About the exception ipc reply

[Guanghui, Cheng]

Some parts of this message have been removed. Learn more about Nabble's security policy.

Hello:
From the l4-x2 manual it is said the reply from the exception handler contains a label, an instruction pointer where the faulting thread is resumed. I want to know whether it is implemented in the Fiasco.
I try to do this. Modify the utcb before send ipc resume the exception thread but it seems no any effect about the instruction pointer and stack pointer of resumed exception thread.
Thanks.
Cheng Guanghui

_______________________________________________
l4-hackers mailing list
l4-hackers@...
http://os.inf.tu-dresden.de/mailman/listinfo/l4-hackers

[Adam Lackorzynski]

On Sun Oct 11, 2009 at 22:17:49 +0800, Guanghui, Cheng wrote:
> From the l4-x2 manual it is said the reply from the exception handler
> contains a label, an instruction pointer where the faulting thread is resumed.
> I want to know whether it is implemented in the Fiasco.
> I try to do this. Modify the utcb before send ipc resume the exception thread
> but it seems no any effect about the instruction pointer and stack pointer of
> resumed exception thread.

My guess would be that you did not set the number of words to send in
the reply. Set L4_UTCB_EXCEPTION_REGS_SIZE in the msgtag-words field of
the reply.


Adam
--
Adam                 adam@...
  Lackorzynski         http://os.inf.tu-dresden.de/~adam/

_______________________________________________
l4-hackers mailing list
l4-hackers@...
http://os.inf.tu-dresden.de/mailman/listinfo/l4-hackers

[Guanghui, Cheng]

Some parts of this message have been removed. Learn more about Nabble's security policy.

On Monday 12 October 2009 02:03:41 Adam Lackorzynski wrote:
> On Sun Oct 11, 2009 at 22:17:49 +0800, Guanghui, Cheng wrote:
> > From the l4-x2 manual it is said the reply from the exception handler
> > contains a label, an instruction pointer where the faulting thread is
> > resumed. I want to know whether it is implemented in the Fiasco.
> > I try to do this. Modify the utcb before send ipc resume the exception
> > thread but it seems no any effect about the instruction pointer and stack
> > pointer of resumed exception thread.
>
> My guess would be that you did not set the number of words to send in
> the reply. Set L4_UTCB_EXCEPTION_REGS_SIZE in the msgtag-words field of
> the reply.
Hello Adam:
Now i use L4_UTCB_EXCEPTION_REGS_SIZE and i could fix the thread with esp and eip by exception handler UTCB. And the thread could start with new instruction pointer and new stack pointer. But it still has some problem when the thread quit from new function. So i want to know how an thread is resumed by exception reply. I mean which part of code in kernel could finish the thread wakeup. I read the receive.c but i don't find it.
Thanks.
Cheng

_______________________________________________
l4-hackers mailing list
l4-hackers@...
http://os.inf.tu-dresden.de/mailman/listinfo/l4-hackers

[Adam Lackorzynski]

On Tue Oct 13, 2009 at 13:01:46 +0800, Guanghui, Cheng wrote:

> On Monday 12 October 2009 02:03:41 Adam Lackorzynski wrote:
> > On Sun Oct 11, 2009 at 22:17:49 +0800, Guanghui, Cheng wrote:
> > > From the l4-x2 manual it is said the reply from the exception handler
> > > contains a label, an instruction pointer where the faulting thread is
> > > resumed. I want to know whether it is implemented in the Fiasco.
> > > I try to do this. Modify the utcb before send ipc resume the exception
> > > thread but it seems no any effect about the instruction pointer and stack
> > > pointer of resumed exception thread.
> >
> > My guess would be that you did not set the number of words to send in
> > the reply. Set L4_UTCB_EXCEPTION_REGS_SIZE in the msgtag-words field of
> > the reply.
> Hello Adam:
> Now i use L4_UTCB_EXCEPTION_REGS_SIZE and i could fix the thread with esp and
> eip by exception handler UTCB. And the thread could start with new instruction
> pointer and new stack pointer.  But it still has some problem when the thread
> quit from new function. So i want to know how an thread is resumed by
> exception reply. I mean which part of code in kernel could finish the thread
> wakeup. I read the receive.c but i don't find it.

The function copy_utcb_to_ts copies the state from the utcb of the
exception handler over the state of the thread. The thread then resumes
with this new state. I think what you have to do is to e.g. prepare the
stack of the thread in a way that when the new function's ret is
called it resumes at the position it was intercepted. Is this possible?



Adam
--
Adam                 adam@...
  Lackorzynski         http://os.inf.tu-dresden.de/~adam/

_______________________________________________
l4-hackers mailing list
l4-hackers@...
http://os.inf.tu-dresden.de/mailman/listinfo/l4-hackers

[Guanghui, Cheng]

Some parts of this message have been removed. Learn more about Nabble's security policy.

On Wednesday 14 October 2009 06:52:10 you wrote:
> On Tue Oct 13, 2009 at 13:01:46 +0800, Guanghui, Cheng wrote:
> > On Monday 12 October 2009 02:03:41 Adam Lackorzynski wrote:
> > > On Sun Oct 11, 2009 at 22:17:49 +0800, Guanghui, Cheng wrote:
> > > > From the l4-x2 manual it is said the reply from the exception
> > > > handler contains a label, an instruction pointer where the faulting
> > > > thread is resumed. I want to know whether it is implemented in the
> > > > Fiasco. I try to do this. Modify the utcb before send ipc resume the
> > > > exception thread but it seems no any effect about the instruction
> > > > pointer and stack pointer of resumed exception thread.
> > >
> > > My guess would be that you did not set the number of words to send in
> > > the reply. Set L4_UTCB_EXCEPTION_REGS_SIZE in the msgtag-words field of
> > > the reply.
> >
> > Hello Adam:
> > Now i use L4_UTCB_EXCEPTION_REGS_SIZE and i could fix the thread with
> > esp and eip by exception handler UTCB. And the thread could start with
> > new instruction pointer and new stack pointer. But it still has some
> > problem when the thread quit from new function. So i want to know how an
> > thread is resumed by exception reply. I mean which part of code in kernel
> > could finish the thread wakeup. I read the receive.c but i don't find it.
>
> The function copy_utcb_to_ts copies the state from the utcb of the
> exception handler over the state of the thread. The thread then resumes
> with this new state. I think what you have to do is to e.g. prepare the
> stack of the thread in a way that when the new function's ret is
> called it resumes at the position it was intercepted. Is this possible?
Hello, Adam:
Now the demo could work according to your design. And this demo is so simple only to emulate the situation we talked about before. I introduced a little about this demo:
3 threads: timer_thread, exception_thread, main_thread
main_thread emulates the behaviour of system which is a endless loop to output. the function body is thread_func1.
timer_thread emulates the behaviour of timer thread which could trigger the exception periodically.
exception_thread emulates the behaviour of handling interrupt. The function body is exception_handler.

When the timer_thread modify the status of main_thread with flag L4_THREAD_EX_REGS_RAISE_EXCEPTION. The main thread will be suspend and the exception_thread could get the exception ipc from main_thread. Exception_thread will modify the ESP and EIP in the utcb and then reply to main thread. The main thread will resume to the function about handling interrupt. When the handling interrupt function is over. The main thread could go back to the status before the exception happens.
The output:
count 49
...
count 58
id: 8:1, 12 0xeacff011 15 0x100711c
do irq 0
...
do irq 9
l4_sleep(): IPC error 00
count 59
...
count 67
id: 8:1, 12 0xeacff011 15 0x100711c
The output between "count ..." is execution of main thread. The output between "do_irq ..." is execution of exception thread which emulates the interrupt handling.

BUT. I have a problem about my code when i fixing the stack of main thread. The correct code which could work well is like this:
utcb = l4_utcb_get();
eip = utcb->exc.eip;
esp = utcb->exc.esp;
utcb->values[12] = (l4_umword_t)(do_irq);
esp_loc = 1024 - (esp - (l4_umword_t)stack)/4;
stack[esp_loc - 1] = eip;
l4_msgtag ...
l4_ipc_send_tag
In the code above i only reset the next stack with return address (old eip). But it seems i can't reset the new stack pointer like
utcb->values[15] = esp - 4
In my opinion it should do but if i did it can't work. It seems some tricky here. Can you tell me why it is like this?
Additinally, i tried this way about handling interrupt with interrupt number like this:
void do_irq(int irq)
it can't work either.

Thanks.
Cheng Guanghui

[main.c]

---

#include <l4/sys/types.h>
#include <l4/sys/ipc.h>
#include <l4/sys/kdebug.h>
#include <l4/util/util.h>
#include <stdio.h>

l4_threadid_t timer_thread, exception_thread, main_thread;

char * stack[1024];
char * stack2[1024];

void do_irq(void)
{
        int irq = 0;
        while(irq < 10)
                printf("do irq %d\n", irq ++);
}

static void exception_handler(void)
{
        l4_threadid_t src, preempter, pager;
        l4_umword_t ignore, dummy1, dummy2, old_eip, old_esp, eip, esp;
        l4_msgdope_t dope;
        int irq = 0;
        l4_utcb_t *utcb;
        l4_msgtag_t tag;
        int esp_loc;
        int ret;
       
        while(1)
        {
                l4_ipc_wait(&src, L4_IPC_SHORT_MSG, &dummy1, &old_eip, L4_IPC_NEVER, &dope);
                utcb = l4_utcb_get();
                eip = utcb->exc.eip;
                esp = utcb->exc.esp;
                printf("id: %d:%d, 12 0x%x 15 0x%x \n ", src.id.task, src.id.lthread, eip, esp);
                utcb->values[12] = (l4_umword_t)(do_irq);
                esp_loc = 1024 - (esp - (l4_umword_t)stack)/4;
                stack[esp_loc - 1] = eip;
               
// utcb->values[15] = esp - 4;
       
                tag = l4_msgtag(0, L4_UTCB_EXCEPTION_REGS_SIZE, 0, 0);
                       
                ret = l4_ipc_send_tag(src, L4_IPC_SHORT_MSG, 0, 0, tag, L4_IPC_NEVER, &dope);
        }
}

static void thread_func1(void)
{
        int count = 0;
        while(1)
        {
                count++;
                printf("count %d\n", count);
                l4_sleep(100);
        }
}

int main(int argc, char ** argv)
{
        l4_threadid_t preempter, pager, my_pager;
        l4_umword_t ignore, old_eip, old_esp;

        preempter = L4_INVALID_ID;
        my_pager = L4_INVALID_ID;

        //get pager of main thread
        l4_thread_ex_regs(l4_myself(), -1, -1, &preempter, &my_pager, &ignore, &ignore, &ignore);

        //configure the thread ID and new pager of new thread
        timer_thread = l4_myself();
        main_thread = l4_myself();
        preempter = L4_INVALID_ID;
        pager = my_pager;
        main_thread.id.lthread = l4_myself().id.lthread + 1;

        l4_thread_ex_regs(main_thread, (l4_umword_t)(thread_func1), (l4_umword_t)(stack + 1024), &preempter, &pager, &ignore, &ignore, &ignore);
        l4_sleep(100);

        exception_thread = l4_myself();
        preempter = L4_INVALID_ID;
        pager = my_pager;
        exception_thread.id.lthread = l4_myself().id.lthread + 2;
        l4_thread_ex_regs(exception_thread, (l4_umword_t)(exception_handler), (l4_umword_t)(stack2 + 1024), &preempter, &pager, &ignore, &ignore, &ignore);
        l4_sleep(100);

        //modify the pager of main thread
        pager = exception_thread;
        preempter = L4_INVALID_ID;
        l4_thread_ex_regs(main_thread, -1, -1, &preempter, &pager, &ignore, &ignore, &ignore);
        printf("pager thread is finished.\n");

        while(1)
        {
                pager = L4_INVALID_ID;
                preempter = L4_INVALID_ID;

                l4_thread_ex_regs_flags(main_thread, -1, -1, &preempter, &pager, &ignore, &old_eip, &old_esp, L4_THREAD_EX_REGS_NO_CANCEL|L4_THREAD_EX_REGS_RAISE_EXCEPTION);
                l4_sleep(1000);
        }
}

---

_______________________________________________
l4-hackers mailing list
l4-hackers@...
http://os.inf.tu-dresden.de/mailman/listinfo/l4-hackers

[Adam Lackorzynski]

Hi Cheng,

On Thu Oct 15, 2009 at 13:57:32 +0800, Guanghui, Cheng wrote:

> BUT. I have a problem about my code when i fixing the stack of main thread.
> The correct code which could work well is like this:
> utcb = l4_utcb_get();
> eip = utcb->exc.eip;
> esp = utcb->exc.esp;
> utcb->values[12] = (l4_umword_t)(do_irq);
> esp_loc = 1024 - (esp - (l4_umword_t)stack)/4;
> stack[esp_loc - 1] = eip;
> l4_msgtag ...
> l4_ipc_send_tag
> In the code above i only reset the next stack with return address (old eip).
> But it seems i can't reset the new stack pointer like
> utcb->values[15] = esp - 4
> In my opinion it should do  but if i did it can't work. It seems some tricky
> here. Can you tell me why it is like this?
> Additinally, i tried this way about handling interrupt  with interrupt number  
> like this:
> void do_irq(int irq)
> it can't work either.

Please refer to the attached modified version of your program. It's a
bit more tricky than that, regs also need to be saved etc...


Adam
--
Adam                 adam@...
  Lackorzynski         http://os.inf.tu-dresden.de/~adam/

---

#include <l4/sys/types.h>
#include <l4/sys/ipc.h>
#include <l4/sys/kdebug.h>
#include <l4/util/util.h>
#include <stdio.h>

l4_threadid_t timer_thread, exception_thread, main_thread;

char stack[8024];
char stack2[8024];

void do_irq(int irq)
{
  printf("do irq %d\n", irq ++);
}


static
__attribute__((regparm(0)))
void intra_iret(int foo)
{
  asm volatile ("movl %0, %%esp \t\n"
                "pop %%eax      \t\n"
                "pop %%ecx      \t\n"
                "pop %%edx      \t\n"
                "pop %%ebx      \t\n"
                "pop %%ebp      \t\n"
                "pop %%esi      \t\n"
                "pop %%edi      \t\n"
                "iret           \t\n"
                : : "r" (&foo));
}

static void exception_handler(void)
{
        l4_threadid_t src, preempter, pager;
        l4_umword_t ignore, dummy1, dummy2, old_eip, old_esp, eip;
        l4_umword_t *esp;
        l4_msgdope_t dope;
        int irq = 0;
        l4_utcb_t *utcb;
        l4_msgtag_t tag;
        int esp_loc;
        int ret;

        while(1)
        {
                l4_ipc_wait(&src, L4_IPC_SHORT_MSG, &dummy1, &old_eip, L4_IPC_NEVER, &dope);
                utcb = l4_utcb_get();
                eip = utcb->exc.eip;
                esp = (l4_umword_t *)utcb->exc.esp;
                printf("id: %d:%d, 12 0x%x 15 0x%x \n ", src.id.task, src.id.lthread, eip, esp);

                l4_umword_t cs;
                asm volatile ("mov %%cs, %0" : "=r" (cs));
                *(--esp) = utcb->exc.eflags;
                *(--esp) = cs;
                *(--esp) = utcb->exc.eip;

                *(--esp) = utcb->exc.edi;
                *(--esp) = utcb->exc.esi;
                *(--esp) = utcb->exc.ebp;
                *(--esp) = utcb->exc.ebx;
                *(--esp) = utcb->exc.edx;
                *(--esp) = utcb->exc.ecx;
                *(--esp) = utcb->exc.eax;

                *(--esp) = 1234;
                *(--esp) = (unsigned long)intra_iret;

                utcb->exc.eip = (l4_umword_t)do_irq;
                utcb->exc.esp = esp;

                tag = l4_msgtag(0, L4_UTCB_EXCEPTION_REGS_SIZE, 0, 0);
                ret = l4_ipc_send_tag(src, L4_IPC_SHORT_MSG, 0, 0, tag, L4_IPC_NEVER, &dope);
                if (ret)
                  printf("send error\n");
        }
}

static void thread_func1(void)
{
        int count = 0;
        while(1)
        {
                count++;
                printf("count %d\n", count);
                l4_sleep(100);
        }
}

int main(int argc, char ** argv)
{
        l4_threadid_t preempter, pager, my_pager;
        l4_umword_t ignore, old_eip, old_esp;

        preempter = L4_INVALID_ID;
        my_pager = L4_INVALID_ID;

        //get pager of main thread
        l4_thread_ex_regs(l4_myself(), -1, -1, &preempter, &my_pager, &ignore, &ignore, &ignore);

        //configure the thread ID and new pager of new thread
        timer_thread = l4_myself();
        main_thread = l4_myself();
        preempter = L4_INVALID_ID;
        pager = my_pager;
        main_thread.id.lthread = l4_myself().id.lthread + 1;

        l4_thread_ex_regs(main_thread, (l4_umword_t)(thread_func1), (l4_umword_t)(stack + sizeof(stack)), &preempter, &pager, &ignore, &ignore, &ignore);
        l4_sleep(100);

        exception_thread = l4_myself();
        preempter = L4_INVALID_ID;
        pager = my_pager;
        exception_thread.id.lthread = l4_myself().id.lthread + 2;
        l4_thread_ex_regs(exception_thread, (l4_umword_t)(exception_handler), (l4_umword_t)(stack2 + sizeof(stack)), &preempter, &pager, &ignore, &ignore, &ignore);
        l4_sleep(100);

        //modify the pager of main thread
        pager = exception_thread;
        preempter = L4_INVALID_ID;
        l4_thread_ex_regs_flags(main_thread, -1, -1, &preempter, &pager, &ignore, &ignore, &ignore, L4_THREAD_EX_REGS_NO_CANCEL);
        printf("pager thread is finished.\n");

        while(1)
        {
                pager = L4_INVALID_ID;
                preempter = L4_INVALID_ID;

                l4_thread_ex_regs_flags(main_thread, -1, -1, &preempter, &pager, &ignore, &old_eip, &old_esp, L4_THREAD_EX_REGS_NO_CANCEL|L4_THREAD_EX_REGS_RAISE_EXCEPTION);
                l4_sleep(1000);
        }
}

---

_______________________________________________
l4-hackers mailing list
l4-hackers@...
http://os.inf.tu-dresden.de/mailman/listinfo/l4-hackers

[Guanghui, Cheng]

Some parts of this message have been removed. Learn more about Nabble's security policy.

On Friday 16 October 2009 17:05:27 Adam Lackorzynski wrote:
> Hi Cheng,
>
> On Thu Oct 15, 2009 at 13:57:32 +0800, Guanghui, Cheng wrote:
> > BUT. I have a problem about my code when i fixing the stack of main
> > thread. The correct code which could work well is like this:
> > utcb = l4_utcb_get();
> > eip = utcb->exc.eip;
> > esp = utcb->exc.esp;
> > utcb->values[12] = (l4_umword_t)(do_irq);
> > esp_loc = 1024 - (esp - (l4_umword_t)stack)/4;
> > stack[esp_loc - 1] = eip;
> > l4_msgtag ...
> > l4_ipc_send_tag
> > In the code above i only reset the next stack with return address (old
> > eip). But it seems i can't reset the new stack pointer like
> > utcb->values[15] = esp - 4
> > In my opinion it should do but if i did it can't work. It seems some
> > tricky here. Can you tell me why it is like this?
> > Additinally, i tried this way about handling interrupt with interrupt
> > number like this:
> > void do_irq(int irq)
> > it can't work either.
>
> Please refer to the attached modified version of your program. It's a
> bit more tricky than that, regs also need to be saved etc...
Your code is so smart. I tried to use the assembler
code to finish the process. But ret instruction could
only be back to the last step. iret is a really good idea
to go back the origin place like goto.
Thanks a lot.
Cheng Guanghui

_______________________________________________
l4-hackers mailing list
l4-hackers@...
http://os.inf.tu-dresden.de/mailman/listinfo/l4-hackers