This new platform is NXP Semiconductor's Evaluation Kit for the i.MX 8M
Plus Applications Processor. It's from the i.MX 8M family of processors
and is largely similar to the existing i.MX 8M Quad and i.MX 8M Mini
platforms.
Signed-off-by: Damon Lee <damon@kry10.com>
Check for CONFIG_ENABLE_SMP_SUPPORT instead of checking for the
number in CONFIG_MAX_NUM_NODES. This allows enabling SMP support
with just one node also.
Signed-off-by: Axel Heider <axel.heider@codasip.com>
- fix: brackets in check
- fix: use CONFIG_ENABLE_SMP_SUPPORT
- conditions for CONFIG_MAX_NUM_NODES have been removed
Signed-off-by: Axel Heider <axel.heider@codasip.com>
Add a glossary with seL4-specific terms and their
definitions.
Remove chapter number from bibliography
Tweak Makefile for glossary
Signed-off-by: Birgit Brecknell <bbrcknl@gmail.com>
This way common error codes can be in their own file.
To use, add the xmlns:xi="http://www.w3.org/2001/XInclude
attribute to the top level node and use:
<xi:include href="file-to-include.xml"/>
The content of the file will be included verbatim.
Include files must be complete XML documents, but without
<?xml version="1.0" ?> at the top. Practically this means
all nodes within the file need to be contained in one root
element.
Caveat: There is no proper dependency for Xincludes files in
the Makefile, so you need to do make clean after changing an
included XML file!
Signed-off-by: Indan Zupancic <indan@nul.nu>
Currently the seL4_VCPUReg enum only defines the seL4_VCPUReg_VMPIDR_EL2
register when the kernel is configured for SMP. This register should be
available for unicore systems too as otherwise a user level VMM is not
able to control the value of MPIDR_EL1 that the guest VM reads.
Signed-off-by: Kent McLeod <kent@kry10.com>
Disambiguate (for the reader) between normal and mcs versions of
SetSpace in the manual. This does not yet solve doxygen confusion.
Signed-off-by: Gerwin Klein <gerwin.klein@proofcraft.systems>
Provide seL4_BootInfoFrameSize (and seL4_BootInfoFrameBits) for
userland, to there is no longer a need to hard-code the 4 KiByte
assumption.
Signed-off-by: Axel Heider <axelheider@gmx.de>
Additional header files may now be included in non-C contexts and so we
need to guard some C definitions with the __ASSEMBLER__ guards
convention.
Signed-off-by: Kent McLeod <kent@kry10.com>
Some slot positions in the rootnode would depend on configuration.
However that makes it difficult to add new root caps, especially if
multiple caps only exist based on configuration. Make all caps always
there, but null if not configured.
Signed-off-by: Robbie VanVossen <robert.vanvossen@dornerworks.com>
Now the vspace_cap is used for all vspace roots and all other page
tables are referred to by page table caps.
Signed-off-by: Kent McLeod <kent@kry10.com>
Guard the new implementation of 64-bit x86 guests behind a config
option. This is done so that existing projects that use x86_64 hosts
with ia32-bit guests can continue to be supported until either the old
feature is preferred to be deprecated, or support can be added to
support both simmultaneously.
Signed-off-by: Kent McLeod <kent@kry10.com>
This commit combines a number of smaller commits which do the following:
* Enter IA-32e mode when running a 64-bit host
* Handle additional general purpose registers in 64-bit mode
* Handle 64-bit specific MSR events
* Properly save and restore FS, GS, and Shadow GS registers
CCDC-GVSC DISTRIBUTION A. Approved for public release; distribution
unlimited. OPSEC#4481.
Signed-off-by: Gerwin Klein <gerwin.klein@proofcraft.systems>
__builtin_offsetof is not part of the verification C subset -- avoid
accidental use by not declaring a macro for it and filter out the
single use by explicitly marking it as invisible to verification.
Signed-off-by: Gerwin Klein <gerwin.klein@proofcraft.systems>
Add a `--form_file <file>` option to the bitfield generator for
printing a `/* generated from <file> */` message in a comment.
Use this option in cmake to provide the original source .bf file before
preprocessing so it's easier to find out where the corresponding
definitions are.
Signed-off-by: Gerwin Klein <gerwin.klein@proofcraft.systems>
This header file is shared by kernel and userland. We can control the
kernel compiler setting, but userland might use an arbitrary setup.
Put a safeguard in place that things works as expected.
Signed-off-by: Axel Heider <axelheider@gmx.de>
The "excluding extra refills" was confusing. seL4_CoreSchedContextBytes
is the size of sched_context_t + minimum refills, excluding any extra
refills.
We'd write it that way, but sched_context_t is not in scope in this
file.
Signed-off-by: Gerwin Klein <gerwin.klein@proofcraft.systems>
Currently, building `libsel4` as a static library with `KernelIsMCS`
enabled fails with the following error:
```
static declaration of 'seL4_NBWait' follows non-static declaration
```
This [was mentioned][1] in the original PR that modified exported
functions to use `LIBSEL4_INLINE_FUNC`.
[1]: https://github.com/seL4/seL4/pull/101#issuecomment-442010551
Signed-off-by: Klim Tsoutsman <klim@tsoutsman.com>
This adds support for the Pine64 Quartz64 and other devices based on
the Rockchip RK3566. The platform support is adapted from the
Rockpro64 code, except that the RK356x has A55 cores, and adjusting
for the fact that the ARM Generic Timer is the only on-chip timer
available.
Signed-off-by: Peter S. Housel <housel@acm.org>
This also adds a compile assert for checking that MinSchedContextBits
is the correct size in relation to seL4_CoreSchedContextBytes.
Signed-off-by: Michael McInerney <michael.mcinerney@proofcraft.systems>
Add a comment that they are empty on purpose. They are not removed to
keep the infrastructure in case there will be deprecated items in the
future.
Signed-off-by: Axel Heider <axelheider@gmx.de>
The MCS-related macros were causing the build to fail when configured to
use the sysenter instruction. Additionally, some message registers
weren't explicitly being passed to the assembly block for
seL4_NBSendRecv in this configuration.
Signed-off-by: Jimmy Brush <code@jimmah.com>
For writing/reading/copying TCB registers, the
arch_flags parameter is not used on RISC-V (in
addition to x86 and ARM).
Signed-off-by: Ivan Velickovic <i.velickovic@unsw.edu.au>
Now that there is no need to reserve page table entries in each VSpace
object, the full architecture specified address space range is usable.
Signed-off-by: Kent McLeod <kent@kry10.com>
The condition element currently exists parallel
to the condition attribute. The condition attribute
should be removed in a subsequent patch.
Signed-off-by: matt rice <ratmice@gmail.com>
This patch restricts mixed-content elements from ANY
to the various leaf nodes which are used.
This is intended to allow for easier parsing in languages with
no recursive datatypes like rust.
Since they no longer have to handle things like
'<description> text
<description>more text</description>
<description>'
which the dtd allowed for, but never used.
tested with:
for i in {libsel4/arch_include/*/interfaces/,\
libsel4/include/interfaces/,\
libsel4/sel4_arch_include/*/interfaces}/*.xml;
do
xmllint --noout --dtdvalid libsel4/tools/sel4_idl.dtd $i;
done
Signed-off-by: matt rice <ratmice@gmail.com>
This adds an alternative script for syscall_stub_gen.py
syscall_stub_gen_rs.py was initially derived from Robigalia project
which can be found here: https://gitlab.com/robigalia/sel4-sys
However, this is no longer compatible.
The script is intended to be used with a proper sel4-sys crate
in order to allow Rust applications to interface with the seL4 API.
Signed-off-by: Wojciech Sipak <wsipak@antmicro.com>
Signed-off-by: Karol Gugala <kgugala@antmicro.com>
This reverts a small part of 1596aa5857 which unexpectedly broke the
binary verification frontend, because the verification tool chain
forces the enum to `int` instead of `long`.
See also seL4 issue #738 -- when that issue is solved, we may be
able to go back to the more specific type.
Signed-off-by: Gerwin Klein <gerwin.klein@proofcraft.systems>
* use enum for SEL4_BOOTINFO_HEADER_xxx
Also add more comments and use seL4_BootInfoID in seL4_BootInfoHeader.
Signed-off-by: Axel Heider <axelheider@gmx.de>
Commit 8035f1a7c4 removed "-fno-integrated-as" for llvm, which on more
recent versions (clang-11) means that we now need `#` instead of `$`
for immediate values.
Signed-off-by: Gerwin Klein <gerwin.klein@proofcraft.systems>
Remove a userError that is present on mainline kernel but not on MCS.
seL4_ReplyRecv is often used in a loop to create an event handler. When
first entering this loop, or when handling signals from notifications,
there won't already be a pending caller blocked on the reply object. In
this case the kernel doesn't perform a reply transfer and continues with
the receive operation. This is a common operation and shouldn't result
in a userError being printed by the kernel each time the reply phase
ends up as a no-op.
Signed-off-by: Kent McLeod <kent@kry10.com>
Align the API wrapper guards with the kernel syscall implementation,
the function is available if CONFIG_ENABLE_SMP_SUPPORT is set instead
of depending on CONFIG_MAX_NUM_NODES.
Signed-off-by: Axel Heider <axelheider@gmx.de>
32-bit architectures have to share a small 4GiB address space between
privileged and non-privileged modes. Picking the address to split the
address space at affects how much virtual memory userlevel can use, and
how much physical memory the kernel can turn into untypeds. This is
something that should be configurable policy as different divisions make
sense for different applications. For now we only add the config
option to qemu-arm-virt to try it out before potentially adding it to
all 32-bit platforms.
Signed-off-by: Kent McLeod <kent@kry10.com>
Mutate cannot be used to badge endpoints (many years ago, before the
first public release, this was possible, but was removed).
Also explain why Mutate is not always replaceable with Mint+Delete.
Signed-off-by: Gerwin Klein <gerwin.klein@proofcraft.systems>
Add error conditions for the lazy bind of SchedContexts to
notifications or TCBs (introduced in e18e32e28e).
Signed-off-by: Gerwin Klein <gerwin.klein@proofcraft.systems>
- seL4_FailedLookup in X86IOPageTableMap
- seL4_FailedLookup in ARM page invalidation operations
- seL4_FailedLookup in ARMASIDPoolAssign
Signed-off-by: Jimmy Brush <code@jimmah.com>
- KernelGlobalsFrame caused the definition of seL4_GlobalsFrame which
was a reservation at the top of the user address space on ARMv6
platforms.
- KernelDangerousCodeInjectionOnUndefInstr was used to implement calling
user code in kernel mode won ARMv6.
Signed-off-by: Kent McLeod <kent@kry10.com>
The platform was the original verification target of seL4 over 10 years
ago and by now there doesn't appear to be any ways to obtain new
hardware.
Currently, the KZM platform is the only ARMv6 platform and supporting it
requires a few work-arounds for emulating mechanisms that newer hardware
supports. Removing this platform also implies removing armv6 support
soon.
Signed-off-by: Kent McLeod <kent@kry10.com>
In x86, EPT and normal mappings have different cache attributes. This
commit adds an enum for the EPT attributes.
Signed-off-by: Chris Guikema <chris.guikema@dornerworks.com>
Define CONFIG_KERNEL_LOG_BUFFER in the same way as all other kernel
config options so that it is present in autoconf.h
Signed-off-by: Kent McLeod <kent@kry10.com>
autoconf.h is expected to contain all defined config options for an seL4
build configuration. Having these redefinitions were leftover from when
the verification build system didn't produce an autoconf.h file and set
the config separately. Its more likely that these defaults would
incorrectly hide an include path misconfiguration and produce settings
that are inconsistent with the kernel's configuration.
Signed-off-by: Kent McLeod <kent@kry10.com>
TQ Group produces a system-on-module family called TQMa8Xx.
The user manual for this SoM is available here:
https://www.tq-group.com/filedownloads/files/products/embedded/manuals/arm/embedded-modul/TQ-Socket/TQMa8Xx/TQMa8Xx.UM.0104.pdf
This SoM comes in a number of different configurations.
The specific NXP SoC used, and the amount of memory are both
configurable.
The TQMa8XQP is the part number for the TQMa8Xx family configured with
the i.MX 8QuadXPlus SoC.
The datasheet for the SoC is available here:
https://www.nxp.com/docs/en/data-sheet/IMX8QXPAEC.pdf
In addition to the SoC being configurable the amount of SDRAM
on the SoM is also configurable.
The support provided in this PR is specifically for the TQMa8XQP
configured for 1GiB of memory. Note: Actual usable memory available
to the ARM application processor is 1022MiB.
System-on-modules rely on an appropriate carrier board.
Testing of this PR has been done on the MBa8Xx carrier board
that is available from TQ Group as part of their starter kit.
To the best of my knowledge there is nothing in this PR
that depends on the carrier board itself; all code is SoM
specific and should support any carrier board.
Note: This support is very specifically for the TQMa8XQP configured
with 1GiB of memory.
This may be a starting point for supporting other boards that
also have the NXP i.MX 8QuadXPlus SoC (as well as the i.MX 8DXP
and possibly other SoC in the i.MX 8 family).
Support is limited to the specific SoM due to the way in which
platform support currently works for seL4. Building a kernel
currently relies on the information from the DTS file (which is
SoM + RAM configuration specific). It would be preferable to
allow more generic support but SoC families but that is beyond
the scope of this PR.
Signed-off-by: Ben Leslie <benno@brkawy.com>
This adds support for the ODroidC4. The ODroidC4 is just a beefier
ODroidC2 with some bits moved around. The devices we care about here are
all essentially the same except the cores are A55s instead of A53s.
Signed-off-by: Curtis Millar <curtis@curtism.me>
- Add underscored in name to improve readability.
- Add brackets to ensure parameters are atoms
- add comment clarifying c99 usage
Signed-off-by: Axel Heider <axelheider@gmx.de>
This adds a flags parameter to SchedControl_Configure to enable
configuration of a sporadic SC.
This also allows flags to be added in the future as needed without
breaking the API.
This allows the user to configure an SC either to be constrained as a
sporadic task where accumulated time is only delayed to when a task has
become runnable (implementing the sporadic server algorithm) or
whenever the task becomes the current executing task (implementing the
sliding-window constraint as in constant-bandwidth servers).
This can be used to prevent non-realtime tasks from exceeding bandwidth
under any circumstances, even in an over-committed configuration, whilst
also allowing work-conserving tasks to be configured in the same system.
To implement sporadic servers, we need to ensure that the suspension of
a task cannot be used as a mechanism to amplify budget of a task by
granting that task access to effectively multiple periods worth of
replenishments within a single period.
To align the implementation of SCs with the model of sporadic servers we
must delay available time until the release of a task. Within seL4, a
release would be any time where an SC changes from not being associated
with a Running, RunningVM, or Restart thread to one that is.
This can occur when an SC is bound to a new thread in such a state or
when a thread changes to such a state from any non-running states.
Critically, replenishments should not be delayed at the point when an SC
becomes the current SC (as was the case prior to this commit). This has
the effect of enforcing a continuous, constant bandwidth which is a
restriction that is incompatible with standard scheduling logic.
Accounting for this requires inserting a new refill_unblock_check
call whenever a sporadic SC is unblocked and removing the
refill_unblock_check call from when said SC is scheduled.
Signed-off-by: Curtis Millar <curtis.millar@data61.csiro.au>
define KernelPlatformZCU102 and KernelPlatformUltra96 that both
use KernelPlatformZynqmp then.
Signed-off-by: Oliver Scott <Oliver.Scott@data61.csiro.au>
This provides a generic way to print an seL4_Word on 32-bit and 64-bit
platforms, aligned with PRIu64 and friends. Use it as:
printf("foo = %" PRI_sel4_word "\n", (seL4_Word)foo);
Signed-off-by: Axel Heider <axelheider@gmx.de>
