depot: update recipe hashes

So far this dummy was only triggered on AX devices after the driver
has been used for a few hours.

Issue #4488.

.gitignore

@@ -7,5 +7,10 @@
 /contrib
 /depot
 /public
+/repos/allwinner
+/repos/imx
+/repos/riscv
+/repos/rpi
 /repos/world
+/repos/zynq
 

VERSION

@@ -1 +1 @@
-21.08
+22.02

doc/components.txt

@@ -343,10 +343,6 @@ Separate components
   Provides each file contained in a tar file obtained via Genode's ROM session
   as separate ROM session.
 
-:_os/src/server/iso9660/_:
-  Provides each file of an ISO9660 file system accessed via a block session as
-  separate ROM session.
-
 :_os/src/server/lx_fs/_:
   A file system server that makes the file system of a Linux base platform
   available to Genode.
@@ -361,9 +357,6 @@ Separate components
 :_os/src/server/log_terminal/_:
   Adapter for forwarding terminal output to a LOG session.
 
-:_os/src/server/fs_log/_:
-  Adapter that writes LOG messages to files on a file system.
-
 :_demo/src/server/nitlog/_:
   Provides a LOG session, printing log output on screen via a GUI session.
 
@@ -377,9 +370,6 @@ Separate components
   switching between configuration variants dependent on the state of
   the system.
 
-:_os/src/server/log_terminal/_:
-  Forwards terminal output to a LOG session.
-
 :_gems/src/server/file_terminal/_:
   Provides terminal sessions that target files on a file system.
 
@@ -395,10 +385,6 @@ Separate components
   The terminal crosslink service allows to terminal clients to talk to each
   other.
 
-:_gems/src/server/http_block/_:
-  A block service that fetches a virtual block device over the network from
-  a HTTP server.
-
 :_os/src/server/fs_rom/_:
   A ROM service that translates the 'File_system' session interface to the
   'ROM' session' interface. Each request for a ROM file is handled by looking
@@ -454,6 +440,9 @@ implement the VFS-plugin interface. They can be combined with any application
 based on Genode's C runtime, with the VFS server, and with non-POSIX
 components that use the Genode's VFS library directly.
 
+:_os/src/lib/vfs/tap/_:
+  A VFS plugin that allows for packet-level access of a NIC or uplink session.
+
 :_gems/src/lib/vfs/trace/_:
   A VFS plugin that makes core's TRACE service accessible as a pseudo
   file system.
@@ -609,15 +598,11 @@ Package-management components
 Runtime environments
 ####################
 
-:_ports/src/app/seoul/_: Seoul is a virtual-machine monitor developed for
-  the use with the NOVA platform. It virtualizes 32bit x86 PC hardware
-  including various peripherals.
-
 :_os/src/server/loader/_: A service that allows the creation and destruction
   of Genode subsystems via a session interface. For further information,
   refer to _os/src/server/loader/README_.
 
-:_ports/src/virtualbox5/_: VirtualBox running on top of the NOVA hypervisor.
+:_ports/src/virtualbox6/_: VirtualBox running on top of the NOVA hypervisor.
 
 :_os/src/server/vmm/_: A virtual machine monitor that is based on
   hardware-assisted virtualization of ARM platforms. It is supported on

doc/news.txt

@@ -4,6 +4,163 @@
                                ===========
 
 
+Genode OS Framework release 22.02 | 2022-02-28
+##############################################
+
+| With Genode 22.02, 3D acceleration becomes available to guest operating
+| systems running in VirtualBox 6, Sculpt OS evolves into a versatile framework
+| for building special-purpose operating systems, and Genode starts to interact
+| with the modem of the Pinephone.
+
+The features mentioned above are merely the tip of the iceberg of version
+22.02. In fact, the majority of the development work during the release cycle
+was focused on topics beyond the visible surface, ranging from the
+reorganization of the code base for streamlining the targeting of new hardware,
+over the tightening of foundational framework APIs, to the raising of the
+default warning level used when building genuine Genode components. Over the
+course of this infrastructural work, almost no component was left unturned.
+
+Functionality-wise, improvements of the Genode-based Sculpt OS are at the
+center stage of the release. Originally pursued with the vision of a
+Genode-based general-purpose OS that is fit for day-to-day use on commodity PC
+hardware, the current release lifts the potential of Sculpt's architecture for
+the creation of special-purpose operating-system appliances. The gained
+flexibility took even us developers by surprise! Thanks to the new modular
+approach, we were able to demonstrate a bare-bones version of Sculpt OS on
+the Pinephone at FOSDEM, or accelerate our development workflow by routinely
+running Sculpt OS directly on the Linux kernel.
+
+The intensive device-driver-related developments of the previous releases
+continued as well. This time, we took our new approach for running Linux
+drivers in Genode to PC hardware, starting with a fresh port of the USB host
+controller driver. The Intel GPU driver received numerous performance
+improvements and can now even be combined with guest operating systems running
+in VirtualBox 6. Further notable driver-related improvements are the new
+ability to interact with the modem on the Pinephone and largely streamlined
+driver infrastructure for the Raspberry Pi.
+
+All the details of the new version can be found in the
+[https:/documentation/release-notes/22.02 - release documentation of version 22.02...]
+
+
+Road Map for 2022 | 2022-01-18
+##############################
+
+| Our plans for 2022 envision the use of Genode for advanced mobile
+| use cases such as video chat.
+
+Following Genode's major technical breakthroughs in the areas of reusing Linux
+drivers, hardware-accelerated graphics, and the native execution of Chromium
+during 2021, we will pursue _mobile usability_ as overarching theme in 2022.
+Specifically, we aspire the routine use of Genode on the Pinephone as a
+platform for video chat, using WireGuard to protect the communications.
+
+This vision motivates a large variety of challenging technical topics.
+To name a few, we have to squeeze good performance out of the
+resource-constrained Pinephone hardware, focus on UI latency and the quality
+of service of audio streaming, come up with a somewhat usable touch-based
+user interface, and get to the guts of power management.
+
+Aside this guiding theme, we put a broad update of our PC drivers on our
+agenda so that Sculpt OS remains a suitable basis for our day-to-day
+computing needs on recent generations of Intel hardware.
+As an additional line of development, we are excited to intensify the
+combination of Genode with reconfigurable hardware.
+
+More information about our review of the past year, this year's focus, and a
+rough schedule are presented at our official
+[https:/about/road-map - road-map page].
+
+
+Genode OS Framework release 21.11 | 2021-11-30
+##############################################
+
+| Genode 21.11 puts the spotlight on device drivers. Interactive Genode
+| scenarios come to the Pinephone, hardware-accelerated graphics becomes
+| available on Intel Gen9+ and Vivante GPUs, and Xilnx Zynq receives
+| new love.
+
+The previous release presented our new take on porting drivers from Linux, and
+the architectural integration of hardware-accelerated graphics in Genode-based
+systems. The just released version 21.11 is the continuation of both topics.
+Thanks to our streamlined approach for transplanting Linux drivers to Genode, we
+were able to reuse the Pinephone's Linux drivers for the display and
+touchscreen without modification. But, in contrast to running those drivers in
+the Linux kernel, we are walking on new ground by confining each driver in a
+separate sandbox.
+
+With our GPU line of work, we followed two major directions during the release
+cycle. For one, we applied our architectural approach to a second GPU vendor
+besides Intel, namely the Vivante GPU as used by the i.MX SoC family.
+Combined with the etnaviv Gallium driver of the Mesa library, Genode thereby
+becomes able to render graphics with hardware acceleration on the MNT Reform
+open-hardware laptop. The second branch is the promised extension of our
+custom Intel GPU multiplexer to GPUs of generation 9 or newer. Thereby, GPU
+support has now become a regular feature of the Genode-based Sculpt OS that
+can be taken for a spin on commodity PC hardware.
+
+Regarding 32-bit ARM platforms, the current release revives our engagement
+with Xilinx Zynq devices, which combine FPGA fabric with a 32-bit ARM CPU.
+In particular, the release brings the framework to the USRP E310 board,
+opening new hardware-software co-design opportunities.
+
+Besides the many hardware-related topics outlined above, two functional
+improvements stand out. First, the Genode version of VirtualBox 6 has reached
+feature parity with version 5. Both versions can now be used interchangeably
+on Sculpt OS. Finally, libSDL2 got upgraded with support for audio and OpenGL,
+which is a nice pathway for hosting games on Genode.
+
+The new version is described in full detail by the
+[https:/documentation/release-notes/21.11 - release documentation of version 21.11...]
+
+
+Sculpt OS release 21.10 | 2021-10-14
+####################################
+
+| Sculpt OS version 21.10 introduces GPU-accelerated graphics on Intel,
+| media playback in the web browser, VirtualBox 6, and USB webcam support.
+
+At the first glance, the just released Sculpt 21.10 looks and feels nearly
+identical to the time-tested previous version 21.03. However, a look at the
+installable packages reveals a firework of exciting new features.
+
+First and technically most exciting, the new version enables the use of
+hardware-accelerated graphics on Intel GPUs, paving the ground for
+graphics-intensive applications and games. The GPU support is based on the
+combination of the Mesa library stack with our custom GPU multiplexer
+as featured in
+[https://genode.org/documentation/release-notes/21.08#Advancing_GPU_driver_stack - Genode 21.08].
+_Note that this fresh new feature should best be regarded as experimental_
+_and be used with caution._
+
+Second, our port of the Chromium-based Falkon web browser has become able to
+present media content like videos and sound. Look out for the browser in the
+tools menu of cproc's depot. It is accompanied with a ready-to-use audio
+driver and a mixer component. In cases where audio output is not desired, the
+browser - or any other component that requests audio output - can be connected
+to a new component called black hole, which merely mimics an audio driver
+without any audible effect.
+
+Third, with the addition of the new file-vault component, Sculpt now provides
+an easy way to setup and use an encrypted file store using our custom CBE
+block encrypter as underlying crypto container. The file vault is especially
+useful in combination with the recall-fs component that provides each client
+with a distinct storage compartment.
+
+Finally, the support for USB webcams as introduced with
+[https://genode.org/documentation/release-notes/21.05#Webcam_support - Genode 21.05]
+has entered Sculpt OS in the form of a new webcam package. The webcam support
+can best be combined with our new port of VirtualBox 6 that is available in
+addition to VirtualBox version 5. With Sculpt 21.10, both VirtualBox versions
+can be used in parallel.
+
+Sculpt OS 21.10 is available as ready-to-use system image at the
+[https://genode.org/download/sculpt - Sculpt download page] and is accompanied
+with updated [https://genode.org/documentation/articles/sculpt-21-10 - documentation].
+More details about individual new features of Sculpt 21.10 will be covered
+soon by dedicated articles at [https://genodians.org].
+
+
 Genode OS Framework release 21.08 | 2021-08-31
 ##############################################
 

doc/porting_guide.txt

@@ -289,9 +289,9 @@ Examining the log file leaves us with the following list of source files:
 ! FILTER_OUT_dos  = cdrom_aspi_win32.cpp cdrom_ioctl_linux.cpp cdrom_ioctl_os2.cpp \
 !                   cdrom_ioctl_win32.cpp
 ! SRC_CC_dos      = $(filter-out $(FILTER_OUT_dos), \
-!                   $(notdir $(wildcard $(DOSBOX_DIR)/src/*.cpp)))
+!                   $(notdir $(wildcard $(DOSBOX_DIR)/src/dos/*.cpp)))
 ! […]
-! SRC_CC          = $(DOSBOX_DIR)/src/dosbox.cpp
+! SRC_CC          = $(notdir $(DOSBOX_DIR)/src/dosbox.cpp)
 ! SRC_CC         += $(SRC_CC_cpu) $(SRC_CC_debug) $(SRC_CC_dos) $(SRC_CC_fpu) \
 !                   $(SRC_CC_gui) $(SRC_CC_hw) $(SRC_CC_hw_ser) $(SRC_CC_ints) \
 !                   $(SRC_CC_ints) $(SRC_CC_misc) $(SRC_CC_shell)

doc/release_notes/18-02.txt

@@ -219,8 +219,9 @@ Base framework and OS-level infrastructure
 Increased default warning level
 ===============================
 
-For building Genode components written in C++, the compiler flags -Wextra,
--Weffc++, and -Werror are now enabled in addition to -Wall by default.
+For building Genode components written in C++, the compiler
+flags -Wextra, -Weffc++, and -Werror are now enabled in addition
+to -Wall by default.
 
 If this strict warning level is inapplicable for a given component or
 library, it is possible to explicitly disable the strictness in the

doc/release_notes/21-11.txt

@@ -0,0 +1,835 @@
+
+
+              ===============================================
+              Release notes for the Genode OS Framework 21.11
+              ===============================================
+
+                               Genode Labs
+
+
+
+Version 21.11 of the Genode OS Framework puts device drivers into the
+spotlight. Where to begin? Back in
+[https://genode.org/news/road-map-for-2021 - January], we envisioned Genode
+running on the Pinephone. With the current release, the first interactive
+Genode scenarios become alive on this platform. Unlike the regular Linux-based
+systems used on the Pinephone, we are walking on new ground by running each
+individual driver in a dedicated sandbox.
+
+Speaking of 64-bit ARM platforms, Genode's support for the i.MX8 SoC family
+received a new USB host driver as well as the first version of the Vivante GPU
+driver. The latter is a continuation of our GPU-related work presented in the
+[https://genode.org/documentation/release-notes/21.08#Advancing_GPU_driver_stack - previous release],
+which proves that our approach of integrating hardware-accelerated graphics
+into the framework's architecture is applicable across different GPU vendors.
+As promised three months ago, we have also taken our custom Intel GPU
+multiplexer to Gen9 or newer devices. In fact, GPU support has now become a
+regular feature of the Genode-based Sculpt OS that can be taken for a spin on
+commodity PC hardware.
+
+Even though most efforts are nowadays spent on 64-bit platforms, we have
+revived Genode's support for Xilinx Zynq devices in aspiration of future
+hardware-software co-design work. Those chips combine FPGA fabric with 32-bit
+ARM cores and thereby allow us to explore the combination of reconfigurable
+hardware with Genode's component architecture.
+
+For users who prefer the comforts of virtual hardware over the tinkering with
+physical devices, new drivers for VirtIO input and graphics open up the use of
+interactive Genode systems on Qemu's "virt" platform.
+
+Besides the predominant device-driver topics of the release, one other
+highlight is the feature completion of Genode's version of VirtualBox 6 on PC
+platforms, which has now reached parity with the time-tested version 5. Now,
+features like shared folders, shared clipboard, sound, or USB pass-through
+have become readily available.
+
+
+A little kingdom for each SoC family
+####################################
+
+With the number of supported boards and CPU architectures growing, our
+existing maintenance structure of the central Genode code repository becomes
+increasingly nonviable. We made the following observations.
+
+First, with respect to drivers ported from Linux, each SoC tends to refer
+to a different _flavour_ of the Linux kernel. This so-called vendor kernel
+may be a specific version with a blessed kernel configuration, or even a
+hard fork. In the past, we tried harmonizing drivers across SoCs by using
+the vanilla Linux kernel as common ground. But in practice, this common
+ground seems to be walked-on by only a few. Devices are shipped with vendor
+kernels after all. To get the best supported drivers for a given hardware,
+we have to port the drivers from the respective vendor kernel.
+This realization, in turn, faces us with the problem of a growing number
+of vendor kernels we have to work with whenever extending Genode's hardware
+support to a new SoC. But there are only so many Linux kernels one can juggle
+with.
+
+Second, when using one monolithic code base for all SoCs, the coordination of
+the code repository becomes a bottleneck when it comes to reviewing and
+merging contributions, and the nurturing of a consistent level of quality
+assurance. In the case of Genode, this responsibility is shared by two head
+maintainers. However, their expertise lies in the Genode framework, not in the
+peculiarities of specific SoC hardware. Hence, the review of such SoC-related
+contributions must remain at surface level. But the burden of responsibility
+still rests on the two.
+
+Third, we ultimately want to encourage 3rd parties - like hardware vendors -
+to supplement SoC support for Genode independently from us. Forcing such
+independent developers to funnel their results into our code base is not
+always natural and may even be legally impeded by Genode's need for a
+[https://genode.org/community/contributions#Genode_Contributors_Agreement - contributor's agreement].
+We want to avoid such artificial friction.
+
+The consequence of these observations is the need to modularize our code base
+around the idea of giving each SoC family a little kingdom of their own. We
+envision a code repository with a different maintainer for each SoC family. As
+a prerequisite, we had to cleanly separate SoC-specific code from the generic
+code that will remain in the main Genode repository. To stress this approach,
+each of four developers picked a dedicated SoC family and went with it. Stefan
+Kalkowski took the i.MX-related code to his
+[https://github.com/skalk/genode-imx - genode-imx] repository,
+Johannes Schlatow took the Xilinx Zynq code to his
+[https://github.com/jschlatow/genode-zynq - genode-zynq] repository,
+Norman Feske
+maintains the Allwinner code for the Pinephone in
+his [https://github.com/nfeske/genode-allwinner - genode-allwinner]
+repository, and Sebastian Sumpf gave the RISC-V support a new home
+at his [https://github.com/ssumpf/genode-riscv - genode-riscv] repository.
+
+By looking at this modularization from four different perspectives at the same
+time, we reached satisfying interfaces between the generic and SoC-specific
+code. We found that this maintenance model works as anticipated. In
+particular, we hoped that each SoC can be shepherded by a single person
+without stress. This turned out to be true.
+
+We also found that the taken approach gives each maintainer a sense of
+autonomy that was not possible with one monolithic code base. This is
+particularly fruitful when drafting generic utilities for the eventual
+inclusion into Genode's main repository. The drafts can first receive a test
+of time at individual SoC repositories before integrating them into the common
+code base, the pin I/O interfaces described in
+Section [Pin I/O session interfaces] being a good example.
+
+The supportive tooling for each SoC tends to differ between vendors, speaking
+of custom system-image formats, boot loaders, or firmware. The SoC-specific
+repositories provide a natural home for hosting such tools, custom work-flow
+scripts, and configurations.
+
+With this exploratory phase completed, we plan to move the SoC-specific
+repositories - that currently reside at each maintainer's GitHub account -
+under the banner of [https://github.com/genodelabs - genodelabs] during the
+next release cycle.
+
+
+NXP i.MX family
+===============
+
+Support for the family of i.MX SoC related boards is located in the
+[https://github.com/skalk/genode-imx - genode-imx] repository.
+By now, it contains far-reaching support for the i.MX 8M Quad evaluation kit,
+and the MNT Reform2.
+
+Besides the basic kernel support for Genode's custom base-hw microkernel,
+it contains drivers for using SD and eMMC cards, HDMI, and MIPI-DSI connected
+displays, Ethernet, and USB connected devices. Moreover, we are proud to
+introduce support for the Vivante GPU used by the i.MX 8M SoC. All mentioned
+device drivers were ported using the
+[https://genode.org/documentation/release-notes/21.08#Linux-device-driver_environment_re-imagined - re-imagined approach to port Linux drivers]
+that was introduced in the previous release.
+
+To obtain a ready-to-use SD-card when testing an arbitrary run-script
+scenario, it is sufficient to add the following value to the 'RUN_OPT'
+variable:
+
+! RUN_OPT += --include image/imx8mq_mmc
+
+Depending on which board you've chosen, it will build the corresponding u-boot
+bootloader, file system, Genode system image, and integrate those parts into
+one SD-card image.
+
+
+Xilinx Zynq
+===========
+
+Basic platform support for the Zynq-7000 SoC has already been added to Genode
+with
+[https://genode.org/documentation/release-notes/15.11#Xilinx_Zynq-7000 - release 15.11].
+While the virtualized zynq_qemu board support resided in the main Genode
+repository and was regularly tested, support files for real Zynq-hardware were
+living in segregation within the Genode-world repository.
+
+By creating a new realm in form of a
+[https://github.com/jschlatow/genode-zynq - genode-zynq repository], we were
+able to consolidate the Zynq-specific board support and drivers in one place.
+Furthermore, we are currently intensifying our work on this platform and
+documenting the journey on
+[https://genodians.org/jschlatow/2021-11-29-zynq-guide-1 - genodians.org].
+This particularly includes building ready-to-use SD card images with u-boot
+and supporting run-time re-configuration of the FPGA.
+
+In order to use the zynq repository, you only need to create a clone at
+_repos/zynq_, create a new build directory for arm_v7a and uncomment the
+corresponding line in your etc/build.conf. Step-by-step instructions for
+individual boards can be found at _repos/zynq/doc/_.
+
+
+Allwinner A64 (Pinephone)
+=========================
+
+During the release cycle, Genode's support for the Allwinner A64 SoC, and
+the Pinephone in particular, made big leaps forward. The corresponding code
+is hosted in the dedicated
+[https://github.com/nfeske/genode-allwinner - genode-allwinner] repository.
+
+First, the Linux version taken as the basis for ported device drivers has been
+updated to 5.14.1 in order to support the revision v2 of the Pine-A64-LTS
+board, which features a different Ethernet PHY, namely the Motorcomm YT8511
+PHY. Genode's 'pine_a64lts' board supports both board revisions now.
+
+To enable touchscreen input on the Pinephone, the corresponding driver for the
+Goodix touchscreen controller has been ported from the Linux kernel. It
+complements the framebuffer driver that we introduced with the previous
+release. Combined, both drivers enable the use of Genode's regular interactive
+scenarios based on the 'drivers_interactive' package. The biggest technical
+challenge was the untangling of both drivers from the clock, reset, and power
+control units (CCU, RSB, PMIC). Those low-level platform configurations are
+now handled by a new A64-specific version of the platform driver.
+
+[image pinephone_touch]
+  Genode's nano-3D example responding to touch input
+
+The improved driver support is accompanied with new tooling for booting Genode
+on the Pinephone, either via USB fastboot, or via SD-card. Both options are
+described in the following Genodians article.
+
+:Booting Genode on the Pinephone:
+
+  [https://genodians.org/nfeske/2021-09-20-pine-fun-pinephone-boot]
+
+
+RISC-V
+======
+
+RISC-V board support for the base-hw kernel is now located at the
+[https://github.com/ssumpf/genode-riscv - genode-riscv] repository. Currently,
+the repository contains support for the
+[https://hensoldt-cyber.com/mig-v - MiG-V] SoC including kernel specific parts
+as well as a driver for MiG-V's network-interface controller.
+
+
+Base framework and OS-level infrastructure
+##########################################
+
+New pattern for C++ error handling
+==================================
+
+Genode employs C++ exceptions for propagating errors, which is true to the
+language. However, the use and the mechanics of C++ exceptions comes with its
+own bag of problems. The current release introduces a new error-handling
+pattern in the form of the so-called 'Attempt' utility. Its name reflects its
+designated use as a carrier for return values. This new utility is described
+by a dedicated article at Genodians.org:
+
+:An 'Attempt' to avoid C++ exceptions:
+
+  [https://genodians.org/nfeske/2021-11-26-attempt-no-exceptions]
+
+During the release cycle, we applied the 'Attempt' pattern to Genode's
+low-level memory-allocation code, namely core's PD session interface (for the
+allocation of RAM dataspaces), and the code related to the generic 'Allocator'
+interface (for the allocation of bytes). The latter is an extensive change,
+touching all implementations of this interface.
+
+To largely uphold compatibility with components using the original
+exception-based interface as a mere client - in particular use cases where an
+'Allocator' is passed to the 'new' operator - the traditional 'alloc' is still
+supported. But it exists merely as a wrapper around the new 'try_alloc'.
+However, the change does not preserve compatibility with the original
+'Range_allocator' interface. So uses of this interface must be adapted.
+
+
+Pin I/O session interfaces
+==========================
+
+On ARM-based SoCs, the use of general-purpose I/O (GPIO) pins is omnipresent.
+Traditionally, Genode features the "Gpio" session interface for this purpose.
+This interface allows a client to access an individual pin. Once assigned to a
+pin, the session grants the client the full responsibility for the pin. In
+particular the direction of the I/O pin is laid into the hands of the client.
+We later realized that the wiring and thereby the direction of a pin is
+ultimately a board-level decision. Wrongly operating an input pin in output
+mode can easily result in a short-circuit. Therefore, the client of an
+individual pin should better not be burdened with the responsibility to
+control the pin direction or pull resistors. To address this concern, it is
+best to split the roles of GPIO pins into clear-cut session interfaces.
+Those roles are:
+
+* The sensing of the state of a GPIO pin, e.g., detecting whether a button is
+  pressed or not: operating a pin as an input signal. This role is now covered
+  by the "Pin_state" session interface with the single RPC function
+
+  ! bool state() const;
+
+  By calling this function, the client can request the state of the pin.
+  That's it.
+
+* Controlling the signal level of a pin: operating a pin as an output signal.
+  This role is now addressed by the "Pin_control" session interface that
+  provides an interface of only one rather unsurprising RPC function
+
+  ! void state(bool);
+
+* Receiving a notification of a change of the signal level of a GPIO pin:
+  operating a pin as an interrupt source. This role can be represented by
+  Genode's existing IRQ session interface - the same interface as provided by
+  Genode's core for GIC interrupts.
+
+Since each pin corresponds to a separate session, per-pin access control
+becomes possible by Genode's regular session-routing mechanisms.
+In contrast to the original GPIO session, the role of each pin as output and
+input becomes explicit. A client can no longer drive a pin that is an input
+signal unless explicitly permitted.
+
+The interfaces were created and time-tested in the context of our
+Pinephone-related development, in particular during the work described in the
+following two articles.
+
+:Device access from the user level:
+
+  [https://genodians.org/nfeske/2021-03-17-pine-fun-device-access]
+
+:One Platform driver to rule them all:
+
+  [https://genodians.org/nfeske/2021-04-29-platform-driver]
+
+
+Pin-driver framework
+--------------------
+
+In real-world system scenarios, a variety of different components must
+decidedly interact with individual GPIO pins. This is where a so-called pin
+driver enters the picture. This component provides the pin-state, pin-control,
+and IRQ services. Analogously to how the platform driver safeguards the access
+to device resources by different - mutually distrusting - device drivers, the
+pin driver's job is the safeguarding of GPIO pins.
+
+To ease the implementation of such pin drivers, the new session interfaces are
+accompanied by a set of new utilities in
+[https://github.com/genodelabs/genode/blob/staging/repos/os/include/os/pin_driver.h -  os/pin_driver.h].
+The use of these utilities is best illustrated by the
+[https://github.com/nfeske/genode-allwinner/tree/master/src/drivers/pin/a64 - pin driver for the A64 SoC].
+
+
+Time-multiplexed pin direction
+------------------------------
+
+There exist rare use cases for changing the direction of an I/O pin during
+runtime. For example, the Goodix touchscreen controller as found in the
+Pinephone monitors the state of its interrupt signal during reset. During its
+normal operation, this signal is driven by the touchscreen controller but
+during reset, it is driven by the host to send one bit of information (I2C
+address selection). We support this time-multiplexed use of one pin as both
+input and output by the means of session lifetimes. The pin driver switches
+the pin into output mode not before a client establishes a pin-control session
+referring to this pin. The client can thereby control the direction by
+creating or closing its pin-control session.
+
+
+Genode C APIs
+=============
+
+USB host-controller service API
+-------------------------------
+
+While porting the Linux driver for the Designware USB host-controller used
+within the i.MX 8M SoC, we introduced a new C API to serve Genode USB clients
+from C driver ports. It enables drivers to:
+
+* Announce and release USB devices,
+* Ask for a session handle of an open session via the bus/device ID pair,
+* Ask for a single USB request via a session handle,
+* Acknowledge a USB request via a session and request handle, and
+* Notify potential USB clients that I/O progress has been made.
+
+You can find the new C API under _repos/os/include/genode_c_api/usb.h_. A
+working example driver can be found within the 'genode-imx' repository under
+_src/drivers/usb_host/imx8mq_.
+
+
+Touchscreen driver API
+----------------------
+
+To accommodate input drivers written in C, like the ones ported from the Linux
+kernel, we need a clean way to connect C code with Genode's event session
+interface.
+The current release introduces a C API to be used by input drivers to generate
+Genode events. The interface is located at
+_repos/os/include/genode_c_api/event.h_ whereas the implementation resides at
+_repos/os/src/lib/genode_c_api/event.cc_.
+The initial version is limited to multitouch events only.
+As of now, it is used by the Goodix touchscreen driver for the Pinephone.
+
+
+Event filter for converting touch to pointer input
+==================================================
+
+Unlike traditional pointer devices, touchscreens have no notion of a pointer
+position, hovering, or mouse buttons. E.g., without touching, there is no
+position. There exists a gap between those devices and regular GUI
+applications, which respond to pointer events in terms of hovering motion (in
+screen coordinates) and mouse clicks. Genode's existing touchscreen drivers
+try to bridge this gap by translating touch input to pointer events in rather
+pragmatic ways. This is not optimal for two reasons.
+
+First, putting the burden of emulating traditional pointer devices on the
+touchscreen drivers not only inflates their complexity but is also unnatural
+when the calibration of touch coordinates to screen coordinates comes into
+play. In this case, the touchscreen driver must be made aware of the display
+resolution. Second, the heuristics of how touch events are best translated
+into pointer events tend to differ from driver to driver, or between Genode
+use cases. Any intelligence that is builtin in the drivers stands in the way
+of interchanging the drivers or enhancing the translation across all drivers
+(e.g., adding two-finger-scroll).
+
+To solve this problem in a clean way, we added a new optional filter for
+translating touch events to pointer events to Genode's event-filter component
+(first introduced in
+[https://genode.org/documentation/release-notes/17.02#Input-event_filter - 17.02]
+as input filter, reworked in
+[https://genode.org/documentation/release-notes/20.08#Replacing_the_input_filter_with_an_event_filter - 20.08]).
+The new filter comes in the form of a new '<touch-click>' node in the filter's
+'<output>' definition. For example, the configuration of the event filter that
+sits in-between the Goodix touchscreen driver for the Pinephone and the
+nitpicker GUI server looks as follows.
+
+! <config>
+!   <output>
+!     <touch-click>
+!       <input name="touch"/>
+!     </touch-click>
+!   </output>
+!   <policy label="touch" input="touch"/>
+! </config>
+
+The filter augments touch events with artificial absolute motion and mouse
+click/clack events as understood by regular GUI applications. The original
+touch events are preserved, enabling touch-aware applications to interpret
+touch gestures.
+
+
+Device drivers
+##############
+
+Hardware-accelerated graphics
+=============================
+
+Generic GPU-session interface
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+When we introduced the GPU session initially, it was modeled after the
+perceived requirements of the Linux i915 DRM back end. In the meantime, with
+the enablement of a more recent Mesa version and the addition of Vivante as
+another GPU family, we learned that some of those requirements are obsolete.
+
+First, we replaced the 'info' RPC by an information ROM dataspace to overcome
+the following limitations.
+
+* The amount of data that can be transferred in an RPC is constrained by the
+  underlying base platform,
+* Most information never changes during run time but must be copied
+  nonetheless when using an RPC interface,
+* The information presented differs depending on the used GPU device.
+  With the introduction of Vivante, the original Intel-centric implementation no
+  longer suffices.
+* Sequence numbers of GPU execution buffers are not GPU-specific and, thus,
+  should be part of the generic GPU session interface.
+
+Currently, the GPU-specific information is presented in binary format, which
+is specified in _gpu/info_intel.h_ resp. _gpu/info_etnaviv.h_ for the Vivante
+GPU. We entertain the idea to replace the current representation by an
+XML-based ROM in the future to render the interface binary agnostic and also
+backwards-compatible. The information ROM can be accessed via the
+'attached_info' client API function.
+
+Furthermore, we replaced the usage of heavy-weight dataspace capabilities with
+light-weight client-local identifiers called 'Buffer_id' within the API. In
+case the client requires a capability (e.g., for mapping the buffer in its
+address space) it uses the corresponding ID to request it from the server.
+
+With upcoming support for other driver back ends, we need to take their
+requirements into account as well. We introduced abstractions that further
+encapsulate the device-specific state and operations. The changes in this
+release represent only the first consolidation steps of Genode's GPU support
+and we will continue this work during the next months.
+
+
+Intel GPU support for Gen9 and newer
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+As mentioned in the
+[https://genode.org/documentation/release-notes/21.08#Advancing_GPU_driver_stack - 21.08]
+release notes, we were fiercely working on Intel GPU Gen9+ support because
+Gen8 (Broadwell) was the only stable running GPU on Genode at the time. For
+Gen9+, we experienced severe GPU hangs after an undefined amount of rendering
+passes. As promised in the previous release, we dove right in and were able to
+identify the main causes of this behavior. This led to working Gen9+ support in
+[https://genode.org/documentation/articles/sculpt-21-10#GPU - Sculpt OS release 21.10].
+To go into a little more detail, we had to look into workarounds as described by the
+[https://01.org/sites/default/files/documentation/intel-gfx-prm-osrc-skl-vol16-workarounds_0.pdf - Intel documentation]
+and the Linux kernel driver, and determine known workarounds that only apply
+to Gen9 and above. After many iterations, we found one workaround that fixed
+our GPU hang issue and now apply it during GPU initialization. Additionally,
+we found the hardware context sizes (a memory region where the GPU stores its
+state) vary between GPU generations, where Gen9 requires more space than Gen8.
+
+Additionally, we found that some features like tiling or client mappings
+through the global-graphics translation table are not required by our updated
+Mesa 21.0.0 Iris Gallium driver. Since these resources are global and were
+split between multiple GPU client applications, not using them lifts the
+limits formerly imposed by the partitioning.
+
+For the Sculpt integration, we added GPU-service support and are providing
+various packages. A summary on how to test GPU acceleration on Sculpt can be
+found at the following Genodians article.
+
+:Test driving Sculpt's 3D support:
+
+  [https://genodians.org/ssumpf/2021-10-25-glmark2]
+
+
+
+Vivante GPUs (i.MX8)
+~~~~~~~~~~~~~~~~~~~~
+
+With the previous release, we already foresaw adding support for Vivante
+GPUs as found in i.MX8 SoCs by show-casing a work-in-progress driver
+component based on the Linux 'etnaviv' DRM driver and using the also ported
+'etnaviv' Gallium driver.
+
+This driver component is now available in an updated fashion in the
+[https://github.com/skalk/genode-imx - genode-imx] repository that
+encapsulates support for the family of i.MX8 SoCs for Genode. In contrast to
+our first prototype, the driver now relies completely on the new DDE Linux
+approach and re-uses the existing 'lx_emul' and 'lx_kit' libraries. At the
+moment, the driver does not make use of a C-API to Genode services for
+accessing the GPU service like the other new DDE Linux drivers do but
+implements the session directly. We decided against prematurely introducing
+such an C-API while the GPU session itself is still in flux.
+
+[image glmark_mnt_reform]
+  Glmark running via the ported Vivante GPU driver on the MNT Reform laptop
+
+Briefly touching on the current implementation of the driver, we had to extend
+the 'lx_kit' API slightly to implement the buffer-object allocation. Also, we
+added a special-purpose interface called 'lx_drm' that comprises all Linux DRM
+I/O controls that need to be performed for implementing the GPU session and
+itself is a simple layer on top of 'drm_ioctl'.
+
+The 'lx_drm' functions are executed within the context of an emulated Linux
+kernel thread executed under a cooperative user-level scheduling scheme.
+However, since the GPU session is based on synchronous RPCs and we do not know
+in advance if a call into the ported driver code blocks at some point, we had
+to ensure the RPC returns not before the operation completed. The completion
+of operations may include several blocking states and concurrent event
+handling (e.g., hardware interrupts).
+
+For the time being, the driver component is still being worked on. We are, for
+example, investigating overall performance regressions. Nevertheless, the
+driver is functionally complete and currently supports one client at a time.
+
+In addition to the driver component, we cleaned up the existing 'etnaviv'
+libdrm back end and created a Sculpt pkg called *mesa_gpu-etnaviv* analogous
+to the pkgs for 'iris' and 'softpipe' back ends. The most visible change is
+the switch from the ad-hoc DRM session to the GPU session.
+
+All in all, we are now at a stage were we can work on optimizing the graphics
+stack on the Vivante GPU and are in particular looking forward to porting the
+next Linux driver. After all, by doing so, we can flesh out and maybe
+generalize the 'lx_drm' API so that for other drivers the porting effort gets
+reduced even further.
+
+
+VirtIO input and framebuffer drivers
+====================================
+
+_This section was co-authored by Piotr Tworek who created the_
+_VirtIO driver support. Thanks Piotr for the welcome contribution!_
+
+Over the
+[https://genode.org/documentation/release-notes/21.02#VirtIO_block_devices_for_virtual_machines_on_ARM - previous]
+[https://genode.org/documentation/release-notes/21.08#RAM_framebuffer_driver_for_Qemu - releases]
+of Genode this year, the framework received steadily improved driver support
+for virtual devices as supported by Qemu. The primary motivation behind this
+line of work is the use of virtual hardware as an experimentation ground for
+Genode on the AARCH64 and RISC-V architectures. The use of virtual hardware
+nicely side-steps the costs and (un-)availability of suitable devices, and
+avoids the extra effort that is usually involved when working with real
+hardware. The current release further advances the virtual-device support by
+the introduction of VirtIO input and graphics drivers.
+
+
+VirtIO input
+------------
+
+The new input driver can service Qemu VirtIO mouse, keyboard, and tablet
+devices. The implementation is based on the VirtIO 1.1 device specification,
+Section 5.8 "Input Device". The driver can service three separate device
+types, namely mouse, keyboard, and tablet. The main difference between mouse
+and tablet devices is that the former produces relative events whereas the
+latter produces absolute motion events.
+
+By default, the driver tries to attach to the first VirtIO input device of any
+of the listed types. Such behavior would pose a bit of a problem since in
+Genode, we'd like to know that a specific instance of the driver will attach
+only to a mouse for example. This way, we can define proper policies for it.
+To allow such behavior, the VirtIO input driver has one configuration key
+called 'match_product', which accepts the values of "mouse", "keyboard",
+"tablet", and "any" (default). Using this config key, one can accomplish
+exactly what is needed to tell the driver to only attach to a VirtIO input
+device if it's of "match_product" type.
+
+
+VirtIO framebuffer
+------------------
+
+The new VirtIO framebuffer driver implements the necessary bits to provide 2D
+framebuffer support on top of a VirtIO GPU device as provided by Qemu. Compared
+to the ramfb driver, which was introduced in Genode
+[https://genode.org/documentation/release-notes/21.08#RAM_framebuffer_driver_for_Qemu - 21.08],
+the VirtIO framebuffer driver has one major benefit: It allows the Qemu window
+to be dynamically resized at runtime. The driver will treat this as resolution
+change and act accordingly. In contrast to the VirtIO input driver, the
+framebuffer driver does not support any extra config options.
+
+
+Practical use
+-------------
+
+Thanks to the new drivers, the drivers_interactive package for the 'virt_qemu'
+board has become fully interactively usable. The drivers subsystem spawns two
+instances of virtio_input. One attaches to a keyboard device and the second to
+a mouse. This is what the default virt_qemu board exposes. At this time, the
+tablet device is not instantiated by default but it might become useful in the
+future for testing Genode's touch support.
+
+Make sure that Qemu exposes those new devices in the modern VirtIO 1.0 mode.
+Versions up to Qemu 5.1.0 still use pre-1.0 mode in the default setup.
+
+One thing to keep in mind is that the VirtIO framebuffer driver will change
+the resolution of the virtual display whenever the Qemu window is resized.
+This means that for high resolution screens, one might have to tweak the
+default RAM quota for the driver. The default should be enough for 1080p
+screens, but not much more than that.
+
+
+Linux device-driver environment
+===============================
+
+While working on Linux device-driver ports that use the new DDE Linux
+environment introduced in
+[https://genode.org/documentation/release-notes/21.08#Linux-device-driver_environment_re-imagined - release 21.08],
+we stumbled across some inaccuracies and missing pieces of the former
+implementation.
+For instance, kworker threads were blocked unconditionally before. But the
+original Linux kernel semantics includes corner-cases that delay kworker
+suspension. By adding them, we circumvent potential deadlocks. The cache
+maintenance operations got optimized by checking the read/write direction of
+the device with regard to DMA memory more accurately. Moreover, we had to
+learn that on ARM the minimal alignment for all allocations within Linux have
+to be of cache-line granularity.
+
+Feature-wise, a new API got introduced to access the pin-control service and
+IRQ sessions offered by it. This is useful when a Linux driver directly
+depends on GPIO settings respectively uses GPIO pins as interrupt source.
+
+
+Libraries and Applications
+##########################
+
+Feature completion of VirtualBox 6
+==================================
+
+With [https://genode.org/documentation/articles/sculpt-21-10 - Sculpt OS 21.10],
+we released VirtualBox version 6 as experimental alternative to the existing
+port of version 5. We also switched to version 6 as daily driver on our
+development machines at Genode Labs. These steps yielded the following
+improvements during the past Genode release cycle.
+
+The integration features shared folders, shared clipboard, and guest
+mouse-pointer shape were fully enabled. Most guest-integration modules in
+VirtualBox are implemented as shared libraries/objects, which are loaded at
+runtime on demand. Following our goal to keep changes to the upstream code
+minimal, our version of VirtualBox 6 now provides VBoxSharedClipboard and
+VBoxSharedFolders as dedicated libraries that must be integrated into the
+system as follows. Note, the libraries are accessed by the VirtualBox code as
+files before loading but must also be available as ROMs to our runtime dynamic
+linker.
+
+! <start name="virtualbox6">
+!   <config vbox_file="machine.vbox6">
+!     <vfs>
+!       <!-- original file names of shared objects -->
+!       <rom name="VBoxSharedClipboard.so"/>
+!       <rom name="VBoxSharedFolders.so"/>
+!     </vfs>
+!   </config>
+!   <route>
+!     <!-- map file names to Genode shared-object naming scheme -->
+!     <service name="ROM" label="VBoxSharedClipboard.so">
+!       <parent label="virtualbox6-sharedclipboard.lib.so"/> </service>
+!     <service name="ROM" label="VBoxSharedFolders.so">
+!       <parent label="virtualbox6-sharedfolders.lib.so"/> </service>
+!   </route>
+! </start>
+
+As depicted in the configuration snippet above, we use the file extension
+_.vbox6_ for VirtualBox 6 configuration files. The background is that there
+are some subtle incompatibilities in VirtualBox 6 with settings we used in
+version 5. For example, the version of the configuration file must be set to
+1.18+ for maximum compatibility of virtual-device configuration and guest
+operating systems. An example configuration is provided by the pkg/vbox6 depot
+archive and specifies the version like follows.
+
+! <VirtualBox xmlns="http://www.virtualbox.org/" version="1.18-genode">
+
+Unlike VirtualBox 5, the current version does not implement a custom Audio
+back end for Genode but uses the existing OSS back end of the original
+implementation. The feature can be enabled in .vbox and runtime configuration.
+We recommend using the HDA controller.
+
+! <AudioAdapter controller="HDA" driver="OSS" enabled="true" enabledOut="true" enabledIn="false"/>
+
+! <start name="virtualbox6">
+!   <config>
+!     <vfs>
+!       <dir name="dev"> <oss name="dsp"/> </dir>
+!     <vfs>
+!   </config>
+! </start>
+
+More device-related improvements are the reporting of mouse-wheel events, the
+support of up to 8 pass-through USB devices via the virtual XHCI USB3
+controller, and a ready-to-use Sculpt package to capture webcam streams in the
+VM (genodelabs/pkg/vbox6-capture).
+
+Finally, this release includes a whole lot of stability improvements to bring
+VirtualBox 6 on par with version 5 in daily use like robust machine state
+handling including the FPU, fixed corner cases in the AHCI model and
+Startup-IPI implementation as well as enhanced timeout and CPU wakeup
+handling.
+
+
+Sculpt OS for 64-bit ARM in addition to x86
+===========================================
+
+Up until now, the Genode-based [https://genode.org/download/sculpt - Sculpt OS]
+was primarily targeted at the 64-bit x86 architecture. However, since the
+hardware support of 64-bit ARM platforms like i.MX8 has reached almost feature
+parity with the PC platform, it was time to introduce the notion of CPU
+architectures to package index files.
+
+In Sculpt OS, software packages are provided in a federated way from any
+number of package providers. Each provider offers a so-called _index_ that
+enlists the available package versions blessed for a specific Sculpt OS
+release. See the release notes for Genode
+[https://genode.org/documentation/release-notes/19.02#Announcing_software_packages - 19.02]
+for more details.
+Starting with [https://genode.org/news/sculpt-os-release-21.10 - Sculpt OS 21.10]
+released in October, each index file features a declaration of the CPU
+architectures supported by the package provider.
+
+! <index>
+!   <supports arch="x86_64"/>
+!   <supports arch="arm_v8a"/>
+!  ...
+
+Sculpt uses this information to decide whether to display the index or not by
+comparing the architecture of the running machine with these declarations.
+Individual entries of an index file can be tagged as being specific for one
+architecture.
+
+! <pkg path="mesa_gpu-intel" info="Intel GPU driver (IRIS)" arch="x86_64"/>
+
+This annotation can also be specified for a sub index.
+
+! <index name="Virtual machines" arch="x86_64">
+!    ...
+! </index>
+
+Thanks to this approach, most packages - which are architecture-agnostic - can
+be offered for both x64_64 and arm_v8a with almost no manual work. In fact,
+starting with Sculpt 21.10, all default packages offered by Genode Labs are
+available for both architectures.
+
+
+Audio and OpenGL support for libSDL2
+====================================
+
+With this release, we extend the features of our SDL2 port by enabling audio
+support via the OSS back end and added basic support for using OpenGL.
+
+Re-using the existing OSS back end via our VFS OSS plugin is in contrast to
+how we enabled audio in our SDL1 port where we use Genode's audio-out
+session directly. Instead of having to add a Genode specific back end to each
+ported software, it is more reasonable to have just one implementation of a
+somewhat common interface for which the back end already exists.
+
+The OpenGL support, on the other hand, has not been thoroughly tested yet
+but works well enough for one or the other game. It still suffers from the
+same limitation as the normal video back end where resizing the window during
+runtime is not supported. This feature is yet to be implemented.
+
+Additionally, we made SDL2 now to use its existing pthread back ends,
+rather than using the generic fallback ones, as we deem the current pthread
+support in Genode sufficient.
+
+
+SSH terminal moved to Genode world repository
+=============================================
+
+The SSH terminal component now resides in the world repository. When we
+initially introduced this component, it complemented the existing TCP
+terminal. Rather than using plain TCP to access a terminal server the
+connection is secured by the SSH protocol.
+
+In the meantime the component itself incorporated more and more features
+that were not anticipated in the initial design. Since we have not used
+the component much ourselves lately, albeit some features are tested in our
+nightly CI, we decided to move it to the world repository.
+
+On a different note, the component now features new support for SFTP that
+enables one to access a Genode file system via SSH. Thanks to Tomasz Gajewski
+for this welcome contribution.
+
+
+Build system and tools
+######################
+
+Moving the platform-specific board support into extra repositories made it
+necessary to review the run tool with respect to virtualized platforms. For
+running Genode within Qemu, the run tool used to assemble the Qemu command
+line depending on the target board. In order to achieve a clean cut between
+the main repository hosting this part of the run tool and the
+platform-specific repositories, we came up with a way to specify the Qemu
+arguments outside the main repository.
+
+The solution follows along our approach of how we already specify the
+architecture and link address of a target board in distinct files within a
+board-property directory _board/<board_name>/_. Similarly, the board-specific
+Qemu arguments are now provided in a _board/<board_name>/qemu_args_ file. This
+file may contain one or multiple lines that will be appended to the command
+line generated by the run tool. Because it is required by virt_qemu, it is
+possible to restrict particular arguments to a certain spec, e.g. arm_v8a, by
+prefixing the line with 'arm_v8a:'. Note, that any '-m *' argument, which
+specifies the amount of RAM, provided within a _qemu_args_ file will override
+any memory setting provided in the run scripts.
+
+Moreover, the _qemu_args_ file is obliged with instantiating a network
+controller since this is also specific to the platform. For the zynq_qemu
+board, e.g., this is achieved by the following arguments:
+
+! -net nic,model=cadence_gem,netdev=net0 -netdev user,id=net0
+
+Always instantiating a network device removes the need to call
+'append_qemu_nic_args' in the run scripts. However, you can still use this
+function to add forwarding rules to the netdev with id _net0_.

doc/road_map.txt

@@ -7,99 +7,89 @@
 Herein, we lay out our plans for evolving Genode. Progress in addition to this
 planning will very much depend on the degree of community support the project
 will receive. The
-[https://genode.org/about/challenges - Challenges] page collects some of our ideas to
-advance Genode in various further directions.
+[https://genode.org/about/challenges - Challenges] page collects some of our
+ideas to advance Genode in various further directions.
 
 The road map is not fixed. If there is commercial interest of pushing the
 Genode technology to a certain direction, we are willing to revisit our plans.
 
 
-Review of 2020
+Review of 2021
 ##############
 
-The overarching theme of our road map for 2020 was "Dwarfing the barrier of
-entry", which expressed the ambition to reach a wider audience. On that
-account, we identified four promising directions: First, making Sculpt OS
-palatable for a wider circle. Second, fostering the public perception of the
-high quality of Genode to reinforce the confidence of people who are sceptical
-towards novel operating-system technology. Third, lowering the barrier of
-entry by providing frictionless tooling. And fourth, publicly presenting use
-cases that prove the fitness and flexibility of Genode. These directions
-certainly did a good job of motivating the working topics of last year's four
-releases
-[https://genode.org/documentation/release-notes/20.02 - 20.02],
-[https://genode.org/documentation/release-notes/20.05 - 20.05],
-[https://genode.org/documentation/release-notes/20.08 - 20.08], and
-[https://genode.org/documentation/release-notes/20.11 - 20.11].
+Genode's year 2021 was defined by three extremely challenging lines of work.
 
-The UI improvements of Sculpt OS in version 20.02 largely eliminated the need
-to use the command line as presented
-[https://www.youtube.com/watch?v=vmgWgzeKAjU - here].
-The second direction - software quality - motivated the steady improvements of
-our POSIX runtime, ultimately enabling highly sophisticated workloads like the
-Chromium web engine on Genode. Regarding our stated commitment to 64-bit ARM
-hardware, in particular supporting the NXP i.MX8 SoC, we covered 64-bit
-multi-core virtualization, HDMI, touch input, OLED, networking, LTE, USB,
-clock and power management, VirtIO, up to running Sculpt OS on this platform.
+First, we conquered the territory of GPU support that was ridden with
+uncertainties and seemed almost impenetrable when we started. But at the end
+of the year, our custom Intel-GPU multiplexer has landed in Sculpt OS like it
+always belonged there. In tandem with the Intel-GPU work, we explored the
+Vivante GPU as a representative of an ARM platform. The work required a deep
+dive into the respective GPU architectures and the Mesa software stack. It
+eventually led us to the design of Genode's device-agnostic GPU interfaces.
 
-Granted, Genode's audience hasn't increased by a large margin as a direct
-result of these efforts. But as illustrated by the fruitful road-map
-discussion for 2021 on the
-[https://genode.org/community/mailing-lists - mailing list],
-our community is more engaged and enthusiastic than ever before.
+The second line of work was concerned with the reuse of Linux drivers as
+Genode components. Over the year, the puzzle pieces of our new Linux
+device-driver environment come together, replacing former confusion and chaos
+with knowledge and order, ultimately uncovering the treasure of Linux drivers
+for Genode with very little friction. On the way, we created new methodology
+and tooling, as well as extensive documentation in the form of the "Genode
+Platforms" document. Thanks to the new drivers ported from the Linux kernel,
+we were able to witness interactive Genode scenarios becoming alive on the
+Pinephone by the end of the year.
+
+The third major topic was the growing sophistication of Genode-native
+workloads, with the media features of the Chromium-based browser on 64-bit ARM
+being the most impressive example. Apart from the apparent functional benefits
+for Genode and Sculpt OS, this is the long outstanding validation of some bold
+design decisions we took years ago, in particular the role and architecture of
+the VFS and its interplay with the libc.
+
+When reviewing the road map for 2021, some items remained uncovered. In
+particular the seL4-related topics became stale. At the end of 2020 - when we
+assembled the road map for the past year - there was a tangible prospect of
+pursuing this topic as funded work. However, those plans were repeatedly
+deferred and remained uncertain. Also, there are some items that have seen
+healthy doses of progress - like the topics related to Ada/SPARK or Goa - but
+received less attention than anticipated. On the other hand, the four releases
+([https://genode.org/documentation/release-notes/21.02 - 21.02],
+[https://genode.org/documentation/release-notes/21.05 - 21.05],
+[https://genode.org/documentation/release-notes/21.08 - 21.08],
+[https://genode.org/documentation/release-notes/21.11 - 21.11])
+of 2021 covered quite a few topics not advertised at the road
+map, e.g., webcam support, Xilinx Zynq, or RISC-V.
+
+It is fair to say that the level of technical risks we took in 2021 had been
+unprecedented in Genode's development history. We are more than proud of the
+outcome, which will hopefully propel Genode to new heights in 2022.
 
 
-2021 - Optimization and Platform diversity
-##########################################
+2022 - Mobile Usability
+#######################
 
-For the initial conquering of 64-bit ARM territory, restraining our focus to
-one particular SoC - namely NXP i.MX8 - was a healthy approach. Now it is the
-right time to optimize and to branch out the development to further
-platforms. The following key aspects of our road map for 2021 reflect that.
+After having enabled the first interactive Genode scenarios on the Pinephone
+last year, we plan to take Genode on the Pinephone to a level where we can
+routinely use it for advanced applications, in particular video chat. This
+vision confronts us with a multitude of hard technical nuts to crack such as
+power efficiency, UI latency, quality-of-service of audio processing, drivers
+for multi-media devices, WebRTC performance, and usability. This grand theme
+will not only address the Pinephone specifically. The efficiency gains will
+benefit all Genode use cases large and small.
 
-:Pinephone:
-  By the end of the year, we want be able to use Genode on the
-  [https://pine64.com/product-category/pinephone/ - Pinephone]
-  as a feature phone, covering basic web-browsing needs, placing calls, and
-  SMS.
+Our theme of the Genode-based video chat on the Pinephone fuels several
+ambitions in closely related areas. In particular, we aspire using WireGuard
+to secure private communication, and experiment with the operation of
+hardware-based trust anchors as the basis for encrypted storage and
+communication.
 
-:Linux-device-driver environment re-imagined:
-  We are convinced that we have to dramatically reduce the engineering
-  effort needed to port device drivers from the Linux kernel to Genode. With
-  many years of driver-porting experience under our belts, we plan to condense
-  the lessons learned in the form of new tooling and documentation. This, in
-  turn, will hopefully pave the ground for more and more developers
-  contributing to Genode's device-driver coverage in the future.
-
-:Developer experience:
-  Speaking of new developers, we see Genode's existing tool set as a barrier
-  because it requires a rather steep learning curve. Hence, this year, we will
-  have a fresh take on tooling and workflows. The starting point will be the
-  experimental [https://github.com/nfeske/goa - Goa] tool, which in principle
-  allows developers to use familiar build systems for Genode development. We
-  plan to extend Goa to cover more build systems, and shape the tool towards
-  system-integration tasks and quick compile-test cycles targeting embedded
-  devices.
-
-:Optimization:
-  Motivated by usage scenarios like the Pinephone, we are eager to tap into
-  plenty of opportunities for optimization. Based on data gathered by improved
-  system tracing, we consider interface refinements to improve the batching of
-  I/O (file-system access, networking), micro-optimizations of hot code paths
-  (like TLS lookup, parsers, and allocators), as well as structural changes
-  (like the consolidation of low-level services).
-
-:GPU support:
-  Distantly related to optimization, GPU support is an increasingly requested
-  feature. We already
-  [https://genode.org/documentation/release-notes/17.08#Hardware-accelerated_graphics_for_Intel_Gen-8_GPUs - wetted our toes]
-  in the past. But GPU support has not yet become routinely supported in
-  system scenarios like Sculpt OS. In 2021, we want to change that, making GPU
-  support a feature that can be relied on. We will primarily address Intel
-  graphics first but also explore GPUs on ARM-based devices.
+Besides the Pinephone, we will steadily nurture the quality and scope of
+driver support on PC hardware, which remains the primary platform for the
+day-to-day use of Sculpt OS. So you can expect us to keep up with recent
+generations of Intel-based hardware. In this area, we plan to make IOMMU
+support available with kernels beyond NOVA, and explore the use of
+power-management features like suspend-resume with Sculpt OS.
 
 
-Milestones for 2021
+Milestones for 2022
 ###################
 
 In the following, we present a rough schedule of the planned work. As usual,
@@ -107,65 +97,45 @@ it is not set in stone. If you are interested in a particular line of work,
 please get in touch.
 
 
-February - Release 21.02
+February - Release 22.02
 ========================
 
-* Pluggable device drivers (NIC, WLAN, framebuffer, input)
-* VirtualBox 6
-* Sculpt: basic UI for the consistent block encrypter (CBE)
-* 64-bit ARM
-  * VirtIO block-device support for virtual machines
-  * Base platform support for the Pine A64 board (kernel base framework)
+* OpenGL in VirtualBox 6
+* Sculpt OS as tool kit for special-purpose OS images
+* Pinephone
+  * Modem access
+  * Touch-screen compatibility of Sculpt OS
 
 
-May - Release 21.05
+May - Release 22.05
 ===================
 
-* Annual documentation update, including the "Genode Foundations" book
-* GPU support
-  * MESA update
-  * Experiments on ARM (e.g., Vivante on i.MX8, or Mali-400 on A64)
-* Sculpt OS on Pine A64 (USB, input, framebuffer, SD-card, networking)
-* 64-bit ARM
-  * Platform-driver consolidation between ARM and x86
-  * PCI-express support for MNT Reform (i.MX8)
-* Tool-chain update (e.g., switching to hard-float on ARM)
-* Modernized client-side NIC and uplink APIs
-* Goa
-  * Broadened architecture support and testing workflow
-  * API projects
-  * Inter-project dependencies
+* Annual update of the "Genode Foundations" book
+* Second edition of the "Genode Platforms" documentation
+* WireGuard VPN
+* Updated drivers for PC hardware (Wifi, Intel framebuffer, USB)
+* New tracing tool with support for CTF and PCAP
+* Pinephone telephony
 
 
-August - Release 21.08
+August - Release 22.08
 ======================
 
-* Linux DDE re-imagined
-  * Improved tooling
-  * Exploring Goa-based development workflow
-* GPU support
-  * GPU multiplexer for Intel Gen9 graphics
-  * Harmonization of GPU driver with Intel framebuffer driver
-* Initial version of a custom kernel (Spunky) implemented in Ada/SPARK
-* System-level tracing infrastructure for guiding and validating optimizations
 * Pinephone
-  * Touchscreen and display
-  * Mobile web browser
-* Goa
-  * CMake-based Qt5 applications
-  * QML-based applications
+  * Morph browser
+  * Media record and playback capabilities
+* FPGA-powered DMA protection for the Zynq-7000 SoC
+* Kernel-agnostic IOMMU support for PC hardware
+* Optimized GUI latency and synchronization
 
 
-November - Release 21.11
+November - Release 22.11
 ========================
 
 * Pinephone
-  * Mobile data connectivity (LTE)
-  * Phone calls (audio)
-  * SMS
-* seL4
-  * Update to current kernel version, MCS scheduling
-  * Combining CAmkES with Genode
-* SMMU (I/O-MMU for ARM) support for our custom (base-hw) kernel
-* Multi-monitor support
+  * WebRTC-based video chat
+  * Power management
+* Base mechanism for suspend-resume on PC hardware
+* Support for hardware-based trust anchor for CBE and WireGuard
+* Software-hardware co-design example for the Zynq-7000 SoC
 

repos/README

@@ -103,6 +103,10 @@ but build upon of each other:
   The repository contains a server that uses a rump kernel to provide
   various NetBSD file systems to Genode.
 
+:'pc':
+  This source-code repository hosts device drivers that are specific for PC
+  platforms. It depends on the 'dde_linux' repository.
+
 :'ports':
 
   This source-code repository hosts ports of 3rd-party applications to

repos/base-fiasco/lib/mk/kernel-fiasco.inc

@@ -6,22 +6,22 @@ FIASCO_SRC       = $(L4_SRC_DIR)/kernel/fiasco
 
 KERNEL_BUILD_OUTPUT_FILTER = 2>&1 | sed "s/^/      [fiasco]  /"
 
+KERNEL_CXXFLAGS = -std=gnu++98 -fno-delete-null-pointer-checks $(CXXWARN) \
+                  -Wno-address-of-packed-member
+
 $(FIASCO_BUILD_DIR):
-	$(VERBOSE_MK) set -o pipefail; \
-	              MAKEFLAGS= $(MAKE) SYSTEM_TARGET="$(CROSS_DEV_PREFIX)" \
+	$(VERBOSE_MK) MAKEFLAGS= $(MAKE) SYSTEM_TARGET="$(CROSS_DEV_PREFIX)" \
 	                                 $(VERBOSE_DIR) -C $(FIASCO_SRC) BUILDDIR=$@ \
 	                                 $(KERNEL_BUILD_OUTPUT_FILTER)
 	$(VERBOSE)cp $(KERNEL_CONFIG) $@/globalconfig.out
-	$(VERBOSE_MK) set -o pipefail; \
-	              MAKEFLAGS= $(MAKE) SYSTEM_TARGET="$(CROSS_DEV_PREFIX)" \
+	$(VERBOSE_MK) MAKEFLAGS= $(MAKE) SYSTEM_TARGET="$(CROSS_DEV_PREFIX)" \
 	                                 $(VERBOSE_DIR) -C $@ oldconfig \
 	                                 $(KERNEL_BUILD_OUTPUT_FILTER)
 	$(VERBOSE)cp $(KERNEL_CONFIG) $@/globalconfig.out
 
 $(FIASCO): $(FIASCO_BUILD_DIR)
-	$(VERBOSE_MK) set -o pipefail; \
-	              MAKEFLAGS= CFLAGS="-std=gnu89 $(CWARN)" \
-	              CXXFLAGS="-std=gnu++98 -fno-delete-null-pointer-checks $(CXXWARN)" \
+	$(VERBOSE_MK) MAKEFLAGS= CFLAGS="-std=gnu89 $(CWARN)" \
+	              CXXFLAGS="$(KERNEL_CXXFLAGS)" \
 	              $(MAKE) SYSTEM_TARGET="$(CROSS_DEV_PREFIX)" \
 	                                 $(VERBOSE_DIR) -C $(FIASCO_BUILD_DIR) \
 	                                 $(KERNEL_BUILD_OUTPUT_FILTER)

repos/base-fiasco/lib/mk/l4_pkg.inc

@@ -33,6 +33,9 @@ ifeq ($(VERBOSE),)
 L4_VERBOSE = V=1
 endif
 
+# do not confuse third-party sub-makes
+unexport .SHELLFLAGS
+
 #
 # Execute the rules in this file only at the second build stage when we know
 # about the complete build settings, e.g., 'CROSS_DEV_PREFIX'.
@@ -61,8 +64,7 @@ CXXWARN = $(WARN) -Wno-bool-compare -Wno-c++11-compat -Wno-class-memaccess
 # 'off64_t' type, which is used by bootstrap.
 #
 %.tag:
-	$(VERBOSE_MK) set -o pipefail; \
-	              MAKEFLAGS= CPPFLAGS="$(CC_MARCH)" \
+	$(VERBOSE_MK) MAKEFLAGS= CPPFLAGS="$(CC_MARCH)" \
 	              CFLAGS="$(CC_MARCH) -std=gnu89 $(CWARN)" \
 	              CXXFLAGS="$(CC_MARCH) -D_GNU_SOURCE -std=gnu++98 $(CXXWARN)" \
 	              ASFLAGS="$(CC_MARCH)" LDFLAGS="$(LD_MARCH)" \

repos/base-fiasco/lib/mk/syscall-fiasco.inc

@@ -15,7 +15,7 @@ L4_BUILD_DIR := $(shell pwd)
 .Makeconf.bid.old:
 	$(VERBOSE)mkdir -p $(dir $@)
 	$(VERBOSE)cp $(L4_CONFIG) $(@:.old=)
-	$(VERBOSE_MK) set -o pipefail; \
+	$(VERBOSE_MK) \
 	   MAKEFLAGS= make $(VERBOSE_DIR) -C $(L4_SRC_DIR)/l4 \
 	   O=$(L4_BUILD_DIR) SYSTEM_TARGET="$(CROSS_DEV_PREFIX)" oldconfig \
 	   2>&1 | sed "s/^/      [l4build]  /"

repos/base-fiasco/recipes/src/base-fiasco/hash

@@ -1 +1 @@
-2021-10-13 05c76f8a5e76e0cc76fd7336c7cf63836ecec35d
+2022-04-12 515112b4fff8f569ab6194cabbde0dc8e8446c82

repos/base-fiasco/src/core/include/platform_pd.h

@@ -46,6 +46,7 @@ class Genode::Platform_pd : public Address_space
 
 		enum {
 			VERSION_BITS   = 10,
+			VERSION_MASK   = (1 << VERSION_BITS) - 1,
 			PD_FIRST       = 0x10,
 			PD_MAX         = (1 << 11) - 1, /* leave 0x7ff free for L4_INVALID_ID */
 			PD_VERSION_MAX = (1 << 10) - 1,
@@ -101,7 +102,7 @@ class Genode::Platform_pd : public Address_space
 			unsigned version  : VERSION_BITS;
 
 			Pd_alloc(bool r, bool f, unsigned v)
-			: reserved(r), free(f), version(v) { }
+			: reserved(r), free(f), version(v & VERSION_MASK) { }
 
 			Pd_alloc() : reserved(0), free(0), version(0) { }
 		};

repos/base-fiasco/src/core/io_mem_session_support.cc

@@ -38,61 +38,67 @@ static inline bool can_use_super_page(addr_t, size_t)
 }
 
 
-addr_t Io_mem_session_component::_map_local(addr_t base, size_t size)
+addr_t Io_mem_session_component::_map_local(addr_t phys_base, size_t size)
 {
-	using namespace Fiasco;
+	auto map_io_region = [] (addr_t phys_base, addr_t local_base, size_t size)
+	{
+		using namespace Fiasco;
+
+		l4_threadid_t const sigma0 = sigma0_threadid;
+
+		unsigned offset = 0;
+		while (size) {
+
+			/*
+			 * Call sigma0 for I/O region
+			 */
+
+			/* special case for page0, which is RAM in sigma0/x86 */
+			l4_umword_t const request = (phys_base + offset == 0)
+			                          ? SIGMA0_REQ_FPAGE_RAM
+			                          : SIGMA0_REQ_FPAGE_IOMEM;
+
+			size_t const size_log2 = can_use_super_page(phys_base + offset, size)
+			                       ? get_super_page_size_log2()
+			                       : get_page_size_log2();
+
+			l4_umword_t  dw0 = 0, dw1 = 0;
+			l4_msgdope_t result { };
+			l4_msgtag_t  tag    { };
+
+			int const err =
+				l4_ipc_call_tag(sigma0,
+				                L4_IPC_SHORT_MSG,
+				                request,
+				                l4_fpage(phys_base + offset, size_log2, 0, 0).fpage,
+				                l4_msgtag(L4_MSGTAG_SIGMA0, 0, 0, 0),
+				                L4_IPC_MAPMSG(local_base + offset, size_log2),
+				                               &dw0, &dw1,
+				                L4_IPC_NEVER, &result, &tag);
+
+			if (err || !l4_ipc_fpage_received(result)) {
+				error("map_local failed err=", err, " "
+				      "(", l4_ipc_fpage_received(result), ")");
+				return;
+			}
+
+			offset += 1 << size_log2;
+			size   -= 1 << size_log2;
+		}
+	};
 
 	/* align large I/O dataspaces on a super-page boundary within core */
-	size_t alignment = (size >= get_super_page_size()) ? get_super_page_size_log2()
-	                                                   : get_page_size_log2();
+	size_t align = (size >= get_super_page_size()) ? get_super_page_size_log2()
+	                                               : get_page_size_log2();
 
-	/* find appropriate region for mapping */
-	void *local_base = 0;
-	if (platform().region_alloc().alloc_aligned(size, &local_base, alignment).error())
-		return 0;
+	return platform().region_alloc().alloc_aligned(size, align).convert<addr_t>(
 
-	/* call sigma0 for I/O region */
-	int err;
-	l4_umword_t request;
-	l4_umword_t dw0, dw1;
-	l4_msgdope_t result;
-	l4_msgtag_t tag;
+		[&] (void *ptr) {
+			addr_t const core_local_base = (addr_t)ptr;
+			map_io_region(phys_base, core_local_base, size);
+			return core_local_base; },
 
-	l4_threadid_t sigma0 = sigma0_threadid;
-
-	unsigned offset = 0;
-	while (size) {
-		/* FIXME what about caching demands? */
-		/* FIXME what about read / write? */
-
-		/* special case for page0, which is RAM in sigma0/x86 */
-		if (base + offset == 0)
-			request = SIGMA0_REQ_FPAGE_RAM;
-		else
-			request = SIGMA0_REQ_FPAGE_IOMEM;
-
-		size_t page_size_log2 = get_page_size_log2();
-		if (can_use_super_page(base + offset, size))
-			page_size_log2 = get_super_page_size_log2();
-
-		err = l4_ipc_call_tag(sigma0,
-		                      L4_IPC_SHORT_MSG,
-		                        request,
-		                        l4_fpage(base + offset, page_size_log2, 0, 0).fpage,
-		                      l4_msgtag(L4_MSGTAG_SIGMA0, 0, 0, 0),
-		                      L4_IPC_MAPMSG((addr_t)local_base + offset, page_size_log2),
-		                        &dw0, &dw1,
-		                      L4_IPC_NEVER, &result, &tag);
-
-		if (err || !l4_ipc_fpage_received(result)) {
-			error("map_local failed err=", err, " "
-			      "(", l4_ipc_fpage_received(result), ")");
-			return 0;
-		}
-
-		offset += 1 << page_size_log2;
-		size   -= 1 << page_size_log2;
-	}
-
-	return (addr_t)local_base;
+		[&] (Range_allocator::Alloc_error) -> addr_t {
+			error("core-local mapping of memory-mapped I/O range failed");
+			return 0; });
 }

repos/base-fiasco/src/core/irq_session_component.cc

@@ -130,7 +130,7 @@ Irq_session_component::Irq_session_component(Range_allocator &irq_alloc,
 	if (msi)
 		throw Service_denied();
 
-	if (irq_alloc.alloc_addr(1, _irq_number).error()) {
+	if (irq_alloc.alloc_addr(1, _irq_number).failed()) {
 		error("unavailable IRQ ", _irq_number, " requested");
 		throw Service_denied();
 	}

repos/base-fiasco/src/core/platform.cc

@@ -445,51 +445,42 @@ Platform::Platform()
 	fiasco_register_thread_name(core_thread.native_thread_id(),
 	                            core_thread.name().string());
 
-	/* core log as ROM module */
+	auto export_page_as_rom_module = [&] (auto rom_name, auto content_fn)
 	{
-		void * phys_ptr       = nullptr;
-		unsigned const pages  = 1;
-		size_t const log_size = pages << get_page_size_log2();
+		size_t const size = 1 << get_page_size_log2();
+		ram_alloc().alloc_aligned(size, get_page_size_log2()).with_result(
 
-		ram_alloc().alloc_aligned(log_size, &phys_ptr, get_page_size_log2());
-		addr_t const phys_addr = reinterpret_cast<addr_t>(phys_ptr);
+			[&] (void *phys_ptr) {
 
-		void * const core_local_ptr  = phys_ptr;
-		addr_t const core_local_addr = phys_addr;
+				/* core-local memory is one-to-one mapped physical RAM */
+				addr_t const phys_addr = reinterpret_cast<addr_t>(phys_ptr);
+				void * const core_local_ptr = phys_ptr;
 
-		/* let one page free after the log buffer */
-		region_alloc().remove_range(core_local_addr, log_size + get_page_size());
+				region_alloc().remove_range((addr_t)core_local_ptr, size);
+				memset(core_local_ptr, 0, size);
+				content_fn(core_local_ptr, size);
 
-		memset(core_local_ptr, 0, log_size);
+				_rom_fs.insert(new (core_mem_alloc())
+				               Rom_module(phys_addr, size, rom_name));
+			},
+			[&] (Range_allocator::Alloc_error) {
+				warning("failed to export ", rom_name, " as ROM module"); }
+		);
+	};
 
-		_rom_fs.insert(new (core_mem_alloc()) Rom_module(phys_addr, log_size,
-		                                                 "core_log"));
-
-		init_core_log(Core_log_range { core_local_addr, log_size } );
-	}
+	/* core log as ROM module */
+	export_page_as_rom_module("core_log",
+		[&] (void *core_local_ptr, size_t size) {
+			init_core_log(Core_log_range { (addr_t)core_local_ptr, size } ); });
 
 	/* export platform specific infos */
-	{
-		void * phys_ptr    = nullptr;
-		size_t const size  = 1 << get_page_size_log2();
-
-		if (ram_alloc().alloc_aligned(size, &phys_ptr,
-			                          get_page_size_log2()).ok()) {
-			addr_t const phys_addr = reinterpret_cast<addr_t>(phys_ptr);
-			addr_t const core_local_addr = phys_addr;
-
-			region_alloc().remove_range(core_local_addr, size);
-
-			Genode::Xml_generator xml(reinterpret_cast<char *>(core_local_addr),
-			                          size, "platform_info", [&] ()
-			{
-				xml.node("kernel", [&] () { xml.attribute("name", "fiasco"); });
-			});
-
-			_rom_fs.insert(new (core_mem_alloc()) Rom_module(phys_addr, size,
-			                                                 "platform_info"));
-		}
-	}
+	export_page_as_rom_module("platform_info",
+		[&] (void *core_local_ptr, size_t size) {
+			Xml_generator xml(reinterpret_cast<char *>(core_local_ptr),
+			                  size, "platform_info",
+				[&] () {
+					xml.node("kernel", [&] () {
+						xml.attribute("name", "fiasco"); }); }); });
 }
 
 

repos/base-fiasco/src/core/platform_pd.cc

@@ -58,10 +58,13 @@ void Platform_pd::init()
 
 void Platform_pd::_create_pd(bool syscall)
 {
+	enum { TASK_ID_MASK     = (1 << 11) - 1,
+	       VERSION_LOW_MASK = (1 << 10) - 1 };
+
 	l4_threadid_t l4t  = l4_myself();
-	l4t.id.task        = _pd_id;
+	l4t.id.task        = _pd_id & TASK_ID_MASK;
 	l4t.id.lthread     = 0;
-	l4t.id.version_low = _version;
+	l4t.id.version_low = _version & VERSION_LOW_MASK;
 
 	l4_taskid_t nt;
 	if (syscall)
@@ -203,8 +206,10 @@ bool Platform_pd::bind_thread(Platform_thread &thread)
 	}
 	thread_id = t;
 
+	enum { LTHREAD_MASK = (1 << 7) - 1 };
+
 	l4_thread_id = _l4_task_id;
-	l4_thread_id.id.lthread = thread_id;
+	l4_thread_id.id.lthread = thread_id & LTHREAD_MASK;
 
 	/* finally inform thread about binding */
 	thread.bind(thread_id, l4_thread_id, *this);

repos/base-fiasco/src/include/fiasco/syscall.h

@@ -15,6 +15,10 @@
 #define _INCLUDE__FIASCO__SYSCALL_H_
 
 namespace Fiasco {
+
+#pragma GCC diagnostic push
+#pragma GCC diagnostic ignored "-Wconversion"
+
 #include <l4/sys/types.h>
 #include <l4/sys/kdebug.h>
 #include <l4/sys/ipc.h>
@@ -24,6 +28,8 @@ namespace Fiasco {
 #include <l4/sys/ktrace.h>
 #include <l4/sys/syscalls.h>
 #include <l4/sigma0/sigma0.h>
+
+#pragma GCC diagnostic pop  /* restore -Wconversion warnings */
 }
 
 #endif /* _INCLUDE__FIASCO__SYSCALL_H_ */

repos/base-fiasco/src/lib/base/ipc.cc

@@ -32,9 +32,9 @@ class Msg_header
 	private:
 
 		/* kernel-defined message header */
-		l4_fpage_t   rcv_fpage; /* unused */
-		l4_msgdope_t size_dope;
-		l4_msgdope_t send_dope;
+		l4_fpage_t   _rcv_fpage; /* unused */
+		l4_msgdope_t _size_dope;
+		l4_msgdope_t _send_dope;
 
 	public:
 
@@ -52,6 +52,8 @@ class Msg_header
 
 		enum { MAX_CAPS_PER_MSG = Msgbuf_base::MAX_CAPS_PER_MSG };
 
+		enum { SIZE_DOPE_MASK = 0x3ffff };
+
 		l4_threadid_t _cap_tid        [MAX_CAPS_PER_MSG];
 		unsigned long _cap_local_name [MAX_CAPS_PER_MSG];
 
@@ -68,7 +70,7 @@ class Msg_header
 
 	public:
 
-		void *msg_start() { return &rcv_fpage; }
+		void *msg_start() { return &_rcv_fpage; }
 
 		/**
 		 * Load header fields according to send-message buffer
@@ -79,7 +81,8 @@ class Msg_header
 			num_caps = min((unsigned)MAX_CAPS_PER_MSG, snd_msg.used_caps());
 
 			size_t const snd_words = snd_msg.data_size()/sizeof(l4_umword_t);
-			send_dope = L4_IPC_DOPE(_num_msg_words(snd_words), 0);
+
+			_send_dope = L4_IPC_DOPE(_num_msg_words(snd_words) & SIZE_DOPE_MASK, 0);
 
 			/* reset _cap_tid and _cap_local_name */
 			for (unsigned i = 0; i < MAX_CAPS_PER_MSG; i++) {
@@ -107,7 +110,7 @@ class Msg_header
 		{
 			size_t const rcv_max_words = rcv_msg.capacity()/sizeof(l4_umword_t);
 
-			size_dope = L4_IPC_DOPE(_num_msg_words(rcv_max_words), 0);
+			_size_dope = L4_IPC_DOPE(_num_msg_words(rcv_max_words) & SIZE_DOPE_MASK, 0);
 		}
 
 		/**
@@ -234,11 +237,8 @@ Genode::Rpc_request Genode::ipc_reply_wait(Reply_capability const &last_caller,
 		 * error condition to the user but want to wait for the next proper
 		 * incoming message.
 		 */
-		if (L4_IPC_IS_ERROR(ipc_result)) {
-			error("ipc_reply_and_wait error ", Hex(L4_IPC_ERROR(ipc_result)));
-		} else {
+		if (!L4_IPC_IS_ERROR(ipc_result))
 			need_to_wait = false;
-		}
 	}
 
 	while (need_to_wait) {

repos/base-fiasco/src/lib/base/thread_bootstrap.cc

@@ -25,8 +25,7 @@ using namespace Genode;
  ** Startup library support **
  *****************************/
 
-void prepare_init_main_thread()   { }
-void prepare_reinit_main_thread() { }
+void prepare_init_main_thread() { }
 
 
 /************

repos/base-foc/include/foc/syscall.h

@@ -14,6 +14,9 @@
 #ifndef _INCLUDE__FOC__SYSCALL_H_
 #define _INCLUDE__FOC__SYSCALL_H_
 
+#pragma GCC diagnostic push
+#pragma GCC diagnostic ignored "-Wconversion"
+
 namespace Foc {
 #include <l4/sys/types.h>
 #include <l4/sys/kip>
@@ -33,4 +36,6 @@ namespace Foc {
 #include <l4/sigma0/sigma0.h>
 }
 
+#pragma GCC diagnostic pop  /* restore -Wconversion warnings */
+
 #endif /* _INCLUDE__FOC__SYSCALL_H_ */

repos/base-foc/include/foc/thread_state.h

@@ -26,7 +26,7 @@ namespace Genode { struct Foc_thread_state; }
 struct Genode::Foc_thread_state : Thread_state
 {
 	Foc::l4_cap_idx_t  kcap;         /* thread's gate cap in its PD */
-	int                id;           /* ID of gate capability */
+	uint16_t           id;           /* ID of gate capability */
 	addr_t             utcb;         /* thread's UTCB in its PD */
 
 	/**

repos/base-foc/lib/mk/kernel-foc.inc

@@ -8,15 +8,13 @@ MAKEOVERRIDES := $(filter-out KERNEL=%,$(MAKEOVERRIDES))
 unexport KERNEL
 
 $(FOC_BUILD_DIR):
-	$(VERBOSE_MK) set -o pipefail; \
-	              $(MAKE) CROSS_COMPILE="$(CROSS_DEV_PREFIX)" \
+	$(VERBOSE_MK) $(MAKE) CROSS_COMPILE="$(CROSS_DEV_PREFIX)" \
 	                      $(VERBOSE_DIR) -C $(FOC_SRC) BUILDDIR=$@ \
 	                      $(KERNEL_BUILD_OUTPUT_FILTER)
 	$(VERBOSE)cp $(KERNEL_CONFIG) $@/globalconfig.out
 
 $(FOC): $(FOC_BUILD_DIR)
-	$(VERBOSE_MK) set -o pipefail; \
-	              $(MAKE) CROSS_COMPILE="$(CROSS_DEV_PREFIX)" \
+	$(VERBOSE_MK) $(MAKE) CROSS_COMPILE="$(CROSS_DEV_PREFIX)" \
 	                      CC="$(CC)" CXX="$(CXX)" \
 	                      $(VERBOSE_DIR) -C $(FOC_BUILD_DIR) \
 	                      $(KERNEL_BUILD_OUTPUT_FILTER)

repos/base-foc/lib/mk/l4_pkg.inc

@@ -39,6 +39,9 @@ PKG_TAGS     = $(addsuffix .tag,$(addsuffix .$(BOARD),$(PKGS)))
 
 BUILD_OUTPUT_FILTER = 2>&1 | sed "s~^~      [$*]  ~"
 
+# do not confuse third-party sub-makes
+unexport .SHELLFLAGS
+
 #
 # Execute the rules in this file only at the second build stage when we know
 # about the complete build settings, e.g., 'CROSS_DEV_PREFIX'.
@@ -55,8 +58,7 @@ endif
 .NOTPARALLEL: $(PKG_TAGS)
 
 %.$(BOARD).tag:
-	$(VERBOSE_MK) set -o pipefail; \
-	              $(MAKE) $(VERBOSE_DIR) O=$(L4_BUILD_DIR) -C $(L4_PKG_DIR)/$* \
+	$(VERBOSE_MK) $(MAKE) $(VERBOSE_DIR) O=$(L4_BUILD_DIR) -C $(L4_PKG_DIR)/$* \
 	                      "$(L4_BUILD_OPT)" WARNINGS=$(WARNINGS) $(BUILD_OUTPUT_FILTER)
 	$(VERBOSE)mkdir -p $(dir $@) && touch $@
 

repos/base-foc/lib/mk/syscall-foc.inc

@@ -37,7 +37,7 @@ CC_OPT += -DL4SYS_USE_UTCB_WRAP=1 -Wno-unused-function
 # build system will stuble over predefined variables, i.e., 'LIB'
 #
 $(L4_BUILD_DIR)/.kconfig:
-	$(VERBOSE_MK) set -o pipefail; \
+	$(VERBOSE_MK) \
 	     MAKEFLAGS= $(MAKE) $(VERBOSE_DIR) -C $(L4_SRC_DIR)/l4 \
 	     B=$(L4_BUILD_DIR) DROPSCONF_DEFCONFIG="$(L4_CONFIG)" \
 	     VERBOSE="$(VERBOSE)" CROSS_COMPILE="$(CROSS_DEV_PREFIX)" \

repos/base-foc/recipes/src/base-foc-imx6q_sabrelite/hash

@@ -1 +1 @@
-2021-10-13 0e3f2b9302333cb9bcabfb933a0ab142f41d070c
+2022-04-12 b1e43bda46dcc2e180649bed9990230bbc6f5eb3

repos/base-foc/recipes/src/base-foc-imx7d_sabre/hash

@@ -1 +1 @@
-2021-10-13 af7ceb5c77e20a66ed9f394526766b31a205d89d
+2022-04-12 587953d4a135f958b156bf9ec31adfbc2c84881a

repos/base-foc/recipes/src/base-foc-pbxa9/hash

@@ -1 +1 @@
-2021-10-13 62af5bc4ad5747f1552f1c03882f756ec7f1d63c
+2022-04-12 99c54bf391d7e438022b70b39ba175ee13a831f8

repos/base-foc/recipes/src/base-foc-pc/hash

@@ -1 +1 @@
-2021-10-13 6bd8c055af6f1031539124d93164d0ae24f956c8
+2022-04-12 4fe361144ecfe216246e5ba199f578c69ebbec57

repos/base-foc/recipes/src/base-foc-rpi3/hash

@@ -1 +1 @@
-2021-10-13 dabb150f6be49ee72d2d5db160e8885ac7faddd0
+2022-04-12 b920fe281256f366f1565444ba07bc136897ba06

repos/base-foc/src/core/include/cap_id_alloc.h

@@ -25,6 +25,12 @@ namespace Genode { class Cap_id_allocator; }
 
 class Genode::Cap_id_allocator
 {
+	public:
+
+		using id_t = uint16_t;
+
+		enum { ID_MASK = 0xffff };
+
 	private:
 
 		enum {
@@ -44,8 +50,8 @@ class Genode::Cap_id_allocator
 
 		Cap_id_allocator(Allocator &);
 
-		unsigned long alloc();
-		void free(unsigned long id);
+		id_t alloc();
+		void free(id_t id);
 };
 
 #endif /* _CORE__INCLUDE__CAP_ID_ALLOC_H_ */

repos/base-foc/src/core/include/irq_object.h

@@ -38,7 +38,7 @@ class Genode::Irq_object
 		Irq_session::Polarity  _polarity; /* interrupt polarity */
 
 		unsigned               _irq;
-		addr_t                 _msi_addr;
+		uint64_t               _msi_addr;
 		addr_t                 _msi_data;
 
 		Signal_context_capability _sig_cap { };
@@ -53,8 +53,8 @@ class Genode::Irq_object
 		Irq_session::Trigger  trigger()  const { return _trigger; }
 		Irq_session::Polarity polarity() const { return _polarity; }
 
-		Genode::addr_t msi_address() const { return _msi_addr; }
-		Genode::addr_t msi_value()   const { return _msi_data; }
+		uint64_t msi_address() const { return _msi_addr; }
+		addr_t   msi_value()   const { return _msi_data; }
 
 		void sigh(Genode::Signal_context_capability cap) { _sig_cap = cap; }
 		void notify() { Genode::Signal_transmitter(_sig_cap).submit(1); }

repos/base-foc/src/core/include/map_local.h

@@ -45,7 +45,7 @@ namespace Genode {
 			using namespace Foc;
 
 			l4_fpage_t snd_fpage = l4_fpage(from_addr + offset,
-			                                page_size_log2, L4_FPAGE_RW);
+			                                (unsigned)page_size_log2, L4_FPAGE_RW);
 
 			if (l4_msgtag_has_error(l4_task_map(L4_BASE_TASK_CAP,
 			                                    L4_BASE_TASK_CAP,
@@ -95,13 +95,13 @@ namespace Genode {
 			if (can_use_super_page(from_addr + offset, size))
 				page_size_log2 = get_super_page_size_log2();
 			l4_utcb_mr()->mr[1] = l4_fpage(from_addr + offset,
-			                               page_size_log2, L4_FPAGE_RWX).raw;
+			                               (unsigned)page_size_log2, L4_FPAGE_RWX).raw;
 
 			/* open receive window for mapping */
 			l4_utcb_br()->bdr   = 0;
 			l4_utcb_br()->br[0] = L4_ITEM_MAP;
 			l4_utcb_br()->br[1] = l4_fpage((addr_t)to_addr + offset,
-			                               page_size_log2, L4_FPAGE_RWX).raw;
+			                               (unsigned)page_size_log2, L4_FPAGE_RWX).raw;
 
 			l4_msgtag_t tag = l4_msgtag(L4_PROTO_SIGMA0, 2, 0, 0);
 			tag = l4_ipc_call(L4_BASE_PAGER_CAP, l4_utcb(), tag, L4_IPC_NEVER);

repos/base-foc/src/core/io_mem_session_support.cc

@@ -34,14 +34,18 @@ addr_t Io_mem_session_component::_map_local(addr_t base, size_t size)
 	                                                   : get_page_size_log2();
 
 	/* find appropriate region for mapping */
-	void *local_base = 0;
-	if (platform().region_alloc().alloc_aligned(size, &local_base, alignment).error())
-		return 0;
+	return platform().region_alloc().alloc_aligned(size, (unsigned)alignment).convert<addr_t>(
 
-	if (!map_local_io(base, (addr_t)local_base, size >> get_page_size_log2())) {
-		error("map_local_io failed");
-		return 0;
-	}
+		[&] (void *local_base) {
+			if (!map_local_io(base, (addr_t)local_base, size >> get_page_size_log2())) {
+				error("map_local_io failed");
+				platform().region_alloc().free(local_base, base);
+				return 0UL;
+			}
+			return (addr_t)local_base;
+		},
 
-	return (addr_t)local_base;
+		[&] (Range_allocator::Alloc_error) {
+			error("allocation of virtual memory for local I/O mapping failed");
+			return 0UL; });
 }

repos/base-foc/src/core/ipc_pager.cc

@@ -86,7 +86,7 @@ void Ipc_pager::wait_for_fault()
 
 	do {
 		_tag = l4_ipc_wait(l4_utcb(), &label, L4_IPC_NEVER);
-		int err = l4_ipc_error(_tag, l4_utcb());
+		l4_umword_t err = l4_ipc_error(_tag, l4_utcb());
 		if (!err) {
 			_parse(label);
 			return;
@@ -121,7 +121,7 @@ void Ipc_pager::reply_and_wait_for_fault()
 	};
 
 	l4_fpage_t const fpage = l4_fpage(_reply_mapping.src_addr,
-	                                  _reply_mapping.size_log2,
+	                                  (unsigned)_reply_mapping.size_log2,
 	                                  rights(_reply_mapping.writeable,
 	                                         _reply_mapping.executable));
 
@@ -129,7 +129,7 @@ void Ipc_pager::reply_and_wait_for_fault()
 
 	_tag = l4_ipc_send_and_wait(_last.kcap, l4_utcb(), snd_tag,
 	                            &label, L4_IPC_SEND_TIMEOUT_0);
-	int const err = l4_ipc_error(_tag, l4_utcb());
+	l4_umword_t const err = l4_ipc_error(_tag, l4_utcb());
 	if (err) {
 		error("Ipc error ", err, " in pagefault from ", Hex(label & ~0x3));
 		wait_for_fault();

repos/base-foc/src/core/irq_session_component.cc

@@ -139,7 +139,7 @@ void Irq_object::ack_irq()
 {
 	using namespace Foc;
 
-	int err;
+	l4_umword_t err;
 	l4_msgtag_t tag = l4_irq_unmask(_capability());
 	if ((err = l4_ipc_error(tag, l4_utcb())))
 		error("IRQ unmask: ", err);
@@ -148,7 +148,7 @@ void Irq_object::ack_irq()
 
 Irq_object::Irq_object()
 :
-	 _cap(cap_map().insert(platform_specific().cap_id_alloc().alloc())),
+	 _cap(cap_map().insert((Cap_index::id_t)platform_specific().cap_id_alloc().alloc())),
 	 _trigger(Irq_session::TRIGGER_UNCHANGED),
 	 _polarity(Irq_session::POLARITY_UNCHANGED),
 	 _irq(~0U), _msi_addr(0), _msi_data(0)
@@ -170,7 +170,7 @@ Irq_object::~Irq_object()
 	if (l4_error(l4_irq_detach(_capability())))
 		error("cannot detach IRQ");
 
-	if (l4_error(l4_icu_unbind(L4_BASE_ICU_CAP, irq, _capability())))
+	if (l4_error(l4_icu_unbind(L4_BASE_ICU_CAP, (unsigned)irq, _capability())))
 		error("cannot unbind IRQ");
 
 	cap_map().remove(_cap);
@@ -184,7 +184,7 @@ Irq_object::~Irq_object()
 Irq_session_component::Irq_session_component(Range_allocator &irq_alloc,
                                              const char      *args)
 :
-	_irq_number(Arg_string::find_arg(args, "irq_number").long_value(-1)),
+	_irq_number((unsigned)Arg_string::find_arg(args, "irq_number").long_value(-1)),
 	_irq_alloc(irq_alloc), _irq_object()
 {
 	long const msi = Arg_string::find_arg(args, "device_config_phys").long_value(0);
@@ -196,7 +196,7 @@ Irq_session_component::Irq_session_component(Range_allocator &irq_alloc,
 		}
 		msi_alloc.set(_irq_number, 1);
 	} else {
-		if (irq_alloc.alloc_addr(1, _irq_number).error()) {
+		if (irq_alloc.alloc_addr(1, _irq_number).failed()) {
 			error("unavailable IRQ ", _irq_number, " requested");
 			throw Service_denied();
 		}
@@ -252,7 +252,7 @@ Irq_session::Info Irq_session_component::info()
 
 	return {
 		.type    = Genode::Irq_session::Info::Type::MSI,
-		.address = _irq_object.msi_address(),
+		.address = (addr_t)_irq_object.msi_address(),
 		.value   = _irq_object.msi_value()
 	};
 }
@@ -269,7 +269,7 @@ void Interrupt_handler::entry()
 {
 	using namespace Foc;
 
-	int         err;
+	l4_umword_t err;
 	l4_msgtag_t tag;
 	l4_umword_t label;
 

repos/base-foc/src/core/platform.cc

@@ -293,14 +293,14 @@ void Platform::_setup_mem_alloc()
 	for ( ; beg < end; beg += L4_PAGESIZE) (void)(*beg);
 
 	/* request pages of known page size starting with largest */
-	size_t const log2_sizes[] = { L4_LOG2_SUPERPAGESIZE, L4_LOG2_PAGESIZE };
+	unsigned const log2_sizes[] = { L4_LOG2_SUPERPAGESIZE, L4_LOG2_PAGESIZE };
 
 	for (unsigned i = 0; i < sizeof(log2_sizes)/sizeof(*log2_sizes); ++i) {
-		size_t const log2_size = log2_sizes[i];
-		size_t const size      = 1UL << log2_size;
+		unsigned const log2_size = log2_sizes[i];
+		size_t   const size      = 1UL << log2_size;
 
-		int    err       = 0;
-		addr_t addr      = 0;
+		Foc::l4_umword_t err = 0;
+		addr_t addr = 0;
 		Region region;
 
 		/* request any page of current size from sigma0 */
@@ -467,75 +467,68 @@ Platform::Platform()
 	core_thread.pager(_sigma0);
 	_core_pd->bind_thread(core_thread);
 
-	/* export x86 platform specific infos */
+	auto export_page_as_rom_module = [&] (auto rom_name, auto content_fn)
 	{
-		void * core_local_ptr = nullptr;
-		void * phys_ptr       = nullptr;
-		unsigned const pages  = 1;
-		size_t const   align  = get_page_size_log2();
-		size_t const   size   = pages << get_page_size_log2();
+		size_t const pages = 1;
+		size_t const align = get_page_size_log2();
+		size_t const bytes = pages << get_page_size_log2();
+		ram_alloc().alloc_aligned(bytes, align).with_result(
 
-		if (ram_alloc().alloc_aligned(size, &phys_ptr, align).error())
-			return;
+			[&] (void *phys_ptr) {
 
-		if (region_alloc().alloc_aligned(size, &core_local_ptr, align).error())
-			return;
+				addr_t const phys_addr = reinterpret_cast<addr_t>(phys_ptr);
 
-		addr_t const phys_addr       = reinterpret_cast<addr_t>(phys_ptr);
-		addr_t const core_local_addr = reinterpret_cast<addr_t>(core_local_ptr);
+				region_alloc().alloc_aligned(bytes, align).with_result(
+					[&] (void *core_local_ptr) {
 
-		if (!map_local(phys_addr, core_local_addr, pages))
-			return;
+						if (!map_local(phys_addr, (addr_t)core_local_ptr, pages)) {
+							warning("map_local failed while exporting ",
+							        rom_name, " as ROM module");
+							ram_alloc().free(phys_ptr, bytes);
+							region_alloc().free(core_local_ptr, bytes);
+							return;
+						}
 
-		memset(core_local_ptr, 0, size);
+						memset(core_local_ptr, 0, bytes);
+						content_fn((char *)core_local_ptr, bytes);
 
-		Xml_generator xml(reinterpret_cast<char *>(core_local_addr),
-		                  pages << get_page_size_log2(),
-		                  "platform_info", [&] ()
-		{
-			xml.node("kernel", [&] () {
-				xml.attribute("name", "foc");
-				xml.attribute("acpi", true);
-				xml.attribute("msi" , true);
+						_rom_fs.insert(new (core_mem_alloc())
+						               Rom_module(phys_addr, bytes, rom_name));
+					},
+					[&] (Range_allocator::Alloc_error) {
+						warning("failed allocate virtual memory to export ",
+						        rom_name, " as ROM module");
+						ram_alloc().free(phys_ptr, bytes);
+					}
+				);
+			},
+			[&] (Range_allocator::Alloc_error) {
+				warning("failed to export ", rom_name, " as ROM module"); }
+		);
+	};
+
+	export_page_as_rom_module("platform_info",
+		[&] (char *core_local_ptr, size_t size) {
+			Xml_generator xml(core_local_ptr, size, "platform_info", [&] ()
+			{
+				xml.node("kernel", [&] () {
+					xml.attribute("name", "foc");
+					xml.attribute("acpi", true);
+					xml.attribute("msi" , true);
+				});
+				xml.node("hardware", [&] () {
+					_setup_platform_info(xml, sigma0_map_kip()); });
+
+				xml.node("affinity-space", [&] () {
+					xml.attribute("width", affinity_space().width());
+					xml.attribute("height", affinity_space().height()); });
 			});
-			xml.node("hardware", [&] () {
-				_setup_platform_info(xml, sigma0_map_kip()); });
+		}
+	);
 
-			xml.node("affinity-space", [&] () {
-				xml.attribute("width", affinity_space().width());
-				xml.attribute("height", affinity_space().height()); });
-		});
-
-		_rom_fs.insert(new (core_mem_alloc()) Rom_module(phys_addr, size,
-		                                                 "platform_info"));
-	}
-
-	/* core log as ROM module */
-	{
-		void * core_local_ptr = nullptr;
-		void * phys_ptr       = nullptr;
-		unsigned const pages  = 1;
-		size_t const   align  = get_page_size_log2();
-		size_t const   size   = pages << get_page_size_log2();
-
-		if (ram_alloc().alloc_aligned(size, &phys_ptr, align).error())
-			return;
-		if (region_alloc().alloc_aligned(size, &core_local_ptr, align).error())
-			return;
-
-		addr_t const phys_addr = reinterpret_cast<addr_t>(phys_ptr);
-		addr_t const core_local_addr = reinterpret_cast<addr_t>(core_local_ptr);
-
-		if (!map_local(phys_addr, core_local_addr, pages))
-			return;
-
-		memset(core_local_ptr, 0, size);
-
-		_rom_fs.insert(new (core_mem_alloc()) Rom_module(phys_addr, size,
-		                                                 "core_log"));
-
-		init_core_log(Core_log_range { core_local_addr, size } );
-	}
+	export_page_as_rom_module("core_log",
+		[&] (char *core_local_ptr, size_t size) {
+			init_core_log(Core_log_range { (addr_t)core_local_ptr, size } ); });
 
 	Affinity::Space const cpus = affinity_space();
 

repos/base-foc/src/core/platform_pd.cc

@@ -122,12 +122,13 @@ void Platform_pd::flush(addr_t, size_t size, Core_local_addr core_local)
 
 static Native_capability debug_cap()
 {
-	unsigned long const id = platform_specific().cap_id_alloc().alloc();
+	Cap_index::id_t const id = platform_specific().cap_id_alloc().alloc();
 	static Cap_index * idx = cap_map().insert(id, DEBUG_CAP);
 	static Native_capability debug_cap(reinterpret_cast<Core_cap_index*>(idx));
 	return debug_cap;
 }
 
+
 Platform_pd::Platform_pd(Core_cap_index &ci)
 :
 	_task(Native_capability(&ci), TASK_CAP)

repos/base-foc/src/core/platform_thread.cc

@@ -32,7 +32,10 @@ using namespace Foc;
 Trace::Execution_time Platform_thread::execution_time() const
 {
 	Foc::l4_kernel_clock_t us = 0;
+	/* syscall does not return ever, if thread is on remote cpu,
+	   see issue #4357
 	l4_thread_stats_time(_thread.local.data()->kcap(), &us);
+	*/
 	return { us, 0, 10000 /* quantum readable ?*/, _prio };
 }
 
@@ -211,7 +214,7 @@ Foc_thread_state Platform_thread::state()
 		s = _pager_obj->state.state;
 
 	s.kcap = _gate.remote;
-	s.id   = _gate.local.local_name();
+	s.id   = (uint16_t)_gate.local.local_name();
 	s.utcb = _utcb;
 
 	return s;

repos/base-foc/src/core/rpc_cap_factory.cc

@@ -49,7 +49,7 @@ Cap_index_allocator &Genode::cap_idx_alloc()
 
 Core_cap_index *Cap_mapping::_get_cap()
 {
-	int const id = platform_specific().cap_id_alloc().alloc();
+	Cap_index::id_t const id = platform_specific().cap_id_alloc().alloc();
 	return static_cast<Core_cap_index*>(cap_map().insert(id));
 }
 
@@ -104,7 +104,7 @@ Native_capability Rpc_cap_factory::alloc(Native_capability ep)
 		/*
 		 * Allocate new id, and ipc-gate and set id as gate-label
 		 */
-		unsigned long const id = platform_specific().cap_id_alloc().alloc();
+		Cap_index::id_t const id = platform_specific().cap_id_alloc().alloc();
 		Core_cap_index *idx = static_cast<Core_cap_index*>(cap_map().insert(id));
 
 		if (!idx) {
@@ -194,19 +194,21 @@ Cap_id_allocator::Cap_id_allocator(Allocator &alloc)
 }
 
 
-unsigned long Cap_id_allocator::alloc()
+Cap_id_allocator::id_t Cap_id_allocator::alloc()
 {
 	Mutex::Guard lock_guard(_mutex);
 
-	void *id = nullptr;
-	if (_id_alloc.alloc(CAP_ID_OFFSET, &id))
-		return (unsigned long) id;
+	return _id_alloc.try_alloc(CAP_ID_OFFSET).convert<id_t>(
 
-	throw Out_of_ids();
+		[&] (void *id) -> id_t {
+			return (addr_t)id & ID_MASK; },
+
+		[&] (Range_allocator::Alloc_error) -> id_t {
+			throw Out_of_ids(); });
 }
 
 
-void Cap_id_allocator::free(unsigned long id)
+void Cap_id_allocator::free(id_t id)
 {
 	Mutex::Guard lock_guard(_mutex);
 

repos/base-foc/src/core/signal_source_component.cc

@@ -41,7 +41,7 @@ void Signal_source_component::submit(Signal_context_component &context,
                                      unsigned long             cnt)
 {
 	/* enqueue signal to context */
-	context.increment_signal_cnt(cnt);
+	context.increment_signal_cnt((int)cnt);
 
 	if (!context.enqueued()) {
 		_signal_queue.enqueue(context);

repos/base-foc/src/core/thread_start.cc

@@ -78,14 +78,22 @@ void Thread::start()
 		Info trace_source_info() const override
 		{
 			uint64_t const sc_time = 0;
-			addr_t const kcap = (addr_t) platform_thread.pager_object_badge();
 
 			using namespace Foc;
 			l4_kernel_clock_t ec_time = 0;
-			l4_msgtag_t res = l4_thread_stats_time(kcap, &ec_time);
-			if (l4_error(res))
-				Genode::error("cpu time for ", thread.name(),
-				              " is not available ", l4_error(res));
+
+			/*
+			 * The 'l4_thread_stats_time' syscall does not always return if
+			 * the thread is on remote CPU. Disable the feature to keep core
+			 * safe (see issue #4357).
+			 */
+			if (0) {
+				addr_t const kcap = (addr_t) platform_thread.pager_object_badge();
+				l4_msgtag_t res = l4_thread_stats_time(kcap, &ec_time);
+				if (l4_error(res))
+					Genode::error("cpu time for ", thread.name(),
+					              " is not available ", l4_error(res));
+			}
 
 			return { Session_label("core"), thread.name(),
 			         Trace::Execution_time(ec_time, sc_time, 10000,

repos/base-foc/src/core/vm_session_component.cc

@@ -49,7 +49,7 @@ Vcpu::Vcpu(Rpc_entrypoint            &ep,
 	}
 
 	try {
-		unsigned const vcpu_id = _vcpu_ids.alloc();
+		unsigned const vcpu_id = (unsigned)_vcpu_ids.alloc();
 		_task_index_client = thread.setup_vcpu(vcpu_id, task_cap, recall_cap(),
 	                                           _foc_vcpu_state);
 		if (_task_index_client == Foc::L4_INVALID_CAP) {
@@ -76,7 +76,7 @@ Vcpu::~Vcpu()
 	}
 
 	if (_foc_vcpu_state) {
-		unsigned const vcpu_id = ((addr_t)_foc_vcpu_state -
+		addr_t const vcpu_id = ((addr_t)_foc_vcpu_state -
 		                          Platform::VCPU_VIRT_EXT_START) / L4_PAGESIZE;
 		_vcpu_ids.free(vcpu_id);
 	}
@@ -176,7 +176,7 @@ void Vm_session_component::_attach_vm_memory(Dataspace_component &dsc,
 	using namespace Foc;
 
 	uint8_t flags = L4_FPAGE_RO;
-	if (dsc.writable() && attribute.writeable)
+	if (dsc.writeable() && attribute.writeable)
 		if (attribute.executable)
 			flags = L4_FPAGE_RWX;
 		else
@@ -187,7 +187,7 @@ void Vm_session_component::_attach_vm_memory(Dataspace_component &dsc,
 
 	Flexpage page = flex.page();
 	while (page.valid()) {
-		l4_fpage_t fp = l4_fpage(page.addr, page.log2_order, flags);
+		l4_fpage_t fp = l4_fpage(page.addr, (unsigned)page.log2_order, flags);
 		l4_msgtag_t msg = l4_task_map(_task_vcpu.local.data()->kcap(),
 		                              L4_BASE_TASK_CAP, fp,
 		                              l4_map_obj_control(page.hotspot,
@@ -210,7 +210,7 @@ void Vm_session_component::_detach_vm_memory(addr_t guest_phys, size_t size)
 		using namespace Foc;
 
 		l4_task_unmap(_task_vcpu.local.data()->kcap(),
-		              l4_fpage(page.addr, page.log2_order, L4_FPAGE_RWX),
+		              l4_fpage(page.addr, (unsigned)page.log2_order, L4_FPAGE_RWX),
 		              L4_FP_ALL_SPACES);
 
 		page = flex.page();

repos/base-foc/src/include/base/internal/cap_map.h

@@ -190,7 +190,7 @@ class Genode::Capability_map : private Noncopyable
 		 * \param  id the global capability id
 		 * \return    pointer of Cap_index when found, otherwise zero
 		 */
-		Cap_index* find(int id);
+		Cap_index* find(Cap_index::id_t id);
 
 		/**
 		 * Create and insert a new Cap_index with a specific capability id
@@ -203,7 +203,7 @@ class Genode::Capability_map : private Noncopyable
 		 * \return    pointer to the new Cap_index object, or zero
 		 *            when allocation failed
 		 */
-		Cap_index* insert(int id);
+		Cap_index* insert(Cap_index::id_t id);
 
 
 		/**
@@ -217,7 +217,7 @@ class Genode::Capability_map : private Noncopyable
 		 * \return      pointer to the new Cap_index object, or zero
 		 *              when allocation failed
 		 */
-		Cap_index* insert(int id, addr_t kcap);
+		Cap_index* insert(Cap_index::id_t id, addr_t kcap);
 
 		/**
 		 * Create and insert a new Cap_index with a specific capability id
@@ -236,7 +236,7 @@ class Genode::Capability_map : private Noncopyable
 		 *            with the same id exists and it's kernel-object
 		 *            differs to the one given by kcap
 		 */
-		Cap_index *insert_map(int id, addr_t kcap);
+		Cap_index *insert_map(Cap_index::id_t id, addr_t kcap);
 
 		/**
 		 * Remove (resp. invalidate) a Cap_index object

repos/base-foc/src/include/base/internal/capability_data.h

@@ -28,13 +28,17 @@
  */
 class Genode::Native_capability::Data : public Avl_node<Data>
 {
+	public:
+
+		using id_t = uint16_t;
+
 	private:
 
 		constexpr static uint16_t INVALID_ID = ~0;
 		constexpr static uint16_t UNUSED     =  0;
 
-		uint8_t  _ref_cnt; /* reference counter    */
-		uint16_t _id;      /* global capability id */
+		uint8_t _ref_cnt; /* reference counter    */
+		id_t    _id;      /* global capability id */
 
 	public:
 
@@ -56,7 +60,7 @@ class Genode::Native_capability::Data : public Avl_node<Data>
 		 ************************/
 
 		bool higher(Data *n);
-		Data *find_by_id(uint16_t id);
+		Data *find_by_id(id_t id);
 };
 
 #endif /* _INCLUDE__BASE__INTERNAL__CAPABILITY_DATA_H_ */

repos/base-foc/src/include/base/internal/parent_cap.h

@@ -30,7 +30,7 @@ namespace Genode {
 
 	static inline Parent_capability parent_cap()
 	{
-		unsigned long const local_name = _parent_cap;
+		Cap_index::id_t const local_name = (Cap_index::id_t)_parent_cap;
 
 		static Cap_index *i = cap_map().insert(local_name, Foc::PARENT_CAP);
 		/*

repos/base-foc/src/lib/base/cap_map.cc

@@ -104,7 +104,7 @@ uint8_t Cap_index::dec()
  **  Capability_map class  **
  ****************************/
 
-Cap_index* Capability_map::find(int id)
+Cap_index* Capability_map::find(Cap_index::id_t id)
 {
 	Lock_guard<Spin_lock> guard(_lock);
 
@@ -112,7 +112,7 @@ Cap_index* Capability_map::find(int id)
 }
 
 
-Cap_index* Capability_map::insert(int id)
+Cap_index* Capability_map::insert(Cap_index::id_t id)
 {
 	Lock_guard<Spin_lock> guard(_lock);
 
@@ -128,7 +128,7 @@ Cap_index* Capability_map::insert(int id)
 }
 
 
-Cap_index* Capability_map::insert(int id, addr_t kcap)
+Cap_index* Capability_map::insert(Cap_index::id_t id, addr_t kcap)
 {
 	Lock_guard<Spin_lock> guard(_lock);
 
@@ -146,7 +146,7 @@ Cap_index* Capability_map::insert(int id, addr_t kcap)
 }
 
 
-Cap_index* Capability_map::insert_map(int id, addr_t kcap)
+Cap_index* Capability_map::insert_map(Cap_index::id_t id, addr_t kcap)
 {
 	using namespace Foc;
 

repos/base-foc/src/lib/base/ipc.cc

@@ -49,13 +49,13 @@ enum Debug { DEBUG_MSG = 1 };
 
 static inline bool ipc_error(l4_msgtag_t tag, bool print)
 {
-	int const ipc_error = l4_ipc_error(tag, l4_utcb());
+	Foc::l4_umword_t const ipc_error = l4_ipc_error(tag, l4_utcb());
 	if (ipc_error && print) raw("Ipc error: ", ipc_error, " occurred!");
 	return ipc_error;
 }
 
 
-static constexpr unsigned long INVALID_BADGE = ~0UL;
+static constexpr Cap_index::id_t INVALID_BADGE = 0xffff;
 
 
 /**
@@ -63,9 +63,9 @@ static constexpr unsigned long INVALID_BADGE = ~0UL;
  */
 struct Cap_info
 {
-	bool          valid = false;
-	unsigned long sel   = 0;
-	unsigned long badge = 0;
+	bool            valid = false;
+	unsigned long   sel   = 0;
+	Cap_index::id_t badge = 0;
 };
 
 
@@ -74,9 +74,9 @@ struct Cap_info
  *
  * \return  protocol word (local name or exception code)
  */
-static unsigned long extract_msg_from_utcb(l4_msgtag_t     tag,
-                                           Receive_window &rcv_window,
-                                           Msgbuf_base    &rcv_msg)
+static int extract_msg_from_utcb(l4_msgtag_t     tag,
+                                 Receive_window &rcv_window,
+                                 Msgbuf_base    &rcv_msg)
 {
 	unsigned num_msg_words = l4_msgtag_words(tag);
 
@@ -90,7 +90,7 @@ static unsigned long extract_msg_from_utcb(l4_msgtag_t     tag,
 	unsigned long const protocol_word = *msg_words++;
 
 	/* read number of capability arguments from second message word */
-	size_t const num_caps = min(*msg_words, Msgbuf_base::MAX_CAPS_PER_MSG);
+	unsigned const num_caps = (unsigned)min(*msg_words, Msgbuf_base::MAX_CAPS_PER_MSG);
 	msg_words++;
 
 	num_msg_words -= 2;
@@ -114,7 +114,7 @@ static unsigned long extract_msg_from_utcb(l4_msgtag_t     tag,
 
 	for (unsigned i = 0, sel_idx = 0; i < num_caps; i++) {
 
-		unsigned long const badge = *msg_words++;
+		Cap_index::id_t const badge = (Cap_index::id_t)(*msg_words++);
 
 		if (badge == INVALID_BADGE)
 			continue;
@@ -135,7 +135,7 @@ static unsigned long extract_msg_from_utcb(l4_msgtag_t     tag,
 	if ((num_msg_words)*sizeof(l4_mword_t) > rcv_msg.capacity()) {
 		if (DEBUG_MSG)
 			raw("receive message buffer too small");
-		num_msg_words = rcv_msg.capacity()/sizeof(l4_mword_t);
+		num_msg_words = (unsigned)(rcv_msg.capacity()/sizeof(l4_mword_t));
 	}
 
 	/* read message payload beginning from the second UTCB message register */
@@ -160,7 +160,7 @@ static unsigned long extract_msg_from_utcb(l4_msgtag_t     tag,
 		}
 	}
 
-	return protocol_word;
+	return (int)protocol_word;
 }
 
 
@@ -175,8 +175,8 @@ static l4_msgtag_t copy_msgbuf_to_utcb(Msgbuf_base &snd_msg,
                                        unsigned long protocol_word)
 {
 
-	unsigned const num_data_words = snd_msg.data_size() / sizeof(l4_mword_t);
-	unsigned const num_caps       = snd_msg.used_caps();
+	unsigned const num_data_words = (unsigned)(snd_msg.data_size() / sizeof(l4_mword_t));
+	unsigned const num_caps       = (unsigned)snd_msg.used_caps();
 
 	/* validate capabilities present in the message buffer */
 	for (unsigned i = 0; i < num_caps; i++) {
@@ -201,7 +201,7 @@ static l4_msgtag_t copy_msgbuf_to_utcb(Msgbuf_base &snd_msg,
 		Native_capability const &cap = snd_msg.cap(i);
 		if (cap.valid()) {
 			caps[i].valid = true;
-			caps[i].badge = cap.local_name();
+			caps[i].badge = (Cap_index::id_t)cap.local_name();
 			caps[i].sel   = cap.data()->kcap();
 		}
 	}

repos/base-foc/src/lib/base/thread_bootstrap.cc

@@ -38,14 +38,6 @@ void prepare_init_main_thread()
 }
 
 
-void prepare_reinit_main_thread()
-{
-	construct_at<Capability_map>(&cap_map());
-	cap_idx_alloc().reinit();
-	prepare_init_main_thread();
-}
-
-
 /************
  ** Thread **
  ************/

repos/base-foc/src/lib/base/x86/vm.cc

@@ -29,9 +29,12 @@
 #include <foc/native_capability.h>
 
 namespace Foc {
+#pragma GCC diagnostic push
+#pragma GCC diagnostic ignored "-Wconversion"
 #include <l4/sys/vcpu.h>
 #include <l4/sys/__vm-svm.h>
 #include <l4/sys/__vm-vmx.h>
+#pragma GCC diagnostic pop  /* restore -Wconversion warnings */
 }
 
 using namespace Genode;
@@ -218,9 +221,9 @@ struct Foc_vcpu : Thread, Noncopyable
 			CR0_PG = 0 /* 1U << 31 - not needed in case of UG */
 		};
 
-		addr_t const _cr0_mask       { CR0_NM | CR0_CD };
-		addr_t const vmcb_ctrl0      { CTRL0_IO | CTRL0_MSR };
-		addr_t const vmcb_ctrl1      { 0 };
+		addr_t   const _cr0_mask  { CR0_NM | CR0_CD };
+		uint32_t const vmcb_ctrl0 { CTRL0_IO | CTRL0_MSR };
+		uint32_t const vmcb_ctrl1 { 0 };
 
 		addr_t       vmcb_cr0_shadow { 0 };
 		addr_t       vmcb_cr4_shadow { 0 };
@@ -481,7 +484,7 @@ struct Foc_vcpu : Thread, Noncopyable
 		 * Convert to AMD (and Genode) format comprising 16 bits.
 		 */
 		uint16_t _convert_ar_16(addr_t value) {
-			return ((value & 0x1f000) >> 4) | (value & 0xff); }
+			return (uint16_t)(((value & 0x1f000) >> 4) | (value & 0xff)); }
 
 		void _read_intel_state(Vcpu_state &state, void *vmcs,
 		                       Foc::l4_vcpu_state_t *vcpu)
@@ -495,18 +498,15 @@ struct Foc_vcpu : Thread, Noncopyable
 			state.di.charge(vcpu->r.di);
 			state.si.charge(vcpu->r.si);
 
-			state.flags.charge(Foc::l4_vm_vmx_read(vmcs, Vmcs::FLAGS));
-
-			state.sp.charge(Foc::l4_vm_vmx_read(vmcs, Vmcs::SP));
-
-			state.ip.charge(Foc::l4_vm_vmx_read(vmcs, Vmcs::IP));
-			state.ip_len.charge(Foc::l4_vm_vmx_read(vmcs, Vmcs::INST_LEN));
-
-			state.dr7.charge(Foc::l4_vm_vmx_read(vmcs, Vmcs::DR7));
+			state.flags .charge((addr_t)Foc::l4_vm_vmx_read(vmcs, Vmcs::FLAGS));
+			state.sp    .charge((addr_t)Foc::l4_vm_vmx_read(vmcs, Vmcs::SP));
+			state.ip    .charge((addr_t)Foc::l4_vm_vmx_read(vmcs, Vmcs::IP));
+			state.ip_len.charge((addr_t)Foc::l4_vm_vmx_read(vmcs, Vmcs::INST_LEN));
+			state.dr7   .charge((addr_t)Foc::l4_vm_vmx_read(vmcs, Vmcs::DR7));
 
 #ifdef __x86_64__
-			state.r8.charge(vcpu->r.r8);
-			state.r9.charge(vcpu->r.r9);
+			state.r8 .charge(vcpu->r.r8);
+			state.r9 .charge(vcpu->r.r9);
 			state.r10.charge(vcpu->r.r10);
 			state.r11.charge(vcpu->r.r11);
 			state.r12.charge(vcpu->r.r12);
@@ -516,21 +516,25 @@ struct Foc_vcpu : Thread, Noncopyable
 #endif
 
 			{
-				addr_t const cr0 = Foc::l4_vm_vmx_read(vmcs, Vmcs::CR0);
-				addr_t const cr0_shadow = Foc::l4_vm_vmx_read(vmcs, Vmcs::CR0_SHADOW);
+				addr_t const cr0        = (addr_t)Foc::l4_vm_vmx_read(vmcs, Vmcs::CR0);
+				addr_t const cr0_shadow = (addr_t)Foc::l4_vm_vmx_read(vmcs, Vmcs::CR0_SHADOW);
+
 				state.cr0.charge((cr0 & ~vmcs_cr0_mask) | (cr0_shadow & vmcs_cr0_mask));
+
 				if (state.cr0.value() != cr0_shadow)
 					Foc::l4_vm_vmx_write(vmcs, Vmcs::CR0_SHADOW, state.cr0.value());
 			}
 
 			unsigned const cr2 = Foc::l4_vm_vmx_get_cr2_index(vmcs);
-			state.cr2.charge(Foc::l4_vm_vmx_read(vmcs, cr2));
-			state.cr3.charge(Foc::l4_vm_vmx_read(vmcs, Vmcs::CR3));
+			state.cr2.charge((addr_t)Foc::l4_vm_vmx_read(vmcs, cr2));
+			state.cr3.charge((addr_t)Foc::l4_vm_vmx_read(vmcs, Vmcs::CR3));
 
 			{
-				addr_t const cr4 = Foc::l4_vm_vmx_read(vmcs, Vmcs::CR4);
-				addr_t const cr4_shadow = Foc::l4_vm_vmx_read(vmcs, Vmcs::CR4_SHADOW);
+				addr_t const cr4        = (addr_t)Foc::l4_vm_vmx_read(vmcs, Vmcs::CR4);
+				addr_t const cr4_shadow = (addr_t)Foc::l4_vm_vmx_read(vmcs, Vmcs::CR4_SHADOW);
+
 				state.cr4.charge((cr4 & ~vmcs_cr4_mask) | (cr4_shadow & vmcs_cr4_mask));
+
 				if (state.cr4.value() != cr4_shadow)
 					Foc::l4_vm_vmx_write(vmcs, Vmcs::CR4_SHADOW,
 					                        state.cr4.value());
@@ -545,7 +549,7 @@ struct Foc_vcpu : Thread, Noncopyable
 
 			{
 				Segment cs { l4_vm_vmx_read_16(vmcs, Vmcs::CS_SEL),
-				             _convert_ar_16(l4_vm_vmx_read(vmcs, Vmcs::CS_AR)),
+				             _convert_ar_16((addr_t)l4_vm_vmx_read(vmcs, Vmcs::CS_AR)),
 				             l4_vm_vmx_read_32(vmcs, Vmcs::CS_LIMIT),
 				             l4_vm_vmx_read_nat(vmcs, Vmcs::CS_BASE) };
 
@@ -554,7 +558,7 @@ struct Foc_vcpu : Thread, Noncopyable
 
 			{
 				Segment ss { l4_vm_vmx_read_16(vmcs, Vmcs::SS_SEL),
-				            _convert_ar_16(l4_vm_vmx_read(vmcs, Vmcs::SS_AR)),
+				            _convert_ar_16((addr_t)l4_vm_vmx_read(vmcs, Vmcs::SS_AR)),
 				            l4_vm_vmx_read_32(vmcs, Vmcs::SS_LIMIT),
 				            l4_vm_vmx_read_nat(vmcs, Vmcs::SS_BASE) };
 
@@ -563,7 +567,7 @@ struct Foc_vcpu : Thread, Noncopyable
 
 			{
 				Segment es { l4_vm_vmx_read_16(vmcs, Vmcs::ES_SEL),
-				             _convert_ar_16(l4_vm_vmx_read(vmcs, Vmcs::ES_AR)),
+				             _convert_ar_16((addr_t)l4_vm_vmx_read(vmcs, Vmcs::ES_AR)),
 				             l4_vm_vmx_read_32(vmcs, Vmcs::ES_LIMIT),
 				             l4_vm_vmx_read_nat(vmcs, Vmcs::ES_BASE) };
 
@@ -572,7 +576,7 @@ struct Foc_vcpu : Thread, Noncopyable
 
 			{
 				Segment ds { l4_vm_vmx_read_16(vmcs, Vmcs::DS_SEL),
-				             _convert_ar_16(l4_vm_vmx_read(vmcs, Vmcs::DS_AR)),
+				             _convert_ar_16((addr_t)l4_vm_vmx_read(vmcs, Vmcs::DS_AR)),
 				             l4_vm_vmx_read_32(vmcs, Vmcs::DS_LIMIT),
 				             l4_vm_vmx_read_nat(vmcs, Vmcs::DS_BASE) };
 
@@ -581,7 +585,7 @@ struct Foc_vcpu : Thread, Noncopyable
 
 			{
 				Segment fs { l4_vm_vmx_read_16(vmcs, Vmcs::FS_SEL),
-				             _convert_ar_16(l4_vm_vmx_read(vmcs, Vmcs::FS_AR)),
+				             _convert_ar_16((addr_t)l4_vm_vmx_read(vmcs, Vmcs::FS_AR)),
 				             l4_vm_vmx_read_32(vmcs, Vmcs::FS_LIMIT),
 				             l4_vm_vmx_read_nat(vmcs, Vmcs::FS_BASE) };
 
@@ -590,7 +594,7 @@ struct Foc_vcpu : Thread, Noncopyable
 
 			{
 				Segment gs { l4_vm_vmx_read_16(vmcs, Vmcs::GS_SEL),
-				             _convert_ar_16(l4_vm_vmx_read(vmcs, Vmcs::GS_AR)),
+				             _convert_ar_16((addr_t)l4_vm_vmx_read(vmcs, Vmcs::GS_AR)),
 				             l4_vm_vmx_read_32(vmcs, Vmcs::GS_LIMIT),
 				             l4_vm_vmx_read_nat(vmcs, Vmcs::GS_BASE) };
 
@@ -599,7 +603,7 @@ struct Foc_vcpu : Thread, Noncopyable
 
 			{
 				Segment tr { l4_vm_vmx_read_16(vmcs, Vmcs::TR_SEL),
-				             _convert_ar_16(l4_vm_vmx_read(vmcs, Vmcs::TR_AR)),
+				             _convert_ar_16((addr_t)l4_vm_vmx_read(vmcs, Vmcs::TR_AR)),
 				             l4_vm_vmx_read_32(vmcs, Vmcs::TR_LIMIT),
 				             l4_vm_vmx_read_nat(vmcs, Vmcs::TR_BASE) };
 
@@ -608,7 +612,7 @@ struct Foc_vcpu : Thread, Noncopyable
 
 			{
 				Segment ldtr { l4_vm_vmx_read_16(vmcs, Vmcs::LDTR_SEL),
-				               _convert_ar_16(l4_vm_vmx_read(vmcs, Vmcs::LDTR_AR)),
+				               _convert_ar_16((addr_t)l4_vm_vmx_read(vmcs, Vmcs::LDTR_AR)),
 				               l4_vm_vmx_read_32(vmcs, Vmcs::LDTR_LIMIT),
 				               l4_vm_vmx_read_nat(vmcs, Vmcs::LDTR_BASE) };
 
@@ -621,35 +625,35 @@ struct Foc_vcpu : Thread, Noncopyable
 			state.idtr.charge(Range{.limit = l4_vm_vmx_read_32(vmcs, Vmcs::IDTR_LIMIT),
 			                        .base  = l4_vm_vmx_read_nat(vmcs, Vmcs::IDTR_BASE)});
 
-			state.sysenter_cs.charge(l4_vm_vmx_read(vmcs, Vmcs::SYSENTER_CS));
-			state.sysenter_sp.charge(l4_vm_vmx_read(vmcs, Vmcs::SYSENTER_SP));
-			state.sysenter_ip.charge(l4_vm_vmx_read(vmcs, Vmcs::SYSENTER_IP));
+			state.sysenter_cs.charge((addr_t)l4_vm_vmx_read(vmcs, Vmcs::SYSENTER_CS));
+			state.sysenter_sp.charge((addr_t)l4_vm_vmx_read(vmcs, Vmcs::SYSENTER_SP));
+			state.sysenter_ip.charge((addr_t)l4_vm_vmx_read(vmcs, Vmcs::SYSENTER_IP));
 
-			state.qual_primary.charge(l4_vm_vmx_read(vmcs, Vmcs::EXIT_QUAL));
+			state.qual_primary  .charge(l4_vm_vmx_read(vmcs, Vmcs::EXIT_QUAL));
 			state.qual_secondary.charge(l4_vm_vmx_read(vmcs, Vmcs::GUEST_PHYS));
 
-			state.ctrl_primary.charge(l4_vm_vmx_read(vmcs, Vmcs::CTRL_0));
-			state.ctrl_secondary.charge(l4_vm_vmx_read(vmcs, Vmcs::CTRL_1));
+			state.ctrl_primary  .charge((uint32_t)l4_vm_vmx_read(vmcs, Vmcs::CTRL_0));
+			state.ctrl_secondary.charge((uint32_t)l4_vm_vmx_read(vmcs, Vmcs::CTRL_1));
 
 			if (state.exit_reason == INTEL_EXIT_INVALID ||
 			    state.exit_reason == VMEXIT_PAUSED)
 			{
-				state.inj_info.charge(l4_vm_vmx_read(vmcs, Vmcs::INTR_INFO));
-				state.inj_error.charge(l4_vm_vmx_read(vmcs, Vmcs::INTR_ERROR));
+				state.inj_info .charge((uint32_t)l4_vm_vmx_read(vmcs, Vmcs::INTR_INFO));
+				state.inj_error.charge((uint32_t)l4_vm_vmx_read(vmcs, Vmcs::INTR_ERROR));
 			} else {
-				state.inj_info.charge(l4_vm_vmx_read(vmcs, Vmcs::IDT_INFO));
-				state.inj_error.charge(l4_vm_vmx_read(vmcs, Vmcs::IDT_ERROR));
+				state.inj_info .charge((uint32_t)l4_vm_vmx_read(vmcs, Vmcs::IDT_INFO));
+				state.inj_error.charge((uint32_t)l4_vm_vmx_read(vmcs, Vmcs::IDT_ERROR));
 			}
 
-			state.intr_state.charge(l4_vm_vmx_read(vmcs, Vmcs::STATE_INTR));
-			state.actv_state.charge(l4_vm_vmx_read(vmcs, Vmcs::STATE_ACTV));
+			state.intr_state.charge((uint32_t)l4_vm_vmx_read(vmcs, Vmcs::STATE_INTR));
+			state.actv_state.charge((uint32_t)l4_vm_vmx_read(vmcs, Vmcs::STATE_ACTV));
 
 			state.tsc.charge(Trace::timestamp());
 			state.tsc_offset.charge(_tsc_offset);
 
-			state.efer.charge(l4_vm_vmx_read(vmcs, Vmcs::EFER));
+			state.efer.charge((addr_t)l4_vm_vmx_read(vmcs, Vmcs::EFER));
 
-			state.star.charge(l4_vm_vmx_read(vmcs, Vmcs::MSR_STAR));
+			state.star .charge(l4_vm_vmx_read(vmcs, Vmcs::MSR_STAR));
 			state.lstar.charge(l4_vm_vmx_read(vmcs, Vmcs::MSR_LSTAR));
 			state.cstar.charge(l4_vm_vmx_read(vmcs, Vmcs::MSR_CSTAR));
 			state.fmask.charge(l4_vm_vmx_read(vmcs, Vmcs::MSR_FMASK));
@@ -665,7 +669,7 @@ struct Foc_vcpu : Thread, Noncopyable
 		void _read_amd_state(Vcpu_state &state, Foc::l4_vm_svm_vmcb_t *vmcb,
 		                     Foc::l4_vcpu_state_t * const vcpu)
 		{
-			state.ax.charge(vmcb->state_save_area.rax);
+			state.ax.charge((addr_t)vmcb->state_save_area.rax);
 			state.cx.charge(vcpu->r.cx);
 			state.dx.charge(vcpu->r.dx);
 			state.bx.charge(vcpu->r.bx);
@@ -674,18 +678,18 @@ struct Foc_vcpu : Thread, Noncopyable
 			state.si.charge(vcpu->r.si);
 			state.bp.charge(vcpu->r.bp);
 
-			state.flags.charge(vmcb->state_save_area.rflags);
+			state.flags.charge((addr_t)vmcb->state_save_area.rflags);
 
-			state.sp.charge(vmcb->state_save_area.rsp);
+			state.sp.charge((addr_t)vmcb->state_save_area.rsp);
 
-			state.ip.charge(vmcb->state_save_area.rip);
+			state.ip.charge((addr_t)vmcb->state_save_area.rip);
 			state.ip_len.charge(0); /* unsupported on AMD */
 
-			state.dr7.charge(vmcb->state_save_area.dr7);
+			state.dr7.charge((addr_t)vmcb->state_save_area.dr7);
 
 #ifdef __x86_64__
-			state.r8.charge(vcpu->r.r8);
-			state.r9.charge(vcpu->r.r9);
+			state.r8 .charge(vcpu->r.r8);
+			state.r9 .charge(vcpu->r.r9);
 			state.r10.charge(vcpu->r.r10);
 			state.r11.charge(vcpu->r.r11);
 			state.r12.charge(vcpu->r.r12);
@@ -695,15 +699,15 @@ struct Foc_vcpu : Thread, Noncopyable
 #endif
 
 			{
-				addr_t const cr0 = vmcb->state_save_area.cr0;
+				addr_t const cr0 = (addr_t)vmcb->state_save_area.cr0;
 				state.cr0.charge((cr0 & ~vmcb_cr0_mask) | (vmcb_cr0_shadow & vmcb_cr0_mask));
 				if (state.cr0.value() != vmcb_cr0_shadow)
 					vmcb_cr0_shadow = state.cr0.value();
 			}
-			state.cr2.charge(vmcb->state_save_area.cr2);
-			state.cr3.charge(vmcb->state_save_area.cr3);
+			state.cr2.charge((addr_t)vmcb->state_save_area.cr2);
+			state.cr3.charge((addr_t)vmcb->state_save_area.cr3);
 			{
-				addr_t const cr4 = vmcb->state_save_area.cr4;
+				addr_t const cr4 = (addr_t)vmcb->state_save_area.cr4;
 				state.cr4.charge((cr4 & ~vmcb_cr4_mask) | (vmcb_cr4_shadow & vmcb_cr4_mask));
 				if (state.cr4.value() != vmcb_cr4_shadow)
 					vmcb_cr4_shadow = state.cr4.value();
@@ -712,44 +716,44 @@ struct Foc_vcpu : Thread, Noncopyable
 			typedef Vcpu_state::Segment Segment;
 
 			state.cs.charge(Segment{vmcb->state_save_area.cs.selector,
-			                       vmcb->state_save_area.cs.attrib,
-			                       vmcb->state_save_area.cs.limit,
-			                       (addr_t)vmcb->state_save_area.cs.base});
+			                        vmcb->state_save_area.cs.attrib,
+			                        vmcb->state_save_area.cs.limit,
+			                        (addr_t)vmcb->state_save_area.cs.base});
 
 			state.ss.charge(Segment{vmcb->state_save_area.ss.selector,
-			                       vmcb->state_save_area.ss.attrib,
-			                       vmcb->state_save_area.ss.limit,
-			                       (addr_t)vmcb->state_save_area.ss.base});
+			                        vmcb->state_save_area.ss.attrib,
+			                        vmcb->state_save_area.ss.limit,
+			                        (addr_t)vmcb->state_save_area.ss.base});
 
 			state.es.charge(Segment{vmcb->state_save_area.es.selector,
-			                       vmcb->state_save_area.es.attrib,
-			                       vmcb->state_save_area.es.limit,
-			                       (addr_t)vmcb->state_save_area.es.base});
+			                        vmcb->state_save_area.es.attrib,
+			                        vmcb->state_save_area.es.limit,
+			                        (addr_t)vmcb->state_save_area.es.base});
 
 			state.ds.charge(Segment{vmcb->state_save_area.ds.selector,
-			                       vmcb->state_save_area.ds.attrib,
-			                       vmcb->state_save_area.ds.limit,
-			                       (addr_t)vmcb->state_save_area.ds.base});
+			                        vmcb->state_save_area.ds.attrib,
+			                        vmcb->state_save_area.ds.limit,
+			                        (addr_t)vmcb->state_save_area.ds.base});
 
 			state.fs.charge(Segment{vmcb->state_save_area.fs.selector,
-			                       vmcb->state_save_area.fs.attrib,
-			                       vmcb->state_save_area.fs.limit,
-			                       (addr_t)vmcb->state_save_area.fs.base});
+			                        vmcb->state_save_area.fs.attrib,
+			                        vmcb->state_save_area.fs.limit,
+			                        (addr_t)vmcb->state_save_area.fs.base});
 
 			state.gs.charge(Segment{vmcb->state_save_area.gs.selector,
-			                       vmcb->state_save_area.gs.attrib,
-			                       vmcb->state_save_area.gs.limit,
-			                       (addr_t)vmcb->state_save_area.gs.base});
+			                        vmcb->state_save_area.gs.attrib,
+			                        vmcb->state_save_area.gs.limit,
+			                        (addr_t)vmcb->state_save_area.gs.base});
 
 			state.tr.charge(Segment{vmcb->state_save_area.tr.selector,
-			                       vmcb->state_save_area.tr.attrib,
-			                       vmcb->state_save_area.tr.limit,
-			                       (addr_t)vmcb->state_save_area.tr.base});
+			                        vmcb->state_save_area.tr.attrib,
+			                        vmcb->state_save_area.tr.limit,
+			                        (addr_t)vmcb->state_save_area.tr.base});
 
 			state.ldtr.charge(Segment{vmcb->state_save_area.ldtr.selector,
-			                         vmcb->state_save_area.ldtr.attrib,
-			                         vmcb->state_save_area.ldtr.limit,
-			                         (addr_t)vmcb->state_save_area.ldtr.base});
+			                          vmcb->state_save_area.ldtr.attrib,
+			                          vmcb->state_save_area.ldtr.limit,
+			                          (addr_t)vmcb->state_save_area.ldtr.base});
 
 			typedef Vcpu_state::Range Range;
 
@@ -759,11 +763,11 @@ struct Foc_vcpu : Thread, Noncopyable
 			state.idtr.charge(Range{.limit = vmcb->state_save_area.idtr.limit,
 			                        .base  = (addr_t)vmcb->state_save_area.idtr.base });
 
-			state.sysenter_cs.charge(vmcb->state_save_area.sysenter_cs);
-			state.sysenter_sp.charge(vmcb->state_save_area.sysenter_esp);
-			state.sysenter_ip.charge(vmcb->state_save_area.sysenter_eip);
+			state.sysenter_cs.charge((addr_t)vmcb->state_save_area.sysenter_cs);
+			state.sysenter_sp.charge((addr_t)vmcb->state_save_area.sysenter_esp);
+			state.sysenter_ip.charge((addr_t)vmcb->state_save_area.sysenter_eip);
 
-			state.qual_primary.charge(vmcb->control_area.exitinfo1);
+			state.qual_primary  .charge(vmcb->control_area.exitinfo1);
 			state.qual_secondary.charge(vmcb->control_area.exitinfo2);
 
 			uint32_t inj_info = 0;
@@ -771,22 +775,22 @@ struct Foc_vcpu : Thread, Noncopyable
 			if (state.exit_reason == AMD_EXIT_INVALID ||
 			    state.exit_reason == VMEXIT_PAUSED)
 			{
-				inj_info  = vmcb->control_area.eventinj;
-				inj_error = vmcb->control_area.eventinj >> 32;
+				inj_info  = (uint32_t)vmcb->control_area.eventinj;
+				inj_error = (uint32_t)(vmcb->control_area.eventinj >> 32);
 			} else {
-				inj_info  = vmcb->control_area.exitintinfo;
-				inj_error = vmcb->control_area.exitintinfo >> 32;
+				inj_info  = (uint32_t)vmcb->control_area.exitintinfo;
+				inj_error = (uint32_t)(vmcb->control_area.exitintinfo >> 32);
 			}
-			state.inj_info.charge(inj_info);
+			state.inj_info .charge(inj_info);
 			state.inj_error.charge(inj_error);
 
-			state.intr_state.charge(vmcb->control_area.interrupt_shadow);
+			state.intr_state.charge((uint32_t)vmcb->control_area.interrupt_shadow);
 			state.actv_state.charge(0);
 
 			state.tsc.charge(Trace::timestamp());
 			state.tsc_offset.charge(_tsc_offset);
 
-			state.efer.charge(vmcb->state_save_area.efer);
+			state.efer.charge((addr_t)vmcb->state_save_area.efer);
 
 			if (state.pdpte_0.charged() || state.pdpte_1.charged() ||
 			    state.pdpte_2.charged() || state.pdpte_3.charged()) {
@@ -894,9 +898,9 @@ struct Foc_vcpu : Thread, Noncopyable
 			}
 
 			if (state.inj_info.charged() || state.inj_error.charged()) {
-				addr_t ctrl_0 = state.ctrl_primary.charged() ?
-				                state.ctrl_primary.value() :
-				                Foc::l4_vm_vmx_read(vmcs, Vmcs::CTRL_0);
+				uint32_t ctrl_0 = state.ctrl_primary.charged()
+				              ? (uint32_t)state.ctrl_primary.value()
+				              : (uint32_t)Foc::l4_vm_vmx_read(vmcs, Vmcs::CTRL_0);
 
 				if (state.inj_info.value() & 0x2000)
 					warning("unimplemented ", state.inj_info.value() & 0x1000, " ",

repos/base-foc/src/test/cap_integrity/main.cc

@@ -38,7 +38,8 @@ Main::Main(Env &env)
 	Foc::l4_cap_idx_t tid = Capability_space::kcap(env.pd_session_cap());
 
 	/* try the first 1000 local name IDs */
-	for (int local_name = 0; local_name < COUNT; local_name++, idx++) {
+	using id_t = Native_capability::Data::id_t;
+	for (id_t local_name = 0; local_name < COUNT; local_name++, idx++) {
 		idx->id(local_name);
 		l4_task_map(L4_BASE_TASK_CAP, L4_BASE_TASK_CAP,
 		            l4_obj_fpage(tid, 0, L4_FPAGE_RWX),

repos/base-hw/board/imx8q_evk/arch

@@ -1 +0,0 @@
-arm_v8a

repos/base-hw/board/imx8q_evk/image_link_address

@@ -1 +0,0 @@
-0x40010000

repos/base-hw/board/riscv_qemu/arch

@@ -1 +0,0 @@
-riscv

repos/base-hw/board/riscv_qemu/image_link_address

@@ -1 +0,0 @@
-0x80200000

repos/base-hw/board/rpi/arch

@@ -1 +0,0 @@
-arm_v6

repos/base-hw/board/rpi/image_link_address

@@ -1 +0,0 @@
-0x00800000

repos/base-hw/board/rpi3/arch

@@ -1 +0,0 @@
-arm_v8a

repos/base-hw/board/rpi3/image_link_address

@@ -1 +0,0 @@
-0x00800000

repos/base-hw/board/zynq_qemu/arch

@@ -1 +0,0 @@
-arm_v7a

repos/base-hw/board/zynq_qemu/image_link_address

@@ -1 +0,0 @@
-0x00100000

repos/base-hw/include/kernel/interface.h

@@ -16,7 +16,6 @@
 
 /* base-hw includes */
 #include <kernel/types.h>
-#include <kernel/interface_support.h>
 
 namespace Kernel {
 
@@ -92,12 +91,11 @@ namespace Kernel {
 	 * \param  duration_us  timeout duration in microseconds
 	 * \param  sigid        local name of signal context to trigger
 	 *
-	 * This call always overwrites the last timeout installed by the thread
-	 * if any.
+	 * This call overwrites the last timeout installed by the thread.
 	 */
 	inline int timeout(timeout_t const duration_us, capid_t const sigid)
 	{
-		return call(call_id_timeout(), duration_us, sigid);
+		return (int)call(call_id_timeout(), duration_us, sigid);
 	}
 
 
@@ -130,7 +128,7 @@ namespace Kernel {
 	 *
 	 * The stop syscall always targets the calling thread that, therefore must
 	 * be in the 'active' thread state. The thread then switches to the
-	 * 'stopped' thread state in wich it waits for a restart. The restart
+	 * 'stopped' thread state, in which it waits for a restart. The restart
 	 * syscall can only be used on a thread in the 'stopped' or the 'active'
 	 * thread state. The thread then switches back to the 'active' thread
 	 * state and the syscall returns whether the thread was stopped. Both
@@ -151,7 +149,7 @@ namespace Kernel {
 	/**
 	 * End blocking of a stopped thread
 	 *
-	 * \param thread_id  capability id of the targeted thread
+	 * \param thread_id  capability ID of the targeted thread
 	 *
 	 * \return  wether the thread was stopped beforehand
 	 *
@@ -164,9 +162,9 @@ namespace Kernel {
 
 
 	/**
-	 * Yield the callers remaining CPU time for this super period
+	 * Yield the caller's remaining CPU time for this super period
 	 *
-	 * Does its best that the caller is scheduled as few as possible in the
+	 * Tell the kernel to schedule the caller as little as possible in the
 	 * current scheduling super-period without touching the thread or pause
 	 * state of the thread. In the next superperiod, however, the thread is
 	 * scheduled 'normal' again. The syscall is not core-restricted and always
@@ -217,25 +215,25 @@ namespace Kernel {
 
 
 	/**
-	 * Send request message and await receipt of corresponding reply message
+	 * Send request message and await reception of corresponding reply message
 	 *
-	 * \param thread_id  capability id of targeted thread
+	 * \param thread_id  capability ID of targeted thread
 	 *
 	 * \retval  0  succeeded
 	 * \retval -1  failed
 	 * \retval -2  failed due to out-of-memory for capability reception
 	 *
 	 * If the call returns successful, the received message is located at the
-	 * base of the callers userland thread-context.
+	 * base of the caller's userland thread-context.
 	 */
 	inline int send_request_msg(capid_t const thread_id, unsigned rcv_caps)
 	{
-		return call(call_id_send_request_msg(), thread_id, rcv_caps);
+		return (int)call(call_id_send_request_msg(), thread_id, rcv_caps);
 	}
 
 
 	/**
-	 * Await receipt of request message
+	 * Await reception of request message
 	 *
 	 * \param rcv_caps number of capabilities willing to accept
 	 *
@@ -243,37 +241,37 @@ namespace Kernel {
 	 * \retval -1  canceled
 	 * \retval -2  failed due to out-of-memory for capability reception
 	 *
-	 * If the call returns successful, the received message is located at the
-	 * base of the callers userland thread-context.
+	 * If the call returns successfully, the received message is located at the
+	 * base of the caller's userland thread-context.
 	 */
 	inline int await_request_msg(unsigned rcv_caps)
 	{
-		return call(call_id_await_request_msg(), rcv_caps);
+		return (int)call(call_id_await_request_msg(), rcv_caps);
 	}
 
 
 	/**
-	 * Reply to lastly received request message
+	 * Reply to previously received request message
 	 *
 	 * \param rcv_caps number of capabilities to accept when awaiting again
-	 * \param await_request_msg  wether the call shall await a request message
+	 * \param await_request_msg  whether the call shall await a request message
 	 *
-	 * \retval  0  await_request_msg == 0 or request-message receipt succeeded
-	 * \retval -1  await_request_msg == 1 and request-message receipt failed
+	 * \retval  0  await_request_msg == 0 or request-message received
+	 * \retval -1  await_request_msg == 1 and request-message failed
 	 *
 	 * If the call returns successful and await_request_msg == 1, the received
-	 * message is located at the base of the callers userland thread-context.
+	 * message is located at the base of the caller's userland thread context.
 	 */
 	inline int send_reply_msg(unsigned rcv_caps, bool const await_request_msg)
 	{
-		return call(call_id_send_reply_msg(), rcv_caps, await_request_msg);
+		return (int)call(call_id_send_reply_msg(), rcv_caps, await_request_msg);
 	}
 
 
 	/**
-	 * Print a char c to the kernels serial ouput
+	 * Print a char c to the kernel's serial ouput
 	 *
-	 * If c is set to 0 the kernel prints a table of all threads and their
+	 * If 'c' is set to 0 the kernel prints a table of all threads and their
 	 * current activities to the serial output.
 	 */
 	inline void print_char(char const c)
@@ -285,13 +283,13 @@ namespace Kernel {
 	/**
 	 * Await any context of a receiver and optionally ack a context before
 	 *
-	 * \param receiver_id  capability id of the targeted signal receiver
+	 * \param receiver_id  capability ID of the targeted signal receiver
 	 *
 	 * \retval  0  suceeded
 	 * \retval -1  failed
 	 *
 	 * If this call returns 0, an instance of 'Signal::Data' is located at the
-	 * base of the callers UTCB. Every occurence of a signal is provided
+	 * base of the caller's UTCB. Every occurence of a signal is provided
 	 * through this function until it gets delivered through this function or
 	 * context respectively receiver get destructed. If multiple threads
 	 * listen at the same receiver, and/or multiple contexts of the receiver
@@ -302,7 +300,7 @@ namespace Kernel {
 	 */
 	inline int await_signal(capid_t const receiver_id)
 	{
-		return call(call_id_await_signal(), receiver_id);
+		return (int)call(call_id_await_signal(), receiver_id);
 	}
 
 
@@ -310,7 +308,7 @@ namespace Kernel {
 	 * Check for any pending signal of a context of a receiver the calling
 	 * thread relates to
 	 *
-	 * \param receiver_id  capability id of the targeted signal receiver
+	 * \param receiver_id  capability ID of the targeted signal receiver
 	 *
 	 * \retval  0  suceeded
 	 * \retval -1  failed
@@ -320,14 +318,14 @@ namespace Kernel {
 	 */
 	inline int pending_signal(capid_t const receiver_id)
 	{
-		return call(call_id_pending_signal(), receiver_id);
+		return (int)call(call_id_pending_signal(), receiver_id);
 	}
 
 
 	/**
 	 * Request to cancel the next signal blocking of a local thread
 	 *
-	 * \param thread_id  capability id of the targeted thread
+	 * \param thread_id  capability ID of the targeted thread
 	 *
 	 * Does not block. Targeted thread must be in the same PD as the caller.
 	 * If the targeted thread is in a signal blocking, cancels the blocking
@@ -344,7 +342,7 @@ namespace Kernel {
 	/**
 	 * Trigger a specific signal context
 	 *
-	 * \param context  capability id of the targeted signal context
+	 * \param context  capability ID of the targeted signal context
 	 * \param num      how often the context shall be triggered by this call
 	 *
 	 * \retval  0  suceeded
@@ -352,14 +350,14 @@ namespace Kernel {
 	 */
 	inline int submit_signal(capid_t const context, unsigned const num)
 	{
-		return call(call_id_submit_signal(), context, num);
+		return (int)call(call_id_submit_signal(), context, num);
 	}
 
 
 	/**
 	 * Acknowledge the processing of the last delivery of a signal context
 	 *
-	 * \param context  capability id of the targeted signal context
+	 * \param context  capability ID of the targeted signal context
 	 */
 	inline void ack_signal(capid_t const context)
 	{
@@ -370,20 +368,20 @@ namespace Kernel {
 	/**
 	 * Halt processing of a signal context synchronously
 	 *
-	 * \param context  capability id of the targeted signal context
+	 * \param context  capability ID of the targeted signal context
 	 *
 	 * \retval  0  suceeded
 	 * \retval -1  failed
 	 */
 	inline int kill_signal_context(capid_t const context)
 	{
-		return call(call_id_kill_signal_context(), context);
+		return (int)call(call_id_kill_signal_context(), context);
 	}
 
 	/**
 	 * Acknowledge reception of a capability
 	 *
-	 * \param cap  capability id to acknowledge
+	 * \param cap  capability ID to acknowledge
 	 */
 	inline void ack_cap(capid_t const cap)
 	{
@@ -391,9 +389,9 @@ namespace Kernel {
 	}
 
 	/**
-	 * Delete a capability id
+	 * Delete a capability ID
 	 *
-	 * \param cap  capability id to delete
+	 * \param cap  capability ID to delete
 	 */
 	inline void delete_cap(capid_t const cap)
 	{
@@ -404,7 +402,7 @@ namespace Kernel {
 	/**
 	 * Execute a virtual-machine (again)
 	 *
-	 * \param vm  pointer to vm kernel object
+	 * \param vm  pointer to VM kernel object
 	 */
 	inline void run_vm(capid_t const cap)
 	{
@@ -415,7 +413,7 @@ namespace Kernel {
 	/**
 	 * Stop execution of a virtual-machine
 	 *
-	 * \param vm  pointer to vm kernel object
+	 * \param vm  pointer to VM kernel object
 	 */
 	inline void pause_vm(capid_t const cap)
 	{

repos/base-hw/include/kernel/types.h

@@ -14,8 +14,8 @@
 #ifndef _KERNEL__TYPES_H_
 #define _KERNEL__TYPES_H_
 
-/* base-hw includes */
-#include <kernel/interface_support.h>
+/* Genode includes */
+#include <base/stdint.h>
 
 namespace Kernel {
 
@@ -25,6 +25,11 @@ namespace Kernel {
 	using time_t    = Genode::uint64_t;
 	using timeout_t = Genode::uint32_t;
 
+	using Call_arg  = Genode::umword_t;
+	using Call_ret  = Genode::umword_t;
+
+	using Call_ret_64 = Genode::uint64_t;
+
 	constexpr capid_t cap_id_invalid() { return 0; }
 }
 

repos/base-hw/include/spec/arm/kernel/interface_support.h

@@ -1,26 +0,0 @@
-/*
- * \brief  Interface between kernel and userland
- * \author Martin Stein
- * \date   2011-11-30
- */
-
-/*
- * Copyright (C) 2011-2017 Genode Labs GmbH
- *
- * This file is part of the Genode OS framework, which is distributed
- * under the terms of the GNU Affero General Public License version 3.
- */
-
-#ifndef _INCLUDE__SPEC__ARM__KERNEL__INTERFACE_SUPPORT_H_
-#define _INCLUDE__SPEC__ARM__KERNEL__INTERFACE_SUPPORT_H_
-
-/* Genode includes */
-#include <base/stdint.h>
-
-namespace Kernel {
-	typedef Genode::uint32_t Call_arg;
-	typedef Genode::uint32_t Call_ret;
-	typedef Genode::uint64_t Call_ret_64;
-}
-
-#endif /* _INCLUDE__SPEC__ARM__KERNEL__INTERFACE_SUPPORT_H_ */

repos/base-hw/include/spec/arm_64/kernel/interface_support.h

@@ -1,26 +0,0 @@
-/*
- * \brief  Interface between kernel and userland
- * \author Stefan Kalkowski
- * \date   2019-05-09
- */
-
-/*
- * Copyright (C) 2019 Genode Labs GmbH
- *
- * This file is part of the Genode OS framework, which is distributed
- * under the terms of the GNU Affero General Public License version 3.
- */
-
-#ifndef _INCLUDE__SPEC__ARM_64__KERNEL__INTERFACE_SUPPORT_H_
-#define _INCLUDE__SPEC__ARM_64__KERNEL__INTERFACE_SUPPORT_H_
-
-/* Genode includes */
-#include <base/stdint.h>
-
-namespace Kernel {
-	typedef Genode::uint64_t Call_arg;
-	typedef Genode::uint64_t Call_ret;
-	typedef Genode::uint64_t Call_ret_64;
-}
-
-#endif /* _INCLUDE__SPEC__ARM_64__KERNEL__INTERFACE_SUPPORT_H_ */

repos/base-hw/include/spec/riscv/kernel/interface_support.h

@@ -1,26 +0,0 @@
-/*
- * \brief  Interface between kernel and userland
- * \author Sebastian Sumpf
- * \date   2015-06-02
- */
-
-/*
- * Copyright (C) 2015-2017 Genode Labs GmbH
- *
- * This file is part of the Genode OS framework, which is distributed
- * under the terms of the GNU Affero General Public License version 3.
- */
-
-#ifndef _KERNEL__INTERFACE_SUPPORT_H_
-#define _KERNEL__INTERFACE_SUPPORT_H_
-
-/* Genode includes */
-#include <base/stdint.h>
-
-namespace Kernel {
-	typedef Genode::uint64_t Call_arg;
-	typedef Genode::uint64_t Call_ret;
-	typedef Genode::uint64_t Call_ret_64;
-}
-
-#endif /* _KERNEL__INTERFACE_SUPPORT_H_ */

repos/base-hw/include/spec/x86_64/kernel/interface_support.h

@@ -1,26 +0,0 @@
-/*
- * \brief  Interface between kernel and userland
- * \author Reto Buerki
- * \date   2015-02-06
- */
-
-/*
- * Copyright (C) 2015-2017 Genode Labs GmbH
- *
- * This file is part of the Genode OS framework, which is distributed
- * under the terms of the GNU Affero General Public License version 3.
- */
-
-#ifndef _INCLUDE__SPEC__X86_64__KERNEL__INTERFACE_SUPPORT_H_
-#define _INCLUDE__SPEC__X86_64__KERNEL__INTERFACE_SUPPORT_H_
-
-/* Genode includes */
-#include <base/stdint.h>
-
-namespace Kernel {
-	typedef Genode::uint64_t Call_arg;
-	typedef Genode::uint64_t Call_ret;
-	typedef Genode::uint64_t Call_ret_64;
-}
-
-#endif /* _INCLUDE__SPEC__X86_64__KERNEL__INTERFACE_SUPPORT_H_ */

repos/base-hw/lib/mk/bootstrap-hw.inc

@@ -38,3 +38,5 @@ vpath hw/%          $(BASE_HW_DIR)/src/lib
 vpath lib/base/%    $(BASE_HW_DIR)/src
 vpath lib/base/%    $(BASE_DIR)/src
 vpath lib/startup/% $(BASE_DIR)/src
+
+CC_CXX_WARN_STRICT_CONVERSION =

repos/base-hw/lib/mk/spec/arm_v6/bootstrap-hw-rpi.mk

@@ -1,8 +0,0 @@
-REP_INC_DIR += src/bootstrap/board/rpi
-
-SRC_CC  += bootstrap/board/rpi/platform.cc
-SRC_CC  += bootstrap/spec/arm/arm_v6_cpu.cc
-SRC_CC  += hw/spec/32bit/memory_map.cc
-SRC_S   += bootstrap/spec/arm/crt0.s
-
-include $(call select_from_repositories,lib/mk/bootstrap-hw.inc)

repos/base-hw/lib/mk/spec/arm_v6/core-hw-rpi.mk

@@ -1,16 +0,0 @@
-#
-# \brief  Build config for Genodes core process
-# \author Norman Feske
-# \date   2013-04-05
-#
-
-# add include paths
-REP_INC_DIR += src/core/board/rpi
-
-# add C++ sources
-SRC_CC += platform_services.cc
-SRC_CC += spec/arm/bcm2835_pic.cc
-SRC_CC += spec/arm/bcm2835_system_timer.cc
-
-# include less specific configuration
-include $(call select_from_repositories,lib/mk/spec/arm_v6/core-hw.inc)

repos/base-hw/lib/mk/spec/arm_v6/core-hw.inc

@@ -1,20 +0,0 @@
-#
-# \brief  Build config for Genodes core process
-# \author Martin Stein
-# \author Stefan Kalkowski
-# \date   2012-10-04
-#
-
-# add include paths
-REP_INC_DIR += src/core/spec/arm_v6
-
-# add C++ sources
-SRC_CC += spec/arm_v6/perf_counter.cc
-SRC_CC += kernel/vm_thread_off.cc
-SRC_CC += kernel/cpu_up.cc
-SRC_CC += kernel/lock.cc
-
-SRC_S  += spec/arm/vfpv2.s
-
-# include less specific configuration
-include $(call select_from_repositories,lib/mk/spec/arm/core-hw.inc)

repos/base-hw/lib/mk/spec/arm_v7/bootstrap-hw-zynq_qemu.mk

@@ -1,14 +0,0 @@
-REP_INC_DIR += src/bootstrap/board/zynq_qemu
-
-SRC_S   += bootstrap/spec/arm/crt0.s
-
-SRC_CC  += bootstrap/board/zynq_qemu/platform.cc
-SRC_CC  += bootstrap/spec/arm/cpu.cc
-SRC_CC  += bootstrap/spec/arm/cortex_a9_mmu.cc
-SRC_CC  += bootstrap/spec/arm/gicv2.cc
-SRC_CC  += bootstrap/spec/arm/arm_v7_cpu.cc
-SRC_CC  += hw/spec/32bit/memory_map.cc
-
-NR_OF_CPUS = 1
-
-include $(call select_from_repositories,lib/mk/bootstrap-hw.inc)

repos/base-hw/lib/mk/spec/arm_v7/core-hw-imx53_qsb.inc

@@ -1,16 +1,8 @@
-#
-# \brief  Build config for Genodes core process
-# \author Stefan Kalkowski
-# \author Martin Stein
-# \date   2012-10-24
-#
-
-# add include paths
 REP_INC_DIR += src/core/board/imx53_qsb
 
 SRC_CC += spec/arm/imx_epit.cc
 SRC_CC += spec/arm/imx_tzic.cc
 
-# include less specific configuration
 include $(call select_from_repositories,lib/mk/spec/cortex_a8/core-hw.inc)
 
+CC_CXX_WARN_STRICT_CONVERSION =

repos/base-hw/lib/mk/spec/arm_v7/core-hw-imx53_qsb_tz.mk

@@ -11,4 +11,3 @@ SRC_S += spec/arm_v7/trustzone/exception_vector.s
 
 # include less specific configuration
 include $(call select_from_repositories,lib/mk/spec/arm_v7/core-hw-imx53_qsb.inc)
-

repos/base-hw/lib/mk/spec/arm_v7/core-hw-virt_qemu.mk

@@ -16,6 +16,6 @@ SRC_S += spec/arm_v7/virtualization/exception_vector.s
 
 NR_OF_CPUS = 2
 
-CC_MARCH = -march=armv7ve -mtune=cortex-a15 -mfpu=vfpv3 -mfloat-abi=soft
+CC_MARCH = -march=armv7ve -mtune=cortex-a15 -mfpu=vfpv3 -mfloat-abi=softfp
 
 include $(call select_from_repositories,lib/mk/spec/cortex_a15/core-hw.inc)

repos/base-hw/lib/mk/spec/arm_v7/core-hw-zynq.inc

@@ -1,11 +0,0 @@
-#
-# \brief  Build config for Genodes core process
-# \author Johannes Schlatow
-# \date   2014-12-15
-#
-
-# add C++ sources
-SRC_CC += platform_services.cc
-
-# include less specific configuration
-include $(call select_from_repositories,lib/mk/spec/cortex_a9/core-hw.inc)

repos/base-hw/lib/mk/spec/arm_v7/core-hw-zynq_qemu.mk

@@ -1,13 +0,0 @@
-#
-# \brief  Build config for Genodes core process
-# \author Johannes Schlatow
-# \date   2014-12-15
-#
-
-# add include paths
-REP_INC_DIR += src/core/board/zynq_qemu
-
-NR_OF_CPUS = 1
-
-# include less specific configuration
-include $(call select_from_repositories,lib/mk/spec/arm_v7/core-hw-zynq.inc)

repos/base-hw/lib/mk/spec/arm_v8/bootstrap-hw-imx8q_evk.mk

@@ -1,14 +0,0 @@
-REP_INC_DIR += src/bootstrap/board/imx8q_evk
-
-SRC_CC  += bootstrap/board/imx8q_evk/platform.cc
-SRC_CC  += bootstrap/spec/arm/gicv3.cc
-SRC_CC  += bootstrap/spec/arm_64/cortex_a53_mmu.cc
-SRC_CC  += lib/base/arm_64/kernel/interface.cc
-SRC_CC  += spec/64bit/memory_map.cc
-SRC_S   += bootstrap/spec/arm_64/crt0.s
-
-NR_OF_CPUS = 4
-
-vpath spec/64bit/memory_map.cc $(call select_from_repositories,src/lib/hw)
-
-include $(call select_from_repositories,lib/mk/bootstrap-hw.inc)

repos/base-hw/lib/mk/spec/arm_v8/bootstrap-hw-rpi3.mk

@@ -1,13 +0,0 @@
-REP_INC_DIR += src/bootstrap/board/rpi3
-
-SRC_CC  += bootstrap/spec/arm_64/cortex_a53_mmu.cc
-SRC_CC  += bootstrap/board/rpi3/platform.cc
-SRC_CC  += lib/base/arm_64/kernel/interface.cc
-SRC_CC  += spec/64bit/memory_map.cc
-SRC_S   += bootstrap/spec/arm_64/crt0.s
-
-NR_OF_CPUS = 4
-
-vpath spec/64bit/memory_map.cc $(call select_from_repositories,src/lib/hw)
-
-include $(call select_from_repositories,lib/mk/bootstrap-hw.inc)

repos/base-hw/lib/mk/spec/arm_v8/core-hw-imx8q_evk.mk

@@ -1,19 +0,0 @@
-REP_INC_DIR += src/core/board/imx8q_evk
-REP_INC_DIR += src/core/spec/arm/virtualization
-
-# add C++ sources
-SRC_CC += kernel/vm_thread_on.cc
-SRC_CC += spec/arm/gicv3.cc
-SRC_CC += spec/arm_v8/virtualization/kernel/vm.cc
-SRC_CC += spec/arm/virtualization/platform_services.cc
-SRC_CC += spec/arm/virtualization/vm_session_component.cc
-SRC_CC += vm_session_common.cc
-SRC_CC += vm_session_component.cc
-
-#add assembly sources
-SRC_S += spec/arm_v8/virtualization/exception_vector.s
-
-NR_OF_CPUS = 4
-
-# include less specific configuration
-include $(call select_from_repositories,lib/mk/spec/arm_v8/core-hw.inc)

repos/base-hw/lib/mk/spec/arm_v8/core-hw-rpi3.mk

@@ -1,11 +0,0 @@
-REP_INC_DIR += src/core/board/rpi3
-
-# add C++ sources
-SRC_CC += kernel/vm_thread_off.cc
-SRC_CC += platform_services.cc
-SRC_CC += spec/arm/bcm2837_pic.cc
-
-NR_OF_CPUS = 4
-
-# include less specific configuration
-include $(call select_from_repositories,lib/mk/spec/arm_v8/core-hw.inc)

repos/base-hw/lib/mk/spec/cortex_a15/core-hw.inc

@@ -11,3 +11,5 @@ SRC_CC += spec/arm/kernel/lock.cc
 
 # include less specific configuration
 include $(call select_from_repositories,lib/mk/spec/arm_v7/core-hw.inc)
+
+CC_CXX_WARN_STRICT_CONVERSION =

repos/base-hw/lib/mk/spec/cortex_a8/core-hw.inc

@@ -12,3 +12,5 @@ NR_OF_CPUS = 1
 
 # include less specific configuration
 include $(call select_from_repositories,lib/mk/spec/arm_v7/core-hw.inc)
+
+CC_CXX_WARN_STRICT_CONVERSION =

repos/base-hw/lib/mk/spec/cortex_a9/core-hw.inc

@@ -15,3 +15,5 @@ SRC_CC += kernel/cpu_mp.cc
 
 # include less specific configuration
 include $(call select_from_repositories,lib/mk/spec/arm_v7/core-hw.inc)
+
+CC_CXX_WARN_STRICT_CONVERSION =

repos/base-hw/lib/mk/spec/riscv/bootstrap-hw-riscv_qemu.mk

@@ -1,10 +0,0 @@
-INC_DIR += $(REP_DIR)/src/bootstrap/board/riscv_qemu
-
-SRC_CC  += bootstrap/spec/riscv/platform.cc
-SRC_S   += bootstrap/spec/riscv/crt0.s
-SRC_CC  += lib/base/riscv/kernel/interface.cc
-SRC_CC  += spec/64bit/memory_map.cc
-
-vpath spec/64bit/memory_map.cc $(REP_DIR)/src/lib/hw
-
-include $(REP_DIR)/lib/mk/bootstrap-hw.inc

repos/base-hw/lib/mk/spec/riscv/core-hw-riscv_qemu.mk

@@ -1,27 +0,0 @@
-REP_INC_DIR += src/core/spec/riscv src/core/board/riscv_qemu
-
-CC_OPT += -fno-delete-null-pointer-checks
-
-# add C++ sources
-SRC_CC += platform_services.cc
-SRC_CC += kernel/vm_thread_off.cc
-SRC_CC += kernel/cpu_up.cc
-SRC_CC += kernel/lock.cc
-SRC_CC += spec/riscv/kernel/thread.cc
-SRC_CC += spec/riscv/kernel/cpu.cc
-SRC_CC += spec/riscv/kernel/interface.cc
-SRC_CC += spec/riscv/kernel/pd.cc
-SRC_CC += spec/riscv/cpu.cc
-SRC_CC += spec/riscv/pic.cc
-SRC_CC += spec/riscv/platform_support.cc
-SRC_CC += spec/riscv/timer.cc
-SRC_CC += spec/64bit/memory_map.cc
-
-#add assembly sources
-SRC_S += spec/riscv/exception_vector.s
-SRC_S += spec/riscv/crt0.s
-
-vpath spec/64bit/memory_map.cc $(call select_from_repositories,src/lib/hw)
-
-# include less specific configuration
-include $(call select_from_repositories,lib/mk/core-hw.inc)

repos/base-hw/recipes/api/base-hw/hash

@@ -1 +1 @@
-2021-10-13 e4a9e369a9c321759fdc73d5e2b2b9ac1e2d7795
+2022-02-27 86bd429179fd08dcb42e5fe852040d7e2785f4fb

repos/base-hw/recipes/src/base-hw-imx53_qsb/hash

@@ -1 +1 @@
-2021-10-13 11943f5bc31d6ebd43c67e008cf12cc7e2ca2934
+2022-04-12 97ecc02ab7544f8b8bad04a2d23178ce0f14f566

repos/base-hw/recipes/src/base-hw-imx53_qsb_tz/hash

@@ -1 +1 @@
-2021-10-13 69215f704c6797b15bcacfc11a2709d5b65019e9
+2022-04-12 46afb000e6e14e6580e66f489891b14ea7765ddc

repos/base-hw/recipes/src/base-hw-imx6q_sabrelite/hash

@@ -1 +1 @@
-2021-10-13 78f942508805ec6afc8d75550d5b67f38664b5f6
+2022-04-12 2dcfe4b1dc0cf006c4c2acbcfb6b72fcf8e50890

repos/base-hw/recipes/src/base-hw-imx7d_sabre/hash

@@ -1 +1 @@
-2021-10-13 85df38295bad953fc194078cc22d31f1acfa4c08
+2022-04-12 90a97e63f9870468b957b2493a6c433dd5b0a64c

repos/base-hw/recipes/src/base-hw-imx8q_evk/content.mk

@@ -1 +0,0 @@
-include $(GENODE_DIR)/repos/base-hw/recipes/src/base-hw_content.inc

repos/base-hw/recipes/src/base-hw-imx8q_evk/hash

@@ -1 +0,0 @@
-2021-10-13 e23737af156d1967b1d59c690b62f5538856a85c

repos/base-hw/recipes/src/base-hw-imx8q_evk/used_apis

@@ -1,2 +0,0 @@
-base-hw
-base

repos/base-hw/recipes/src/base-hw-nit6_solox/hash

@@ -1 +1 @@
-2021-10-13 cf4e82d22cc8f343aa16f5b996e4cf3cc9608d69
+2022-04-12 1eb2a74c06a2130d39d57edcb31e19365e1ee2d9

repos/base-hw/recipes/src/base-hw-pbxa9/hash

@@ -1 +1 @@
-2021-10-13 ec5754c900404b3d4e1594fa5e36630afb58df0e
+2022-04-12 d562748afbe8ef29883d33de8c2c63740a3adc30

repos/base-hw/recipes/src/base-hw-pc/hash

@@ -1 +1 @@
-2021-10-13 910b8cd795a9326fc0b3fcd9afef8d35abd60c8b
+2022-04-12 0af1ada2933e4af5b0d07c8586f39f60d31d68f9

repos/base-hw/recipes/src/base-hw-riscv_qemu/content.mk

@@ -1 +0,0 @@
-include $(GENODE_DIR)/repos/base-hw/recipes/src/base-hw_content.inc