Imported Genode release 11.11

base/README

@@ -0,0 +1,12 @@
+This is generic part of the Genode implementation. It consists of two parts:
+
+:_Core_: is the ultimate root of the Genode application tree
+  and provides abstractions for the lowest-level hardware resources
+  such as RAM, ROM, CPU, and generic device access. All generic parts of Core
+  can be found here - for system-specific implementations refer to the
+  appropriate 'base-<system>' directory.
+
+:_Base libraries and protocols_: that are used by each Genode component
+  to interact with other components. This is the glue that holds everything
+  together.
+

base/etc/README

@@ -0,0 +1,16 @@
+This directory contains default configuration files that are used
+by the '<role>.mk' files in the 'mk/' directory. By
+convention, configuration files are first read from here
+followed by a corresponding config file in '<builddir>/etc/'.
+
+
+Convention
+~~~~~~~~~~
+
+We include config files directly into makefiles. So the basic
+makefile syntax applies here, too.
+
+Config files should
+* Have '.conf' as filename extension.
+* Use only assignments but provide no rules or other 'make'-magic.
+* Not include other files!

base/etc/tools.conf

@@ -0,0 +1,57 @@
+#
+# The following options let you define non-default tools to use
+#
+# CUSTOM_LD is only used for the progressive linking of libraries.
+# It is not used for linking the final target.
+#
+#CUSTOM_CC      = gcc
+#CUSTOM_CXX     = g++
+#CUSTOM_AS      = as
+#CUSTOM_LD      = ld
+
+#
+# For using a cross-compile tool chain, the names of all
+# binutils and compilers are typically prefixed by the
+# target platform. Instead of defining CUSTOM_* variables
+# individually for each tool, the prefix can be defined
+# via the following variable.
+#
+ifeq ($(filter-out $(SPECS),x86),)
+CROSS_DEV_PREFIX ?= /usr/local/genode-gcc/bin/genode-x86-
+endif
+ifeq ($(filter-out $(SPECS),arm),)
+CROSS_DEV_PREFIX ?= /usr/local/genode-gcc/bin/genode-arm-
+endif
+
+#
+# We use libsupc++ from g++ version 3 because
+# this version does not use thread-local storage
+# via the gs register. This is an interim solution.
+#
+#CUSTOM_CXX_LIB = g++-3.4
+
+#
+# The default optimization level used for compiling is -O2.
+# By defining the variable CC_OLEVEL, you can override this
+# default value, for example to optimize your binaries for size.
+#
+#CC_OLEVEL = -Os
+
+#
+# If CC_OPT should be extended please use concatenation syntax like:
+#
+#CC_OPT += -ffunction-sections -fdata-sections
+
+#
+# If CXX_LINK_OPT (linker options given to CXX)  should be extended please use
+# concatenation syntax like:
+#
+#CXX_LINK_OPT += -Wl,-gc-sections
+
+#
+# On non-GNU systems, you may direct the build system to use GNU-
+# specific tools.
+#
+#TAC              ?= /opt/gnu/bin/tac
+#GNU_FIND         ?= /opt/gnu/bin/find
+#GNU_XARGS        ?= /opt/gnu/bin/xargs

base/include/32bit/base/fixed_stdint.h

@@ -0,0 +1,60 @@
+/*
+ * \brief  Standard fixed-width integer types
+ * \author Christian Helmuth
+ * \author Norman Feske
+ * \date   2006-05-10
+ *
+ * In contrast to most Genode header files, which are only usable for C++,
+ * this file is a valid C header file because a lot of existing C-based
+ * software relies on fixed-size integer types. These types, however, are
+ * platform specific but cannot be derived from the compiler's built-in
+ * types. Normally, the platform-dependent part of a C library provides
+ * these type definitions. This header file provides a single header for
+ * C and C++ programs that are not using a C library but need fixed-width
+ * integer types.
+ *
+ * All type definition are prefixed with 'genode_'. If included as a C++
+ * header, the types are also defined within the 'Genode' namespace.
+ */
+
+/*
+ * Copyright (C) 2006-2011 Genode Labs GmbH
+ *
+ * This file is part of the Genode OS framework, which is distributed
+ * under the terms of the GNU General Public License version 2.
+ */
+
+#ifndef _INCLUDE__32BIT__BASE__FIXED_STDINT_H_
+#define _INCLUDE__32BIT__BASE__FIXED_STDINT_H_
+
+
+/*
+ * Fixed-size types usable from both C and C++ programs
+ */
+typedef signed char            genode_int8_t;
+typedef unsigned char          genode_uint8_t;
+typedef signed short int       genode_int16_t;
+typedef unsigned short int     genode_uint16_t;
+typedef signed int             genode_int32_t;
+typedef unsigned int           genode_uint32_t;
+typedef signed long long int   genode_int64_t;
+typedef unsigned long long int genode_uint64_t;
+
+
+/*
+ * Types residing within Genode's C++ namespace
+ */
+#ifdef __cplusplus
+namespace Genode {
+	typedef genode_int8_t     int8_t;
+	typedef genode_uint8_t   uint8_t;
+	typedef genode_int16_t   int16_t;
+	typedef genode_uint16_t uint16_t;
+	typedef genode_int32_t   int32_t;
+	typedef genode_uint32_t uint32_t;
+	typedef genode_int64_t   int64_t;
+	typedef genode_uint64_t uint64_t;
+}
+#endif
+
+#endif /* _INCLUDE__32BIT__BASE__FIXED_STDINT_H_ */

base/include/64bit/base/fixed_stdint.h

@@ -0,0 +1,50 @@
+/*
+ * \brief  Standard fixed-width integer types
+ * \author Christian Helmuth
+ * \author Norman Feske
+ * \date   2006-05-10
+ *
+ * For additional information, please revisit the 32bit version of this file.
+ */
+
+/*
+ * Copyright (C) 2006-2011 Genode Labs GmbH
+ *
+ * This file is part of the Genode OS framework, which is distributed
+ * under the terms of the GNU General Public License version 2.
+ */
+
+#ifndef _INCLUDE__64BIT__BASE__FIXED_STDINT_H_
+#define _INCLUDE__64BIT__BASE__FIXED_STDINT_H_
+
+
+/*
+ * Fixed-size types usable from both C and C++ programs
+ */
+typedef signed char            genode_int8_t;
+typedef unsigned char          genode_uint8_t;
+typedef signed short int       genode_int16_t;
+typedef unsigned short int     genode_uint16_t;
+typedef signed int             genode_int32_t;
+typedef unsigned int           genode_uint32_t;
+typedef signed long int        genode_int64_t;
+typedef unsigned long int      genode_uint64_t;
+
+
+/*
+ * Types residing within Genode's C++ namespace
+ */
+#ifdef __cplusplus
+namespace Genode {
+	typedef genode_int8_t     int8_t;
+	typedef genode_uint8_t   uint8_t;
+	typedef genode_int16_t   int16_t;
+	typedef genode_uint16_t uint16_t;
+	typedef genode_int32_t   int32_t;
+	typedef genode_uint32_t uint32_t;
+	typedef genode_int64_t   int64_t;
+	typedef genode_uint64_t uint64_t;
+}
+#endif
+
+#endif /* _INCLUDE__64BIT__BASE__FIXED_STDINT_H_ */

base/include/README

@@ -0,0 +1,3 @@
+This directory contains include files of interfaces that are exported
+by components to be used by other components. Each subdirectory corresponds
+to the component exporting the interface.

base/include/arm/cpu/cpu_state.h

@@ -0,0 +1,32 @@
+/*
+ * \brief  CPU state
+ * \author Norman Feske
+ * \author Stefan Kalkowski
+ * \date   2011-05-06
+ */
+
+/*
+ * Copyright (C) 2011 Genode Labs GmbH
+ *
+ * This file is part of the Genode OS framework, which is distributed
+ * under the terms of the GNU General Public License version 2.
+ */
+
+#ifndef _INCLUDE__ARM__CPU__CPU_STATE_H_
+#define _INCLUDE__ARM__CPU__CPU_STATE_H_
+
+#include <base/stdint.h>
+
+namespace Genode {
+
+	struct Cpu_state
+	{
+		addr_t ip;
+		addr_t sp;
+		addr_t r[13];
+		addr_t lr;
+		addr_t cpsr;
+	};
+}
+
+#endif /* _INCLUDE__ARM__CPU__CPU_STATE_H_ */

base/include/base/allocator.h

@@ -0,0 +1,205 @@
+/*
+ * \brief  Generic allocator interface
+ * \author Norman Feske
+ * \date   2006-04-16
+ */
+
+/*
+ * Copyright (C) 2006-2011 Genode Labs GmbH
+ *
+ * This file is part of the Genode OS framework, which is distributed
+ * under the terms of the GNU General Public License version 2.
+ */
+
+#ifndef _INCLUDE__BASE__ALLOCATOR_H_
+#define _INCLUDE__BASE__ALLOCATOR_H_
+
+#include <base/stdint.h>
+#include <base/exception.h>
+
+namespace Genode {
+
+	class Allocator
+	{
+		public:
+
+			/*********************
+			 ** Exception types **
+			 *********************/
+
+			class Out_of_memory : public Exception { };
+
+			/**
+			 * Destructor
+			 */
+			virtual ~Allocator() { }
+
+			/**
+			 * Allocate block
+			 *
+			 * \param size      block size to allocate
+			 * \param out_addr  resulting pointer to the new block,
+			 *                  undefined in the error case
+			 * \return          true on success
+			 */
+			virtual bool alloc(size_t size, void **out_addr) = 0;
+
+			/**
+			 * Allocate typed block
+			 *
+			 * This template allocates a typed block returned as a pointer to
+			 * a non-void type. By providing this function, we prevent the
+			 * compiler from warning us about "dereferencing type-punned
+			 * pointer will break strict-aliasing rules".
+			 */
+			template <typename T> bool alloc(size_t size, T **out_addr)
+			{
+				void *addr = 0;
+				bool ret = alloc(size, &addr);
+				*out_addr = (T *)addr;
+				return ret;
+			}
+
+			/**
+			 * Free block a previously allocated block
+			 */
+			virtual void free(void *addr, size_t size) = 0;
+
+			/**
+			 * Return total amount of backing store consumed by the allocator
+			 */
+			virtual size_t consumed() { return 0; }
+
+			/**
+			 * Return meta-data overhead per block
+			 */
+			virtual size_t overhead(size_t size) = 0;
+
+
+			/***************************
+			 ** Convenience functions **
+			 ***************************/
+
+			/**
+			 * Allocate block and signal error as an exception
+			 *
+			 * \param   size block size to allocate
+			 * \return  pointer to the new block
+			 * \throw   Out_of_memory
+			 */
+			void *alloc(size_t size)
+			{
+				void *result = 0;
+				if (!alloc(size, &result))
+					throw Out_of_memory();
+
+				return result;
+			}
+	};
+
+
+	class Range_allocator : public Allocator
+	{
+		public:
+
+			/**
+			 * Destructor
+			 */
+			virtual ~Range_allocator() { }
+
+			/**
+			 * Add free address range to allocator
+			 */
+			virtual int add_range(addr_t base, size_t size) = 0;
+
+			/**
+			 * Remove address range from allocator
+			 */
+			virtual int remove_range(addr_t base, size_t size) = 0;
+
+			/**
+			 * Allocate block
+			 *
+			 * \param size      size of new block
+			 * \param out_addr  start address of new block,
+			 *                  undefined in the error case
+			 * \param align     alignment of new block specified
+			 *                  as the power of two
+			 * \return          true on success
+			 */
+			virtual bool alloc_aligned(size_t size, void **out_addr, int align = 0) = 0;
+
+			enum Alloc_return { ALLOC_OK = 0, OUT_OF_METADATA = -1, RANGE_CONFLICT = -2 };
+
+			/**
+			 * Allocate block at address
+			 *
+			 * \param size   size of new block
+			 * \param addr   desired address of block
+			 *
+			 * \return  'ALLOC_OK' on success, or
+			 *          'OUT_OF_METADATA' if meta-data allocation failed, or
+			 *          'RANGE_CONFLICT' if specified range is occupied
+			 */
+			virtual Alloc_return alloc_addr(size_t size, addr_t addr) = 0;
+
+			/**
+			 * Free a previously allocated block
+			 *
+			 * NOTE: We have to declare the 'Allocator::free' function here
+			 * as well to make gcc happy.
+			 */
+			virtual void free(void *addr) = 0;
+			virtual void free(void *addr, size_t size) = 0;
+
+			/**
+			 * Return the sum of available memory
+			 *
+			 * Note that the returned value is not neccessarily allocatable
+			 * because the memory may be fragmented.
+			 */
+			virtual size_t avail() = 0;
+
+			/**
+			 * Check if address is inside an allocated block
+			 *
+			 * \param addr  address to check
+			 *
+			 * \return      true if address is inside an allocated block, false
+			 *              otherwise
+			 */
+			virtual bool valid_addr(addr_t addr) = 0;
+	};
+
+
+	/**
+	 * Destroy object
+	 *
+	 * For destroying an object, we need to specify the allocator
+	 * that was used by the object. Because we cannot pass the
+	 * allocator directly to the delete operator, we mimic the
+	 * delete operator using this template function.
+	 *
+	 * \param T      implicit object type
+	 *
+	 * \param alloc  allocator from which the object was allocated
+	 * \param obj    object to destroy
+	 */
+	template <typename T>
+	void destroy(Allocator *alloc, T *obj)
+	{
+		if (!obj)
+			return;
+
+		/* call destructors */
+		obj->~T();
+
+		/* free memory at the allocator */
+		alloc->free(obj, sizeof(T));
+	}
+}
+
+void *operator new    (Genode::size_t size, Genode::Allocator *allocator);
+void *operator new [] (Genode::size_t size, Genode::Allocator *allocator);
+
+#endif /* _INCLUDE__BASE__ALLOCATOR_H_ */

base/include/base/allocator_avl.h

@@ -0,0 +1,325 @@
+/*
+ * \brief  Interface of AVL-tree-based allocator
+ * \author Norman Feske
+ * \date   2006-04-16
+ *
+ * Each block of the managed address space is present in two AVL trees,
+ * one tree ordered by the base addresses of the blocks and one tree ordered
+ * by the available capacity within the block.
+ */
+
+/*
+ * Copyright (C) 2006-2011 Genode Labs GmbH
+ *
+ * This file is part of the Genode OS framework, which is distributed
+ * under the terms of the GNU General Public License version 2.
+ */
+
+#ifndef _INCLUDE__BASE__ALLOCATOR_AVL_H_
+#define _INCLUDE__BASE__ALLOCATOR_AVL_H_
+
+#include <base/allocator.h>
+#include <base/tslab.h>
+#include <util/avl_tree.h>
+#include <util/misc_math.h>
+
+namespace Genode {
+
+	class Allocator_avl_base : public Range_allocator
+	{
+		private:
+
+			static bool _sum_in_range(addr_t addr, addr_t offset) {
+				return (~0UL - addr > offset); }
+
+		protected:
+
+			class Block : public Avl_node<Block>
+			{
+				private:
+
+					addr_t _addr;       /* base address    */
+					size_t _size;       /* size of block   */
+					bool   _used;       /* block is in use */
+					short  _id;         /* for debugging   */
+					size_t _max_avail;  /* biggest free block size of subtree */
+
+					/**
+					 * Request max_avail value of subtree
+					 */
+					inline size_t _child_max_avail(bool side) {
+						return child(side) ? child(side)->max_avail() : 0; }
+
+					/**
+					 * Query if block can hold a specified subblock
+					 *
+					 * \param n       number of bytes
+					 * \param align   alignment (power of two)
+					 * \return        true if block fits
+					 */
+					inline bool _fits(size_t n, unsigned align = 1) {
+						return ((align_addr(addr(), align) >= addr()) &&
+						        _sum_in_range(align_addr(addr(), align), n) &&
+						        (align_addr(addr(), align) - addr() + n <= avail())); }
+
+				public:
+
+					/**
+					 * Avl_node interface: compare two nodes
+					 */
+					bool higher(Block *a) {
+						return a->_addr >= _addr; }
+
+					/**
+					 * Avl_node interface: update meta data on node rearrangement
+					 */
+					void recompute();
+
+					/**
+					 * Accessor functions
+					 */
+					inline int    id()            { return _id; }
+					inline addr_t addr()          { return _addr; }
+					inline size_t avail()         { return _used ? 0 : _size; }
+					inline size_t size()          { return _size; }
+					inline bool   used()          { return _used; }
+					inline size_t max_avail()     { return _max_avail; }
+					inline void   used(bool used) { _used = used; }
+
+					enum { FREE = false, USED = true };
+
+					/**
+					 * Constructor
+					 *
+					 * This constructor is called from meta-data allocator during
+					 * initialization of new meta-data blocks.
+					 */
+					Block() : _addr(0), _size(0), _used(0), _max_avail(0) { }
+
+					/**
+					 * Constructor
+					 */
+					Block(addr_t addr, size_t size, bool used)
+					: _addr(addr), _size(size), _used(used),
+					  _max_avail(used ? 0 : size)
+					{
+						static int num_blocks;
+						_id = ++num_blocks;
+					}
+
+					/**
+					 * Find best-fitting block
+					 */
+					Block *find_best_fit(size_t size, unsigned align = 1);
+
+					/**
+					 * Find block that contains the specified address range
+					 */
+					Block *find_by_address(addr_t addr, size_t size = 0,
+					                       bool check_overlap = 0);
+
+					/**
+					 * Return sum of available memory in subtree
+					 */
+					size_t avail_in_subtree(void);
+
+					/**
+					 * Debug hooks
+					 */
+					void dump();
+					void dump_dot(int indent = 0);
+			};
+
+		private:
+
+			Avl_tree<Block>  _addr_tree;      /* blocks sorted by base address */
+			Allocator       *_md_alloc;       /* meta-data allocator           */
+			size_t           _md_entry_size;  /* size of block meta-data entry */
+
+			/**
+			 * Alloc meta-data block
+			 */
+			Block *_alloc_block_metadata();
+
+			/**
+			 * Alloc two meta-data blocks in a transactional way
+			 */
+			bool _alloc_two_blocks_metadata(Block **dst1, Block **dst2);
+
+			/**
+			 * Create new block
+			 */
+			int _add_block(Block *block_metadata,
+			               addr_t base, size_t size, bool used);
+
+			/**
+			 * Destroy block
+			 */
+			void _destroy_block(Block *b);
+
+			/**
+			 * Cut specified area from block
+			 *
+			 * The original block gets replaced by (up to) two smaller blocks
+			 * with remaining space.
+			 */
+			void _cut_from_block(Block *b, addr_t cut_addr, size_t cut_size,
+			                     Block *dst1, Block *dst2);
+
+		protected:
+
+			/**
+			 * Find block by specified address
+			 */
+			Block *_find_by_address(addr_t addr, size_t size = 0,
+			                        bool check_overlap = 0) const
+			{
+				Block *b = static_cast<Block *>(_addr_tree.first());
+
+				/* if the tree has one or more nodes, start search */
+				return b ? b->find_by_address(addr, size, check_overlap) : 0;
+			}
+
+			/**
+			 * Constructor
+			 *
+			 * This constructor can only be called from a derived class that
+			 * provides an allocator for block meta-data entries. This way,
+			 * we can attach custom information to block meta data.
+			 */
+			Allocator_avl_base(Allocator *md_alloc, size_t md_entry_size) :
+				_md_alloc(md_alloc), _md_entry_size(md_entry_size) { }
+
+		public:
+
+			/**
+			 * Return address of any block of the allocator
+			 *
+			 * \param out_addr   result that contains address of block
+			 * \return           true if block was found or
+			 *                   false if there is no block available
+			 *
+			 * If no block was found, out_addr is set to zero.
+			 */
+			bool any_block_addr(addr_t *out_addr);
+
+			/**
+			 * Debug hook
+			 */
+			void dump_addr_tree(Block *addr_node = 0);
+
+
+			/*******************************
+			 ** Range allocator interface **
+			 *******************************/
+
+			int          add_range(addr_t base, size_t size);
+			int          remove_range(addr_t base, size_t size);
+			bool         alloc_aligned(size_t size, void **out_addr, int align = 0);
+			Alloc_return alloc_addr(size_t size, addr_t addr);
+			void         free(void *addr);
+			size_t       avail();
+			bool         valid_addr(addr_t addr);
+
+
+			/*************************
+			 ** Allocator interface **
+			 *************************/
+
+			bool alloc(size_t size, void **out_addr) {
+				return Allocator_avl_base::alloc_aligned(size, out_addr); }
+
+			void free(void *addr, size_t) { free(addr); }
+
+			/**
+			 * Return the memory overhead per Block
+			 *
+			 * The overhead is a rough estimation. If a block is somewhere
+			 * in the middle of a free area, we could consider the meta data
+			 * for the two free subareas when calculating the overhead.
+			 *
+			 * The 'sizeof(umword_t)' represents the overhead of the meta-data
+			 * slab allocator.
+			 */
+			size_t overhead(size_t size) { return sizeof(Block) + sizeof(umword_t); }
+	};
+
+
+	/**
+	 * AVL-based allocator with custom meta data attached to each block.
+	 *
+	 * \param BMDT  block meta-data type
+	 */
+	template <typename BMDT>
+	class Allocator_avl_tpl : public Allocator_avl_base
+	{
+		private:
+
+			/*
+			 * Pump up the Block class with custom meta-data type
+			 */
+			class Block : public Allocator_avl_base::Block, public BMDT { };
+
+			Tslab<Block,1024> _metadata;    /* meta-data allocator            */
+			char _initial_md_block[1024];   /* first (static) meta-data block */
+
+		public:
+
+			/**
+			 * Constructor
+			 *
+			 * \param metadata_chunk_alloc  pointer to allocator used to allocate
+			 *                              meta-data blocks. If set to 0,
+			 *                              use ourself for allocating our
+			 *                              meta-data blocks. This works only
+			 *                              if the managed memory is completely
+			 *                              accessible by the allocator.
+			 */
+			explicit Allocator_avl_tpl(Allocator *metadata_chunk_alloc) :
+				Allocator_avl_base(&_metadata, sizeof(Block)),
+				_metadata((metadata_chunk_alloc) ? metadata_chunk_alloc : this,
+				          (Slab_block *)&_initial_md_block) { }
+
+			/**
+			 * Assign custom meta data to block at specified address
+			 */
+			void metadata(void *addr, BMDT bmd) const
+			{
+				Block *b = static_cast<Block *>(_find_by_address((addr_t)addr));
+				if (b) *static_cast<BMDT *>(b) = bmd;
+			}
+
+			/**
+			 * Return meta data that was attached to block at specified address
+			 */
+			BMDT* metadata(void *addr) const
+			{
+				Block *b = static_cast<Block *>(_find_by_address((addr_t)addr));
+				return b && b->used() ? b : 0;
+			}
+
+			int add_range(addr_t base, size_t size)
+			{
+				/*
+				 * We disable the slab block allocation while
+				 * processing add_range to prevent avalanche
+				 * effects when (slab trying to make an allocation
+				 * at Allocator_avl that is empty).
+				 */
+				Allocator *md_bs = _metadata.backing_store();
+				_metadata.backing_store(0);
+				int ret = Allocator_avl_base::add_range(base, size);
+				_metadata.backing_store(md_bs);
+				return ret;
+			}
+	};
+
+
+	/**
+	 * Define AVL-based allocator without any meta data attached to each block
+	 */
+	class Empty { };
+	typedef Allocator_avl_tpl<Empty> Allocator_avl;
+}
+
+#endif /* _INCLUDE__BASE__ALLOCATOR_AVL_H_ */

base/include/base/allocator_guard.h

@@ -0,0 +1,93 @@
+/*
+ * \brief  A guard for arbitrary allocators to limit memory exhaustion
+ * \author Stefan Kalkowski
+ * \date   2010-08-20
+ */
+
+/*
+ * Copyright (C) 2010-2011 Genode Labs GmbH
+ *
+ * This file is part of the Genode OS framework, which is distributed
+ * under the terms of the GNU General Public License version 2.
+ */
+
+#ifndef _ALLOCATOR_GUARD_H_
+#define _ALLOCATOR_GUARD_H_
+
+#include <base/allocator.h>
+#include <base/printf.h>
+#include <base/stdint.h>
+
+namespace Genode {
+
+	/**
+	 * This class acts as guard for arbitrary allocators to limit
+	 * memory exhaustion
+	 */
+	class Allocator_guard : public Allocator
+	{
+		private:
+
+			Allocator *_allocator;  /* allocator to guard */
+			size_t     _amount;     /* total amount */
+			size_t     _consumed;   /* already consumed bytes */
+
+		public:
+
+			Allocator_guard(Allocator *allocator, size_t amount)
+			: _allocator(allocator), _amount(amount), _consumed(0) { }
+
+			/**
+			 * Extend allocation limit
+			 */
+			void upgrade(size_t additional_amount) {
+				_amount += additional_amount; }
+
+
+			/*************************
+			 ** Allocator interface **
+			 *************************/
+
+			/**
+			 * Allocate block
+			 *
+			 * \param size      block size to allocate
+			 * \param out_addr  resulting pointer to the new block,
+			 *                  undefined in the error case
+			 * \return          true on success
+			 */
+			bool alloc(size_t size, void **out_addr)
+			{
+				if ((_amount - _consumed) < (size + _allocator->overhead(size))) {
+					PWRN("Quota exceeded! amount=%zd, size=%zd, consumed=%zd",
+					     _amount, (size + _allocator->overhead(size)), _consumed);
+					return false;
+				}
+				bool b = _allocator->alloc(size, out_addr);
+				if (b)
+					_consumed += size + _allocator->overhead(size);
+				return b;
+			}
+
+			/**
+			 * Free block a previously allocated block
+			 */
+			void free(void *addr, size_t size)
+			{
+				_allocator->free(addr, size);
+				_consumed -= size - _allocator->overhead(size);
+			}
+
+			/**
+			 * Return total amount of backing store consumed by the allocator
+			 */
+			size_t consumed() { return _consumed; }
+
+			/**
+			 * Return meta-data overhead per block
+			 */
+			size_t overhead(size_t size) { return _allocator->overhead(size); }
+	};
+}
+
+#endif /* _ALLOCATOR_GUARD_H_ */

base/include/base/blocking.h

@@ -0,0 +1,28 @@
+/*
+ * \brief  Support for blocking operations
+ * \author Norman Feske
+ * \date   2007-09-06
+ *
+ * In Genode, two operations may block a thread,
+ * waiting at a lock or performing an IPC call.
+ * Both operations may be canceled when killing
+ * the thread. In this case, the thread unblocks
+ * and throws an exception, and therefore, is able
+ * to clean up the thread state before exiting.
+ */
+
+/*
+ * Copyright (C) 2007-2011 Genode Labs GmbH
+ *
+ * This file is part of the Genode OS framework, which is distributed
+ * under the terms of the GNU General Public License version 2.
+ */
+
+#ifndef _INCLUDE__BASE__BLOCKING_H_
+#define _INCLUDE__BASE__BLOCKING_H_
+
+#include <base/exception.h>
+
+namespace Genode {  class Blocking_canceled : public Exception { }; }
+
+#endif /* _INCLUDE__BASE__BLOCKING_H_ */

base/include/base/cancelable_lock.h

@@ -0,0 +1,94 @@
+/*
+ * \brief  Basic locking primitive
+ * \author Norman Feske
+ * \date   2006-07-26
+ */
+
+/*
+ * Copyright (C) 2006-2011 Genode Labs GmbH
+ *
+ * This file is part of the Genode OS framework, which is distributed
+ * under the terms of the GNU General Public License version 2.
+ */
+
+#ifndef _INCLUDE__BASE__CANCELABLE_LOCK_H_
+#define _INCLUDE__BASE__CANCELABLE_LOCK_H_
+
+#include <base/lock_guard.h>
+#include <base/native_types.h>
+#include <base/blocking.h>
+
+namespace Genode {
+
+	class Cancelable_lock
+	{
+		private:
+
+			class Applicant
+			{
+				private:
+
+					Native_thread_id _tid;
+					Applicant       *_to_wake_up;
+
+				public:
+
+					explicit Applicant(Native_thread_id tid)
+					: _tid(tid), _to_wake_up(0) { }
+
+					void applicant_to_wake_up(Applicant *to_wake_up) {
+						_to_wake_up = to_wake_up; }
+
+					Applicant *applicant_to_wake_up() { return _to_wake_up; }
+
+					Native_thread_id tid() { return _tid; }
+
+					/**
+					 * Called from previous lock owner
+					 */
+					void wake_up();
+
+					bool operator == (Applicant &a) { return _tid == a.tid(); }
+					bool operator != (Applicant &a) { return _tid != a.tid(); }
+			};
+
+			/*
+			 * Note that modifications of the applicants queue must be performed
+			 * atomically. Hence, we use the additional spinlock here.
+			 */
+
+			volatile int _spinlock_state;
+			volatile int _state;
+
+			Applicant* volatile _last_applicant;
+			Applicant  _owner;
+
+		public:
+
+			enum State { LOCKED, UNLOCKED };
+
+			/**
+			 * Constructor
+			 */
+			explicit Cancelable_lock(State initial = UNLOCKED);
+
+			/**
+			 * Try to aquire lock an block while lock is not free
+			 *
+			 * This function may throw a Genode::Blocking_canceled exception.
+			 */
+			void lock();
+
+			/**
+			 * Release lock
+			 */
+			void unlock();
+
+			/**
+			 * Lock guard
+			 */
+			typedef Genode::Lock_guard<Cancelable_lock> Guard;
+	};
+}
+
+#endif /* _INCLUDE__BASE__CANCELABLE_LOCK_H_ */

base/include/base/capability.h

@@ -0,0 +1,291 @@
+/*
+ * \brief  Capability
+ * \author Norman Feske
+ * \date   2011-05-22
+ *
+ * A typed capability is a capability tied to one specifiec RPC interface
+ */
+
+/*
+ * Copyright (C) 2011 Genode Labs GmbH
+ *
+ * This file is part of the Genode OS framework, which is distributed
+ * under the terms of the GNU General Public License version 2.
+ */
+
+#ifndef _INCLUDE__BASE__CAPABILITY_H_
+#define _INCLUDE__BASE__CAPABILITY_H_
+
+#include <util/string.h>
+#include <base/rpc.h>
+#include <base/native_types.h>
+
+namespace Genode {
+
+	/**
+	 * Forward declaration needed for internal interfaces of 'Capability'
+	 */
+	class Ipc_client;
+
+
+	/**
+	 * Capability that is not associated with a specific RPC interface
+	 */
+	typedef Native_capability Untyped_capability;
+
+
+	/**
+	 * Capability referring to a specific RPC interface
+	 *
+	 * \param RPC_INTERFACE  class containing the RPC interface declaration
+	 */
+	template <typename RPC_INTERFACE>
+	class Capability : public Untyped_capability
+	{
+		private:
+
+			/**
+			 * Insert RPC arguments into the message buffer
+			 */
+			template <typename ATL>
+			void _marshal_args(Ipc_client &ipc_client, ATL &args);
+
+			void _marshal_args(Ipc_client &, Meta::Empty &) { }
+
+			/**
+			 * Unmarshal single RPC argument from the message buffer
+			 */
+			template <typename T>
+			void _unmarshal_result(Ipc_client &ipc_client, T &arg,
+			                       Meta::Overload_selector<Rpc_arg_out>);
+
+			template <typename T>
+			void _unmarshal_result(Ipc_client &ipc_client, T &arg,
+			                       Meta::Overload_selector<Rpc_arg_inout>);
+
+			template <typename T>
+			void _unmarshal_result(Ipc_client &, T &arg,
+			                       Meta::Overload_selector<Rpc_arg_in>) { }
+
+			/**
+			 * Read RPC results from the message buffer
+			 */
+			template <typename ATL>
+			void _unmarshal_results(Ipc_client &ipc_client, ATL &args);
+
+			void _unmarshal_results(Ipc_client &, Meta::Empty &) { }
+
+			/**
+			 * Check RPC return code for the occurrence of exceptions
+			 *
+			 * A server-side exception is indicated by a non-zero exception
+			 * code. Each exception code corresponds to an entry in the
+			 * exception type list specified in the RPC function declaration.
+			 * The '_check_for_exception' function template throws the
+			 * exception type belonging to the received exception code.
+			 */
+			template <typename EXC_TL>
+			void _check_for_exceptions(Rpc_exception_code const exc_code,
+			                           Meta::Overload_selector<EXC_TL>)
+			{
+				enum { EXCEPTION_CODE = RPC_EXCEPTION_BASE - Meta::Length<EXC_TL>::Value };
+
+				if (exc_code == EXCEPTION_CODE)
+					throw typename EXC_TL::Head();
+
+				_check_for_exceptions(exc_code, Meta::Overload_selector<typename EXC_TL::Tail>());
+			}
+
+			void _check_for_exceptions(Rpc_exception_code const,
+			                           Meta::Overload_selector<Meta::Empty>) { }
+
+			/**
+			 * Perform RPC call, arguments passed a as nested 'Ref_tuple' object
+			 */
+			template <typename IF>
+			void _call(typename IF::Client_args &args, typename IF::Ret_type &ret);
+
+			/**
+			 * Shortcut for querying argument types used in 'call' functions
+			 */
+			template <typename IF, unsigned I>
+			struct Arg
+			{
+				typedef typename Meta::Type_at<typename IF::Client_args, I>::Type Type;
+			};
+
+			template <typename FROM_RPC_INTERFACE>
+			Untyped_capability
+			_check_compatibility(Capability<FROM_RPC_INTERFACE> const &cap)
+			{
+				FROM_RPC_INTERFACE *from = 0;
+				RPC_INTERFACE *to = from;
+				(void)to;
+				return cap;
+			}
+
+		public:
+
+			typedef RPC_INTERFACE Rpc_interface;
+
+			/**
+			 * Constructor
+			 *
+			 * This implicit constructor checks at compile time for the
+			 * compatibility of the source and target capability types. The
+			 * construction is performed only if the target capability type is
+			 * identical to or a base type of the source capability type.
+			 */
+			template <typename FROM_RPC_INTERFACE>
+			Capability(Capability<FROM_RPC_INTERFACE> const &cap)
+			: Untyped_capability(_check_compatibility(cap))
+			{ }
+
+			/**
+			 * Default constructor creates invalid capability
+			 */
+			Capability() { }
+
+			/*
+			 * Suppress warning about uninitialized 'ret' variable in 'call'
+			 * functions on compilers that support the #praga. If this is
+			 * not the case, the pragma can be masked by supplying the
+			 * 'SUPPRESS_GCC_PRAGMA_WUNINITIALIZED' define to the compiler.
+			 */
+			#ifndef SUPPRESS_GCC_PRAGMA_WUNINITIALIZED
+			#pragma GCC diagnostic ignored "-Wuninitialized" call();
+			#endif
+
+			template <typename IF>
+			typename Trait::Call_return<typename IF::Ret_type>::Type
+			call()
+			{
+				Meta::Empty e;
+				typename Trait::Call_return<typename IF::Ret_type>::Type ret;
+				_call<IF>(e, ret);
+				return ret;
+			}
+
+			template <typename IF>
+			typename Trait::Call_return<typename IF::Ret_type>::Type
+			call(typename Arg<IF, 0>::Type v1)
+			{
+				Meta::Empty e;
+				typename IF::Client_args args(v1, e);
+				typename Trait::Call_return<typename IF::Ret_type>::Type ret;
+				_call<IF>(args, ret);
+				return ret;
+			}
+
+			template <typename IF>
+			typename Trait::Call_return<typename IF::Ret_type>::Type
+			call(typename Arg<IF, 0>::Type v1, typename Arg<IF, 1>::Type v2)
+			{
+				Meta::Empty e;
+				typename IF::Client_args args(v1, v2, e);
+				typename Trait::Call_return<typename IF::Ret_type>::Type ret;
+				_call<IF>(args, ret);
+				return ret;
+			}
+
+			template <typename IF>
+			typename Trait::Call_return<typename IF::Ret_type>::Type
+			call(typename Arg<IF, 0>::Type v1, typename Arg<IF, 1>::Type v2,
+			     typename Arg<IF, 2>::Type v3)
+			{
+				Meta::Empty e;
+				typename IF::Client_args args(v1, v2, v3, e);
+				typename Trait::Call_return<typename IF::Ret_type>::Type ret;
+				_call<IF>(args, ret);
+				return ret;
+			}
+
+			template <typename IF>
+			typename Trait::Call_return<typename IF::Ret_type>::Type
+			call(typename Arg<IF, 0>::Type v1, typename Arg<IF, 1>::Type v2,
+			     typename Arg<IF, 2>::Type v3, typename Arg<IF, 3>::Type v4)
+			{
+				Meta::Empty e;
+				typename IF::Client_args args(v1, v2, v3, v4, e);
+				typename Trait::Call_return<typename IF::Ret_type>::Type ret;
+				_call<IF>(args, ret);
+				return ret;
+			}
+
+			template <typename IF>
+			typename Trait::Call_return<typename IF::Ret_type>::Type
+			call(typename Arg<IF, 0>::Type v1, typename Arg<IF, 1>::Type v2,
+			     typename Arg<IF, 2>::Type v3, typename Arg<IF, 3>::Type v4,
+			     typename Arg<IF, 4>::Type v5)
+			{
+				Meta::Empty e;
+				typename IF::Client_args args(v1, v2, v3, v4, v5, e);
+				typename Trait::Call_return<typename IF::Ret_type>::Type ret;
+				_call<IF>(args, ret);
+				return ret;
+			}
+
+			template <typename IF>
+			typename Trait::Call_return<typename IF::Ret_type>::Type
+			call(typename Arg<IF, 0>::Type v1, typename Arg<IF, 1>::Type v2,
+			     typename Arg<IF, 2>::Type v3, typename Arg<IF, 3>::Type v4,
+			     typename Arg<IF, 4>::Type v5, typename Arg<IF, 5>::Type v6)
+			{
+				Meta::Empty e;
+				typename IF::Client_args args(v1, v2, v3, v4, v5, v6, e);
+				typename Trait::Call_return<typename IF::Ret_type>::Type ret;
+				_call<IF>(args, ret);
+				return ret;
+			}
+
+			template <typename IF>
+			typename Trait::Call_return<typename IF::Ret_type>::Type
+			call(typename Arg<IF, 0>::Type v1, typename Arg<IF, 1>::Type v2,
+			     typename Arg<IF, 2>::Type v3, typename Arg<IF, 3>::Type v4,
+			     typename Arg<IF, 4>::Type v5, typename Arg<IF, 5>::Type v6,
+			     typename Arg<IF, 6>::Type v7)
+			{
+				Meta::Empty e;
+				typename IF::Client_args args(v1, v2, v3, v4, v5, v6, v7, e);
+				typename Trait::Call_return<typename IF::Ret_type>::Type ret;
+				_call<IF>(args, ret);
+				return ret;
+			}
+	};
+
+
+	/**
+	 * Convert an untyped capability to a typed capability
+	 */
+	template <typename RPC_INTERFACE>
+	Capability<RPC_INTERFACE>
+	reinterpret_cap_cast(Untyped_capability const &untyped_cap)
+	{
+		Capability<RPC_INTERFACE> typed_cap;
+
+		/*
+		 * The object layout of untyped and typed capabilities is identical.
+		 * Hence we can use memcpy to load the values of the supplied untyped
+		 * capability into a typed capability.
+		 */
+		::Genode::memcpy(&typed_cap, &untyped_cap, sizeof(untyped_cap));
+		return typed_cap;
+	}
+
+
+	/**
+	 * Convert capability type from an interface base type to an inherited
+	 * interface type
+	 */
+	template <typename TO_RPC_INTERFACE, typename FROM_RPC_INTERFACE>
+	Capability<TO_RPC_INTERFACE>
+	static_cap_cast(Capability<FROM_RPC_INTERFACE> cap)
+	{
+		/* check interface compatibility */
+		(void)static_cast<TO_RPC_INTERFACE *>((FROM_RPC_INTERFACE *)0);
+
+		return reinterpret_cap_cast<TO_RPC_INTERFACE>(cap);
+	}
+}
+
+#endif /* _INCLUDE__BASE__CAPABILITY_H_ */

base/include/base/child.h

@@ -0,0 +1,583 @@
+/*
+ * \brief  Child creation framework
+ * \author Norman Feske
+ * \date   2006-07-22
+ */
+
+/*
+ * Copyright (C) 2006-2011 Genode Labs GmbH
+ *
+ * This file is part of the Genode OS framework, which is distributed
+ * under the terms of the GNU General Public License version 2.
+ */
+
+#ifndef _INCLUDE__BASE__CHILD_H_
+#define _INCLUDE__BASE__CHILD_H_
+
+#include <base/rpc_server.h>
+#include <base/heap.h>
+#include <base/process.h>
+#include <base/service.h>
+#include <base/lock.h>
+#include <util/arg_string.h>
+#include <parent/parent.h>
+
+namespace Genode {
+
+	/**
+	 * Child policy interface
+	 *
+	 * A child-policy object is an argument to a 'Child'. It is responsible for
+	 * taking policy decisions regarding the parent interface. Most importantly,
+	 * it defines how session requests are resolved and how session arguments
+	 * are passed to servers when creating sessions.
+	 */
+	struct Child_policy
+	{
+		virtual ~Child_policy() { }
+
+		/**
+		 * Return process name of the child
+		 */
+		virtual const char *name() const = 0;
+
+		/**
+		 * Determine service to provide a session request
+		 *
+		 * \return  Service to be contacted for the new session, or
+		 *          0 if session request could not be resolved
+		 */
+		virtual Service *resolve_session_request(const char *service_name,
+		                                         const char *args)
+		{ return 0; }
+
+		/**
+		 * Apply transformations to session arguments
+		 */
+		virtual void filter_session_args(const char *service,
+		                                 char *args, size_t args_len) { }
+
+		/**
+		 * Register a service provided by the child
+		 *
+		 * \param name   service name
+		 * \param root   interface for creating sessions for the service
+		 * \param alloc  allocator to be used for child-specific
+		 *               meta-data allocations
+		 * \return       true if announcement succeeded, or false if
+		 *               child is not permitted to announce service
+		 */
+		virtual bool announce_service(const char            *name,
+		                              Root_capability        root,
+		                              Allocator             *alloc)
+		{ return false; }
+
+		/**
+		 * Unregister services that had been provided by the child
+		 */
+		virtual void unregister_services() { }
+
+		/**
+		 * Exit child
+		 */
+		virtual void exit(int exit_value)
+		{
+			PDBG("child exited with exit value %d", exit_value);
+		}
+	};
+
+
+	/**
+	 * Implementation of the parent interface that supports resource trading
+	 *
+	 * There are three possible cases of how a session can be provided to
+	 * a child:
+	 *
+	 * # The service is implemented locally
+	 * # The session was obtained by asking our parent
+	 * # The session is provided by one of our children
+	 *
+	 * These types must be differentiated for the quota management when a child
+	 * issues the closing of a session or a transfers quota via our parent
+	 * interface.
+	 *
+	 * If we close a session to a local service, we transfer the session quota
+	 * from our own account to the client.
+	 *
+	 * If we close a parent session, we receive the session quota on our own
+	 * account and must transfer this amount to the session-closing child.
+	 *
+	 * If we close a session provided by a server child, we close the session
+	 * at the server, transfer the session quota from the server's ram session
+	 * to our account, and subsequently transfer the same amount from our
+	 * account to the client.
+	 */
+	class Child : protected Rpc_object<Parent>
+	{
+		private:
+
+			/**
+			 * Representation of an open session
+			 */
+			class Session : public Object_pool<Session>::Entry,
+			                public List<Session>::Element
+			{
+				private:
+
+					enum { IDENT_LEN = 16 };
+
+					/**
+					 * Session capability at the server
+					 */
+					Session_capability _cap;
+
+					/**
+					 * Service interface that was used to create the session
+					 */
+					Service *_service;
+
+					/**
+					 * Server implementing the session
+					 *
+					 * Even though we can normally determine the server of the
+					 * session via '_service->server()', this does not apply
+					 * when destructing a server. During destruction, we use
+					 * the 'Server' pointer as opaque key for revoking active
+					 * sessions of the server. So we keep a copy independent of
+					 * the 'Service' object.
+					 */
+					Server *_server;
+
+					/**
+					 * Total of quota associated with this session
+					 */
+					size_t _donated_ram_quota;
+
+					/**
+					 * Name of session, used for debugging
+					 */
+					char _ident[IDENT_LEN];
+
+				public:
+
+					/**
+					 * Constructor
+					 *
+					 * \param session    session capability
+					 * \param service    service that implements the session
+					 * \param ram_quota  initial quota donation associated with
+					 *                   the session
+					 * \param ident      optional session identifier, used for
+					 *                   debugging
+					 */
+					Session(Session_capability session, Service *service,
+					        size_t ram_quota, const char *ident = "<noname>")
+					:
+						Object_pool<Session>::Entry(session), _cap(session),
+						_service(service), _server(service->server()),
+						_donated_ram_quota(ram_quota) {
+						strncpy(_ident, ident, sizeof(_ident)); }
+
+					/**
+					 * Default constructor creates invalid session
+					 */
+					Session() : _service(0), _donated_ram_quota(0) { }
+
+					/**
+					 * Extend amount of ram attached to the session
+					 */
+					void upgrade_ram_quota(size_t ram_quota) {
+						_donated_ram_quota += ram_quota; }
+
+					/**
+					 * Accessors
+					 */
+					Session_capability cap()               const { return _cap; }
+					size_t             donated_ram_quota() const { return _donated_ram_quota; }
+					bool               valid()             const { return _service != 0; }
+					Service           *service()           const { return _service; }
+					Server            *server()            const { return _server; }
+					const char        *ident()             const { return _ident; }
+			};
+
+
+			/**
+			 * Guard for transferring quota donation
+			 *
+			 * This class is used to provide transactional semantics of quota
+			 * transfers. Establishing a new session involves several steps, in
+			 * particular subsequent quota transfers. If one intermediate step
+			 * fails, we need to revert all quota transfers that already took
+			 * place. When instantated at a local scope, a 'Transfer' object
+			 * guards a quota transfer. If the scope is left without prior an
+			 * explicit acknowledgement of the transfer (for example via an
+			 * exception), the destructor the 'Transfer' object reverts the
+			 * transfer in flight.
+			 */
+			class Transfer {
+
+				bool                   _ack;
+				size_t                 _quantum;
+				Ram_session_capability _from;
+				Ram_session_capability _to;
+
+				public:
+
+					/**
+					 * Constructor
+					 *
+					 * \param quantim  number of bytes to transfer
+					 * \param from     donator RAM session
+					 * \param to       receiver RAM session
+					 */
+					Transfer(size_t quantum,
+					         Ram_session_capability from,
+					         Ram_session_capability to)
+					: _ack(false), _quantum(quantum), _from(from), _to(to)
+					{
+						if (_from.valid() && _to.valid() &&
+						    Ram_session_client(_from).transfer_quota(_to, quantum)) {
+							PWRN("not enough quota for a donation of %zd bytes", quantum);
+							throw Quota_exceeded();
+						}
+					}
+
+					/**
+					 * Destructor
+					 *
+					 * The destructor will be called when leaving the scope of
+					 * the 'session' function. If the scope is left because of
+					 * an error (e.g., an exception), the donation will be
+					 * reverted.
+					 */
+					~Transfer()
+					{
+						if (!_ack && _from.valid() && _to.valid())
+							Ram_session_client(_to).transfer_quota(_from, _quantum);
+					}
+
+					/**
+					 * Acknowledge quota donation
+					 */
+					void acknowledge() { _ack = true; }
+			};
+
+			/* RAM session that contains the quota of the child */
+			Ram_session_capability  _ram;
+			Ram_session_client      _ram_session_client;
+
+			/* CPU session that contains the quota of the child */
+			Cpu_session_capability  _cpu;
+
+			/* RM session representing the address space of the child */
+			Rm_session_capability   _rm;
+
+			/* heap for child-specific allocations using the child's quota */
+			Heap                    _heap;
+
+			Rpc_entrypoint         *_entrypoint;
+			Parent_capability       _parent_cap;
+
+			Process                 _process;
+
+			/* sessions opened by the child */
+			Lock                    _lock;   /* protect list manipulation */
+			Object_pool<Session>    _session_pool;
+			List<Session>           _session_list;
+
+			/* child policy */
+			Child_policy           *_policy;
+
+			/**
+			 * Session-argument buffer
+			 */
+			char _args[Parent::Session_args::MAX_SIZE];
+
+			/**
+			 * Attach session information to a child
+			 *
+			 * \throw Ram_session::Quota_exceeded  the child's heap partition cannot
+			 *                                     hold the session meta data
+			 */
+			void _add_session(const Session &s)
+			{
+				Lock::Guard lock_guard(_lock);
+
+				/*
+				 * Store session information in a new child's meta data
+				 * structure.  The allocation from 'heap()' may throw a
+				 * 'Ram_session::Quota_exceeded' exception.
+				 */
+				Session *session = 0;
+				try {
+					session = new (heap())
+					          Session(s.cap(), s.service(),
+					                  s.donated_ram_quota(), s.ident()); }
+				catch (Allocator::Out_of_memory) {
+					throw Parent::Quota_exceeded(); }
+
+				/* these functions may also throw 'Ram_session::Quota_exceeded' */
+				_session_pool.insert(session);
+				_session_list.insert(session);
+			}
+
+			/**
+			 * Close session and revert quota donation associated with it
+			 */
+			void _remove_session(Session *s)
+			{
+				Lock::Guard lock_guard(_lock);
+
+				/* forget about this session */
+				_session_pool.remove(s);
+				_session_list.remove(s);
+
+				/* return session quota to the ram session of the child */
+				if (env()->ram_session()->transfer_quota(_ram, s->donated_ram_quota()))
+					PERR("We ran out of our own quota");
+
+				destroy(heap(), s);
+			}
+
+		public:
+
+			/**
+			 * Constructor
+			 *
+			 * \param elf_ds       dataspace containing the binary
+			 * \param ram          RAM session with the child's quota
+			 * \param cpu          CPU session with the child's quota
+			 * \param entrypoint   server entrypoint to serve the parent interface
+			 * \param policy       child policy
+			 *
+			 * If assigning a separate entry point to each child, the host of
+			 * multiple children is able to handle a blocking invocation of
+			 * the parent interface of one child while still maintaining the
+			 * service to other children, each having an independent entry
+			 * point.
+			 */
+			Child(Dataspace_capability    elf_ds,
+			      Ram_session_capability  ram,
+			      Cpu_session_capability  cpu,
+			      Rm_session_capability   rm,
+			      Rpc_entrypoint         *entrypoint,
+			      Child_policy           *policy)
+			:
+				_ram(ram), _ram_session_client(ram), _cpu(cpu), _rm(rm),
+				_heap(&_ram_session_client, env()->rm_session()),
+				_entrypoint(entrypoint),
+				_parent_cap(_entrypoint->manage(this)),
+				_process(elf_ds, ram, cpu, rm, _parent_cap, policy->name(), 0),
+				_policy(policy)
+			{ }
+
+			/**
+			 * Destructor
+			 *
+			 * On destruction of a child, we close all sessions of the child to
+			 * other services.
+			 */
+			virtual ~Child()
+			{
+				_entrypoint->dissolve(this);
+				_policy->unregister_services();
+
+				for (Session *s; (s = _session_pool.first()); )
+					close(s->cap());
+			}
+
+			/**
+			 * Return heap that uses the child's quota
+			 */
+			Allocator *heap() { return &_heap; }
+
+			Ram_session_capability ram_session_cap() const { return _ram; }
+			Cpu_session_capability cpu_session_cap() const { return _cpu; }
+			Rm_session_capability   rm_session_cap() const { return _rm;  }
+
+			/**
+			 * Discard all sessions to specified service
+			 *
+			 * When this function is called, we assume the server protection
+			 * domain to be dead and all that all server quota was already
+			 * transferred back to our own 'env()->ram_session()' account. Note
+			 * that the specified server object may not exist anymore. We do
+			 * not de-reference the server argument in here!
+			 */
+			void revoke_server(const Server *server)
+			{
+				while (1) {
+
+					/* search session belonging to the specified server */
+					Session *s = _session_list.first();
+					for ( ; s && (s->server() != server); s = s->next());
+
+					/* if no matching session exists, we are done */
+					if (!s) return;
+
+					_remove_session(s);
+				}
+			}
+
+
+			/**********************
+			 ** Parent interface **
+			 **********************/
+
+			void announce(Service_name const &name, Root_capability root)
+			{
+				if (!name.is_valid_string()) return;
+
+				_policy->announce_service(name.string(), root, heap());
+			}
+
+			Session_capability session(Service_name const &name, Session_args const &args)
+			{
+				if (!name.is_valid_string() || !args.is_valid_string()) throw Unavailable();
+
+				/* return sessions that we created for the child */
+				if (!strcmp("Env::ram_session", name.string())) return _ram;
+				if (!strcmp("Env::cpu_session", name.string())) return _cpu;
+				if (!strcmp("Env::rm_session",  name.string())) return _rm;
+				if (!strcmp("Env::pd_session",  name.string())) return _process.pd_session_cap();
+
+				/* filter session arguments according to the child policy */
+				strncpy(_args, args.string(), sizeof(_args));
+				_policy->filter_session_args(name.string(), _args, sizeof(_args));
+
+				/* transfer the quota donation from the child's account to ourself */
+				size_t ram_quota = Arg_string::find_arg(_args, "ram_quota").long_value(0);
+
+				Transfer donation_from_child(ram_quota, _ram, env()->ram_session_cap());
+
+				Service *service = _policy->resolve_session_request(name.string(), _args);
+
+				/* raise an error if no matching service provider could be found */
+				if (!service)
+					throw Service_denied();
+
+				/* transfer session quota from ourself to the service provider */
+				Transfer donation_to_service(ram_quota, env()->ram_session_cap(),
+				                             service->ram_session_cap());
+
+				/* create session */
+				Session_capability cap;
+				try { cap = service->session(_args); }
+				catch (Service::Invalid_args)   { throw Service_denied(); }
+				catch (Service::Unavailable)    { throw Service_denied(); }
+				catch (Service::Quota_exceeded) { throw Quota_exceeded(); }
+
+				/* register session */
+				try { _add_session(Session(cap, service, ram_quota, name.string())); }
+				catch (Ram_session::Quota_exceeded) { throw Quota_exceeded(); }
+
+				/* finish transaction */
+				donation_from_child.acknowledge();
+				donation_to_service.acknowledge();
+
+				return cap;
+			}
+
+			void upgrade(Session_capability to_session, Upgrade_args const &args)
+			{
+				Session *s = _session_pool.obj_by_cap(to_session);
+
+				if (!s) {
+					PWRN("no session structure found - nothing to be done\n");
+					return;
+				}
+
+				if (!args.is_valid_string()) {
+					PWRN("no valid session-upgrade arguments");
+					return;
+				}
+
+				size_t ram_quota = Arg_string::find_arg(args.string(), "ram_quota").ulong_value(0);
+
+				/* transfer quota from client to ourself */
+				Transfer donation_from_child(ram_quota, _ram,
+				                             env()->ram_session_cap());
+
+				/* transfer session quota from ourself to the service provider */
+				Transfer donation_to_service(ram_quota, env()->ram_session_cap(),
+				                             s->service()->ram_session_cap());
+
+				try { s->service()->upgrade(to_session, args.string()); }
+				catch (Service::Quota_exceeded) { throw Quota_exceeded(); }
+
+				/* remember new amount attached to the session */
+				s->upgrade_ram_quota(ram_quota);
+
+				/* finish transaction */
+				donation_from_child.acknowledge();
+				donation_to_service.acknowledge();
+			}
+
+			void close(Session_capability session_cap)
+			{
+				/* refuse to close the child's initial sessions */
+				if (session_cap.local_name() == _ram.local_name()
+				 || session_cap.local_name() == _cpu.local_name()
+				 || session_cap.local_name() == _rm.local_name()
+				 || session_cap.local_name() == _process.pd_session_cap().local_name())
+					return;
+
+				Session *s = _session_pool.obj_by_cap(session_cap);
+
+				if (!s) {
+					PWRN("no session structure found");
+					return;
+				}
+
+				/*
+				 * There is a chance that the server is not responding to
+				 * the 'close' call, making us block infinitely. However,
+				 * by using core's cancel-blocking mechanism, we can cancel
+				 * the 'close' call by another (watchdog) thread that
+				 * invokes 'cancel_blocking' at our thread after a timeout.
+				 * The unblocking is reflected at the API level as an
+				 * 'Blocking_canceled' exception. We catch this exception
+				 * to proceed with normal operation after being unblocked.
+				 */
+				try { s->service()->close(s->cap()); }
+				catch (Blocking_canceled) {
+					PDBG("Got Blocking_canceled exception during %s->close call\n",
+					     s->ident()); }
+
+				/*
+				 * If the session was provided by a child of us,
+				 * 'server()->ram_session_cap()' returns the RAM session of the
+				 * corresponding child. Since the session to the server is
+				 * closed now, we expect that the server released all donated
+				 * resources and we can decrease the servers' quota.
+				 *
+				 * If this goes wrong, the server is misbehaving.
+				 */
+				if (s->service()->ram_session_cap().valid()) {
+					Ram_session_client server_ram(s->service()->ram_session_cap());
+					if (server_ram.transfer_quota(env()->ram_session_cap(),
+					                              s->donated_ram_quota())) {
+						PERR("Misbehaving server '%s'!", s->service()->name());
+					}
+				}
+
+				_remove_session(s);
+			}
+
+			void exit(int exit_value)
+			{
+				/*
+				 * This function receives the hint from the child that now, its
+				 * a good time to kill it. An inherited child class could use
+				 * this hint to schedule the destruction of the child object.
+				 *
+				 * Note that the child object must not be destructed from by
+				 * this function because it is executed by the thread contained
+				 * in the child object.
+				 */
+				return _policy->exit(exit_value);
+			}
+	};
+}
+
+#endif /* _INCLUDE__BASE__CHILD_H_ */

base/include/base/connection.h

@@ -0,0 +1,98 @@
+/*
+ * \brief  Connection to a service
+ * \author Norman Feske
+ * \date   2008-08-22
+ */
+
+/*
+ * Copyright (C) 2008-2011 Genode Labs GmbH
+ *
+ * This file is part of the Genode OS framework, which is distributed
+ * under the terms of the GNU General Public License version 2.
+ */
+
+#ifndef _INCLUDE__BASE__CONNECTION_H_
+#define _INCLUDE__BASE__CONNECTION_H_
+
+#include <base/env.h>
+#include <base/capability.h>
+
+namespace Genode {
+
+	/**
+	 * Representation of an open connection to a service
+	 */
+	template <typename SESSION_TYPE>
+	class Connection
+	{
+		public:
+
+			enum On_destruction { CLOSE = false, KEEP_OPEN = true };
+
+		private:
+
+			/*
+			 * Because the argument string is used with the parent interface,
+			 * the message-buffer size of the parent-interface provides a
+			 * realistic upper bound for dimensioning the format- string
+			 * buffer.
+			 */
+			enum { FORMAT_STRING_SIZE = Parent::Session_args::MAX_SIZE };
+
+			Capability<SESSION_TYPE> _cap;
+
+			On_destruction _on_destruction;
+
+		public:
+
+			/**
+			 * Constructor
+			 *
+			 * \param cap  session capability
+			 * \param od   session policy applied when destructing the connection
+			 */
+			Connection(Capability<SESSION_TYPE> cap, On_destruction od = CLOSE):
+				_cap(cap), _on_destruction(od) { }
+
+			/**
+			 * Destructor
+			 */
+			~Connection()
+			{
+				if (_on_destruction == CLOSE)
+					env()->parent()->close(_cap);
+			}
+
+			/**
+			 * Return session capability
+			 */
+			Capability<SESSION_TYPE> cap() const { return _cap; }
+
+			/**
+			 * Define session policy
+			 */
+			void on_destruction(On_destruction od) { _on_destruction = od; }
+
+			/**
+			 * Shortcut for env()->parent()->session() function
+			 */
+			Capability<SESSION_TYPE> session(const char *format_args, ...)
+			{
+				char buf[FORMAT_STRING_SIZE];
+
+				/* process format string */
+				va_list list;
+				va_start(list, format_args);
+
+				String_console sc(buf, FORMAT_STRING_SIZE);
+				sc.vprintf(format_args, list);
+
+				va_end(list);
+
+				/* call parent interface with the resulting argument buffer */
+				return env()->parent()->session<SESSION_TYPE>(buf);
+			}
+	};
+}
+
+#endif /* _INCLUDE__BASE__CONNECTION_H_ */

base/include/base/console.h

@@ -0,0 +1,60 @@
+/*
+ * \brief  Simple console for debug output
+ * \author Norman Feske
+ * \date   2006-04-07
+ */
+
+/*
+ * Copyright (C) 2006-2011 Genode Labs GmbH
+ *
+ * This file is part of the Genode OS framework, which is distributed
+ * under the terms of the GNU General Public License version 2.
+ */
+
+#ifndef _INCLUDE__BASE__CONSOLE_H_
+#define _INCLUDE__BASE__CONSOLE_H_
+
+#include <stdarg.h>
+
+namespace Genode {
+
+	class Console
+	{
+		public:
+
+			virtual ~Console() {}
+
+			/**
+			 * Print format string
+			 */
+			void  printf(const char *format, ...) __attribute__((format(printf, 2, 3)));
+			void vprintf(const char *format, va_list) __attribute__((format(printf, 2, 0)));
+
+		protected:
+
+			/**
+			 * Backend function for the output of one character
+			 */
+			virtual void _out_char(char c) = 0;
+
+			/**
+			 * Backend function for the output of a null-terminated string
+			 *
+			 * The default implementation uses _out_char. This function may
+			 * be overridden by the backend for improving efficiency.
+			 *
+			 * This function is virtual to enable the use an optimized
+			 * string-output functions on some target platforms, e.g.
+			 * a kernel debugger that offers a string-output syscall. The
+			 * default implementation calls '_out_char' for each character.
+			 */
+			virtual void _out_string(const char *str);
+
+		private:
+
+			template <typename T> void _out_unsigned(T value, unsigned base = 10, int pad = 0);
+			template <typename T> void _out_signed(T value, unsigned base = 10);
+	};
+}
+
+#endif /* _INCLUDE__BASE__CONSOLE_H_ */

base/include/base/cpu_state.h

@@ -0,0 +1,35 @@
+/*
+ * \brief  CPU state
+ * \author Christian Prochaska
+ * \date   2011-04-15
+ *
+ * This file contains the generic part of the CPU state.
+ */
+
+/*
+ * Copyright (C) 2011 Genode Labs GmbH
+ *
+ * This file is part of the Genode OS framework, which is distributed
+ * under the terms of the GNU General Public License version 2.
+ */
+
+#ifndef _INCLUDE__BASE__CPU_STATE_H_
+#define _INCLUDE__BASE__CPU_STATE_H_
+
+#include <base/stdint.h>
+
+namespace Genode {
+
+	struct Cpu_state
+	{
+		addr_t ip;   /* instruction pointer */
+		addr_t sp;   /* stack pointer       */
+
+		/**
+		 * Constructor
+		 */
+		Cpu_state(): ip(0), sp(0) { }
+	};
+}
+
+#endif /* _INCLUDE__BASE__CPU_STATE_H_ */

base/include/base/crt0.h

@@ -0,0 +1,45 @@
+/*
+ * \brief  Startup code and program image specifica
+ * \author Christian Helmuth
+ * \date   2006-05-16
+ */
+
+/*
+ * Copyright (C) 2006-2011 Genode Labs GmbH
+ *
+ * This file is part of the Genode OS framework, which is distributed
+ * under the terms of the GNU General Public License version 2.
+ */
+
+#ifndef _INCLUDE__BASE__CRT0_H_
+#define _INCLUDE__BASE__CRT0_H_
+
+
+/************************************
+ ** Program image exported symbols **
+ ************************************/
+
+extern unsigned _prog_img_beg;  /* begin of program image (link address) */
+extern unsigned _prog_img_end;  /* end of program image */
+
+extern void (*_ctors_start)();  /* begin of constructor table */
+extern void (*_ctors_end)();    /* end of constructor table */
+extern void (*_dtors_start)();  /* begin of destructor table */
+extern void (*_dtors_end)();    /* end of destructor table */
+
+extern unsigned _start;         /* program entry point */
+extern unsigned _stack_low;     /* lower bound of intial stack */
+extern unsigned _stack_high;    /* upper bound of intial stack */
+
+
+/***************************************************
+ ** Parameters for parent capability construction **
+ ***************************************************/
+
+/*
+ * The protection domain creator initializes the information about
+ * the parent capability prior the execution of the main thread.
+ */
+extern unsigned long _parent_cap;
+
+#endif /* _INCLUDE__BASE__CRT0_H_ */

base/include/base/elf.h

@@ -0,0 +1,157 @@
+/*
+ * \brief  ELF binary utility
+ * \author Christian Helmuth
+ * \date   2006-05-04
+ */
+
+/*
+ * Copyright (C) 2006-2011 Genode Labs GmbH
+ *
+ * This file is part of the Genode OS framework, which is distributed
+ * under the terms of the GNU General Public License version 2.
+ */
+
+#ifndef _INCLUDE__BASE__ELF_H_
+#define _INCLUDE__BASE__ELF_H_
+
+#include <base/stdint.h>
+
+namespace Genode {
+
+	class Elf_segment;
+
+	class Elf_binary
+	{
+		public:
+
+			/**
+			 * Default constructor creates invalid object
+			 */
+			Elf_binary() : _valid(false) { }
+
+			/**
+			 * Constructor
+			 *
+			 * The object is only useful if valid() returns true.
+			 */
+			explicit Elf_binary(addr_t start);
+
+			/* special types */
+
+			struct Flags {
+				unsigned r:1;
+				unsigned w:1;
+				unsigned x:1;
+				unsigned skip:1;
+			};
+
+			/**
+			 * Read information about program segments
+			 *
+			 * \return  properties of the specified program segment
+			 */
+			Elf_segment get_segment(unsigned num);
+
+			/**
+			 * Check validity
+			 */
+			bool valid() { return _valid; }
+
+			/**
+			 * Check for dynamic elf
+			 */
+			bool is_dynamically_linked() { return (_dynamic && _interp); }
+
+
+			/************************
+			 ** Accessor functions **
+			 ************************/
+
+			addr_t entry() { return valid() ? _entry : 0; }
+
+		private:
+
+			/* validity indicator indicates if the loaded ELF is valid and supported */
+			bool _valid;
+
+			/* dynamically linked */
+			bool _dynamic;
+
+			/* dynamic linker name matches 'genode' */
+			bool _interp;
+
+			/* ELF start pointer in memory */
+			addr_t _start;
+
+			/* ELF entry point */
+			addr_t _entry;
+
+			/* program segments */
+			addr_t   _ph_table;
+			size_t   _phentsize;
+			unsigned _phnum;
+
+
+			/************
+			 ** Helper **
+			 ************/
+
+			/**
+			 * Check ELF header compatibility
+			 */
+			int _ehdr_check_compat();
+
+			/**
+			 * Check program header compatibility
+			 */
+			int _ph_table_check_compat();
+
+			/**
+			 * Check for dynamic program segments
+			 */
+			bool _dynamic_check_compat(unsigned type);
+	};
+
+
+	class Elf_segment
+	{
+		public:
+
+			/**
+			 * Standard constructor creates invalid object
+			 */
+			Elf_segment() : _valid(false) { }
+
+			Elf_segment(const Elf_binary *elf, void *start, size_t file_offset,
+			            size_t file_size, size_t mem_size, Elf_binary::Flags flags)
+			: _elf(elf), _start((unsigned char *)start), _file_offset(file_offset),
+			  _file_size(file_size), _mem_size(mem_size), _flags(flags)
+			{
+				_valid = elf ? true : false;
+			}
+
+			const Elf_binary *        elf() { return _elf; }
+			void *                  start() { return (void *)_start; }
+			size_t            file_offset() { return _file_offset; }
+			size_t              file_size() { return _file_size; }
+			size_t               mem_size() { return _mem_size; }
+			Elf_binary::Flags       flags() { return _flags; }
+
+			/**
+			 * Check validity
+			 */
+			bool valid() { return _valid; }
+
+		private:
+
+			const Elf_binary *_elf;
+			bool              _valid;       /* validity indicator */
+			unsigned char    *_start;
+			size_t            _file_offset;
+			size_t            _file_size;
+			size_t            _mem_size;
+			Elf_binary::Flags _flags;
+	};
+}
+
+#endif /* _INCLUDE__BASE__ELF_H_ */

base/include/base/env.h

@@ -0,0 +1,88 @@
+/*
+ * \brief  Environment of a process
+ * \author Norman Feske
+ * \date   2006-07-01
+ *
+ * The environment of a Genode process is defined by its parent and initialized
+ * on startup.
+ */
+
+/*
+ * Copyright (C) 2006-2011 Genode Labs GmbH
+ *
+ * This file is part of the Genode OS framework, which is distributed
+ * under the terms of the GNU General Public License version 2.
+ */
+
+#ifndef _INCLUDE__BASE__ENV_H_
+#define _INCLUDE__BASE__ENV_H_
+
+#include <parent/capability.h>
+#include <parent/parent.h>
+#include <rm_session/rm_session.h>
+#include <ram_session/ram_session.h>
+#include <cpu_session/cpu_session.h>
+#include <pd_session/pd_session.h>
+#include <base/allocator.h>
+#include <base/snprintf.h>
+#include <base/lock.h>
+
+namespace Genode {
+
+	class Env
+	{
+		public:
+
+			virtual ~Env() { }
+
+			/**
+			 * Communication channel to our parent
+			 */
+			virtual Parent *parent() = 0;
+
+			/**
+			 * RAM session for the program
+			 *
+			 * The RAM Session represents a quota of memory that is
+			 * available to the program. Quota can be used to allocate
+			 * RAM-Dataspaces.
+			 */
+			virtual Ram_session *ram_session() = 0;
+			virtual Ram_session_capability ram_session_cap() = 0;
+
+			/**
+			 * CPU session for the program
+			 *
+			 * This session is used to create threads.
+			 */
+			virtual Cpu_session *cpu_session() = 0;
+
+			/**
+			 * Region manager session of the program
+			 */
+			virtual Rm_session *rm_session() = 0;
+
+			/**
+			 * Pd session of the program
+			 */
+			virtual Pd_session *pd_session() = 0;
+
+			/**
+			 * Heap backed by the ram_session of the
+			 * environment.
+			 */
+			virtual Allocator *heap() = 0;
+	};
+
+	extern Env *env();
+
+	/**
+	 * Return parent capability
+	 *
+	 * Platforms have to implement this function for environment
+	 * initialization.
+	 */
+	Parent_capability parent_cap();
+}
+
+#endif /* _INCLUDE__BASE__ENV_H_ */

base/include/base/errno.h

@@ -0,0 +1,22 @@
+/*
+ * \brief  Genode error codes
+ * \author Norman Feske
+ * \date   2006-04-28
+ */
+
+/*
+ * Copyright (C) 2006-2011 Genode Labs GmbH
+ *
+ * This file is part of the Genode OS framework, which is distributed
+ * under the terms of the GNU General Public License version 2.
+ */
+
+#ifndef _INCLUDE__BASE__ERRNO_H_
+#define _INCLUDE__BASE__ERRNO_H_
+
+namespace Genode {
+
+	enum { ERR_INVALID_OBJECT = -70000, };
+}
+
+#endif /* _INCLUDE__BASE__ERRNO_H_ */

base/include/base/exception.h

@@ -0,0 +1,19 @@
+/*
+ * \brief  Exception base class
+ * \author Norman Feske
+ * \date   2008-03-22
+ */
+
+/*
+ * Copyright (C) 2008-2011 Genode Labs GmbH
+ *
+ * This file is part of the Genode OS framework, which is distributed
+ * under the terms of the GNU General Public License version 2.
+ */
+
+#ifndef _INCLUDE__BASE__EXCEPTION_H_
+#define _INCLUDE__BASE__EXCEPTION_H_
+
+namespace Genode { class Exception { }; }
+
+#endif /* _INCLUDE__BASE__EXCEPTION_H_ */

base/include/base/heap.h

@@ -0,0 +1,182 @@
+/*
+ * \brief  Heap partition
+ * \author Norman Feske
+ * \date   2006-05-15
+ */
+
+/*
+ * Copyright (C) 2006-2011 Genode Labs GmbH
+ *
+ * This file is part of the Genode OS framework, which is distributed
+ * under the terms of the GNU General Public License version 2.
+ */
+
+#ifndef _INCLUDE__BASE__HEAP_H_
+#define _INCLUDE__BASE__HEAP_H_
+
+#include <util/list.h>
+#include <ram_session/ram_session.h>
+#include <rm_session/rm_session.h>
+#include <base/allocator_avl.h>
+#include <base/lock.h>
+
+namespace Genode {
+
+	/**
+	 * Heap that uses dataspaces as backing store
+	 *
+	 * The heap class provides an allocator that uses a list of dataspaces of a ram
+	 * session as backing store. One dataspace may be used for holding multiple blocks.
+	 */
+	class Heap : public Allocator
+	{
+		private:
+
+			enum {
+				MIN_CHUNK_SIZE =    4*1024,  /* in machine words */
+				MAX_CHUNK_SIZE = 1024*1024
+			};
+
+			class Dataspace : public List<Dataspace>::Element
+			{
+				public:
+
+					Ram_dataspace_capability cap;
+					void  *local_addr;
+			};
+
+			class Dataspace_pool : public List<Dataspace>
+			{
+				private:
+
+					Ram_session *_ram_session;  /* ram session for backing store */
+					Rm_session  *_rm_session;   /* region manager                */
+
+				public:
+
+					/**
+					 * Constructor
+					 */
+					Dataspace_pool(Ram_session *ram_session, Rm_session *rm_session):
+						_ram_session(ram_session), _rm_session(rm_session) { }
+
+					/**
+					 * Destructor
+					 */
+					~Dataspace_pool();
+
+					/**
+					 * Expand dataspace by specified size
+					 *
+					 * \param size      number of bytes to add to the dataspace pool
+					 * \param md_alloc  allocator to expand. This allocator is also
+					 *                  used for meta data allocation (only after
+					 *                  being successfully expanded).
+					 * \throw           Rm_session::Invalid_dataspace,
+					 *                  Rm_session::Region_conflict
+					 * \return          0 on success or negative error code
+					 */
+					int expand(size_t size, Range_allocator *alloc);
+			};
+
+			/*
+			 * NOTE: The order of the member variables is important for
+			 *       the calling order of the destructors!
+			 */
+
+			Lock           _lock;
+			Dataspace_pool _ds_pool;      /* list of dataspaces */
+			Allocator_avl  _alloc;        /* local allocator    */
+			size_t         _quota_limit;
+			size_t         _quota_used;
+			size_t         _chunk_size;
+
+			/**
+			 * Try to allocate block at our local allocator
+			 *
+			 * \return true on success
+			 *
+			 * This function is a utility used by 'alloc' to avoid
+			 * code duplication.
+			 */
+			bool _try_local_alloc(size_t size, void **out_addr);
+
+		public:
+
+			enum { UNLIMITED = ~0 };
+
+			Heap(Ram_session *ram_session,
+			     Rm_session  *rm_session,
+			     size_t       quota_limit = UNLIMITED,
+			     void        *static_addr = 0,
+			     size_t       static_size = 0)
+			:
+				_ds_pool(ram_session, rm_session),
+				_alloc(0),
+				_quota_limit(quota_limit), _quota_used(0),
+				_chunk_size(MIN_CHUNK_SIZE)
+			{
+				if (static_addr)
+					_alloc.add_range((addr_t)static_addr, static_size);
+			}
+
+			/**
+			 * Reconfigure quota limit
+			 *
+			 * \return  negative error code if new quota limit is higher than
+			 *          currently used quota.
+			 */
+			int quota_limit(size_t new_quota_limit);
+
+
+			/*************************
+			 ** Allocator interface **
+			 *************************/
+
+			bool   alloc(size_t, void **);
+			void   free(void *, size_t);
+			size_t consumed() { return _quota_used; }
+			size_t overhead(size_t size) { return _alloc.overhead(size); }
+	};
+
+
+	/**
+	 * Heap that allocates each block at a separate dataspace
+	 */
+	class Sliced_heap : public Allocator
+	{
+		private:
+
+			class Block;
+
+			Ram_session    *_ram_session;  /* ram session for backing store */
+			Rm_session     *_rm_session;   /* region manager                */
+			size_t          _consumed;     /* number of allocated bytes     */
+			List<Block>     _block_list;   /* list of allocated blocks      */
+			Lock            _lock;         /* serialize allocations         */
+
+		public:
+
+			/**
+			 * Constructor
+			 */
+			Sliced_heap(Ram_session *ram_session, Rm_session *rm_session);
+
+			/**
+			 * Destructor
+			 */
+			~Sliced_heap();
+
+
+			/*************************
+			 ** Allocator interface **
+			 *************************/
+
+			bool   alloc(size_t, void **);
+			void   free(void *, size_t);
+			size_t consumed() { return _consumed; }
+			size_t overhead(size_t size);
+	};
+}
+
+#endif /* _INCLUDE__BASE__HEAP_H_ */

base/include/base/ipc.h

@@ -0,0 +1,41 @@
+/*
+ * \brief  Generic IPC infrastructure
+ * \author Norman Feske
+ * \date   2009-10-02
+ *
+ * This file is used for platforms that only use the generic IPC API. A platform
+ * may extend the generic API with platform-specific marshalling operators by
+ * providing a custom version of 'ipc.h' in its 'base-<platform>' repository.
+ */
+
+/*
+ * Copyright (C) 2009-2011 Genode Labs GmbH
+ *
+ * This file is part of the Genode OS framework, which is distributed
+ * under the terms of the GNU General Public License version 2.
+ */
+
+#ifndef _INCLUDE__BASE__IPC_H_
+#define _INCLUDE__BASE__IPC_H_
+
+#include <base/ipc_generic.h>
+
+/**
+ * Marshalling of capabilities as plain data representation
+ */
+inline void
+Genode::Ipc_ostream::_marshal_capability(Genode::Native_capability const &cap)
+{
+	_write_to_buf(cap);
+}
+
+/**
+ * Unmarshalling of capabilities as plain data representation
+ */
+inline void
+Genode::Ipc_istream::_unmarshal_capability(Genode::Native_capability &cap)
+{
+	_read_from_buf(cap);
+}
+
+#endif /* _INCLUDE__BASE__IPC_H_ */

base/include/base/ipc_generic.h

@@ -0,0 +1,624 @@
+/*
+ * \brief  Generic IPC infrastructure
+ * \author Norman Feske
+ * \date   2006-06-12
+ *
+ * Most of the marshalling and unmarshallung code is generic for IPC
+ * implementations among different platforms. In addition to the generic
+ * marshalling items, platform-specific marshalling items can be realized
+ * via specialized stream operators defined in the platform-specific
+ * 'base/ipc.h'.  Hence, this header file is never to be included directly.
+ * It should only be included by a platform-specific 'base/ipc.h' file.
+ */
+
+/*
+ * Copyright (C) 2006-2011 Genode Labs GmbH
+ *
+ * This file is part of the Genode OS framework, which is distributed
+ * under the terms of the GNU General Public License version 2.
+ */
+
+#ifndef _INCLUDE__BASE__IPC_GENERIC_H_
+#define _INCLUDE__BASE__IPC_GENERIC_H_
+
+#include <util/misc_math.h>
+#include <util/string.h>
+#include <base/errno.h>
+#include <base/exception.h>
+#include <base/capability.h>
+#include <base/ipc_msgbuf.h>
+#include <base/rpc_args.h>
+#include <base/printf.h>
+
+namespace Genode {
+
+	enum Ipc_ostream_send      { IPC_SEND };
+	enum Ipc_istream_wait      { IPC_WAIT };
+	enum Ipc_client_call       { IPC_CALL };
+	enum Ipc_server_reply      { IPC_REPLY };
+	enum Ipc_server_reply_wait { IPC_REPLY_WAIT };
+
+
+	/*********************
+	 ** Exception types **
+	 *********************/
+
+	class Ipc_error : public Exception { };
+
+
+	/**
+	 * Marshal arguments into send message buffer
+	 */
+	class Ipc_marshaller
+	{
+		protected:
+
+			char        *_sndbuf;
+			size_t       _sndbuf_size;
+			unsigned     _write_offset;
+
+		protected:
+
+			/**
+			 * Write value to send buffer
+			 */
+			template <typename T>
+			void _write_to_buf(T const &value)
+			{
+				/* check buffer range */
+				if (_write_offset + sizeof(T) >= _sndbuf_size) return;
+
+				/* write integer to buffer */
+				*reinterpret_cast<T *>(&_sndbuf[_write_offset]) = value;
+
+				/* increment write pointer to next dword-aligned value */
+				_write_offset += align_natural(sizeof(T));
+			}
+
+			/**
+			 * Write bytes to send buffer
+			 */
+			void _write_to_buf(char const *src_addr, unsigned num_bytes)
+			{
+				/* check buffer range */
+				if (_write_offset + num_bytes >= _sndbuf_size) return;
+
+				/* copy buffer */
+				memcpy(&_sndbuf[_write_offset], src_addr, num_bytes);
+
+				/* increment write pointer to next dword-aligned value */
+				_write_offset += align_natural(num_bytes);
+			}
+
+			/**
+			 * Write 'Rpc_in_buffer' to send buffer
+			 */
+			void _write_buffer_to_buf(Rpc_in_buffer_base const &b)
+			{
+				size_t size = b.size();
+				_write_to_buf(size);
+				_write_to_buf(b.base(), size);
+			}
+
+			/**
+			 * Write array to send buffer
+			 */
+			template <typename T, size_t N>
+			void _write_to_buf(T const (&array)[N])
+			{
+				/* check buffer range */
+				if (_write_offset + sizeof(array) >= _sndbuf_size)
+					PERR("send buffer overrun");
+
+				memcpy(&_sndbuf[_write_offset], array, sizeof(array));
+				_write_offset += align_natural(sizeof(array));
+			}
+
+		public:
+
+			Ipc_marshaller(char *sndbuf, size_t sndbuf_size)
+			: _sndbuf(sndbuf), _sndbuf_size(sndbuf_size), _write_offset(0) { }
+	};
+
+
+	/**
+	 * Unmarshal arguments from receive buffer
+	 */
+	class Ipc_unmarshaller
+	{
+		protected:
+
+			char        *_rcvbuf;
+			size_t       _rcvbuf_size;
+			unsigned     _read_offset;
+
+		protected:
+
+			/**
+			 * Read value of type T from buffer
+			 */
+			template <typename T>
+			void _read_from_buf(T &value)
+			{
+				/* check receive buffer range */
+				if (_read_offset + sizeof(T) >= _rcvbuf_size) return;
+
+				/* return value from receive buffer */
+				value = *reinterpret_cast<T *>(&_rcvbuf[_read_offset]);
+
+				/* increment read pointer to next dword-aligned value */
+				_read_offset += align_natural(sizeof(T));
+			}
+
+			/**
+			 * Read 'Rpc_in_buffer' from receive buffer
+			 */
+			void _read_bytebuf_from_buf(Rpc_in_buffer_base &b)
+			{
+				size_t size = 0;
+				_read_from_buf(size);
+				b = Rpc_in_buffer_base(0, 0);
+
+				/*
+				 * Check receive buffer range
+				 *
+				 * Note: The addr of the Rpc_in_buffer_base is a null pointer when this
+				 *       condition triggers.
+				 */
+				if (_read_offset + size >= _rcvbuf_size) {
+					PERR("message buffer overrun");
+					return;
+				}
+
+				b = Rpc_in_buffer_base(&_rcvbuf[_read_offset], size);
+				_read_offset += align_natural(size);
+			}
+
+			/**
+			 * Read array from receive buffer
+			 */
+			template <typename T, size_t N>
+			void _read_from_buf(T (&array)[N])
+			{
+				if (_read_offset + sizeof(array) >= _rcvbuf_size) {
+					PERR("receive buffer overrun");
+					return;
+				}
+
+				memcpy(array, &_rcvbuf[_read_offset], sizeof(array));
+				_read_offset += align_natural(sizeof(array));
+			}
+
+			/**
+			 * Read long value at specified byte index of receive buffer
+			 */
+			long _long_at_idx(int idx) { return *(long *)(&_rcvbuf[idx]); }
+
+		public:
+
+			Ipc_unmarshaller(char *rcvbuf, size_t rcvbuf_size)
+			: _rcvbuf(rcvbuf), _rcvbuf_size(rcvbuf_size), _read_offset(0) { }
+	};
+
+
+	/**
+	 * Stream for sending information via a capability to an endpoint
+	 */
+	class Ipc_ostream : public Ipc_marshaller
+	{
+		protected:
+
+			Msgbuf_base      *_snd_msg;  /* send message buffer */
+			Native_capability _dst;
+
+			/**
+			 * Reset marshaller and write badge at the beginning of the message
+			 */
+			void _prepare_next_send();
+
+			/**
+			 * Send message in _snd_msg to _dst
+			 */
+			void _send();
+
+			/**
+			 * Insert capability to message buffer
+			 */
+			void _marshal_capability(Native_capability const &cap);
+
+		public:
+
+			/**
+			 * Constructor
+			 */
+			Ipc_ostream(Native_capability dst, Msgbuf_base *snd_msg);
+
+			/**
+			 * Return true if Ipc_ostream is ready for send
+			 */
+			bool ready_for_send() const { return _dst.valid(); }
+
+			/**
+			 * Insert value into send buffer
+			 */
+			template <typename T>
+			Ipc_ostream &operator << (T const &value)
+			{
+				_write_to_buf(value);
+				return *this;
+			}
+
+			/**
+			 * Insert byte buffer to send buffer
+			 */
+			Ipc_ostream &operator << (Rpc_in_buffer_base const &b)
+			{
+				_write_buffer_to_buf(b);
+				return *this;
+			}
+
+			/**
+			 * Insert capability to send buffer
+			 */
+			Ipc_ostream &operator << (Native_capability const &cap)
+			{
+				_marshal_capability(cap);
+				return *this;
+			}
+
+			/**
+			 * Insert typed capability to send buffer
+			 */
+			template <typename IT>
+			Ipc_ostream &operator << (Capability<IT> const &typed_cap)
+			{
+				_marshal_capability(typed_cap);
+				return *this;
+			}
+
+			/**
+			 * Issue the sending of the message buffer
+			 */
+			Ipc_ostream &operator << (Ipc_ostream_send)
+			{
+				_send();
+				return *this;
+			}
+
+			/**
+			 * Return current 'IPC_SEND' destination
+			 *
+			 * This function is typically needed by a server than sends replies
+			 * in a different order as the incoming calls.
+			 */
+			Native_capability dst() const { return _dst; }
+
+			/**
+			 * Set destination for the next 'IPC_SEND'
+			 */
+			void dst(Native_capability const &dst) { _dst = dst; }
+	};
+
+
+	/**
+	 * Stream for receiving information
+	 */
+	class Ipc_istream : public Ipc_unmarshaller, public Native_capability
+	{
+		private:
+
+			/**
+			 * Prevent 'Ipc_istream' objects from being copied
+			 *
+			 * Copying an 'Ipc_istream' object would result in a duplicated
+			 * (and possibly inconsistent) connection state both the original
+			 * and the copied object.
+			 */
+			Ipc_istream(const Ipc_istream &);
+
+		protected:
+
+			Msgbuf_base            *_rcv_msg;
+			Native_connection_state _rcv_cs;
+
+			/**
+			 * Obtain capability from message buffer
+			 */
+			void _unmarshal_capability(Native_capability &cap);
+
+		protected:
+
+			/**
+			 * Reset unmarshaller
+			 */
+			void _prepare_next_receive();
+
+			/**
+			 * Wait for incoming message to be received in _rcv_msg
+			 */
+			void _wait();
+
+		public:
+
+			explicit Ipc_istream(Msgbuf_base *rcv_msg);
+
+			~Ipc_istream();
+
+			/**
+			 * Read badge that was supplied with the message
+			 */
+			long badge() { return _long_at_idx(0); }
+
+			/**
+			 * Block for an incoming message filling the receive buffer
+			 */
+			Ipc_istream &operator >> (Ipc_istream_wait)
+			{
+				_wait();
+				return *this;
+			}
+
+			/**
+			 * Read values from receive buffer
+			 */
+			template <typename T>
+			Ipc_istream &operator >> (T &value)
+			{
+				_read_from_buf(value);
+				return *this;
+			}
+
+			/**
+			 * Read byte buffer from receive buffer
+			 */
+			Ipc_istream &operator >> (Rpc_in_buffer_base &b)
+			{
+				_read_bytebuf_from_buf(b);
+				return *this;
+			}
+
+			/**
+			 * Read byte buffer from receive buffer
+			 */
+			template <size_t MAX_BUFFER_SIZE>
+			Ipc_istream &operator >> (Rpc_in_buffer<MAX_BUFFER_SIZE> &b)
+			{
+				_read_bytebuf_from_buf(b);
+				return *this;
+			}
+
+			/**
+			 * Read capability from receive buffer
+			 */
+			Ipc_istream &operator >> (Native_capability &cap)
+			{
+				_unmarshal_capability(cap);
+				return *this;
+			}
+
+			/**
+			 * Read typed capability from receive buffer
+			 */
+			template <typename IT>
+			Ipc_istream &operator >> (Capability<IT> &typed_cap)
+			{
+				_unmarshal_capability(typed_cap);
+				return *this;
+			}
+	};
+
+
+	class Ipc_client: public Ipc_istream, public Ipc_ostream
+	{
+		protected:
+
+			int _result;   /* result of most recent call */
+
+			void _prepare_next_call();
+
+			/**
+			 * Send RPC message and wait for result
+			 */
+			void _call();
+
+		public:
+
+			/**
+			 * Constructor
+			 */
+			Ipc_client(Native_capability const &srv, Msgbuf_base *snd_msg,
+			                                         Msgbuf_base *rcv_msg);
+
+			/**
+			 * Operator that issues an IPC call
+			 *
+			 * \throw Ipc_error
+			 * \throw Blocking_canceled
+			 */
+			Ipc_client &operator << (Ipc_client_call)
+			{
+				_call();
+				_read_from_buf(_result);
+				if (_result == ERR_INVALID_OBJECT) {
+					PERR("tried to call an invalid object");
+					throw Ipc_error();
+				}
+				return *this;
+			}
+
+			template <typename T>
+			Ipc_client &operator << (T const &value)
+			{
+				_write_to_buf(value);
+				return *this;
+			}
+
+			Ipc_client &operator << (Rpc_in_buffer_base const &b)
+			{
+				_write_buffer_to_buf(b);
+				return *this;
+			}
+
+			template <size_t MAX_BUFFER_SIZE>
+			Ipc_client &operator << (Rpc_in_buffer<MAX_BUFFER_SIZE> const &b)
+			{
+				_write_buffer_to_buf(b);
+				return *this;
+			}
+
+			Ipc_client &operator << (Native_capability const &cap)
+			{
+				_marshal_capability(cap);
+				return *this;
+			}
+
+			template <typename IT>
+			Ipc_client &operator << (Capability<IT> const &typed_cap)
+			{
+				_marshal_capability(typed_cap);
+				return *this;
+			}
+
+			Ipc_client &operator >> (Native_capability &cap)
+			{
+				_unmarshal_capability(cap);
+				return *this;
+			}
+
+			template <typename IT>
+			Ipc_client &operator >> (Capability<IT> &typed_cap)
+			{
+				_unmarshal_capability(typed_cap);
+				return *this;
+			}
+
+			template <typename T>
+			Ipc_client &operator >> (T &value)
+			{
+				_read_from_buf(value);
+				return *this;
+			}
+
+			Ipc_client &operator >> (Rpc_in_buffer_base &b)
+			{
+				_read_bytebuf_from_buf(b);
+				return *this;
+			}
+
+			int result() const { return _result; }
+	};
+
+
+	class Ipc_server : public Ipc_istream, public Ipc_ostream
+	{
+		protected:
+
+			bool _reply_needed;   /* false for the first reply_wait */
+
+			void _prepare_next_reply_wait();
+
+			/**
+			 * Wait for incoming call
+			 *
+			 * In constrast to 'Ipc_istream::_wait()', this function stores the
+			 * next reply destination from into 'dst' of the 'Ipc_ostream'.
+			 */
+			void _wait();
+
+			/**
+			 * Send reply to destination
+			 *
+			 * In contrast to 'Ipc_ostream::_send()', this function prepares
+			 * the 'Ipc_server' to send another subsequent reply without the
+			 * calling '_wait()' in between. This is needed when a server
+			 * answers calls out of order.
+			 */
+			void _reply();
+
+			/**
+			 * Send result of previous RPC request and wait for new one
+			 */
+			void _reply_wait();
+
+		public:
+
+			/**
+			 * Constructor
+			 */
+			Ipc_server(Msgbuf_base *snd_msg, Msgbuf_base *rcv_msg);
+
+			/**
+			 * Set return value of server call
+			 */
+			void ret(int retval)
+			{
+				*reinterpret_cast<int *>(&_sndbuf[sizeof(umword_t)]) = retval;
+			}
+
+			/**
+			 * Set reply destination
+			 */
+			void dst(Native_capability const &reply_dst)
+			{
+				Ipc_ostream::dst(reply_dst);
+				_reply_needed = reply_dst.valid();
+			}
+
+			using Ipc_ostream::dst;
+
+			/**
+			 * Block for an incoming message filling the receive buffer
+			 */
+			Ipc_server &operator >> (Ipc_istream_wait)
+			{
+				_wait();
+				return *this;
+			}
+
+			/**
+			 * Issue the sending of the message buffer
+			 */
+			Ipc_server &operator << (Ipc_server_reply)
+			{
+				_reply();
+				return *this;
+			}
+
+			/**
+			 * Reply current request and wait for a new one
+			 */
+			Ipc_server &operator >> (Ipc_server_reply_wait)
+			{
+				_reply_wait();
+				return *this;
+			}
+
+			/**
+			 * Write value to send buffer
+			 *
+			 * This operator is only used by test programs
+			 */
+			template <typename T>
+			Ipc_server &operator << (T const &value)
+			{
+				_write_to_buf(value);
+				return *this;
+			}
+
+			/**
+			 * Read value from receive buffer
+			 *
+			 * This operator should only be used by the server framework for
+			 * reading the function offset. The server-side processing of the
+			 * payload is done using 'Ipc_istream' and 'Ipc_ostream'.
+			 */
+			template <typename T>
+			Ipc_server &operator >> (T &value)
+			{
+				_read_from_buf(value);
+				return *this;
+			}
+	};
+}
+
+#endif /* _INCLUDE__BASE__IPC_GENERIC_H_ */

base/include/base/lock.h

@@ -0,0 +1,47 @@
+/*
+ * \brief  Locking primitives
+ * \author Norman Feske
+ * \date   2006-07-26
+ */
+
+/*
+ * Copyright (C) 2006-2011 Genode Labs GmbH
+ *
+ * This file is part of the Genode OS framework, which is distributed
+ * under the terms of the GNU General Public License version 2.
+ */
+
+#ifndef _INCLUDE__BASE__LOCK_H_
+#define _INCLUDE__BASE__LOCK_H_
+
+#include <base/cancelable_lock.h>
+
+namespace Genode {
+
+	class Lock : public Cancelable_lock
+	{
+		public:
+
+			/**
+			 * Constructor
+			 */
+			explicit Lock(State initial = UNLOCKED)
+			: Cancelable_lock(initial) { }
+
+			void lock()
+			{
+				while (1)
+					try {
+						Cancelable_lock::lock();
+						return;
+					} catch (Blocking_canceled) { }
+			}
+
+			/**
+			 * Lock guard
+			 */
+			typedef Lock_guard<Lock> Guard;
+	};
+}
+
+#endif /* _INCLUDE__BASE__LOCK_H_ */

base/include/base/lock_guard.h

@@ -0,0 +1,46 @@
+/*
+ * \brief  Lock guard
+ * \author Norman Feske
+ * \date   2006-07-26
+ *
+ * A lock guard is instantiated as a local variable.
+ * When a lock guard is constructed, it acquires the lock that
+ * is specified as constructor argument. When the control
+ * flow leaves the scope of the lock guard variable via
+ * a return statement or an exception, the lock guard's
+ * destructor gets called, freeing the lock.
+ */
+
+/*
+ * Copyright (C) 2006-2011 Genode Labs GmbH
+ *
+ * This file is part of the Genode OS framework, which is distributed
+ * under the terms of the GNU General Public License version 2.
+ */
+
+#ifndef _INCLUDE__BASE__LOCK_GUARD_H_
+#define _INCLUDE__BASE__LOCK_GUARD_H_
+
+namespace Genode {
+
+	/**
+	 * Lock guard template
+	 *
+	 * \param LT  lock type
+	 */
+	template <typename LT>
+	class Lock_guard
+	{
+		private:
+
+			LT &_lock;
+
+		public:
+
+			explicit Lock_guard(LT &lock) : _lock(lock) { _lock.lock(); }
+
+			~Lock_guard() { _lock.unlock(); }
+	};
+}
+
+#endif /* _INCLUDE__BASE__LOCK_GUARD_H_ */

base/include/base/object_pool.h

@@ -0,0 +1,130 @@
+/*
+ * \brief  Object pool - map ids to objects
+ * \author Norman Feske
+ * \date   2006-06-26
+ */
+
+/*
+ * Copyright (C) 2006-2011 Genode Labs GmbH
+ *
+ * This file is part of the Genode OS framework, which is distributed
+ * under the terms of the GNU General Public License version 2.
+ */
+
+#ifndef _INCLUDE__BASE__OBJECT_POOL_H_
+#define _INCLUDE__BASE__OBJECT_POOL_H_
+
+#include <util/avl_tree.h>
+#include <base/capability.h>
+#include <base/lock.h>
+
+namespace Genode {
+
+	/**
+	 * Map object ids to local objects
+	 *
+	 * \param OBJ_TYPE  object type (must be inherited from Object_pool::Entry)
+	 *
+	 * The local names of a capabilities are used to differentiate multiple server
+	 * objects managed by one and the same object pool.
+	 */
+	template <typename OBJ_TYPE>
+	class Object_pool
+	{
+		public:
+
+			class Entry : public Avl_node<Entry>
+			{
+				private:
+
+					Untyped_capability _cap;
+
+					inline long _obj_id() { return _cap.local_name(); }
+
+					friend class Object_pool;
+					friend class Avl_tree<Entry>;
+
+				public:
+
+					enum { OBJ_ID_INVALID = 0 };
+
+					/**
+					 * Constructors
+					 */
+					Entry() { }
+					Entry(Untyped_capability cap) : _cap(cap) { }
+
+					/**
+					 * Avl_node interface
+					 */
+					bool higher(Entry *e) { return e->_obj_id() > _obj_id(); }
+					void recompute() { }  /* for gcc-3.4 compatibility */
+
+					/**
+					 * Support for object pool
+					 */
+					Entry *find_by_obj_id(long obj_id)
+					{
+						if (obj_id == _obj_id()) return this;
+
+						Entry *obj = child(obj_id > _obj_id());
+
+						return obj ? obj->find_by_obj_id(obj_id) : 0;
+					}
+
+					/**
+					 * Assign capability to object pool entry
+					 */
+					void cap(Untyped_capability c) { _cap = c; }
+
+					Untyped_capability const cap() const { return _cap; }
+			};
+
+		private:
+
+			Avl_tree<Entry> _tree;
+			Lock            _lock;
+
+		public:
+
+			void insert(OBJ_TYPE *obj)
+			{
+				Lock::Guard lock_guard(_lock);
+				_tree.insert(obj);
+			}
+
+			void remove(OBJ_TYPE *obj)
+			{
+				Lock::Guard lock_guard(_lock);
+				_tree.remove(obj);
+			}
+
+			/**
+			 * Lookup object
+			 */
+			OBJ_TYPE *obj_by_id(long obj_id)
+			{
+				Lock::Guard lock_guard(_lock);
+				Entry *obj = _tree.first();
+				return (OBJ_TYPE *)(obj ? obj->find_by_obj_id(obj_id) : 0);
+			}
+
+			OBJ_TYPE *obj_by_cap(Untyped_capability cap)
+			{
+				return obj_by_id(cap.local_name());
+			}
+
+			/**
+			 * Return first element of tree
+			 *
+			 * This function is used for removing tree elements step by step.
+			 */
+			OBJ_TYPE *first()
+			{
+				Lock::Guard lock_guard(_lock);
+				return (OBJ_TYPE *)_tree.first();
+			}
+	};
+}
+
+#endif /* _INCLUDE__BASE__OBJECT_POOL_H_ */

base/include/base/pager.h

@@ -0,0 +1,199 @@
+/*
+ * \brief  Paging-server framework
+ * \author Norman Feske
+ * \author Christian Helmuth
+ * \date   2006-04-28
+ */
+
+/*
+ * Copyright (C) 2006-2011 Genode Labs GmbH
+ *
+ * This file is part of the Genode OS framework, which is distributed
+ * under the terms of the GNU General Public License version 2.
+ */
+
+#ifndef _INCLUDE__BASE__PAGER_H_
+#define _INCLUDE__BASE__PAGER_H_
+
+#include <base/thread.h>
+#include <base/thread_state.h>
+#include <base/errno.h>
+#include <base/ipc_pager.h>
+#include <base/printf.h>
+#include <base/object_pool.h>
+#include <base/signal.h>
+#include <cap_session/cap_session.h>
+#include <pager/capability.h>
+
+namespace Genode {
+
+	/**
+	 * Special server object for paging
+	 *
+	 * A 'Pager_object' is very similar to a 'Rpc_object'. It is just a
+	 * special implementation for page-fault handling, which does not allow to
+	 * define a "badge" for pager capabilities.
+	 */
+	class Pager_object : public Object_pool<Pager_object>::Entry
+	{
+		protected:
+
+			/**
+			 * Local name for this pager object
+			 */
+			unsigned long _badge;
+
+			/**
+			 * User-level signal handler registered for this pager object via
+			 * 'Cpu_session::exception_handler()'.
+			 */
+			Signal_context_capability _exception_sigh;
+
+		public:
+
+			/**
+			 * Contains information about exception state of corresponding thread.
+			 */
+			Thread_state state;
+
+			Pager_object(unsigned long badge) : _badge(badge) { }
+			virtual ~Pager_object() { }
+
+			unsigned long badge() const { return _badge; }
+
+			/**
+			 * Interface to be implemented by a derived class
+			 *
+			 * \param ps  'Ipc_pager' stream
+			 *
+			 * Returns !0 on error and pagefault will not be answered.
+			 */
+			virtual int pager(Ipc_pager &ps) = 0;
+
+			void wake_up()
+			{
+				/* notify pager to wake up faulter */
+				Msgbuf<16> snd, rcv;
+				Native_capability pager = cap();
+				Ipc_client ipc_client(pager, &snd, &rcv);
+				ipc_client << this << IPC_CALL;
+			}
+
+			/**
+			 * Assign user-level exception handler for the pager object
+			 */
+			void exception_handler(Signal_context_capability sigh)
+			{
+				_exception_sigh = sigh;
+			}
+
+			/**
+			 * Notify exception handler about the occurrence of an exception
+			 */
+			void submit_exception_signal()
+			{
+				if (!_exception_sigh.valid()) return;
+
+				Signal_transmitter transmitter(_exception_sigh);
+				transmitter.submit();
+			}
+	};
+
+	/**
+	 * A 'Pager_activation' processes one page fault of a 'Pager_object' at a time.
+	 */
+	class Pager_entrypoint;
+	class Pager_activation_base: public Thread_base
+	{
+		private:
+
+			Native_capability _cap;
+			Pager_entrypoint *_ep;       /* entry point to which the
+			                                activation belongs */
+			/**
+			 * Lock used for blocking until '_cap' is initialized
+			 */
+			Lock _cap_valid;
+
+		public:
+
+			Pager_activation_base(const char *name, size_t stack_size) :
+				Thread_base(name, stack_size),
+				_cap(Native_capability()), _ep(0), _cap_valid(Lock::LOCKED) { }
+
+			/**
+			 * Set entry point, which the activation serves
+			 *
+			 * This function is only called by the 'Pager_entrypoint'
+			 * constructor.
+			 */
+			void ep(Pager_entrypoint *ep) { _ep = ep; }
+
+			/**
+			 * Thread interface
+			 */
+			void entry();
+
+			/**
+			 * Return capability to this activation
+			 *
+			 * This function should only be called from 'Pager_entrypoint'
+			 */
+			Native_capability cap()
+			{
+				/* ensure that the initialization of our 'Ipc_pager' is done */
+				if (!_cap.valid())
+					_cap_valid.lock();
+				return _cap;
+			}
+	};
+
+
+	/**
+	 * Paging entry point
+	 *
+	 * For a paging entry point can hold only one activation. So, paging is
+	 * strictly serialized for one entry point.
+	 */
+	class Pager_entrypoint : public Object_pool<Pager_object>
+	{
+		private:
+
+			Pager_activation_base *_activation;
+			Cap_session           *_cap_session;
+
+		public:
+
+			/**
+			 * Constructor
+			 *
+			 * \param cap_session  Cap_session for creating capabilities
+			 *                     for the pager objects managed by this
+			 *                     entry point
+			 * \param a            initial activation
+			 */
+			Pager_entrypoint(Cap_session *cap_session, Pager_activation_base *a = 0);
+
+			/**
+			 * Associate Pager_object with the entry point
+			 */
+			Pager_capability manage(Pager_object *obj);
+
+			/**
+			 * Dissolve Pager_object from entry point
+			 */
+			void dissolve(Pager_object *obj);
+	};
+
+
+	template <int STACK_SIZE>
+	class Pager_activation : public Pager_activation_base
+	{
+		public:
+
+			Pager_activation() : Pager_activation_base("pager", STACK_SIZE)
+			{ start(); }
+	};
+}
+
+#endif /* _INCLUDE__BASE__PAGER_H_ */

base/include/base/platform_env.h

@@ -0,0 +1,150 @@
+/*
+ * \brief  Platform environment of Genode process
+ * \author Norman Feske
+ * \author Christian Helmuth
+ * \date   2006-07-28
+ *
+ * This file is a generic variant of the platform environment, which is
+ * suitable for platforms such as L4ka::Pistachio and L4/Fiasco. On other
+ * platforms, it may be replaced by a platform-specific version residing
+ * in the corresponding 'base-<platform>' repository.
+ */
+
+/*
+ * Copyright (C) 2006-2011 Genode Labs GmbH
+ *
+ * This file is part of the Genode OS framework, which is distributed
+ * under the terms of the GNU General Public License version 2.
+ */
+
+#ifndef _INCLUDE__BASE__PLATFORM_ENV_H_
+#define _INCLUDE__BASE__PLATFORM_ENV_H_
+
+#include <base/env.h>
+
+#include <base/heap.h>
+#include <parent/client.h>
+#include <ram_session/client.h>
+#include <rm_session/client.h>
+#include <cpu_session/client.h>
+#include <pd_session/client.h>
+
+
+namespace Genode {
+
+	class Platform_env : public Env
+	{
+		class Expanding_rm_session_client : public Rm_session_client
+		{
+			Rm_session_capability _cap;
+
+			public:
+
+				Expanding_rm_session_client(Rm_session_capability cap)
+				: Rm_session_client(cap), _cap(cap) { }
+
+				Local_addr attach(Dataspace_capability ds,
+				                  size_t size = 0, off_t offset = 0,
+				                  bool use_local_addr = false,
+				                  Local_addr local_addr = (addr_t)0) {
+
+					bool try_again;
+					do {
+						try_again = false;
+						try {
+							return Rm_session_client::attach(ds, size, offset,
+							                                 use_local_addr,
+							                                 local_addr);
+
+						} catch (Rm_session::Out_of_metadata) {
+
+							/* give up if the error occurred a second time */
+							if (try_again)
+								break;
+
+							PINF("upgrade quota donation for Env::RM session");
+							env()->parent()->upgrade(_cap, "ram_quota=8K");
+							try_again = true;
+						}
+					} while (try_again);
+
+					return (addr_t)0;
+				}
+		};
+
+		class Expanding_ram_session_client : public Ram_session_client
+		{
+			Ram_session_capability _cap;
+
+			public:
+
+				Expanding_ram_session_client(Ram_session_capability cap)
+				: Ram_session_client(cap), _cap(cap) { }
+
+				Ram_dataspace_capability alloc(size_t size) {
+					bool try_again;
+					do {
+						try_again = false;
+						try {
+							return Ram_session_client::alloc(size);
+
+						} catch (Ram_session::Out_of_metadata) {
+
+							/* give up if the error occurred a second time */
+							if (try_again)
+								break;
+
+							PINF("upgrade quota donation for Env::RAM session");
+							env()->parent()->upgrade(_cap, "ram_quota=8K");
+							try_again = true;
+						}
+					} while (try_again);
+
+					return Ram_dataspace_capability();
+				}
+		};
+
+		private:
+
+			Parent_client                 _parent_client;
+			Parent                       *_parent;
+			Ram_session_capability        _ram_session_cap;
+			Expanding_ram_session_client  _ram_session_client;
+			Cpu_session_client            _cpu_session_client;
+			Expanding_rm_session_client   _rm_session_client;
+			Pd_session_client             _pd_session_client;
+			Heap                          _heap;
+
+
+		public:
+
+			/**
+			 * Standard constructor
+			 */
+			Platform_env()
+			:
+				_parent_client(Genode::parent_cap()), _parent(&_parent_client),
+				_ram_session_cap(static_cap_cast<Ram_session>(parent()->session("Env::ram_session", ""))),
+				_ram_session_client(_ram_session_cap),
+				_cpu_session_client(static_cap_cast<Cpu_session>(parent()->session("Env::cpu_session", ""))),
+				_rm_session_client(static_cap_cast<Rm_session>(parent()->session("Env::rm_session", ""))),
+				_pd_session_client(static_cap_cast<Pd_session>(parent()->session("Env::pd_session", ""))),
+				_heap(ram_session(), rm_session())
+			{ }
+
+
+			/*******************
+			 ** Env interface **
+			 *******************/
+
+			Parent                 *parent()          { return  _parent; }
+			Ram_session            *ram_session()     { return &_ram_session_client; }
+			Ram_session_capability  ram_session_cap() { return  _ram_session_cap; }
+			Cpu_session            *cpu_session()     { return &_cpu_session_client; }
+			Rm_session             *rm_session()      { return &_rm_session_client; }
+			Pd_session             *pd_session()      { return &_pd_session_client; }
+			Allocator              *heap()            { return &_heap; }
+	};
+}
+
+#endif /* _INCLUDE__BASE__PLATFORM_ENV_H_ */

base/include/base/printf.h

@@ -0,0 +1,105 @@
+/*
+ * \brief  Interface of the printf backend
+ * \author Norman Feske
+ * \date   2006-04-08
+ */
+
+/*
+ * Copyright (C) 2006-2011 Genode Labs GmbH
+ *
+ * This file is part of the Genode OS framework, which is distributed
+ * under the terms of the GNU General Public License version 2.
+ */
+
+#ifndef _INCLUDE__BASE__PRINTF_H_
+#define _INCLUDE__BASE__PRINTF_H_
+
+#include <stdarg.h>
+
+namespace Genode {
+
+	/**
+	 * For your convenience...
+	 */
+	void  printf(const char *format, ...) __attribute__((format(printf, 1, 2)));
+	void vprintf(const char *format, va_list) __attribute__((format(printf, 1, 0)));
+}
+
+#define ESC_LOG  "\033[33m"
+#define ESC_DBG  "\033[33m"
+#define ESC_INF  "\033[32m"
+#define ESC_WRN  "\033[34m"
+#define ESC_ERR  "\033[31m"
+#define ESC_END  "\033[0m"
+
+/**
+ * Remove colored output from release version
+ */
+#ifdef GENODE_RELEASE
+#undef ESC_LOG
+#undef ESC_DBG
+#undef ESC_INF
+#undef ESC_WRN
+#undef ESC_ERR
+#undef ESC_END
+#define ESC_LOG
+#define ESC_DBG
+#define ESC_INF
+#define ESC_WRN
+#define ESC_ERR
+#define ESC_END
+#endif /* GENODE_RELEASE */
+
+/*
+ * We're using heavy CPP wizardry here to prevent compiler errors after macro
+ * expansion. Each macro works as follows:
+ *
+ * - Support one format string plus zero or more arguments.
+ * - Put all static strings (including the format string) in the first argument
+ *   of the call to printf() and let the compiler merge them.
+ * - Append the function name (magic static string variable) as first argument.
+ * - (Optionally) append the arguments to the macro with ", ##__VA_ARGS__". CPP
+ *   only appends the comma and arguments if __VA__ARGS__ is not empty,
+ *   otherwise nothing (not even the comma) is appended.
+ */
+
+/**
+ * Print debug message with function name
+ */
+#define PDBG(fmt, ...) \
+	Genode::printf("%s: " ESC_DBG fmt ESC_END "\n", \
+	               __PRETTY_FUNCTION__, ##__VA_ARGS__ )
+
+/**
+ * Suppress debug messages in release version
+ */
+#ifdef GENODE_RELEASE
+#undef PDBG
+#define PDBG(fmt, ...)
+#endif /* GENODE_RELEASE */
+
+/**
+ * Print log message
+ */
+#define PLOG(fmt, ...) \
+	Genode::printf(ESC_LOG fmt ESC_END "\n", ##__VA_ARGS__ )
+
+/**
+ * Print status-information message
+ */
+#define PINF(fmt, ...) \
+	Genode::printf(ESC_INF fmt ESC_END "\n", ##__VA_ARGS__ )
+
+/**
+ * Print warning message
+ */
+#define PWRN(fmt, ...) \
+	Genode::printf(ESC_WRN fmt ESC_END "\n", ##__VA_ARGS__ )
+
+/**
+ * Print error message
+ */
+#define PERR(fmt, ...) \
+	Genode::printf(ESC_ERR fmt ESC_END "\n", ##__VA_ARGS__ )
+
+#endif /* _INCLUDE__BASE__PRINTF_H_ */

base/include/base/process.h

@@ -0,0 +1,92 @@
+/*
+ * \brief  Process-creation interface
+ * \author Norman Feske
+ * \date   2006-06-22
+ */
+
+/*
+ * Copyright (C) 2006-2011 Genode Labs GmbH
+ *
+ * This file is part of the Genode OS framework, which is distributed
+ * under the terms of the GNU General Public License version 2.
+ */
+
+#ifndef _INCLUDE__BASE__PROCESS_H_
+#define _INCLUDE__BASE__PROCESS_H_
+
+#include <ram_session/capability.h>
+#include <rm_session/connection.h>
+#include <pd_session/connection.h>
+#include <cpu_session/client.h>
+#include <parent/capability.h>
+
+namespace Genode {
+
+	class Process
+	{
+		private:
+
+			Pd_connection      _pd;
+			Thread_capability  _thread0_cap;
+			Cpu_session_client _cpu_session_client;
+			Rm_session_client  _rm_session_client;
+
+			static Dataspace_capability _dynamic_linker_cap;
+
+			/*
+			 * Hook for passing additional platform-specific session
+			 * arguments to the PD session. For example, on Linux a new
+			 * process is created locally via 'fork' and the new PID gets
+			 * then communicated to core via a PD-session argument.
+			 */
+			enum { PRIV_ARGBUF_LEN = 32 };
+			char _priv_pd_argbuf[PRIV_ARGBUF_LEN];
+			const char *_priv_pd_args(Parent_capability parent_cap,
+			                          Dataspace_capability elf_data_ds,
+			                          const char *name, char *const argv[]);
+
+		public:
+
+			/**
+			 * Constructor
+			 *
+			 * \param elf_data_ds   dataspace that contains the elf binary
+			 * \param ram_session   RAM session providing the BSS for the
+			 *                      new protection domain
+			 * \param cpu_session   CPU session for the new protection domain
+			 * \param rm_session    RM session for the new protection domain
+			 * \param parent        parent of the new protection domain
+			 * \param name          name of protection domain (can be used
+			 *                      in debugging)
+			 * \param argv          not used
+			 *
+			 * The dataspace 'elf_data_ds' can be read-only.
+			 *
+			 * On construction of a protection domain, execution of the initial
+			 * thread is started immediately.
+			 */
+			Process(Dataspace_capability    elf_data_ds,
+			        Ram_session_capability  ram_session,
+			        Cpu_session_capability  cpu_session,
+			        Rm_session_capability   rm_session,
+			        Parent_capability       parent,
+			        const char             *name,
+			        char *const             argv[]);
+
+			/**
+			 * Destructor
+			 *
+			 * When called, the protection domain gets killed.
+			 */
+			~Process();
+
+			static void dynamic_linker(Dataspace_capability dynamic_linker_cap)
+			{
+				_dynamic_linker_cap = dynamic_linker_cap;
+			}
+
+			Pd_session_capability pd_session_cap() const { return _pd.cap(); }
+	};
+}
+
+#endif /* _INCLUDE__BASE__PROCESS_H_ */

base/include/base/rpc.h

@@ -0,0 +1,287 @@
+/*
+ * \brief  Support for defining and working with RPC interfaces
+ * \author Norman Feske
+ * \date   2011-03-28
+ */
+
+/*
+ * Copyright (C) 2011 Genode Labs GmbH
+ *
+ * This file is part of the Genode OS framework, which is distributed
+ * under the terms of the GNU General Public License version 2.
+ */
+
+#ifndef _INCLUDE__BASE__RPC_H_
+#define _INCLUDE__BASE__RPC_H_
+
+#include <util/meta.h>
+
+
+/**
+ * Macro for declaring a RPC function
+ *
+ * \param rpc_name   type name representing the RPC function
+ * \param ret_type   RPC return type
+ * \param func_name  RPC function name
+ * \param exc_types  type list of exceptions that may be thrown by the
+ *                   function
+ * \param ...        variable number of RPC function arguments
+ *
+ * Each RPC function is represented by a struct that contains the meta data
+ * about the function arguments, the return type, and the exception types.
+ * Furthermore, it contains an adapter function called 'serve', which is used
+ * on the server side to invoke the server-side implementation of the RPC
+ * function. It takes an a 'Pod_tuple' argument structure and calls the
+ * server-side function with individual arguments using the 'call_member'
+ * mechanism provided by 'meta.h'.
+ */
+#define GENODE_RPC_THROW(rpc_name, ret_type, func_name, exc_types, ...) \
+	struct rpc_name { \
+		typedef ::Genode::Meta::Ref_args<__VA_ARGS__>::Type  Client_args; \
+		typedef ::Genode::Meta::Pod_args<__VA_ARGS__>::Type  Server_args; \
+		typedef ::Genode::Trait::Exc_list<exc_types>::Type   Exceptions; \
+		typedef ::Genode::Trait::Call_return<ret_type>::Type Ret_type; \
+		\
+		template <typename SERVER, typename RET> \
+		static void serve(SERVER &server, Server_args &args, RET &ret) { \
+			::Genode::Meta::call_member<RET, SERVER, Server_args> \
+				(ret, server, args, &SERVER::func_name); } \
+	};
+
+/**
+ * Shortcut for 'GENODE_RPC_THROW' for an RPC that throws no exceptions
+ */
+#define GENODE_RPC(rpc_name, ret_type, func_name, ...) \
+	GENODE_RPC_THROW(rpc_name, ret_type, func_name, GENODE_TYPE_LIST(), __VA_ARGS__)
+
+/**
+ * Macro for declaring a RPC interface
+ *
+ * \param ...  list of RPC functions as declared via 'GENODE_RPC'
+ *
+ * An RPC interface is represented as type list of RPC functions. The RPC
+ * opcode for each function is implicitly defined by its position within
+ * this type list.
+ */
+#define GENODE_RPC_INTERFACE(...) \
+	typedef GENODE_TYPE_LIST(__VA_ARGS__) Rpc_functions
+
+/**
+ * Macro for declaring a RPC interface derived from another RPC interface
+ *
+ * \param base  class hosting the RPC interface to be inherited
+ * \param ...   list of the locally declared RPC functions
+ *
+ * RPC interface inheritance is simply the concatenation of the type list
+ * of RPC functions declared for the base interface and the locally declared
+ * RPC functions. By appending the local RPC functions, the RPC opcodes of
+ * the inherited RPC functions are preserved.
+ */
+#define GENODE_RPC_INTERFACE_INHERIT(base, ...) \
+	typedef ::Genode::Meta::Append<base::Rpc_functions, \
+	                               GENODE_TYPE_LIST(__VA_ARGS__) >::Type \
+		Rpc_functions;
+
+
+namespace Genode {
+
+	struct Rpc_arg_in    { enum { IN = true,  OUT = false }; };
+	struct Rpc_arg_out   { enum { IN = false, OUT = true  }; };
+	struct Rpc_arg_inout { enum { IN = true,  OUT = true  }; };
+
+	namespace Trait {
+
+		/*****************************************
+		 ** Type meta data used for marshalling **
+		 *****************************************/
+
+		template <typename T> struct Rpc_direction;
+
+
+		template <typename T> struct Rpc_direction            { typedef Rpc_arg_in    Type; };
+		template <typename T> struct Rpc_direction<T const *> { typedef Rpc_arg_in    Type; };
+		template <typename T> struct Rpc_direction<T const &> { typedef Rpc_arg_in    Type; };
+		template <typename T> struct Rpc_direction<T*>        { typedef Rpc_arg_inout Type; };
+		template <typename T> struct Rpc_direction<T&>        { typedef Rpc_arg_inout Type; };
+
+		/**
+		 * Representation of function return type
+		 *
+		 * For RPC functions with no return value, we use a pseudo return value
+		 * of type 'Empty' instead. This way, we can process all functions
+		 * regardless of the presence of a return type with the same meta
+		 * program.
+		 */
+		template <typename T> struct Call_return       { typedef T Type; };
+		template <>           struct Call_return<void> { typedef Meta::Empty Type; };
+
+		/**
+		 * Representation of the list of exception types
+		 *
+		 * This template maps the special case of a 'Type_list' with no arguments
+		 * to the 'Empty' type.
+		 */
+		template <typename T> struct Exc_list { typedef T Type; };
+		template <> struct Exc_list<Meta::Type_list<> > { typedef Meta::Empty Type; };
+	}
+
+
+	/*******************************************************
+	 ** Automated computation of RPC message-buffer sizes **
+	 *******************************************************/
+
+	/**
+	 * Determine transfer size of an RPC argument
+	 *
+	 * For data arguments, the transfer size is the size of the data type. For
+	 * pointer arguments, the transfer size is the size of the pointed-to
+	 * object.
+	 */
+	template <typename T>
+	struct Rpc_transfer_size {
+		enum { Value = Meta::Round_to_machine_word<sizeof(T)>::Value }; };
+
+	template <typename T>
+	struct Rpc_transfer_size<T *> {
+		enum { Value = Meta::Round_to_machine_word<sizeof(T)>::Value }; };
+
+
+	/**
+	 * Type used for transmitting the opcode of a RPC function (used for RPC call)
+	 */
+	typedef int Rpc_opcode;
+
+
+	/**
+	 * Type used for transmitting exception information (used for RPC reply)
+	 */
+	typedef int Rpc_exception_code;
+
+
+	/**
+	 * Special exception code used to respond to illegal opcodes
+	 */
+	enum { RPC_INVALID_OPCODE = -1 };
+
+
+	/**
+	 * Opcode base used for passing exception information
+	 */
+	enum { RPC_EXCEPTION_BASE = -1000 };
+
+
+	/**
+	 * Return the accumulated size of RPC arguments
+	 *
+	 * \param ARGS  typelist with RPC arguments
+	 * \param IN    true to account for RPC-input arguments
+	 * \param OUT   true to account for RPC-output arguments
+	 */
+	template <typename ARGS, bool IN, bool OUT>
+	struct Rpc_args_size {
+		typedef typename ARGS::Head This;
+		enum { This_size = Rpc_transfer_size<This>::Value };
+		enum { Value = (IN  && Trait::Rpc_direction<This>::Type::IN  ? This_size : 0)
+		             + (OUT && Trait::Rpc_direction<This>::Type::OUT ? This_size : 0)
+		             + Rpc_args_size<typename ARGS::Tail, IN, OUT>::Value }; };
+	
+	template <bool IN, bool OUT>
+	struct Rpc_args_size<Meta::Empty, IN, OUT> { enum { Value = 0 }; };
+
+
+	/**
+	 * Return the size of the return value
+	 *
+	 * The return type of an RPC function can be either a real type or
+	 * 'Meta::Empty' if the function has no return value. In the latter case,
+	 * 'Retval_size' returns 0 instead of the non-zero size of 'Meta::Empty'.
+	 */
+	template <typename RET>
+	struct Rpc_retval_size { enum { Value = sizeof(RET) }; };
+
+	template <>
+	struct Rpc_retval_size<Meta::Empty> { enum { Value = 0 }; };
+
+
+	/**
+	 * Calculate the payload size of a RPC message
+	 *
+	 * Setting either IN or OUT to true, the call size or respectively the
+	 * reply size is calculated. Protocol-related message parts (such as RPC
+	 * opcode or exception status) is not accounted for.
+	 */
+	template <typename RPC_FUNCTION, bool IN, bool OUT>
+	struct Rpc_msg_payload_size {
+		typedef typename RPC_FUNCTION::Server_args Args;
+		enum { Value = Rpc_args_size<Args, IN, OUT>::Value }; };
+
+
+	/**
+	 * RPC message type
+	 *
+	 * An RPC message can be either a 'RPC_CALL' (from client to server) or a
+	 * 'RPC_REPLY' (from server to client). The message payload for each type
+	 * depends on the RPC function arguments as well as protocol-specific
+	 * message parts. For example, a 'RPC_CALL' requires the transmission of
+	 * the RPC opcode to select the server-side RPC function. In contrast, a
+	 * 'RPC_REPLY' message carries along the exception state returned from the
+	 * server-side RPC implementation. The 'Rpc_msg_type' is used as template
+	 * argument to specialize the calculation of message sizes for each of both
+	 * cases.
+	 */
+	enum Rpc_msg_type { RPC_CALL, RPC_REPLY };
+
+
+	/**
+	 * Calculate size of RPC message
+	 *
+	 * The send and receive cases are handled by respective template
+	 * specializations for the 'MSG_TYPE' template argument.
+	 */
+	template <typename RPC_FUNCTION, Rpc_msg_type MSG_TYPE>
+	struct Rpc_function_msg_size;
+
+	template <typename RPC_FUNCTION>
+	struct Rpc_function_msg_size<RPC_FUNCTION, RPC_CALL> {
+		enum { Value = Rpc_msg_payload_size<RPC_FUNCTION, true, false>::Value
+		             + sizeof(Rpc_opcode) }; };
+
+	template <typename RPC_FUNCTION>
+	struct Rpc_function_msg_size<RPC_FUNCTION, RPC_REPLY> {
+		enum { Value = Rpc_msg_payload_size<RPC_FUNCTION, false, true>::Value
+		             + Rpc_retval_size<typename RPC_FUNCTION::Ret_type>::Value
+		             + sizeof(Rpc_exception_code) }; };
+
+
+	/**
+	 * Calculate size of message buffer needed for a list of RPC functions
+	 *
+	 * \param RPC_FUNCTIONS  type list of RPC functions
+	 *
+	 * The returned 'Value' is the maximum of all function's message sizes.
+	 */
+	template <typename RPC_FUNCTIONS, Rpc_msg_type MSG_TYPE>
+	struct Rpc_function_list_msg_size {
+		enum {
+			This_size = Rpc_function_msg_size<typename RPC_FUNCTIONS::Head, MSG_TYPE>::Value,
+			Tail_size = Rpc_function_list_msg_size<typename RPC_FUNCTIONS::Tail, MSG_TYPE>::Value,
+			Value     = (This_size > Tail_size) ? This_size : Tail_size }; };
+
+	template <Rpc_msg_type MSG_TYPE>
+	struct Rpc_function_list_msg_size<Meta::Empty, MSG_TYPE> { enum { Value = 0 }; };
+
+
+	/**
+	 * Calculate size of message buffer needed for an RPC interface
+	 *
+	 * \param RPC_IF  class that hosts the RPC interface declaration
+	 *
+	 * This is a convenience wrapper for 'Rpc_function_list_msg_size'.
+	 */
+	template <typename RPC_IF, Rpc_msg_type MSG_TYPE>
+	struct Rpc_interface_msg_size {
+		typedef typename RPC_IF::Rpc_functions Rpc_functions;
+		enum { Value = Rpc_function_list_msg_size<Rpc_functions, MSG_TYPE>::Value }; };
+}
+
+#endif /* _INCLUDE__BASE__RPC_H_ */

base/include/base/rpc_args.h

@@ -0,0 +1,121 @@
+/*
+ * \brief  Helpers for non-ordinary RPC arguments
+ * \author Norman Feske
+ * \date   2011-04-06
+ */
+
+/*
+ * Copyright (C) 2011 Genode Labs GmbH
+ *
+ * This file is part of the Genode OS framework, which is distributed
+ * under the terms of the GNU General Public License version 2.
+ */
+
+#ifndef _INCLUDE__BASE__RPC_ARGS_H_
+#define _INCLUDE__BASE__RPC_ARGS_H_
+
+#include <util/string.h>
+#include <base/stdint.h>
+
+namespace Genode {
+
+	/**
+	 * Base class of 'Rpc_in_buffer'
+	 */
+	class Rpc_in_buffer_base
+	{
+		protected:
+
+			const char *_base;
+			size_t      _size;
+
+			/**
+			 * Construct buffer from null-terminated string
+			 */
+			explicit Rpc_in_buffer_base(const char *str)
+			: _base(str), _size(strlen(str) + 1) { }
+
+			/**
+			 * Construct an empty buffer by default
+			 */
+			Rpc_in_buffer_base(): _base(0), _size(0) { }
+
+		public:
+
+			/**
+			 * Construct buffer
+			 */
+			Rpc_in_buffer_base(const char *base, size_t size)
+			: _base(base), _size(size) { }
+
+			const char *base() const { return _base; }
+			size_t      size() const { return _size; }
+	};
+
+
+	/**
+	 * Buffer with size constrain
+	 */
+	template <size_t MAX>
+	class Rpc_in_buffer : public Rpc_in_buffer_base
+	{
+		private:
+
+			/*
+			 * This member is only there to pump up the size of the object such
+			 * that 'sizeof()' returns the maximum buffer size when queried by
+			 * the RPC framework.
+			 */
+			char _balloon[MAX];
+
+		public:
+
+			enum { MAX_SIZE = MAX };
+
+			/**
+			 * Construct buffer
+			 */
+			Rpc_in_buffer(const char *base, size_t size)
+			: Rpc_in_buffer_base(base, min(size, (size_t)MAX_SIZE)) { }
+
+			/**
+			 * Construct buffer from null-terminated string
+			 */
+			Rpc_in_buffer(const char *str) : Rpc_in_buffer_base(str)
+			{
+				if (_size >= MAX_SIZE - 1)
+					_size = MAX_SIZE - 1;
+			}
+
+			/**
+			 * Default constructor creates invalid buffer
+			 */
+			Rpc_in_buffer() { }
+
+			void operator = (Rpc_in_buffer<MAX_SIZE> const &from)
+			{
+				_base = from.base();
+				_size = from.size();
+			}
+
+			/**
+			 * Return true if buffer contains a valid null-terminated string
+			 */
+			bool is_valid_string() const {
+				return (_size < MAX_SIZE) && (_size > 0) && (_base[_size - 1] == '\0'); }
+
+			/**
+			 * Return buffer content as null-terminated string
+			 *
+			 * \return  pointer to null-terminated string
+			 *
+			 * The function returns an empty string if the buffer does not hold
+			 * a valid null-terminated string. To distinguish a buffer holding
+			 * an invalid string from a buffer holding a valid empty string,
+			 * the function 'is_valid_string' can be used.
+			 */
+			char const *string() const { return is_valid_string() ? base() : ""; }
+	};
+}
+
+#endif /* _INCLUDE__BASE__RPC_ARGS_H_ */

base/include/base/rpc_client.h

@@ -0,0 +1,135 @@
+/*
+ * \brief  Support for performing RPC calls
+ * \author Norman Feske
+ * \date   2011-04-06
+ */
+
+/*
+ * Copyright (C) 2011 Genode Labs GmbH
+ *
+ * This file is part of the Genode OS framework, which is distributed
+ * under the terms of the GNU General Public License version 2.
+ */
+
+#ifndef _INCLUDE__BASE__RPC_CLIENT_H_
+#define _INCLUDE__BASE__RPC_CLIENT_H_
+
+#include <base/ipc.h>
+
+namespace Genode {
+
+	/**
+	 * RPC client
+	 *
+	 * This class template is the base class of the client-side implementation
+	 * of the specified 'RPC_INTERFACE'. Usually, it inherits the pure virtual
+	 * functions declared in 'RPC_INTERFACE' and has the built-in facility to
+	 * perform RPC calls to this particular interface. Hence, the client-side
+	 * implementation of each pure virtual interface function comes down to a
+	 * simple wrapper in the line of 'return call<Rpc_function>(arguments...)'.
+	 */
+	template <typename RPC_INTERFACE>
+	struct Rpc_client : Capability<RPC_INTERFACE>, RPC_INTERFACE
+	{
+		typedef RPC_INTERFACE Rpc_interface;
+
+		Rpc_client(Capability<RPC_INTERFACE> const &cap)
+		: Capability<RPC_INTERFACE>(cap) { }
+	};
+
+
+	/*********************************************************
+	 ** Implementation of 'Capability:call' functions **
+	 *********************************************************/
+
+	template <typename RPC_INTERFACE>
+	template <typename ATL>
+	void Capability<RPC_INTERFACE>::
+	_marshal_args(Ipc_client &ipc_client, ATL &args)
+	{
+		if (Trait::Rpc_direction<typename ATL::Head>::Type::IN)
+			ipc_client << args.get();
+
+		_marshal_args(ipc_client, args._2);
+	}
+
+
+	template <typename RPC_INTERFACE>
+	template <typename T>
+	void Capability<RPC_INTERFACE>::
+	_unmarshal_result(Ipc_client &ipc_client, T &arg,
+	                  Meta::Overload_selector<Rpc_arg_out>)
+	{
+		ipc_client >> arg;
+	}
+
+
+	template <typename RPC_INTERFACE>
+	template <typename T>
+	void Capability<RPC_INTERFACE>::
+	_unmarshal_result(Ipc_client &ipc_client, T &arg,
+	                  Meta::Overload_selector<Rpc_arg_inout>)
+	{
+		_unmarshal_result(ipc_client, arg, Meta::Overload_selector<Rpc_arg_out>());
+	}
+
+
+	template <typename RPC_INTERFACE>
+	template <typename ATL>
+	void Capability<RPC_INTERFACE>::
+	_unmarshal_results(Ipc_client &ipc_client, ATL &args)
+	{
+		/*
+		 * Unmarshal current argument. The overload of
+		 * '_unmarshal_result' is selected depending on the RPC
+		 * direction.
+		 */
+		typedef typename Trait::Rpc_direction<typename ATL::Head>::Type Rpc_dir;
+		_unmarshal_result(ipc_client, args.get(), Meta::Overload_selector<Rpc_dir>());
+
+		/* unmarshal remaining arguments */
+		_unmarshal_results(ipc_client, args._2);
+	}
+
+
+	template <typename RPC_INTERFACE>
+	template <typename IF>
+	void Capability<RPC_INTERFACE>::
+	_call(typename IF::Client_args &args, typename IF::Ret_type &ret)
+	{
+		/**
+		 * Message buffer for RPC message
+		 *
+		 * The message buffer gets automatically dimensioned according to the
+		 * specified 'IF' RPC function.
+		 */
+		enum { PROTOCOL_OVERHEAD = 4*sizeof(long),
+		       CALL_MSG_SIZE     = Rpc_function_msg_size<IF, RPC_CALL>::Value,
+		       REPLY_MSG_SIZE    = Rpc_function_msg_size<IF, RPC_REPLY>::Value };
+
+		Msgbuf<CALL_MSG_SIZE  + PROTOCOL_OVERHEAD>  call_buf;
+		Msgbuf<REPLY_MSG_SIZE + PROTOCOL_OVERHEAD> reply_buf;
+
+		Ipc_client ipc_client(*this, &call_buf, &reply_buf);
+
+		/* determine opcode of RPC function */
+		typedef typename RPC_INTERFACE::Rpc_functions Rpc_functions;
+		Rpc_opcode opcode = static_cast<int>(Meta::Index_of<Rpc_functions, IF>::Value);
+
+		/* marshal opcode and RPC input arguments */
+		ipc_client << opcode;
+		_marshal_args(ipc_client, args);
+
+		/* perform RPC, unmarshal return value */
+		ipc_client << IPC_CALL >> ret;
+
+		/* unmarshal RPC output arguments */
+		_unmarshal_results(ipc_client, args);
+
+		/* reflect callee-side exception at the caller */
+		_check_for_exceptions(ipc_client.result(),
+		                      Meta::Overload_selector<typename IF::Exceptions>());
+	}
+}
+
+#endif /* _INCLUDE__BASE__RPC_CLIENT_H_ */

base/include/base/rpc_server.h

@@ -0,0 +1,394 @@
+/*
+ * \brief  Server-side API of the RPC framework
+ * \author Norman Feske
+ * \date   2006-04-28
+ */
+
+/*
+ * Copyright (C) 2006-2011 Genode Labs GmbH
+ *
+ * This file is part of the Genode OS framework, which is distributed
+ * under the terms of the GNU General Public License version 2.
+ */
+
+#ifndef _INCLUDE__BASE__RPC_SERVER_H_
+#define _INCLUDE__BASE__RPC_SERVER_H_
+
+#include <base/rpc.h>
+#include <base/thread.h>
+#include <base/ipc.h>
+#include <base/object_pool.h>
+#include <base/lock.h>
+#include <base/printf.h>
+#include <cap_session/cap_session.h>
+
+namespace Genode {
+
+	/**
+	 * RPC dispatcher implementing the specified RPC interface
+	 *
+	 * \param RPC_INTERFACE  class providing the RPC interface description
+	 * \param SERVER         class to invoke for the server-side RPC functions
+	 *
+	 * This class is the base class of each server-side RPC implementation. It
+	 * contains the logic for dispatching incoming RPC requests and calls the
+	 * server functions according to the RPC declarations in 'RPC_INTERFACE'.
+	 *
+	 * If using the default argument for 'SERVER', the 'RPC_INTERFACE' is expected
+	 * to contain the abstract interface for all RPC functions. So virtual functions
+	 * must be declared in 'RPC_INTERFACE'. In contrast, by explicitly specifying
+	 * the 'SERVER' argument, the server-side dispatching performs direct function
+	 * calls to the respective member functions of the 'SERVER' class and thereby
+	 * omits virtual functions calls.
+	 */
+	template <typename RPC_INTERFACE, typename SERVER = RPC_INTERFACE>
+	class Rpc_dispatcher : public RPC_INTERFACE
+	{
+		/**
+		 * Shortcut for the type list of RPC functions provided by this server
+		 * component
+		 */
+		typedef typename RPC_INTERFACE::Rpc_functions Rpc_functions;
+
+		protected:
+
+			template <typename ARG_LIST>
+			void _read_args(Ipc_istream &is, ARG_LIST &args)
+			{
+				if (Trait::Rpc_direction<typename ARG_LIST::Head>::Type::IN)
+					is >> args._1;
+
+				_read_args(is, args._2);
+			}
+
+			void _read_args(Ipc_istream &is, Meta::Empty) { }
+
+			template <typename ARG_LIST>
+			void _write_results(Ipc_ostream &os, ARG_LIST &args)
+			{
+				if (Trait::Rpc_direction<typename ARG_LIST::Head>::Type::OUT)
+					os << args._1;
+
+				_write_results(os, args._2);
+			}
+
+			void _write_results(Ipc_ostream &os, Meta::Empty) { }
+
+			template <typename RPC_FUNCTION, typename EXC_TL>
+			Rpc_exception_code _do_serve(typename RPC_FUNCTION::Server_args &args,
+			                             typename RPC_FUNCTION::Ret_type    &ret,
+			                             Meta::Overload_selector<RPC_FUNCTION, EXC_TL>)
+			{
+				enum { EXCEPTION_CODE = RPC_EXCEPTION_BASE - Meta::Length<EXC_TL>::Value };
+				try {
+					typedef typename EXC_TL::Tail Exc_tail;
+					return _do_serve(args, ret,
+					                 Meta::Overload_selector<RPC_FUNCTION, Exc_tail>());
+				} catch (typename EXC_TL::Head) { return EXCEPTION_CODE; }
+			}
+
+			template <typename RPC_FUNCTION>
+			Rpc_exception_code _do_serve(typename RPC_FUNCTION::Server_args &args,
+			                             typename RPC_FUNCTION::Ret_type    &ret,
+			                             Meta::Overload_selector<RPC_FUNCTION, Meta::Empty>)
+			{
+				RPC_FUNCTION::serve(*static_cast<SERVER *>(this), args, ret);
+				return 0;
+			}
+
+			template <typename RPC_FUNCTIONS_TO_CHECK>
+			Rpc_exception_code _do_dispatch(Rpc_opcode opcode, Ipc_istream &is, Ipc_ostream &os,
+			                                Meta::Overload_selector<RPC_FUNCTIONS_TO_CHECK>)
+			{
+				using namespace Meta;
+
+				typedef typename RPC_FUNCTIONS_TO_CHECK::Head This_rpc_function;
+
+				if (opcode == Index_of<Rpc_functions, This_rpc_function>::Value) {
+
+					/*
+					 * Argument receive buffer
+					 *
+					 * To prevent the compiler from complaining about the
+					 * 'Server_args' data structure from being uninitialized,
+					 * we instantiate the variable as volatile and strip away
+					 * the volatile-ness when using it.
+					 */
+					struct {
+						typedef typename This_rpc_function::Server_args Data;
+						volatile Data _data;
+						Data &data() { return *(Data *)(&_data); }
+					} args;
+
+					/* read arguments from istream */
+					_read_args(is, args.data());
+
+					/*
+					 * Dispatch call to matching RPC base class, using
+					 * 'This_rpc_function' and the list of its exceptions to
+					 * select the overload.
+					 */
+					typedef typename This_rpc_function::Exceptions Exceptions;
+
+					typename This_rpc_function::Ret_type ret;
+					Rpc_exception_code exc;
+					exc = _do_serve(args.data(), ret, Overload_selector<This_rpc_function, Exceptions>());
+					os << ret;
+
+					/* write results to ostream 'os' */
+					_write_results(os, args.data());
+
+					return exc;
+				}
+
+				typedef typename RPC_FUNCTIONS_TO_CHECK::Tail Tail;
+				return _do_dispatch(opcode, is, os, Overload_selector<Tail>());
+			}
+
+			int _do_dispatch(int opcode, Ipc_istream &, Ipc_ostream &,
+			                 Meta::Overload_selector<Meta::Empty>)
+			{
+				PERR("invalid opcode %d\n", opcode);
+				return RPC_INVALID_OPCODE;
+			}
+
+			/**
+			 * Handle corner case of having an RPC interface with no RPC functions
+			 */
+			Rpc_exception_code _do_dispatch(int opcode, Ipc_istream &, Ipc_ostream &,
+			                                Meta::Overload_selector<Meta::Type_list<> >)
+			{
+				return 0;
+			}
+
+			/**
+			 * Protected constructor
+			 *
+			 * This class is only usable as base class.
+			 */
+			Rpc_dispatcher() { }
+
+		public:
+
+			Rpc_exception_code dispatch(int opcode, Ipc_istream &is, Ipc_ostream &os)
+			{
+				return _do_dispatch(opcode, is, os,
+				                    Meta::Overload_selector<Rpc_functions>());
+			}
+	};
+
+
+	class Rpc_object_base : public Object_pool<Rpc_object_base>::Entry
+	{
+		private:
+
+			Lock _dispatch_lock;
+
+		public:
+
+			virtual ~Rpc_object_base() { }
+
+			/*
+			 * Serialize access with dispatch loop
+			 *
+			 * These methods are used for the destruction of server objects.
+			 * They are exclusively used by 'Server_activation_base::entry()'
+			 * and 'Rpc_entrypoint::dissolve()'. Never use this lock for other
+			 * purposes.
+			 */
+
+			void lock()   { _dispatch_lock.lock(); }
+			void unlock() { _dispatch_lock.unlock(); }
+
+			/**
+			 * Interface to be implemented by a derived class
+			 *
+			 * \param op   opcode of invoked method
+			 * \param is   Ipc_input stream with method arguments
+			 * \param os   Ipc_output stream for storing method results
+			 */
+			virtual int dispatch(int op, Ipc_istream &is, Ipc_ostream &os) = 0;
+	};
+
+
+	/**
+	 * Object that is accessible from remote protection domains
+	 *
+	 * A 'Rpc_object' is a locally implemented object that can be referenced
+	 * from the outer world using a capability. The capability gets created
+	 * when attaching a 'Rpc_object' to a 'Rpc_entrypoint'.
+	 */
+	template <typename RPC_INTERFACE, typename SERVER = RPC_INTERFACE>
+	struct Rpc_object : Rpc_object_base, Rpc_dispatcher<RPC_INTERFACE, SERVER>
+	{
+		/*****************************
+		 ** Server-object interface **
+		 *****************************/
+
+		Rpc_exception_code dispatch(int opcode, Ipc_istream &is, Ipc_ostream &os)
+		{
+			return Rpc_dispatcher<RPC_INTERFACE, SERVER>::dispatch(opcode, is, os);
+		}
+
+		Capability<RPC_INTERFACE> const cap() const
+		{
+			return reinterpret_cap_cast<RPC_INTERFACE>(Rpc_object_base::cap());
+		}
+	};
+
+
+	/**
+	 * RPC entrypoint serving RPC objects
+	 *
+	 * The entrypoint's thread will initialize its capability but will not
+	 * immediately enable the processing of requests. This way, the
+	 * activation-using server can ensure that it gets initialized completely
+	 * before the first capability invocations come in. Once the server is
+	 * ready, it must enable the entrypoint explicitly by calling the
+	 * 'activate()' function. The 'start_on_construction' argument is a
+	 * shortcut for the common case where the server's capability is handed
+	 * over to other parties _after_ the server is completely initialized.
+	 */
+	class Rpc_entrypoint : Thread_base, public Object_pool<Rpc_object_base>
+	{
+		private:
+
+			/**
+			 * Prototype capability to derive capabilities for RPC objects
+			 * from.
+			 */
+			Untyped_capability _cap;
+
+			enum { SND_BUF_SIZE = 1024, RCV_BUF_SIZE = 1024 };
+			Msgbuf<SND_BUF_SIZE> _snd_buf;
+			Msgbuf<RCV_BUF_SIZE> _rcv_buf;
+
+			/**
+			 * Hook to let low-level thread init code access private members
+			 *
+			 * This function is only used on NOVA.
+			 */
+			static void _activation_entry();
+
+		protected:
+
+			Ipc_server      *_ipc_server;
+			Rpc_object_base *_curr_obj;       /* currently dispatched RPC object    */
+			Lock             _curr_obj_lock;  /* for the protection of '_curr_obj'  */
+			Lock             _cap_valid;      /* thread startup synchronization     */
+			Lock             _delay_start;    /* delay start of request dispatching */
+			Cap_session     *_cap_session;    /* for creating capabilities          */
+
+			/**
+			 * Back-end function to associate RPC object with the entry point
+			 */
+			Untyped_capability _manage(Rpc_object_base *obj);
+
+			/**
+			 * Back-end function to Dissolve RPC object from entry point
+			 */
+			void _dissolve(Rpc_object_base *obj);
+
+			/**
+			 * Force activation to cancel dispatching the specified server object
+			 */
+			void _leave_server_object(Rpc_object_base *obj);
+
+			/**
+			 * Wait until the entrypoint activation is initialized
+			 */
+			void _block_until_cap_valid();
+
+			/**
+			 * Thread interface
+			 */
+			void entry();
+
+		public:
+
+			/**
+			 * Constructor
+			 *
+			 * \param cap_session  'Cap_session' for creating capabilities
+			 *                     for the RPC objects managed by this entry
+			 *                     point
+			 * \param stack_size   stack size of entrypoint thread
+			 * \param name         name of entrypoint thread
+			 */
+			Rpc_entrypoint(Cap_session *cap_session, size_t stack_size,
+			               char const *name, bool start_on_construction = true);
+
+			/**
+			 * Associate RPC object with the entry point
+			 */
+			template <typename RPC_INTERFACE, typename RPC_SERVER>
+			Capability<RPC_INTERFACE>
+			manage(Rpc_object<RPC_INTERFACE, RPC_SERVER> *obj)
+			{
+				Untyped_capability untyped_cap = _manage(obj);
+
+				/*
+				 * Turn untyped capability returned by '_entrypoint.manage()'
+				 * to a capability with the type corresponding to the supplied
+				 * RPC object.
+				 */
+				Capability<RPC_INTERFACE> typed_cap;
+				memcpy(&typed_cap, &untyped_cap, sizeof(typed_cap));
+				return typed_cap;
+			}
+
+			/**
+			 * Dissolve server object from entry point
+			 */
+			template <typename RPC_INTERFACE, typename RPC_SERVER>
+			void dissolve(Rpc_object<RPC_INTERFACE, RPC_SERVER> *obj)
+			{
+				_dissolve(obj);
+			}
+
+			/**
+			 * Activate entrypoint, start processing RPC requests
+			 */
+			void activate();
+
+			/**
+			 * Request reply capability for current call
+			 *
+			 * Note: This is a temporary API function, which is going to be
+			 * removed. Please do not use this function.
+			 *
+			 * Typically, a capability obtained via this function is used as
+			 * argument of 'intermediate_reply'.
+			 */
+			Untyped_capability reply_dst();
+
+			/**
+			 * Prevent reply of current request
+			 *
+			 * Note: This is a temporary API function, which is going to be
+			 * removed. Please do not use this function.
+			 *
+			 * This function can be used to keep the calling client blocked
+			 * after the server has finished the processing of the client's
+			 * request. At a later time, the server may chose to unblock the
+			 * client via the 'intermedate_reply' function.
+			 */
+			void omit_reply();
+
+			/**
+			 * Send a reply out of the normal call-reply order
+			 *
+			 * Note: This is a temporary API function, which is going to be
+			 * removed. Please do not use this function.
+			 *
+			 * In combination with the 'reply_dst' accessor functions, this
+			 * function can be used to implement services that dispatch client
+			 * requests out of order. In such cases, the server activation may
+			 * send reply messages to multiple blocking clients before
+			 * answering the original call.
+			 */
+			void explicit_reply(Untyped_capability reply_cap, int return_value);
+	};
+}
+
+#endif /* _INCLUDE__BASE__RPC_SERVER_H_ */

base/include/base/semaphore.h

@@ -0,0 +1,173 @@
+/*
+ * \brief  Semaphore
+ * \author Norman Feske
+ * \author Christian Prochaska
+ * \date   2006-09-22
+ */
+
+/*
+ * Copyright (C) 2006-2011 Genode Labs GmbH
+ *
+ * This file is part of the Genode OS framework, which is distributed
+ * under the terms of the GNU General Public License version 2.
+ */
+
+#ifndef _INCLUDE__BASE__SEMAPHORE_H_
+#define _INCLUDE__BASE__SEMAPHORE_H_
+
+#include <base/lock.h>
+#include <util/list.h>
+#include <util/fifo.h>
+
+namespace Genode {
+
+	/**
+	 * Semaphore queue interface
+	 */
+	class Semaphore_queue
+	{
+		public:
+
+			/**
+			 * Semaphore-queue elements
+			 *
+			 * A queue element represents a thread blocking on the
+			 * semaphore.
+			 */
+			class Element : Lock
+			{
+				public:
+
+					/**
+					 * Constructor
+					 */
+					Element() : Lock(LOCKED) { }
+
+					void block()   { lock();   }
+					void wake_up() { unlock(); }
+			};
+
+			/**
+			 * Add new queue member that is going to block
+			 */
+			void enqueue(Element *e);
+
+			/**
+			 * Dequeue queue member to wake up next
+			 */
+			Element *dequeue();
+	};
+
+
+	/**
+	 * First-in-first-out variant of the semaphore-queue interface
+	 */
+	class Fifo_semaphore_queue : public Semaphore_queue
+	{
+		public:
+
+			class Element : public Semaphore_queue::Element,
+			                public Fifo<Element>::Element { };
+
+		private:
+
+			Fifo<Element> _fifo;
+
+		public:
+
+			void enqueue(Element *e) { _fifo.enqueue(e); }
+
+			Element *dequeue()  { return _fifo.dequeue(); }
+	};
+
+
+	/**
+	 * Semaphore base template
+	 *
+	 * \param QT  semaphore wait queue type implementing the
+	 *            'Semaphore_queue' interface
+	 * \param QTE wait-queue element type implementing the
+	 *            'Semaphore_queue::Element' interface
+	 *
+	 * The queuing policy is defined via the QT and QTE types.
+	 * This way, the platform-specific semaphore-queueing policies
+	 * such as priority-sorted queueing can be easily supported.
+	 */
+	template <typename QT, typename QTE>
+	class Semaphore_template
+	{
+		protected:
+
+			int  _cnt;
+			Lock _meta_lock;
+			QT   _queue;
+
+		public:
+
+			/**
+			 * Constructor
+			 *
+			 * \param n  initial counter value of the semphore
+			 */
+			Semaphore_template(int n = 0) : _cnt(n) { }
+
+			~Semaphore_template()
+			{
+				/* synchronize destruction with unfinished 'up()' */
+				try { _meta_lock.lock(); } catch (...) { }
+			}
+
+			void up()
+			{
+				Lock::Guard lock_guard(_meta_lock);
+
+				if (++_cnt > 0)
+					return;
+
+				/*
+				 * Remove element from queue and wake up the corresponding
+				 * blocking thread
+				 */
+				_queue.dequeue()->wake_up();
+			}
+
+			void down()
+			{
+				_meta_lock.lock();
+
+				if (--_cnt < 0) {
+
+					/*
+					 * Create semaphore queue element representing the thread
+					 * in the wait queue.
+					 */
+					QTE queue_element;
+					_queue.enqueue(&queue_element);
+					_meta_lock.unlock();
+
+					/*
+					 * The thread is going to block on a local lock now,
+					 * waiting for getting waked from another thread
+					 * calling 'up()'
+					 * */
+					queue_element.block();
+
+				} else {
+					_meta_lock.unlock();
+				}
+			}
+
+			/**
+			 * Return current semaphore counter
+			 */
+			int cnt() { return _cnt; }
+	};
+
+
+	/**
+	 * Semaphore with default behaviour
+	 */
+	typedef Semaphore_template<Fifo_semaphore_queue, Fifo_semaphore_queue::Element> Semaphore;
+}
+
+#endif /* _INCLUDE__BASE__SEMAPHORE_H_ */

base/include/base/service.h

@@ -0,0 +1,414 @@
+/*
+ * \brief  Service management framework
+ * \author Norman Feske
+ * \date   2006-07-12
+ */
+
+/*
+ * Copyright (C) 2006-2011 Genode Labs GmbH
+ *
+ * This file is part of the Genode OS framework, which is distributed
+ * under the terms of the GNU General Public License version 2.
+ */
+
+#ifndef _INCLUDE__BASE__SERVICE_H_
+#define _INCLUDE__BASE__SERVICE_H_
+
+#include <root/client.h>
+#include <base/printf.h>
+#include <util/list.h>
+#include <ram_session/client.h>
+#include <base/env.h>
+
+namespace Genode {
+
+	/**
+	 * Client role
+	 *
+	 * A client is someone who applies for a service. If the service is not
+	 * available yet, we enqueue the client into a wait queue and wake him up
+	 * as soon as the requested service gets available.
+	 */
+	class Client : public List<Client>::Element
+	{
+		private:
+
+			Cancelable_lock _service_apply_lock;
+			const char     *_apply_for;
+
+		public:
+
+			/**
+			 * Constructor
+			 */
+			Client(): _service_apply_lock(Lock::LOCKED), _apply_for(0) { }
+
+			virtual ~Client() { }
+
+			/**
+			 * Set/Request service name that we are currently applying for
+			 */
+			void apply_for(const char *apply_for) { _apply_for = apply_for; }
+			const char *apply_for() { return _apply_for; }
+
+			/**
+			 * Service wait queue support
+			 */
+			void sleep()  { _service_apply_lock.lock(); }
+			void wakeup() { _service_apply_lock.unlock(); }
+	};
+
+
+	/**
+	 * Server role
+	 *
+	 * A server is a process that provides one or multiple services. For the
+	 * most part, this class is used as an opaque key to represent the server
+	 * role.
+	 */
+	class Server
+	{
+		private:
+
+			Ram_session_capability _ram;
+
+		public:
+
+			/**
+			 * Constructor
+			 *
+			 * \param ram  RAM session capability of the server process used,
+			 *             for quota transfers from/to the server
+			 */
+			Server(Ram_session_capability ram): _ram(ram) { }
+
+			/**
+			 * Return RAM session capability of the server process
+			 */
+			Ram_session_capability ram_session_cap() const { return _ram; }
+	};
+
+
+	class Service : public List<Service>::Element
+	{
+		public:
+
+			enum { MAX_NAME_LEN = 32 };
+
+		private:
+
+			char _name[MAX_NAME_LEN];
+
+		public:
+
+			/*********************
+			 ** Exception types **
+			 *********************/
+
+			class Invalid_args   { };
+			class Unavailable    { };
+			class Quota_exceeded { };
+
+			/**
+			 * Constructor
+			 *
+			 * \param name  service name
+			 */
+			Service(const char *name) { strncpy(_name, name, sizeof(_name)); }
+
+			virtual ~Service() { }
+
+			/**
+			 * Return service name
+			 */
+			const char *name() const { return _name; }
+
+			/**
+			 * Create session
+			 *
+			 * \param args  session-construction arguments
+			 *
+			 * \throw Invalid_args
+			 * \throw Unavailable
+			 * \throw Quota_exceeded
+			 */
+			virtual Session_capability session(const char *args) = 0;
+
+			/**
+			 * Extend resource donation to an existing session
+			 */
+			virtual void upgrade(Session_capability session, const char *args) = 0;
+
+			/**
+			 * Close session
+			 */
+			virtual void close(Session_capability session) { }
+
+			/**
+			 * Return server providing the service
+			 */
+			virtual Server *server() const { return 0; }
+
+			/**
+			 * Return the RAM session to be used for trading resources
+			 */
+			Ram_session_capability ram_session_cap()
+			{
+				if (server())
+					return server()->ram_session_cap();
+				return Ram_session_capability();
+			}
+	};
+
+
+	/**
+	 * Representation of a locally implemented service
+	 */
+	class Local_service : public Service
+	{
+		private:
+
+			Root *_root;
+
+		public:
+
+			Local_service(const char *name, Root *root)
+			: Service(name), _root(root) { }
+
+			Session_capability session(const char *args)
+			{
+				try { return _root->session(args); }
+				catch (Root::Invalid_args)   { throw Invalid_args(); }
+				catch (Root::Unavailable)    { throw Unavailable(); }
+				catch (Root::Quota_exceeded) { throw Quota_exceeded(); }
+			}
+
+			void upgrade(Session_capability session, const char *args) {
+				_root->upgrade(session, args); }
+
+			void close(Session_capability session) {
+				_root->close(session); }
+	};
+
+
+	/**
+	 * Representation of a service provided by our parent
+	 */
+	class Parent_service : public Service
+	{
+		public:
+
+			Parent_service(const char *name) : Service(name) { }
+
+			Session_capability session(const char *args)
+			{
+				try { return env()->parent()->session(name(), args); }
+				catch (Parent::Unavailable) {
+					PWRN("parent has no service \"%s\"", name());
+					throw Unavailable();
+				}
+				catch (Parent::Quota_exceeded) { throw Quota_exceeded(); }
+			}
+
+			void upgrade(Session_capability session, const char *args) {
+				env()->parent()->upgrade(session, args); }
+
+			void close(Session_capability session) {
+				env()->parent()->close(session); }
+	};
+
+
+	/**
+	 * Representation of a service that is implemented in a child
+	 */
+	class Child_service : public Service
+	{
+		private:
+
+			Root_capability _root_cap;
+			Root_client     _root;
+			Server         *_server;
+
+		public:
+
+			/**
+			 * Constructor
+			 *
+			 * \param name    name of service
+			 * \param root    capability to root interface
+			 * \param server  server process providing the service
+			 */
+			Child_service(const char     *name,
+			              Root_capability root,
+			              Server         *server)
+			: Service(name), _root_cap(root), _root(root), _server(server) { }
+
+			Server *server() const { return _server; }
+
+			Session_capability session(const char *args)
+			{
+				if (!_root_cap.valid())
+					throw Unavailable();
+
+				try { return _root.session(args); }
+				catch (Root::Invalid_args)   { throw Invalid_args();   }
+				catch (Root::Unavailable)    { throw Unavailable();    }
+				catch (Root::Quota_exceeded) { throw Quota_exceeded(); }
+			}
+
+			void upgrade(Session_capability sc, const char *args)
+			{
+				if (!_root_cap.valid())
+					throw Unavailable();
+
+				try { _root.upgrade(sc, args); }
+				catch (Root::Invalid_args)   { throw Invalid_args();   }
+				catch (Root::Unavailable)    { throw Unavailable();    }
+				catch (Root::Quota_exceeded) { throw Quota_exceeded(); }
+			}
+
+			void close(Session_capability sc) { _root.close(sc); }
+	};
+
+
+	/**
+	 * Container for holding service representations
+	 */
+	class Service_registry
+	{
+		protected:
+
+			Lock          _service_wait_queue_lock;
+			List<Client>  _service_wait_queue;
+			List<Service> _services;
+
+		public:
+
+			/**
+			 * Probe for service with specified name
+			 *
+			 * \param name    service name
+			 * \param server  server providing the service,
+			 *                default (0) for any server
+			 */
+			Service *find(const char *name, Server *server = 0)
+			{
+				if (!name) return 0;
+
+				Lock::Guard lock_guard(_service_wait_queue_lock);
+
+				for (Service *s = _services.first(); s; s = s->next())
+					if (strcmp(s->name(), name) == 0
+					 && (!server || s->server() == server)) return s;
+
+				return 0;
+			}
+
+			/**
+			 * Check if service name is ambiguous
+			 *
+			 * \return true  if the same service is provided multiple
+			 *               times
+			 */
+			bool is_ambiguous(const char *name)
+			{
+				Lock::Guard lock_guard(_service_wait_queue_lock);
+
+				/* count number of services with the specified name */
+				unsigned cnt = 0;
+				for (Service *s = _services.first(); s; s = s->next())
+					cnt += (strcmp(s->name(), name) == 0);
+				return cnt > 1;
+			}
+
+			/**
+			 * Return first service provided by specified server
+			 */
+			Service *find_by_server(Server *server)
+			{
+				Lock::Guard lock_guard(_service_wait_queue_lock);
+
+				for (Service *s = _services.first(); s; s = s->next())
+					if (s->server() == server)
+						return s;
+
+				return 0;
+			}
+
+			/**
+			 * Wait for service
+			 *
+			 * This function is called by the clients's thread
+			 * when requesting a session creation. It blocks
+			 * if the requested service is not available.
+			 *
+			 * \return  service structure that matches the request or
+			 *          0 if the waiting was canceled.
+			 */
+			Service *wait_for_service(const char *name, Client *client, const char *client_name)
+			{
+				Service *service;
+
+				client->apply_for(name);
+
+				_service_wait_queue_lock.lock();
+				_service_wait_queue.insert(client);
+				_service_wait_queue_lock.unlock();
+
+				do {
+					service = find(name);
+
+					/*
+					 * The service that we are seeking is not available today.
+					 * Lets sleep a night over it.
+					 */
+					if (!service) {
+						printf("%s: service %s not yet available - sleeping\n",
+						       client_name, name);
+
+						try {
+							client->sleep();
+							printf("%s: service %s got available\n", client_name, name);
+						} catch (Blocking_canceled) {
+							printf("%s: cancel waiting for service\n", client_name);
+							break;
+						}
+					}
+
+				} while (!service);
+
+				/* we got what we needed, stop applying */
+				_service_wait_queue_lock.lock();
+				_service_wait_queue.remove(client);
+				_service_wait_queue_lock.unlock();
+
+				client->apply_for(0);
+
+				return service;
+			}
+
+			/**
+			 * Register service
+			 *
+			 * This function is called by the server's thread.
+			 */
+			void insert(Service *service)
+			{
+				/* make new service known */
+				_services.insert(service);
+
+				/* wake up applicants waiting for the service */
+				Lock::Guard lock_guard(_service_wait_queue_lock);
+				for (Client *c = _service_wait_queue.first(); c; c = c->next())
+					if (strcmp(service->name(), c->apply_for()) == 0)
+						c->wakeup();
+			}
+
+			/**
+			 * Unregister service
+			 */
+			void remove(Service *service) { _services.remove(service); }
+	};
+}
+
+#endif /* _INCLUDE__BASE__SERVICE_H_ */

base/include/base/signal.h

@@ -0,0 +1,284 @@
+/*
+ * \brief  Delivery and reception of asynchronous notifications
+ * \author Norman Feske
+ * \date   2008-09-05
+ *
+ * Each transmitter sends signals to one fixed destination.
+ * A receiver can receive signals from multiple sources.
+ */
+
+/*
+ * Copyright (C) 2008-2011 Genode Labs GmbH
+ *
+ * This file is part of the Genode OS framework, which is distributed
+ * under the terms of the GNU General Public License version 2.
+ */
+
+#ifndef _INCLUDE__BASE__SIGNAL_H__
+#define _INCLUDE__BASE__SIGNAL_H__
+
+#include <base/semaphore.h>
+#include <signal_session/signal_session.h>
+
+namespace Genode {
+
+	class Signal_receiver;
+	class Signal_context;
+
+
+	/**
+	 * Signal
+	 *
+	 * A signal represents a number of asynchronous notifications produced by
+	 * one transmitter. If notifications are generated at a higher rate than as
+	 * they can be processed at the receiver, the transmitter counts the
+	 * notifications and delivers the total amount with the next signal
+	 * transmission. This way, the total number of notifications gets properly
+	 * communicated to the receiver even if the receiver is not highly
+	 * responsive.
+	 *
+	 * Asynchronous notifications do not carry any payload because this payload
+	 * would need to be queued at the transmitter. However, each transmitter
+	 * imprints a signal-context reference into each signal. This context
+	 * can be used by the receiver to distinguish signals coming from different
+	 * transmitters.
+	 */
+	class Signal
+	{
+		private:
+
+			friend class Signal_receiver;
+			friend class Signal_context;
+
+			Signal_context *_context;
+			int             _num;
+
+			/**
+			 * Constructor
+			 *
+			 * \param context  signal context specific for the signal-receiver
+			 *                 capability used for signal transmission
+			 * \param num      number of signals received from the same transmitter
+			 *
+			 * Signal objects are constructed only by signal receivers.
+			 */
+			Signal(Signal_context *context, int num)
+			: _context(context), _num(num)
+			{ }
+
+		public:
+
+			/**
+			 * Default constructor, creating an invalid signal
+			 */
+			Signal() : _context(0), _num(0) { }
+
+			/**
+			 * Return signal context
+			 */
+			Signal_context *context() { return _context; }
+
+			/**
+			 * Return number of signals received from the same transmitter
+			 */
+			int num() { return _num; }
+	};
+
+	/**
+	 * Signal context
+	 *
+	 * A signal context is a destination for signals. One receiver can listen
+	 * to multple contexts. If a signal arrives, the context is provided with the
+	 * signel. This enables the receiver to distinguish different signal sources
+	 * and dispatch incoming signals context-specific.
+	 */
+	class Signal_context
+	{
+		private:
+
+			/**
+			 * Helper class to handle a 'Signal_context' as list element
+			 */
+			struct List_element : public List<List_element>::Element {
+				Signal_context *context; };
+
+			/**
+			 * List element in the receiver's context list
+			 */
+			List_element _list_element;
+
+			/**
+			 * Receiver to which the context is associated with
+			 *
+			 * This member is initialized by the receiver when associating
+			 * the context with the receiver via the 'cap' function.
+			 */
+			Signal_receiver *_receiver;
+
+			Lock   _lock;          /* protect '_curr_signal'         */
+			Signal _curr_signal;   /* most-currently received signal */
+			bool   _pending;       /* current signal is valid        */
+
+			/**
+			 * Capability assigned to this context after being assocated with
+			 * a 'Signal_receiver' via the 'manage' function. We store this
+			 * capability in the 'Signal_context' for the mere reason to
+			 * properly destruct the context (see '_unsynchronized_dissolve').
+			 */
+			Signal_context_capability _cap;
+
+			friend class Signal_receiver;
+
+		public:
+
+			/**
+			 * Constructor
+			 */
+			Signal_context() : _receiver(0), _pending(0) { }
+
+			/**
+			 * Destructor
+			 *
+			 * The virtual destructor is just there to generate a vtable for
+			 * signal-context objects such that signal contexts can be dynamically
+			 * casted.
+			 */
+			virtual ~Signal_context() { }
+
+			/*
+			 * Signal contexts are never invoked but only used as arguments for
+			 * 'Signal_session' functions. Hence, there exists a capability
+			 * type for it but no real RPC interface.
+			 */
+			GENODE_RPC_INTERFACE();
+	};
+
+
+	/**
+	 * Signal transmitter
+	 *
+	 * Each signal-transmitter instance acts on behalf the context specified
+	 * as constructor argument. Therefore, the resources needed for the
+	 * transmitter such as the consumed memory 'sizeof(Signal_transmitter)'
+	 * should be accounted to the owner of the context.
+	 */
+	class Signal_transmitter
+	{
+		private:
+
+			Signal_context_capability _context;  /* destination */
+
+		public:
+
+			/**
+			 * Constructor
+			 *
+			 * \param context  capability to signal context that is going to
+			 *                 receive signals produced by the transmitter
+			 */
+			Signal_transmitter(Signal_context_capability context = Signal_context_capability());
+
+			/**
+			 * Set signal context
+			 */
+			void context(Signal_context_capability context);
+
+			/**
+			 * Trigger signal submission to context
+			 *
+			 * \param cnt  number of signals to submit at once
+			 */
+			void submit(int cnt = 1);
+	};
+
+
+	/**
+	 * Signal receiver
+	 */
+	class Signal_receiver
+	{
+		private:
+
+			Semaphore _signal_available;  /* signal(s) awaiting to be picked up */
+
+			/**
+			 * List of associated contexts
+			 */
+			Lock                               _contexts_lock;
+			List<Signal_context::List_element> _contexts;
+
+			/**
+			 * Helper to dissolve given context
+			 *
+			 * This function prevents duplicated code in '~Signal_receiver'
+			 * and 'dissolve'. Note that '_contexts_lock' must be held when
+			 * calling this function.
+			 */
+			void _unsynchronized_dissolve(Signal_context *context);
+
+		public:
+
+			/**
+			 * Exception class
+			 */
+			class Context_already_in_use { };
+			class Context_not_associated { };
+
+			/**
+			 * Constructor
+			 */
+			Signal_receiver();
+
+			/**
+			 * Destructor
+			 */
+			~Signal_receiver();
+
+			/**
+			 * Manage signal context and return new signal-context capability
+			 *
+			 * \param context  context associated with signals delivered to the
+			 *                 receiver
+			 * \throw          'Context_already_in_use'
+			 * \return         new signal-context capability that can be
+			 *                 passed to a signal transmitter
+			 */
+			Signal_context_capability manage(Signal_context *context);
+
+			/**
+			 * Dissolve signal context from receiver
+			 *
+			 * \param context  context to remove from receiver
+			 * \throw          'Context_not_associated'
+			 */
+			void dissolve(Signal_context *context);
+
+			/**
+			 * Return true if signal was received
+			 */
+			bool pending();
+
+			/**
+			 * Block until a signal is received
+			 *
+			 * \return received signal
+			 */
+			Signal wait_for_signal();
+
+			/**
+			 * Locally submit signal to the receiver
+			 */
+			void local_submit(Signal signal);
+
+			/**
+			 * Framework-internal signal-dispatcher
+			 *
+			 * This function is called from the thread that monitors the signal
+			 * source associated with the process. It must not be used for other
+			 * purposes.
+			 */
+			static void dispatch_signals(Signal_source *signal_source);
+	};
+}
+
+#endif /* _INCLUDE__BASE__SIGNAL_H__ */

base/include/base/slab.h

@@ -0,0 +1,255 @@
+/*
+ * \brief  Slab allocator
+ * \author Norman Feske
+ * \date   2006-04-18
+ */
+
+/*
+ * Copyright (C) 2006-2011 Genode Labs GmbH
+ *
+ * This file is part of the Genode OS framework, which is distributed
+ * under the terms of the GNU General Public License version 2.
+ */
+
+#ifndef _INCLUDE__BASE__SLAB_H_
+#define _INCLUDE__BASE__SLAB_H_
+
+#include <base/allocator.h>
+#include <base/stdint.h>
+
+namespace Genode {
+
+	class Slab;
+	class Slab_entry;
+	class Allocator;
+
+	/**
+	 * A slab block holds an array of slab entries.
+	 */
+	class Slab_block
+	{
+		public:
+
+			Slab_block *next;  /* next block     */
+			Slab_block *prev;  /* previous block */
+
+		private:
+
+			enum { FREE, USED };
+
+			Slab    *_slab;    /* back reference to slab allocator */
+			unsigned _avail;   /* free entries of this block       */
+
+			/*
+			 * Each slab block consists of three areas, a fixed-size header
+			 * that contains the member variables declared above, a byte array
+			 * called state table that holds the allocation state for each slab
+			 * entry, and an area holding the actual slab entries. The number
+			 * of state-table elements corresponds to the maximum number of slab
+			 * entries per slab block (the '_num_elem' member variable of the
+			 * Slab allocator).
+			 */
+
+			char _data[];  /* dynamic data (state table and slab entries) */
+
+			/*
+			 * Caution! no member variables allowed below this line!
+			 */
+
+			/**
+			 * Accessor functions to allocation state
+			 *
+			 * \param idx  index of slab entry
+			 */
+			inline bool state(int idx) { return _data[idx]; }
+			inline void state(int idx, bool state) { _data[idx] = state; }
+
+			/**
+			 * Request address of slab entry by its index
+			 */
+			Slab_entry *slab_entry(int idx);
+
+			/**
+			 * Determine block index of specified slab entry
+			 */
+			int slab_entry_idx(Slab_entry *e);
+
+		public:
+
+			/**
+			 * Constructor
+			 *
+			 * Normally, Slab_blocks are constructed by a Slab allocator
+			 * that specifies itself as constructor argument.
+			 */
+			explicit Slab_block(Slab *s = 0) { if (s) slab(s); }
+
+			/**
+			 * Configure block to be managed by the specified slab allocator
+			 */
+			void slab(Slab *slab);
+
+			/**
+			 * Request number of available entries in block
+			 */
+			unsigned avail() { return _avail; }
+
+			/**
+			 * Allocate slab entry from block
+			 */
+			void *alloc();
+
+			/**
+			 * Return a used slab block entry
+			 */
+			Slab_entry *first_used_entry();
+
+			/**
+			 * These functions are called by Slab_entry.
+			 */
+			void inc_avail(Slab_entry *e);
+			void dec_avail();
+
+			/**
+			 * Debug and test hooks
+			 */
+			void dump();
+			int check_bounds();
+	};
+
+
+	class Slab_entry
+	{
+		private:
+
+			Slab_block *_sb;
+			char        _data[];
+
+			/*
+			 * Caution! no member variables allowed below this line!
+			 */
+
+		public:
+
+			void init() { _sb = 0; }
+
+			void occupy(Slab_block *sb)
+			{
+				_sb = sb;
+				_sb->dec_avail();
+			}
+
+			void free()
+			{
+				_sb->inc_avail(this);
+				_sb = 0;
+			}
+
+			void *addr() { return _data; }
+
+			/**
+			 * Lookup Slab_entry by given address
+			 *
+			 * The specified address is supposed to point to _data[0].
+			 */
+			static Slab_entry *slab_entry(void *addr) {
+				return (Slab_entry *)((addr_t)addr - sizeof(Slab_entry)); }
+	};
+
+
+	/**
+	 * Slab allocator
+	 */
+	class Slab : public Allocator
+	{
+		private:
+
+			size_t      _slab_size;     /* size of one slab entry               */
+			size_t      _block_size;    /* size of slab block                   */
+			size_t      _num_elem;      /* number of slab entries per block     */
+			Slab_block *_first_sb;      /* first slab block                     */
+			Slab_block *_initial_sb;    /* initial (static) slab block          */
+			bool        _alloc_state;   /* indicator for 'currently in service' */
+
+			Allocator *_backing_store;
+
+			/**
+			 * Allocate and initialize new slab block
+			 */
+			Slab_block *_new_slab_block();
+
+		public:
+
+			inline size_t slab_size()  { return _slab_size;  }
+			inline size_t block_size() { return _block_size; }
+			inline size_t num_elem()   { return _num_elem;   }
+			inline size_t entry_size() { return sizeof(Slab_entry) + _slab_size; }
+
+			/**
+			 * Constructor
+			 *
+			 * At construction time, there exists one initial slab
+			 * block that is used for the first couple of allocations,
+			 * especially for the allocation of the second slab
+			 * block.
+			 */
+			Slab(size_t slab_size, size_t block_size, Slab_block *initial_sb,
+			     Allocator *backing_store = 0);
+
+			/**
+			 * Destructor
+			 */
+			~Slab();
+
+			/**
+			 * Debug function for dumping the current slab block list
+			 */
+			void dump_sb_list();
+
+			/**
+			 * Remove block from slab block list
+			 */
+			void remove_sb(Slab_block *sb);
+
+			/**
+			 * Insert block into slab block list
+			 */
+			void insert_sb(Slab_block *sb, Slab_block *at = 0);
+
+			/**
+			 * Allocate slab entry
+			 */
+			void *alloc();
+
+			/**
+			 * Free slab entry
+			 */
+			static void free(void *addr);
+
+			/**
+			 * Return a used slab element
+			 */
+			void *first_used_elem();
+
+			/**
+			 * Return true if number of free slab entries is higher than n
+			 */
+			bool num_free_entries_higher_than(int n);
+
+			/**
+			 * Define/request backing-store allocator
+			 */
+			void backing_store(Allocator *bs) { _backing_store = bs; }
+			Allocator *backing_store() { return _backing_store; }
+
+			/**
+			 * Allocator interface
+			 */
+			bool   alloc(size_t, void **);
+			void   free(void *addr, size_t) { free(addr); }
+			size_t consumed();
+			size_t overhead(size_t size) { return _block_size/_num_elem; }
+	};
+}
+
+#endif /* _INCLUDE__BASE__SLAB_H_ */

base/include/base/sleep.h

@@ -0,0 +1,29 @@
+/*
+ * \brief  Lay back and relax
+ * \author Norman Feske
+ * \date   2006-07-19
+ */
+
+/*
+ * Copyright (C) 2006-2011 Genode Labs GmbH
+ *
+ * This file is part of the Genode OS framework, which is distributed
+ * under the terms of the GNU General Public License version 2.
+ */
+
+#ifndef _INCLUDE__BASE__SLEEP_H_
+#define _INCLUDE__BASE__SLEEP_H_
+
+#include <base/ipc.h>
+
+namespace Genode {
+
+	__attribute__((noreturn)) inline void sleep_forever()
+	{
+		Msgbuf<16> buf;
+		Ipc_server s(&buf, &buf);
+		while (1) s >> IPC_WAIT;
+	}
+}
+
+#endif /* _INCLUDE__BASE__SLEEP_H_ */

base/include/base/snprintf.h

@@ -0,0 +1,82 @@
+/*
+ * \brief  Facility to write format string into character buffer
+ * \author Norman Feske
+ * \date   2006-07-17
+ */
+
+/*
+ * Copyright (C) 2006-2011 Genode Labs GmbH
+ *
+ * This file is part of the Genode OS framework, which is distributed
+ * under the terms of the GNU General Public License version 2.
+ */
+
+#ifndef _INCLUDE__BASE__SNPRINTF_H_
+#define _INCLUDE__BASE__SNPRINTF_H_
+
+#include <base/console.h>
+#include <base/stdint.h>
+
+namespace Genode {
+
+	class String_console : public Console
+	{
+		private:
+
+			char   *_dst;
+			size_t  _dst_len;
+			size_t  _w_offset;
+
+		public:
+
+			/**
+			 * Constructor
+			 *
+			 * \param dst      destination character buffer
+			 * \param dst_len  size of dst
+			 */
+			String_console(char *dst, size_t dst_len)
+			: _dst(dst), _dst_len(dst_len), _w_offset(0)
+			{ _dst[0] = 0; }
+
+			/**
+			 * Return number of characters in destination buffer
+			 */
+			size_t len() { return _w_offset; }
+
+
+			/***********************
+			 ** Console interface **
+			 ***********************/
+
+			void _out_char(char c)
+			{
+				/* ensure to leave space for null-termination */
+				if (_w_offset > _dst_len - 2)
+					return;
+
+				_dst[_w_offset++] = c;
+				_dst[_w_offset] = 0;
+			}
+	};
+
+	/**
+	 * Print format string into character buffer
+	 *
+	 * \return  number of characters written to destination buffer
+	 */
+	inline int snprintf(char *, size_t, const char *, ...) __attribute__((format(printf, 3, 4)));
+	inline int snprintf(char *dst, size_t dst_len, const char *format, ...)
+	{
+		va_list list;
+		va_start(list, format);
+
+		String_console sc(dst, dst_len);
+		sc.vprintf(format, list);
+
+		va_end(list);
+		return sc.len();
+	}
+}
+
+#endif /* _INCLUDE__BASE__SNPRINTF_H_ */

base/include/base/stdint.h

@@ -0,0 +1,43 @@
+/*
+ * \brief  Genode-specific integer types
+ * \author Christian Helmuth
+ * \date   2006-05-10
+ */
+
+/*
+ * Copyright (C) 2006-2011 Genode Labs GmbH
+ *
+ * This file is part of the Genode OS framework, which is distributed
+ * under the terms of the GNU General Public License version 2.
+ */
+
+#ifndef _INCLUDE__BASE__STDINT_H_
+#define _INCLUDE__BASE__STDINT_H_
+
+/* fixed-width integer types */
+#include <base/fixed_stdint.h>
+
+namespace Genode {
+
+	/**
+	 * Integer type for non-negative size values
+	 */
+	typedef __SIZE_TYPE__   size_t;
+
+	/**
+	 * Integer type for memory addresses
+	 */
+	typedef unsigned long   addr_t;
+
+	/**
+	 * Integer type for memory offset values
+	 */
+	typedef long             off_t;
+
+	/**
+	 * Integer type corresponding to a machine register
+	 */
+	typedef unsigned long umword_t;
+}
+
+#endif /* _INCLUDE__BASE__STDINT_H_ */

base/include/base/sync_allocator.h

@@ -0,0 +1,168 @@
+/*
+ * \brief  Lock-guarded allocator interface
+ * \author Norman Feske
+ * \date   2008-08-05
+ */
+
+/*
+ * Copyright (C) 2008-2011 Genode Labs GmbH
+ *
+ * This file is part of the Genode OS framework, which is distributed
+ * under the terms of the GNU General Public License version 2.
+ */
+
+#ifndef _INCLUDE__BASE__SYNC_ALLOCATOR_H_
+#define _INCLUDE__BASE__SYNC_ALLOCATOR_H_
+
+#include <base/allocator.h>
+#include <base/lock.h>
+
+namespace Genode {
+
+	/**
+	 * Lock-guarded range allocator
+	 *
+	 * This class wraps the complete 'Range_allocator' interface while
+	 * preventing concurrent calls to the wrapped allocator implementation.
+	 *
+	 * \param ALLOCATOR_IMPL  class implementing the 'Range_allocator'
+	 *                        interface
+	 */
+	template <typename ALLOCATOR_IMPL>
+	class Synchronized_range_allocator : public Range_allocator
+	{
+		private:
+
+			Lock           _default_lock;
+			Lock          *_lock;
+			ALLOCATOR_IMPL _alloc;
+
+		public:
+
+			/**
+			 * Constructor
+			 *
+			 * This constructor uses an embedded lock for synchronizing the
+			 * access to the allocator.
+			 */
+			Synchronized_range_allocator()
+			: _lock(&_default_lock) { }
+
+			/**
+			 * Constructor
+			 *
+			 * This constructor uses an embedded lock for synchronizing the
+			 * access to the allocator.
+			 */
+			explicit Synchronized_range_allocator(Allocator *metadata_alloc)
+			: _lock(&_default_lock), _alloc(metadata_alloc) { }
+
+			/**
+			 * Constructor
+			 *
+			 * \param lock  use specified lock rather then an embedded lock for
+			 *              synchronization
+			 *
+			 * This constructor is useful if multiple allocators must be
+			 * synchronized with each other. In such as case, the shared
+			 * lock can be passed to each 'Synchronized_range_allocator'
+			 * instance.
+			 */
+			Synchronized_range_allocator(Lock *lock, Allocator *metadata_alloc)
+			: _lock(lock), _alloc(metadata_alloc) { }
+
+			/**
+			 * Return reference to wrapped (non-thread-safe) allocator
+			 *
+			 * This is needed, for example, if the wrapped allocator implements
+			 * methods in addition to the Range_allocator interface.
+			 *
+			 * NOTE: Synchronize accesses to the raw allocator by facilitating
+			 * the lock() member function.
+			 */
+			ALLOCATOR_IMPL *raw() { return &_alloc; }
+
+			/**
+			 * Return reference to synchronization lock
+			 */
+			Lock *lock() { return _lock; }
+
+
+			/*************************
+			 ** Allocator interface **
+			 *************************/
+
+			bool alloc(size_t size, void **out_addr)
+			{
+				Lock::Guard lock_guard(*_lock);
+				return _alloc.alloc(size, out_addr);
+			}
+
+			void free(void *addr, size_t size)
+			{
+				Lock::Guard lock_guard(*_lock);
+				_alloc.free(addr, size);
+			}
+
+			size_t consumed()
+			{
+				Lock::Guard lock_guard(*_lock);
+				return _alloc.consumed();
+			}
+
+			size_t overhead(size_t size)
+			{
+				Lock::Guard lock_guard(*_lock);
+				return _alloc.overhead(size);
+			}
+
+
+			/*******************************
+			 ** Range-allocator interface **
+			 *******************************/
+
+			int add_range(addr_t base, size_t size)
+			{
+				Lock::Guard lock_guard(*_lock);
+				return _alloc.add_range(base, size);
+			}
+
+			int remove_range(addr_t base, size_t size)
+			{
+				Lock::Guard lock_guard(*_lock);
+				return _alloc.remove_range(base, size);
+			}
+
+			bool alloc_aligned(size_t size, void **out_addr, int align = 0)
+			{
+				Lock::Guard lock_guard(*_lock);
+				return _alloc.alloc_aligned(size, out_addr, align);
+			}
+
+			Alloc_return alloc_addr(size_t size, addr_t addr)
+			{
+				Lock::Guard lock_guard(*_lock);
+				return _alloc.alloc_addr(size, addr);
+			}
+
+			void free(void *addr)
+			{
+				Lock::Guard lock_guard(*_lock);
+				_alloc.free(addr);
+			}
+
+			size_t avail()
+			{
+				Lock::Guard lock_guard(*_lock);
+				return _alloc.avail();
+			}
+
+			bool valid_addr(addr_t addr)
+			{
+				Lock::Guard lock_guard(*_lock);
+				return _alloc.valid_addr(addr);
+			}
+	};
+}
+
+#endif /* _INCLUDE__BASE__SYNC_ALLOCATOR_H_ */

base/include/base/thread.h

@@ -0,0 +1,367 @@
+/*
+ * \brief  Thread interface
+ * \author Norman Feske
+ * \date   2006-04-28
+ *
+ * For storing thread-specific data (called thread context) such as the stack
+ * and thread-local data, there is a dedicated portion of the virtual address
+ * space. This portion is called thread-context area. Within the thread-context
+ * area, each thread has a fixed-sized slot, a thread context. The layout of
+ * each thread context looks as follows
+ *
+ * ! lower address
+ * !   ...
+ * !   ============================ <- aligned at 'CONTEXT_VIRTUAL_SIZE'
+ * !
+ * !             empty
+ * !
+ * !   ----------------------------
+ * !
+ * !             stack
+ * !             (top)              <- initial stack pointer
+ * !   ---------------------------- <- address of 'Context' object
+ * !    additional context members
+ * !   ----------------------------
+ * !              UTCB
+ * !   ============================ <- aligned at 'CONTEXT_VIRTUAL_SIZE'
+ * !   ...
+ * ! higher address
+ *
+ * On some platforms, a user-level thread-control block (UTCB) area contains
+ * data shared between the user-level thread and the kernel. It is typically
+ * used for transferring IPC message payload or for system-call arguments.
+ * The additional context members are a reference to the corresponding
+ * 'Thread_base' object and the name of the thread.
+ *
+ * The thread context is a virtual memory area, initially not backed by real
+ * memory. When a new thread is created, an empty thread context gets assigned
+ * to the new thread and populated with memory pages for the stack and the
+ * additional context members. Note that this memory is allocated from the RAM
+ * session of the process environment and not accounted for when using the
+ * 'sizeof()' operand on a 'Thread_base' object.
+ */
+
+/*
+ * Copyright (C) 2006-2011 Genode Labs GmbH
+ *
+ * This file is part of the Genode OS framework, which is distributed
+ * under the terms of the GNU General Public License version 2.
+ */
+
+#ifndef _INCLUDE__BASE__THREAD_H_
+#define _INCLUDE__BASE__THREAD_H_
+
+/* Genode includes */
+#include <base/exception.h>
+#include <base/lock.h>
+#include <base/native_types.h>
+#include <util/list.h>
+#include <ram_session/ram_session.h>  /* for 'Ram_dataspace_capability' type */
+#include <cpu_session/cpu_session.h>  /* for 'Thread_capability' type */
+
+
+namespace Genode {
+
+	class Rm_session;
+
+	/**
+	 * Concurrent control flow
+	 *
+	 * A 'Thread_base' object corresponds to a physical thread. The execution
+	 * starts at the 'entry()' function as soon as 'start()' is called.
+	 */
+	class Thread_base
+	{
+		public:
+
+			class Context_alloc_failed : public Exception { };
+			class Stack_too_large      : public Exception { };
+			class Stack_alloc_failed   : public Exception { };
+
+			/*
+			 * Thread-context area configuration.
+			 *
+			 * Please update platform-specific files after changing these
+			 * values, e.g., 'base-linux/src/platform/context_area.*.ld'.
+			 */
+			enum { CONTEXT_AREA_VIRTUAL_BASE = 0x40000000 };
+			enum { CONTEXT_AREA_VIRTUAL_SIZE = 0x10000000 };
+
+			/**
+			 * Size of virtual address region holding the context of one thread
+			 */
+			enum { CONTEXT_VIRTUAL_SIZE      = 0x00100000 };
+			enum { CONTEXT_VIRTUAL_BASE_MASK = ~(CONTEXT_VIRTUAL_SIZE - 1) };
+
+		private:
+
+			/**
+			 * List-element helper to enable inserting threads in a list
+			 */
+			List_element<Thread_base> _list_element;
+
+		public:
+
+			/**
+			 * Thread context located within the thread-context area
+			 *
+			 * The end of a thread context is placed at a boundary aligned at
+			 * 'CONTEXT_VIRTUAL_SIZE'.
+			 */
+			struct Context
+			{
+				/**
+				 * Top of the stack
+				 */
+				long stack[];
+
+				/**
+				 * Pointer to corresponding 'Thread_base' object
+				 */
+				Thread_base *thread_base;
+
+				/**
+				 * Virtual address of the start of the stack
+				 *
+				 * This address is pointing to the begin of the dataspace used
+				 * for backing the thread context except for the UTCB (which is
+				 * managed by the kernel).
+				 */
+				addr_t stack_base;
+
+				/**
+				 * Dataspace containing the backing store for the thread context
+				 *
+				 * We keep the dataspace capability to be able to release the
+				 * backing store on thread destruction.
+				 */
+				Ram_dataspace_capability ds_cap;
+
+				/**
+				 * Maximum length of thread name, including null-termination
+				 */
+				enum { NAME_LEN = 64 };
+
+				/**
+				 * Thread name, used for debugging
+				 */
+				char name[NAME_LEN];
+
+				/*
+				 * <- end of regular memory area
+				 *
+				 * The following part of the thread context is backed by
+				 * kernel-managed memory. No member variables are allowed
+				 * beyond this point.
+				 */
+
+				/**
+				 * Kernel-specific user-level thread control block
+				 */
+				Native_utcb utcb;
+			};
+
+		private:
+
+			/**
+			 * Manage the allocation of thread contexts
+			 *
+			 * There exists only one instance of this class per process.
+			 */
+			class Context_allocator
+			{
+				private:
+
+					List<List_element<Thread_base> > _threads;
+					Lock                             _threads_lock;
+
+					/**
+					 * Detect if a context already exists at the specified address
+					 */
+					bool _is_in_use(addr_t base);
+
+				public:
+
+					/**
+					 * Allocate thread context for specified thread
+					 *
+					 * \param thread  thread for which to allocate the new context
+					 * \return        virtual address of new thread context, or
+					 *                0 if the allocation failed
+					 */
+					Context *alloc(Thread_base *thread);
+
+					/**
+					 * Release thread context
+					 */
+					void free(Thread_base *thread);
+
+					/**
+					 * Return 'Context' object for a given base address
+					 */
+					static Context *base_to_context(addr_t base);
+
+					/**
+					 * Return base address of context containing the specified address
+					 */
+					static addr_t addr_to_base(void *addr);
+			};
+
+			/**
+			 * Return thread-context allocator
+			 */
+			static Context_allocator *_context_allocator();
+
+			/**
+			 * Allocate and locally attach a new thread context
+			 */
+			Context *_alloc_context(size_t stack_size);
+
+			/**
+			 * Detach and release thread context of the thread
+			 */
+			void _free_context();
+
+			/**
+			 * Platform-specific thread-startup code
+			 *
+			 * On some platforms, each new thread has to perform a startup
+			 * protocol, e.g., waiting for a message from the kernel. This hook
+			 * function allows for the implementation of such protocols.
+			 */
+			void _thread_bootstrap();
+
+			/**
+			 * Helper for thread startup
+			 */
+			static void _thread_start();
+
+			/**
+			 * Hook for platform-specific constructor supplements
+			 */
+			void _init_platform_thread();
+
+			/**
+			 * Hook for platform-specific destructor supplements
+			 */
+			void _deinit_platform_thread();
+
+			/* hook only used for microblaze kernel */
+			void _init_context(Context* c);
+
+		protected:
+
+			/**
+			 * Capability for this thread (set by _start())
+			 *
+			 * Used if thread creation involves core's CPU service.
+			 * Currently, this is not the case for NOVA.
+			 */
+			Genode::Thread_capability _thread_cap;
+
+			/**
+			 * Pointer to corresponding thread context
+			 */
+			Context *_context;
+
+			/**
+			 * Physical thread ID
+			 */
+			Native_thread _tid;
+
+		public:
+
+			/**
+			 * Constructor
+			 *
+			 * \param name        thread name for debugging
+			 * \param stack_size  stack size
+			 *
+			 * The stack for the new thread will be allocated from the RAM
+			 * session of the process environment. A small portion of the
+			 * stack size is internally used by the framework for storing
+			 * thread-context information such as the thread's name (see
+			 * 'struct Context').
+			 */
+			Thread_base(const char *name, size_t stack_size);
+
+			/**
+			 * Destructor
+			 */
+			virtual ~Thread_base();
+
+			/**
+			 * Entry function of the thread
+			 */
+			virtual void entry() = 0;
+
+			/**
+			 * Start execution of the thread
+			 *
+			 * This function is virtual to enable the customization of threads
+			 * used as server activation.
+			 */
+			virtual void start();
+
+			/**
+			 * Request name of thread
+			 */
+			void name(char *dst, size_t dst_len);
+
+			/**
+			 * Request capability of thread
+			 */
+			Genode::Thread_capability cap() const { return _thread_cap; }
+
+			/**
+			 * Cancel currently blocking operation
+			 */
+			void cancel_blocking();
+
+			/**
+			 * Only to be called from platform-specific code
+			 */
+			Native_thread & tid() { return _tid; }
+
+			/**
+			 * Return top of stack
+			 *
+			 * \return  pointer to first stack element
+			 */
+			void *stack_top() { return &_context->stack[-1]; }
+
+			/**
+			 * Return 'Thread_base' object corresponding to the calling thread
+			 *
+			 * \return  pointer to 'Thread_base' object, or
+			 *          0 if the calling thread is the main thread
+			 */
+			static Thread_base *myself();
+
+			/**
+			 * Return user-level thread control block
+			 *
+			 * Note that it is safe to call this function on the result of the
+			 * 'myself' function. It handles the special case of 'myself' being
+			 * 0 when called by the main thread.
+			 */
+			Native_utcb *utcb();
+	};
+
+
+	template <unsigned STACK_SIZE>
+	class Thread : public Thread_base
+	{
+		public:
+
+			/**
+			 * Constructor
+			 *
+			 * \param name  thread name (for debugging)
+			 */
+			explicit Thread(const char *name = "<noname>")
+			: Thread_base(name, STACK_SIZE) { }
+	};
+}
+
+#endif /* _INCLUDE__BASE__THREAD_H_ */

base/include/base/thread_state.h

@@ -0,0 +1,26 @@
+/*
+ * \brief  Thread state
+ * \author Norman Feske
+ * \date   2007-07-30
+ *
+ * This file contains the generic part of the thread state.
+ */
+
+/*
+ * Copyright (C) 2007-2011 Genode Labs GmbH
+ *
+ * This file is part of the Genode OS framework, which is distributed
+ * under the terms of the GNU General Public License version 2.
+ */
+
+#ifndef _INCLUDE__BASE__THREAD_STATE_H_
+#define _INCLUDE__BASE__THREAD_STATE_H_
+
+#include <base/cpu_state.h>
+
+namespace Genode {
+
+	struct Thread_state : public Cpu_state { };
+}
+
+#endif /* _INCLUDE__BASE__THREAD_STATE_H_ */

base/include/base/tslab.h

@@ -0,0 +1,35 @@
+/*
+ * \brief  Typed slab allocator
+ * \author Norman Feske
+ * \date   2006-05-17
+ */
+
+/*
+ * Copyright (C) 2006-2011 Genode Labs GmbH
+ *
+ * This file is part of the Genode OS framework, which is distributed
+ * under the terms of the GNU General Public License version 2.
+ */
+
+#ifndef _INCLUDE__BASE__TSLAB_H_
+#define _INCLUDE__BASE__TSLAB_H_
+
+#include <base/slab.h>
+
+namespace Genode {
+
+	template <typename T, size_t BLOCK_SIZE>
+	class Tslab : public Slab
+	{
+		public:
+
+			Tslab(Allocator  *backing_store,
+			      Slab_block *initial_sb = 0)
+			: Slab(sizeof(T), BLOCK_SIZE, initial_sb, backing_store)
+			{ }
+
+			T *first_object() { return (T *)Slab::first_used_elem(); }
+	};
+}
+
+#endif /* _INCLUDE__BASE__TSLAB_H_ */

base/include/cap_session/cap_session.h

@@ -0,0 +1,59 @@
+/*
+ * \brief  CAP-session interface
+ * \author Norman Feske
+ * \date   2006-06-23
+ *
+ * A 'Cap_session' is an allocator of user-level capabilities.
+ * User-level capabilities are used to reference server objects
+ * across address spaces.
+ */
+
+/*
+ * Copyright (C) 2006-2011 Genode Labs GmbH
+ *
+ * This file is part of the Genode OS framework, which is distributed
+ * under the terms of the GNU General Public License version 2.
+ */
+
+#ifndef _INCLUDE__CAP_SESSION__CAP_SESSION_H_
+#define _INCLUDE__CAP_SESSION__CAP_SESSION_H_
+
+#include <base/native_types.h>
+#include <session/session.h>
+
+namespace Genode {
+
+	struct Cap_session : Session
+	{
+		static const char *service_name() { return "CAP"; }
+
+		virtual ~Cap_session() { }
+
+		/**
+		 * Allocate new unique userland capability
+		 *
+		 * \param ep  entry point that will use this capability
+		 *
+		 * \return new userland capability
+		 */
+		virtual Native_capability alloc(Native_capability ep) = 0;
+
+		/**
+		 * Free userland capability
+		 *
+		 * \param cap  userland capability to free
+		 */
+		virtual void free(Native_capability cap) = 0;
+
+
+		/*********************
+		 ** RPC declaration **
+		 *********************/
+
+		GENODE_RPC(Rpc_alloc, Native_capability, alloc, Native_capability);
+		GENODE_RPC(Rpc_free, void, free, Native_capability);
+		GENODE_RPC_INTERFACE(Rpc_alloc, Rpc_free);
+	};
+}
+
+#endif /* _INCLUDE__CAP_SESSION__CAP_SESSION_H_ */

base/include/cap_session/capability.h

@@ -0,0 +1,22 @@
+/*
+ * \brief  CAP-session capability type
+ * \author Norman Feske
+ * \date   2008-08-16
+ */
+
+/*
+ * Copyright (C) 2008-2011 Genode Labs GmbH
+ *
+ * This file is part of the Genode OS framework, which is distributed
+ * under the terms of the GNU General Public License version 2.
+ */
+
+#ifndef _INCLUDE__CAP_SESSION__CAPABILITY_H_
+#define _INCLUDE__CAP_SESSION__CAPABILITY_H_
+
+#include <base/capability.h>
+#include <cap_session/cap_session.h>
+
+namespace Genode { typedef Capability<Cap_session> Cap_session_capability; }
+
+#endif /* _INCLUDE__CAP_SESSION__CAPABILITY_H_ */

base/include/cap_session/client.h

@@ -0,0 +1,35 @@
+/*
+ * \brief  Client-side CAP session interface
+ * \author Norman Feske
+ * \date   2006-07-10
+ */
+
+/*
+ * Copyright (C) 2006-2011 Genode Labs GmbH
+ *
+ * This file is part of the Genode OS framework, which is distributed
+ * under the terms of the GNU General Public License version 2.
+ */
+
+#ifndef _INCLUDE__CAP_SESSION__CLIENT_H_
+#define _INCLUDE__CAP_SESSION__CLIENT_H_
+
+#include <cap_session/capability.h>
+#include <cap_session/cap_session.h>
+#include <base/rpc_client.h>
+
+namespace Genode {
+
+	struct Cap_session_client : Rpc_client<Cap_session>
+	{
+		explicit Cap_session_client(Cap_session_capability session)
+		: Rpc_client<Cap_session>(session) { }
+
+		Native_capability alloc(Native_capability ep) {
+			return call<Rpc_alloc>(ep); }
+
+		void free(Native_capability cap) { call<Rpc_free>(cap); }
+	};
+}
+
+#endif /* _INCLUDE__CAP_SESSION__CLIENT_H_ */

base/include/cap_session/connection.h

@@ -0,0 +1,32 @@
+/*
+ * \brief  Connection to CAP service
+ * \author Norman Feske
+ * \date   2008-08-22
+ */
+
+/*
+ * Copyright (C) 2008-2011 Genode Labs GmbH
+ *
+ * This file is part of the Genode OS framework, which is distributed
+ * under the terms of the GNU General Public License version 2.
+ */
+
+#ifndef _INCLUDE__CAP_SESSION__CONNECTION_H_
+#define _INCLUDE__CAP_SESSION__CONNECTION_H_
+
+#include <cap_session/client.h>
+#include <base/connection.h>
+
+namespace Genode {
+
+	struct Cap_connection : Connection<Cap_session>, Cap_session_client
+	{
+		Cap_connection()
+		:
+			Connection<Cap_session>(session("ram_quota=4K")),
+			Cap_session_client(cap())
+		{ }
+	};
+}
+
+#endif /* _INCLUDE__CAP_SESSION__CONNECTION_H_ */

base/include/cpu_session/capability.h

@@ -0,0 +1,22 @@
+/*
+ * \brief  CPU-session capability type
+ * \author Norman Feske
+ * \date   2008-08-16
+ */
+
+/*
+ * Copyright (C) 2008-2011 Genode Labs GmbH
+ *
+ * This file is part of the Genode OS framework, which is distributed
+ * under the terms of the GNU General Public License version 2.
+ */
+
+#ifndef _INCLUDE__CPU_SESSION__CAPABILITY_H_
+#define _INCLUDE__CPU_SESSION__CAPABILITY_H_
+
+#include <base/capability.h>
+#include <cpu_session/cpu_session.h>
+
+namespace Genode { typedef Capability<Cpu_session> Cpu_session_capability; }
+
+#endif /* _INCLUDE__CPU_SESSION__CAPABILITY_H_ */

base/include/cpu_session/client.h

@@ -0,0 +1,65 @@
+/*
+ * \brief  Client-side cpu session interface
+ * \author Christian Helmuth
+ * \date   2006-07-12
+ */
+
+/*
+ * Copyright (C) 2006-2011 Genode Labs GmbH
+ *
+ * This file is part of the Genode OS framework, which is distributed
+ * under the terms of the GNU General Public License version 2.
+ */
+
+#ifndef _INCLUDE__CPU_SESSION__CLIENT_H_
+#define _INCLUDE__CPU_SESSION__CLIENT_H_
+
+#include <cpu_session/capability.h>
+#include <base/rpc_client.h>
+
+namespace Genode {
+
+	struct Cpu_session_client : Rpc_client<Cpu_session>
+	{
+		explicit Cpu_session_client(Cpu_session_capability session)
+		: Rpc_client<Cpu_session>(session) { }
+
+		Thread_capability create_thread(Name const &name) {
+			return call<Rpc_create_thread>(name); }
+
+		void kill_thread(Thread_capability thread) {
+			call<Rpc_kill_thread>(thread); }
+
+		Thread_capability first() {
+			return call<Rpc_first>(); }
+
+		Thread_capability next(Thread_capability curr) {
+			return call<Rpc_next>(curr); }
+
+		int set_pager(Thread_capability thread, Pager_capability pager) {
+			return call<Rpc_set_pager>(thread, pager); }
+
+		int start(Thread_capability thread, addr_t ip, addr_t sp) {
+			return call<Rpc_start>(thread, ip, sp); }
+
+		void pause(Thread_capability thread) {
+			call<Rpc_pause>(thread); }
+
+		void resume(Thread_capability thread) {
+			call<Rpc_resume>(thread); }
+
+		void cancel_blocking(Thread_capability thread) {
+			call<Rpc_cancel_blocking>(thread); }
+
+		int state(Thread_capability thread, Thread_state *dst_state) {
+			return call<Rpc_state>(thread, dst_state); }
+
+		void exception_handler(Thread_capability thread, Signal_context_capability handler) {
+			call<Rpc_exception_handler>(thread, handler); }
+
+		void single_step(Thread_capability thread, bool enable) {
+			call<Rpc_single_step>(thread, enable); }
+	};
+}
+
+#endif /* _INCLUDE__CPU_SESSION__CLIENT_H_ */

base/include/cpu_session/connection.h

@@ -0,0 +1,42 @@
+/*
+ * \brief  Connection to CPU service
+ * \author Norman Feske
+ * \date   2008-08-22
+ */
+
+/*
+ * Copyright (C) 2008-2011 Genode Labs GmbH
+ *
+ * This file is part of the Genode OS framework, which is distributed
+ * under the terms of the GNU General Public License version 2.
+ */
+
+#ifndef _INCLUDE__CPU_SESSION__CONNECTION_H_
+#define _INCLUDE__CPU_SESSION__CONNECTION_H_
+
+#include <cpu_session/client.h>
+#include <base/connection.h>
+
+namespace Genode {
+
+	struct Cpu_connection : Connection<Cpu_session>, Cpu_session_client
+	{
+		enum { RAM_QUOTA = 32*1024 };
+
+		/**
+		 * Constructor
+		 *
+		 * \param label     initial session label
+		 * \param priority  designated priority of all threads created
+		 *                  with this CPU session
+		 */
+		Cpu_connection(const char *label = "", long priority = DEFAULT_PRIORITY)
+		:
+			Connection<Cpu_session>(
+				session("priority=0x%lx, ram_quota=32K, label=\"%s\"",
+				        priority, label)),
+			Cpu_session_client(cap()) { }
+	};
+}
+
+#endif /* _INCLUDE__CPU_SESSION__CONNECTION_H_ */

base/include/cpu_session/cpu_session.h

@@ -0,0 +1,230 @@
+/*
+ * \brief  CPU (processing time) manager session interface
+ * \author Christian Helmuth
+ * \date   2006-06-27
+ *
+ * :Question:
+ *
+ *   Why are thread operations not methods of the thread but
+ *   methods of the CPU session?
+ *
+ * :Answer:
+ *
+ *   This enables the CPU session to impose policies on thread
+ *   operations. These policies are based on the session
+ *   construction arguments. If thread operations would be
+ *   provided as thread methods, Thread would need to consult
+ *   its container object (its CPU session) about the authorization
+ *   of each operation and, thereby, would introduce a circular
+ *   dependency between CPU session and Thread.
+ */
+
+/*
+ * Copyright (C) 2006-2011 Genode Labs GmbH
+ *
+ * This file is part of the Genode OS framework, which is distributed
+ * under the terms of the GNU General Public License version 2.
+ */
+
+#ifndef _INCLUDE__CPU_SESSION__CPU_SESSION_H_
+#define _INCLUDE__CPU_SESSION__CPU_SESSION_H_
+
+#include <base/stdint.h>
+#include <base/exception.h>
+#include <base/thread_state.h>
+#include <base/rpc_args.h>
+#include <base/signal.h>
+#include <thread/capability.h>
+#include <pager/capability.h>
+#include <session/session.h>
+
+namespace Genode {
+
+	struct Cpu_session : Session
+	{
+			/*********************
+			 ** Exception types **
+			 *********************/
+
+			class Thread_creation_failed : public Exception { };
+
+			static const char *service_name() { return "CPU"; }
+
+			enum { THREAD_NAME_LEN = 48 };
+			enum { PRIORITY_LIMIT = 1 << 16 };
+			enum { DEFAULT_PRIORITY = 0 };
+
+			typedef Rpc_in_buffer<THREAD_NAME_LEN> Name;
+
+			virtual ~Cpu_session() { }
+
+			/**
+			 * Create a new thread
+			 *
+			 * \param   name  name for the thread
+			 * \return        capability representing the new thread
+			 * \throw         Thread_creation_failed
+			 */
+			virtual Thread_capability create_thread(Name const &name) = 0;
+
+			/**
+			 * Kill an existing thread
+			 *
+			 * \param thread  capability of the thread to kill
+			 */
+			virtual void kill_thread(Thread_capability thread) = 0;
+
+			/**
+			 * Retrieve thread list of CPU session
+			 *
+			 * The next() function returns an invalid capability if the
+			 * specified thread does not exists or if it is the last one
+			 * of the CPU session.
+			 */
+			virtual Thread_capability first() = 0;
+			virtual Thread_capability next(Thread_capability curr) = 0;
+
+			/**
+			 * Set paging capabilities for thread
+			 *
+			 * \param thread  thread to configure
+			 * \param pager   capability used to propagate page faults
+			 */
+			virtual int set_pager(Thread_capability thread,
+			                      Pager_capability  pager) = 0;
+
+			/**
+			 * Modify instruction and stack pointer of thread - start the
+			 * thread
+			 *
+			 * \param thread  thread to start
+			 * \param ip      initial instruction pointer
+			 * \param sp      initial stack pointer
+			 *
+			 * \return        0 on success
+			 */
+			virtual int start(Thread_capability thread, addr_t ip, addr_t sp) = 0;
+
+			/**
+			 * Pause the specified thread
+			 *
+			 * After calling this function, the execution of the thread can be
+			 * continued by calling 'resume'.
+			 */
+			virtual void pause(Thread_capability thread) = 0;
+
+			/**
+			 * Resume the specified thread
+			 */
+			virtual void resume(Thread_capability thread) = 0;
+
+			/**
+			 * Cancel a currently blocking operation
+			 *
+			 * \param thread  thread to unblock
+			 */
+			virtual void cancel_blocking(Thread_capability thread) = 0;
+
+			/**
+			 * Return thread state
+			 *
+			 * \param thread     thread to spy on
+			 * \param state_dst  result
+			 *
+			 * \return           0 on success
+			 */
+			virtual int state(Thread_capability thread,
+			                  Thread_state *state_dst) = 0;
+
+			/**
+			 * Register signal handler for exceptions of the specified thread
+			 */
+			virtual void exception_handler(Thread_capability         thread,
+			                               Signal_context_capability handler) = 0;
+
+			/**
+			 * Enable/disable single stepping for specified thread.
+			 *
+			 * Since this functions is currently supported by a small number of
+			 * platforms, we provide a default implementation
+			 *
+			 * \param thread  thread to set into single step mode
+			 * \param enable  true = enable single-step mode; false = disable
+			 */
+			virtual void single_step(Thread_capability thread, bool enable) {}
+
+			/**
+			 * Translate generic priority value to kernel-specific priority levels
+			 *
+			 * \param pf_prio_limit  maximum priority used for the kernel, must
+			 *                       be power of 2
+			 * \param prio           generic priority value as used by the CPU
+			 *                       session interface
+			 * \param inverse        order of platform priorities, if true
+			 *                       'pf_prio_limit' corresponds to the highest
+			 *                       priority, otherwise it refers to the
+			 *                       lowest priority.
+			 * \return               platform-specific priority value
+			 */
+			static unsigned scale_priority(unsigned pf_prio_limit, unsigned prio,
+			                               bool inverse = true)
+			{
+				/* if no priorities are used, use the platform priority limit */
+				if (prio == 0) return pf_prio_limit;
+
+				/*
+				 * Generic priority values are (0 is highest, 'PRIORITY_LIMIT'
+				 * is lowest. On platforms where priority levels are defined
+				 * the other way round, we have to invert the priority value.
+				 */
+				prio = inverse ? Cpu_session::PRIORITY_LIMIT - prio : prio;
+
+				/* scale value to platform priority range 0..pf_prio_limit */
+				return (prio*pf_prio_limit)/Cpu_session::PRIORITY_LIMIT;
+			}
+
+			/*********************
+			 ** RPC declaration **
+			 *********************/
+
+			GENODE_RPC_THROW(Rpc_create_thread, Thread_capability, create_thread,
+			                 GENODE_TYPE_LIST(Thread_creation_failed), Name const &);
+			GENODE_RPC(Rpc_kill_thread, void, kill_thread, Thread_capability);
+			GENODE_RPC(Rpc_first, Thread_capability, first,);
+			GENODE_RPC(Rpc_next, Thread_capability, next, Thread_capability);
+			GENODE_RPC(Rpc_set_pager, int, set_pager, Thread_capability, Pager_capability);
+			GENODE_RPC(Rpc_start, int, start, Thread_capability, addr_t, addr_t);
+			GENODE_RPC(Rpc_pause, void, pause, Thread_capability);
+			GENODE_RPC(Rpc_resume, void, resume, Thread_capability);
+			GENODE_RPC(Rpc_cancel_blocking, void, cancel_blocking, Thread_capability);
+			GENODE_RPC(Rpc_state, int, state, Thread_capability, Thread_state *);
+			GENODE_RPC(Rpc_exception_handler, void, exception_handler,
+			                                  Thread_capability, Signal_context_capability);
+			GENODE_RPC(Rpc_single_step, void, single_step, Thread_capability, bool);
+
+			/*
+			 * 'GENODE_RPC_INTERFACE' declaration done manually
+			 *
+			 * The number of RPC function of this interface exceeds the maximum
+			 * number of elements supported by 'Meta::Type_list'. Therefore, we
+			 * construct the type list by hand using nested type tuples instead
+			 * of employing the convenience macro 'GENODE_RPC_INTERFACE'.
+			 */
+			typedef Meta::Type_tuple<Rpc_create_thread,
+			        Meta::Type_tuple<Rpc_kill_thread,
+			        Meta::Type_tuple<Rpc_first,
+			        Meta::Type_tuple<Rpc_next,
+			        Meta::Type_tuple<Rpc_set_pager,
+			        Meta::Type_tuple<Rpc_start,
+			        Meta::Type_tuple<Rpc_pause,
+			        Meta::Type_tuple<Rpc_resume,
+			        Meta::Type_tuple<Rpc_cancel_blocking,
+			        Meta::Type_tuple<Rpc_state,
+			        Meta::Type_tuple<Rpc_exception_handler,
+			        Meta::Type_tuple<Rpc_single_step,
+			                         Meta::Empty>
+			        > > > > > > > > > > > Rpc_functions;
+	};
+}
+
+#endif /* _INCLUDE__CPU_SESSION__CPU_SESSION_H_ */

base/include/dataspace/capability.h

@@ -0,0 +1,22 @@
+/*
+ * \brief  Dataspace capability type
+ * \author Norman Feske
+ * \date   2008-08-16
+ */
+
+/*
+ * Copyright (C) 2008-2011 Genode Labs GmbH
+ *
+ * This file is part of the Genode OS framework, which is distributed
+ * under the terms of the GNU General Public License version 2.
+ */
+
+#ifndef _INCLUDE__DATASPACE__CAPABILITY_H_
+#define _INCLUDE__DATASPACE__CAPABILITY_H_
+
+#include <base/capability.h>
+#include <dataspace/dataspace.h>
+
+namespace Genode { typedef Capability<Dataspace> Dataspace_capability; }
+
+#endif /* _INCLUDE__DATASPACE__CAPABILITY_H_ */

base/include/dataspace/client.h

@@ -0,0 +1,33 @@
+/*
+ * \brief  Dataspace client interface
+ * \author Norman Feske
+ * \date   2006-05-11
+ */
+
+/*
+ * Copyright (C) 2006-2011 Genode Labs GmbH
+ *
+ * This file is part of the Genode OS framework, which is distributed
+ * under the terms of the GNU General Public License version 2.
+ */
+
+#ifndef _INCLUDE__DATASPACE__CLIENT_H_
+#define _INCLUDE__DATASPACE__CLIENT_H_
+
+#include <dataspace/capability.h>
+#include <base/rpc_client.h>
+
+namespace Genode {
+
+	struct Dataspace_client : Rpc_client<Dataspace>
+	{
+		explicit Dataspace_client(Dataspace_capability ds)
+		: Rpc_client<Dataspace>(ds) { }
+
+		size_t size()      { return call<Rpc_size>();      }
+		addr_t phys_addr() { return call<Rpc_phys_addr>(); }
+		bool   writable()  { return call<Rpc_writable>();  }
+	};
+}
+
+#endif /* _INCLUDE__DATASPACE__CLIENT_H_ */

base/include/dataspace/dataspace.h

@@ -0,0 +1,54 @@
+/*
+ * \brief  Dataspace interface
+ * \author Norman Feske
+ * \date   2006-07-05
+ */
+
+/*
+ * Copyright (C) 2006-2011 Genode Labs GmbH
+ *
+ * This file is part of the Genode OS framework, which is distributed
+ * under the terms of the GNU General Public License version 2.
+ */
+
+#ifndef _INCLUDE__DATASPACE__DATASPACE_H_
+#define _INCLUDE__DATASPACE__DATASPACE_H_
+
+#include <base/stdint.h>
+#include <base/rpc.h>
+
+namespace Genode {
+
+	struct Dataspace
+	{
+		virtual ~Dataspace() { }
+
+		/**
+		 * Request size of dataspace
+		 */
+		virtual size_t size() = 0;
+
+		/**
+		 * Request base address in physical address space
+		 */
+		virtual addr_t phys_addr() = 0;
+
+		/**
+		 * Return true if dataspace is writable
+		 */
+		virtual bool writable() = 0;
+
+
+		/*********************
+		 ** RPC declaration **
+		 *********************/
+
+		GENODE_RPC(Rpc_size,      size_t, size);
+		GENODE_RPC(Rpc_phys_addr, addr_t, phys_addr);
+		GENODE_RPC(Rpc_writable,  bool,   writable);
+
+		GENODE_RPC_INTERFACE(Rpc_size, Rpc_phys_addr, Rpc_writable);
+	};
+}
+
+#endif /* _INCLUDE__DATASPACE__DATASPACE_H_ */

base/include/io_mem_session/capability.h

@@ -0,0 +1,22 @@
+/*
+ * \brief  I/O-memory session capability type
+ * \author Norman Feske
+ * \date   2008-08-16
+ */
+
+/*
+ * Copyright (C) 2008-2011 Genode Labs GmbH
+ *
+ * This file is part of the Genode OS framework, which is distributed
+ * under the terms of the GNU General Public License version 2.
+ */
+
+#ifndef _INCLUDE__IO_MEM_SESSION__CAPABILITY_H_
+#define _INCLUDE__IO_MEM_SESSION__CAPABILITY_H_
+
+#include <base/capability.h>
+#include <io_mem_session/io_mem_session.h>
+
+namespace Genode { typedef Capability<Io_mem_session> Io_mem_session_capability; }
+
+#endif /* _INCLUDE__IO_MEM_SESSION__CAPABILITY_H_ */

base/include/io_mem_session/client.h

@@ -0,0 +1,31 @@
+/*
+ * \brief  Client-side I/O-memory session interface
+ * \author Christian Helmuth
+ * \date   2006-08-01
+ */
+
+/*
+ * Copyright (C) 2006-2011 Genode Labs GmbH
+ *
+ * This file is part of the Genode OS framework, which is distributed
+ * under the terms of the GNU General Public License version 2.
+ */
+
+#ifndef _INCLUDE__IO_MEM_SESSION__CLIENT_H_
+#define _INCLUDE__IO_MEM_SESSION__CLIENT_H_
+
+#include <io_mem_session/capability.h>
+#include <base/rpc_client.h>
+
+namespace Genode {
+
+	struct Io_mem_session_client : Rpc_client<Io_mem_session>
+	{
+		explicit Io_mem_session_client(Io_mem_session_capability session)
+		: Rpc_client<Io_mem_session>(session) { }
+
+		Io_mem_dataspace_capability dataspace() { return call<Rpc_dataspace>(); }
+	};
+}
+
+#endif /* _INCLUDE__IO_MEM_SESSION__CLIENT_H_ */

base/include/io_mem_session/connection.h

@@ -0,0 +1,42 @@
+/*
+ * \brief  Connection to I/O-memory service
+ * \author Norman Feske
+ * \date   2008-08-22
+ */
+
+/*
+ * Copyright (C) 2008-2011 Genode Labs GmbH
+ *
+ * This file is part of the Genode OS framework, which is distributed
+ * under the terms of the GNU General Public License version 2.
+ */
+
+#ifndef _INCLUDE__IO_MEM_SESSION__CONNECTION_H_
+#define _INCLUDE__IO_MEM_SESSION__CONNECTION_H_
+
+#include <io_mem_session/client.h>
+#include <base/connection.h>
+
+namespace Genode {
+
+	struct Io_mem_connection : Connection<Io_mem_session>, Io_mem_session_client
+	{
+		/**
+		 * Constructor
+		 *
+		 * \param base            physical base address of memory-mapped I/O resource
+		 * \param size            size memory-mapped I/O resource
+		 * \param write_combined  enable write-combined access to I/O memory
+		 */
+		Io_mem_connection(addr_t base, size_t size, bool write_combined = false)
+		:
+			Connection<Io_mem_session>(
+				session("ram_quota=4K, base=0x%p, size=0x%zx, wc=%s",
+				        base, size, write_combined ? "yes" : "no")),
+
+			Io_mem_session_client(cap())
+		{ }
+	};
+}
+
+#endif /* _INCLUDE__IO_MEM_SESSION__CONNECTION_H_ */

base/include/io_mem_session/io_mem_session.h

@@ -0,0 +1,51 @@
+/*
+ * \brief  I/O-memory session interface
+ * \author Christian Helmuth
+ * \date   2006-08-01
+ */
+
+/*
+ * Copyright (C) 2006-2011 Genode Labs GmbH
+ *
+ * This file is part of the Genode OS framework, which is distributed
+ * under the terms of the GNU General Public License version 2.
+ */
+
+#ifndef _INCLUDE__IO_MEM_SESSION__IO_MEM_SESSION_H_
+#define _INCLUDE__IO_MEM_SESSION__IO_MEM_SESSION_H_
+
+#include <dataspace/capability.h>
+#include <session/session.h>
+
+namespace Genode {
+
+	struct Io_mem_dataspace : Dataspace { };
+
+	typedef Capability<Io_mem_dataspace> Io_mem_dataspace_capability;
+
+	struct Io_mem_session : Session
+	{
+		static const char *service_name() { return "IO_MEM"; }
+
+		virtual ~Io_mem_session() { }
+
+		/**
+		 * Request dataspace containing the IO_MEM session data
+		 *
+		 * \return  capability to IO_MEM dataspace
+		 *          (may be invalid)
+		 */
+		virtual Io_mem_dataspace_capability dataspace() = 0;
+
+
+		/*********************
+		 ** RPC declaration **
+		 *********************/
+
+		GENODE_RPC(Rpc_dataspace, Io_mem_dataspace_capability, dataspace);
+
+		GENODE_RPC_INTERFACE(Rpc_dataspace);
+	};
+}
+
+#endif /* _INCLUDE__IO_MEM_SESSION__IO_MEM_SESSION_H_ */

base/include/io_port_session/capability.h

@@ -0,0 +1,22 @@
+/*
+ * \brief  I/O-port session capability type
+ * \author Norman Feske
+ * \date   2008-08-16
+ */
+
+/*
+ * Copyright (C) 2008-2011 Genode Labs GmbH
+ *
+ * This file is part of the Genode OS framework, which is distributed
+ * under the terms of the GNU General Public License version 2.
+ */
+
+#ifndef _INCLUDE__IO_PORT_SESSION__CAPABILITY_H_
+#define _INCLUDE__IO_PORT_SESSION__CAPABILITY_H_
+
+#include <base/capability.h>
+#include <io_port_session/io_port_session.h>
+
+namespace Genode { typedef Capability<Io_port_session> Io_port_session_capability; }
+
+#endif /* _INCLUDE__IO_PORT_SESSION__CAPABILITY_H_ */

base/include/io_port_session/client.h

@@ -0,0 +1,47 @@
+/*
+ * \brief  Client-side I/O-port session interface
+ * \author Christian Helmuth
+ * \date   2007-04-17
+ */
+
+/*
+ * Copyright (C) 2007-2011 Genode Labs GmbH
+ *
+ * This file is part of the Genode OS framework, which is distributed
+ * under the terms of the GNU General Public License version 2.
+ */
+
+#ifndef _INCLUDE__IO_PORT_SESSION__CLIENT_H_
+#define _INCLUDE__IO_PORT_SESSION__CLIENT_H_
+
+#include <io_port_session/capability.h>
+#include <base/rpc_client.h>
+
+namespace Genode {
+
+	struct Io_port_session_client : Rpc_client<Io_port_session>
+	{
+		explicit Io_port_session_client(Io_port_session_capability session)
+		: Rpc_client<Io_port_session>(session) { }
+
+		unsigned char inb(unsigned short address) {
+			return call<Rpc_inb>(address); }
+
+		unsigned short inw(unsigned short address) {
+			return call<Rpc_inw>(address); }
+
+		unsigned inl(unsigned short address) {
+			return call<Rpc_inl>(address); }
+
+		void outb(unsigned short address, unsigned char value) {
+			call<Rpc_outb>(address, value); }
+
+		void outw(unsigned short address, unsigned short value) {
+			call<Rpc_outw>(address, value); }
+
+		void outl(unsigned short address, unsigned value) {
+			call<Rpc_outl>(address, value); }
+	};
+}
+
+#endif /* _INCLUDE__IO_PORT_SESSION__CLIENT_H_ */

base/include/io_port_session/connection.h

@@ -0,0 +1,42 @@
+/*
+ * \brief  Connection to I/O-port service
+ * \author Norman Feske
+ * \date   2008-08-22
+ */
+
+/*
+ * Copyright (C) 2008-2011 Genode Labs GmbH
+ *
+ * This file is part of the Genode OS framework, which is distributed
+ * under the terms of the GNU General Public License version 2.
+ */
+
+#ifndef _INCLUDE__IO_PORT_SESSION__CONNECTION_H_
+#define _INCLUDE__IO_PORT_SESSION__CONNECTION_H_
+
+#include <io_port_session/client.h>
+#include <base/connection.h>
+
+namespace Genode {
+
+	struct Io_port_connection : Connection<Io_port_session>,
+	                            Io_port_session_client
+	{
+		/**
+		 * Constructor
+		 *
+		 * \param base  base address of port range
+		 * \param size  size of port range
+		 */
+		Io_port_connection(unsigned base, unsigned size)
+		:
+			Connection<Io_port_session>(
+				session("ram_quota=4K, io_port_base=%u, io_port_size=%u",
+				        base, size)),
+
+			Io_port_session_client(cap())
+		{ }
+	};
+}
+
+#endif /* _INCLUDE__IO_PORT_SESSION__CONNECTION_H_ */

base/include/io_port_session/io_port_session.h

@@ -0,0 +1,116 @@
+/*
+ * \brief  I/O-port session interface
+ * \author Christian Helmuth
+ * \date   2007-04-17
+ *
+ * An I/O port session permits access to a range of ports. Inside this range
+ * variable-sized accesses (i.e., 8, 16, 32 bit) at arbitrary addresses are
+ * allowed - currently, alignment is not enforced. Core enforces that access is
+ * limited to the session-defined range while the user provides physical I/O port
+ * addresses as function parameters.
+ *
+ * The design is founded on experiences while programming PCI configuration
+ * space which needs two 32-bit port registers. Each byte, word and dword in
+ * the data register must be explicitly accessible for read and write. The old
+ * design needs six capabilities only for the data register.
+ */
+
+/*
+ * Copyright (C) 2007-2011 Genode Labs GmbH
+ *
+ * This file is part of the Genode OS framework, which is distributed
+ * under the terms of the GNU General Public License version 2.
+ */
+
+#ifndef _INCLUDE__IO_PORT_SESSION__IO_PORT_SESSION_H_
+#define _INCLUDE__IO_PORT_SESSION__IO_PORT_SESSION_H_
+
+#include <base/capability.h>
+#include <session/session.h>
+
+namespace Genode {
+
+	struct Io_port_session : Session
+	{
+		static const char *service_name() { return "IO_PORT"; }
+
+		virtual ~Io_port_session() { }
+
+		/******************************
+		 ** Read value from I/O port **
+		 ******************************/
+
+		/**
+		 * Read byte (8 bit)
+		 *
+		 * \param address  physical I/O port address
+		 *
+		 * \return         value read from port
+		 */
+		virtual unsigned char inb(unsigned short address) = 0;
+
+		/**
+		 * Read word (16 bit)
+		 *
+		 * \param address  physical I/O port address
+		 *
+		 * \return         value read from port
+		 */
+		virtual unsigned short inw(unsigned short address) = 0;
+
+		/**
+		 * Read double word (32 bit)
+		 *
+		 * \param address  physical I/O port address
+		 *
+		 * \return         value read from port
+		 */
+		virtual unsigned inl(unsigned short address) = 0;
+
+
+		/*****************************
+		 ** Write value to I/O port **
+		 *****************************/
+
+		/**
+		 * Write byte (8 bit)
+		 *
+		 * \param address  physical I/O port address
+		 * \param value    value to write to port
+		 */
+		virtual void outb(unsigned short address, unsigned char value) = 0;
+
+		/**
+		 * Write word (16 bit)
+		 *
+		 * \param address  physical I/O port address
+		 * \param value    value to write to port
+		 */
+		virtual void outw(unsigned short address, unsigned short value) = 0;
+
+		/**
+		 * Write double word (32 bit)
+		 *
+		 * \param address  physical I/O port address
+		 * \param value    value to write to port
+		 */
+		virtual void outl(unsigned short address, unsigned value) = 0;
+
+
+		/*********************
+		 ** RPC declaration **
+		 *********************/
+
+		GENODE_RPC(Rpc_inb, unsigned char,  inb, unsigned short);
+		GENODE_RPC(Rpc_inw, unsigned short, inw, unsigned short);
+		GENODE_RPC(Rpc_inl, unsigned,       inl, unsigned short);
+
+		GENODE_RPC(Rpc_outb, void, outb, unsigned short, unsigned char);
+		GENODE_RPC(Rpc_outw, void, outw, unsigned short, unsigned short);
+		GENODE_RPC(Rpc_outl, void, outl, unsigned short, unsigned);
+
+		GENODE_RPC_INTERFACE(Rpc_inb, Rpc_inw, Rpc_inl, Rpc_outb, Rpc_outw, Rpc_outl);
+	};
+}
+
+#endif /* _INCLUDE__IO_PORT_SESSION__IO_PORT_SESSION_H_ */

base/include/irq_session/capability.h

@@ -0,0 +1,22 @@
+/*
+ * \brief  IRQ-session capability type
+ * \author Norman Feske
+ * \date   2008-08-16
+ */
+
+/*
+ * Copyright (C) 2008-2011 Genode Labs GmbH
+ *
+ * This file is part of the Genode OS framework, which is distributed
+ * under the terms of the GNU General Public License version 2.
+ */
+
+#ifndef _INCLUDE__IRQ_SESSION__CAPABILITY_H_
+#define _INCLUDE__IRQ_SESSION__CAPABILITY_H_
+
+#include <base/capability.h>
+#include <irq_session/irq_session.h>
+
+namespace Genode { typedef Capability<Irq_session> Irq_session_capability; }
+
+#endif /* _INCLUDE__IRQ_SESSION__CAPABILITY_H_ */

base/include/irq_session/client.h

@@ -0,0 +1,31 @@
+/*
+ * \brief  Client-side IRQ session interface
+ * \author Christian Helmuth
+ * \date   2007-09-13
+ */
+
+/*
+ * Copyright (C) 2007-2011 Genode Labs GmbH
+ *
+ * This file is part of the Genode OS framework, which is distributed
+ * under the terms of the GNU General Public License version 2.
+ */
+
+#ifndef _INCLUDE__IRQ_SESSION__CLIENT_H_
+#define _INCLUDE__IRQ_SESSION__CLIENT_H_
+
+#include <irq_session/capability.h>
+#include <base/rpc_client.h>
+
+namespace Genode {
+
+	struct Irq_session_client : Rpc_client<Irq_session>
+	{
+		explicit Irq_session_client(Irq_session_capability session)
+		: Rpc_client<Irq_session>(session) { }
+
+		void wait_for_irq() { call<Rpc_wait_for_irq>(); }
+	};
+}
+
+#endif /* _INCLUDE__IRQ_SESSION__CLIENT_H_ */

base/include/irq_session/connection.h

@@ -0,0 +1,39 @@
+/*
+ * \brief  Connection to IRQ service
+ * \author Norman Feske
+ * \date   2008-08-22
+ */
+
+/*
+ * Copyright (C) 2008-2011 Genode Labs GmbH
+ *
+ * This file is part of the Genode OS framework, which is distributed
+ * under the terms of the GNU General Public License version 2.
+ */
+
+#ifndef _INCLUDE__IRQ_SESSION__CONNECTION_H_
+#define _INCLUDE__IRQ_SESSION__CONNECTION_H_
+
+#include <irq_session/client.h>
+#include <base/connection.h>
+
+namespace Genode {
+
+	struct Irq_connection : Connection<Irq_session>, Irq_session_client
+	{
+		/**
+		 * Constructor
+		 *
+		 * \param irq  physical interrupt number
+		 */
+		Irq_connection(unsigned irq)
+		:
+			Connection<Irq_session>(
+				session("ram_quota=4K, irq_number=%u", irq)),
+
+			Irq_session_client(cap())
+		{ }
+	};
+}
+
+#endif /* _INCLUDE__IRQ_SESSION__CONNECTION_H_ */

base/include/irq_session/irq_session.h

@@ -0,0 +1,47 @@
+/*
+ * \brief  IRQ session interface
+ * \author Christian Helmuth
+ * \date   2007-09-13
+ *
+ * An open IRQ session represents a valid IRQ attachment/association.
+ * Initially, the interrupt is masked and will only occur if enabled. This is
+ * done by calling wait_for_irq(). When the interrupt is delivered to the
+ * client, it was acknowledged and masked at the interrupt controller before.
+ *
+ * Disassociation from an IRQ is done by closing the session.
+ */
+
+/*
+ * Copyright (C) 2007-2011 Genode Labs GmbH
+ *
+ * This file is part of the Genode OS framework, which is distributed
+ * under the terms of the GNU General Public License version 2.
+ */
+
+#ifndef _INCLUDE__IRQ_SESSION__IRQ_SESSION_H_
+#define _INCLUDE__IRQ_SESSION__IRQ_SESSION_H_
+
+#include <base/capability.h>
+#include <session/session.h>
+
+namespace Genode {
+
+	struct Irq_session : Session
+	{
+		static const char *service_name() { return "IRQ"; }
+
+		virtual ~Irq_session() { }
+
+		virtual void wait_for_irq() = 0;
+
+
+		/*********************
+		 ** RPC declaration **
+		 *********************/
+
+		GENODE_RPC(Rpc_wait_for_irq, void, wait_for_irq);
+		GENODE_RPC_INTERFACE(Rpc_wait_for_irq);
+	};
+}
+
+#endif /* _INCLUDE__IRQ_SESSION__IRQ_SESSION_H_ */

base/include/log_session/capability.h

@@ -0,0 +1,22 @@
+/*
+ * \brief  LOG-session capability type
+ * \author Norman Feske
+ * \date   2008-08-16
+ */
+
+/*
+ * Copyright (C) 2008-2011 Genode Labs GmbH
+ *
+ * This file is part of the Genode OS framework, which is distributed
+ * under the terms of the GNU General Public License version 2.
+ */
+
+#ifndef _INCLUDE__LOG_SESSION__CAPABILITY_H_
+#define _INCLUDE__LOG_SESSION__CAPABILITY_H_
+
+#include <base/capability.h>
+#include <log_session/log_session.h>
+
+namespace Genode { typedef Capability<Log_session> Log_session_capability; }
+
+#endif /* _INCLUDE__LOG_SESSION__CAPABILITY_H_ */

base/include/log_session/client.h

@@ -0,0 +1,32 @@
+/*
+ * \brief  Client-side log text output session interface
+ * \author Norman Feske
+ * \date   2006-09-15
+ */
+
+/*
+ * Copyright (C) 2006-2011 Genode Labs GmbH
+ *
+ * This file is part of the Genode OS framework, which is distributed
+ * under the terms of the GNU General Public License version 2.
+ */
+
+#ifndef _INCLUDE__LOG_SESSION__CLIENT_H_
+#define _INCLUDE__LOG_SESSION__CLIENT_H_
+
+#include <log_session/capability.h>
+#include <base/rpc_client.h>
+
+namespace Genode {
+
+	struct Log_session_client : Rpc_client<Log_session>
+	{
+		explicit Log_session_client(Log_session_capability session)
+		: Rpc_client<Log_session>(session) { }
+
+		size_t write(String const &string) {
+			return call<Rpc_write>(string); }
+	};
+}
+
+#endif /* _INCLUDE__LOG_SESSION__CLIENT_H_ */

base/include/log_session/connection.h

@@ -0,0 +1,32 @@
+/*
+ * \brief  Connection to LOG service
+ * \author Norman Feske
+ * \date   2008-08-22
+ */
+
+/*
+ * Copyright (C) 2008-2011 Genode Labs GmbH
+ *
+ * This file is part of the Genode OS framework, which is distributed
+ * under the terms of the GNU General Public License version 2.
+ */
+
+#ifndef _INCLUDE__LOG_SESSION__CONNECTION_H_
+#define _INCLUDE__LOG_SESSION__CONNECTION_H_
+
+#include <log_session/client.h>
+#include <base/connection.h>
+
+namespace Genode {
+
+	struct Log_connection : Connection<Log_session>, Log_session_client
+	{
+		Log_connection()
+		:
+			Connection<Log_session>(session("ram_quota=8K")),
+			Log_session_client(cap())
+		{ }
+	};
+}
+
+#endif /* _INCLUDE__LOG_SESSION__CONNECTION_H_ */

base/include/log_session/log_session.h

@@ -0,0 +1,49 @@
+/*
+ * \brief  Log text output session interface
+ * \author Norman Feske
+ * \date   2006-09-15
+ */
+
+/*
+ * Copyright (C) 2006-2011 Genode Labs GmbH
+ *
+ * This file is part of the Genode OS framework, which is distributed
+ * under the terms of the GNU General Public License version 2.
+ */
+
+#ifndef _INCLUDE__LOG_SESSION__LOG_SESSION_H_
+#define _INCLUDE__LOG_SESSION__LOG_SESSION_H_
+
+#include <base/capability.h>
+#include <base/stdint.h>
+#include <base/rpc_args.h>
+#include <session/session.h>
+
+namespace Genode {
+
+	struct Log_session : Session
+	{
+		static const char *service_name() { return "LOG"; }
+
+		virtual ~Log_session() { }
+
+		typedef Rpc_in_buffer<256> String;
+
+		/**
+		 * Output null-terminated string
+		 *
+		 * \return  number of written characters
+		 */
+		virtual size_t write(String const &string) = 0;
+
+
+		/*********************
+		 ** RPC declaration **
+		 *********************/
+
+		GENODE_RPC(Rpc_write, size_t, write, String const &);
+		GENODE_RPC_INTERFACE(Rpc_write);
+	};
+}
+
+#endif /* _INCLUDE__LOG_SESSION__LOG_SESSION_H_ */

base/include/pager/capability.h

@@ -0,0 +1,30 @@
+/*
+ * \brief  Pager capability type
+ * \author Norman Feske
+ * \date   2010-01-27
+ */
+
+/*
+ * Copyright (C) 2010-2011 Genode Labs GmbH
+ *
+ * This file is part of the Genode OS framework, which is distributed
+ * under the terms of the GNU General Public License version 2.
+ */
+
+#ifndef _INCLUDE__PAGER__CAPABILITY_H_
+#define _INCLUDE__PAGER__CAPABILITY_H_
+
+#include <base/capability.h>
+
+namespace Genode {
+
+	/*
+	 * The 'Pager_capability' type is returned by 'Rm_session::add_client' and
+	 * passed as argument to 'Cpu_session::set_pager'. It is never invoked or
+	 * otherwise used.
+	 */
+	class Pager_object;
+	typedef Capability<Pager_object> Pager_capability;
+}
+
+#endif /* _INCLUDE__PAGER__CAPABILITY_H_ */

base/include/parent/capability.h

@@ -0,0 +1,22 @@
+/*
+ * \brief  Parent capability type
+ * \author Norman Feske
+ * \date   2008-08-16
+ */
+
+/*
+ * Copyright (C) 2008-2011 Genode Labs GmbH
+ *
+ * This file is part of the Genode OS framework, which is distributed
+ * under the terms of the GNU General Public License version 2.
+ */
+
+#ifndef _INCLUDE__PARENT__CAPABILITY_H_
+#define _INCLUDE__PARENT__CAPABILITY_H_
+
+#include <base/capability.h>
+#include <parent/parent.h>
+
+namespace Genode { typedef Capability<Parent> Parent_capability; }
+
+#endif /* _INCLUDE__PARENT__CAPABILITY_H_ */

base/include/parent/client.h

@@ -0,0 +1,43 @@
+/*
+ * \brief  Client-side parent interface
+ * \author Norman Feske
+ * \date   2006-05-10
+ */
+
+/*
+ * Copyright (C) 2006-2011 Genode Labs GmbH
+ *
+ * This file is part of the Genode OS framework, which is distributed
+ * under the terms of the GNU General Public License version 2.
+ */
+
+#ifndef _INCLUDE__PARENT__CLIENT_H_
+#define _INCLUDE__PARENT__CLIENT_H_
+
+#include <parent/capability.h>
+#include <base/rpc_client.h>
+
+namespace Genode {
+
+	struct Parent_client : Rpc_client<Parent>
+	{
+		explicit Parent_client(Parent_capability parent)
+		: Rpc_client<Parent>(parent) { }
+
+		void exit(int exit_value) { call<Rpc_exit>(exit_value); }
+
+		void announce(Service_name const &service, Root_capability root) {
+			call<Rpc_announce>(service, root); }
+
+		Session_capability session(Service_name const &service,
+		                           Session_args const &args) {
+			return call<Rpc_session>(service, args); }
+
+		void upgrade(Session_capability to_session, Upgrade_args const &args) {
+			call<Rpc_upgrade>(to_session, args); }
+
+		void close(Session_capability session) { call<Rpc_close>(session); }
+	};
+}
+
+#endif /* _INCLUDE__PARENT__CLIENT_H_ */

base/include/parent/parent.h

@@ -0,0 +1,152 @@
+/*
+ * \brief  Parent interface
+ * \author Norman Feske
+ * \date   2006-05-10
+ */
+
+/*
+ * Copyright (C) 2006-2011 Genode Labs GmbH
+ *
+ * This file is part of the Genode OS framework, which is distributed
+ * under the terms of the GNU General Public License version 2.
+ */
+
+#ifndef _INCLUDE__PARENT__PARENT_H_
+#define _INCLUDE__PARENT__PARENT_H_
+
+#include <base/exception.h>
+#include <base/rpc.h>
+#include <base/rpc_args.h>
+#include <session/capability.h>
+#include <root/capability.h>
+
+namespace Genode {
+
+	struct Parent
+	{
+		/*********************
+		 ** Exception types **
+		 *********************/
+
+		class Exception      : public ::Genode::Exception { };
+		class Service_denied : public Exception { };
+		class Quota_exceeded : public Exception { };
+		class Unavailable    : public Exception { };
+
+		typedef Rpc_in_buffer<64>  Service_name;
+		typedef Rpc_in_buffer<160> Session_args;
+		typedef Rpc_in_buffer<160> Upgrade_args;
+
+
+		virtual ~Parent() { }
+
+		/**
+		 * Tell parent to exit the program
+		 */
+		virtual void exit(int exit_value) = 0;
+
+		/**
+		 * Announce service to the parent
+		 */
+		virtual void announce(Service_name const &service_name,
+		                      Root_capability service_root) = 0;
+
+		/**
+		 * Announce service to the parent
+		 *
+		 * \param service_root  root capability
+		 *
+		 * The type of the specified 'service_root' capability match with
+		 * an interface that provides a 'Session_type' type (i.e., a
+		 * 'Typed_root' interface). This 'Session_type' is expected to
+		 * host a static function called 'service_name' returning the
+		 * name of the provided interface as null-terminated string.
+		 */
+		template <typename ROOT_INTERFACE>
+		void announce(Capability<ROOT_INTERFACE> const &service_root)
+		{
+			announce(ROOT_INTERFACE::Session_type::service_name(), service_root);
+		}
+
+		/**
+		 * Create session to a service
+		 *
+		 * \param service_name     name of the requested interface
+		 * \param args             session constructor arguments
+		 *
+		 * \throw Service_denied   parent denies session request
+		 * \throw Quota_exceeded   our own quota does not suffice for
+		 *                         the creation of the new session
+		 * \throw Unavailable
+		 *
+		 * \return                 untyped capability to new session
+		 *
+		 * The use of this function is discouraged. Please use the type safe
+		 * 'session()' template instead.
+		 */
+		virtual Session_capability session(Service_name const &service_name,
+		                                   Session_args const &args) = 0;
+
+		/**
+		 * Create session to a service
+		 *
+		 * \param SESSION_TYPE  session interface type
+		 * \param args          session constructor arguments
+		 *
+		 * \throw Service_denied   parent denies session request
+		 * \throw Quota_exceeded   our own quota does not suffice for
+		 *                         the creation of the new session
+		 * \throw Unavailable
+		 *
+		 * \return                 capability to new session
+		 */
+		template <typename SESSION_TYPE>
+		Capability<SESSION_TYPE> session(Session_args const &args)
+		{
+			Session_capability cap = session(SESSION_TYPE::service_name(), args);
+			return reinterpret_cap_cast<SESSION_TYPE>(cap);
+		}
+
+		/**
+		 * Transfer our quota to the server that provides the specified session
+		 *
+		 * \param to_session recipient session
+		 * \param args       description of the amount of quota to transfer
+		 *
+		 * \throw Quota_exceeded  quota could not be transferred
+		 *
+		 * The 'args' argument has the same principle format as the 'args'
+		 * argument of the 'session' function.
+		 * The error case indicates that there is not enough unused quota on
+		 * the source side.
+		 */
+		virtual void upgrade(Session_capability to_session,
+		                     Upgrade_args const &args) = 0;
+
+		/**
+		 * Close session
+		 */
+		virtual void close(Session_capability session) = 0;
+
+
+		/*********************
+		 ** RPC declaration **
+		 *********************/
+
+		GENODE_RPC(Rpc_exit, void, exit, int);
+		GENODE_RPC(Rpc_announce, void, announce,
+		           Service_name const &, Root_capability);
+		GENODE_RPC_THROW(Rpc_session, Session_capability, session,
+		                 GENODE_TYPE_LIST(Service_denied, Quota_exceeded, Unavailable),
+		                 Service_name const &, Session_args const &);
+		GENODE_RPC_THROW(Rpc_upgrade, void, upgrade,
+		                 GENODE_TYPE_LIST(Quota_exceeded),
+		                 Session_capability, Upgrade_args const &);
+		GENODE_RPC(Rpc_close, void, close, Session_capability);
+
+		GENODE_RPC_INTERFACE(Rpc_exit, Rpc_announce, Rpc_session, Rpc_upgrade,
+		                     Rpc_close);
+	};
+}
+
+#endif /* _INCLUDE__PARENT__PARENT_H_ */

base/include/pd_session/capability.h

@@ -0,0 +1,22 @@
+/*
+ * \brief  PD-session capability type
+ * \author Norman Feske
+ * \date   2008-08-16
+ */
+
+/*
+ * Copyright (C) 2008-2011 Genode Labs GmbH
+ *
+ * This file is part of the Genode OS framework, which is distributed
+ * under the terms of the GNU General Public License version 2.
+ */
+
+#ifndef _INCLUDE__PD_SESSION__CAPABILITY_H_
+#define _INCLUDE__PD_SESSION__CAPABILITY_H_
+
+#include <base/capability.h>
+#include <pd_session/pd_session.h>
+
+namespace Genode { typedef Capability<Pd_session> Pd_session_capability; }
+
+#endif /* _INCLUDE__PD_SESSION__CAPABILITY_H_ */

base/include/pd_session/client.h

@@ -0,0 +1,35 @@
+/*
+ * \brief  Client-side pd session interface
+ * \author Christian Helmuth
+ * \date   2006-07-12
+ */
+
+/*
+ * Copyright (C) 2006-2011 Genode Labs GmbH
+ *
+ * This file is part of the Genode OS framework, which is distributed
+ * under the terms of the GNU General Public License version 2.
+ */
+
+#ifndef _INCLUDE__PD_SESSION__CLIENT_H_
+#define _INCLUDE__PD_SESSION__CLIENT_H_
+
+#include <pd_session/capability.h>
+#include <base/rpc_client.h>
+
+namespace Genode {
+
+	struct Pd_session_client : Rpc_client<Pd_session>
+	{
+		explicit Pd_session_client(Pd_session_capability session)
+		: Rpc_client<Pd_session>(session) { }
+
+		int bind_thread(Thread_capability thread) {
+			return call<Rpc_bind_thread>(thread); }
+
+		int assign_parent(Parent_capability parent) {
+			return call<Rpc_assign_parent>(parent); }
+	};
+}
+
+#endif /* _INCLUDE__PD_SESSION__CLIENT_H_ */

base/include/pd_session/connection.h

@@ -0,0 +1,41 @@
+/*
+ * \brief  Connection to PD service
+ * \author Norman Feske
+ * \date   2008-08-22
+ */
+
+/*
+ * Copyright (C) 2008-2011 Genode Labs GmbH
+ *
+ * This file is part of the Genode OS framework, which is distributed
+ * under the terms of the GNU General Public License version 2.
+ */
+
+#ifndef _INCLUDE__PD_SESSION__CONNECTION_H_
+#define _INCLUDE__PD_SESSION__CONNECTION_H_
+
+#include <pd_session/client.h>
+#include <base/connection.h>
+
+namespace Genode {
+
+	struct Pd_connection : Connection<Pd_session>, Pd_session_client
+	{
+		/**
+		 * Constructor
+		 *
+		 * \param args  additional session arguments
+		 */
+		Pd_connection(const char *args = 0)
+		:
+			Connection<Pd_session>(
+				session("ram_quota=4K%s%s",
+				        args ? ", " : "",
+				        args ? args : "")),
+
+			Pd_session_client(cap())
+		{ }
+	};
+}
+
+#endif /* _INCLUDE__PD_SESSION__CONNECTION_H_ */

base/include/pd_session/pd_session.h

@@ -0,0 +1,63 @@
+/*
+ * \brief  Protection domain (PD) session interface
+ * \author Christian Helmuth
+ * \date   2006-06-27
+ *
+ * A pd session represents the protection domain of a program.
+ */
+
+/*
+ * Copyright (C) 2006-2011 Genode Labs GmbH
+ *
+ * This file is part of the Genode OS framework, which is distributed
+ * under the terms of the GNU General Public License version 2.
+ */
+
+#ifndef _INCLUDE__PD_SESSION__PD_SESSION_H_
+#define _INCLUDE__PD_SESSION__PD_SESSION_H_
+
+#include <thread/capability.h>
+#include <parent/capability.h>
+#include <session/session.h>
+
+namespace Genode {
+
+	struct Pd_session : Session
+	{
+		static const char *service_name() { return "PD"; }
+
+		virtual ~Pd_session() { }
+
+		/**
+		 * Bind thread to protection domain
+		 *
+		 * \param thread  capability of thread to bind
+		 *
+		 * \return        0 on success or negative error code
+		 *
+		 * After successful bind, the thread will execute inside this
+		 * protection domain when started.
+		 */
+		virtual int bind_thread(Thread_capability thread) = 0;
+
+		/**
+		 * Assign parent to protection domain
+		 *
+		 * \param   parent  capability of parent interface
+		 * \return  0 on success, or negative error code
+		 */
+		virtual int assign_parent(Parent_capability parent) = 0;
+
+
+		/*********************
+		 ** RPC declaration **
+		 *********************/
+
+		GENODE_RPC(Rpc_bind_thread,   int, bind_thread,   Thread_capability);
+		GENODE_RPC(Rpc_assign_parent, int, assign_parent, Parent_capability);
+
+		GENODE_RPC_INTERFACE(Rpc_bind_thread, Rpc_assign_parent);
+	};
+}
+
+#endif /* _INCLUDE__PD_SESSION__PD_SESSION_H_ */

base/include/ram_session/capability.h

@@ -0,0 +1,29 @@
+/*
+ * \brief  RAM-session capability type
+ * \author Norman Feske
+ * \date   2008-08-16
+ */
+
+/*
+ * Copyright (C) 2008-2011 Genode Labs GmbH
+ *
+ * This file is part of the Genode OS framework, which is distributed
+ * under the terms of the GNU General Public License version 2.
+ */
+
+#ifndef _INCLUDE__RAM_SESSION__CAPABILITY_H_
+#define _INCLUDE__RAM_SESSION__CAPABILITY_H_
+
+#include <base/capability.h>
+
+namespace Genode {
+
+	/*
+	 * We cannot include 'ram_session/ram_session.h' because this file relies
+	 * on the the 'Ram_session_capability' type.
+	 */
+	class Ram_session;
+	typedef Capability<Ram_session> Ram_session_capability;
+}
+
+#endif /* _INCLUDE__RAM_SESSION__CAPABILITY_H_ */

base/include/ram_session/client.h

@@ -0,0 +1,45 @@
+/*
+ * \brief  Client-side ram session interface
+ * \author Norman Feske
+ * \date   2006-05-31
+ */
+
+/*
+ * Copyright (C) 2006-2011 Genode Labs GmbH
+ *
+ * This file is part of the Genode OS framework, which is distributed
+ * under the terms of the GNU General Public License version 2.
+ */
+
+#ifndef _INCLUDE__RAM_SESSION__CLIENT_H_
+#define _INCLUDE__RAM_SESSION__CLIENT_H_
+
+#include <ram_session/capability.h>
+#include <ram_session/ram_session.h>
+#include <base/rpc_client.h>
+
+namespace Genode {
+
+	struct Ram_session_client : Rpc_client<Ram_session>
+	{
+		explicit Ram_session_client(Ram_session_capability session)
+		: Rpc_client<Ram_session>(session) { }
+
+		Ram_dataspace_capability alloc(size_t size) {
+			return call<Rpc_alloc>(size); }
+
+		void free(Ram_dataspace_capability ds) { call<Rpc_free>(ds); }
+
+		int ref_account(Ram_session_capability ram_session) {
+			return call<Rpc_ref_account>(ram_session); }
+
+		int transfer_quota(Ram_session_capability ram_session, size_t amount) {
+			return call<Rpc_transfer_quota>(ram_session, amount); }
+
+		size_t quota() { return call<Rpc_quota>(); }
+
+		size_t used() { return call<Rpc_used>(); }
+	};
+}
+
+#endif /* _INCLUDE__RAM_SESSION__CLIENT_H_ */

base/include/ram_session/connection.h

@@ -0,0 +1,40 @@
+/*
+ * \brief  Connection to RAM service
+ * \author Norman Feske
+ * \date   2008-08-22
+ */
+
+/*
+ * Copyright (C) 2008-2011 Genode Labs GmbH
+ *
+ * This file is part of the Genode OS framework, which is distributed
+ * under the terms of the GNU General Public License version 2.
+ */
+
+#ifndef _INCLUDE__RAM_SESSION__CONNECTION_H_
+#define _INCLUDE__RAM_SESSION__CONNECTION_H_
+
+#include <ram_session/client.h>
+#include <base/connection.h>
+
+namespace Genode {
+
+	struct Ram_connection : Connection<Ram_session>, Ram_session_client
+	{
+		enum { RAM_QUOTA = 64*1024 };
+		/**
+		 * Constructor
+		 *
+		 * \param label  session label
+		 */
+		Ram_connection(const char *label = "")
+		:
+			Connection<Ram_session>(
+				session("ram_quota=64K, label=\"%s\"", label)),
+
+			Ram_session_client(cap())
+		{ }
+	};
+}
+
+#endif /* _INCLUDE__RAM_SESSION__CONNECTION_H_ */

base/include/ram_session/ram_session.h

@@ -0,0 +1,127 @@
+/*
+ * \brief  RAM session interface
+ * \author Norman Feske
+ * \date   2006-05-11
+ */
+
+/*
+ * Copyright (C) 2006-2011 Genode Labs GmbH
+ *
+ * This file is part of the Genode OS framework, which is distributed
+ * under the terms of the GNU General Public License version 2.
+ */
+
+#ifndef _INCLUDE__RAM_SESSION__RAM_SESSION_H_
+#define _INCLUDE__RAM_SESSION__RAM_SESSION_H_
+
+#include <base/stdint.h>
+#include <base/capability.h>
+#include <base/exception.h>
+#include <dataspace/capability.h>
+#include <ram_session/capability.h>
+#include <session/session.h>
+
+namespace Genode {
+
+	struct Ram_dataspace : Dataspace { };
+
+	typedef Capability<Ram_dataspace> Ram_dataspace_capability;
+
+	struct Ram_session : Session
+	{
+		static const char *service_name() { return "RAM"; }
+
+
+		/*********************
+		 ** Exception types **
+		 *********************/
+
+		class Alloc_failed    : public Exception    { };
+		class Quota_exceeded  : public Alloc_failed { };
+		class Out_of_metadata : public Alloc_failed { };
+
+		/**
+		 * Destructor
+		 */
+		virtual ~Ram_session() { }
+
+		/**
+		 * Allocate RAM dataspace
+		 *
+		 * \param  size  size of RAM dataspace
+		 *
+		 * \throw  Quota_exceeded
+		 * \throw  Out_of_metadata
+		 * \return capability to new RAM dataspace
+		 */
+		virtual Ram_dataspace_capability alloc(size_t size) = 0;
+
+		/**
+		 * Free RAM dataspace
+		 *
+		 * \param ds  dataspace capability as returned by alloc
+		 */
+		virtual void free(Ram_dataspace_capability ds) = 0;
+
+		/**
+		 * Define reference account for the RAM session
+		 *
+		 * \param   ram_session    reference account
+		 *
+		 * \return  0 on success
+		 *
+		 * Each RAM session requires another RAM session as reference
+		 * account to transfer quota to and from. The reference account can
+		 * be defined only once.
+		 */
+		virtual int ref_account(Ram_session_capability ram_session) = 0;
+
+		/**
+		 * Transfer quota the another ram session
+		 *
+		 * \param ram_session  receiver of quota donation
+		 * \param amount       amount of quota to donate
+		 * \return             0 on success
+		 *
+		 * Quota can only be transfered if the specified RAM session is
+		 * either the reference account for this session or vice versa.
+		 */
+		virtual int transfer_quota(Ram_session_capability ram_session, size_t amount) = 0;
+
+		/**
+		 * Return current quota limit
+		 */
+		virtual size_t quota() = 0;
+
+		/**
+		 * Return used quota
+		 */
+		virtual size_t used() = 0;
+
+		/**
+		 * Return amount of available quota
+		 */
+		size_t avail()
+		{
+			size_t q = quota(), u = used();
+			return q > u ? q - u : 0;
+		}
+
+		/*********************
+		 ** RPC declaration **
+		 *********************/
+
+		GENODE_RPC_THROW(Rpc_alloc, Ram_dataspace_capability, alloc,
+		                 GENODE_TYPE_LIST(Quota_exceeded, Out_of_metadata), size_t);
+		GENODE_RPC(Rpc_free, void, free, Ram_dataspace_capability);
+		GENODE_RPC(Rpc_ref_account, int, ref_account, Ram_session_capability);
+		GENODE_RPC(Rpc_transfer_quota, int, transfer_quota, Ram_session_capability, size_t);
+		GENODE_RPC(Rpc_quota, size_t, quota);
+		GENODE_RPC(Rpc_used, size_t, used);
+
+		GENODE_RPC_INTERFACE(Rpc_alloc, Rpc_free, Rpc_ref_account,
+		                     Rpc_transfer_quota, Rpc_quota, Rpc_used);
+	};
+}
+
+#endif /* _INCLUDE__RAM_SESSION__RAM_SESSION_H_ */

base/include/rm_session/capability.h

@@ -0,0 +1,22 @@
+/*
+ * \brief  RM-session capability type
+ * \author Norman Feske
+ * \date   2008-08-16
+ */
+
+/*
+ * Copyright (C) 2008-2011 Genode Labs GmbH
+ *
+ * This file is part of the Genode OS framework, which is distributed
+ * under the terms of the GNU General Public License version 2.
+ */
+
+#ifndef _INCLUDE__RM_SESSION__CAPABILITY_H_
+#define _INCLUDE__RM_SESSION__CAPABILITY_H_
+
+#include <rm_session/rm_session.h>
+#include <base/capability.h>
+
+namespace Genode { typedef Capability<Rm_session> Rm_session_capability; }
+
+#endif /* _INCLUDE__RM_SESSION__CAPABILITY_H_ */

base/include/rm_session/client.h

@@ -0,0 +1,51 @@
+/*
+ * \brief  Client-side region manager session interface
+ * \author Christian Helmuth
+ * \date   2006-07-11
+ */
+
+/*
+ * Copyright (C) 2006-2011 Genode Labs GmbH
+ *
+ * This file is part of the Genode OS framework, which is distributed
+ * under the terms of the GNU General Public License version 2.
+ */
+
+#ifndef _INCLUDE__RM_SESSION__CLIENT_H_
+#define _INCLUDE__RM_SESSION__CLIENT_H_
+
+#include <rm_session/capability.h>
+#include <base/rpc_client.h>
+
+namespace Genode {
+
+	struct Rm_session_client : Rpc_client<Rm_session>
+	{
+		explicit Rm_session_client(Rm_session_capability session)
+		: Rpc_client<Rm_session>(session) { }
+
+		Local_addr attach(Dataspace_capability ds, size_t size, off_t offset,
+		                  bool use_local_addr, Local_addr local_addr)
+		{
+			return call<Rpc_attach>(ds, size, offset,
+			                        use_local_addr, local_addr);
+		}
+
+		void detach(Local_addr local_addr) {
+			call<Rpc_detach>(local_addr); }
+
+		Pager_capability add_client(Thread_capability thread) {
+			return call<Rpc_add_client>(thread); }
+
+		void fault_handler(Signal_context_capability handler) {
+			call<Rpc_fault_handler>(handler); }
+
+		State state() {
+			return call<Rpc_state>(); }
+
+		Dataspace_capability dataspace() {
+			return call<Rpc_dataspace>(); }
+	};
+}
+
+#endif /* _INCLUDE__RM_SESSION__CLIENT_H_ */

base/include/rm_session/connection.h

@@ -0,0 +1,40 @@
+/*
+ * \brief  Connection to RM service
+ * \author Norman Feske
+ * \date   2008-08-22
+ */
+
+/*
+ * Copyright (C) 2008-2011 Genode Labs GmbH
+ *
+ * This file is part of the Genode OS framework, which is distributed
+ * under the terms of the GNU General Public License version 2.
+ */
+
+#ifndef _INCLUDE__RM_SESSION__CONNECTION_H_
+#define _INCLUDE__RM_SESSION__CONNECTION_H_
+
+#include <rm_session/client.h>
+#include <base/connection.h>
+
+namespace Genode {
+
+	struct Rm_connection : Connection<Rm_session>, Rm_session_client
+	{
+		enum { RAM_QUOTA = 64*1024 };
+
+		/**
+		 * Constructor
+		 *
+		 * \param start start of the managed VM-region
+		 * \param size  size of the VM-region to manage
+		 */
+		Rm_connection(addr_t start = ~0UL, size_t size = 0) :
+			Connection<Rm_session>(
+				session("ram_quota=64K, start=0x%p, size=0x%zx",
+				        start, size)),
+			Rm_session_client(cap()) { }
+	};
+}
+
+#endif /* _INCLUDE__RM_SESSION__CONNECTION_H_ */

base/include/rm_session/rm_session.h

@@ -0,0 +1,196 @@
+/*
+ * \brief  Region manager session interface
+ * \author Norman Feske
+ * \date   2006-05-15
+ */
+
+/*
+ * Copyright (C) 2006-2011 Genode Labs GmbH
+ *
+ * This file is part of the Genode OS framework, which is distributed
+ * under the terms of the GNU General Public License version 2.
+ */
+
+#ifndef _INCLUDE__RM_SESSION__RM_SESSION_H_
+#define _INCLUDE__RM_SESSION__RM_SESSION_H_
+
+#include <base/exception.h>
+#include <base/stdint.h>
+#include <base/signal.h>
+#include <dataspace/capability.h>
+#include <thread/capability.h>
+#include <pager/capability.h>
+#include <session/session.h>
+
+namespace Genode {
+
+	struct Rm_session : Session
+	{
+		enum Fault_type {
+			READY = 0, READ_FAULT = 1, WRITE_FAULT = 2, EXEC_FAULT = 3 };
+
+		/**
+		 * State of region-manager session
+		 *
+		 * If a client accesses a location outside the regions attached to
+		 * the region-manager session, a fault occurs and gets signalled to
+		 * the registered fault handler. The fault handler, in turn needs
+		 * the information about the fault address and fault type to
+		 * resolve the fault. This information is represented by this
+		 * structure.
+		 */
+		struct State
+		{
+			/**
+			 * Type of occurred fault
+			 */
+			Fault_type type;
+
+			/**
+			 * Fault address
+			 */
+			addr_t addr;
+
+			/**
+			 * Default constructor
+			 */
+			State() : type(READY), addr(0) { }
+
+			/**
+			 * Constructor
+			 */
+			State(Fault_type fault_type, addr_t fault_addr) :
+				type(fault_type), addr(fault_addr) { }
+		};
+
+
+		/**
+		 * Helper for tranferring the bit representation of a pointer as RPC
+		 * argument.
+		 */
+		class Local_addr
+		{
+			private:
+
+				void *_ptr;
+
+			public:
+
+				template <typename T>
+				Local_addr(T ptr) : _ptr((void *)ptr) { }
+
+				Local_addr() : _ptr(0) { }
+
+				template <typename T>
+				operator T () { return (T)_ptr; }
+		};
+
+
+		static const char *service_name() { return "RM"; }
+
+
+		/*********************
+		 ** Exception types **
+		 *********************/
+
+		class Attach_failed     : public Exception     { };
+		class Invalid_args      : public Attach_failed { };
+		class Invalid_dataspace : public Attach_failed { };
+		class Region_conflict   : public Attach_failed { };
+		class Out_of_metadata   : public Attach_failed { };
+
+		class Invalid_thread    : public Exception { };
+		class Out_of_memory     : public Exception { };
+
+		/**
+		 * Destructor
+		 */
+		virtual ~Rm_session() { }
+
+		/**
+		 * Map dataspace into local address space
+		 *
+		 * \param ds               capability of dataspace to map
+		 * \param size             size of the locally mapped region
+		 *                         default (0) is the whole dataspace
+		 * \param offset           start at offset in dataspace (page-aligned)
+		 * \param use_local_addr   if set to true, attach the dataspace at
+		 *                         the specified 'local_addr'
+		 * \param local_addr       local destination address
+		 *
+		 * \throw Attach_failed    if dataspace or offset is invalid,
+		 *                         or on region conflict
+		 * \throw Out_of_metadata  if meta-data backing store is exhausted
+		 *
+		 * \return                 local address of mapped dataspace
+		 *
+		 */
+		virtual Local_addr attach(Dataspace_capability ds,
+		                          size_t size = 0, off_t offset = 0,
+		                          bool use_local_addr = false,
+		                          Local_addr local_addr = (addr_t)0) = 0;
+
+		/**
+		 * Shortcut for attaching a dataspace at a predefined local address
+		 */
+		Local_addr attach_at(Dataspace_capability ds, addr_t local_addr,
+		                     size_t size = 0, off_t offset = 0) {
+			return attach(ds, size, offset, true, local_addr); }
+
+		/**
+		 * Remove region from local address space
+		 */
+		virtual void detach(Local_addr local_addr) = 0;
+
+		/**
+		 * Add client to pager
+		 *
+		 * \param thread  thread that will be paged
+		 * \throw         Invalid_thread
+		 * \throw         Out_of_memory
+		 * \return        capability to be used for handling page faults
+		 *
+		 * This method must be called at least once to establish a valid
+		 * communication channel between the pager part of the region manager
+		 * and the client thread.
+		 */
+		virtual Pager_capability add_client(Thread_capability thread) = 0;
+
+		/**
+		 * Register signal handler for region-manager faults
+		 */
+		virtual void fault_handler(Signal_context_capability handler) = 0;
+
+		/**
+		 * Request current state of RM session
+		 */
+		virtual State state() = 0;
+
+		/**
+		 * Return dataspace representation of region-manager session
+		 */
+		virtual Dataspace_capability dataspace() = 0;
+
+
+		/*********************
+		 ** RPC declaration **
+		 *********************/
+
+		GENODE_RPC_THROW(Rpc_attach, Local_addr, attach,
+		                 GENODE_TYPE_LIST(Invalid_dataspace, Region_conflict,
+		                                  Out_of_metadata, Invalid_args),
+		                 Dataspace_capability, size_t, off_t, bool, Local_addr);
+		GENODE_RPC(Rpc_detach, void, detach, Local_addr);
+		GENODE_RPC_THROW(Rpc_add_client, Pager_capability, add_client,
+		                 GENODE_TYPE_LIST(Invalid_thread, Out_of_memory),
+		                 Thread_capability);
+		GENODE_RPC(Rpc_fault_handler, void, fault_handler, Signal_context_capability);
+		GENODE_RPC(Rpc_state, State, state);
+		GENODE_RPC(Rpc_dataspace, Dataspace_capability, dataspace);
+
+		GENODE_RPC_INTERFACE(Rpc_attach, Rpc_detach, Rpc_add_client,
+		                     Rpc_fault_handler, Rpc_state, Rpc_dataspace);
+	};
+}
+
+#endif /* _INCLUDE__RM_SESSION__RM_SESSION_H_ */

base/include/rom_session/capability.h

@@ -0,0 +1,22 @@
+/*
+ * \brief  ROM-session capability type
+ * \author Norman Feske
+ * \date   2008-08-16
+ */
+
+/*
+ * Copyright (C) 2008-2011 Genode Labs GmbH
+ *
+ * This file is part of the Genode OS framework, which is distributed
+ * under the terms of the GNU General Public License version 2.
+ */
+
+#ifndef _INCLUDE__ROM_SESSION__CAPABILITY_H_
+#define _INCLUDE__ROM_SESSION__CAPABILITY_H_
+
+#include <base/capability.h>
+#include <rom_session/rom_session.h>
+
+namespace Genode { typedef Capability<Rom_session> Rom_session_capability; }
+
+#endif /* _INCLUDE__ROM_SESSION__CAPABILITY_H_ */

base/include/rom_session/client.h

@@ -0,0 +1,32 @@
+/*
+ * \brief  Client-side ROM session interface
+ * \author Norman Feske
+ * \date   2006-07-06
+ */
+
+/*
+ * Copyright (C) 2006-2011 Genode Labs GmbH
+ *
+ * This file is part of the Genode OS framework, which is distributed
+ * under the terms of the GNU General Public License version 2.
+ */
+
+#ifndef _INCLUDE__ROM_SESSION__CLIENT_H_
+#define _INCLUDE__ROM_SESSION__CLIENT_H_
+
+#include <rom_session/capability.h>
+#include <base/rpc_client.h>
+
+namespace Genode {
+
+	struct Rom_session_client : Rpc_client<Rom_session>
+	{
+		explicit Rom_session_client(Rom_session_capability session)
+		: Rpc_client<Rom_session>(session) { }
+
+		Rom_dataspace_capability dataspace() {
+			return call<Rpc_dataspace>(); }
+	};
+}
+
+#endif /* _INCLUDE__ROM_SESSION__CLIENT_H_ */

base/include/rom_session/connection.h

@@ -0,0 +1,60 @@
+/*
+ * \brief  Connection to ROM file service
+ * \author Norman Feske
+ * \date   2008-08-22
+ */
+
+/*
+ * Copyright (C) 2008-2011 Genode Labs GmbH
+ *
+ * This file is part of the Genode OS framework, which is distributed
+ * under the terms of the GNU General Public License version 2.
+ */
+
+#ifndef _INCLUDE__ROM_SESSION__CONNECTION_H_
+#define _INCLUDE__ROM_SESSION__CONNECTION_H_
+
+#include <rom_session/client.h>
+#include <base/connection.h>
+#include <base/printf.h>
+
+namespace Genode {
+
+	class Rom_connection : public Connection<Rom_session>,
+	                       public Rom_session_client
+	{
+		public:
+
+			class Rom_connection_failed : public Parent::Exception { };
+
+		private:
+
+			Rom_session_capability _create_session(const char *filename, const char *label)
+			{
+				try {
+					return session("ram_quota=4K, filename=\"%s\", label=%s",
+					               filename, label); }
+				catch (...) {
+					PERR("Could not open file \"%s\"", filename);
+					throw Rom_connection_failed();
+				}
+			}
+
+		public:
+
+			/**
+			 * Constructor
+			 *
+			 * \param filename  name of ROM file
+			 * \param label     initial session label
+			 *
+			 * \throw Rom_connection_failed
+			 */
+			Rom_connection(const char *filename, const char *label = "") :
+				Connection<Rom_session>(_create_session(filename, label)),
+				Rom_session_client(cap())
+			{ }
+	};
+}
+
+#endif /* _INCLUDE__ROM_SESSION__CONNECTION_H_ */

base/include/rom_session/rom_session.h

@@ -0,0 +1,55 @@
+/*
+ * \brief  ROM session interface
+ * \author Norman Feske
+ * \date   2006-07-06
+ *
+ * A ROM session corresponds to an open file. The file name is specified as an
+ * argument on session creation.
+ */
+
+/*
+ * Copyright (C) 2006-2011 Genode Labs GmbH
+ *
+ * This file is part of the Genode OS framework, which is distributed
+ * under the terms of the GNU General Public License version 2.
+ */
+
+#ifndef _INCLUDE__ROM_SESSION__ROM_SESSION_H_
+#define _INCLUDE__ROM_SESSION__ROM_SESSION_H_
+
+#include <dataspace/capability.h>
+#include <session/session.h>
+
+namespace Genode {
+
+	struct Rom_dataspace : Dataspace { };
+
+	typedef Capability<Rom_dataspace> Rom_dataspace_capability;
+
+	struct Rom_session : Session
+	{
+		static const char *service_name() { return "ROM"; }
+
+		virtual ~Rom_session() { }
+
+		/**
+		 * Request dataspace containing the ROM session data
+		 *
+		 * \return  capability to ROM dataspace
+		 *
+		 * The capability may be invalid.
+		 */
+		virtual Rom_dataspace_capability dataspace() = 0;
+
+
+		/*********************
+		 ** RPC declaration **
+		 *********************/
+
+		GENODE_RPC(Rpc_dataspace, Rom_dataspace_capability, dataspace);
+
+		GENODE_RPC_INTERFACE(Rpc_dataspace);
+	};
+}
+
+#endif /* _INCLUDE__ROM_SESSION__ROM_SESSION_H_ */

base/include/root/capability.h

@@ -0,0 +1,22 @@
+/*
+ * \brief  Root capability type
+ * \author Norman Feske
+ * \date   2008-08-16
+ */
+
+/*
+ * Copyright (C) 2008-2011 Genode Labs GmbH
+ *
+ * This file is part of the Genode OS framework, which is distributed
+ * under the terms of the GNU General Public License version 2.
+ */
+
+#ifndef _INCLUDE__ROOT__CAPABILITY_H_
+#define _INCLUDE__ROOT__CAPABILITY_H_
+
+#include <base/capability.h>
+#include <root/root.h>
+
+namespace Genode { typedef Capability<Root> Root_capability; }
+
+#endif /* _INCLUDE__ROOT__CAPABILITY_H_ */

base/include/root/client.h

@@ -0,0 +1,38 @@
+/*
+ * \brief  Root client interface
+ * \author Norman Feske
+ * \date   2006-05-11
+ */
+
+/*
+ * Copyright (C) 2006-2011 Genode Labs GmbH
+ *
+ * This file is part of the Genode OS framework, which is distributed
+ * under the terms of the GNU General Public License version 2.
+ */
+
+#ifndef _INCLUDE__ROOT__CLIENT_H_
+#define _INCLUDE__ROOT__CLIENT_H_
+
+#include <root/capability.h>
+#include <base/rpc_client.h>
+
+namespace Genode {
+
+	struct Root_client : Rpc_client<Root>
+	{
+		explicit Root_client(Root_capability root)
+		: Rpc_client<Root>(root) { }
+
+		Session_capability session(Session_args const &args) {
+			return call<Rpc_session>(args); }
+
+		void upgrade(Session_capability session, Upgrade_args const &args) {
+			call<Rpc_upgrade>(session, args); }
+
+		void close(Session_capability session) {
+			call<Rpc_close>(session); }
+	};
+}
+
+#endif /* _INCLUDE__ROOT__CLIENT_H_ */

base/include/root/component.h

@@ -0,0 +1,250 @@
+/*
+ * \brief  Generic root component implementation
+ * \author Norman Feske
+ * \date   2006-05-22
+ *
+ * This class is there for your convenience. It performs the common actions
+ * that must always be taken when creating a new session.
+ */
+
+/*
+ * Copyright (C) 2006-2011 Genode Labs GmbH
+ *
+ * This file is part of the Genode OS framework, which is distributed
+ * under the terms of the GNU General Public License version 2.
+ */
+
+#ifndef _INCLUDE__ROOT__COMPONENT_H_
+#define _INCLUDE__ROOT__COMPONENT_H_
+
+#include <root/root.h>
+#include <base/rpc_server.h>
+#include <base/heap.h>
+#include <ram_session/ram_session.h>
+#include <util/arg_string.h>
+#include <base/printf.h>
+
+namespace Genode {
+
+	/**
+	 * Session creation policy for a single-client service
+	 */
+	class Single_client
+	{
+		private:
+
+			bool _used;
+
+		public:
+
+			Single_client() : _used(0) { }
+
+			void aquire(const char *args)
+			{
+				if (_used)
+					throw Root::Unavailable();
+
+				_used = true;
+			}
+
+			void release() { _used = false; }
+	};
+
+
+	/**
+	 * Session-creation policy for a multi-client service
+	 */
+	struct Multiple_clients
+	{
+		void aquire(const char *args) { }
+		void release() { }
+	};
+
+
+	/**
+	 * Template for implementing the root interface
+	 *
+	 * \param SESSION_TYPE  session-component type to manage,
+	 *                      derived from 'Rpc_object'
+	 * \param POLICY        session-creation policy
+	 *
+	 * The 'POLICY' template parameter allows for constraining the session
+	 * creation to only one instance at a time (using the 'Single_session'
+	 * policy) or multiple instances (using the 'Multiple_sessions' policy).
+	 *
+	 * The 'POLICY' class must provide the following two functions:
+	 *
+	 * :'aquire(const char *args)': is called with the session arguments
+	 *   at creation time of each new session. It can therefore implement
+	 *   a session-creation policy taking session arguments into account.
+	 *   If the policy denies the creation of a new session, it throws
+	 *   one of the exceptions defined in the 'Root' interface.
+	 *
+	 * :'release': is called at the destruction time of a session. It enables
+	 *   the policy to keep track of and impose restrictions on the number
+	 *   of existing sessions.
+	 *
+	 * The default policy 'Multiple_clients' imposes no restrictions on the
+	 * creation of new sessions.
+	 */
+	template <typename SESSION_TYPE, typename POLICY = Multiple_clients>
+	class Root_component : public Rpc_object<Typed_root<SESSION_TYPE> >, private POLICY
+	{
+		private:
+
+			/*
+			 * Entry point that manages the session objects
+			 * created by this root interface
+			 */
+			Rpc_entrypoint *_ep;
+
+			/*
+			 * Allocator for allocating session objects.
+			 * This allocator must be used by the derived
+			 * class when calling the 'new' operator for
+			 * creating a new session.
+			 */
+			Allocator *_md_alloc;
+
+		protected:
+
+			/**
+			 * Create new session (to be implemented by a derived class)
+			 *
+			 * Only a derived class knows the constructor arguments of
+			 * a specific session. Therefore, we cannot unify the call
+			 * of its 'new' operator and must implement the session
+			 * creation at a place, where the required knowledge exist.
+			 *
+			 * In the implementation of this function, the heap, provided
+			 * by 'Root_component' must be used for allocating the session
+			 * object.
+			 *
+			 * \throw Allocator::Out_of_memory  typically caused by the
+			 *                                  meta-data allocator
+			 * \throw Root::Invalid_args        typically caused by the
+			 *                                  session-component constructor
+			 */
+			virtual SESSION_TYPE *_create_session(const char *args) = 0;
+
+			/**
+			 * Inform session about a quota upgrade
+			 *
+			 * Once a session is created, its client can successively extend
+			 * its quota donation via the 'Parent::transfer_quota' function.
+			 * This will result in the invokation of 'Root::upgrade' at the
+			 * root interface the session was created with. The root interface,
+			 * in turn, informs the session about the new resources via the
+			 * '_upgrade_session' function. The default implementation is
+			 * suited for sessions that use a static amount of resources
+			 * accounted for at session-creation time. For such sessions, an
+			 * upgrade is not useful. However, sessions that dynamically
+			 * allocate resources on behalf of its client, should respond to
+			 * quota upgrades by implementing this function.
+			 *
+			 * \param session  session to upgrade
+			 * \param args     description of additional resources in the
+			 *                 same format as used at session creation
+			 */
+			virtual void _upgrade_session(SESSION_TYPE *session, const char *args) { }
+
+			virtual void _destroy_session(SESSION_TYPE *session) {
+				destroy(_md_alloc, session); }
+
+			/**
+			 * Return allocator to allocate server object in '_create_session()'
+			 */
+			Allocator      *md_alloc() { return _md_alloc; }
+			Rpc_entrypoint *ep()       { return _ep; }
+
+		public:
+
+			/**
+			 * Constructor
+			 *
+			 * \param ep           entry point that manages the sessions of this
+			 *                     root interface.
+			 * \param ram_session  provider of dataspaces for the backing store
+			 *                     of session objects and session data
+			 */
+			Root_component(Rpc_entrypoint *ep, Allocator *metadata_alloc)
+			: _ep(ep), _md_alloc(metadata_alloc) { }
+
+
+			/********************
+			 ** Root interface **
+			 ********************/
+
+			Session_capability session(Root::Session_args const &args)
+			{
+				if (!args.is_valid_string()) throw Root::Invalid_args();
+
+				POLICY::aquire(args.string());
+
+				/*
+				 * We need to decrease 'ram_quota' by
+				 * the size of the session object.
+				 */
+				size_t ram_quota = Arg_string::find_arg(args.string(), "ram_quota").long_value(0);
+				size_t const remaining_ram_quota = ram_quota - sizeof(SESSION_TYPE) -
+				                                   md_alloc()->overhead(sizeof(SESSION_TYPE));
+				if (remaining_ram_quota < 0) {
+					PERR("Insufficient ram quota, provided=%zd, required=%zd",
+					     ram_quota, sizeof(SESSION_TYPE) + md_alloc()->overhead(sizeof(SESSION_TYPE)));
+					throw Root::Quota_exceeded();
+				}
+
+				/*
+				 * Deduce ram quota needed for allocating the session object from the
+				 * donated ram quota.
+				 *
+				 * XXX  the size of the 'adjusted_args' buffer should dependent
+				 *      on the message-buffer size and stack size.
+				 */
+				enum { MAX_ARGS_LEN = 256 };
+				char adjusted_args[MAX_ARGS_LEN];
+				strncpy(adjusted_args, args.string(), sizeof(adjusted_args));
+				char ram_quota_buf[64];
+				snprintf(ram_quota_buf, sizeof(ram_quota_buf), "%zd",
+				         remaining_ram_quota);
+				Arg_string::set_arg(adjusted_args, sizeof(adjusted_args),
+				                    "ram_quota", ram_quota_buf);
+
+				SESSION_TYPE *s = 0;
+				try { s = _create_session(adjusted_args); }
+				catch (Allocator::Out_of_memory) { throw Root::Quota_exceeded(); }
+
+				return _ep->manage(s);
+			}
+
+			void upgrade(Session_capability session, Root::Upgrade_args const &args)
+			{
+				if (!args.is_valid_string()) throw Root::Invalid_args();
+
+				SESSION_TYPE *s =
+					dynamic_cast<SESSION_TYPE *>(_ep->obj_by_cap(session));
+
+				if (!s) return;
+
+				_upgrade_session(s, args.string());
+			}
+
+			void close(Session_capability session)
+			{
+				SESSION_TYPE *s = 
+					dynamic_cast<SESSION_TYPE *>(_ep->obj_by_cap(session));
+
+				if (!s) return;
+
+				/* let the entry point forget the session object */
+				_ep->dissolve(s);
+
+				_destroy_session(s);
+
+				POLICY::release();
+				return;
+			}
+	};
+}
+
+#endif /* _INCLUDE__ROOT__COMPONENT_H_ */

base/include/root/root.h

@@ -0,0 +1,93 @@
+/*
+ * \brief  Root interface
+ * \author Norman Feske
+ * \date   2006-05-11
+ */
+
+/*
+ * Copyright (C) 2006-2011 Genode Labs GmbH
+ *
+ * This file is part of the Genode OS framework, which is distributed
+ * under the terms of the GNU General Public License version 2.
+ */
+
+#ifndef _INCLUDE__ROOT__ROOT_H_
+#define _INCLUDE__ROOT__ROOT_H_
+
+#include <base/exception.h>
+#include <base/rpc.h>
+#include <base/rpc_args.h>
+#include <session/capability.h>
+
+namespace Genode {
+
+	struct Root
+	{
+		/*********************
+		 ** Exception types **
+		 *********************/
+
+		class Exception      : public ::Genode::Exception { };
+		class Unavailable    : public Exception { };
+		class Quota_exceeded : public Exception { };
+		class Invalid_args   : public Exception { };
+
+		typedef Rpc_in_buffer<160> Session_args;
+		typedef Rpc_in_buffer<160> Upgrade_args;
+
+		virtual ~Root() { }
+
+		/**
+		 * Create session
+		 *
+		 * \throw Unavailable
+		 * \throw Quota_exceeded
+		 * \throw Invalid_args
+		 *
+		 * \return capability to new session
+		 */
+		virtual Session_capability session(Session_args const &args) = 0;
+
+		/**
+		 * Extend resource donation to an existing session
+		 */
+		virtual void upgrade(Session_capability session, Upgrade_args const &args) = 0;
+
+		/**
+		 * Close session
+		 */
+		virtual void close(Session_capability session) = 0;
+
+
+		/*********************
+		 ** RPC declaration **
+		 *********************/
+
+		GENODE_RPC_THROW(Rpc_session, Session_capability, session,
+		                 GENODE_TYPE_LIST(Unavailable, Quota_exceeded, Invalid_args),
+		                 Session_args const &);
+		GENODE_RPC_THROW(Rpc_upgrade, void, upgrade,
+		                 GENODE_TYPE_LIST(Invalid_args),
+		                 Session_capability, Upgrade_args const &);
+		GENODE_RPC(Rpc_close, void, close, Session_capability);
+
+		GENODE_RPC_INTERFACE(Rpc_session, Rpc_upgrade, Rpc_close);
+	};
+
+
+	/**
+	 * Root interface supplemented with information about the managed
+	 * session type
+	 *
+	 * This class template is used to automatically propagate the
+	 * correct session type to 'Parent::announce()' when announcing
+	 * a service.
+	 */
+	template <typename SESSION_TYPE>
+	struct Typed_root : Root
+	{
+		typedef SESSION_TYPE Session_type;
+	};
+}
+
+#endif /* _INCLUDE__ROOT__ROOT_H_ */

base/include/session/capability.h

@@ -0,0 +1,22 @@
+/*
+ * \brief  Session capability type
+ * \author Norman Feske
+ * \date   2008-08-16
+ */
+
+/*
+ * Copyright (C) 2008-2011 Genode Labs GmbH
+ *
+ * This file is part of the Genode OS framework, which is distributed
+ * under the terms of the GNU General Public License version 2.
+ */
+
+#ifndef _INCLUDE__SESSION__CAPABILITY_H_
+#define _INCLUDE__SESSION__CAPABILITY_H_
+
+#include <base/capability.h>
+#include <session/session.h>
+
+namespace Genode { typedef Capability<Session> Session_capability; }
+
+#endif /* _INCLUDE__SESSION__CAPABILITY_H_ */

base/include/session/session.h

@@ -0,0 +1,38 @@
+/*
+ * \brief  Session
+ * \author Norman Feske
+ * \date   2011-05-15
+ */
+
+/*
+ * Copyright (C) 2011 Genode Labs GmbH
+ *
+ * This file is part of the Genode OS framework, which is distributed
+ * under the terms of the GNU General Public License version 2.
+ */
+
+#ifndef _INCLUDE__SESSION_H_
+#define _INCLUDE__SESSION_H_
+
+/*
+ * Each session interface declares an RPC interface and, therefore, relies on
+ * the RPC framework. By including 'base/rpc.h' here, we relieve the interfaces
+ * from including 'base/rpc.h' in addition to 'session/session.h'.
+ */
+#include <base/rpc.h>
+
+namespace Genode {
+
+	/**
+	 * Base class of session interfaces
+	 *
+	 * Each session interface must implement the function 'service_name'
+	 * ! static const char *service_name();
+	 * This function returns the name of the service provided via the session
+	 * interface.
+	 */
+	class Session { };
+}
+
+
+#endif /* _INCLUDE__SESSION_H_ */