Manual labels for methods are inferred unless specified in the api
description. This change extends this inference to prevent slashes
appearing in method labels. It also refactors the logic for label
inference to be more readable.
Methods with no output params return an error. Previously each such
method had a line of documentation in its interface definition
explaining this. This commit removes this. The documentation is
for such cases is generated implicitly.
If no documentation is provided for the return value of a function, the
documentation generator will attempt to infer the documentation based on
the return type.
- when CONFIG_DEBUG is enabled, track all threads
- when CONFIG_PRINTING is enabled, provide seL4_DebugDumpScheduler which
allows the user to dump the state of the kernel scheduler.
Provides a configuration option for enabling HDCR.TD* traps, or saving and loading debug
state on VCPU switches. Currently verification only plans to support the trap setting.
As this option complicates all of the #ifdef's related to debug registers even further,
abstractions for enabling/disabling each individual piece of the debug code for different
configuration options are also implemented.
Part of these refactored #ifdef guards was to remove the guards completely from libsel4
around the definitions of the number of breakpoints and watchpoints.
This patch disables the debug register state save and restore on ARM-hyp,
such that Guest VMs can now interfere with one another and trigger
one another for certain limited scenarios. This will be undone later on.
As things are now, the Guest VMs can modify the debug registers at will
from non-secure PL1, and the kernel does nothing to ensure that guest VM
debug coprocessor registers are preserved.
This is a preliminary patch that simply hooks into vcpu_save and saves the
CPU's debug coprocessor registers when saving VCPU state.
For restoring the debug registers on switching to a VCPU, we just re-use
restore_user_debug_context, which is already called in restore_user_context.
(Restore_user_context is called by c_handle_vcpu_fault()). Specifically,
we modify the used_breakpoints_bf so that restore_user_debug_context()
will always pop all the debug context.
This patch only covers the breakpoint and watchpoint registers,
and it doesn't cover the entire debug coprocessor, which is another
conversation.
There is no way to know how many entries the syscall log contains
otherwise. One option was iterating through until finding a 0
terminator, however this requires the log to be zeroed before each
trial. This changes the FinalizeLog syscall to return the number of
entries.
Previously the #ifdefs for some debug syscalls relied on definitions
from Makefile.flags in sel4_tools. This changes them to use configs
defined in autoconf.h which makes them easier to import when building
projects that don't use sel4_tools.
This provides a future proof interface for extending the bootinfo region with additional
kinds of optional architecture and platform specific information. The basic idea is to
report the size of a region directly following the bootinfo frame, which is made up of
a series of 'chunks'. Each chunk has an identifier (describing what it is) and a length,
allowing unknown chunks to be skipped in favor of examining the remaining of the chunks.
* Adds object and cap definitions for VT-x structures (VCPU and EPT).
* Extends the asid_map implementation to support ASIDs in the EPT
* Adds size definitions for VCPU and EPT objects
CONFIG_LIB_SEL4_PUBLIC_SYMBOLS=y will disable inlining for external
interfaces (except deprecated functions), thereby providing public
symbols for easy linkage with other languages.
* commit '0435985eca5117a9df272e991fd0f8c421515831':
arm: Use new cap rights structures in iospace
libsel4: Correct VGIC and VCPU fault types
libsel4: Correct deprecated macro for in unknown syscall
* commit '2e30ac481f212b3490fde8dbd13f496a50d70f49':
libsel4: Add remaining combinations of cap rights
libsel4: Removed stray semicolon from shared_types
This also moves the description of TCBSetEPTRoot from the general object
invocation xml file to the x86-specific one to prevent the need for
documentation-generating scripts to distinguish between VTX (ie. x86)
invocations, and truly architecture independent invocations.
JIRA: SELFOUR-606
The motivation for this change is the fact that the types of `true` and
`false` are different between userland and the kernel. This was forcing
code including shared_types.h to first include the appropriate header
defining `true` and `false`. This change prevents this need.
This change
* changes seL4_CapRights from the kernel to be seL4_CapRights_t in
libsel4
* deprecates the duplicated seL4_CapRights in libsel4, which is
now the bitfield generated type seL4_CapRights_t.
* fixes all usages in kernel and libsel4
Impact: for verification, this will require the type to change name
from cap_rights to seL4_CapRights_t.
This is a breaking libsel4 API change, although most code uses
seL4_AllRights or similar constants, which will not break
at a source level as these constants have been updated.
This is a *breaking API change*
This commit:
* makes seL4_Fault_tag_t common between the kernel and libsel4
* deprecates the existing functions from sel4/messages.h includes
* introduces a new fault API in sel4/faults.h and
* sel4/sel4_arch/faults.h
* deprecates seL4_GetTag(), as the function did not work without
the user calling seL4_SetTag() first (seL4_MessageInfo is passed
in registers and not set in the IPC buffer)
* removes previously deprecated functions (deprecated prior to 3.0.0)
* updates the seL4 manual to reflect the changes
Prior to this commit faults were separate
per architecture. This commit extracts the common
fault types and introduces arch specific faults,
reducing code duplication across architectures.
This commit adds support for using the ThreadID registers of the ARM MPCore
platforms for storing the address of the IPC buffer instead of the globals
frame. The choice of using the user readable/writeable ThreadID register
is chosen, even though it means the user cannot use it for its own
purposes, as it leaves room in the future for doing TLS support in the
user read only register, where compilers expect it.
Removes the recycle operation and adds an operation
to cancel any badged sends on and endpoint. Calling
Revoke + CancelBadgedSend is equivalent to Recycle
on a badged endpoint
This reorders the bootinfo struct to place the untyped array as the
last element. Having the array at the end makes the layout of the
information in this struct easier to represent in other languages.
This change uses the seL4_MaxUntypedBits constant in decodeUntypedInvocation
when checking the size of the requested allocation. This constant
is also changed to be the correct value. The verification team suspects
this check is probably unnecessary, but have also resolved not to waste more
time investigating.
* commit 'be68b0c0bde5bfa439376fac4c8be255dacaa958':
libsel4: Allow invocations to not use IPC buffer
Retain in-register error descriptions when not using IPC buffer
- Fixes "lost" error descriptions when using *WithMRs system call
variants [1].
- Only stores real registers to IPC buffer if there's an error.
- If there's an error in a struct-returning function, return
early without setting any struct members.
- Passes the sabre/qemu test suite... with and without --buffer!
[1] https://sel4.systems/pipermail/devel/2016-October/001079.html
* Initialise the message variables (as per ia32 and x86_64)
* `libsel4` now builds when `syscall_stub_gen.py` is run without `--buffer`
* While simple things appear to work, `sel4test` with aarch32 in qemu is *not* happy:
```
Bootstrapping kernel
Warning: using printf before serial is set up. This only works as your
printf is backed by seL4_Debug_PutChar()
sel4utils_create_object_at_level@mapping.h:22 Should not be called
Ignoring call to sys_rt_sigprocmask
Ignoring call to sys_gettid
sys_tkill assuming self kill
```
The lowest syscall number is -8, which doesnt' fit in 3 bits -> change
to 4.
Also, we were storing the -ve number, which also doesn't fit into 3
bits -> invert it when we store it.
This reorders the bootinfo struct to place the untyped array as the
last element. Having the array at the end makes the layout of the
information in this struct easier to represent in other languages.
This commit implements the body of SELFOUR-499. The API exposes the x86 DR0-7
and ARM coprocessor 14 features to userspace by virtualizing them as context-
switched registers in the TCB. Implemented as TCB invocations. This feature is
only built when CONFIG_HARDWARE_DEBUG_API is selected.
* Add low-level support routines for setting, unsetting, getting, enabling
and disabling breakpoints.
* Add support for single-stepping as well.
^ Single-stepping is not supported on ARMv6 since the hardware
doesn't have support.
^ ARM implements single-stepping as instruction breakpoints
configured to fault on every instruction -- this is achieved through
the "mismatch" mode, which is only supported from ARMv7 onwards.
* Also support explicit software break requests, a la "BKPT" and "INT $3".
* New invocations:
* seL4_TCB_SetBreakpoint().
* seL4_TCB_GetBreakpoint().
* seL4_TCB_UnsetBreakpoint().
* seL4_TCB_ConfigureSingleStepping().
* New constants:
^ Event types:
^ seL4_InstructionBreakpoint.
^ seL4_DataBreakpoint.
^ seL4_SoftwareBreakRequest.
^ Access types:
^ seL4_BreakOnRead.
^ seL4_BreakOnWrite.
^ seL4_BreakOnReadWrite.
^ Exports:
^ seL4_NumHWBreakpoints.
^ seL4_NumExclusiveBreakpoints.
^ seL4_NumExclusiveWatchpoints.
^ seL4_NumDualFunctionMonitors.
^ seL4_FirstBreakpoint.
^ seL4_FirstWatchpoint.
^ seL4_FirstDualFunctionMonitor.
See documentation in the seL4 API manual.
Where MCP = Maximum Controlled Priority
This commit adds:
* seL4_TCB_SetMCPriority
and changes the arguments to
* seL4_TCB_Configure
As of this commit, a thread cannot create or set a threads
priority (including itself) above its mcp. Previously the kernel
did this check against a threads priority, which prevented a thread
from setting it's own priority down and then up again.
Refactors syscalls to use common base functions for assembly stubs.
As a result of this refactor the problem of low optimization levels
breaking the syscall stubs is also resolved.
* commit '8e77cdb5e91e971f49747492a3350c2b443a3827':
SELFOUR-421: Add padding for untyped in bootinfo
SELFOUR-421: minor changes for c-refine
SELFOUR-421: fix up boolean equality in Arch_sameObjectAs
SELFOUR-421: added device check to sameObjectAs
SELFOUR-421: Arch_createObject changed to use new user_data_device in ghostupdates for device pages
SELFOUR-421 Introduce explicit device frames and untypeds
Kernel objects cannot be created from device untypeds, with the
exception of frames, which do not get zeroed and cannot be used
as an IPC buffer. Device untypeds additionally cannot be used
in the construction of ASID pools.
This then changes the API to the rootserver (i.e. bootinfo) to
send device untypeds instead of device frames. On ARM these
device untypeds are the same as the previously exported device
frame regions. On x86 PCI scanning is removed and all physical
memory addresses (that are not important for kernel integrity)
are released to the user.
In order to have bits in the frame and untyped caps on ARM the
number of software ASIDs had to be reduced from 2^18 to 2^17,
and the maximum untyped size reduced from 2^31 to 2^30
This adds a dummy header with syscall prototypes with doxygen comments.
The build process for the manual includes parsing these comments using
doxygen. Doxygen produces an xml file which is parsed by a script to
generate latex which is included in the manual. This approach was chosen
over doxygen's native latex output to gain greater control over the
formatting of the generated documentation, and to take advantage of
existing api-formatting support in the sel4 manual.
Related issue: SELFOUR-606
Given that the log buffer is now
(79291252a8) in user-level, the kernel doesn't have
to dump and send the size for users. Users have to take care of this.
Adds the following constants to libsel4
and uses them in the kernel.
seL4_SectionSize (arm)
seL4_SuperSectionSize (arm)
seL4_HugePageSize (x86 - pae)
seL4_LargePageSize (arm)
seL4_DataFault
seL4_InstructionFault
* commit 'da0c39f473270a965d8ad73774a204290dd5b44b':
libsel4: Tidied comments and moved compound rights
libsel4: Use pragma once in cap rights header
libsel4: Added cap rights interface wrapper
Condition invocation labels where added in commit 73837c8ace
This commit guards usage of conditionally generated labels during generation
of the syscall stubs.
* commit 'eee71654b2c7e13ff282109845073794b337b060':
arm-hyp/tk1: add ARM_HYP as a dependency
arm-hyp/tk1: remove unnecessary check
arm-hyp/tk1: make style
arm-hyp/tk1: address review comments.
arm-hyp/tk1: address review comments.
arm-hyp/tk1: should trap SMC from guest kernel
arm-hyp/tk1: remove const number
arm-hyp/tk1: make style
arm-hyp/tk1: add default SMMU translation for VM
arm-hyp/tk1: enable SMMU interrupts
arm-hyp/tk1: reserve the SMMU interrupt
arm-hyp/tk1: fix bugs found during testing
arm-hyp/tk1: add the missing return
arm-hyp/tk1: put iospace caps to bootinfo
arm-hyp/tk1: disable/enable SMMU in secure mode
arm/tk1: connect objects with SMMU invocations
arm/tk1: a checkpoint for iospace.c
arm/tk1: a checkpoint for SMMU implementation
Benchmark feature that currently:
- Keeps track of system calls info
- Start time
- Duration
- Capability type
- Invocation tag
- Log the number of invocations of each system call*
- Log the number of invocations for each capability type per syscall.
- Has 3 new syscalls (dump, reset, get size).
- This new feature uses the existing log buffer (which is 1MiB for x86
and ARM). Since the number of syscall invocations is not
deterministic, the logged number of invocations is limited by the size
of the buffer. I suggested to enable the users to pass their own
user-level buffer, to enable more flexibility, later.
- ENABLE_BENCHMARKS is now a parent config option of trace points and
system call track features, they can't be used at the same time.
They would get shifted by the size of the type rather than the
size of the word. This wasn't detected initially as the master
branch of the kernel does not have any double word types in the API.
`syscall_stub_gen` has hardcoded constants for word size, this patch removes
that constraint and makes the word size an argument to the program instead.
The word size can either be passed either as command line arugmemt (-w option)
or a path to the build configuration file can be given(-c option) and the
generator will use the value of `CONFIG_WORD_SIZE` instead.
The `Makefile` in `libsel4` calls the generator with the configuration file as
an option.
Ideally, the architecture should be determined from the configration file, but
since we don't have unit tests for the generator, I will make one change at a
time.
This commit also includes a few changes to make it Python 2.7 compliant.
Rename all functions, constants and types in libsel4 that are in the
general x86 architecture to have an X86 name instead of an IA32 name.
As libsel4 and the kernel share names this requires changing those
in the kernel as well.
All the original IA32 names can still be used for the moment, but are
marked as deprecated.
This merely aligns the libsel4 bootinfo declaration with kernel.
Each change corresponds to a place where the kerne bootinfo_t
structure is using a uint32_t
Current bootinfo defines two slot regions for paging structures,
one for page directories and one for page tables. This does not
easily generalise for N levels of paging structures. This change
uses a single region that has a known order of objects for however
many levels exist
Restructure the x86 interrupt handling to allow for a more flexible
method of using IOAPIC and MSI interrupts. The essence of this change
is to allow for the user to pick, for both IOAPIC and MSIs, which
CPU vector to use. Additionally there is future support, in the API,
for seL4 to eventually protect MSI interrupts with the vt-d interrupt
routing tables.
API behaviour for legacy systems using the PIC is preserved
Part of SELFOUR-281
Moving the section and super section objects to the aarch32 mode headers caused the
object orders to be reordered, which breaks verification. This commit undoes this
until it can either be verified or refactored a different way.
* commit '1a1110a0949c76a2d372e2bba6b2526898c51a68':
Modify Kconfig and Makefile for aach32 as sel4_arch libsel4: updates to include aarch32 as sel4_arch
Guarding code with #ifdef's makes even cursor testing of 'does this code compile'
difficult due to code being hidden by the pre-processor. Using config_set in
regular C if statements is performant as the compiler can trivially detect
dead code at compile time, and at -O1 and above will not even link in symbols
referenced by dead code in these blocks, so this will not bloat image size
Guarding code with #ifdef's makes even cursor testing of 'does this code compile'
difficult due to code being hidden by the pre-processor. Using config_set in
regular C if statements is performant as the compiler can trivially detect
dead code at compile time, and at -O1 and above will not even link in symbols
referenced by dead code in these blocks, so this will not bloat image size
This commit deprecates seL4_ReplyWait, removes seL4_NBwait completely,
and changes the return type of seL4_Wait to void (seL4_Wait should be
used for notification objects, and seL4_Recv should be used where
seL4_Wait was used previously for endpoints).
The 'WithMRs' variants of the syscall stubs are known to be broken
on ARM with GCC at -O0. This commit prevents the generation and
usage of these stubs when -O0 is set in the common tool configuration
options.
Due to limitations in specifying Kconfig constraints, and to preserve
the existing meaning of the Kconfig variables, the 'LIB_SEl4_STUBS_USE_IPC_BUFFER_ONLY'
config variable has to be duplicated with two variants, one for use
when the user is free to pick either and one hidden for when selection
has to be forced. Also to prevent the sub options from not appearing
in the libsel4 submenu I had to change libsel4 to be a 'true' menu
instead of a 'menuconfig'
This commit closes SELFOUR-187
