These files are derived from the output of the device tree compiler in
the Linux kernel. The licenses of the input files do all have to be
compatible with at least GPL-2.0-only to be part of Linux.
Invocation and syscall headers are generated and provided under
BSD-2-Clause for user code and GPL-2.0-only for kernel code. To
facilitate people other than the copyright holder performing this
operation, the master files are provided under both (BSD or GPL, free
to choose).
This commit also converts our own copyright headers to directly use
SPDX, but leaves all other copyright header intact, only adding the
SPDX ident. As far as possible this commit also merges multiple
Data61 copyright statements/headers into one for consistency.
fastpath_call and fastpath_reply_recv got inlined into a single
function. This could cause loading unused code in cache and
additional jump instructions required in c_handle_syscall.
By default, clang looks for tools prefixed with the target triple.
Explicitly setting the target triple in the toolchain file allows seL4
tools to do the same.
This commit updates the secondary core initialisation to reserve
the VGIC maintenance and VTimer Event IRQs. This change is
introduced in support of SMP configurations when arm hypervisor
support is enabled.
Added support for injecting remote IPI calls towards given VCPU's
on SMP configured systems. This introudcing a new type of
IpiRemoteCall and handlers for updating the vgic state on
incoming/outgoing IPI's.
Co-authored-by: Yanyan Shen <yanyan.shen@data61.csiro.au>
Added constant definitions for the VMPIDR (arm32) and VMPIDR_EL2
(arm64) registers. These being vcpu registers that can be
written, read, saved and restored. The 'Virtualization Multiprocessor
ID Register' (VMPIDR) is needed to program a vcpu's affinity during
initialisation. This is currently only exposed on SMP configurations.
Co-authored-by: Anna Lyons <anna@gh.st>
Without an invariant, during verification we no longer know that the
virtual timer irq is not inactive in restore_virt_timer, necessitating
an extra check.
Truncation to 10 bits is therefore handled by bitfield generator, making
correspondence with more abstract verified specs easier, as they use a
10-bit word to represent IRQs on 32-bit ARM platforms.
At this time verification does not have a provable link between the
current active VCPU and the current thread which would allow concluding
the current thread is runnable when the current VCPU is active. To
handle a fault, the current thread must be runnable.
Added extra checks to VGICMaintenance and VPPIEvent.
C parser cascades up DONT_TRANSLATE blocking modifies proofs, unless
some kind of spec is provided. This makes the claim that the timer
register getters don't modify any global state, and the setters modify
only state verification does not care about.
The PGD constants refer to the top level mapping object used by the
kernel for its own private mappings. Userlevel cannot create any PGD
objects and so these constants don't belong in libsel4.
Configure the ability to trap on vcpu WFE/WFI calls. If enabled,
user-level would need to schedule a future interrupt when a given
vcpu invokes a WFE/WFI instruction. This otherwise leaving the
vcpu in a disabled state. An application can choose to
disable the trap if it doesn't want to handle the instruction and
schedule a future interrupt.
Cache flush operations are applied through the kernel window mapping in
hyp mode. This requires an extra check that the frame being provided is
accessible through the kernel window.
Added support for reading and writing additional virtual timer
registers for vcpu hw read and write accesses. These include the
compare value register (CNTV_CVAL) and offset register (CNTV_OFF),
each represented as two 32 bit (high and low) registers on aarch32 and
as single 64 bit registers on aarch64.
Added support for explicitly saving and restoring the virtual
timer registers when the vcpu is enabled and disabled. This
ensures when the vcpu is switched in and out, the virtual timer
registers are restored to a state that is consistent to when
it was last run.
By default the CNTVOFF register will be updated by the kernel to
accumulate the time the VCPU is not running. From the guest this will
result in the VCNT register not increasing when the VCPU is suspended.
This behavior can be turned off by disabling the
KernelArmVtimerUpdateVOffset config option.
This commit introduces a new fault type, seL4_Fault_VPPIEvent.
This change means the kernel can reserve PPI interrupts and virtualise
them via delivering the irq to the active vcpu through a
specific fault. This enables multiplexing PPI IRQs across multiple VCPUS
which requires correctly masking and unmasking the IRQ depending on
which VCPU is running.
A new VCPU invocation, seL4_ARM_VCPU_AckVPPI is also added for
acknowledging the handling of the IRQ. This takes an IRQ as a parameter
but will only accept IRQ numbers that are sent as VPPIEvent faults.
Co-authored-by: Rafal Kolanski <rafal.kolanski@data61.csiro.au>
Co-authored-by: Kent McLeod <Kent.Mcleod@data61.csiro.au>
Added constant defintion for the "cntpct_el0" and " cntv_ctl_el0"
register. This being consistent with the 32bit mode definition
of the same registers.
Move vcpu functions that are specific to a particular Arm architecture
version into the relevant header files. Also move some generic functions
into the generic vcpu header file for use by arch specific headers.
Specifying a function name prefixed with 'm' is not compatible with
clang.
For 32 bit, call vmlaunch_failed explicitly from within the assembly.
Requires adding the USED attribute to vmlaunch_failed as it is only
referenced in a string literal.
For 64 bit, move the address of vmlaunch_failed into rax as an integer
rather than loading it as the address of a function (lea).
This inline function doesn't get inlined with -O3.
It affects the cold cache performance, so use always_inline
attribute to tell compiler always get it inlined.
Depending on the platform, IPI has a slightly different interface.
Explicitly cast from the more speific enum type to the generic
and vice versa when calling in and out of generic code.
Another possibility would be to typedef a specific enum on RISCV
platforms that aliases the one currently used. Then casting would only
have to take place when passing args to function calls.
