Daniel Samson
afbf10f7fc
Add a `system_spawn(name)` system call: the kernel loads a binary bundled in the initial-ramdisk, by name, as a fresh ring-3 process. It's the mechanism a user-space supervisor needs — discovery and policy stay in user space, the kernel only spawns. The kernel already holds the initial-ramdisk image from the boot handoff; it now stashes it (process.setInitialRamdisk) so the handler can resolve names, bounds-checks the name into the user half like debug_write, and returns -1 for an unknown name or a load failure. Ungated for now (any process may spawn any bundled binary); a spawn capability belongs here once the model grows one. The device manager stops logging "would spawn it" and calls runtime.system.spawn on its matched driver. On QEMU it discovers the HPET, matches `hpet`, and spawns it — and the driver comes all the way up (claims the timer, maps its MMIO, binds and services its IRQ, prints "hpet: ok"). The device-manager test now keys on that final marker: since only the manager is spawned, `hpet: ok` appearing proves the whole discover -> match -> system_spawn -> driver-up chain end to end. Transitional: the kernel still auto-spawns the whole initial-ramdisk at boot, so a real boot briefly double-spawns hpet (the second claim fails harmlessly). Increment 3 removes that redundancy so the manager is the sole owner of driver spawning. Suite 36/36 plus host tests.
61 lines
2.3 KiB
Zig
61 lines
2.3 KiB
Zig
//! Typed system_call surface for user space — thin wrappers over the raw `system_call`
|
|
//! stubs, one per kernel call. Numbers come from `abi.SystemCall`, the single
|
|
//! source of truth shared with the kernel dispatcher.
|
|
|
|
const abi = @import("abi");
|
|
const sc = @import("system-call.zig");
|
|
|
|
/// `mmap` protection flags (matching the usual C bit values). Grants are always
|
|
/// readable+writable today; the kernel does not yet honour finer prot.
|
|
pub const PROT_READ: usize = abi.prot_read;
|
|
pub const PROT_WRITE: usize = abi.prot_write;
|
|
pub const PROT_EXEC: usize = abi.prot_exec;
|
|
|
|
/// Give up the rest of this quantum.
|
|
pub fn yield() void {
|
|
_ = sc.systemCall0(.yield);
|
|
}
|
|
|
|
/// Write raw bytes to the kernel log (a bring-up diagnostic; real output goes
|
|
/// through the console/VFS later). Returns the byte count, or a wrapped -1.
|
|
pub fn write(message: []const u8) usize {
|
|
return sc.systemCall2(.debug_write, @intFromPtr(message.ptr), message.len);
|
|
}
|
|
|
|
/// Block the caller for `ms` milliseconds.
|
|
pub fn sleep(ms: usize) void {
|
|
_ = sc.systemCall1(.sleep, ms);
|
|
}
|
|
|
|
/// End the process. Never returns.
|
|
pub fn exit(code: usize) noreturn {
|
|
_ = sc.systemCall1(.exit, code);
|
|
unreachable; // the kernel never returns from exit
|
|
}
|
|
|
|
/// Start the binary bundled in the initial-ramdisk under `name` as a new ring-3
|
|
/// process, returning true on success. This is how a supervisor (the device manager)
|
|
/// launches a driver it matched — danos-native, not POSIX (a spawn/exec family comes
|
|
/// with the process work later).
|
|
pub fn spawn(name: []const u8) bool {
|
|
return sc.systemCall2(.system_spawn, @intFromPtr(name.ptr), name.len) == 0;
|
|
}
|
|
|
|
/// Grant `len` bytes (rounded up to whole pages) of fresh, zeroed, writable
|
|
/// memory and return the base virtual address. On failure returns a value in the
|
|
/// top page (see `mmapFailed`). The user heap grows through this call.
|
|
pub fn mmap(len: usize, prot: usize) usize {
|
|
return sc.systemCall2(.mmap, len, prot);
|
|
}
|
|
|
|
/// Release a range previously handed out by `mmap`.
|
|
pub fn munmap(base: usize, len: usize) usize {
|
|
return sc.systemCall2(.munmap, base, len);
|
|
}
|
|
|
|
/// Whether an `mmap` return value is an error (the kernel returns a wrapped
|
|
/// -errno, which lands in the top page — no real grant base is ever that high).
|
|
pub inline fn mmapFailed(ret: usize) bool {
|
|
return ret > ~@as(usize, 0) - 4095;
|
|
}
|