Support fork in LiteBox userland

litebox/src/broker/mod.rs

@@ -19,8 +19,8 @@ use litebox_broker_protocol::fs::{
 };
 use litebox_broker_protocol::pipe::{CreatePipeResponse, MAX_PIPE_TRANSFER_SIZE};
 use litebox_broker_protocol::process::{
-    CreatedProcess, MAX_CHILD_OBJECT_DUPLICATES, MAX_PROCESS_BOOTSTRAP_SIZE, ProcessExitStatus,
-    ProcessTermination,
+    CreatedProcess, MAX_CHILD_MEMORY_WRITE_SIZE, MAX_CHILD_OBJECT_DUPLICATES,
+    MAX_PROCESS_BOOTSTRAP_SIZE, ProcessExitStatus, ProcessTermination,
 };
 use litebox_broker_protocol::random::MAX_RANDOM_TRANSFER_SIZE;
 use litebox_broker_protocol::readiness::ReadinessFlags;
@@ -62,6 +62,13 @@ pub(crate) trait BrokerControl: Send + Sync {
         payload: &[u8],
     ) -> core::result::Result<(), BrokerControlError>;
 
+    fn write_child_memory(
+        &self,
+        child_process_id: litebox_broker_protocol::ProcessId,
+        offset: u64,
+        data: &[u8],
+    ) -> core::result::Result<(), BrokerControlError>;
+
     fn exit_child_process(
         &self,
         child_process_id: litebox_broker_protocol::ProcessId,
@@ -523,6 +530,21 @@ where
         })
     }
 
+    fn write_child_memory(
+        &self,
+        child_process_id: litebox_broker_protocol::ProcessId,
+        offset: u64,
+        data: &[u8],
+    ) -> core::result::Result<(), BrokerControlError> {
+        if data.is_empty() || data.len() > MAX_CHILD_MEMORY_WRITE_SIZE as usize {
+            return Err(BrokerControlError::Broker(ErrorCode::ResourceExhausted));
+        }
+        let lease = self.acquire_shared_buffer(data.len())?;
+        self.request(|local| {
+            local.write_child_memory(child_process_id, offset, lease.sequence(), data)
+        })
+    }
+
     fn exit_child_process(
         &self,
         child_process_id: litebox_broker_protocol::ProcessId,

litebox/src/event/wait.rs

@@ -412,15 +412,20 @@ impl<'a, Platform: RawSyncPrimitivesProvider + TimeProvider> WaitContext<'a, Pla
         // Check for timeout before checking for an interrupt. This is important
         // for things like sleep(), where we want to return `TimedOut` rather than
         // `Interrupted` if the deadline has already passed.
+        if self.deadline.is_some() && self.remaining_timeout().is_none() {
+            return Err(WaitError::TimedOut);
+        }
+        if self.check_interrupt.check_for_interrupt() {
+            return Err(WaitError::Interrupted);
+        }
+
+        // The interrupt check may block (for example, while another thread
+        // pauses this one), so compute the remaining timeout after it.
         let timeout = if self.deadline.is_some() {
             Some(self.remaining_timeout().ok_or(WaitError::TimedOut)?)
         } else {
             None
         };
-        if self.check_interrupt.check_for_interrupt() {
-            return Err(WaitError::Interrupted);
-        }
-
         if let Some(timeout) = timeout {
             let r = self
                 .waker

litebox/src/platform/page_mgmt.rs

@@ -124,6 +124,14 @@ pub trait PageManagementProvider<const ALIGN: usize>: RawPointerProvider {
     ///
     /// Note it must be aligned to `ALIGN`.
     const TASK_ADDR_MAX: usize;
+    /// The upper bound (exclusive) for addresses that the memory manager chooses itself.
+    ///
+    /// Mappings at caller-specified fixed addresses may still extend up to
+    /// [`Self::TASK_ADDR_MAX`]. Platforms whose host allocates in the upper part of the task
+    /// range can lower this to keep self-placed task memory clear of host memory.
+    ///
+    /// Note it must be aligned to `ALIGN` and greater than [`Self::TASK_ADDR_MIN`].
+    const PLACEMENT_ADDR_MAX: usize = Self::TASK_ADDR_MAX;
 
     /// Alignment of native reservation base addresses, in bytes.
     ///

litebox/src/process.rs

@@ -8,7 +8,9 @@ use alloc::sync::Arc;
 use alloc::vec::Vec;
 
 use litebox_broker_protocol::error::ErrorCode;
-use litebox_broker_protocol::process::{ProcessExitStatus, ProcessIdentity, ProcessTermination};
+use litebox_broker_protocol::process::{
+    MAX_CHILD_MEMORY_WRITE_SIZE, ProcessExitStatus, ProcessIdentity, ProcessTermination,
+};
 use litebox_broker_protocol::signal::PendingSignal;
 use litebox_broker_protocol::{ObjectHandle, ProcessId};
 use litebox_platform::time::TimeProvider;
@@ -231,6 +233,22 @@ impl<Platform: RawSyncPrimitivesProvider + TimeProvider> Process<Platform> {
             .collect())
     }
 
+    /// Writes `data` at `offset` of this pending child process's memory image,
+    /// which the child's runner receives when the child starts.
+    ///
+    /// The image is zero-filled where nothing was written.
+    pub fn write_memory(&self, offset: u64, data: &[u8]) -> Result<(), ProcessError> {
+        let mut offset = offset;
+        for chunk in data.chunks(MAX_CHILD_MEMORY_WRITE_SIZE as usize) {
+            self.broker
+                .write_child_memory(self.identity.process_id, offset, chunk)?;
+            offset = offset
+                .checked_add(chunk.len() as u64)
+                .ok_or(ProcessError::ResourceExhausted)?;
+        }
+        Ok(())
+    }
+
     /// Records that this pending child process exited without starting a
     /// runner, leaving it a zombie reporting `exit_status`.
     pub fn exit(&self, exit_status: ProcessExitStatus) -> Result<(), ProcessError> {

litebox_broker_core/src/lib.rs

@@ -39,7 +39,7 @@ mod test_platform;
 pub mod test_support;
 
 use alloc::sync::{Arc, Weak};
-use core::sync::atomic::{AtomicBool, AtomicUsize, Ordering};
+use core::sync::atomic::{AtomicBool, AtomicU64, AtomicUsize, Ordering};
 
 use hashbrown::HashMap;
 use litebox_broker_protocol::{ObjectHandle, ProcessId};
@@ -55,7 +55,8 @@ pub use policy::{
     PolicyProfile, SocketPolicy, SocketPolicyError,
 };
 pub use process::{
-    AssociationCancellation, BrokerProcess, CallerCredential, ProcessLifecycleSink, ProcessShutdown,
+    AssociationCancellation, BrokerProcess, CallerCredential, ChildImage, ProcessImage,
+    ProcessLifecycleSink, ProcessShutdown,
 };
 use random::RandomProvider;
 use socket::{BrokerSocketPorts, SocketProvider};
@@ -87,6 +88,10 @@ pub struct BrokerCoreLimits {
     pub max_threads: usize,
     /// Maximum live broker-allocated thread IDs owned by one process.
     pub max_threads_per_process: usize,
+    /// Maximum size in bytes of one pending child's memory image.
+    pub max_child_image_size: u64,
+    /// Maximum total size in bytes of child memory images held by the broker.
+    pub max_total_child_image_size: u64,
 }
 
 impl BrokerCoreLimits {
@@ -101,6 +106,8 @@ impl BrokerCoreLimits {
         max_sockets_per_process: 256,
         max_threads: 4096,
         max_threads_per_process: 1024,
+        max_child_image_size: 1024 * 1024 * 1024,
+        max_total_child_image_size: 4 * 1024 * 1024 * 1024,
     };
 
     /// Creates a broker core limit set.
@@ -118,6 +125,8 @@ impl BrokerCoreLimits {
             max_sockets_per_process: Self::DEFAULT.max_sockets_per_process,
             max_threads: Self::DEFAULT.max_threads,
             max_threads_per_process: Self::DEFAULT.max_threads_per_process,
+            max_child_image_size: Self::DEFAULT.max_child_image_size,
+            max_total_child_image_size: Self::DEFAULT.max_total_child_image_size,
         }
     }
 
@@ -141,6 +150,8 @@ impl BrokerCoreLimits {
             max_sockets_per_process,
             max_threads: Self::DEFAULT.max_threads,
             max_threads_per_process: Self::DEFAULT.max_threads_per_process,
+            max_child_image_size: Self::DEFAULT.max_child_image_size,
+            max_total_child_image_size: Self::DEFAULT.max_total_child_image_size,
         }
     }
 
@@ -186,6 +197,24 @@ impl BrokerCoreLimits {
             ..self
         }
     }
+
+    /// Returns these limits with explicit per-child and broker-wide child
+    /// memory image size limits.
+    ///
+    /// A per-child limit above the broker-wide limit is accepted; the
+    /// broker-wide limit still applies.
+    #[must_use]
+    pub const fn with_child_image_size_limits(
+        self,
+        max_child_image_size: u64,
+        max_total_child_image_size: u64,
+    ) -> Self {
+        Self {
+            max_child_image_size,
+            max_total_child_image_size,
+            ..self
+        }
+    }
 }
 
 impl Default for BrokerCoreLimits {
@@ -212,6 +241,8 @@ pub struct BrokerCore {
     pub(crate) pending_references: Arc<AtomicUsize>,
     pub(crate) reserved_pipe_capacity: Arc<AtomicUsize>,
     pub(crate) reserved_sockets: Arc<AtomicUsize>,
+    /// Bytes of child memory images held by the broker.
+    pub(crate) reserved_child_image_size: Arc<AtomicU64>,
     pub(crate) random_provider: Arc<dyn RandomProvider>,
     pub(crate) socket_provider: Arc<dyn SocketProvider>,
     pub(crate) timer_provider: Arc<dyn TimerProvider>,
@@ -272,6 +303,7 @@ impl BrokerCore {
             pending_references: Arc::new(AtomicUsize::new(0)),
             reserved_pipe_capacity: Arc::new(AtomicUsize::new(0)),
             reserved_sockets: Arc::new(AtomicUsize::new(0)),
+            reserved_child_image_size: Arc::new(AtomicU64::new(0)),
             random_provider,
             socket_provider,
             timer_provider,