Change AP boot code to use a memory region that is lower down, although also
smaller. As long as the boot code can fit in this smaller region booting is
more reliable as depending on the machine, bios, firmware and bootloader
varying amounts of the low memory will be available.
This commit changes the stack so that it is declared a single time in stack.c,
with the correct attributes and alignment, instead of being declared in stack.h
and relying on the linker to collapse the multiple declarations.
Previously if the `ksCurThread` of the destination core is not the thread that is
receiving the notification in `sendSignal` then the notification would be delayed
until the VMM for that VM next did a `seL4_VMEnter`. This adds a `tcb_t*` parameter
to `VMCheckBoundNotification` instead of having it implicitly talk about `ksCurThread`.
A TCB parameter is safe to send here as the `doRemoteVMCheckBoundNotification`
happens synchronously and so the TCB is guaranteed to still exist.
Provides a mechanism where if af GP fault is potentially expected it can be caught
and the calling code returned to. The GP happening can be detected by setting
a specific return to handler and additionally by the return to handler being
cleared if a GP happened.
This commit allows x86 to completely handle a pending interrupt without switching
out to user mode. To handle an interrupt on x86 the APIC *must* generate an exception,
prior to you being able to acknowledge it. Previously we only allow exceptions (i.e.
interrupts) to be generated outside of kernel mode when we are in user mode.
This change allows us to 'poll' for an interrupt and transition the APIC whilst in kernel
mode by enabling and taking interrupts at carefully defined points. A pending interrupt
will be stored by the exception handler, allowing us to then handle the interrupt and
acknowledge the hardware APIC. Handling is done by waiting until after we have 'left' the
kernel and are about to switch to user mode and then 'entering' the kernel again by jumping
to the interrupt entry point.
Handling interrupts entirely in kernel mode provides two advantages
* It will allow, in the future, the ability to handle kernel interrupts in situations
where we need to handle the interrupt before actually performing the hardware switch
back to user mode. This case happens where the user thread is using vt-x and so
pending interrupts do not generate an interrupt exception, but rather cause an exception
to be generated telling the system that there is a pending interrupt
* Where there are multiple pending interrupts it is more efficient to avoid additional
switches in and out of the user thread
Whilst this change does not enable pre-emption points to handle the interrupt before
returning out of `handleSyscall` it should be easily implementable with what is provided.
Adds space in the vcpu_t struct for the registers from the different operating modes
and saves/restores these registers as part of saving and restoring the VCPU
Previously any thread could be set to run in any mode (except HYP mode).
Whilst this causes no security issues for the kernel, different execution
modes in ARM have different banked registers. These registers are not
currently saved and restored allowing for threads to manipulate registers
that will be seen (or potentially are being actively used) by other threads.
Saving and restoring these banked registers for all threads is a performance
cost (even if only done for the actual mode the thread runs in) for no real
benefit, as there is no clear reason to run a thread in other modes if you
do not have a vcpu. Therefore this commit restricts being in modes other than
user to threads that have a vcpu. When multiple VCPUs are properly supported
the switching of VCPUs will then save/restore these banked registers.
Prior to this commit virtual addresses in the bitfield were considered
to be 48-bits, with sign extension to 64-bits. This meant that we were
actually sign extended bit number 47. Whilst this gives correct cannonical
addresses it prevents a portion of the address space from being used.
This commit changes the bitfield to use 49-bit virtual addresses, so that
after the bit 48 is used for sign extension there is still 48-bits of
usable address.
The ARM_MPCORE configuration was added to capture which systems have the additional
ThreadID registers. This was an unneeded indirection as any arm version from v7 and
beyond has these registers. For the purposes of seL4 this means any arm version
except v6. This change scrubs ARM_MPCORE and replaces it with negated usages of
ARCH_ARM_V6. Additionally the IPC buffer config defaults were updated as the
ARM_MPCORE config was explicitly selecting the optimal one.
This commit makes seL4 hold the stack address on TPIDRPRW register (PL1 only
Thread ID Register, VMSA, see B4.1.150 section of ARMv7-A and ARMv7-R
edition reference manual).
Originally, the kernel stack was (re-)mapped to a fixed kernel virtual address and
on traps sp is loaded with this virtual address. Reason is to shave up some
cycles/instructions on (fast) traps path instead of having two instructions
(loading global variable pointer and then memory-load stack address from
it).
With ARM pipelining getting smart/complex (from ARMv7 onwards), there is
no noticeable difference in performance between the two implementations.
Furthermore, this change makes it easy for SMP to load different stacks
for each core and do CPU ID arithmetic efficiently. It also avoids the
issues involving (re-)mapping stacks for different cores if we
followed the original design.
Note: the main side-effect to this change is that the kernel stack for
ARM is no longer mapped with execute-never attribute.
* commit 'be77963e5bb4c5c28ad3ebd8746c292e7b5876f6':
Define CONFIG_MAX_NUM_NODES and CONFIG_KERNEL_STACK_BITS in plat/autoconf.h
Unify kernel stack definition/declaration and share it between architecures/modes
Defines the vtd structures to be their full 52-bit size when in 64-bit mode by
making the hardware.bf per mode in the pc99 platform.
Updates some variables in iospace.c that were hard defined to be 32-bit
Rather than defining a kernel stack in random places for each
architecure for each mode (32/64) and for single/SMP modes, make the
stack definition shareable between all of the above. This is also useful
for the future ARM SMP work.
This commit is a re-arrangement of SMP directory structure to make it
easier for other architectures/platforms (in general) and ARM (in
particular) to add SMP support.
* new include/smp directory to act as a centralised container of
"shared" architecture-independent SMP headers.
This makes it clearer what's needed for other architecture/platform to
support SMP.
* Each platform can define its own unique ipi.[h|c] that make sense,
since ipi implementation is SoC/platform dependent.
Circular dependency prevents extern definition of benchmark_log_utilisation_enabled from
getting included in include/arch/arm/arch/benchmark_overflowHandler.h.
arch-level headers shouldn't depend on arch-independent headers to avoid
such circular dependency issues (in the future).
This looks like we're just swapping the positions of capEPBadge and capEPPtr,
but it turns out that the bitwise op being performed on capEPPtr to set the
high bits were part of the data dependency critical path, so this actually
does improve the speed by moving the bitwise op to capEPBadge (albeit it's
now an AND instead of an OR)
I initially set the field size to 32 bits, but it turns out that causes gcc
to emit an instruction (mov r32, r32) that causes the instruction decoder
to switch to the legacy decode path for the rest of the fast path for some
reason.
Previous code to return to user level performed
popf
sysexit
The popf was just before the sysexit as there is a one instruction
delay on the trap flag taking effect and ensured we did not attempt
to single step the kernel. Unfortunately there is not a one instruction
delay on enabling the interrupt flag, and as a result an interrupt
can be taken prior to executing the sysexit instruction. It is
possible to exploit this to escalate a user level thread such that
it is running with CPL0
This commit changes the restore paths to perform
sti
sysexit
Which will correctly delay interrupts until the completion of sysexit.
As the popf is now being done earlier to prevent single stepping the
kernel we return via an iret, instead of sysexit, for threads that
have single stepping enabled. To achieve this we
* When loading debug state if we enable the Trap flag we also manipulate
the register state such that the iret return path will be picked
* As fastpath_restore does not have an iret return path we forbid
the fastpath from switching to threads that have single stepping
enabled
* Adds object and cap definitions for VT-x structures (VCPU and EPT).
* Extends the asid_map implementation to support ASIDs in the EPT
* Adds size definitions for VCPU and EPT objects
* commit '6cd485204f0b3ca09a42770c545f0724189e7b78':
x86: Add Skylake-related info
x86: Add support for more architectures in reading the TSC frequency
This actually leads to better code. Copies of the halt loop inlined
in various places will instead be single instructions 'bl halt'. It's
also important for the translation validation to avoid having
pointless loops everywhere, especially inside the bodies of other
loops.
The vast majority of the DONT_TRANSLATE markers in the kernel are used
to hide __asm__ statements and builtin functions
(e.g. __builtin_unreachable ()) from the C-to-Isabelle parser.
The parser now supports underscore identifiers and many __asm__ statements,
and the builtin functions are prototyped, meaning the vast majority of the
DONT_TRANSLATE markers can be dropped. The remaining markers cover functions
that must be treated specially.
Add compatible prototypes for compiler builtins
__builtin_unreachable, __builtin_ctzl, __builtin_clzl,
and __builtin_popcountl.
The compiler ignores these, but they are necessary for the Isabelle
C parser to handle them. This is needed to drop DONT_TRANSLATE markers
from various functions which call these builtins.
Previously we threw away any modifications the kernel may have made
to the EFER when a VM exit happens. In x86-64 there are modifications
to the EFER that must be preserved
This unifies the interface provided by ia32 and x86-64. This interface
is neccessary as it is not always sufficient to talk about the current
PD (or vspace root), as CR3 can contain more than just the root.
x86-64 has better ways (`swapgs`) of managing per core kernel stacks.
This commit hides the `kernelSP` member of a `vcpu_t` under x86-64
so as not to cause confusion and accidental attempted usage
Previously the GP registers for a VCPU were defined in the 32-bit
arch registerset. This does not actually make sense as the mode
for the VCPU should be decoupled (and well defined) regardless of
the execution mode of the kernel. This commit provides an explicit
definition and register order for VCPU GP registers.
Uninitialized data structures in BOOT and PHYS code currently get
placed in sections that are allocated in the file of the final image.
Whilst these sections will get reclaimed during kernel boot, so no
runtime memory is being wasted, it results in kernel images that
are much larger to load and transport than necesary.
This change adds explicit BSS regions for both BOOT and PHYS code
and moves all appropriate data structures into them
seL4 is always in the top of memory, so the high bits of pointers are always 1.
The autogenerated unpacking code doesn't know that, however, so will try to
conditionally sign extend (in 64-bit mode), which wastes cycles in the fast
path. Instead, we can do the unpacking ourselves and explicitly set the high
bits.
This commit moves the write to FS and GS base, allowing for a much
more efficient write to GS base under x86-64 SMP. When writing
GS base was in Arch_switchToThread it was neccessary to write to
an MSR such that when swapgs was performed on kernel exit the new
value of GS base would be retrieved. Unfortunately writing to an
MSR is very expensive and we would much prefer to use the writegsbase
instructions instead. By moving this code to restore user context
we are able to call swapgs earlier and then use the normal
writegsbase instruction
When using, SSE (and other variants), mxcsr would assume similar role as
control word in i387 FPU. When initializing the FPU, it should have valid value.
In the common case this function expands to a single check, with a blank
body. Whilst forcively inling will cause code bloat, will be code bloat
in the uncommon code path, which we do not care about
config_default was intended to either evaluated to the passed configuration
value, or the a default value if the config didn't exist. For integer values
this does not actually work, and the default value always gets returned.
This commit reimplements the desired functionality as config_ternary, which
takes 3 arguments, a config to switch on and a desired true and false expansion
* commit 'ed95f84a438aea6365762a180cc493113e9282e0':
SELFOUR-413: changes for verification
SELFOUR-567: use seL4_CapRights_t from libsel4
SELFOUR-413: refactor libsel4 fault API
Split fault types into arch/generic
This change
* changes seL4_CapRights from the kernel to be seL4_CapRights_t in
libsel4
* deprecates the duplicated seL4_CapRights in libsel4, which is
now the bitfield generated type seL4_CapRights_t.
* fixes all usages in kernel and libsel4
Impact: for verification, this will require the type to change name
from cap_rights to seL4_CapRights_t.
This is a breaking libsel4 API change, although most code uses
seL4_AllRights or similar constants, which will not break
at a source level as these constants have been updated.
This is a *breaking API change*
This commit:
* makes seL4_Fault_tag_t common between the kernel and libsel4
* deprecates the existing functions from sel4/messages.h includes
* introduces a new fault API in sel4/faults.h and
* sel4/sel4_arch/faults.h
* deprecates seL4_GetTag(), as the function did not work without
the user calling seL4_SetTag() first (seL4_MessageInfo is passed
in registers and not set in the IPC buffer)
* removes previously deprecated functions (deprecated prior to 3.0.0)
* updates the seL4 manual to reflect the changes
Prior to this commit faults were separate
per architecture. This commit extracts the common
fault types and introduces arch specific faults,
reducing code duplication across architectures.
Adds a heuristic to switch to a NULL fpu state if we think the FPU
is not presently in use. A NULL fpu state is more efficient as
we do not have to enable/disable the FPU when switching threads
The compiler fails to realize that inlining these functions is
a performance benefit due to fact that after inlining their
bodies can be optimized with other inlined functions.
The use of 'volatile' on the asm blocks used by getCurrentCPUIndex
resulted in an inability for the compiler to elide repeated invocations
of getCurrentCPUIndex when inlining. The volatile is not needed
as we already want to claim that these functions are CONST and so
the asm block can be move/reordered/deleted as the compiler wishes
When sending a signal to a notification object that has a bound thread that is
in the 'runningVM' start we, ordinarily, want to deliver it by switching back
to the native execution of that thread and delivering the message. If the thread
is in the 'runningVM' state on a different core, then we must not modify its
thread state. Previously we would modify the thread state (changing it to
Running) and then attemptSwitchTo. Switching would fail, as its affinity would
be for a different core, resulting in us enqueing the thread into the
scheduling queue, despite the thread also presently running.
This commit both adds a check to prevent us manipulating a thread that
is actively running on a different core, as well as a remote operation
to tell that core that if it is running a VM it should recheck its
endpoint for a message.
benchmark.h requires a definition of KS_LOG_PPTR, but its previous
placement in machine.h resulted in a circular include. This commit
factors out KS_LOG_PPTR and related definitions to a separate header,
creates the corresponding header for x86, and prevents circular
includes in the x86 builds
Adds support for per-core kernel stacks through the use of
thread local storage and swapgs. In addition to the main
kernel stack the IRQ stack also needs to be made per core
Defines the TLB bitmap to be located, virtually, just below the kernel
window. To get an initialized bitmap in each new address space we
change copyGlobalMappings to copy from USER_TOP (which includes the
initialized TLB bitmap in the global address space) instead of just
the kernel window base
This commit adds support for using the ThreadID registers of the ARM MPCore
platforms for storing the address of the IPC buffer instead of the globals
frame. The choice of using the user readable/writeable ThreadID register
is chosen, even though it means the user cannot use it for its own
purposes, as it leaves room in the future for doing TLS support in the
user read only register, where compilers expect it.
This commit adds support for saving/restoring an additional register
that exists on ARM MPCore platforms. As this register is user wrieable,
as well as readable, it must saved and restored by the kernel to
prevent gross information channels.
Although this function is called from the fastpath inside of an
`unlikely` macro and the function itself gets inlined, the knowledge
that this conjunction is unlikely is somehow lost. Explicitly putting
a `likely` here fixes it
Removes the recycle operation and adds an operation
to cancel any badged sends on and endpoint. Calling
Revoke + CancelBadgedSend is equivalent to Recycle
on a badged endpoint
This removes usages of CONST Arch_activateIdleThread. According to
gcc 'a function that has pointer arguments and examines the data
pointed to must not be declared const'. Whilst these functions do
not presently examine their tcb_t pointer argument, it seems
pointless to pass something that can never be safely looked at.
Further a function that returns void and is CONST is utterly meaningless
This commit does the following:
* invert the bit field scheduler for better cache performance for high priority threads
* peeks into the bitfield scheduler to allow fastpath to be leveraged when IPC occurs from lo --> hi priority threads if correct
Previously generic functions for manipulating page table and page
directory entries were placed in mode/structures.h. These are moved
to a mode/vspace.h instead so that they can use existing functions
defined in arch/vspace.h.
The x86_make_pde_mapping function is dropped in this move as it is
not used. Instead it is replaced with a function for creating an
empty mapping for whatever is the vspace root.
1. Missing loop counter when accessing to PD in 'tlb_bitmap_get'.
2. Missing 'TLBBITMAP_PD_INDEX' in 'TLBBITMAP_PD_MAKE_INDEX'. The index generated by 'TLBBITMAP_PD_MAKE_INDEX' should be valid in PD while the original one used to generate just 0, 1, etc. The correct index is '0 + TLBBITMAP_PD_INDEX', '1 + TLBBITMAP_PD_INDEX' and so on.
When checking if a thread is using the FPU or not we now check on that
threads core, under the assumption that if a thread migrates its FPU
state is explicitly (and not lazily) migrated.
Change to the order of operations and timing behaviour of
invokeUntyped_Retype. The Retype operation now zeroes the
entire range of the Untyped cap (if it is being used for
the first time) before installing any objects. This avoids
the need for long-running initialisation of large objects,
whose initial contents are always zero. The initial zeroing
phase is preemptible, and may take multiple timeslices to
complete.
* commit '25bb94372fe4afce072959af88c1afe9ff1c67d3':
SELFOUR-635: support for TCB operations This will update TCB invocations to consider multicore environment, this may include: - adds the affinity invocation to transfer TCB between different cores and update TCB structure for core ID - checking the thread/core state before performing TCB operation, e.g. deleting the runnable TCB, etc
This will update TCB invocations to consider multicore environment, this may include:
- adds the affinity invocation to transfer TCB between different cores and update TCB structure for core ID
- checking the thread/core state before performing TCB operation, e.g. deleting the runnable TCB, etc
statedata.h gets included from arch/machine.h, and statedata
does not require any of the machine.h definitions.
As a result of removing this various other, previously missing,
includes need to be added
benchmark_track.h does not depend upon anything in debug.h and
so it does not need to include it. Once this include is removed
debug.h can pull its definition of ksKernelEntry from benchmark_track.h
x86/arch/machine/hardware.h gets include via types.h (through the
compound_types.h header). As this header is defining compound types
it really only needs access to the basic types (i.e. stdint.h)
The lowest syscall number is -8, which doesnt' fit in 3 bits -> change
to 4.
Also, we were storing the -ve number, which also doesn't fit into 3
bits -> invert it when we store it.
* commit 'e3f764a65be484d89e29ebc22ea406f1438ae3d3':
Benchmark: move arch-dependent benchmark.c from api/ to new benchmark/ directory
Benchmark: Pack arch-independent benchmark-related files into separate directories
* commit 'cdc869309b69d04c8682f166755c26cc7a401667':
arm_hyp: Used cached value for num LRs
arm_hyp: Add lazy vcpu switching
arm_hyp: Declare armHSCurVCPU in header
arm_hyp: Correctly destroy armHSCurVCPU
arm_hyp: Move hype state into correct statedata header
Hardware debugging was already supported if using SYSCALL for kernel
invocations, this adds support for when using SYSENTER. SYSENTER
is special because when entering the kernel the TF flag is not masked,
so the case of taking a debug exception in the kernel needs to be
handled. Also, unlike ia32, there is a race between performing
popf and calling sysexit where interrupts can be received. This race
is avoided by performing a full state restore with iret if a thread
is single stepping.
The hypervisor state is declared in arch/32/statedata.c, but is
defined in arch/statedata.h. This commit moves the definitions to
arch/32/statedata.h to match all the other state in arch/32/statedata.c
Having a different name for the FLAGS register creates an unnecessary difference
between ia32 and x86_64 code since regardless of the name/size the bits in the
register mean exactly the same thing
This commit implements the body of SELFOUR-499. The API exposes the x86 DR0-7
and ARM coprocessor 14 features to userspace by virtualizing them as context-
switched registers in the TCB. Implemented as TCB invocations. This feature is
only built when CONFIG_HARDWARE_DEBUG_API is selected.
* Add low-level support routines for setting, unsetting, getting, enabling
and disabling breakpoints.
* Add support for single-stepping as well.
^ Single-stepping is not supported on ARMv6 since the hardware
doesn't have support.
^ ARM implements single-stepping as instruction breakpoints
configured to fault on every instruction -- this is achieved through
the "mismatch" mode, which is only supported from ARMv7 onwards.
* Also support explicit software break requests, a la "BKPT" and "INT $3".
* New invocations:
* seL4_TCB_SetBreakpoint().
* seL4_TCB_GetBreakpoint().
* seL4_TCB_UnsetBreakpoint().
* seL4_TCB_ConfigureSingleStepping().
* New constants:
^ Event types:
^ seL4_InstructionBreakpoint.
^ seL4_DataBreakpoint.
^ seL4_SoftwareBreakRequest.
^ Access types:
^ seL4_BreakOnRead.
^ seL4_BreakOnWrite.
^ seL4_BreakOnReadWrite.
^ Exports:
^ seL4_NumHWBreakpoints.
^ seL4_NumExclusiveBreakpoints.
^ seL4_NumExclusiveWatchpoints.
^ seL4_NumDualFunctionMonitors.
^ seL4_FirstBreakpoint.
^ seL4_FirstWatchpoint.
^ seL4_FirstDualFunctionMonitor.
See documentation in the seL4 API manual.
syscall/sysret is an additional way of performing kernel entry/exits.
Whilst the instructions themselves are not supported when running
in 32-bit mode, this commit provides the config choice for them as
well as the generic support code for them.
Where MCP = Maximum Controlled Priority
This commit adds:
* seL4_TCB_SetMCPriority
and changes the arguments to
* seL4_TCB_Configure
As of this commit, a thread cannot create or set a threads
priority (including itself) above its mcp. Previously the kernel
did this check against a threads priority, which prevented a thread
from setting it's own priority down and then up again.
Adds a mapping type to frame caps that tracks
what kind of hierarchy the cap is mapped into;
an MMU, IOMMU and in the future an EPT structure.
Additionally the IOMMU code is updated to
have correct functionality and be verification
friendly.
The TK1 manual's address map has a 16K MMIO region called the "Misc" region,
where they lump together several controllers that aren't all page aligned,
including a USB controller and a SATA controller of some kind.
They also lump the pinmux controller into this "misc" region, but the
pinmux controller is at a page aligned boundary, and has no other devices
sharing that page, so it can be split off into its own device untyped.
This also makes it easier to request that mapping from userspace.
- update core detection code and Kconfig file
- update kernel stack managment so that BSP does not use boot stack before IPI APs
- move arch dependant data to a single structure
- add cache line size to Kconfig
- add cpu indexing and apic id mapping
- boot APs to halting state
- add guard for kernel stack if there is only one core
The ACTLR register is not a PL2 exclusive register, and is architecturally
defined to exist (although the contents of the register are implementation defined).
* commit '8e77cdb5e91e971f49747492a3350c2b443a3827':
SELFOUR-421: Add padding for untyped in bootinfo
SELFOUR-421: minor changes for c-refine
SELFOUR-421: fix up boolean equality in Arch_sameObjectAs
SELFOUR-421: added device check to sameObjectAs
SELFOUR-421: Arch_createObject changed to use new user_data_device in ghostupdates for device pages
SELFOUR-421 Introduce explicit device frames and untypeds
Kernel objects cannot be created from device untypeds, with the
exception of frames, which do not get zeroed and cannot be used
as an IPC buffer. Device untypeds additionally cannot be used
in the construction of ASID pools.
This then changes the API to the rootserver (i.e. bootinfo) to
send device untypeds instead of device frames. On ARM these
device untypeds are the same as the previously exported device
frame regions. On x86 PCI scanning is removed and all physical
memory addresses (that are not important for kernel integrity)
are released to the user.
In order to have bits in the frame and untyped caps on ARM the
number of software ASIDs had to be reduced from 2^18 to 2^17,
and the maximum untyped size reduced from 2^31 to 2^30
The previous macro computed to (0 - sizeof(tcb_t)). Basically a negative
number, which is just a really big unsigned number, so this macro was
basically allowing TCB naming of any length.
* commit 'fbc071b4f11b3d7d423e26908a661f416b07cda2':
SELFOUR-630:preliminary booting application processors - update core detection code and Kconfig file - update kernel stack managment so that BSP does not use boot stack before IPI APs - move arch dependant data to a single structure - add cache line size to Kconfig - add cpu indexing and apic id mapping - boot APs to halting state - add guard for kernel stack if there is only one core
- update core detection code and Kconfig file
- update kernel stack managment so that BSP does not use boot stack before IPI APs
- move arch dependant data to a single structure
- add cache line size to Kconfig
- add cpu indexing and apic id mapping
- boot APs to halting state
- add guard for kernel stack if there is only one core
The first time the irq number is read from the controller, the interrupt
is acknowledged. Subsequent reads of the irq number result in an invalid
irq number being read.
This modifies the kzm interrupt controller driver to save the current irq
number when it's first read from the interrupt controller, preventing the
need for future reads from the controller until the next interrupt arrives.
s/ASID_POOL_BITS/ASID_POOL_INDEX_BITS
Current convention is to say that X_BITS is the log base 2
size of an object, not the log base 2 number of indices
* commit '57f1352ff70cb2de18768174d257d151e4fd12e8':
SELFOUR-614: calling halt() on the hikey platform results in infinite data abort SELFOUR-408: halt does not halt
- separate putDebugChar and putConsoleChar
- this only has effect on x86 where 2 serial ports are initialised by
the kernel
- for arm, putConsoleChar just calls putDebugChar
It can be deseriable to run code before/after user mode, but
not have to write it in assembly. This commit adds such stubs
that get called as the first/last C code when coming in
and out of the kernel
* Change restore_user_context() and fastpath_restore() to call POPF
just before SYSEXIT.
* Also change the way registers are loaded such that we don't access
memory that is not guarded by the current position of the stack pointer.
The reason for this change is that EFLAGS.TF, the Trap Flag, only takes
effect on the instruction AFTER the instruction that sets EFLAGS.TF. The
reason Intel/AMD did it this way is to allow the kernel to enable EFLAGS.TF
for userspace, without it taking effect on kernel instructions BEFORE
the CPU actually has returned to userspace.
EFLAGS.TF enables single-stepping. So the full picture is that since we
executed other instructions between POPF and SYSRET, those instructions
were triggering single-stepping IN the kernel. To solve this, we must
put POPF immediately before SYSRET.
Given that the log buffer is now
(79291252a8) in user-level, the kernel doesn't have
to dump and send the size for users. Users have to take care of this.
Adds the following constants to libsel4
and uses them in the kernel.
seL4_SectionSize (arm)
seL4_SuperSectionSize (arm)
seL4_HugePageSize (x86 - pae)
seL4_LargePageSize (arm)
seL4_DataFault
seL4_InstructionFault
* commit '16c3481109e2024d6fd65365ea94265ead37dcca':
SELFOUR-518: User-level log buffer
Benchmark: share and use KS_LOG_PPTR and PPTR_TOP for x86 and ARM
CPSR_IDLETHREAD was introduced in a5f61c7 to mask FIQs and asynchronous
aborts. Usage of this was lost in a merge, this commit restores the
usages in Arch_configureIdleThread, and updates CPSR_IDLETHREAD to
use the correct PMODE depending on whether the kernel is running
in hypervisor mode or not
If an irq over max IRQ came in (unlikely) then it would result in an
array bounds over flow. gcc detected this as a result of the inlining of
the irq functions.
* rename physBaseMapping to BASE_OFFSET
* because physBaseMapping was only used explicity in a few places
* move duplicated arm definions up a level
- PPTR_TOP
- PADDR_TOP
- BASE_OFFSET
Inline non-boot irq functions called on the irq path.
This improves performance of interrupt paths through code locality.
Additionally, remove unused functions and use the BIT macro
rather than redefining it.
When hypervisor extensions are not enabled the boot code cannot
actually call vcpu_boot_init as the symbol names do not even
exist. This is fixed be defining macros that expand to nothing
This commit wraps accesses to the vgic in functions that are marked as
DONT_TRANSLATE and uses a global constant (that is determined at boot time)
for the number of LR registers to prevent loops that have undefined bounds
* commit '3ffa58aa1fb75c65fac4d1351bc6e014bdda2b64':
Verification: don't translate functions that are re-implemented from assembly to C
ARM Hyp: Fix fastpath_restore on ARM Hyp and implement slowpath and restore in C
SELFOUR-526: ARM - Implement slowpath and restore_user_context in C
Fixes a bug where previously MODEL_ID() was defined as:
`#define MODEL_ID(x) ( ((x & 0xf0000) >> 16) + (x & 0xf0) )`
This was incorrect because (1) it didn't take into account the conditional
nature of the extended_model_ID, and (2) it's actually shifting the
extended_model_ID into the low bits and keeping the model_ID in the high bits,
when it should be the other way around.
This patch also introduces a foundation for more sane testing of CPU vendor,
family, model and brand_ID.
* commit 'cee1268e9bf9619b60bd85cfda0a5d5306e8cf8a':
[VER-619] Pass verification related to newly added built-in unreachable
SELFOUR-545: x86 - cleanup c_traps.c file and use new traps.h
SELFOUR-526: ARM - dummy unreachable statements after fastpath calls
SELFOUR-526: ARM - Unify C entry point for system calls
This commit moves setThreadState outside the 'perform' stage of the
invocation, and renames decodeARMIOUnmapInvocation to
performPageInvocationUnmapIO as it is actually doing a perform
and not a decode
Previously looking up the page directory base for a SysteMMU was
done by writing the ASID into the hardware and reading out the
currently set page directory for that ASID. This is confusing for
verification so this commit introduces a global translation table
for converting an ASID to a page directory.
The `VISIBLE` macro is designed to selectively inhibit the effects of GCC's
whole program and link-time optimisations. This is necessary when a C function
is only referenced from a context outside the compiler's visibility, e.g. an
assembly file. As far as I can determine, Clang's link-time optimisations
already account for this possibility and do not need to have this information
manually indicated to them (see, for example, Linux's compiler support headers).
In any event, `__attribute__((visibility("default")))` is not equivalent to
`__attribute__((externally_visible))`, but is instead for controlling symbol
visibility in a library-like setting. This commit removes this incorrect
expansion.
Previously the return value of cap_get_capPtr was compared to 0 in
sameRegionAs to emulate a check in the abstract specification that
tests if the cap is a physical cap or not. Overloading 0 results
in a scenario where a legitimate deviceUntyped's children do not
get considered to be children because they have a capPtr of 0.
This change adds and explicit function that returns whether or not
a capability is physical or not, and uses that in sameRegionAs
This commit moves a declaration of `ksKernelEntry` such that it is now only
guarded by `DEBUG`, not additionally `CONFIG_PRINTING`. This allows the kernel
to be built standalone with debugging enabled using the following invocation:
DEBUG=1 TOOLPREFIX=arm-none-eabi- CPU=arm1136jf-s PLAT=imx31 ARCH=arm \
ARMV=armv6 make
