Initial monitor state management overhaul

Cargo.toml

@@ -37,8 +37,8 @@ initrd = [
     "crate:netmgr",
     "crate:nettest",
     "crate:pager",
-    #"lib:twz-rt",
-    #"lib:monitor",
+    "lib:twz-rt",
+    "lib:monitor",
     #"third-party:hello-world-rs"
 ]
 
@@ -60,3 +60,4 @@ async-executor = { git = "https://github.com/twizzler-operating-system/async-exe
 twizzler-futures = { path = "src/lib/twizzler-futures" }
 twizzler-abi = { path = "src/lib/twizzler-abi" }
 parking_lot = { git = "https://github.com/twizzler-operating-system/parking_lot.git", branch = "twizzler" }
+lock_api = { git = "https://github.com/twizzler-operating-system/parking_lot.git", branch = "twizzler" }

src/lib/twizzler-abi/src/thread.rs

@@ -4,9 +4,12 @@ use core::sync::atomic::{AtomicU64, Ordering};
 #[cfg(not(feature = "kernel"))]
 use core::time::Duration;
 
-use crate::marker::BaseType;
 #[cfg(not(feature = "kernel"))]
 use crate::syscall::*;
+use crate::{
+    marker::BaseType,
+    syscall::{ThreadSyncFlags, ThreadSyncOp, ThreadSyncReference, ThreadSyncSleep},
+};
 #[allow(unused_imports)]
 use crate::{
     object::{ObjID, Protections},
@@ -125,6 +128,26 @@ impl ThreadRepr {
         }
     }
 
+    /// Create a [ThreadSyncSleep] that will wait until the thread's state matches `state`.
+    pub fn waitable(&self, state: ExecutionState) -> ThreadSyncSleep {
+        ThreadSyncSleep::new(
+            ThreadSyncReference::Virtual(&self.status),
+            state as u64,
+            ThreadSyncOp::Equal,
+            ThreadSyncFlags::empty(),
+        )
+    }
+
+    /// Create a [ThreadSyncSleep] that will wait until the thread's state is _not_ `state`.
+    pub fn waitable_until_not(&self, state: ExecutionState) -> ThreadSyncSleep {
+        ThreadSyncSleep::new(
+            ThreadSyncReference::Virtual(&self.status),
+            state as u64,
+            ThreadSyncOp::Equal,
+            ThreadSyncFlags::INVERT,
+        )
+    }
+
     #[cfg(not(feature = "kernel"))]
     /// Wait for a thread's status to change, optionally timing out. Return value is None if timeout
     /// occurs, or Some((ExecutionState, code)) otherwise.

src/runtime/monitor-api/src/lib.rs

@@ -15,7 +15,7 @@ use std::{
 };
 
 use dynlink::tls::{Tcb, TlsRegion};
-use twizzler_abi::object::ObjID;
+use twizzler_abi::object::{ObjID, MAX_SIZE, NULLPAGE_SIZE};
 
 mod gates {
     include! {"../../monitor/secapi/gates.rs"}
@@ -163,3 +163,21 @@ impl SharedCompConfig {
 }
 
 pub use gates::LibraryInfo;
+
+/// Contains raw mapping addresses, for use when translating to object handles for the runtime.
+#[derive(Copy, Clone, PartialEq, PartialOrd, Ord, Eq)]
+pub struct MappedObjectAddrs {
+    pub slot: usize,
+    pub start: usize,
+    pub meta: usize,
+}
+
+impl MappedObjectAddrs {
+    pub fn new(slot: usize) -> Self {
+        Self {
+            start: slot * MAX_SIZE,
+            meta: (slot + 1) * MAX_SIZE - NULLPAGE_SIZE,
+            slot,
+        }
+    }
+}

src/runtime/monitor/Cargo.toml

@@ -25,6 +25,8 @@ monitor-api = { path = "../monitor-api" }
 static_assertions = "1.1"
 lazy_static = "1.4"
 talc = "3.1"
+happylock = "0.3"
+parking_lot = "*"
 
 [features]
 secgate-impl = []

src/runtime/monitor/src/api.rs

@@ -0,0 +1,3 @@
+use twizzler_runtime_api::ObjID;
+
+pub const MONITOR_INSTANCE_ID: ObjID = ObjID::new(0);

src/runtime/monitor/src/lib.rs

@@ -2,6 +2,7 @@
 #![feature(thread_local)]
 #![feature(c_str_literals)]
 #![feature(new_uninit)]
+#![feature(hash_extract_if)]
 
 use std::sync::{Arc, Mutex};
 
@@ -29,6 +30,9 @@ mod state;
 mod thread;
 mod upcall;
 
+mod api;
+mod mon;
+
 #[path = "../secapi/gates.rs"]
 mod gates;
 
@@ -95,7 +99,7 @@ fn monitor_init(state: Arc<Mutex<MonitorState>>) -> miette::Result<()> {
         }
     }
 
-    load_hello_world_test(&state).unwrap();
+    //load_hello_world_test(&state).unwrap();
 
     Ok(())
 }

src/runtime/monitor/src/mon/compartment.rs

@@ -0,0 +1 @@
+pub struct CompartmentMgr {}

src/runtime/monitor/src/mon/mod.rs

@@ -0,0 +1,38 @@
+use std::sync::OnceLock;
+
+use happylock::RwLock;
+
+use self::space::Unmapper;
+
+pub(crate) mod compartment;
+pub(crate) mod space;
+pub(crate) mod thread;
+
+/// A security monitor instance. All monitor logic is implemented as methods for this type.
+/// We split the state into the following components: 'space', managing the virtual memory space and
+/// mapping objects, 'thread_mgr', which manages all threads owned by the monitor (typically, all
+/// threads started by compartments), 'compartments', which manages compartment state, and
+/// 'dynlink', which contains the dynamic linker state. The unmapper allows for background unmapping
+/// and cleanup of objects and handles.
+pub struct Monitor {
+    space: RwLock<space::Space>,
+    thread_mgr: RwLock<thread::ThreadMgr>,
+    compartments: RwLock<compartment::CompartmentMgr>,
+    dynlink: RwLock<dynlink::context::Context>,
+    unmapper: Unmapper,
+}
+
+static MONITOR: OnceLock<Monitor> = OnceLock::new();
+
+/// Get the monitor instance. Panics if called before first call to [set_monitor].
+pub fn get_monitor() -> &'static Monitor {
+    MONITOR.get().unwrap()
+}
+
+/// Set the monitor instance. Can only be called once. Must be called before any call to
+/// [get_monitor].
+pub fn set_monitor(monitor: Monitor) {
+    if MONITOR.set(monitor).is_err() {
+        panic!("second call to set_monitor");
+    }
+}

src/runtime/monitor/src/mon/space.rs

@@ -0,0 +1,125 @@
+use std::{collections::HashMap, sync::Arc};
+
+use monitor_api::MappedObjectAddrs;
+use twizzler_abi::syscall::{sys_object_map, sys_object_unmap, UnmapFlags};
+use twizzler_object::Protections;
+use twizzler_runtime_api::{MapError, MapFlags, ObjID};
+
+use self::handle::MapHandleInner;
+
+mod handle;
+mod unmapper;
+
+pub use handle::MapHandle;
+pub use unmapper::Unmapper;
+
+#[derive(Debug, Copy, Clone, PartialEq, PartialOrd, Ord, Eq, Hash)]
+/// A mapping of an object and flags.
+pub struct MapInfo {
+    pub(crate) id: ObjID,
+    pub(crate) flags: MapFlags,
+}
+
+#[derive(Default)]
+/// An address space we can map objects into.
+pub struct Space {
+    maps: HashMap<MapInfo, MappedObject>,
+}
+
+struct MappedObject {
+    addrs: MappedObjectAddrs,
+    handle_count: usize,
+}
+
+fn mapflags_into_prot(flags: MapFlags) -> Protections {
+    let mut prot = Protections::empty();
+    if flags.contains(MapFlags::READ) {
+        prot.insert(Protections::READ);
+    }
+    if flags.contains(MapFlags::WRITE) {
+        prot.insert(Protections::WRITE);
+    }
+    if flags.contains(MapFlags::EXEC) {
+        prot.insert(Protections::EXEC);
+    }
+    prot
+}
+
+impl Space {
+    /// Map an object into the space.
+    pub fn map(&mut self, info: MapInfo) -> Result<MapHandle, MapError> {
+        // Can't use the entry API here because the closure may fail.
+        let item = match self.maps.get_mut(&info) {
+            Some(item) => item,
+            None => {
+                // Not yet mapped, so allocate a slot and map it.
+                let slot = twz_rt::OUR_RUNTIME
+                    .allocate_slot()
+                    .ok_or(MapError::OutOfResources)?;
+
+                let Ok(_) = sys_object_map(
+                    None,
+                    info.id,
+                    slot,
+                    mapflags_into_prot(info.flags),
+                    twizzler_abi::syscall::MapFlags::empty(),
+                ) else {
+                    twz_rt::OUR_RUNTIME.release_slot(slot);
+                    return Err(MapError::InternalError);
+                };
+
+                let map = MappedObject {
+                    addrs: MappedObjectAddrs::new(slot),
+                    handle_count: 0,
+                };
+                self.maps.insert(info, map);
+                // Unwrap-Ok: just inserted.
+                self.maps.get_mut(&info).unwrap()
+            }
+        };
+
+        // New maps will be set to zero, so this is unconditional.
+        item.handle_count += 1;
+        Ok(Arc::new(MapHandleInner::new(info, item.addrs)))
+    }
+
+    /// Remove an object from the space. The actual unmapping syscall only happens once the returned
+    /// value from this function is dropped.
+    pub fn handle_drop(&mut self, info: MapInfo) -> Option<UnmapOnDrop> {
+        // Missing maps in unmap should be ignored.
+        let Some(item) = self.maps.get_mut(&info) else {
+            tracing::warn!("unmap called for missing object {:?}", info);
+            return None;
+        };
+        if item.handle_count == 0 {
+            tracing::error!("unmap called for unmapped object {:?}", info);
+            return None;
+        }
+
+        // Decrement and maybe actually unmap.
+        item.handle_count -= 1;
+        if item.handle_count == 0 {
+            let slot = item.addrs.slot;
+            self.maps.remove(&info);
+            Some(UnmapOnDrop { slot })
+        } else {
+            None
+        }
+    }
+}
+
+// Allows us to call handle_drop and do all the hard work in the caller, since
+// the caller probably had to hold a lock to call these functions.
+pub(crate) struct UnmapOnDrop {
+    slot: usize,
+}
+
+impl Drop for UnmapOnDrop {
+    fn drop(&mut self) {
+        if sys_object_unmap(None, self.slot, UnmapFlags::empty()).is_ok() {
+            twz_rt::OUR_RUNTIME.release_slot(self.slot);
+        } else {
+            tracing::warn!("failed to unmap slot {}", self.slot);
+        }
+    }
+}