TQ Group produces a system-on-module family called TQMa8Xx.
The user manual for this SoM is available here:
https://www.tq-group.com/filedownloads/files/products/embedded/manuals/arm/embedded-modul/TQ-Socket/TQMa8Xx/TQMa8Xx.UM.0104.pdf
This SoM comes in a number of different configurations.
The specific NXP SoC used, and the amount of memory are both
configurable.
The TQMa8XQP is the part number for the TQMa8Xx family configured with
the i.MX 8QuadXPlus SoC.
The datasheet for the SoC is available here:
https://www.nxp.com/docs/en/data-sheet/IMX8QXPAEC.pdf
In addition to the SoC being configurable the amount of SDRAM
on the SoM is also configurable.
The support provided in this PR is specifically for the TQMa8XQP
configured for 1GiB of memory. Note: Actual usable memory available
to the ARM application processor is 1022MiB.
System-on-modules rely on an appropriate carrier board.
Testing of this PR has been done on the MBa8Xx carrier board
that is available from TQ Group as part of their starter kit.
To the best of my knowledge there is nothing in this PR
that depends on the carrier board itself; all code is SoM
specific and should support any carrier board.
Note: This support is very specifically for the TQMa8XQP configured
with 1GiB of memory.
This may be a starting point for supporting other boards that
also have the NXP i.MX 8QuadXPlus SoC (as well as the i.MX 8DXP
and possibly other SoC in the i.MX 8 family).
Support is limited to the specific SoM due to the way in which
platform support currently works for seL4. Building a kernel
currently relies on the information from the DTS file (which is
SoM + RAM configuration specific). It would be preferable to
allow more generic support but SoC families but that is beyond
the scope of this PR.
Signed-off-by: Ben Leslie <benno@brkawy.com>
The idle_thread() cannot perform any stack manipulations since it
runs in the idle thread TCB context. Declare the function with
the naked attribute, to ensure that the compiler always eliminates
the function prologue. Previously we rely on the -O2 optimization
flag for this, which on certain compilers (clang for instance) may
not guarantee that the function prologue gets eliminated.
Signed-off-by: Chang Liu <chang_liu3@brown.edu>
clang-11 warns "converting the enum constant to a boolean". The
comparison generates the same code, since the expression can
be evaluated at compile time (I checked the objdump).
Signed-off-by: Gerwin Klein <gerwin.klein@proofcraft.systems>
The structure actually describes kernel frames and not kernel devices.
In most of the cases a peripherals will fit into one page, but some can
need more pages. On some platform there are no kernel devices at all.
Provides the macro NUM_KERNEL_DEVICE_FRAMES as simple way to find out if
there are mapping that hides the corner cases. This eventually allows
implementing a generic handling even on RISC-V without much overhead, so
the hack for HiFive/Spike can be removed.
Signed-off-by: Axel Heider <axelheider@gmx.de>
As a side effect, the BIT() macro creates a word_t instead of an int,
so it can can handle even shift that exceed the int limits. This makes
the code more robust and provides the preferred coding pattern.
Signed-off-by: Axel Heider <axelheider@gmx.de>
Kernel device frames can never be executable. Even is this is generated
code, having an other assert here is a safe guard to catch potential
inconsistencies in the code generator.
Signed-off-by: Axel Heider <axelheider@gmx.de>
Using explicit field name in the assignment states more clearly what the
generated code does. It is also more robust and allows the compiler to
catch potential inconsistencies in case the structure details change.
Signed-off-by: Axel Heider <axelheider@gmx.de>
The trigger action sends repository_dispatch events to all
main test repositories of the manifests this repo is part of.
Signed-off-by: Gerwin Klein <gerwin.klein@proofcraft.systems>
This implements GitHub PR #115 on the current repo state. /usr/bin/env
is already used for other (cmake/python/etc) invocations, and this PR
brings bash/sh into line with that for slightly improved portability.
Co-authored-by: Douglas Wilson <douglas.wilson@gmail.com>
Signed-off-by: Gerwin Klein <gerwin.klein@proofcraft.systems>
Co-authored-by: Oliver Scott <Oliver.Scott@data61.csiro.au>
Co-authored-by: Axel Heider <axel-h@users.noreply.github.com>
Signed-off-by: Gerwin Klein <gerwin.klein@proofcraft.systems>
Memoization is not worth it here, the runtime of the entire program
is tiny. Removing the comment to curb temptations in the future.
Signed-off-by: Gerwin Klein <gerwin.klein@proofcraft.systems>
MAX_NUM_FREEMEM_REG is used to define the number of elements of the
array ndks_boot.freemem[]. However, in the code iterating over the
elements, using the macro ARRAY_SIZE() is more straight forward and
avoids pulling in unnecessary dependencies.
Signed-off-by: Axel Heider <axelheider@gmx.de>
This removes the operations that trigger a reschedule or reprogram the
timer from `preemptionPoint` to ensure the relevant state updates in
the proof occur where they are easier to verify.
Signed-off-by: Gerwin Klein <gerwin.klein@proofcraft.systems>
Avoid the warning 'WARNING:root:Not sure how to parse interrupts for
"/cpus/cpu@0/interrupt-controller"' when building for platform hifive.
Signed-off-by: Axel Heider <axel.heider@hensoldt-cyber.de>
The additional 8 byte go into a new page and then the rest of the page
is filled with padding. There is no good explanation what the 8 bytes
are used for, could be some copy/paste from another linker script.
Signed-off-by: Axel Heider <axel.heider@hensoldt-cyber.de>
Fix some cases where `NODE_STATE` arguments were parenthesised in a
manner that was inconsistent with other uses (but also surprisingly
still valid?).
Signed-off-by: Curtis Millar <curtis@curtism.me>
When we are changing to a new SC, it doesn't matter whether the old SC
is still configured. We should also know statically within
switchSchedContext that whichever SC we will use to execute with next is
both present and configured.
As such, this check can be removed.
Signed-off-by: Curtis Millar <curtis@curtism.me>
Enforce the maximum possible integer size in the generated C headers
instead of doing this in CMake.
Signed-off-by: Axel Heider <axel.heider@hensoldt-cyber.de>
The L2 cache handling functions were copied from the ARM code in the
initial port, but they are not used on RISC-V. Remove them from the
code base, they can be brought back if a platform has an L2 cache that
needs to be maintained.
Signed-off-by: Axel Heider <axel.heider@hensoldt-cyber.de>
Turns out the invariant 17109eb8c9 refers to is hard to prove
because it is not true, and the runtime check is necessary. This
assertion fails in sel4test SCHED_CONTEXT_0003 (Basic
api_sc_bind/UnbindObject testing).
Signed-off-by: Gerwin Klein <gerwin.klein@proofcraft.systems>
Previous "Kernel" showed up for the badge and main checks group, which
is not very informative.
Signed-off-by: Gerwin Klein <gerwin.klein@proofcraft.systems>
The badge now refers to the combined simulation + hw build + hw test +
deployment workflow.
Signed-off-by: Gerwin Klein <gerwin.klein@proofcraft.systems>
Previously the `concurrency` statement also prevented concurrency
within the build matrix which we do not want.
Signed-off-by: Gerwin Klein <gerwin.klein@proofcraft.systems>
This commit pulls out a separate workflow for sel4test (simulation +
hardware runs) on pushes to master, and deploys a new default.xml to
sel4test-manifest when the test is successful.
Signed-off-by: Gerwin Klein <gerwin.klein@proofcraft.systems>
- Explain why restore_user_context() is not called in init_kernel()
directly.
- describe the parameters that init_kernel() expects.
Signed-off-by: Axel Heider <axel.heider@hensoldt-cyber.de>
seL4Config.cmake is responsible for generating a valid
CMAKE_TOOLCHAIN_FILE and setting up platform config options at the start
of the build. The CMAKE_TOOLCHAIN_FILE variable has to be set before the
first cmake `project()` function is processed to take effect.
Previously this file was required to be imported in a CMake script
before the kernel's CMakeLists.txt could be processed. This prevented
the main CMakeLists.txt file from being used without an additional
configuration file:
cmake -G Ninja -C ../configs/ARM_verified.cmake ../
Now it is possible to do:
cmake -G Ninja -DKernelPlatform=imx6 -DKernelARMPlatform=sabre ../
This should make it easier to invoke CMake for building kernel
configurations from other build environments.
Because this file is now imported in the Kernel's CMakeLists.txt
context, there is no longer a requirement to save all the intermediate
settings into the cache and then read them out again.
Signed-off-by: Kent McLeod <kent@kry10.com>
GCC < 10 and clang < 11 put uninitialized global variables into a
'COMMON' section unless '-fno-common' is specified. The linker will put
anything from 'COMMON' as the end of the '.bss' it nothing else is
specified in the linker script. Besides making the variable placement
look odd, this also tends to waste a page because we puts large aligned
block at the end. Eventually, GCC 10 and clang 11 made '-fno-common'
the default, see
- https://gcc.gnu.org/gcc-10/changes.html
- https://releases.llvm.org/11.0.0/tools/clang/docs/ReleaseNotes.html
Signed-off-by: Axel Heider <axelheider@gmx.de>
Add a comment to clearly state the functions are empty on purpose, but
they still need to be provided to support the generic code flow.
Signed-off-by: Axel Heider <axelheider@gmx.de>
