CPPFile is a much more robust version of GenCPP command. We drop the `extra_cflags`
as the CPPFile command uses regular cmake compilation and will use the include
directories added by `include_directories`, which includes all the directories from
`extra_cflags`
include_directories makes these directories directly available to all compilation that
happens, without needing to provide additional target link directories. This is the
first step to removing the `extra_cflags` variable
Provides a syscall interface for reading and writing arbitrary MSR values. This is
being introduced as an alternative to the DebugRun, as the main purpose of debug run
is for modifying the performance monitoring events via read/write MSR.
The GetStatusBits invocation is only implemented on ia32. Adding the condition to the
XML list prevents the invocation from being in the list of invocations on x86_64, when
it has no implementation.
Placing lists directly in the generater expression means that this string, despite having
semicolons in it, is not actually a list, as it has an expression (the generator expression)
spanning multiple lists. This leads to confusion during argument processing and expansion
Adds a named constant of the IPC buffer size bits that can be used when checking the
size/alignment of an IPC buffer. This constant has a compile time assertion to ensure
it corresponds to the actual IPC buffer
This unifies the badge size of endpoints and notifications on 64-bit platforms to a
consistent 64-bits, and also changes the libsel4 definitions to match for both.
The maximum guard size was unnecessarily restricted to 18 bits as it is on 32-bit
platforms. This change increases it to the current maximum possible of 58 bits.
The 58-bit limitation exists due to the need to encode a guard+guardsize into a
single word for cnode invocations.
The definitions of guard and badge sizes is going to be changed for 64-bit platforms,
this change provides an easy way of providing different definitions
Using the bitfield generator to treat guards and badges as a union type can be convenient,
but it requires reserving a bit in the data for the bitfield run time type information.
This type information is not needed by the kernel as it knows implicitly whether the passed
data is a badge or a guard based on the kind of cap being operated on. However, with the
type information present we cannot pass a word sized piece of data to the kernel.
The solution here is to go back to using a plain seL4_Word as the type for invocations
that want a capdata and let the user either construct a badge as a plain word, or use
the seL4_CNode_CapData bitfield for constructing a guard, although they have to manually extract
the word representation out of it.
The purpose of renaming this type is to match the style of the other shared types in libsel4.
Previously its name was fine as this was a private kernel type.
This data structure is meant to be the user visible format of the data for a cnode_cap,
yet it is defined in a kernel only bitfield file. Moving it to libsel4 opens up the
possibility of consolidating the definitions in libsel4
The Zynq UltraScale+ MPSoC (PLAT zynqmp) is a Multi-Processor SOC
made by Xilinx that has a quad-core Cortex-A53, a dual-core Cortex-R5
and an FPGA.
This adds 32-bit, single-core support on the the Cortex-A53 cluster.
This provides documentation for kernel design of the x86 virtualisation, the additional
syscall and object invocations. The ARM design is not fully expanded.
Fixes an inconsistency between manual_label for the x86 AsidPool_Assign invocation
and its reference in the manual. This makes the x86 align with the ARM name.
Nested structs with attributes are not understandable by the C parser. This change simply
moves the nested definitions into the global namespace (with suitable names).
The IOMMU implementation is not going to be verified at the moment, and so the code for
it needs to be hidden from verification, which we do by #ifdef'ing it out if the IOMMU
is not enabled. As a result the IOMMU configuration depends on a non verification target
Changing the register used for the IPC buffer is useful as the standard TLS model for
aarch64 is to use tpidr_el0 for the thread pointer, which we are presently using
for the IPC buffer. This therefore paves the way for implementing proper TLS support
on aarch64.
Since we are not using tpidr_el0 for the IPC buffer we need to save/restore (or at
least clear) this register on thread switch to prevent it being a user channel. Saving
and restoring of it is achieved by ensuring CONFIG_IPC_BUF_TPIDRURW is not set, which
as we are no longer using this strategy this will be the case. To that end as aarch64
only has one IPC buffer strategy this commit makes the choice of IPC buffer strategy
dependeont on aarch32.
This commit implements lazy FP save/restore mechanism, required for user threads
when they use the FPU. The following caveats take place:
* Only support synchronous exceptions. No support for asynchronous ones.
* VFP opcodes are used instead of normal instructions to discard compiler warnings/errors.
* Support is limited to specific ARM subarchitectures we support and tested this commit on.
* Disable the FPU by default if users are not using it to avoid channels.
* FPU support is not verified yet.
* Will not work properly if using a VM that's running besides other VMs/threads that are using the FPU.
Previously anything in an autoref block was assumed to reference
a section, which isn't true. Change 'sec' to 'label' and move the
'sec' prefix into the label itself.
Manual labels for methods are inferred unless specified in the api
description. This change extends this inference to prevent slashes
appearing in method labels. It also refactors the logic for label
inference to be more readable.
Methods with no output params return an error. Previously each such
method had a line of documentation in its interface definition
explaining this. This commit removes this. The documentation is
for such cases is generated implicitly.
If no documentation is provided for the return value of a function, the
documentation generator will attempt to infer the documentation based on
the return type.
- when CONFIG_DEBUG is enabled, track all threads
- when CONFIG_PRINTING is enabled, provide seL4_DebugDumpScheduler which
allows the user to dump the state of the kernel scheduler.
Provides a configuration option for enabling HDCR.TD* traps, or saving and loading debug
state on VCPU switches. Currently verification only plans to support the trap setting.
As this option complicates all of the #ifdef's related to debug registers even further,
abstractions for enabling/disabling each individual piece of the debug code for different
configuration options are also implemented.
Part of these refactored #ifdef guards was to remove the guards completely from libsel4
around the definitions of the number of breakpoints and watchpoints.
This patch disables the debug register state save and restore on ARM-hyp,
such that Guest VMs can now interfere with one another and trigger
one another for certain limited scenarios. This will be undone later on.
As things are now, the Guest VMs can modify the debug registers at will
from non-secure PL1, and the kernel does nothing to ensure that guest VM
debug coprocessor registers are preserved.
This is a preliminary patch that simply hooks into vcpu_save and saves the
CPU's debug coprocessor registers when saving VCPU state.
For restoring the debug registers on switching to a VCPU, we just re-use
restore_user_debug_context, which is already called in restore_user_context.
(Restore_user_context is called by c_handle_vcpu_fault()). Specifically,
we modify the used_breakpoints_bf so that restore_user_debug_context()
will always pop all the debug context.
This patch only covers the breakpoint and watchpoint registers,
and it doesn't cover the entire debug coprocessor, which is another
conversation.
There is no way to know how many entries the syscall log contains
otherwise. One option was iterating through until finding a 0
terminator, however this requires the log to be zeroed before each
trial. This changes the FinalizeLog syscall to return the number of
entries.
Previously the #ifdefs for some debug syscalls relied on definitions
from Makefile.flags in sel4_tools. This changes them to use configs
defined in autoconf.h which makes them easier to import when building
projects that don't use sel4_tools.
This provides a future proof interface for extending the bootinfo region with additional
kinds of optional architecture and platform specific information. The basic idea is to
report the size of a region directly following the bootinfo frame, which is made up of
a series of 'chunks'. Each chunk has an identifier (describing what it is) and a length,
allowing unknown chunks to be skipped in favor of examining the remaining of the chunks.
* Adds object and cap definitions for VT-x structures (VCPU and EPT).
* Extends the asid_map implementation to support ASIDs in the EPT
* Adds size definitions for VCPU and EPT objects
CONFIG_LIB_SEL4_PUBLIC_SYMBOLS=y will disable inlining for external
interfaces (except deprecated functions), thereby providing public
symbols for easy linkage with other languages.
* commit '0435985eca5117a9df272e991fd0f8c421515831':
arm: Use new cap rights structures in iospace
libsel4: Correct VGIC and VCPU fault types
libsel4: Correct deprecated macro for in unknown syscall
* commit '2e30ac481f212b3490fde8dbd13f496a50d70f49':
libsel4: Add remaining combinations of cap rights
libsel4: Removed stray semicolon from shared_types
This also moves the description of TCBSetEPTRoot from the general object
invocation xml file to the x86-specific one to prevent the need for
documentation-generating scripts to distinguish between VTX (ie. x86)
invocations, and truly architecture independent invocations.
JIRA: SELFOUR-606
The motivation for this change is the fact that the types of `true` and
`false` are different between userland and the kernel. This was forcing
code including shared_types.h to first include the appropriate header
defining `true` and `false`. This change prevents this need.
This change
* changes seL4_CapRights from the kernel to be seL4_CapRights_t in
libsel4
* deprecates the duplicated seL4_CapRights in libsel4, which is
now the bitfield generated type seL4_CapRights_t.
* fixes all usages in kernel and libsel4
Impact: for verification, this will require the type to change name
from cap_rights to seL4_CapRights_t.
This is a breaking libsel4 API change, although most code uses
seL4_AllRights or similar constants, which will not break
at a source level as these constants have been updated.
This is a *breaking API change*
This commit:
* makes seL4_Fault_tag_t common between the kernel and libsel4
* deprecates the existing functions from sel4/messages.h includes
* introduces a new fault API in sel4/faults.h and
* sel4/sel4_arch/faults.h
* deprecates seL4_GetTag(), as the function did not work without
the user calling seL4_SetTag() first (seL4_MessageInfo is passed
in registers and not set in the IPC buffer)
* removes previously deprecated functions (deprecated prior to 3.0.0)
* updates the seL4 manual to reflect the changes
Prior to this commit faults were separate
per architecture. This commit extracts the common
fault types and introduces arch specific faults,
reducing code duplication across architectures.
This commit adds support for using the ThreadID registers of the ARM MPCore
platforms for storing the address of the IPC buffer instead of the globals
frame. The choice of using the user readable/writeable ThreadID register
is chosen, even though it means the user cannot use it for its own
purposes, as it leaves room in the future for doing TLS support in the
user read only register, where compilers expect it.
Removes the recycle operation and adds an operation
to cancel any badged sends on and endpoint. Calling
Revoke + CancelBadgedSend is equivalent to Recycle
on a badged endpoint
This reorders the bootinfo struct to place the untyped array as the
last element. Having the array at the end makes the layout of the
information in this struct easier to represent in other languages.
This change uses the seL4_MaxUntypedBits constant in decodeUntypedInvocation
when checking the size of the requested allocation. This constant
is also changed to be the correct value. The verification team suspects
this check is probably unnecessary, but have also resolved not to waste more
time investigating.
* commit 'be68b0c0bde5bfa439376fac4c8be255dacaa958':
libsel4: Allow invocations to not use IPC buffer
Retain in-register error descriptions when not using IPC buffer
- Fixes "lost" error descriptions when using *WithMRs system call
variants [1].
- Only stores real registers to IPC buffer if there's an error.
- If there's an error in a struct-returning function, return
early without setting any struct members.
- Passes the sabre/qemu test suite... with and without --buffer!
[1] https://sel4.systems/pipermail/devel/2016-October/001079.html
* Initialise the message variables (as per ia32 and x86_64)
* `libsel4` now builds when `syscall_stub_gen.py` is run without `--buffer`
* While simple things appear to work, `sel4test` with aarch32 in qemu is *not* happy:
```
Bootstrapping kernel
Warning: using printf before serial is set up. This only works as your
printf is backed by seL4_Debug_PutChar()
sel4utils_create_object_at_level@mapping.h:22 Should not be called
Ignoring call to sys_rt_sigprocmask
Ignoring call to sys_gettid
sys_tkill assuming self kill
```
The lowest syscall number is -8, which doesnt' fit in 3 bits -> change
to 4.
Also, we were storing the -ve number, which also doesn't fit into 3
bits -> invert it when we store it.
This reorders the bootinfo struct to place the untyped array as the
last element. Having the array at the end makes the layout of the
information in this struct easier to represent in other languages.
This commit implements the body of SELFOUR-499. The API exposes the x86 DR0-7
and ARM coprocessor 14 features to userspace by virtualizing them as context-
switched registers in the TCB. Implemented as TCB invocations. This feature is
only built when CONFIG_HARDWARE_DEBUG_API is selected.
* Add low-level support routines for setting, unsetting, getting, enabling
and disabling breakpoints.
* Add support for single-stepping as well.
^ Single-stepping is not supported on ARMv6 since the hardware
doesn't have support.
^ ARM implements single-stepping as instruction breakpoints
configured to fault on every instruction -- this is achieved through
the "mismatch" mode, which is only supported from ARMv7 onwards.
* Also support explicit software break requests, a la "BKPT" and "INT $3".
* New invocations:
* seL4_TCB_SetBreakpoint().
* seL4_TCB_GetBreakpoint().
* seL4_TCB_UnsetBreakpoint().
* seL4_TCB_ConfigureSingleStepping().
* New constants:
^ Event types:
^ seL4_InstructionBreakpoint.
^ seL4_DataBreakpoint.
^ seL4_SoftwareBreakRequest.
^ Access types:
^ seL4_BreakOnRead.
^ seL4_BreakOnWrite.
^ seL4_BreakOnReadWrite.
^ Exports:
^ seL4_NumHWBreakpoints.
^ seL4_NumExclusiveBreakpoints.
^ seL4_NumExclusiveWatchpoints.
^ seL4_NumDualFunctionMonitors.
^ seL4_FirstBreakpoint.
^ seL4_FirstWatchpoint.
^ seL4_FirstDualFunctionMonitor.
See documentation in the seL4 API manual.
Where MCP = Maximum Controlled Priority
This commit adds:
* seL4_TCB_SetMCPriority
and changes the arguments to
* seL4_TCB_Configure
As of this commit, a thread cannot create or set a threads
priority (including itself) above its mcp. Previously the kernel
did this check against a threads priority, which prevented a thread
from setting it's own priority down and then up again.
Refactors syscalls to use common base functions for assembly stubs.
As a result of this refactor the problem of low optimization levels
breaking the syscall stubs is also resolved.
* commit '8e77cdb5e91e971f49747492a3350c2b443a3827':
SELFOUR-421: Add padding for untyped in bootinfo
SELFOUR-421: minor changes for c-refine
SELFOUR-421: fix up boolean equality in Arch_sameObjectAs
SELFOUR-421: added device check to sameObjectAs
SELFOUR-421: Arch_createObject changed to use new user_data_device in ghostupdates for device pages
SELFOUR-421 Introduce explicit device frames and untypeds
Kernel objects cannot be created from device untypeds, with the
exception of frames, which do not get zeroed and cannot be used
as an IPC buffer. Device untypeds additionally cannot be used
in the construction of ASID pools.
This then changes the API to the rootserver (i.e. bootinfo) to
send device untypeds instead of device frames. On ARM these
device untypeds are the same as the previously exported device
frame regions. On x86 PCI scanning is removed and all physical
memory addresses (that are not important for kernel integrity)
are released to the user.
In order to have bits in the frame and untyped caps on ARM the
number of software ASIDs had to be reduced from 2^18 to 2^17,
and the maximum untyped size reduced from 2^31 to 2^30
This adds a dummy header with syscall prototypes with doxygen comments.
The build process for the manual includes parsing these comments using
doxygen. Doxygen produces an xml file which is parsed by a script to
generate latex which is included in the manual. This approach was chosen
over doxygen's native latex output to gain greater control over the
formatting of the generated documentation, and to take advantage of
existing api-formatting support in the sel4 manual.
Related issue: SELFOUR-606
Given that the log buffer is now
(79291252a8) in user-level, the kernel doesn't have
to dump and send the size for users. Users have to take care of this.
Adds the following constants to libsel4
and uses them in the kernel.
seL4_SectionSize (arm)
seL4_SuperSectionSize (arm)
seL4_HugePageSize (x86 - pae)
seL4_LargePageSize (arm)
seL4_DataFault
seL4_InstructionFault
* commit 'da0c39f473270a965d8ad73774a204290dd5b44b':
libsel4: Tidied comments and moved compound rights
libsel4: Use pragma once in cap rights header
libsel4: Added cap rights interface wrapper
