Translation validation reports errors using the "real" struct type name
instead of the typedef name, so having anonymous structs makes debugging
translation validation harder.
Relates to #168. The definition for `seL4_UntypedRetypeMaxObjects` lives
in the UAPI `types.h` but appears to have no link to the value actually
used by the kernel, which is configurable. This change sets the UAPI
definition to the generated definition from the kernel config steps and
defaults to the previous fixed value if, for some reason, the configured
definition is not available.
Use the __ASSEMBLER__ macro to suppress C definitions from appearing in
non-C files when the preprocessor is used. Other libsel4/*/constants.h
files use this strategy to avoid duplicating definitions for seL4 object
sizes that can changed based on kernel configuration.
This allows users to define custom amounts of refills without
increasing the scheduling context size system wide.
also add libsel4 functions for refill size
This is the first part of the seL4 MCS. This commit:
* adds a scheduling context object. Threads without scheduling
context objects cannot be scheduled.
* replaces tcbTimeSlice with the scheduling context object
* adds seL4_SchedControl caps for each core
* adds seL4_SchedControl_Configure which allows users to configure
amount of ticks a scheduling context has, and set a core for the
scheduling context.
* adds seL4_SchedContext_Bind, Unbind and UnbindObject, which allows
a tcb to be bound to a scheduling context.
Created a new syscall, seL4_DebugSendIPI for ARM to send arbitrary SGIs
(software generated interrupts) to arbitrary cores. As SGIs are
specifically PPIs (private interrupts), this syscall effectively allows
to trigger PPIs on arbitrary cores, for debug/testing purposes.
Some platforms and configurations do not allow user code to change the
value of the register used for TLS. On these architectures a syscall can
be used to allow the kernel to update the register on their behalf.
This does not immediately update the value in the user context on many
configurations as the values are only stored in the user context on a
context switch.
This removes the assumption that each platform sotres the IPC buffer
address in a platform-specific register. The IPC buffer address is
instead stored in a thread-local variable in libsel4 which must be
initialised by the runtime.
Now these bitfield definitions are generated from the same source file
in the kernel and libsel4, and also result in the same include path: <sel4/shared_types_gen.h>
GrantReply is a new access right added to endpoint capabilities, which
allows seL4_Call to be used on those capabilities (specifically, it
allows reply caps *only* to be granted across endpoints).
Prior to the addition of GrantReply, endpoint capabilities required the
Grant access right, which allowed any arbitrary capabilitiy to be
transferred over an endpoint. Using GrantReply, systems can now be
constructed where threads using seL4_Call over an endpoint do not need to be in the same
security subsystem.
It has become clear that the 'packed' GCC attribute affects the
memory semantics of C in a way that the verification tools do not
understand. The bootinfo types are used by kernel boot code (not
currently verified, but covered by binary verification) and should
not use this attribute.
This is a source-compatible but not binary-compatible change.
Introduced a new Doxygen XML tag '<docref>'. The intention of
this tag is to indicate a section of text in the Doxygen XML that
will contain a reference to another section in the Manual e.g.
"See \autoref<sec:x>". As other generation formats aren't aware of
other chapters/sections in the manual, the <docref> encapsulation
allows it to omit the text from the output. The Latex generator
has been modified to continue parsing the 'docref' contents.
Changes the way IO ports work such that instead of 'minting' IO port caps down into new
IO port caps with smaller ranges new IO port ranges must be allocated centrally from
an IO port control cap. This mechanism acts in a very similar fashion as IRQ handler/control
capabilities and ensures that allocated IO ports do not overlap. Disallowing overlapping
IO ports is necessary to ensure the CDT remains valid as capabilities are deleted.
Although the C kernel examines (and may modify) some bits of the message
info register, all remaining bits are treated as user data, which the
kernel passes through IPC unmodified.
The seL4_MessageInfo register describes the message info register. The
kernel examines fields `length`, `extraCaps` and `capsUnwrapped`, while
the `label` field represents bits available to the user. However, in
reality, the user may also use any padding bits for user data, since the
kernel also passes these through IPC unmodified.
For verification, we would like to phrase specifications in terms of the
bitfield definition, and so we would like the `label` field to
incorporate all of the bits which the kernel treats as user data.
This commit therefore extends the `label` field across the bits which
were previously marked as padding.
The maximum guard size was unnecessarily restricted to 18 bits as it is on 32-bit
platforms. This change increases it to the current maximum possible of 58 bits.
The 58-bit limitation exists due to the need to encode a guard+guardsize into a
single word for cnode invocations.
The definitions of guard and badge sizes is going to be changed for 64-bit platforms,
this change provides an easy way of providing different definitions
Using the bitfield generator to treat guards and badges as a union type can be convenient,
but it requires reserving a bit in the data for the bitfield run time type information.
This type information is not needed by the kernel as it knows implicitly whether the passed
data is a badge or a guard based on the kind of cap being operated on. However, with the
type information present we cannot pass a word sized piece of data to the kernel.
The solution here is to go back to using a plain seL4_Word as the type for invocations
that want a capdata and let the user either construct a badge as a plain word, or use
the seL4_CNode_CapData bitfield for constructing a guard, although they have to manually extract
the word representation out of it.
The purpose of renaming this type is to match the style of the other shared types in libsel4.
Previously its name was fine as this was a private kernel type.
This data structure is meant to be the user visible format of the data for a cnode_cap,
yet it is defined in a kernel only bitfield file. Moving it to libsel4 opens up the
possibility of consolidating the definitions in libsel4
This provides documentation for kernel design of the x86 virtualisation, the additional
syscall and object invocations. The ARM design is not fully expanded.
Previously anything in an autoref block was assumed to reference
a section, which isn't true. Change 'sec' to 'label' and move the
'sec' prefix into the label itself.
