How to move AROS forward

[itix]

@HenryCase

One problem in memory protection is that applications and the operating system are sharing system structures. For example when you call OpenWindow() the system returns struct Window which is globally shared. If your application trashes this structure it may lead to crash of operating system.

The design of Amiga is unfortunately flawed for memory protection. One could say that on Amiga there is no user space and kernel space -- there is only kernel space where all applications are running.

[itix]

@HenryCase

Thanks for your reply itix. I looked into the OpenWindow() API call and I can't see anything that would prevent changing it from a global variable to a more local one.

Local in which way? Intuition reads and writes to this structure and application reads and writes to this structure. There is no way you could make it "local" and retain API compatibility.

If it is possible to implement a new kernel with MP that supports the OS3.1 API calls then we can have MP in an Amiga based OS.

If it was possible AROS would have implemented it already.

[itix]

@HenryCase

an you talk me through the way OpenWindow() is used in OS 3.1 so that I can look at creating this separation based on how it actually works and not my basic interpretation of Amiga API guides from the Internet.

Uhm... You can not learn it from API guides. Essentially because many actions are not done through API. For example windows can have UserPort. This is allocated by operating system or by application and sometimes there is no UserPort at all. Sometimes application creates its own UserPorts and pokes this into struct Window and Intuition starts using it when you call ModifyIDCMP(). To make things even more complex it is perfectly legal that application A opens a window, application B supplies UserPort to that window and application C manages this window (maybe drawing something). And then there is Intuition task called input.device which manages all windows. You can not assume anything about ownership of that window and its associated structures.

Similarly you can not know who is really going to use memory allocated by AllocMem() or malloc() (in the end malloc() calls AllocMem()). On Amiga you can share all memory allocated by AllocMem()/malloc(), you can even share your code and structures allocated from the stack. There is no absolutely privacy on Amiga. Everything you do is exposed to other applications and both applications and kernel exploit this.

Especially Kickstart 2.0 added many aspects to API which make adding MP even more difficult than it was for Kickstart 1.3.

I should also remind you that OpenWindow() is only one of those few hundred functions which should change to introduce memory protection. Even message passing system in Amiga is flawed in this sense.

To put it short Amiga API is completely broken and can not get fixed. If you want MP, that is

[itix]

@bloodline

No, not at all. AROS in fact implements resource tracking.

Does it also work? :-)

[itix]

The CPU has the ability to recognise an XOR opcode, and every other opcode it uses, and if part of an instruction isn't an opcode it is data. Therefore a CPU knows, after the 'decode' process, what is an opcode and what is an operand, correct? This requires just a yes or no answer.

It is not so simple. You must actually execute code to find out what is actually data and what is an opcode. It is not big problem, UAE does that when translating memory accesses to local memory space.

But this is not going to help you at all. Just like UAE, 68k processor (virtual or real one) does not care or know about operating systems. It is very difficult to find out when program is calling OpenWindow() and it is even more difficult to find out when that particular function returns.

You should try to disassemble some Amiga program and try to figure out where it is calling OpenWindow()... or figure out memory location where it stores struct Window.

[itix]

@HenryCase

Correct, I'm advocating making memory private by default. The 'finding out when sharing is neccessary' task I am trying to pass to humans.

The problem is, you dont get true memory protection. You only get partial memory protection which is already available for Amiga: Enforcer and MuForce tools.

Again everything which is passed between applications and kernel must be public memory. Using private memory in Amiga is useless because such memory can not be passed to kernel calls because you dont know what kernel does with it. You can not trust that library calls can handle private memory.

These topics have been discussed at least 15 years and yet nobody, ever, not even the best developers, could ever introduce anykind of solid idea for true memory protection. Amiga has its limits and we have to live with it.