- define NUM_RESERVED_REGIONS to align ARM and RSIC-V code
- add runtime checks to catch errors. These checks can't be static or
use assert(), as the parameters are passed by a kernel loader. They
must be considered dynamic and can potentially change any time out
of the kernel's control.
Signed-off-by: Axel Heider <axelheider@gmx.de>
Low version QEMU dump dts not have intc location information
and make subsequent generate dtb failed.
Error information:
Reference to non-existent node or label "/intc@8000000"
So when the QEMU version does not meet the requirements there
should be FATAL_ERROR to notice user early and immediately exit
Signed-off-by: Qiao Yongchang <qiaoyongchang@gmail.com>
In x86/boot_sys.c, we output a warning when `multiboot_mmap_length`
exceed limit. So we should correct its value after the `printf`.
close: #177
Signed-off-by: laokz <laokz@foxmail.com>
Print the available physical memory regions before printing the reserved
virtual memory regions, because as this order is more intuitive. For the
checks the order does not make any difference. Factor out the checks
into separate function to improve code readability.
Signed-off-by: Axel Heider <axel.heider@hensoldt-cyber.de>
python2 is not used in the kernel build anymore so the tool
definition is unnecessary.
python2 is also end-of-line so there is no reason to think
we would ever depend on it again.
Signed-off-by: Ben Leslie <benno@brkawy.com>
Check the return value from execute_process calls and fail
with an appropriate message.
This makes debugging of cmake failures much easier.
Signed-off-by: Ben Leslie <benno@brkawy.com>
Ensure the primary core grabs the BKL once the generic kernel init is
done and the secondary cores are running. Improve the comments to
clarify that this is done to play safe.
Signed-off-by: Axel Heider <axel.heider@hensoldt-cyber.de>
Since the build system defaults to python3 now, these have not worked
as advertised in a while now (they have test py3 twice).
Signed-off-by: Gerwin Klein <gerwin.klein@proofcraft.systems>
Before, binding a scheduling context to a TCB was not allowed if the
SC was bound to a notification object. Also, binding a SC to a NF was
not allowed if that scheduling context was already bound to a TCB.
Without these restriction it is much easier to move scheduling contexts
around: In effect having a SC bound on both the TCB and a NF acts as if
the thread is running on a donated SC which will be returned when the
tasks calls Recv/Wait, which is done by maybeReturnSchedContext().
This greatly simplifies startup and time-out exception handling for
passive threads having a NF with a SC bound to it.
Signed-off-by: Indan Zupancic <Indan.Zupancic@mep-info.com>
Merge memory regions before checking for reserved areas
Co-authored-by: Gerwin Klein <gerwin.klein@proofcraft.systems>
Signed-off-by: Bertrand Virfollet <bvirfollet@silicom.fr>
Signed-off-by: Gerwin Klein <gerwin.klein@proofcraft.systems>
Unify ARM and RISC-V behavior for insert_region(). Print a message and
return an error in release builds, so the caller must decide what to do.
Debug build trigger an assert(), because this is usually something that
should not happen.
Signed-off-by: Axel Heider <axelheider@gmx.de>
- On ARM systems, the UART must be set up first before any error
messages are visible. Move the user image location check after
the platform init that brings up the UART.
- Add the user image location check on RISC-V systems also.
- Make the error message more verbose to clearly show the problem.
Signed-off-by: Axel Heider <axel.heider@hensoldt-cyber.de>
The whole reason we have this comparison is that the user input has
not been checked yet when we get here.
Signed-off-by: Gerwin Klein <gerwin.klein@proofcraft.systems>
In x86, EPT and normal mappings have different cache attributes. This
commit adds an enum for the EPT attributes.
Signed-off-by: Chris Guikema <chris.guikema@dornerworks.com>
Verify that KernelArch and KernelWordSize have been correctly
set after including the platform cmake files.
Signed-off-by: Ben Leslie <benno@brkawy.com>
When using CMake to only build the kernel, an install target is now
provided to copy important outputs into an installation directory.
Currently only the following files are installed:
- ./bin/kernel.elf: Location of kernel.elf binary
- ./libsel4/include: The include root for libsel4
- ./libsel4/src: The c source files for the libsel4 library
To build and install this project to an installation directory should
now only require the following from a clean build directory:
```
export CMAKE_GENERATOR=Ninja
cmake -DCMAKE_INSTALL_PREFIX=<path-to-install> -DOption=Val <src-dir>;
cmake --build .;
cmake --install .;
```
Signed-off-by: Kent McLeod <kent@kry10.com>
This path variable overrides the destination that installation files are
copied to. It was set according to an example CMake toolchain file.
Instead it would be better to allow it to be optionally set by some
caller.
Signed-off-by: Kent McLeod <kent@kry10.com>
Define CONFIG_KERNEL_LOG_BUFFER in the same way as all other kernel
config options so that it is present in autoconf.h
Signed-off-by: Kent McLeod <kent@kry10.com>
autoconf.h is expected to contain all defined config options for an seL4
build configuration. Having these redefinitions were leftover from when
the verification build system didn't produce an autoconf.h file and set
the config separately. Its more likely that these defaults would
incorrectly hide an include path misconfiguration and produce settings
that are inconsistent with the kernel's configuration.
Signed-off-by: Kent McLeod <kent@kry10.com>
Update GIC_VCPU_MAX_NUM_LR constant to reflect that only 16 list
registers are supported on GICv3. The kernel still reads the actual
number of supported list registers out of the GICH_VTR register so the
kernel would still do the right thing before this change.
Signed-off-by: Kent McLeod <kent@kry10.com>
This adds sufficient kernel support for the GICv3 interrupt controller
to be used in a virtualization context on aarch64.
This set of changes has some limitations, however it is still an
improvement on the status quo.
Limitations:
1: This only provides support for aarch64. Anyone wanting support
for aarch32 + GICv3 + virtualization would need to add additional
code.
2: This code only supports 32 priority levels. Support for more
than 32 priority requires changing the get/set_gic_vcpu_ctrl_apr
interface. This is feasible, but requires a more invasive set of
changes. 32 priority levels has been shown to be sufficient in
practise.
Impacts on verification:
This set of changes should only impact Aarch64 Hypervisor
configurations. This is not yet verified so should not have
an impact on verification.
Level of testing:
This has been tested on an iMX8QXP based board. Testing
has at this point in time been limited to a single virtual
machine.
Note: support for this board is not yet upstrea, but is
currently being prepared.
Explanation of changes:
Ideally a new config item would not be required and this
could be driven purely by DTS and hardware.yml configuration.
However, the structures.bf requires changes. This can only
deal with config.h header files, not other more complex
header files. As such it was necessary to introduce a config
item which can be used for this purpose.
The appropriate platforms (as determined by examination of
DTS files) have been updated with the appropriate config
setting. This config setting only has any relevance if
hypervisor mode is already enabled, so should not cause
any difficulty for existing code or configuration.
Note: No testing has been performed on the updated
platforms.
There may be alternative factorings of this, which could
be considered in future work.
Signed-off-by: Ben Leslie <benno@brkawy.com>
- The field 'slot_pos_max' from 'ndks_boot' is not needed, the value
stored there is the constant BIT(CONFIG_ROOT_CNODE_SIZE_BITS).
- Improve the error message if the limit has been reached
Signed-off-by: Axel Heider <axelheider@gmx.de>
CONFIG_MAX_NUM_IOAPIC can end up being 0 when the kernel is configured
as PIC-only. This code is then unreachable, but gcc-10 can't figure
that out and fails on array-out-of-bounds access (which would be
correct if the code were reachable).
Signed-off-by: Gerwin Klein <gerwin.klein@proofcraft.systems>
Credits for this one should go to clang-11, which correctly flags that
the big `||` always yielded true and was not doing what was intended.
This means, previously the only possible cache attribute for EPT was
EPTWriteBack.
Signed-off-by: Gerwin Klein <gerwin.klein@proofcraft.systems>
The option -mno-outline-atomics used to be default before gcc-10 and
now needs to be provided explicitly. Without it gcc will produce
references to `__aarch64_ldadd8_acq_rel` which it expects to exist
in libgcc which we are not linking against.
Signed-off-by: Gerwin Klein <gerwin.klein@proofcraft.systems>
Adding a link to Gernot's blog post that explains what GPL on seL4
means for other code. This is mainly intended for people who aren't
that familiar with what all of these licenses mean.
Closes#524
Signed-off-by: Gerwin Klein <gerwin.klein@proofcraft.systems>
The function name handleUnknownSyscall() is slightly misleading, it
handles all non-standard seL4 syscalls used in debug builds also.
Signed-off-by: Axel Heider <axelheider@gmx.de>
