CAmkES component termination

1

Hi,

I have a requirement to terminate a CAmkES component to ensure it stops and can never be restarted (apart from a system reboot). I know all resources used by the components tasks will not be recoverable. Is there a[n] [in]formal specification somewhere about the behaviour of a CAmkES control task when it terminates?

Thanks,
Zippy

2

Hi Zippy,

Do you want the component to be terminated remotely (ie from a separate component) or from within?

Does the components objects need to be reset (eg memory frames have their contents reset back to 0) or is it sufficient for all the threads to just be marked as inactive and never scheduled again?

Doing it internally, a component’s control thread could suspend all its other threads and then suspend itself. Because there’d be no more running threads in the camkes system with any capabilities referencing the stopped threads there’d be no way to restart them.

Doing it externally, another camkes component would need to be designed to have its own capabilities for all threads of the target component and also have its own threads assigned exclusively higher scheduling priorities than the target component. Then it could remotely stop the target component by suspending all of its threads. However you’d need to trust this component not to resume the threads again before reboot.

The current behavior of all camkes components is that:

  • if a camkes managed thread returns from its entry point function, then it will block on an internal notification object for the remainder of the system execution,
  • if a camkes managed thread calls exit() or abort(), then it’ll call seL4_TCB_Suspend() on it’s own TCB cap.
  • A non camkes managed thread (ie a thread internally created and started by a component from some untyped) will need some other way of being suspended.
3

Hi Kent,

Thanks for the quick reply.

I think you’re second bullet point covers our particular scenario.

Cheers,
Zippy

4

So calling exit/abort is enough to resolve your current situation?

5

Yes. But I will need to document how CAmkES framework satisfies how the “no restart after termination” requirement is met. In theory we could put in a check should a terminated component reappear and handle the failure condition - not sure how to do this yet but it might be feasible.