Previous code to return to user level performed
popf
sysexit
The popf was just before the sysexit as there is a one instruction
delay on the trap flag taking effect and ensured we did not attempt
to single step the kernel. Unfortunately there is not a one instruction
delay on enabling the interrupt flag, and as a result an interrupt
can be taken prior to executing the sysexit instruction. It is
possible to exploit this to escalate a user level thread such that
it is running with CPL0
This commit changes the restore paths to perform
sti
sysexit
Which will correctly delay interrupts until the completion of sysexit.
As the popf is now being done earlier to prevent single stepping the
kernel we return via an iret, instead of sysexit, for threads that
have single stepping enabled. To achieve this we
* When loading debug state if we enable the Trap flag we also manipulate
the register state such that the iret return path will be picked
* As fastpath_restore does not have an iret return path we forbid
the fastpath from switching to threads that have single stepping
enabled
* Adds object and cap definitions for VT-x structures (VCPU and EPT).
* Extends the asid_map implementation to support ASIDs in the EPT
* Adds size definitions for VCPU and EPT objects
* commit '6cd485204f0b3ca09a42770c545f0724189e7b78':
x86: Add Skylake-related info
x86: Add support for more architectures in reading the TSC frequency
This actually leads to better code. Copies of the halt loop inlined
in various places will instead be single instructions 'bl halt'. It's
also important for the translation validation to avoid having
pointless loops everywhere, especially inside the bodies of other
loops.
The vast majority of the DONT_TRANSLATE markers in the kernel are used
to hide __asm__ statements and builtin functions
(e.g. __builtin_unreachable ()) from the C-to-Isabelle parser.
The parser now supports underscore identifiers and many __asm__ statements,
and the builtin functions are prototyped, meaning the vast majority of the
DONT_TRANSLATE markers can be dropped. The remaining markers cover functions
that must be treated specially.
Add compatible prototypes for compiler builtins
__builtin_unreachable, __builtin_ctzl, __builtin_clzl,
and __builtin_popcountl.
The compiler ignores these, but they are necessary for the Isabelle
C parser to handle them. This is needed to drop DONT_TRANSLATE markers
from various functions which call these builtins.
Previously we threw away any modifications the kernel may have made
to the EFER when a VM exit happens. In x86-64 there are modifications
to the EFER that must be preserved
This unifies the interface provided by ia32 and x86-64. This interface
is neccessary as it is not always sufficient to talk about the current
PD (or vspace root), as CR3 can contain more than just the root.
x86-64 has better ways (`swapgs`) of managing per core kernel stacks.
This commit hides the `kernelSP` member of a `vcpu_t` under x86-64
so as not to cause confusion and accidental attempted usage
Previously the GP registers for a VCPU were defined in the 32-bit
arch registerset. This does not actually make sense as the mode
for the VCPU should be decoupled (and well defined) regardless of
the execution mode of the kernel. This commit provides an explicit
definition and register order for VCPU GP registers.
Uninitialized data structures in BOOT and PHYS code currently get
placed in sections that are allocated in the file of the final image.
Whilst these sections will get reclaimed during kernel boot, so no
runtime memory is being wasted, it results in kernel images that
are much larger to load and transport than necesary.
This change adds explicit BSS regions for both BOOT and PHYS code
and moves all appropriate data structures into them
seL4 is always in the top of memory, so the high bits of pointers are always 1.
The autogenerated unpacking code doesn't know that, however, so will try to
conditionally sign extend (in 64-bit mode), which wastes cycles in the fast
path. Instead, we can do the unpacking ourselves and explicitly set the high
bits.
This commit moves the write to FS and GS base, allowing for a much
more efficient write to GS base under x86-64 SMP. When writing
GS base was in Arch_switchToThread it was neccessary to write to
an MSR such that when swapgs was performed on kernel exit the new
value of GS base would be retrieved. Unfortunately writing to an
MSR is very expensive and we would much prefer to use the writegsbase
instructions instead. By moving this code to restore user context
we are able to call swapgs earlier and then use the normal
writegsbase instruction
When using, SSE (and other variants), mxcsr would assume similar role as
control word in i387 FPU. When initializing the FPU, it should have valid value.
In the common case this function expands to a single check, with a blank
body. Whilst forcively inling will cause code bloat, will be code bloat
in the uncommon code path, which we do not care about
config_default was intended to either evaluated to the passed configuration
value, or the a default value if the config didn't exist. For integer values
this does not actually work, and the default value always gets returned.
This commit reimplements the desired functionality as config_ternary, which
takes 3 arguments, a config to switch on and a desired true and false expansion
* commit 'ed95f84a438aea6365762a180cc493113e9282e0':
SELFOUR-413: changes for verification
SELFOUR-567: use seL4_CapRights_t from libsel4
SELFOUR-413: refactor libsel4 fault API
Split fault types into arch/generic
This change
* changes seL4_CapRights from the kernel to be seL4_CapRights_t in
libsel4
* deprecates the duplicated seL4_CapRights in libsel4, which is
now the bitfield generated type seL4_CapRights_t.
* fixes all usages in kernel and libsel4
Impact: for verification, this will require the type to change name
from cap_rights to seL4_CapRights_t.
This is a breaking libsel4 API change, although most code uses
seL4_AllRights or similar constants, which will not break
at a source level as these constants have been updated.
This is a *breaking API change*
This commit:
* makes seL4_Fault_tag_t common between the kernel and libsel4
* deprecates the existing functions from sel4/messages.h includes
* introduces a new fault API in sel4/faults.h and
* sel4/sel4_arch/faults.h
* deprecates seL4_GetTag(), as the function did not work without
the user calling seL4_SetTag() first (seL4_MessageInfo is passed
in registers and not set in the IPC buffer)
* removes previously deprecated functions (deprecated prior to 3.0.0)
* updates the seL4 manual to reflect the changes
Prior to this commit faults were separate
per architecture. This commit extracts the common
fault types and introduces arch specific faults,
reducing code duplication across architectures.
Adds a heuristic to switch to a NULL fpu state if we think the FPU
is not presently in use. A NULL fpu state is more efficient as
we do not have to enable/disable the FPU when switching threads
The compiler fails to realize that inlining these functions is
a performance benefit due to fact that after inlining their
bodies can be optimized with other inlined functions.
The use of 'volatile' on the asm blocks used by getCurrentCPUIndex
resulted in an inability for the compiler to elide repeated invocations
of getCurrentCPUIndex when inlining. The volatile is not needed
as we already want to claim that these functions are CONST and so
the asm block can be move/reordered/deleted as the compiler wishes
When sending a signal to a notification object that has a bound thread that is
in the 'runningVM' start we, ordinarily, want to deliver it by switching back
to the native execution of that thread and delivering the message. If the thread
is in the 'runningVM' state on a different core, then we must not modify its
thread state. Previously we would modify the thread state (changing it to
Running) and then attemptSwitchTo. Switching would fail, as its affinity would
be for a different core, resulting in us enqueing the thread into the
scheduling queue, despite the thread also presently running.
This commit both adds a check to prevent us manipulating a thread that
is actively running on a different core, as well as a remote operation
to tell that core that if it is running a VM it should recheck its
endpoint for a message.
benchmark.h requires a definition of KS_LOG_PPTR, but its previous
placement in machine.h resulted in a circular include. This commit
factors out KS_LOG_PPTR and related definitions to a separate header,
creates the corresponding header for x86, and prevents circular
includes in the x86 builds
Adds support for per-core kernel stacks through the use of
thread local storage and swapgs. In addition to the main
kernel stack the IRQ stack also needs to be made per core
Defines the TLB bitmap to be located, virtually, just below the kernel
window. To get an initialized bitmap in each new address space we
change copyGlobalMappings to copy from USER_TOP (which includes the
initialized TLB bitmap in the global address space) instead of just
the kernel window base
This commit adds support for using the ThreadID registers of the ARM MPCore
platforms for storing the address of the IPC buffer instead of the globals
frame. The choice of using the user readable/writeable ThreadID register
is chosen, even though it means the user cannot use it for its own
purposes, as it leaves room in the future for doing TLS support in the
user read only register, where compilers expect it.
This commit adds support for saving/restoring an additional register
that exists on ARM MPCore platforms. As this register is user wrieable,
as well as readable, it must saved and restored by the kernel to
prevent gross information channels.
Although this function is called from the fastpath inside of an
`unlikely` macro and the function itself gets inlined, the knowledge
that this conjunction is unlikely is somehow lost. Explicitly putting
a `likely` here fixes it
Removes the recycle operation and adds an operation
to cancel any badged sends on and endpoint. Calling
Revoke + CancelBadgedSend is equivalent to Recycle
on a badged endpoint
This removes usages of CONST Arch_activateIdleThread. According to
gcc 'a function that has pointer arguments and examines the data
pointed to must not be declared const'. Whilst these functions do
not presently examine their tcb_t pointer argument, it seems
pointless to pass something that can never be safely looked at.
Further a function that returns void and is CONST is utterly meaningless
This commit does the following:
* invert the bit field scheduler for better cache performance for high priority threads
* peeks into the bitfield scheduler to allow fastpath to be leveraged when IPC occurs from lo --> hi priority threads if correct
Previously generic functions for manipulating page table and page
directory entries were placed in mode/structures.h. These are moved
to a mode/vspace.h instead so that they can use existing functions
defined in arch/vspace.h.
The x86_make_pde_mapping function is dropped in this move as it is
not used. Instead it is replaced with a function for creating an
empty mapping for whatever is the vspace root.
1. Missing loop counter when accessing to PD in 'tlb_bitmap_get'.
2. Missing 'TLBBITMAP_PD_INDEX' in 'TLBBITMAP_PD_MAKE_INDEX'. The index generated by 'TLBBITMAP_PD_MAKE_INDEX' should be valid in PD while the original one used to generate just 0, 1, etc. The correct index is '0 + TLBBITMAP_PD_INDEX', '1 + TLBBITMAP_PD_INDEX' and so on.
When checking if a thread is using the FPU or not we now check on that
threads core, under the assumption that if a thread migrates its FPU
state is explicitly (and not lazily) migrated.
Change to the order of operations and timing behaviour of
invokeUntyped_Retype. The Retype operation now zeroes the
entire range of the Untyped cap (if it is being used for
the first time) before installing any objects. This avoids
the need for long-running initialisation of large objects,
whose initial contents are always zero. The initial zeroing
phase is preemptible, and may take multiple timeslices to
complete.
* commit '25bb94372fe4afce072959af88c1afe9ff1c67d3':
SELFOUR-635: support for TCB operations This will update TCB invocations to consider multicore environment, this may include: - adds the affinity invocation to transfer TCB between different cores and update TCB structure for core ID - checking the thread/core state before performing TCB operation, e.g. deleting the runnable TCB, etc
This will update TCB invocations to consider multicore environment, this may include:
- adds the affinity invocation to transfer TCB between different cores and update TCB structure for core ID
- checking the thread/core state before performing TCB operation, e.g. deleting the runnable TCB, etc
statedata.h gets included from arch/machine.h, and statedata
does not require any of the machine.h definitions.
As a result of removing this various other, previously missing,
includes need to be added
benchmark_track.h does not depend upon anything in debug.h and
so it does not need to include it. Once this include is removed
debug.h can pull its definition of ksKernelEntry from benchmark_track.h
x86/arch/machine/hardware.h gets include via types.h (through the
compound_types.h header). As this header is defining compound types
it really only needs access to the basic types (i.e. stdint.h)
The lowest syscall number is -8, which doesnt' fit in 3 bits -> change
to 4.
Also, we were storing the -ve number, which also doesn't fit into 3
bits -> invert it when we store it.
* commit 'e3f764a65be484d89e29ebc22ea406f1438ae3d3':
Benchmark: move arch-dependent benchmark.c from api/ to new benchmark/ directory
Benchmark: Pack arch-independent benchmark-related files into separate directories
* commit 'cdc869309b69d04c8682f166755c26cc7a401667':
arm_hyp: Used cached value for num LRs
arm_hyp: Add lazy vcpu switching
arm_hyp: Declare armHSCurVCPU in header
arm_hyp: Correctly destroy armHSCurVCPU
arm_hyp: Move hype state into correct statedata header
Hardware debugging was already supported if using SYSCALL for kernel
invocations, this adds support for when using SYSENTER. SYSENTER
is special because when entering the kernel the TF flag is not masked,
so the case of taking a debug exception in the kernel needs to be
handled. Also, unlike ia32, there is a race between performing
popf and calling sysexit where interrupts can be received. This race
is avoided by performing a full state restore with iret if a thread
is single stepping.
The hypervisor state is declared in arch/32/statedata.c, but is
defined in arch/statedata.h. This commit moves the definitions to
arch/32/statedata.h to match all the other state in arch/32/statedata.c
Having a different name for the FLAGS register creates an unnecessary difference
between ia32 and x86_64 code since regardless of the name/size the bits in the
register mean exactly the same thing
This commit implements the body of SELFOUR-499. The API exposes the x86 DR0-7
and ARM coprocessor 14 features to userspace by virtualizing them as context-
switched registers in the TCB. Implemented as TCB invocations. This feature is
only built when CONFIG_HARDWARE_DEBUG_API is selected.
* Add low-level support routines for setting, unsetting, getting, enabling
and disabling breakpoints.
* Add support for single-stepping as well.
^ Single-stepping is not supported on ARMv6 since the hardware
doesn't have support.
^ ARM implements single-stepping as instruction breakpoints
configured to fault on every instruction -- this is achieved through
the "mismatch" mode, which is only supported from ARMv7 onwards.
* Also support explicit software break requests, a la "BKPT" and "INT $3".
* New invocations:
* seL4_TCB_SetBreakpoint().
* seL4_TCB_GetBreakpoint().
* seL4_TCB_UnsetBreakpoint().
* seL4_TCB_ConfigureSingleStepping().
* New constants:
^ Event types:
^ seL4_InstructionBreakpoint.
^ seL4_DataBreakpoint.
^ seL4_SoftwareBreakRequest.
^ Access types:
^ seL4_BreakOnRead.
^ seL4_BreakOnWrite.
^ seL4_BreakOnReadWrite.
^ Exports:
^ seL4_NumHWBreakpoints.
^ seL4_NumExclusiveBreakpoints.
^ seL4_NumExclusiveWatchpoints.
^ seL4_NumDualFunctionMonitors.
^ seL4_FirstBreakpoint.
^ seL4_FirstWatchpoint.
^ seL4_FirstDualFunctionMonitor.
See documentation in the seL4 API manual.
syscall/sysret is an additional way of performing kernel entry/exits.
Whilst the instructions themselves are not supported when running
in 32-bit mode, this commit provides the config choice for them as
well as the generic support code for them.
Where MCP = Maximum Controlled Priority
This commit adds:
* seL4_TCB_SetMCPriority
and changes the arguments to
* seL4_TCB_Configure
As of this commit, a thread cannot create or set a threads
priority (including itself) above its mcp. Previously the kernel
did this check against a threads priority, which prevented a thread
from setting it's own priority down and then up again.
Adds a mapping type to frame caps that tracks
what kind of hierarchy the cap is mapped into;
an MMU, IOMMU and in the future an EPT structure.
Additionally the IOMMU code is updated to
have correct functionality and be verification
friendly.
The TK1 manual's address map has a 16K MMIO region called the "Misc" region,
where they lump together several controllers that aren't all page aligned,
including a USB controller and a SATA controller of some kind.
They also lump the pinmux controller into this "misc" region, but the
pinmux controller is at a page aligned boundary, and has no other devices
sharing that page, so it can be split off into its own device untyped.
This also makes it easier to request that mapping from userspace.
- update core detection code and Kconfig file
- update kernel stack managment so that BSP does not use boot stack before IPI APs
- move arch dependant data to a single structure
- add cache line size to Kconfig
- add cpu indexing and apic id mapping
- boot APs to halting state
- add guard for kernel stack if there is only one core
The ACTLR register is not a PL2 exclusive register, and is architecturally
defined to exist (although the contents of the register are implementation defined).
* commit '8e77cdb5e91e971f49747492a3350c2b443a3827':
SELFOUR-421: Add padding for untyped in bootinfo
SELFOUR-421: minor changes for c-refine
SELFOUR-421: fix up boolean equality in Arch_sameObjectAs
SELFOUR-421: added device check to sameObjectAs
SELFOUR-421: Arch_createObject changed to use new user_data_device in ghostupdates for device pages
SELFOUR-421 Introduce explicit device frames and untypeds
Kernel objects cannot be created from device untypeds, with the
exception of frames, which do not get zeroed and cannot be used
as an IPC buffer. Device untypeds additionally cannot be used
in the construction of ASID pools.
This then changes the API to the rootserver (i.e. bootinfo) to
send device untypeds instead of device frames. On ARM these
device untypeds are the same as the previously exported device
frame regions. On x86 PCI scanning is removed and all physical
memory addresses (that are not important for kernel integrity)
are released to the user.
In order to have bits in the frame and untyped caps on ARM the
number of software ASIDs had to be reduced from 2^18 to 2^17,
and the maximum untyped size reduced from 2^31 to 2^30
The previous macro computed to (0 - sizeof(tcb_t)). Basically a negative
number, which is just a really big unsigned number, so this macro was
basically allowing TCB naming of any length.
* commit 'fbc071b4f11b3d7d423e26908a661f416b07cda2':
SELFOUR-630:preliminary booting application processors - update core detection code and Kconfig file - update kernel stack managment so that BSP does not use boot stack before IPI APs - move arch dependant data to a single structure - add cache line size to Kconfig - add cpu indexing and apic id mapping - boot APs to halting state - add guard for kernel stack if there is only one core
- update core detection code and Kconfig file
- update kernel stack managment so that BSP does not use boot stack before IPI APs
- move arch dependant data to a single structure
- add cache line size to Kconfig
- add cpu indexing and apic id mapping
- boot APs to halting state
- add guard for kernel stack if there is only one core
The first time the irq number is read from the controller, the interrupt
is acknowledged. Subsequent reads of the irq number result in an invalid
irq number being read.
This modifies the kzm interrupt controller driver to save the current irq
number when it's first read from the interrupt controller, preventing the
need for future reads from the controller until the next interrupt arrives.
s/ASID_POOL_BITS/ASID_POOL_INDEX_BITS
Current convention is to say that X_BITS is the log base 2
size of an object, not the log base 2 number of indices
* commit '57f1352ff70cb2de18768174d257d151e4fd12e8':
SELFOUR-614: calling halt() on the hikey platform results in infinite data abort SELFOUR-408: halt does not halt
- separate putDebugChar and putConsoleChar
- this only has effect on x86 where 2 serial ports are initialised by
the kernel
- for arm, putConsoleChar just calls putDebugChar
It can be deseriable to run code before/after user mode, but
not have to write it in assembly. This commit adds such stubs
that get called as the first/last C code when coming in
and out of the kernel
* Change restore_user_context() and fastpath_restore() to call POPF
just before SYSEXIT.
* Also change the way registers are loaded such that we don't access
memory that is not guarded by the current position of the stack pointer.
The reason for this change is that EFLAGS.TF, the Trap Flag, only takes
effect on the instruction AFTER the instruction that sets EFLAGS.TF. The
reason Intel/AMD did it this way is to allow the kernel to enable EFLAGS.TF
for userspace, without it taking effect on kernel instructions BEFORE
the CPU actually has returned to userspace.
EFLAGS.TF enables single-stepping. So the full picture is that since we
executed other instructions between POPF and SYSRET, those instructions
were triggering single-stepping IN the kernel. To solve this, we must
put POPF immediately before SYSRET.
Given that the log buffer is now
(79291252a8) in user-level, the kernel doesn't have
to dump and send the size for users. Users have to take care of this.
Adds the following constants to libsel4
and uses them in the kernel.
seL4_SectionSize (arm)
seL4_SuperSectionSize (arm)
seL4_HugePageSize (x86 - pae)
seL4_LargePageSize (arm)
seL4_DataFault
seL4_InstructionFault
* commit '16c3481109e2024d6fd65365ea94265ead37dcca':
SELFOUR-518: User-level log buffer
Benchmark: share and use KS_LOG_PPTR and PPTR_TOP for x86 and ARM
CPSR_IDLETHREAD was introduced in a5f61c7 to mask FIQs and asynchronous
aborts. Usage of this was lost in a merge, this commit restores the
usages in Arch_configureIdleThread, and updates CPSR_IDLETHREAD to
use the correct PMODE depending on whether the kernel is running
in hypervisor mode or not
If an irq over max IRQ came in (unlikely) then it would result in an
array bounds over flow. gcc detected this as a result of the inlining of
the irq functions.
* rename physBaseMapping to BASE_OFFSET
* because physBaseMapping was only used explicity in a few places
* move duplicated arm definions up a level
- PPTR_TOP
- PADDR_TOP
- BASE_OFFSET
Inline non-boot irq functions called on the irq path.
This improves performance of interrupt paths through code locality.
Additionally, remove unused functions and use the BIT macro
rather than redefining it.
When hypervisor extensions are not enabled the boot code cannot
actually call vcpu_boot_init as the symbol names do not even
exist. This is fixed be defining macros that expand to nothing
This commit wraps accesses to the vgic in functions that are marked as
DONT_TRANSLATE and uses a global constant (that is determined at boot time)
for the number of LR registers to prevent loops that have undefined bounds
* commit '3ffa58aa1fb75c65fac4d1351bc6e014bdda2b64':
Verification: don't translate functions that are re-implemented from assembly to C
ARM Hyp: Fix fastpath_restore on ARM Hyp and implement slowpath and restore in C
SELFOUR-526: ARM - Implement slowpath and restore_user_context in C
Fixes a bug where previously MODEL_ID() was defined as:
`#define MODEL_ID(x) ( ((x & 0xf0000) >> 16) + (x & 0xf0) )`
This was incorrect because (1) it didn't take into account the conditional
nature of the extended_model_ID, and (2) it's actually shifting the
extended_model_ID into the low bits and keeping the model_ID in the high bits,
when it should be the other way around.
This patch also introduces a foundation for more sane testing of CPU vendor,
family, model and brand_ID.
* commit 'cee1268e9bf9619b60bd85cfda0a5d5306e8cf8a':
[VER-619] Pass verification related to newly added built-in unreachable
SELFOUR-545: x86 - cleanup c_traps.c file and use new traps.h
SELFOUR-526: ARM - dummy unreachable statements after fastpath calls
SELFOUR-526: ARM - Unify C entry point for system calls
This commit moves setThreadState outside the 'perform' stage of the
invocation, and renames decodeARMIOUnmapInvocation to
performPageInvocationUnmapIO as it is actually doing a perform
and not a decode
Previously looking up the page directory base for a SysteMMU was
done by writing the ASID into the hardware and reading out the
currently set page directory for that ASID. This is confusing for
verification so this commit introduces a global translation table
for converting an ASID to a page directory.
The `VISIBLE` macro is designed to selectively inhibit the effects of GCC's
whole program and link-time optimisations. This is necessary when a C function
is only referenced from a context outside the compiler's visibility, e.g. an
assembly file. As far as I can determine, Clang's link-time optimisations
already account for this possibility and do not need to have this information
manually indicated to them (see, for example, Linux's compiler support headers).
In any event, `__attribute__((visibility("default")))` is not equivalent to
`__attribute__((externally_visible))`, but is instead for controlling symbol
visibility in a library-like setting. This commit removes this incorrect
expansion.
Previously the return value of cap_get_capPtr was compared to 0 in
sameRegionAs to emulate a check in the abstract specification that
tests if the cap is a physical cap or not. Overloading 0 results
in a scenario where a legitimate deviceUntyped's children do not
get considered to be children because they have a capPtr of 0.
This change adds and explicit function that returns whether or not
a capability is physical or not, and uses that in sameRegionAs
This commit moves a declaration of `ksKernelEntry` such that it is now only
guarded by `DEBUG`, not additionally `CONFIG_PRINTING`. This allows the kernel
to be built standalone with debugging enabled using the following invocation:
DEBUG=1 TOOLPREFIX=arm-none-eabi- CPU=arm1136jf-s PLAT=imx31 ARCH=arm \
ARMV=armv6 make
The XSAVE feature set is the future proof way for x86 CPUs to
manage extended CPU state. Extended state is MMX, FPU, SSE, AVX etc
registers. This is a replacement for the current FXSAVE and the
512 byte FPU region.
XSAVE introduces a few problems that this commit has to address
* The alignment of the XSAVE region is 64bytes, instead of the 16
bytes of the FXSAVE region
* XSAVE region size is dependent on the desired features, which
are detected at run time
* There are multiple variants of the XSAVE instruction that have
different potential optimizations, but are not always supported
The solutions to these are
* Re-order the FPU state and user registers in the user context
struct so that the new XSAVE region is first, and is thus
aligned to 64bytes without needing lots of padding
* Provide config options for desired features (including XSAVE
instruction variant) and required XSAVE region size. These
are checked at boot time to ensure the CPU meets these
requirements
This macro allows for using the value of a CONFIG_ variable in situations
where it may not be defined. This could be due to it being a dependency
on another CONFIG_ variable that is not currently defined. This arrises
from code blocks like
if (config_set(CONFIG_FOO)) {
return CONFIG_VAR_DEPENDS_ON_FOO;
}
This will not compile when CONFIG_FOO is not set. Using
return config_default(CONFIG_VAR_DEPENDS_ON_FOO, 42);
Provides a way for this to be built
The address being calculated is the end of the user context array.
There is no need for this to be done as a magic number offset
from the tcb_t, this commit takes an index into the actual array,
using the constant that is defined as the length of that array.
Its probable this was meant to be a boolean flag to represent
whether or not the TCB had a bound notification object. However,
this field is unused and its presence is confusing.
Benchmark feature that currently:
- Keeps track of system calls info
- Start time
- Duration
- Capability type
- Invocation tag
- Log the number of invocations of each system call*
- Log the number of invocations for each capability type per syscall.
- Has 3 new syscalls (dump, reset, get size).
- This new feature uses the existing log buffer (which is 1MiB for x86
and ARM). Since the number of syscall invocations is not
deterministic, the logged number of invocations is limited by the size
of the buffer. I suggested to enable the users to pass their own
user-level buffer, to enable more flexibility, later.
- ENABLE_BENCHMARKS is now a parent config option of trace points and
system call track features, they can't be used at the same time.
lockTLBEntry, an assembly function, had tlb_lock_count as a symbol that
needed to be placed sufficiently close to be loaded and stored with
offset-from-pc addressing. When assembled, the symbol would turn up
between functions, as opposed to within a literal pool (it's a variable,
not a constant) or the .bss / data sections. The decompiler doesn't
handle that use case, and likely won't. This change turns
tlb_lock_count into a C global variable (so that it will be placed in
the .bss / data sections), and splits lockTLBEntry into two parts so the
critical section will still fit in a 64-byte aligned region, and
therefore be guaranteed to live within a single page.
x86_64 (with PCIDs enabled) supports a more fine grained invalidation
approach for the TLB and Page Structure Cache. This change expands
the number and kinds of information passed for certain invalidations,
and provides an implementation of this for ia32.
Originally building the kernel was largely considered to be done in
one of two ways
1. Release build with no assertions, no debug symbols and no printing.
This was generally considered to be a 'verified' build
2. Debug build with assertions, debug symbols and printing
Since then various options were added, such as the 'code injection'
option, which we wanted on builds that did not have assertions or
other options that affected performance. As such it did not depend
upon a debug build and had large warning signs saying that enabling
this in a release build would not give you a verified or trusted
kernel.
Most recently the ability to print from the kernel in release mode
was added. For the same reason that tying the ability to print with
the performance reduction of various debugging was not always desireable.
This change attempts to unify the current state and have a single top
level option to enable a 'verification friendly' build. All other
options (assertions, printing, code injection) then depend upon
this configuration not being set.
vcpu.c:
encapsulate inline assembly into inline functions that added to
device_pl2.h file.
other files:
replace #ifdef ARM_HYP with config_set(ARM_HYP)
machine_pl2.h:
new place for hyp mode inline functions.
boot.c:
replace #ifdef ARM_HYP with config_set(ARM_HYP).
vcpu.h, machine_pl2.h:
add empty functions when ARM_HYP is not defined to
pass compilation.
vcpu.c:
encapsulate inline assembly into inline functions that added to
device_pl2.h file.
other files:
replace #ifdef ARM_HYP with config_set(ARM_HYP)
machine_pl2.h:
new place for hyp mode inline functions.
boot.c:
replace #ifdef ARM_HYP with config_set(ARM_HYP).
vcpu.h, machine_pl2.h:
add empty functions when ARM_HYP is not defined to
pass compilation.
The functions pit_init and pit_wait_wraparound were previously marked as
PHYS_CODE, despite being called from BOOT_CODE elsewhere. This bug has
been present for some time but can be masked by the compiler inlining
all the involved functions, which is what typically happens.
Diminish rights were to prevent a user from sending a writeable
cap over a read only endpoint. It turns out this 'security' can
be worked around without difficulty (by putting caps in a cnode
and sending the cnode) making the current diminish rights
implementation functionally useless.
Removing diminish rights has the benefit of simplifying all the
IPC paths.
For x86-64, to disable IO instructions in user mode requires a
IO permission map being set up properly in TSS. Setting the
IO map base field of TSS larger than the TSS works for 32-bit, but
not 64-bit. This commit sets up a IO permission map usable for both
32-bit and 64-bit kernel and changes the TSS to use the mapping.
The IO permission bitmap is appened to the bitfield generated tss_t,
resulting the tss_io_t structure.
This is a stylistic commit to make names of variables/constants and
functions in the kernel more consistent. That is, things that are
not IA32 specific, but are generic x86, get renamed to having an
x86 name
when FS/GS_BASE_MSR are used to set the base addreses,
user applications should not touch FS/GS regiters; so
the kernel should load proper selectors once, establishing
limits and other attributes for the segments.
Current bootinfo defines two slot regions for paging structures,
one for page directories and one for page tables. This does not
easily generalise for N levels of paging structures. This change
uses a single region that has a known order of objects for however
many levels exist
Add platform dependent code (using macros from autoconf.h)
to make idle thread run in low power mode on all ARMv7
and ARMv6 except for the KZM board: That board does not
seem to support low power mode although the chip should,
according to he manual
Part of SELFOUR-419
Restructure the x86 interrupt handling to allow for a more flexible
method of using IOAPIC and MSI interrupts. The essence of this change
is to allow for the user to pick, for both IOAPIC and MSIs, which
CPU vector to use. Additionally there is future support, in the API,
for seL4 to eventually protect MSI interrupts with the vt-d interrupt
routing tables.
API behaviour for legacy systems using the PIC is preserved
Part of SELFOUR-281
This change brings the ia32 api in line with the planned x64 api,
which will have 12bits of ASID. Aside from providing a consistent
API, this change also frees up bits in the frame cap that will
allow further x64 changes to be unified.
Some versions of GCC replace a struct copy with a call to 'memcpy',
which it is fully in its rights to do. Unfortunately on ARM platforms,
that have no direct calls to memcpy, the optimizer (in the presence
of -fwhole-program) drops the implementation of memcpy, even as it
is outputting calls to it.
Add the USED attribute prevents the optimizer from dropping the
function eagerly.
* commit '1a1110a0949c76a2d372e2bba6b2526898c51a68':
Modify Kconfig and Makefile for aach32 as sel4_arch libsel4: updates to include aarch32 as sel4_arch
