- Devel - lists.sel4.systems

Re: [seL4] ramdisk vs. persistant rfs in VMs.
by Travis Wheatley 26 Jun '20

26 Jun '20

I have made some good progress thanks to Siwei’s advice. I have modified my .dts file and have made a usb controller as well as the sdhci controller available to the VM. However, there still seems to be some issues at start up. Here is what dmesg has to say about the usb controller(s) root@xilinx-zcu102-2019_1:~# dmesg | grep usb [ 1.754678] usbcore: registered new interface driver usbfs [ 1.761934] usbcore: registered new interface driver hub [ 1.768958] usbcore: registered new device driver usb [ 3.827826] usbcore: registered new interface driver asix [ 3.834976] usbcore: registered new interface driver ax88179_178a [ 3.842998] usbcore: registered new interface driver cdc_ether [ 3.850682] usbcore: registered new interface driver net1080 [ 3.858146] usbcore: registered new interface driver cdc_subset [ 3.865948] usbcore: registered new interface driver zaurus [ 3.873301] usbcore: registered new interface driver cdc_ncm [ 3.895799] usbcore: registered new interface driver uas [ 3.902820] usbcore: registered new interface driver usb-storage [ 3.916716] usbcore: registered new interface driver uvcvideo [ 3.991358] usbcore: registered new interface driver bcm203x [ 3.998824] usbcore: registered new interface driver bpa10x [ 4.006182] usbcore: registered new interface driver bfusb [ 4.013424] usbcore: registered new interface driver btusb [ 4.028142] usbcore: registered new interface driver ath3k [ 4.201363] usbcore: registered new interface driver usbhid [ 4.208699] usbhid: USB HID core driver [ 4.224831] usbcore: registered new interface driver snd-usb-audio [ 5.181742] dwc3-of-simple ff9e0000.usb1: failed to add to PM domain domain3: -13 [ 5.191629] dwc3-of-simple: probe of ff9e0000.usb1 failed with error -13 Any clue? Regarding the SD card, it is partitioned with a boot partition where uboot and the .elf file live and the remainder is the free space I hope to use as the filesystem. Here is what dmesg has to say about the sdhc interface. root@xilinx-zcu102-2019_1:~# dmesg | grep sdhc [ 4.049894] sdhci: Secure Digital Host Controller Interface driver [ 4.058026] sdhci: Copyright(c) Pierre Ossman [ 4.063768] sdhci-pltfm: SDHCI platform and OF driver helper [ 5.209925] sdhci-arasan ff160000.mmc: failed to add to PM domain domain4: -13 [ 5.219468] sdhci-arasan: probe of ff160000.mmc failed with error -13 [ 5.351710] mmc0: sdhci: ============ SDHCI REGISTER DUMP =========== [ 5.360229] mmc0: sdhci: Sys addr: 0x00000000 | Version: 0x00000000 [ 5.368759] mmc0: sdhci: Blk size: 0x00000000 | Blk cnt: 0x00000000 [ 5.377280] mmc0: sdhci: Argument: 0x00000000 | Trn mode: 0x00000000 [ 290.055387] random: fast init done [ 5.385810] mmc0: sdhci: Present: 0x00000000 | Host ctl: 0x00000000 [ 5.394331] mmc0: sdhci: Power: 0x00000000 | Blk gap: 0x00000000 [ 5.402860] mmc0: sdhci: Wake-up: 0x00000000 | Clock: 0x00000000 [ 5.411381] mmc0: sdhci: Timeout: 0x00000000 | Int stat: 0x00000000 [ 5.419902] mmc0: sdhci: Int enab: 0x00000000 | Sig enab: 0x00000000 [ 5.428441] mmc0: sdhci: AC12 err: 0x00000000 | Slot int: 0x00000000 [ 5.436962] mmc0: sdhci: Caps: 0x00000000 | Caps_1: 0x00000000 [ 5.445491] mmc0: sdhci: Cmd: 0x00000000 | Max curr: 0x00000000 [ 5.454021] mmc0: sdhci: Resp[0]: 0x00000000 | Resp[1]: 0x00000000 [ 5.462551] mmc0: sdhci: Resp[2]: 0x00000000 | Resp[3]: 0x00000000 [ 5.471089] mmc0: sdhci: Host ctl2: 0x00000000 [ 5.477023] mmc0: sdhci: ============================================ Seems to be getting the same -13 error when setting up it’s domain. So… what do I need to do to make these devices accessible from the linux command line?

1 0

ramdisk vs. persistant rfs in VMs.
by Travis Wheatley 25 Jun '20

25 Jun '20

I’ve been working with VMs running under SEL4 on ARM hardware. I have been able to boot to a command prompt in a VM. However, the filesystem being used is a ramdisk. I need some sort of persistent storage, preferably a regular rfs that lives on an SD card. Not exactly sure what modifications to make and where to cause the kernel to use a persistent rfs rather than the ramdisk. Barring that, wondering if the SD card can be divided into multiple partitions such that one can be the boot partition and the other mounted to provide persistent storage space. Hoping one of y’all can point me in the right direction. — Travis

2 3

CAmkES VM rootfs.cpio with Python3 Causes Error
by Turner, Ben 12 Jun '20

12 Jun '20

Hi, I have been attempting to create a VM to run as a CAmkES component, and it is a requirement that it has Python3. I have been using the vm_minimal app as a template to get started, and was successful at getting my own buildroot filesystem image running, however when I attempted to add the Python3 package, the resulting image resulted in the following error when it booted: ... <<seL4(CPU 0) [decodeInvocation/631 T0xfec34400 "rootserver" @106f0]: Attempted to invoke a null cap> create_objects@main.c:805 [Err seL4_InvalidCapability]: Untyped retype failed with unexpected error seL4 root server abort()ed Debug halt syscall from user thread 0xfec34400 "rootserver" halting... Kernel entry via Unknown syscall, word: 1 The only change I made to the image was to add the Python3 package, and that has caused this error. Is there something the vm_minimal app is missing that is required in order to get Python3 working? Kind regards, Ben Turner ________________________________________ Roke Manor Research Limited, Romsey, Hampshire, SO51 0ZN, United Kingdom.Part of the Chemring Group. Registered in England & Wales. Registered No: 00267550 http://www.roke.co.uk _______________________________________ The information contained in this e-mail and any attachments is proprietary to Roke Manor Research Limited and must not be passed to any third party without permission. This communication is for information only and shall not create or change any contractual relationship. ________________________________________

2 5

camkes-vm-linux tutorial issue
by Nanfang Hu 11 Jun '20

11 Jun '20

When I try to build the tutorial and run ninja I got the following error. [1/31] Performing build step for 'hello-app' ninja: no work to do. [3/31] Performing configure step for 'poke-module' FAILED: poke-module-stamp/poke-module-configure cd /home/weiqi/test/camkes-vm-linux_build/poke-module && /usr/local/bin/cmake -DCMAKE_BUILD_TYPE=Debug -DCMAKE_TOOLCHAIN_FILE=/home/w eiqi/test/tools/seL4/cmake-tool/polly_toolchains/linux-gcc-32bit-pic.cmake -DLINUX_KERNEL_DIR=/home/weiqi/test/camkes-vm-linux_build/out/linux-4.8.16 -DMODULE_HELPERS_FILE=/home/weiqi/test/projects/camkes-vm-linux/linux-module-helpers.cmake -GNinja /home/weiqi/test/camkes-vm-linux/modules && /usr/local/bin/cmake -E touch /home/weiqi/test/camkes-vm-linux_build/poke-module-stamp/pok e-module-configure CMake Warning (dev) in CMakeLists.txt: No project() command is present. The top-level CMakeLists.txt file must contain a literal, direct call to the project() command. Add a line of code such as project(ProjectName) near the top of the file, but after cmake_minimum_required(). CMake is pretending there is a "project(Project)" command on the first line. This warning is for project developers. Use -Wno-dev to suppress it. -- [polly] Used toolchain: Linux / gcc / PIC / c++11 support / 32 bit CMake Error at CMakeLists.txt:11 (DefineLinuxModule): DefineLinuxModule Function invoked with incorrect arguments for function named: DefineLinuxModule -- Configuring incomplete, errors occurred! See also "/home/weiqi/test/camkes-vm-linux_build/poke-module/CMakeFil es/CMakeOutput.log". See also "/home/weiqi/test/camkes-vm-linux_build/poke-module/CMakeFil es/CMakeError.log". [4/31] Completed 'hello-app' ninja: build stopped: subcommand failed. >

2 2

question about creating threads in sel4 based system
by sergey volkovich 10 Jun '20

10 Jun '20

Cabulertion. I trying to create my own sel4 based system, and currently i cannot understand next thing after calling seL4_Untyped_Retype i will be must somehow put execution data in memory. It can be implemented by using seL4_TCB_WriteRegisters. -- sever99

2 1

RISC-V (RV64) is the third ISA with verified seL4
by Heiser, Gernot (Data61, Kensington NSW) 09 Jun '20

09 Jun '20

Dear seL4 community, I’m extremely pleased to announce that we have completed the functional correctness proof of seL4 on the RV64 ISA. Congratulations to our awesome Proof Engineering Team on achieving this major milestone for seL4! And many thanks to HENSOLDT Cyber for making it possible. My blog discusses provides a bit more context for this announcement: https://microkerneldude.wordpress.com/2020/06/09/sel4-is-verified-on-risc-v/ What we have now is the refinement proof from the seL4 formal spec to the C implementation, putting RV64 on the same level as x64 in terms of seL4 verification. The binary verification, which extends this refinement to the binary code of the kernel is progressing, stay tuned for more news on that in the foreseeable future. Gernot for the Trustworthy Systems team and the seL4 Foundation

1 0

seL4 + TrustZone: Spanning both worlds
by Nick Spinale 08 Jun '20

08 Jun '20

On TrustZone-enabled Arm systems, seL4 could span both the secure and normal worlds. To do so would require extending untyped and frame capabilities with a bit associating them with either the secure or non-secure physical address space. In this email, I’ll touch on what a software stack based on this idea might look like, why that’s interesting, and exactly what extensions to the kernel it would require. I’m interested in your thoughts and feedback on this informal proposal. If there’s interest, I’ll draft a patch to illustrate it more precisely. # TrustZone background The security of a TrustZone-enabled system is achieved by partitioning all of the SoC’s hardware and software resources so that they exist in one of two worlds - the secure world for the security subsystem, and the normal world for everything else. From the point of view of an ARMv8-A processor, the system has two physical address spaces: one for secure transactions and another for non-secure transactions. Page table entries contain a field called the NS (non-secure) bit, which determines whether a page is mapped from the secure or non-secure physical address space. Furthermore, the processor state contains a global NS bit, which can only be modified by software executing at the highest exception level, EL3. When the NS processor state bit is set, the processor is said to be executing in the non-secure state, and can’t issue secure bus transactions, regardless of the values of the NS bits in its translation tables. A typical TrustZone software stack hosts a TEE (Trusted Execution Environment) on secure-world resources, and a REE (Rich Execution Environment) on normal-world resources. A so-called “secure monitor” runs in EL3, and uses the NS processor state bit to implement a coarse context switch called a “world switch”. The simplicity of this coarse context switch minimizes the attack surface of the secure monitor. # seL4 + TrustZone A formally verified microkernel such as seL4 can be trusted to protect secure hardware resources, and the TEE they host, using translation tables alone. That is, seL4 allows for a design where the processor always runs in state NS=0 (“secure state”), and normal-world software is restricted to non-secure world hardware resources using just the NS bits in the translation tables controlled by seL4. Such a software stack, with seL4 spanning both the secure and non-secure worlds, is attractive on multiple fronts. seL4 provides a higher level of assurance than typical EL3 monitor firmware, which we can now eliminate from the TCB. seL4 also provides a richer API than typical EL3 firmware, allowing for security critical secure-world components to be developed and verified at a higher level of abstraction. Furthermore, while the two-world model is organized around just one strong security boundary, seL4 allows for an unbounded number of equally strong security boundaries, as isolation is based on translation tables rather than the less flexible NS processor state bit. This design allows a seL4-based system to utilize non-secure hardware resources, while protecting the kernel and sensitive components inside secure hardware resources. This permits a threat model similar to that of a typical TrustZone-based TEE (such as OP-TEE or Trusty), which includes some hardware attacks, but without limiting seL4 userland components to the secure world alone. Such a software stack has been especially interesting since the release of ARMv8.4-A, which enables EL2 in the secure state (S-EL2). seL4 running in S-EL2 can host a rich operating system such as Linux to drive non-secure hardware resources. Compare this to a seL4-based software stack running a Linux VM without the help of TrustZone. In particular, consider a case where the Linux VM drives most of the hardware platform’s devices via direct passthru access. Reasoning about the interactions between hardware components on a SoC is difficult. Even after correctly programming the SMMU, a great deal of SoC-specific detail must be covered in order to convince yourself that a driver or VM can’t violate its isolation indirectly through a device within its reach. This sort of reasoning is an active area of research (see, for example, the Barrelfish OS project). However, for use cases where the trust model aligns with the SoC’s boundary between secure and non-secure hardware resources, TrustZone provides a straightforward means of ensuring the protection of critical software components from those with access to non-secure devices. # Extending seL4 Currently, untyped objects are either general purpose memory or device memory. To support the design I’ve proposed, untyped objects would need to be extended with another dimension: secure memory or non-secure memory. Non-secure general purpose memory would be subject to the same restrictions as device memory, with the exception that frames derived from non-secure general purpose untyped may be used as IPC buffers. Unlike the general-purpose/device dimension, the secure/non-secure dimension affects the mapping of a frame. The kernel would set the NS bit in page table entries according to whether that frame is secure. This extension would require modifying just a few lines of code in the kernel itself and would, of course, be optional and configurable. - - - - Nick Spinale (nickspinale.com) Arm Research, Cambridge UK - - - - The ideas presented in this email constitute research activity at Arm rather than an official position or recommendation. IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.

3 3

Difficulty booting guest kernel on zcu102
by Travis Wheatley 04 Jun '20

04 Jun '20

I’ve been working with a VM and docker container created by the good folks at DornerWorks. I had a compile time error with the camkes-arm-vm-manafest tree called out in their "Getting Started” lab. However, I was able to successfully compile an image using the instructions and files in their single_vm_lab. I am loading that image onto an SD card with their pre-built boot.bin. At the U-boot prompt I load that image to 0x10000000 and subsequently type “go 0x10000000”. The image seems to start the initial boot just fine but I get an exception when it tries to jump to the kernel. image entry point. Looking at the value of esr_eli1 it appears that something is trying to write to a protected register. Wondering if there is some sort of switch setting on the board or special flags that need to be sent to u-boot to keep this from happening. Here is the console output: ZynqMP> fatload mmc 0 0x10000000 dorner 22183936 bytes read in 1472 ms (14.4 MiB/s) ZynqMP> go 0x10000000 ## Starting application at 0x10000000 ... ELF-loader started on CPU: ARM Ltd. Cortex-A53 r0p4 paddr=[10000000..1152e06f] No DTB passed in from boot loader. Looking for DTB in CPIO archive...found at 100f4058. Loaded DTB from 100f4058. paddr=[237000..23bfff] ELF-loading image 'kernel' paddr=[0..236fff] vaddr=[ff8000000000..ff8000236fff] virt_entry=ff8000000000 ELF-loading image 'capdl-loader' paddr=[23c000..1854fff] vaddr=[400000..1a18fff] virt_entry=4088d0 ELF loader relocated, continuing boot... Enabling MMU and paging Jumping to kernel-image entry point... ELF-LOADER: Synchronous exception received: esr_el1: 86000004 elr_el1: ff8000000000 spsr_el1: 600003c5 far_el1: ff8000000000 abort() called.

1 0

Builds
by Matt Youill 04 Jun '20

04 Jun '20

Hi, Am in the process of learning seL4 and have managed to get, build and run the tutorials, which is great. Now looking at creating an application and I have a question about seL4 builds. The documentation here... https://docs.sel4.systems/projects/buildsystem/incorporating.html refers to a build setup that AFAICT is different to the reference application, which I think is here... https://github.com/seL4proj/sel4webserver Which is the best approach to follow? Best, Matt

2 1

Re: [seL4] Threads tutorial fails to initialize
by Weiqi Hu 04 Jun '20

04 Jun '20

Thank you for the suggestion but it seems like I need to access the init file one directory above. In the case of seL4test and build-x86 it needs to be init-build.sh On Sun, May 31, 2020 at 9:14 AM laokz <laokz(a)foxmail.com> wrote: > Hi Weiqi, > > Did you try init-build.sh( > https://docs.sel4.systems/GettingStarted#setting-up-your-machine)? I > recall this like issue before. > > Regards, > laokz > > I tried adding the --plat argument but it's the same error. Also, no build > directory was created on the attempts. > > I didn't have the same problem with the capabilities, untyped, and mapping > tutorials but it appears something is different for the threads tutorial. > > On Sat, May 30, 2020 at 5:11 PM Chubb, Peter (Data61, Kensington NSW) < > Peter.Chubb(a)data61.csiro.au> wrote: > > > >>>>> "Weiqi" == Weiqi Hu <weiqi.hu(a)gmail.com> writes: > > > > Weiqi> Hi, I've tried to start the threads tutorial but it fails to > > Weiqi> initialize or create a build directory. Any hints for moving > > Weiqi> forward? > > > > Looks like you omitted the --plat argument. > > > > Try > > ../init --plat pc99 --tut threads --solution > > > > You may need to delete the build directory before this will work. > > > > -- > > Peter Chubb Tel: +61 2 9490 5852 > > http://ts.data61.csiro.au/ > > Trustworthy Systems Group CSIRO's > Data61 > _______________________________________________ > Devel mailing list > Devel(a)sel4.systems > https://sel4.systems/lists/listinfo/devel > >

2 2