This implements GitHub PR #115 on the current repo state. /usr/bin/env
is already used for other (cmake/python/etc) invocations, and this PR
brings bash/sh into line with that for slightly improved portability.
Co-authored-by: Douglas Wilson <douglas.wilson@gmail.com>
Signed-off-by: Gerwin Klein <gerwin.klein@proofcraft.systems>
Co-authored-by: Oliver Scott <Oliver.Scott@data61.csiro.au>
Co-authored-by: Axel Heider <axel-h@users.noreply.github.com>
Signed-off-by: Gerwin Klein <gerwin.klein@proofcraft.systems>
Memoization is not worth it here, the runtime of the entire program
is tiny. Removing the comment to curb temptations in the future.
Signed-off-by: Gerwin Klein <gerwin.klein@proofcraft.systems>
MAX_NUM_FREEMEM_REG is used to define the number of elements of the
array ndks_boot.freemem[]. However, in the code iterating over the
elements, using the macro ARRAY_SIZE() is more straight forward and
avoids pulling in unnecessary dependencies.
Signed-off-by: Axel Heider <axelheider@gmx.de>
This removes the operations that trigger a reschedule or reprogram the
timer from `preemptionPoint` to ensure the relevant state updates in
the proof occur where they are easier to verify.
Signed-off-by: Gerwin Klein <gerwin.klein@proofcraft.systems>
Avoid the warning 'WARNING:root:Not sure how to parse interrupts for
"/cpus/cpu@0/interrupt-controller"' when building for platform hifive.
Signed-off-by: Axel Heider <axel.heider@hensoldt-cyber.de>
The additional 8 byte go into a new page and then the rest of the page
is filled with padding. There is no good explanation what the 8 bytes
are used for, could be some copy/paste from another linker script.
Signed-off-by: Axel Heider <axel.heider@hensoldt-cyber.de>
Fix some cases where `NODE_STATE` arguments were parenthesised in a
manner that was inconsistent with other uses (but also surprisingly
still valid?).
Signed-off-by: Curtis Millar <curtis@curtism.me>
When we are changing to a new SC, it doesn't matter whether the old SC
is still configured. We should also know statically within
switchSchedContext that whichever SC we will use to execute with next is
both present and configured.
As such, this check can be removed.
Signed-off-by: Curtis Millar <curtis@curtism.me>
Enforce the maximum possible integer size in the generated C headers
instead of doing this in CMake.
Signed-off-by: Axel Heider <axel.heider@hensoldt-cyber.de>
The L2 cache handling functions were copied from the ARM code in the
initial port, but they are not used on RISC-V. Remove them from the
code base, they can be brought back if a platform has an L2 cache that
needs to be maintained.
Signed-off-by: Axel Heider <axel.heider@hensoldt-cyber.de>
Turns out the invariant 17109eb8c9 refers to is hard to prove
because it is not true, and the runtime check is necessary. This
assertion fails in sel4test SCHED_CONTEXT_0003 (Basic
api_sc_bind/UnbindObject testing).
Signed-off-by: Gerwin Klein <gerwin.klein@proofcraft.systems>
Previous "Kernel" showed up for the badge and main checks group, which
is not very informative.
Signed-off-by: Gerwin Klein <gerwin.klein@proofcraft.systems>
The badge now refers to the combined simulation + hw build + hw test +
deployment workflow.
Signed-off-by: Gerwin Klein <gerwin.klein@proofcraft.systems>
Previously the `concurrency` statement also prevented concurrency
within the build matrix which we do not want.
Signed-off-by: Gerwin Klein <gerwin.klein@proofcraft.systems>
This commit pulls out a separate workflow for sel4test (simulation +
hardware runs) on pushes to master, and deploys a new default.xml to
sel4test-manifest when the test is successful.
Signed-off-by: Gerwin Klein <gerwin.klein@proofcraft.systems>
- Explain why restore_user_context() is not called in init_kernel()
directly.
- describe the parameters that init_kernel() expects.
Signed-off-by: Axel Heider <axel.heider@hensoldt-cyber.de>
seL4Config.cmake is responsible for generating a valid
CMAKE_TOOLCHAIN_FILE and setting up platform config options at the start
of the build. The CMAKE_TOOLCHAIN_FILE variable has to be set before the
first cmake `project()` function is processed to take effect.
Previously this file was required to be imported in a CMake script
before the kernel's CMakeLists.txt could be processed. This prevented
the main CMakeLists.txt file from being used without an additional
configuration file:
cmake -G Ninja -C ../configs/ARM_verified.cmake ../
Now it is possible to do:
cmake -G Ninja -DKernelPlatform=imx6 -DKernelARMPlatform=sabre ../
This should make it easier to invoke CMake for building kernel
configurations from other build environments.
Because this file is now imported in the Kernel's CMakeLists.txt
context, there is no longer a requirement to save all the intermediate
settings into the cache and then read them out again.
Signed-off-by: Kent McLeod <kent@kry10.com>
GCC < 10 and clang < 11 put uninitialized global variables into a
'COMMON' section unless '-fno-common' is specified. The linker will put
anything from 'COMMON' as the end of the '.bss' it nothing else is
specified in the linker script. Besides making the variable placement
look odd, this also tends to waste a page because we puts large aligned
block at the end. Eventually, GCC 10 and clang 11 made '-fno-common'
the default, see
- https://gcc.gnu.org/gcc-10/changes.html
- https://releases.llvm.org/11.0.0/tools/clang/docs/ReleaseNotes.html
Signed-off-by: Axel Heider <axelheider@gmx.de>
Add a comment to clearly state the functions are empty on purpose, but
they still need to be provided to support the generic code flow.
Signed-off-by: Axel Heider <axelheider@gmx.de>
All architectures define paddr_t as word_t, but the actual definition of
word_t is specific to every architecture's word size. For this reason, a
dedicated format specifier for word_t has been introduced, it hides
all these detail.
Signed-off-by: Axel Heider <axelheider@gmx.de>
The functions insert_region() and create_rootserver_objects() are not
used outside of boot.c, so there is no reason to make it publicly
available.
Signed-off-by: Axel Heider <axelheider@gmx.de>
Replace the macro SMP_TERNARY(getCurrentCPUIndex(), 0) by the much
simpler macro CURRENT_CPU_INDEX() that does the same.
Signed-off-by: Axel Heider <axelheider@gmx.de>
CURRENT_CPU_INDEX() is supported to return a word_t. The C parser from
the verification toolchain requires declaring word_t constants without
casting integer values to word_t.
Signed-off-by: Axel Heider <axelheider@gmx.de>
This fixes a correctness and security issue where uncached user
mappings might see old data from before the clearMemory operation.
See also the discussion on GitHub issue #481
Signed-off-by: Gerwin Klein <gerwin.klein@proofcraft.systems>
