autoconf.h is expected to contain all defined config options for an seL4
build configuration. Having these redefinitions were leftover from when
the verification build system didn't produce an autoconf.h file and set
the config separately. Its more likely that these defaults would
incorrectly hide an include path misconfiguration and produce settings
that are inconsistent with the kernel's configuration.
Signed-off-by: Kent McLeod <kent@kry10.com>
Update GIC_VCPU_MAX_NUM_LR constant to reflect that only 16 list
registers are supported on GICv3. The kernel still reads the actual
number of supported list registers out of the GICH_VTR register so the
kernel would still do the right thing before this change.
Signed-off-by: Kent McLeod <kent@kry10.com>
This adds sufficient kernel support for the GICv3 interrupt controller
to be used in a virtualization context on aarch64.
This set of changes has some limitations, however it is still an
improvement on the status quo.
Limitations:
1: This only provides support for aarch64. Anyone wanting support
for aarch32 + GICv3 + virtualization would need to add additional
code.
2: This code only supports 32 priority levels. Support for more
than 32 priority requires changing the get/set_gic_vcpu_ctrl_apr
interface. This is feasible, but requires a more invasive set of
changes. 32 priority levels has been shown to be sufficient in
practise.
Impacts on verification:
This set of changes should only impact Aarch64 Hypervisor
configurations. This is not yet verified so should not have
an impact on verification.
Level of testing:
This has been tested on an iMX8QXP based board. Testing
has at this point in time been limited to a single virtual
machine.
Note: support for this board is not yet upstrea, but is
currently being prepared.
Explanation of changes:
Ideally a new config item would not be required and this
could be driven purely by DTS and hardware.yml configuration.
However, the structures.bf requires changes. This can only
deal with config.h header files, not other more complex
header files. As such it was necessary to introduce a config
item which can be used for this purpose.
The appropriate platforms (as determined by examination of
DTS files) have been updated with the appropriate config
setting. This config setting only has any relevance if
hypervisor mode is already enabled, so should not cause
any difficulty for existing code or configuration.
Note: No testing has been performed on the updated
platforms.
There may be alternative factorings of this, which could
be considered in future work.
Signed-off-by: Ben Leslie <benno@brkawy.com>
- The field 'slot_pos_max' from 'ndks_boot' is not needed, the value
stored there is the constant BIT(CONFIG_ROOT_CNODE_SIZE_BITS).
- Improve the error message if the limit has been reached
Signed-off-by: Axel Heider <axelheider@gmx.de>
CONFIG_MAX_NUM_IOAPIC can end up being 0 when the kernel is configured
as PIC-only. This code is then unreachable, but gcc-10 can't figure
that out and fails on array-out-of-bounds access (which would be
correct if the code were reachable).
Signed-off-by: Gerwin Klein <gerwin.klein@proofcraft.systems>
Credits for this one should go to clang-11, which correctly flags that
the big `||` always yielded true and was not doing what was intended.
This means, previously the only possible cache attribute for EPT was
EPTWriteBack.
Signed-off-by: Gerwin Klein <gerwin.klein@proofcraft.systems>
The option -mno-outline-atomics used to be default before gcc-10 and
now needs to be provided explicitly. Without it gcc will produce
references to `__aarch64_ldadd8_acq_rel` which it expects to exist
in libgcc which we are not linking against.
Signed-off-by: Gerwin Klein <gerwin.klein@proofcraft.systems>
Adding a link to Gernot's blog post that explains what GPL on seL4
means for other code. This is mainly intended for people who aren't
that familiar with what all of these licenses mean.
Closes#524
Signed-off-by: Gerwin Klein <gerwin.klein@proofcraft.systems>
The function name handleUnknownSyscall() is slightly misleading, it
handles all non-standard seL4 syscalls used in debug builds also.
Signed-off-by: Axel Heider <axelheider@gmx.de>
TQ Group produces a system-on-module family called TQMa8Xx.
The user manual for this SoM is available here:
https://www.tq-group.com/filedownloads/files/products/embedded/manuals/arm/embedded-modul/TQ-Socket/TQMa8Xx/TQMa8Xx.UM.0104.pdf
This SoM comes in a number of different configurations.
The specific NXP SoC used, and the amount of memory are both
configurable.
The TQMa8XQP is the part number for the TQMa8Xx family configured with
the i.MX 8QuadXPlus SoC.
The datasheet for the SoC is available here:
https://www.nxp.com/docs/en/data-sheet/IMX8QXPAEC.pdf
In addition to the SoC being configurable the amount of SDRAM
on the SoM is also configurable.
The support provided in this PR is specifically for the TQMa8XQP
configured for 1GiB of memory. Note: Actual usable memory available
to the ARM application processor is 1022MiB.
System-on-modules rely on an appropriate carrier board.
Testing of this PR has been done on the MBa8Xx carrier board
that is available from TQ Group as part of their starter kit.
To the best of my knowledge there is nothing in this PR
that depends on the carrier board itself; all code is SoM
specific and should support any carrier board.
Note: This support is very specifically for the TQMa8XQP configured
with 1GiB of memory.
This may be a starting point for supporting other boards that
also have the NXP i.MX 8QuadXPlus SoC (as well as the i.MX 8DXP
and possibly other SoC in the i.MX 8 family).
Support is limited to the specific SoM due to the way in which
platform support currently works for seL4. Building a kernel
currently relies on the information from the DTS file (which is
SoM + RAM configuration specific). It would be preferable to
allow more generic support but SoC families but that is beyond
the scope of this PR.
Signed-off-by: Ben Leslie <benno@brkawy.com>
The idle_thread() cannot perform any stack manipulations since it
runs in the idle thread TCB context. Declare the function with
the naked attribute, to ensure that the compiler always eliminates
the function prologue. Previously we rely on the -O2 optimization
flag for this, which on certain compilers (clang for instance) may
not guarantee that the function prologue gets eliminated.
Signed-off-by: Chang Liu <chang_liu3@brown.edu>
clang-11 warns "converting the enum constant to a boolean". The
comparison generates the same code, since the expression can
be evaluated at compile time (I checked the objdump).
Signed-off-by: Gerwin Klein <gerwin.klein@proofcraft.systems>
The structure actually describes kernel frames and not kernel devices.
In most of the cases a peripherals will fit into one page, but some can
need more pages. On some platform there are no kernel devices at all.
Provides the macro NUM_KERNEL_DEVICE_FRAMES as simple way to find out if
there are mapping that hides the corner cases. This eventually allows
implementing a generic handling even on RISC-V without much overhead, so
the hack for HiFive/Spike can be removed.
Signed-off-by: Axel Heider <axelheider@gmx.de>
As a side effect, the BIT() macro creates a word_t instead of an int,
so it can can handle even shift that exceed the int limits. This makes
the code more robust and provides the preferred coding pattern.
Signed-off-by: Axel Heider <axelheider@gmx.de>
Kernel device frames can never be executable. Even is this is generated
code, having an other assert here is a safe guard to catch potential
inconsistencies in the code generator.
Signed-off-by: Axel Heider <axelheider@gmx.de>
Using explicit field name in the assignment states more clearly what the
generated code does. It is also more robust and allows the compiler to
catch potential inconsistencies in case the structure details change.
Signed-off-by: Axel Heider <axelheider@gmx.de>
The trigger action sends repository_dispatch events to all
main test repositories of the manifests this repo is part of.
Signed-off-by: Gerwin Klein <gerwin.klein@proofcraft.systems>
This implements GitHub PR #115 on the current repo state. /usr/bin/env
is already used for other (cmake/python/etc) invocations, and this PR
brings bash/sh into line with that for slightly improved portability.
Co-authored-by: Douglas Wilson <douglas.wilson@gmail.com>
Signed-off-by: Gerwin Klein <gerwin.klein@proofcraft.systems>
Co-authored-by: Oliver Scott <Oliver.Scott@data61.csiro.au>
Co-authored-by: Axel Heider <axel-h@users.noreply.github.com>
Signed-off-by: Gerwin Klein <gerwin.klein@proofcraft.systems>
Memoization is not worth it here, the runtime of the entire program
is tiny. Removing the comment to curb temptations in the future.
Signed-off-by: Gerwin Klein <gerwin.klein@proofcraft.systems>
MAX_NUM_FREEMEM_REG is used to define the number of elements of the
array ndks_boot.freemem[]. However, in the code iterating over the
elements, using the macro ARRAY_SIZE() is more straight forward and
avoids pulling in unnecessary dependencies.
Signed-off-by: Axel Heider <axelheider@gmx.de>
This removes the operations that trigger a reschedule or reprogram the
timer from `preemptionPoint` to ensure the relevant state updates in
the proof occur where they are easier to verify.
Signed-off-by: Gerwin Klein <gerwin.klein@proofcraft.systems>
Avoid the warning 'WARNING:root:Not sure how to parse interrupts for
"/cpus/cpu@0/interrupt-controller"' when building for platform hifive.
Signed-off-by: Axel Heider <axel.heider@hensoldt-cyber.de>
The additional 8 byte go into a new page and then the rest of the page
is filled with padding. There is no good explanation what the 8 bytes
are used for, could be some copy/paste from another linker script.
Signed-off-by: Axel Heider <axel.heider@hensoldt-cyber.de>
Fix some cases where `NODE_STATE` arguments were parenthesised in a
manner that was inconsistent with other uses (but also surprisingly
still valid?).
Signed-off-by: Curtis Millar <curtis@curtism.me>
When we are changing to a new SC, it doesn't matter whether the old SC
is still configured. We should also know statically within
switchSchedContext that whichever SC we will use to execute with next is
both present and configured.
As such, this check can be removed.
Signed-off-by: Curtis Millar <curtis@curtism.me>
