecated and it is removed from unit test
coverage as well as the documentation.
Change-Id: Ib87b91cb41e9b6d7fdf0dc62b240a531b6a8889f
Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
Change-Id: I0d891772b1fb4246ec9ee9f4764b2121333ae972
Signed-off-by: Inaky Perez-Gonzalez <inaky.perez-gonzalez@intel.com>
Original link "fiber services" does not exist, so renamed to the one
at the head of "nanokernel_fibers.rst".
Change-Id: I39c89e5dbe9b8d0462eb2aa8d84db65b22625fdc
Signed-off-by: Inaky Perez-Gonzalez <inaky.perez-gonzalez@intel.com>
Must use :c:type instead of :cpp:type.
Change-Id: I600c7a018e1b1492e967b05f44fec14afd87eccc
Signed-off-by: Inaky Perez-Gonzalez <inaky.perez-gonzalez@intel.com>
:c:option:`xyz` is non usable without a . c:option:: declaration, so moved
to *xyz`; likewise :option:`xyz` where no .. option:: xyz is declared.
Change-Id: I011ccf2aac244125dbe2d09d197e443bd4c12fe2
Signed-off-by: Inaky Perez-Gonzalez <inaky.perez-gonzalez@intel.com>
Move to use :option:`CONFIG_XYZ` vs :option:`XYZ` to generate propert
links and avoid warnings about unexistant targets.
Change-Id: I4b46041f25e538462b123ccc8337f733033cc0e7
Signed-off-by: Inaky Perez-Gonzalez <inaky.perez-gonzalez@intel.com>
Config options KERNEL_EVENT_{INTERRUPT, CONTEXT, SLEEP} don't exist
any more, removed.
Move to use :option:`CONFIG_XYZ` vs :option:`XYZ` to generate propert
links and avoid warnings about unexistant targets.
Change-Id: Ibafa155f474a05329a8cac7bff5c55800d9f31a4
Signed-off-by: Inaky Perez-Gonzalez <inaky.perez-gonzalez@intel.com>
Four code snippets fail to be properly recognized by the code
highlighter; the makefile snippets seem to be because of the $
character (and I have found a way to escape it out). The C code, I
haven't been able to find out why.
Killed the warning by setting the code-block style to 'none' on all of
them. It is not the best sollution, but it beats a polluted build
process.
Change-Id: I8fa7d327354a93bacad40e25596c9dbaf9ea1e92
Signed-off-by: Inaky Perez-Gonzalez <inaky.perez-gonzalez@intel.com>
