- Devel - lists.sel4.systems

KataOS modifications to seL4
by Isaac Beckett 23 Mar '23

23 Mar '23

> Message: 1 > Date: Tue, 21 Mar 2023 10:52:40 -0500 > From: June Tate-Gans (ジューン) <jtgans(a)google.com> > Subject: [seL4] Bitfield generator EBNF grammar > To: devel <devel(a)sel4.systems> > Message-ID: > <CAOPTAH0q0UABvFhffnmJ6ygDuPmpf8fMjxBawmYbhCjjJT8MTA(a)mail.gmail.com> > Content-Type: text/plain; charset="UTF-8" > > Hey guys, > > I've been attempting to put together some rust bindings for the seL4 fault > handling mechanisms, and I'm afraid the bitfield generator is driving me a > bit up a wall at this point. I'd like to find a concise grammar for the > language so I can better understand how bitfield_gen.py works, but there > doesn't seem to be any explicit BNF for it anywhere. > > Is there a paper I should be reading or a reference guide somewhere that > would help? > > Thanks! > > -- > June Tate-Gans > Software Engineer > Techlead, Kata OS / AmbiML, Google Hello June, I have a question about something I read on the announcement post for KataOS: > The current GitHub release includes most of the KataOS core pieces, including the frameworks we use for Rust (such as the sel4-sys crate, which provides seL4 syscall APIs), an alternate rootserver written in Rust (needed for dynamic system-wide memory management), and the kernel modifications to seL4 that can reclaim the memory used by the rootserver. And we've collaborated with Antmicro to enable GDB debugging and simulation for our target hardware with Renode. Are these changes being formally verified? I understand it involves a not insignificant amount of labor to do so, but I worry about bugs being introduced that undermine the security properties of seL4 if care isn’t taken here. Thanks, Isaac Beckett PS: I decided to post this to the mailing list because I thought it may be of interest to some folks here.

2 2

Reminder seL4 developer hangout
by Birgit Brecknell 20 Mar '23

20 Mar '23

Hi all A friendly reminder that the seL4 developer hangout is on again this week: Tue, Mar 21, 9pm (UTC), Topics: (open) * Sydney: Wed, Mar 22, 8am * Central Europe: Tue, Mar 21, 10pm * US Pacific Time: Tue, Mar 21, 2pm Calendar link: https://sel4.systems/contact/ Zoom link: https://unsw.zoom.us/j/82640784431 cheers Birg --- Dr. Birgit Brecknell Project Officer Trustworthy Systems, UNSW, birgit.brecknell(a)unsw.edu.au<mailto:birgit.brecknell@unsw.edu.au> seL4 Foundation, birgit(a)sel4.systems<mailto:birgit@sel4.systems> 0433 880 571 Mon 9am-5pm Wed 9am-12pm Fri 9am-5pm

1 0

shoehorn & fudge factor
by Sam Leffler 14 Mar '23

14 Mar '23

I have a target platform with only 4M of memory. When the system image is generated and the shoehorn helper script is used to find a place in memory to load the build artifacts it tacks on an extra 4M of memory use (aka fudge_factor). The comment in the code <https://github.com/AmbiML/sparrow-seL4_tools/blame/master/cmake-tool/helper…> says this is to accommodate sel4test_driver. Needless to say this breaks on my 4M target platform. So I made the fudge-factor settable from the cmd line with a default of 0 and changed the sel4test build glue to set 4M when building elfloader. Works fine for my target platform. But this change breaks building a bootable image for rpi3 (AARCH64=1 bcm28367)--shoehorn places elfloader s.t. it overlaps the image; e.g. ELF-loader started on CPU: ARM Ltd. Cortex-A53 r0p4 > paddr=[335000..51a0ff] > No DTB passed in from boot loader. > Looking for DTB in CPIO archive...found at 378778. > Loaded DTB from 378778. > paddr=[237000..23afff] > ELF-loading image 'kernel' to 0 > paddr=[0..236fff] > vaddr=[ffffff8000000000..ffffff8000236fff] > virt_entry=ffffff8000000000 > ELF-loading image 'capdl-loader' to 23b000 > paddr=[23b000..33bfff] > vaddr=[400000..500fff] > virt_entry=4009a8 > ERROR: image load address overlaps with ELF-loader! > ERROR: Physical address range invalid > ERROR: Could not load user image ELF Debug output of shoehorn for this case: shoehorn: debug: found CPIO identifying sequence b'070701' at offset 0x40 > in > /usr/local/google/home/sleffler/shodan/out/cantrip/aarch64-unknown-elf/release/elfloader/archive.o > shoehorn: debug: encountered CPIO entry name: kernel.elf > shoehorn: debug: encountered CPIO entry name: kernel.dtb > shoehorn: debug: encountered CPIO entry name: capdl-loader > shoehorn: debug: setting marker to 0x0 (region 0 start) > shoehorn: debug: setting marker to 0x237000 (kernel_end) > shoehorn: debug: setting marker to 0x23b000 (dtb_end) > shoehorn: debug: setting marker to 0x335000 (end of rootserver) So two questions: 1. Where is the 4M under-count of sel4test_driver? (the code indicates this might be explained in JIRA SELFOUR-2335 but I couldn't locate it) 2. Should zero'ing fudge_factor work? If yes, where should I look to remedy the above? I looked upstream for changes that might address this issue but didn't see anything. I suspect I can invert my logic and default fudge_factor to some value and then override as needed (e.g. 0 for my sparrow platform & 4M for sel4test builds). -Sam

3 5

memory zero'ing
by Sam Leffler 12 Mar '23

12 Mar '23

I'm chasing an issue that looks like retype'd memory has nonsense data. If I read the kernel code correctly it looks like the object returned by an seL4_UntypeRetype syscall should be zero'd (looks to happen when an untyped memory object is reset here <https://github.com/seL4/seL4/blob/master/src/object/untyped.c#L254>). Is that correct? I don't see anything called out in the manual. -Sam

6 9

Reminder seL4 developer hangout
by Birgit Brecknell 06 Mar '23

06 Mar '23

Hi all A friendly reminder that the seL4 developer hangout is on again this week: Wed, Mar 8, 6am (UTC), Topics: (open) * Sydney: Wed, Mar 8, 5pm * Central Europe: Wed, Mar 8, 7am * US Pacific Time: Tue, Mar 7, 10pm Calendar: https://sel4.systems/contact/ Zoom link: https://unsw.zoom.us/j/82640784431 cheers Birg --- Dr. Birgit Brecknell Project Officer Trustworthy Systems, UNSW, birgit.brecknell(a)unsw.edu.au<mailto:birgit.brecknell@unsw.edu.au> seL4 Foundation, birgit(a)sel4.systems<mailto:birgit@sel4.systems> 0433 880 571 Mon 9am-5pm Wed 9am-12pm Fri 9am-5pm

1 0

UnknownSyscall Exception Handler for non-seL4 syscall API
by lukas-graber＠protonmail.com 28 Feb '23

28 Feb '23

Hello, I am working on a syscall handler in user-space and want to implement a trap-and-emulate like mechanism. Firstly, some background information and motivation. I see that the seL4 system call API uses negative syscall numbers. This allows me theoretically to use positive syscall numbers to implement an additional syscall API. The seL4 kernel triggers an UnknownSyscall Exception whenever it encounters different syscalls and leads it to the fault handler endpoint in user space of the corresponding CAmkES component. I work with CAmkES and was able to create a fault handler similar to the one implemented in GDBMem with the help of templates. I am generally able to catch the exception in a thread in the same component and get the corresponding arguments. What I don't seem to manage is redirecting the program flow of the control thread so that we return to right after the faulting syscall instruction (should be faultIP + 2). It generally just retriggers the same exception or a different one (the VMFault exception). To better understand what I did, I quickly provide the code: - My C code: Triggers the system call number 60 with 6 arguments: ```bash int run(void) { while(1){ register int rax __asm__ ("rax") = 60; register int rdi __asm__("rdi") = 1; register int rsi __asm__("rsi") = 2; register int rdx __asm__("rdx") = 3; register int r10 __asm__("r10") = 4; register int r8 __asm__("r8") = 5; register int r9 __asm__("r9") = 6; __asm__ __volatile__ ( "syscall" : "+r" (rax) : "r" (rdi), "r" (rsi), "r" (rdx), "r" (r10), "r" (r8), "r" (r9) : "rcx", "r11", "memory"); printf("After the syscall instruction!\n"); } } ``` - My CAmkES code: We connect two threads of the component CompA, the faultIn thread is related to the From Template, the faultOut thread is related to the To template. ```bash connector camkesFaultHandlerThread { from Procedure; to Procedure; } procedure CAmkES_FaultHandlerThread { void bla(); } component CompA { control; uses CAmkES_FaultHandlerThread faultIn; provides CAmkES_FaultHandlerThread faultOut; } assembly { composition { component CompA compA; connection camkesFaultHandlerThread fault0 (from compA.faultIn, to compA.faultOut); } } ``` - The to Template: gets triggered with every fault, should handle the system call and then redirect program flow ```bash /*- set fault_ep = alloc("fault", seL4_EndpointObject, read=True, write=True, grantreply=True) -*/ /*- set info = c_symbol('info') -*/ int /*? me.interface.name ?*/__run(void) { seL4_Word fault_type; seL4_Word length; seL4_Word delegate_tcb; seL4_UserContext regs; seL4_MessageInfo_t info; while (1) { info = seL4_Recv(/*? fault_ep ?*/, &delegate_tcb); seL4_Fault_t fault = seL4_getFault(info); fault_type = seL4_MessageInfo_get_label(info); if(fault_type == seL4_Fault_UnknownSyscall){ printf("faulting PC: %zx\n",seL4_Fault_UnknownSyscall_get_FaultIP(fault)); //handle the syscall ... length = seL4_MessageInfo_get_length(info); seL4_TCB_ReadRegisters(delegate_tcb, false, 0, sizeof(seL4_UserContext) / sizeof(seL4_Word), &regs); // Which registers should I set for the faultIn thread?, right now simply jump over the syscall instruction regs.rip += 2; // Write registers back seL4_TCB_WriteRegisters(delegate_tcb, false, 0, sizeof(seL4_UserContext) / sizeof(seL4_Word), &regs); // Resume the caller seL4_MessageInfo_t info = seL4_MessageInfo_new(0, 0, 0, length); seL4_Reply(info); } else if(fault_type = seL4_Fault_VMFault){ // Why do we get in here after replying to UnknownSyscallException? } } } ``` I simply want to handle the UnknownSyscall Exception (in the faultOut thread) and then return to the instruction right after the original syscall in the control thread. But no matter how I change the IP, it just retriggers the exception or causes a VM Fault Exception. I see that there is a NextIP virtual register field in kernel/include/arch/x86/arch/64/mode/machine/registerset.h. Can I somehow set this one from userspace with setRegister? Has anyone ever tried something similar? Help would be very much appreciated. Thank you very much! Kind Regards, Lukas

2 2

Slowpath IPC mechanism
by mincheol＠vt.edu 22 Feb '23

22 Feb '23

Hi, I am wondering how the slowpath IPC mechanism works. Does it use shared memory to transfer the IPC message?

2 1

Reminder seL4 developer hangout
by Birgit Brecknell 21 Feb '23

21 Feb '23

Hi all A friendly reminder that the seL4 developer hangout is on again this week: Tue, Feb 21, 9pm (UTC), Topics: (open) * Sydney: Wed, Feb 22, 8am * Central Europe: Tue, Feb 21, 10pm * US Pacific Time: Tue, Feb 21, 1pm Zoom link: https://unsw.zoom.us/j/82640784431 cheers Birg --- Dr. Birgit Brecknell Project Officer Trustworthy Systems, UNSW, birgit.brecknell(a)unsw.edu.au<mailto:birgit.brecknell@unsw.edu.au> seL4 Foundation, birgit(a)sel4.systems<mailto:birgit@sel4.systems> 0433 880 571 Mon 9am-5pm Wed 9am-12pm Fri 9am-5pm

2 1

Re: U-boot for Raspberry PI
by Michal Podhradsky 08 Feb '23

08 Feb '23

Hello, thank you for prompt replies! I used the default U-boot, however now I am stuck in the next phase of booting - specifically loading and booting the sel4 test image. Following the instructions in the docs ( https://docs.sel4.systems/Hardware/Rpi4.html) I do: *U-Boot> fatload mmc 0 0x10000000 sel4test-driver-image-arm-bcm2711** Reading file would overwrite reserved memory **Failed to load 'sel4test-driver-image-arm-bcm2711* Which is odd. Perhaps the memory map on Rpi has changed recently? Picking another memory location gets me further (although it is unclear that it is a correct location): *U-Boot> fatload mmc 0 0x00008000 sel4test-driver-image-arm-bcm27115164988 bytes read in 235 ms (21 MiB/s)U-Boot> bootefi 0x00008000* Now, the image gets loaded but the boot fails with an seL4 assertion fail: *U-Boot> bootefi 0x00008000Card did not respond to voltage select! : -110No EFI system partitionBooting /sel4test-driver-image-arm-bcm2711ELF-loader started on CPU: ARM Ltd. Cortex-A72 r0p3 paddr=[6603000..ffffffffffffffff] dtb=6af2000Looking for DTB in CPIO archive...found at 674d958.Loaded DTB from 674d958. paddr=[123f000..1245fff]ELF-loading image 'kernel' to 1000000 paddr=[1000000..123efff] vaddr=[ffffff8001000000..ffffff800123efff] virt_entry=ffffff8001000000ELF-loading image 'sel4test-driver' to 1246000 paddr=[1246000..164bfff] vaddr=[400000..805fff] virt_entry=40ef20Enabling MMU and pagingJumping to kernel-image entry point...Bootstrapping kernelavailable phys memory regions: 3 [1000000..3b400000] [40000000..fc000000] [100000000..200000000]reserved virt address space regions: 3 [ffffff8001000000..ffffff800123f000] [ffffff800123f000..ffffff800124556b] [ffffff8001246000..ffffff800164c000]Booting all finished, dropped to user spaceseL4 failed assertion 'isSchedulable(candidate)' at /tmp/kernel/src/kernel/thread.c:371 in function schedulehalting...Kernel entry via Interrupt, irq 0* Any suggestions what am I missing? Regards Michal On Thu, Jan 19, 2023 at 5:53 PM Sudvarg, Marion <msudvarg(a)wustl.edu> wrote: > I have a version of U-boot that works. I would have to go back through > piles of notes to see what I did to make it work, but I can share the file > with you if it's helpful. > > I also had to change config.txt to set the GPU and coprocessor frequency > to a fixed value; I had issues with boot (which is handled by the GPU) and > UART without that. > > Happy to help with the process if you like. > > Marion Sudvarg > Washington University in St. Louis > > -----Original Message----- > From: mpodhradsky(a)galois.com <mpodhradsky(a)galois.com> > Sent: Thursday, January 19, 2023 7:02 PM > To: devel(a)sel4.systems > Subject: [seL4] U-boot for Raspberry PI > > Hello! > > The instructions for building seL4 for Raspberry Pi 3 and 4 mention ask > for a custom compiled U-boot. The note mentions that an automatic revert of > the specified commit no longer works. Is this patched U-boot still > necessary, or will a vanilla version work? If the customization is still > needed, do you have a modified version available? It is not clear how to > modify the recent U-boot, since it has changed significantly. > > Regards > Michal > _______________________________________________ > Devel mailing list -- devel(a)sel4.systems To unsubscribe send an email to > devel-leave(a)sel4.systems >

4 5

Reminder seL4 developer hangout
by Birgit Brecknell 06 Feb '23

06 Feb '23

Hi all A friendly reminder that the seL4 developer hangout is on again this week: Wed, Feb 8, 6am (UTC), Topics: (open) * Sydney: Wed, Feb 8, 5pm * Central Europe: Wed, Feb 8, 7am * US Pacific Time: Tue, Feb 7, 10pm Calendar: https://sel4.systems/contact/ Zoom link: https://unsw.zoom.us/j/82640784431 cheers Birg --- Dr. Birgit Brecknell Project Officer Trustworthy Systems, UNSW, birgit.brecknell(a)unsw.edu.au<mailto:birgit.brecknell@unsw.edu.au> seL4 Foundation, birgit(a)sel4.systems<mailto:birgit@sel4.systems> 0433 880 571 Mon 9am-5pm Wed 9am-12pm Fri 9am-5pm

1 0

kernel builds w/ different memory configurations
by Sam Leffler 27 Jan '23

27 Jan '23

I have a target platform w/ 2 pre-defined memory configs. I've created separate .dts files w/ the different memory sizes and then in src/plat/sparrow/config.cmake do: if(KernelDebugBuild) list(APPEND KernelDTSList "tools/dts/sparrow-debug.dts") else() list(APPEND KernelDTSList "tools/dts/sparrow.dts") Overloading KernelDebugBuild is awkward (it seems contrary to it's purpose) and fragile. How is this handled for existing platforms? -Sam

2 2

help with Nvidia Jetson Xavier port
by Axel Heider 27 Jan '23

27 Jan '23

Hi, we are working on porting seL4 to the Nvidia Jetson Xavier. The kernel is booting, but then there are random crashes in user mode where the cores seem to stop completely within a minute, no crash output is visible. Our test applications are just doing some integer number crunching to create load, there are no drivers involved (besides a bit of UART output). It looks like this also happened to others, a similar problem was described in this post: https://forums.developer.nvidia.com/t/illegal-instruction-with-i-cache-disa… Did anybody get seL4 userland running stable there? Axel

1 0

Inquiry to Verified Components
by Seoyeon Hwang 26 Jan '23

26 Jan '23

Hello, From this document https://apps.dtic.mil/sti/pdfs/AD1027690.pdf <https://urldefense.com/v3/__https://apps.dtic.mil/sti/pdfs/AD1027690.pdf__;…>, we figured out that system call APIs are verified (except for their composition with sel4 kernel proofs). However, we are not sure whether other process/thread-spawning APIs are also verified. We use the APIs (listed below) in our project, hoping to develop a formally verified root-of-trust architecture atop seL4. Could you let us know if they are all verified, and if so, could you also point out the resources we can cite in our paper? Thanks, Seoyeon APIs used in our projects are: Initial Process-related APIs platsupport_get_bootinfo simple_default_init_bootinfo bootstrap_use_current_simple allocman_make_vka simple_get_cnode simple_get_pd Thread Spawning APIs vka_alloc_tcb vka_alloc_frame seL4_ARCH_Page_Map vka_alloc_page_table seL4_ARCH_PageTable_Map vka_alloc_endpoint vka_mint_object seL4_TCB_Configure seL4_TCB_SetPriority sel4utils_set_instruction_pointer sel4utils_set_stack_pointer seL4_TCB_WriteRegisters sel4runtime_write_tls_image sel4runtime_set_tls_variable seL4_TCB_SetTLSBase seL4_TCB_Resume Process Spawning APIs sel4utils_bootstrap_vspace_with_bootinfo_leaky vspace_reserve_range bootstrap_configure_virtual_pool process_config_default_simple sel4utils_configure_process_custom vka_cspace_make_path sel4utils_mint_cap_to_process sel4utils_create_word_args sel4utils_spawn_process_v IPC/System call APIs seL4_MessageInfo_new seL4_MessageInfo_get_length seL4_SetMR seL4_GetMR seL4_Call seL4_Recv seL4_Reply seL4_Wait seL4_Yield

7 10

sel4test:nested timeout fault test flaky?
by Sam Leffler 25 Jan '23

25 Jan '23

We run sel4test regularly for a 64-bit raspi target under qemu and occasionally see failures like this: Starting test 129: TIMEOUTFAULT0003 > Running test TIMEOUTFAULT0003 (Nested timeout fault) > Error: Check badge(3) == expected_badge(2) failed. at line 9 This is a stock sel4test <https://github.com/AmbiML/sparrow-sel4test> + dep libs but an older kernel <https://github.com/AmbiML/sparrow-kernel>. Anyone know if this is an old (presumably fixed) bug or known issue? -Sam

3 5

Reminder seL4 developer hangout
by Birgit Brecknell 25 Jan '23

25 Jan '23

Hi all A friendly reminder that the seL4 developer hangout is on again this week: Tue, Jan 24, 9pm (UTC), Topics: (open) * Sydney: Wed, Jan 25, 8am * Central Europe: Tue, Jan 24, 10pm * US Pacific Time: Tue, Jan 24, 1pm Zoom link: https://unsw.zoom.us/j/82640784431 cheers Birg --- Dr. Birgit Brecknell Project Officer Trustworthy Systems, UNSW, birgit.brecknell(a)unsw.edu.au<mailto:birgit.brecknell@unsw.edu.au> seL4 Foundation, birgit(a)sel4.systems<mailto:birgit@sel4.systems> 0433 880 571 Mon 9am-5pm Wed 9am-12pm Fri 9am-5pm

3 2

Sel4 on RISC-V AllwinnerD1 MangoPi MQ1PH boot problem
by alex＠nixd.org 19 Jan '23

19 Jan '23

Hello, I just have a small question because I found the documentation about booting the Sel4 on RISC-V systems a bit confusing and not answering my questions. 1) I have ported all necessary code and I have successful compiled the `sel4test`. 2) I have flashed a SPL and U-Boot to 'mmc' which was built including OpenSBI fw_dynamic.bin but against most recent version (Sel4 was also compiled against most recent version OpenSBI v1.2 U-Boot SPL 2022.10-38338-g528ae9bc6c-dirty (Jan 11 2023 - 01:07:54 +0100)). 3) SPL and U-boot runs perfectly. 4) Sel4 does not want to boot. Why? So, in the DTS which I extracted from SDK it is said: ` /memreserve/ 0x40000000 0x200000; /* opensbi */ /memreserve/ 0x42000000 0x100000; /* dsp used 1MB */ memory@40000000 { device_type = "memory"; reg = <0x0 0x40000000 0x0 0x8000000>; }; ` For the elfloader objdump reports the `_start at 0x40a21000` so I hardcoded it into the following #define CONFIG_BOOTCOMMAND \ "if mmc rescan; then " \ "echo SD/MMC found on device ${mmc_dev};" \ "fatload mmc 0 0x40a21000 elfloader;" \ "fatload mmc 0 0x40a27940 archive.archive.o.cpio;" \ "bootelf 0x40a21000;" \ "fi;" \ And it reported an error: "Unhandled exception: Load access fault EPC: 000000007ffbd308 RA: 000000007ffbd33a TVAL: 00000005c66db5aa EPC: 0000000042e50308 RA: 0000000042e5033a reloc adjusted Code: 69a2 6145 8082 7480 1793 0069 9426 943e (641c) resetting ..." It seems that it relocates itself to 42e5033a (or not?) what actually I was trying to do manually. U-boot reports (for the domain0) the next address which is 0x0000000042e00000. And when I am loading elfloader there, it exists back to uboot shell without any errors and nothing happens. I can not understand what I am doing wrong, because FreeBSD and Linux starts normally. The #define seL4_UserTop is generated from DTS file if I understood correctly. But it seems it is incorrect. I will be happy for any hint. Thank you.

3 2

Can I launch two rumprun instances at the same time?
by mincheol＠vt.edu 06 Jan '23

06 Jan '23

Hi, I am trying to run two rumprun instances on seL4. I called launch_process(bin_name, CONFIG_RUMPRUN_COMMAND_LINE, 1); launch_process(bin_name, CONFIG_RUMPRUN_COMMAND_LINE, 2); in run_rr() of rumprun-sel4-demoapps/roottask/src/main.c. Then I got below: <<seL4(CPU 0) [decodeCNodeInvocation/107 T0xffffff801fe14400 "roottask" @4166c1]: CNode Copy/Mint/Move/Mutate: Source slot invalid o> sel4utils_move_cap_to_process@process.c:157 Failed to move cap <<seL4(CPU 0) [decodeX86PortControlInvocation/147 T0xffffff801fe14400 "roottask" @451efa]: IOPortControl: Some ports in range alread> arch_copy_IOPort_cap@arch.c:25 Failed to get IO port cap for range cf8 to cff I don't understand why I got these errors. launch_process() gets rump_process_t *process from process_from_id(id) so I should get a different slot with the different process id.

1 0

Question about non-blocking notification
by mincheol＠vt.edu 31 Dec '22

31 Dec '22

Hi, Do I need to use seL4-NBSend() for sending a non-blocking signal (cause seL4_Signal() is blocking)?

3 5

Question about sel4-tutorial dynamic-2 and dynamic-3
by mincheol＠vt.edu 29 Dec '22

29 Dec '22

Hi, I have two questions regarding dynamic-2 and dynamic-3 tutorials. 1. In dynamic-2 TASK 4, Why is the ipc_buffer_vaddr put in seL4_ARCH_PageTable_Map()? ipc_buffer_vaddr is the virtual address of the new physical frame allocated for the IPC buffer. I think seL4_ARCH_PageTable_Map's 3rd parameter is the virtual address of the page table frame. 2. In dynamic-3, it uses sel4utils_configure_process_custom() to create a new thread. I looked into the function and found that it created a vspace for the new thread. However, the tutorial's learning outcomes section says "this time the two threads will only share the same vspace", so I am confused. Does this tutorial create a new vspace for the new thread? Mincheol

2 2

Any reliable way to determine if a thread is suspended?
by Andrew Warkentin 28 Dec '22

28 Dec '22

Is there any reliable way to determine if a thread is suspended? seL4_TCB_Suspend() succeeds even if the thread was already suspended. I can force all calls to seL4_TCB_Suspend() and seL4_TCB_Resume() to go through a wrapper that updates a user-level flag (since my OS manages pretty much all capabilities in the root server and will only expose TCBs to regular user processes through a special filesystem); however, this leaves a race when a thread is suspended due to a fault instead of an API call (since the thread will already be suspended before the fault handler updates the "thread running" flag). My initial use for checking if a thread is running is to allow easy atomic updates of some metadata (shared between the root server and the non-root thread, and optionally shared between threads) for my IPC transport layer that implements Unix-like file descriptors on top of seL4 endpoints (and eventually notifications). To add an FD to a thread's list, the root server allocates a copy of the endpoint (and reply if the FD is server-side) into the thread's CSpace, suspends the thread, updates the metadata (which includes the underlying capabilities), and then resumes the thread if it was running. Obviously, I don't want to resume threads that weren't running in the first place. I don't want to use locks here since the root server can't trust regular user processes. Another use is to allow cancelling any in-progress transfers on FDs when they get closed and returning a status to the waiting threads, which I am planning to do by replacing the endpoint with a copy of a global "clunk endpoint" associated with a thread that repeatedly sends a "file descriptor closed" message (actually there will be two such threads - one for clients, and one for servers) and then resuming the thread.

1 0

problem Ethdriver 82574 on Qemu X86_64
by reza yazdanparast 25 Dec '22

25 Dec '22

Hi. I'm working on a new camkes-based project. This project is simulated by using Qemu, on a Q35 machine for X86_64 arch and e1000e eth. I am using an intel controller driver (82574 controller) for network communication. My project has been built successfully and the intel network driver has been initialized. But when using the network in my application in Qemu, no network packet is sent and received! Qemu command: ``` sudo qemu-system-x86_64 -machine q35,accel=kvm,kernel-irqchip=split -cpu host, -netdev tap,id=netdev0,ifname=tap0,script=no,downscript=no -device e1000e,id=nic0,netdev=netdev0,mac=52:55:00:d1:55:01 -nographic -serial mon:stdio -m size=4G -device intel-iommu -kernel ./target/debug/images/kernel-x86_64-pc99 -initrd ./target/debug/images/capdl-loader-image-x86_64-pc99 ``` . Appendix: Create tap0 command: ``` export TAP_DEV=tap0 sudo ip tuntap add dev $TAP_DEV mode tap sudo ip addr flush dev $TAP_DEV sudo ip addr add 10.10.100.1/24 brd 10.10.100.255 dev $TAP_DEV sudo ip link set dev $TAP_DEV addr 02:00:ca:fe:01 sudo ip link set dev $TAP_DEV up ``` . how to fix this problem? Thank you.

1 0

any fun holiday hacks with sel4?
by ember arlynx 25 Dec '22

25 Dec '22

merry christmas :) i've been thinking about reviving some rusty robigalia-ish things. how are you all doing, this stormy sunday? -- ember

1 0

next seL4 TSC meeting on Fri 16 Dec (15 Dec in US and Europe)
by Gerwin Klein 16 Dec '22

16 Dec '22

The Technical Steering Committee (TSC) of the seL4 Foundation will hold its next public meting on: - Sydney: Fri, 16 Dec, 8am - Central Europe: Tue, 15 Dec, 10pm - US West Coast: Tue, 15 Dec, 1pm See also the seL4 calendar feed available from here: https://sel4.systems/contact/home.pml The meeting is by Zoom, and you can join from here: https://unsw.zoom.us/j/5510249963 Anyone interested can join the meeting and listen to the discussion and request to speak, which will be granted if time permits. Only TSC members can vote. The seL4 code of conduct applies to the meeting [1]. The agenda for the meeting so far is: - election (or re-election) of TSC chair - split C-Parser/AutoCorres out from l4v repository - RFCs: - SMC https://sel4.atlassian.net/browse/RFC-9 - MCS: Improve constraints on grant via reply https://sel4.atlassian.net/browse/RFC-13 - MCS: set fault and timeout handler parameters while configuring TCBs https://sel4.atlassian.net/browse/RFC-11 - The seL4 Core Platform https://sel4.atlassian.net/browse/RFC-5 - The seL4 Device Driver Framework https://sel4.atlassian.net/browse/RFC-12 - Ability to build additional bootloaders inside the seL4 build system https://sel4.atlassian.net/browse/RFC-4 - SIG chair nominations - discuss process for establishing SIGs If there are other items that I missed or you think should be on the agenda, please let me know. If we can't get to an item this time, we can still schedule another meeting. Cheers, Gerwin (TSC chair) [1]: https://docs.sel4.systems/processes/conduct.html

1 1

Reminder seL4 developer hangout
by Birgit Brecknell 12 Dec '22

12 Dec '22

Hi all A friendly reminder that the seL4 developer hangout is on again this week: Wed, Dec 14, 6am (UTC), Topics: (open) * Sydney: Wed, Dec 14, 5pm * Central Europe: Wed, Dec 14, 7am * US Pacific Time: Tue, Dec 13, 10pm Zoom link: https://unsw.zoom.us/j/82640784431 cheers Birg --- Dr. Birgit Brecknell Project Officer Trustworthy Systems, UNSW, birgit.brecknell(a)unsw.edu.au<mailto:birgit.brecknell@unsw.edu.au> seL4 Foundation, birgit(a)sel4.systems<mailto:birgit@sel4.systems> 0433 880 571 Mon 9am-5pm Wed 9am-12pm Fri 9am-5pm

1 0

Call for nominations for Special Interest Group Chairs
by Gerwin Klein 05 Dec '22

05 Dec '22

At this year's seL4 summit the community expressed strong interest in starting a number of special interest groups (SIGs) around seL4 and in particular around the following topics: - Virtual machines and virtual machine monitors (SIG VMM) - Drivers (SIG Drivers) - Multicore design + verification (SIG Multicore) The multicore verification topic also showed large overlap with interest in user-level verification at the summit. One suggestion would be to cover both topics in that SIG. To start these SIGs, we are calling for the nomation of a chair for each of them. Anyone can nominate anyone from the seL4 community, including themselves. If there is more than one nomination who is willing to do the job for a specific SIG, we will organise a vote and if possible appoint a chair + vice-chair (for backup). The appointement will be confirmed by the technical steering committee TSC. The main job of the chair of a SIG will be (lightweight) moderatation, keeping the conversation going, and to be a point of contact with the TSC. An initial task for the chair would be to lead the discussion on what the SIG will be about in more detail and what it wants to achieve. Examples could be: - to coordinate concrete work - to discuss the topic of the SIG - to make recommendations to the TSC - to work together on RFCs on the topic of the SIG This should result in a short description that we can use on the seL4 website and discourse groups for the SIG to describe what its purpose is. We suggest that the main communciation medium for SIGs be the seL4 discourse forum, where each SIG could have its own topic area, but we are happy for SIGs to self-organise differently if they prefer. Please send nominations to Gerwin Klein <kleing(a)unsw.edu.au>. Please indicate which SIG they are for. Cheers, Gerwin (seL4 TSC chair)

1 0

[FOSDEM'23] Submit talk for the "Microkernel and Component-based OS" devroom
by Razvan Deaconescu 05 Dec '22

05 Dec '22

Hi. I am Razvan Deaconescu, I'm from University POLITEHNICA of Bucharest (working on Unikraft unikernel) and I'm managing the "Microkernel and Component-based OS" devroom[2] at FOSDEM'2023[1]. The devroom will take place in person, at FOSDEM'23, in Brussels, on Sunday, February 5, 2023. If you have an interesting topic to talk about it would be great if you made a submission. This is something easy to do, takes about 15-20 minutes on Pentabarf[3]. The deadline for submission is today, Friday, December 2, 2022. [1] https://fosdem.org/2023/ [2] https://fosdem.org/2023/schedule/track/microkernel_and_component_based_os/ [3] https://penta.fosdem.org/submission/ Razvan

2 2

Reminder seL4 developer hangout
by Birgit Brecknell 28 Nov '22

28 Nov '22

Hi all A friendly reminder that the seL4 developer hangout is on again this week: Tue, Nov 29, 9pm (UTC), Topics: (open) * Sydney: Wed, Nov 30, 8am * Central Europe: Tue, Nov 29, 10pm * US Pacific Time: Tue, Nov 29, 1pm Zoom link: https://unsw.zoom.us/j/82640784431 cheers Birg --- Dr. Birgit Brecknell Project Officer Trustworthy Systems, UNSW, birgit.brecknell(a)unsw.edu.au<mailto:birgit.brecknell@unsw.edu.au> seL4 Foundation, birgit(a)sel4.systems<mailto:birgit@sel4.systems> 0433 880 571 Mon 9am-5pm Wed 9am-12pm Fri 9am-5pm

1 0

Survey about the seL4 summit 2023's location
by June Andronick (seL4 Foundation) 21 Nov '22

21 Nov '22

Dear seL4 friends, With the great success of the seL4 summit 2022 behind us, we are now already looking at the seL4 summit 2023! This should happen around Sep/Oct 2023. We have started investigating options for the location, and we would like your feedback. We would very much appreciate if you could fill in this very short survey to tell us your opinion between USA (likely Minneapolis) and Australia (likely Sydney) or any other feedback you have: https://forms.gle/k4XxYaYeudYUie9U8 <https://forms.gle/k4XxYaYeudYUie9U8> Please do so by Nov 22nd 2022. Feel free to forward to anyone you believe may want to attend the summit next year. Many thanks! June -- June Andronick CEO of the seL4 Foundation https://sel4.systems/Foundation

1 1

Experimental project on seL4 microbenchmarking
by Nataliya Korovkina 20 Nov '22

20 Nov '22

Hi seL4 friends, I’d like to share an experimental project on seL4 microbenchmarking inspired with my experience with sel4bench suite. Your thoughts on the concept and its practical use will be greatly appreciated. Motivation (informal) Measuring execution times of short code paths, which we can meet in seL4 microbenchmarking, is a good way to immerse oneself into the domain of compiler and microarchitectural optimizations. Implementation of “early processing” measurement methodology in sel4bench suite (for Notification delivery case, as a trial step; PR #26) was an amazing experience in that respect. So, I gladly share the work highlights to explain my motivation. First, latencies of some microarchitectural events can be comparable with execution time of a measured code path. So, if microarchitectural event not planned by a benchmark design happens during a measuring period, deviation of the observed value considerably increases. Second, the both kinds of optimizations of instrumental code cause instability of measured values from one measurement iteration to another. Third, debugging the instrumental code is very challenging. Injection of diagnostic code into it changes effects of the both types of optimizations; therefore, initially witnessed symptoms effectively transform to other ones. When you think about how to control optimizations effects, the situation appears uninspiring, considering the need to treat various microarchitectures and optimization features. As a result, the situation left me with the question on hands: how to distance a benchmark design from necessity to control optimizations effects in instrumental code that impair repeatability? Eventually, it reduced to the foundational one: What we measure, and Why? This experimental work is attempt to find and try the solution for the challenge: designing more predictable measurement context. The work was published in github. Description paper https://github.com/malus-brandywine/sel4KanataBench-papers/blob/main/Kanata… Project repository https://github.com/malus-brandywine/sel4KanataBench Project manifest repository https://github.com/malus-brandywine/sel4KanataBench-manifest Tables of data collected on four TS platforms: files KBenchTable-xxxx.pdf in https://github.com/malus-brandywine/sel4KanataBench-papers Thank you!

1 0

Reminder seL4 developer hangout
by Birgit Brecknell 14 Nov '22

14 Nov '22

Hi all A friendly reminder that the seL4 developer hangout is on again this week: Wed, Nov 16, 6am (UTC), Topics: (open) * Sydney: Wed, Nov 16, 5pm * Central Europe: Wed, Nov 16, 7am * US Pacific Time: Tue, Nov 15, 10pm Zoom link: https://unsw.zoom.us/j/82640784431 cheers Birg --- Dr. Birgit Brecknell Project Officer Trustworthy Systems, UNSW, birgit.brecknell(a)unsw.edu.au<mailto:birgit.brecknell@unsw.edu.au> seL4 Foundation, birgit(a)sel4.systems<mailto:birgit@sel4.systems> 0433 880 571 Mon 9am-5pm Wed 9am-12pm Fri 9am-5pm

1 0

Reminder seL4 developer hangout
by Birgit Brecknell 31 Oct '22

31 Oct '22

Hi all A friendly reminder that the seL4 developer hangout is on again next week: Tue, Nov 1, 9pm (UTC), Topics: (open) * Sydney: Wed, Nov 2, 8am * Central Europe: Tue, Nov 1, 10pm * US Pacific Time: Tue, Nov 1, 2pm Zoom link: https://unsw.zoom.us/j/82640784431 cheers Birg --- Dr. Birgit Brecknell Project Officer Trustworthy Systems, UNSW, birgit.brecknell(a)unsw.edu.au<mailto:birgit.brecknell@unsw.edu.au> seL4 Foundation, birgit(a)sel4.systems<mailto:birgit@sel4.systems> 0433 880 571 Mon 9am-5pm Wed 9am-12pm Fri 9am-5pm

1 0

Cross Core IPC
by Sid Agrawal 24 Oct '22

24 Oct '22

Hi, I came across Gernot Heiser's blog post on "How to use seL4 IPC" [1]. The article explicitly says that doing cross-core IPC is a bad idea. This statement led to a series of questions for me, which I hope you guys can help me with. Scenario ------------ We have a system with two cores. Let's say that a physical memory server is running on core0, my application is on core1, and they are somehow pinned to those cores. The application wants some physical memory (frame capabilities) from the memory server. Questions ------------- Q1. Will the application be able to invoke the endpoint given that the TCB which will respond to it is on a separate core? If yes, will sending a capability back via cross-core IPC be allowed? I did not read anything in the manual which said otherwise. Q2. Why is a cross-core IPC a bad idea? This might be a loaded question, but I am not able to appreciate the badness of the idea :) Q3. What would be the right way to do it? For example, in Barrelfish(limited experience from a course), the application(on core1) would make an IPC to a monitor running on the same core1. This monitor did synchronization with another monitor running on the other core(core0) via a shared memory region (all in user space). That monitor(core0) then sent an IPC to the memory server running on core0. And then back again via the monitors. Best, Sid [1] https://microkerneldude.org/2019/03/07/how-to-and-how-not-to-use-sel4-ipc/

3 2

Suitability for a project
by James Hillman 19 Oct '22

19 Oct '22

Hi Sel4 developers, I am new to this forum and hoping this is the right place to bounce my project idea off. I typically use FPGA to enforce security in my products but there are lots of reasons why FPGAs are not suitable for all use cases. I have also used low end microcontroller where one can review all the code to understand the security risks. My latest project however involves two USB processes (one for each physical connection) with high throughput expectations. And to pass data streams at high typical throughput between them. Due to the wide range of USB type of devices I fear this would be too much code to review - it feels very OS like. Note, I don't need a GUI, it's headless. So I'm interested in sel4 as I could run the processes in Linux VMs if I understand sel4 correctly. And whilst it's not the smallest processors I think they need to be more powerful to support the speeds. So this is fine . I am unsure how much of this project is already done, mainly thinking the usb driver perspective. Thanks in advance, Best wishes James

5 10

new RFC: seL4 Device Driver Framework
by Gerwin Klein 19 Oct '22

19 Oct '22

A new RFC has just landed: https://sel4.atlassian.net/browse/RFC-12 If you have any feedback, please comment there. Cheers, Gerwin

8 16

Re: Suitability for a project
by James Hillman 19 Oct '22

19 Oct '22

Thanks Gernot. Thoughts on throughput rates thats might be achieved?

1 0

Re: Suitability for a project
by James Hillman 19 Oct '22

19 Oct '22

I was interested to see the Google news re. KataOS which I suspect confirms that my sort of requirement / entry point is someway out. I was also reading about ARM Morello / CHERI work. Although I appreciate this is taking a different, perhaps flawed, path of some new hardware memory protection. Appreciate any feedback you can humour me with.

2 1

seL4 dev hangout reminder
by Gerwin Klein 17 Oct '22

17 Oct '22

Hi all A friendly reminder that the seL4 developer hangout is on again this week: Wed, Oct 19, 6am (UTC), Topics: (open) * Sydney: Wed, Oct 19, 5pm * Central Europe: Wed, Oct 19, 8am * US Pacific Time: Tue, Oct 18, 11pm Zoom link: https://unsw.zoom.us/j/82640784431 Cheers, Gerwin

1 0

Re: Devel Digest, Vol 171, Issue 3
by Isaac Beckett 08 Oct '22

08 Oct '22

> From: Gerwin Klein <kleing(a)unsw.edu.au> > Subject: [seL4] new RFC: seL4 Device Driver Framework > To: sel4 <devel(a)sel4.systems> > Cc: "tsc-members(a)sel4.systems" <tsc-members(a)sel4.systems> > Message-ID: <55BB3266-24A1-488B-A623-5B912461AD7F(a)unsw.edu.au> > Content-Type: text/plain; charset="us-ascii" > > A new RFC has just landed: https://sel4.atlassian.net/browse/RFC-12 > > If you have any feedback, please comment there. > > Cheers, > Gerwin Ooh, exciting. I wonder if something similar to Mesa could be implemented for graphics, to ease porting existing Mesa drivers.

1 0

High-throughput asyncrhonous driver API?
by Andrew Warkentin 05 Oct '22

05 Oct '22

I remember talk in one of the developer hangouts I was in about a proof of concept for a high-throughput asynchronous driver layer for seL4 (presumably based on notifications). Has code for this been released anywhere? I'm going to be starting on my own IPC transport layer and I want to include asynchronous message passing as an option.

1 0

Device pass-through in qemu-qrm-virt
by ybbekele＠aggies.ncat.edu 03 Oct '22

03 Oct '22

Hello I am trying to do a device pass-through for a qemu-arm-virt implementation of seL4. Although there are no resources on how to do it on ARM, I followed the procedures for x86 found here [1]. There are differences between the two architectural implementations thus can't be successful. I tried to pass the image as an argument to Simulate, parser.add_argument('--extra-qemu-args', dest='qemu_sim_extra_args', type=str, help="Additional arguments to pass onto QEMU", default="-device virtio-blk-pci,drive=drive0 -drive file=/****/***/****/projects/camkes-vm-images/qemu-arm-virt/sdcard.img,format=raw,if=none,id=drive0") The machine can start successfully, but it keeps dropping to the initramfs and there is no sda in /dev/. Is there someone who is successful in passing through a device to qemu-arm-virt? Are there any documents to do that? Thank you [1] https://docs.sel4.systems/projects/camkes-vm/

1 0

Entry of user program
by mincheol＠vt.edu 30 Sep '22

30 Sep '22

Hi, I am trying to benchmark seL4's cross core IPC. I was able to run the IPC tutorial program and am now trying to run the server and the client on different VCPU. I found seL4_TCB_SetAffinity() but need to know the entry point of user program. Can anyone point it out for me? Mincheol

2 1

I need help with the IPC tutorial
by mincheol＠vt.edu 30 Sep '22

30 Sep '22

Hi, I can't figure out what to code in server.c for the ipc tutorial. What can I code after "// TODO use cap transfer to send the badged cap in the reply" line in the tutorial template (server.c) Can anyone share the fully working source.c?

3 3

Reminder seL4 developer hangout
by Birgit Brecknell 30 Sep '22

30 Sep '22

Hi all A friendly reminder that the seL4 developer hangout is on again next week: Tue, Oct 4, 9pm (UTC), Topics: (open) * Sydney: Wed, Oct 5, 8am * Central Europe: Tue Oct 4, 11pm * US Pacific Time: Tue, Oct 4, 2pm Zoom link: https://unsw.zoom.us/j/82640784431 cheers Birg --- Dr. Birgit Brecknell Project Officer Trustworthy Systems, UNSW, birgit.brecknell(a)unsw.edu.au<mailto:birgit.brecknell@unsw.edu.au> seL4 Foundation, birgit(a)sel4.systems<mailto:birgit@sel4.systems> 0433 880 571 Mon 9am-5pm Wed 9am-12pm Fri 9am-5pm

1 0

Raspberry Pi SMP?
by dave＠synergy.org 30 Sep '22

30 Sep '22

Hello, Is there any intent to enable SMP on the Raspberry Pi? I am using the Raspberry Pi 3B+. I'd like to be able to use all 4 CPUs. Thanks, David

2 2

Support for Sel4 Project
by simone cataldo 29 Sep '22

29 Sep '22

Good morning, We are a small test team, investigating seL4 microkernel to evaluate its use it as core component for a novel “open avionics” drone concept. Essentially, we are starting from scratch, basing ourselves on the provided tutorials such as “hello world”. We were trying to modify its source code for evaluating basic thing simple functions, basic programs and custom libraries. However, it looks like the memory allocation is static and embedded in the original project: once we increase the complexity of the program it evidently causes trouble. We have not found any documentation about how to set the memory allocation at compile time, and how to include external dependencies (i.e. static libraries). We would like to have some guideline to get us started and direction to some in-depth documentation to acquire enough knowledge to build a full project of our own. We are looking forward to hearing from you soon. Best regards, Simone CATALDO

5 5

Reminder seL4 developer hangout
by Birgit Brecknell 19 Sep '22

19 Sep '22

Hi all A friendly reminder that the seL4 developer hangout is on again this week: Wed, Sep 21, 7am (UTC), Topics: (open) * Sydney: Wed, Sep 21, 5pm * Central Europe: Wed, Sep 21, 9am * US Pacific Time: Wed Sep 21, 12 midnight Zoom link: https://unsw.zoom.us/j/82640784431 cheers Birg --- Dr. Birgit Brecknell Project Officer Trustworthy Systems, UNSW, birgit.brecknell(a)unsw.edu.au<mailto:birgit.brecknell@unsw.edu.au> seL4 Foundation, birgit(a)sel4.systems<mailto:birgit@sel4.systems> 0433 880 571 Mon 9am-5pm Wed 9am-12pm Fri 9am-5pm

1 0

Proper seL4 APi/ABI design
by Eric Jacobs 17 Sep '22

17 Sep '22

Jumping off from the recent thread, I was curious if anyone had any thoughts about how to optimally design API's for seL4. I noticed we had a bit of info about what not to do (don't do long IPC, don't implement Posix, don't use messaging as synchronization, etc.) Are there any shining examples of what _to_ do with an API? Thanks, -Eric

5 11

Reminder seL4 developer hangout
by Birgit Brecknell 05 Sep '22

05 Sep '22

Hi all A friendly reminder that the seL4 developer hangout is on again this week: Tue, Sep 6, 10pm (UTC), Topics: (open) * Sydney: Wed, Sep 7, 8am * Central Europe: Wed, Sep 7, 12 midnight * US Pacific Time: Tue, Sep 9, 3pm Zoom link: https://unsw.zoom.us/j/82640784431 cheers Birg --- Dr. Birgit Brecknell Project Officer Trustworthy Systems, UNSW, birgit.brecknell(a)unsw.edu.au<mailto:birgit.brecknell@unsw.edu.au> seL4 Foundation, birgit(a)sel4.systems<mailto:birgit@sel4.systems> 0433 880 571 Mon 9am-5pm Wed 9am-12pm Fri 9am-5pm

1 0

tool to report per-component memory / resource use from system.cdl
by Sam Leffler 27 Aug '22

27 Aug '22

I'm looking for a script/tool that can break down memory by component given a system.cdl file. I've been doing this by hand (sorta) but figured I should ask before doing something more organized. -Sam

1 0

Project Sparrow / KataOS Initial Open Source Release
by June Tate-Gans (ジューン) 23 Aug '22

23 Aug '22

Hey guys! Sam and I have been hard at work at releasing our source code for the Project Sparrow work we've been working on for the last year or so, and we just managed to get our first release up at < https://github.com/AmbiML/sparrow-manifest>. So, we thought we'd announce it to the devel list! A bit of background: Sparrow is a project to build an open source low-power secure embedded platform for Ambient ML applications. Our target platform leverages RISC-V and OpenTitan, and all our contributions are licensed under the Apache-2 open source license. The Sparrow software includes a home-grown operating system named KataOS, that runs on top of seL4 and is written almost entirely in Rust. We’ve pushed some foundational pieces of KataOS to GitHub together with build glue to run seL4 CAmkES test applications on a 64-bit ARM platform (running in simulation on qemu). These are intended to show the direction we’re headed and enable anyone to start building their own systems in Rust on top of seL4. This initial tranche of code includes: frameworks (e.g. the sel4-sys crate that provides seL4 syscall apis), an alternate rootserver (needed for dynamic system-wide memory management), and the kernel modifications that enable reclaiming the memory used by the rootserver. This push does not, as yet, include the CAmkES services that support dynamic loading+running of applications–that will be published as we deem it ready for sharing until eventually all of Sparrow (software and hardware designs) will be available. While we are developing for an experimental 32-bit RISC-V platform, we intend to push code that runs on aarch64 platforms. Help is welcome to make the code base run on more platforms. In the long run, we're planning on opening up everything we can, so please watch this space! -- June Tate-Gans Software Engineer Techlead, Kata OS / AmbiML, Google

4 5

Reminder seL4 developer hangout
by Birgit Brecknell 22 Aug '22

22 Aug '22

Hi all A friendly reminder that the seL4 developer hangout is on again this week: Wed, Aug 24, 7am (UTC), Topics: (open) * Sydney: Wed, Aug 24, 5pm * Central Europe: Wed, Aug 24, 9am * US Pacific Time: Aug 24, 12 midnight Zoom link: https://unsw.zoom.us/j/82640784431 cheers Birg --- Dr. Birgit Brecknell Project Officer Trustworthy Systems, UNSW, birgit.brecknell(a)unsw.edu.au<mailto:birgit.brecknell@unsw.edu.au> seL4 Foundation, birgit(a)sel4.systems<mailto:birgit@sel4.systems> 0433 880 571 Mon 9am-5pm Wed 9am-12pm Fri 9am-5pm

1 0

Re: QubesOS+seL4
by Gernot Heiser 11 Aug '22

11 Aug '22

[ Redirecting this inquiry to the more appropriate ailing list] On 2 Aug 2022, at 05:55, ossgroup <ossgroup(a)protonmail.com<mailto:ossgroup@protonmail.com>> wrote: I'm interested in porting QubesOS to seL4. Is there already an initiative for this? If not, would you mind pointing me in the right direction to get started? People have been playing with this on-and-off, including a honours thesis here at UNSW years ago. The closest current activity I’m aware off is our Makatea project which, in collaboration with Swiss company Neutrality, has a (presently) more limited aim of isolating servers on a private cloud: https://trustworthy.systems/projects/TS/makatea A full Qubes port would be cool but a fair bit of work. I’d definitely like to see it done, and it’s clearly a more secure approach than having Xen (and therefore a whole Linux) in your trusted computing base. Gernot

3 2

Re: QubesOS+seL4
by Demi Marie Obenour 09 Aug '22

09 Aug '22

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 On Mon, Aug 08, 2022 at 03:24:51PM +0200, Hugo V.C. wrote: > You are absolutely rigth Demi. Anyway, I think the point here is not to > "switch" from Xen to seL4, which is an giant task, but to start > "something", some port of QubesOS, based on seL4. Obviously, it will lack > most features, bad hardware support, etc, but I guess that as soon there's > something that can be run, the community will slowly add effort to such > project. If you remember the first versions of Linux, desktop support was > horrible... But at some point there should be people starting new > challenging stuff. I don't think we can have a QubesOS based on seL4 at > short term, but if we start now, it can be a reality in few years. I can > smell lot of interest on it... - From a Qubes OS perspective, the approach I would prefer is to first get Qubes OS working on seL4, with the control plane running in a Linux VM as it does now. This is definitely less than optimal, but it is likely the quickest way to get Qubes on seL4 working at all, and therefore the solution that is the most likely to actually be finished. Over time, more and more of the code can be replaced by native seL4 components as those components become available. For instance, the firewall is currently based on Linux, but it is a stand-alone component that already has an alternative implementation based on MirageOS. Therefore, it would be an excellent candidate for replacement with a firewall running natively on seL4. - -- Sincerely, Demi Marie Obenour (she/her/hers) Invisible Things Lab -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEdodNnxM2uiJZBxxxsoi1X/+cIsEFAmLxkk0ACgkQsoi1X/+c IsH9Kg//U+FlcwVOtDXGfjJI2WCkRrLFbIC2Mvh6k1/m+f+aGtc7jvqj0xAFXxm3 JpvIYgil2LGGsdpC3dvyTH+7xqGQUVgzcYYyJDwbdRv0gBau1T+z3xkagYvOE1E8 94aEHLmvZV6GvXZ+6LdwZjkLgOQ0qnupOSkOJtmNW86tZdXC99u6cGhszejrCSG7 GzlWPaXfP7Niy16RA9QOf4nSusXvpetQwNhzTBvn1y2XrcnvitV9MNyhp23uyWMI 4VCMaA4tYbxyZdH0whQEpjrc75S2j/ewNuuiZ3VVnkOPxid0XG8UCsLGpWtoMIak /pO/JkZ25QuHAJv5ef4JpmDD5EO410vzrs70yswEb9Xcb6Fr+RnyCLmutAS1mpan zQs31KSXVOe0R5glO3p28wpkXLO80hjYrjVITnNknWv+uujHIGE1LiF8yRFaWMNa XpAUnKcTIBSqr/VkRwphBWRHkXMxKUBFbYBwV3WaUJ0fqOsGpUD4wLpLpE6N6Lb9 hRRfdM6raJ5LXNiSuheGKCh2Hxb5WejbQCH9vSCxd0Ew6j5NZf21YY84iykT47aR dO+o2XF04s4lfeBUhd8zMTSrKA6zIyAVdbtYfThT+ONXQd15YkkLWm0f7UJBCx4X kEsgYlCHXdJIQ9mkJZI4WIGRXO39sW+NCe3bs9w/YYwuVhmQKqg= =BkM1 -----END PGP SIGNATURE-----

2 4

Reminder seL4 developer hangout
by Birgit Brecknell 08 Aug '22

08 Aug '22

Hi all A friendly reminder that the seL4 developer hangout is on again this week: Tue Aug 9, 10pm (UTC), Topics: (open) * Sydney: Wed, Aug 10, 8am * Central Europe: Wed, Aug 10, 12 midnight * US Pacific Time: Tue, Aug 9, 3pm Zoom link: https://unsw.zoom.us/j/82640784431 cheers Birg --- Dr. Birgit Brecknell Project Officer Trustworthy Systems, UNSW, birgit.brecknell(a)unsw.edu.au<mailto:birgit.brecknell@unsw.edu.au> seL4 Foundation, birgit(a)sel4.systems<mailto:birgit@sel4.systems> 0433 880 571 Mon 9am-5pm Wed 9am-12pm Fri 9am-5pm

1 0

section type mismatch on aarch64
by Sam Leffler 03 Aug '22

03 Aug '22

I'm building for aarch64 and hitting: /usr/local/google/home/sleffler/camkes-aarch64-rootserver/kernel/include/arch/arm/arch/64/mode/kernel/vspace.h:55:36: error: ‘mode_reserved_region’ causes a section type conflict with ‘avail_p_regs’ 55 | static const region_t BOOT_RODATA *mode_reserved_region = NULL; ... /usr/local/google/home/sleffler/camkes-aarch64-rootserver/build/kernel/gen_headers/plat/machine/devices_gen.h:67:37: note: ‘avail_p_regs’ was declared here 67 | static const p_region_t BOOT_RODATA avail_p_regs[] = { Looking at the commit history I see this commit: https://github.com/seL4/seL4/commit/680ce96b590295c1d49db6a2a34f77ac22e8475a followed by this commit: https://github.com/seL4/seL4/commit/8a87015a7c289f8bc2b5799d61e7c91482ad1cb2 I'm using gcc 11.2 from arm's prebuilt toolchain repo: https://developer.arm.com/tools-and-software/open-source-software/developer… Removing the clang band-aid fixes things. My source tree is "tracking" upstream but not directly based off it. Have I missed a change that resolves this? Is the 11.2 release just not being used yet (assuming it's a change in gcc? -Sam

3 4

Thread Scheduling Domains
by June Tate-Gans (ジューン) 02 Aug '22

02 Aug '22

Hey folks, So Sam and I are at the point now where we're attempting to get our untrusted user threads running in a different scheduling domain, and it's not exactly clear how this is supposed to work in terms of enabling more than one domain in the kernel. So far, I've set KernelNumDomains to 2 in the easy-settings.cmake for our project, but unless I provide a separate implementation of kernel/config/default_domain.c by overriding KernelDomainSchedule, the resulting kernel will only think it has one domain and only ever schedule domain 0 for execution. Are we expected to override the default_domain.c file with our own in the project, like sel4test seems to do? Thanks! -- June Tate-Gans Software Engineer

2 5

Reminder seL4 developer hangout
by Birgit Brecknell 25 Jul '22

25 Jul '22

Hi all A friendly reminder that the seL4 developer hangout is on again next week: Wed, Jul 27, 7am (UTC), Topics: (open) * Sydney: Wed, Jul 27, 5pm * Central Europe: Wed, Jul 27, 9am * US Pacific Time: Wed, Jul 27, 12 midnight * Zoom link: https://unsw.zoom.us/j/82640784431 cheers Birg --- Dr. Birgit Brecknell Project Officer Trustworthy Systems, UNSW, birgit.brecknell(a)unsw.edu.au<mailto:birgit.brecknell@unsw.edu.au> seL4 Foundation, birgit(a)sel4.systems<mailto:birgit@sel4.systems> 0433 880 571 Mon 9am-5pm Wed 9am-12pm Fri 9am-5pm

1 1

Sydney get-together on seL4 Day?
by Gernot Heiser 20 Jul '22

20 Jul '22

This is only of interest for those physically in Sydney. We have seL4 Day coming up (29 July, the 13th anniversary of completion of the seL4 verification and 8th anniversary of its open-sourcing). It would be great to use the occasion to get together. The continuing abnormal (i.e. very wet) weather in Sydney makes planning such an event difficult (and I’ll be on leave and out of town until the evening of the 28th), so things may have to happen on short notice. But weather permitting, a BYO BBQ in Maroubra would be great, and I would really love to catch up with the rest of the Sydney-based seL4 community. So I suggest people interested save the date (and let us know if you’re interested). Gernot

1 0

suggestion; update faq reference to ODROID-C2
by Van Ly 18 Jul '22

18 Jul '22

Hello, The faq section on "How can I build a system with seL4?" [1] has an obsoleted/discountinued product pointing to ODROID-C2 [2] a current product such as the one from OnLogic can replace, perhaps. [3] ``` If you have access to an Odroid-C2, you should be able to do the project work yourself as a way of familiarising yourself with seL4. ``` [1] https://docs.sel4.systems/projects/sel4/frequently-asked-questions.html [2] https://www.hardkernel.com/shop/odroid-c2/ [3] https://www.onlogic.com/industrial-raspberry-pi/ -- vl

6 7

Systems with multiple PCI root complexes
by Peter Chubb 18 Jul '22

18 Jul '22

Has anyone extended the code in https://github.com/seL4/util_libs libpci to handle multiple root complexes? See bug https://github.com/seL4/util_libs/issues/131 I know genode added code to handle this, but they don't use that library. Peter C -- Dr Peter Chubb https://trustworthy.systems/ Trustworthy Systems Group CSE, UNSW

1 0

seL4 kernel memory footprint
by Sam Leffler 14 Jul '22

14 Jul '22

I'm trying to figure out the physical memory used by the kernel. This is for riscv if it matters. -Sam

4 13

sel4 smmuv2.0 on tx2 related questions
by Tao Heng 陶恒-SW 13 Jul '22

13 Jul '22

Hi sel4-devs, I have been trying to make some understandings of smmuv2.0 features provided by sel4. According to the vmm project for the tx2 platform, such as the vm_minimal apps, after all the compiling, there will be two caps,vm0_sid and vm0_cb,which is supposed to be used for stage2 address translation. My questions are as followed: 1. Which smmu device was the sid cap assigned to ? 2. How were these two caps created in the cdl file? There seems no special configuration for Cmakes that is related to the caps. 3. According to the tx2.dts, there are many sid numbers assigned to the smmu device. Why was there just one sid cap created by sel4? 邮件免责申明 Email Disclaimer 本邮件仅供本邮件指定收件人使用，其所载内容可能因含有保密信息或其它原因而不得披露。除本公司及本邮件指定收件人外，任何人不得公开、传播、分发、复制、印刷或使用本邮件之任何部分或其所载之任何内容。如您误收到本邮件，请立即通知本公司，并将原始邮件、附件及其所有复本从系统中删除，切勿使用。 This email is for the use of the designated receivers only，and the content is not allowed to be disclosed due to the confidential information or other reasons. Except for the Company and the designated receivers of this email, no one shall disclose, disseminate, distribute, copy, print or use any part of this email or any content contained therein. If you receive this email by mistake, please notify the Company immediately, and delete the original email, attachments and all copies from the system. Do not use it. 网络通信可能含有计算机病毒或其它缺陷，可能无法准确和/或及时送达其它系统，亦可能受阻而不为本公司或本邮件指定收件人所知。本公司对此类错误或遗漏以及任何因使用本邮件而引致之任何损失概不承担责任。 Network communication may contain computer viruses or other defects, which may not be delivered to other systems accurately and / or in time, or may be blocked by the Company or the designated receivers of this email. The Company shall not be liable for such errors or omissions and for any loss arising from this email. 本邮件所载任何内容仅作为业务层面交流与参考，除非明确说明，本公司不对邮件所载内容之准确性、完整性或公平性等承担任何法律责任。 Any contents contained in this email are only for the purpose of business communication and reference only. Unless explicitly stated otherwise, the Company shall not assume any legal responsibility for the accuracy, completeness or fairness of the content contained in the email. 本邮件指定收件人应特别注意：本邮件所载任何内容不构成本公司对本邮件指定收件人和/或其所属商业实体的任何要约、要约邀请或承诺，任何权利义务皆以双方签字盖章的书面文件为准。除经本公司以签字盖章的书面文件确认外，收件人和/或其所属商业实体不得以本邮件所载任何内容作为其向本公司主张任何权利或利益的正式依据。 The designated receivers should pay special attention to the fact that nothing contained in this email shall constitute an offer, invitation or acceptance by the Company to the designated receivers of this email and/or its affiliated business entities, and any rights and obligations are subject to the written documents signed and sealed by both parties. Except from the written document signed ,sealed and confirmed by the Company, the receivers and / or its affiliated business entity shall not rely on anything contained in this email as the formal basis for claiming any rights or interests to the Company.

2 2

Anyone using capability transfer in an seL4 project? Looking for examples for research
by sjwebb＠student.unimelb.edu.au 12 Jul '22

12 Jul '22

Hi all, I'm working on a Masters research project looking into mapping an object-capability programming language onto seL4, in a way that includes some kind of mapping from the language object capabilities onto seL4's capabilities (or vice versa). I'm at a stage of the project now where it would be really helpful to have some 'motivating examples' for transferring caps between threads/CSpaces. So I was hoping I could reach out to other seL4 developers to see if they had built any systems that made extensive use of moving capabilities around. Ideally, in an ocap language, these examples would be much easier to program than they currently would be in C... The simplest example I can think of is a memory allocation server, but that wouldn't necessarily involve handing caps on beyond the one (requesting) process, which is the kind of thing I think more interesting examples would comprise of. Cheers, Stewart Webb [Masters Research student at University of Melbourne]

2 2

Re: Running RISC-V seL4 in QEMU 7.0.50
by Ahmed Charles 12 Jul '22

12 Jul '22

I'm having similar issues getting seL4test to work on riscv32/64 on QEMU 6.0.0 and 7.0.0. I tried debugging with a connected gdb, but I'm new at this and setting breakpoints in user mode seems to fail, so I'm not sure what happens once the root task starts, other than it eventually runs an infinite loop (0: j 0b, specifically). Any ideas? Thanks.

5 7

How to boot sel4 with a VGA output
by Cong Guo 12 Jul '22

12 Jul '22

Hi, I am new to sel4. I find how to run sel4test on an x86_64 machine, but with only serial output. How can I run sel4test or another sel4 system image using a normal VGA output? Thank you.

2 1

Reminder seL4 developer hangout
by Birgit Brecknell 11 Jul '22

11 Jul '22

Hi all A friendly reminder that the seL4 developer hangout is on again next week: Tue, Jul 12, 10pm (UTC), Topics: (open) * Sydney: Wed, Jul 13, 8am * Central Europe: Wed, Jul 13, midnight * US Pacific Time: Tue, Jul 12, 3pm Zoom link: https://unsw.zoom.us/j/82640784431 cheers Birg --- Dr. Birgit Brecknell Project Officer Trustworthy Systems, UNSW, birgit.brecknell(a)unsw.edu.au<mailto:birgit.brecknell@unsw.edu.au> seL4 Foundation, birgit(a)sel4.systems<mailto:birgit@sel4.systems> 0433 880 571 Mon 9am-5pm Wed 9am-12pm Fri 9am-5pm

1 0

How to Get Input Via Keyboard -SeL4
by Sriram 07 Jul '22

07 Jul '22

Im new to SeL4 and figuring out how to get input from a keyboard and print it as of now What api calls do I use and How to do it Thanks and Regards R.Sriram

2 1

CAmkES components for security auditing.
by Comet 06 Jul '22

06 Jul '22

Hi, Is there an existing CAmkES component that can persistently store seL4 logs for security auditing? So that I can audit data in real time. Comet

1 0

Re: seL4 on TX1
by Yiliang Wan 03 Jul '22

03 Jul '22

Hi! I encountered similar problem on TX1. I tried to boot via DFU, and get exactly the same output as @yjy from time to time. The artifacts in https://github.com/seL4/seL4/actions/runs/1715169793#artifacts are already expired. Could you please provide the latest available sel4test pre-build image for TX1. The original link for the post is： https://103.230.158.80/hyperkitty/list/devel@sel4.systems/message/P3Q5SDSPE… Thank you!

2 2

Camkes Cross VM Tutorial
by Sriram 30 Jun '22

30 Jun '22

Greetings, I have been trying to build Camkes Cross VM tutorial but it fails at the end, similarily when we boot Camkes VM Linux, We were not able to input anything from the keyboard and the Serial Output is as follows """ Starting network[ 0.810972] ip (679) used greatest stack depth: 6732 bytes left : OK Failed to locate device consumes_event. Failed to locate device emits_event. Welcome to Buildroot buildroot login: [ 1.431752] clocksource: tsc: mask: 0xffffffffffffffff max_cycles: 0x31015f85297, max_idle_ns: 440795334135 ns [ 1.442241] clocksource: Switched to clocksource tsc [ 2.811817] random: fast init done [ 134.023597] random: crng init done """" Is there any changes to be made in the source files or any other modifications And are there any pre-built images for x86_64 for easier implementation Keenly Awaiting for your Reply Thanks and Regards R.Sriram

1 0

Some questions about porting seL4 to CHERI(Morello)
by Sid Agrawal 29 Jun '22

29 Jun '22

Hi sel4-devs, As I had mentioned in the last developer call, I am porting seL4 to morello architecture. To be exact, I plan to run a hybrid kernel with hybrid userspace. The hybrid mode essentially means that you define CHERI capability pointers explicitly, but if not stated, everything is just a standard 64bit pointer. Based on browsing the code, I have jotted down the following list of items I need to change. 1,2 are just observations, and 3 is where I need some input. 1. Change the type of "registers" field in TCB in the kernel to store 128 bits instead of 64 bits per reg. This ties into the kernel_enter and restore_user_context code. It ensures that if a user app explicitly uses CHERI capabilities, it is not lost on a context switch.[1,2] - Done. 2. Change the syscall and IPC APIs to allow for passing CHERI caps. CHERIcaps are just 128 bits, so we should be able to pass them as arguments in IPC. The use case I have in mind is as follows - Imagine a mmap server. This server would return a VA to the caller, which in the CHERI world would be a CHERI capability. This mmap-server would allocate the memory and map it into the callee's virtual address space. Do you think this is a valid use case? 3. Update seL4_UserContext code to read and write newer regs from the user space. The seL4_UserContext struct will need to be updated to accommodate the new register DDC(default data capability reg). It will also need to be updated to accommodate 128 bit regs instead of 64 bits. This is where I ran into an issue - an assert statement in the build directory checks the size of the seL4_UserContext structure. Looks like it gets its info from the sel4arch.xml file[4]. I am not sure how to change XML processing to have it generate the correct size value for that struct. I have not created ifdef guard for morello yet, as this is just a hacky pass to get it working. My diff so far is available at [3] if anyone wants to take a look. Any help and suggestions on the approach would be greatly appreciated. Thanks, Sid [1] https://gitlab.com/arm-research/security/icecap/seL4/-/blob/morello/include… [2] https://gitlab.com/arm-research/security/icecap/seL4/-/blob/morello/include… [3] https://gitlab.com/arm-research/security/icecap/seL4/-/compare/pre-morello-… [4] https://gitlab.com/arm-research/security/icecap/seL4/-/blob/morello/libsel4…

1 0

SMP documents
by 603644559＠qq.com 23 Jun '22

23 Jun '22

I mainly want to know how threads is scheduled in SMP configuration. Is there any documents or manuals on SMP configuration?

2 1

Details on involvement of Data61/Trustworthy Systems with DARPA, esp. regarding UAVs?
by Isaac Beckett 23 Jun '22

23 Jun '22

Hello, in your answer about camkes VMs, you mentioned a collaboration with DARPA on their SMACCM/HACMS project. While seL4 is undoubtedly a good choice for mixed criticality systems like avionics on a UAV, I’m somewhat frustrated to hear y’all had done a contract for DARPA considering what they *use* those drones to do. Is there somewhere I can read more in detail about this and other military-adjacent contracts?

2 1

SeL4 Tutorial - Camkes CrossVM
by Sriram 22 Jun '22

22 Jun '22

Greetings, We have followed step by step and tried the CAMKES Linux VM tutorial, We have build it successfully but while booting via USB flash drive The Serial Output Stops after root Login and doesn't take any input SERIAL OUTPUT """ Starting network[ 0.810972] ip (679) used greatest stack depth: 6732 bytes left : OK Failed to locate device consumes_event. Failed to locate device emits_event. Welcome to Buildroot buildroot login: [ 1.431752] clocksource: tsc: mask: 0xffffffffffffffff max_cycles: 0x31015f85297, max_idle_ns: 440795334135 ns [ 1.442241] clocksource: Switched to clocksource tsc [ 2.811817] random: fast init done [ 134.023597] random: crng init done """" This is the serial output we got Is there any modifications of the source code required to make it work if so kindly provide the necessary details. Thanks and Regards R.Sriram

1 0

How can I ensure the security of a system developed by Camkes?
by Comet 22 Jun '22

22 Jun '22

Hi, I am using Camkes to develop VM virtualization, but I have a question that is how can I ensure isolation security between virtual machines? If a virus with a Trojan is installed on the VMM, will the virtual machines attack each other? and will the kernel be corrupted ? I didn't find some security instructions about the system developed by Camkes, or the implementation principle of Camkes, that is, how is resource mapping between seL4 and Camkes? Are there any related articles? Thanks, Comet959

2 1

SeL4 Source Code Documentation
by Sriram 20 Jun '22

20 Jun '22

Greetings, We are trying to understand the SeL4 Source Code, is there any documentation available that explains the source code and libraries Thanks and Regards R.Sriram

2 2

Re: SeL4 Source Code Documentation
by Isaac Beckett 20 Jun '22

20 Jun '22

Are those Haskell sources used to generate the C code, or are they an older version of the spec, or something? This is my first time hearing of them, so not sure what they’re used for.

3 2

Page fault on starting VM
by WILLIAMS Stephen 16 Jun '22

16 Jun '22

We’re currently working on formalising VM support for an iMX8 platform (the Avnet MaaXBoard) building upon the existing sylvain/imx8 and sylvain/gicv3 branches. However on start of the VM we’re seeing the following page fault: >>>>>> Booting all finished, dropped to user space .[0m.[30;1m<<.[0m.[32mseL4(CPU 0).[0m.[30;1m [decodeUntypedInvocation/205 T0x80bf81c400 "rootserver" @4006f8]: Untyped Retype: Insufficient memory (1 * 2097152 bytes needed, 0 bytes available).>>.[0m Install gic v3 Loading Linux: 'linux' dtb: 'linux-dtb' install_linux_devices(a)main.c<mailto:install_linux_devices@main.c>:652 module name: map_frame_hack install_linux_devices(a)main.c<mailto:install_linux_devices@main.c>:652 module name: init_ram libsel4muslcsys: Error attempting syscall 215 libsel4muslcsys: Error attempting syscall 215 libsel4muslcsys: Error attempting syscall 215 Waiting recv Ok -------- .[31;1mPagefault from [Linux]: read prefetch fault @ PC: 0x200 IPA: 0x200, FSR: 0x82000005 Context: x0: 0xb2000000 x1: 0x0 x2: 0xff058169ac x3: 0x3ec6 x4: 0x5527eb8 x5: 0x80000 x6: 0x58169c0 x7: 0x45dad8 x8: 0x5816a00 x9: 0x8c3a000038000000 x10: 0x1100000028000000 x11: 0x10000000 x12: 0x543a00003a040000 pc: 0x200 x14: 0x0 sp: 0x480a58 spsr: 0x3c5 x13: 0x0 x15: 0x1000000 x16: 0xb2000000 x17: 0x480a58 x18: 0x5816bd0 x19: 0x664616f6c x20: 0xb2000000 x21: 0xb0080000 x22: 0x5816a10 x23: 0x405524 x24: 0x5816ab0 x25: 0x5816a40 x26: 0x0 x27: 0xb2000000 x28: 0x480a58 x29: 0x480a50 x30: 0xc63e0000edfe0dd0 .[3.[0mm-------- main_continued(a)main.c<mailto:main_continued@main.c>:1134 Failed to run VM <<<<<< From existing reports it is my understanding that the “insufficient memory” and the “error attempting sys call 215” errors are to be expected and are not a concern; please correct me if that is not the case! Any suggestions as to the possible cause of the page fault or hints on how to progress with debugging this issue would be greatly appreciated. Thanks for your help, Stephen This message contains information that may be privileged or confidential and is the property of the Capgemini Group. It is intended only for the person to whom it is addressed. If you are not the intended recipient, you are not authorized to read, print, retain, copy, disseminate, distribute, or use this message or any part thereof. If you receive this message in error, please notify the sender immediately and delete all copies of this message.

3 5

seL4 gdb + renode support
by Sam Leffler 16 Jun '22

16 Jun '22

As I mentioned on yesterday's zoom call Antmicro has released support for debugging seL4 applications (esp CAmkES). https://antmicro.com/blog/2022/06/sel4-userspace-debugging-with-gdb-extensi… I've used it extensively and find it very useful. -Sam

2 1

Invitation: Reminder seL4 developer hangout @ Tue Jun 14, 2022 3pm - 4pm (PDT) (devel@sel4.systems)
by agrawal.sidhartha＠gmail.com 15 Jun '22

15 Jun '22

You have been invited to the following event. Title: [seL4] Reminder seL4 developer hangout - rump kernel - arm assembly question. When: Tue Jun 14, 2022 3pm – 4pm Pacific Time - Vancouver Where: https://unsw.zoom.us/j/82640784431 Calendar: devel(a)sel4.systems Who: * agrawal.sidhartha(a)gmail.com - organizer * birgit.brecknell(a)unsw.edu.au * devel(a)sel4.systems Event details: https://calendar.google.com/calendar/event?action=VIEW&eid=NWozdWplbDZwZmk3… Invitation from Google Calendar: https://calendar.google.com/calendar/ You are receiving this courtesy email at the account devel(a)sel4.systems because you are an attendee of this event. To stop receiving future updates for this event, decline this event. Alternatively you can sign up for a Google account at https://calendar.google.com/calendar/ and control your notification settings for your entire calendar. Forwarding this invitation could allow any recipient to send a response to the organizer and be added to the guest list, or invite others regardless of their own invitation status, or to modify your RSVP. Learn more at https://support.google.com/calendar/answer/37135#forwarding

3 2

Question about rumpkernel on seL4
by Sid Agrawal 15 Jun '22

15 Jun '22

Hello sel4-devs, I came across the rumprun-sel4-demo apps [1] repo. There seems to be some bitrot as the kernel version keeps moving forward, But after moving the kernel back to 12.0 and some cmake fixes, I could get many apps(LevelDB, Redis, Memcached) to compile. Though "hello" ran fine, the few others I tried failed with various errors in the simulate step(such as page faults and invalid syscall number). I plan to debug these at some point, but I had a few questions about the setup before that. 1. Is this repo considered abandoned? 2. Is the rumpkernel+app running as a Virtual Machine or as a user process in this setup? Phrased differently, is seL4 acting like an OS or a Hypervisor? 3. Is there a known effort to run another libOS on seL4, such as Unikraft? The current mental model I have for running real apps on seL4 is something like this diagram below: 3. App+LibOS(Redis + rump) ------------------------------------- 2. RootTask + other services* ------------------------------------- 1. sel4 ===================== 0. Hardware Most of my contributions would be in layer-2, i.e. (rootTask + other services). I would then want to expose these new functionalities to the libc inside layer 3. The kernel itself should be mostly untouched. Thanks, Sid [1] https://github.com/seL4/rumprun-sel4-demoapps

2 2

Query about the aarch64 Context Switch Code
by Sid Agrawal 15 Jun '22

15 Jun '22

Hi, I had a few questions about the context switch code in seL4 for aarch64. I spent a couple of days trying to make sense of it, so I thought it would be better to ask as I might be missing something that is not obvious. It looks like kernel_enter in traps.S [1] saves the user process's register immediately after an exception. And restore_user_context() in c_traps.c [2] is restoring them. Looks like the regs are stored in the TCB in the "tcbContext.registers" array. The restore code makes sense to me. It puts the ptr value of "(NODE_STATE(ksCurThread)->tcbArch.tcbContext.registers" in to the sp and starts loading the regs from there. However, the code in kernel_enter is a bit unclear to me. 1. What is the value of sp when executing the kernel_enter macro? Is that the SP_EL1, or somewhere else the sp was set to the address of the faulting thread's "tcbContext.registers". On reading the arm32's arm_swi_syscall [3] function, it looks like it is the latter, but I am unsure how that is being accomplished. It might be more to do with aarch64 than seL4. 2 Furthermore, when not specified, does sp mean SP_EL1 in EL1 and SP_EL0 in EL0, Or does lower case "sp" have a special meaning? I know that seL4 is configured to use SP_ELx at ELx based on value of SPEL in [4] 3 Lastly, what is lsp_i trying to do? Are we switching the value of sp from something else to the real kernel stack by storing the kernel's stack address in tpidr_el1? Thanks a lot, as always! Sid [1] https://github.com/seL4/seL4/blob/master/src/arch/arm/64/traps.S#L72 [2] https://github.com/seL4/seL4/blob/master/src/arch/arm/64/c_traps.c#L29 [3] https://github.com/seL4/seL4/blob/master/src/arch/arm/32/traps.S#L51 [4] https://github.com/seL4/seL4/blob/master/src/arch/arm/64/head.S#L78

1 1

SeL4: Cannot Input after booting VM Linux (x86_64)
by Sriram 15 Jun '22

15 Jun '22

Greetings, We built hello world program and recieved exact output as given in the tutorial while booting. Then we built the seL4 CamKes VM Linux and Optiplex 9020 for x86_64 platform and got the following results while booting through usb using syslinux commands "" Welcome to Buildroot buildroot login: [ 1.431752] clocksource: tsc: mask: 0xffffffffffffffff max_cycles: 0x31015f85297, max_idle_ns: 440795334135 ns [ 1.442241] clocksource: Switched to clocksource tsc [ 2.811817] random: fast init done [ 134.023597] random: crng init done "" After this we are not able to type anything (username and password to login ) We have both VTd and VTx enabled, What changes or approach should be done to solve this. Thanks and Regards R.Sriram

3 3

Canceled event: Reminder seL4 developer hangout @ Tue Jun 14, 2022 3pm - 4pm (PDT) (devel@sel4.systems)
by agrawal.sidhartha＠gmail.com 14 Jun '22

14 Jun '22

This event has been canceled. Title: [seL4] Reminder seL4 developer hangout - rump kernel - arm assembly question. When: Tue Jun 14, 2022 3pm – 4pm Pacific Time - Vancouver Where: https://unsw.zoom.us/j/82640784431 Calendar: devel(a)sel4.systems Who: * agrawal.sidhartha(a)gmail.com - organizer Invitation from Google Calendar: https://calendar.google.com/calendar/ You are receiving this courtesy email at the account devel(a)sel4.systems because you are an attendee of this event. To stop receiving future updates for this event, decline this event. Alternatively you can sign up for a Google account at https://calendar.google.com/calendar/ and control your notification settings for your entire calendar. Forwarding this invitation could allow any recipient to send a response to the organizer and be added to the guest list, or invite others regardless of their own invitation status, or to modify your RSVP. Learn more at https://support.google.com/calendar/answer/37135#forwarding

1 0

Reminder seL4 developer hangout
by Birgit Brecknell 10 Jun '22

10 Jun '22

Hi all A friendly reminder that the seL4 developer hangout is on again next week: Tue, Jun 14, 10pm (UTC), Topics: (open) * Sydney: Wed, Jun 15, 8am * Central Europe: Wed, Jun 15, midnight * US Pacific Time: Tue, Jun 14, 3pm Zoom link: https://unsw.zoom.us/j/82640784431 cheers Birg --- Dr. Birgit Brecknell Project Officer Trustworthy Systems, UNSW, birgit.brecknell(a)unsw.edu.au<mailto:birgit.brecknell@unsw.edu.au> seL4 Foundation, birgit(a)sel4.systems<mailto:birgit@sel4.systems> 0433 880 571 Mon 9am-5pm Wed 9am-12pm Fri 9am-5pm

1 0

sel4 on bare-metal | Questions and comments
by Sid Agrawal 10 Jun '22

10 Jun '22

Hi, As per instructions from here[1, 2], I tried booting seL4 on an x86_64-desktop, x86_64-server as RPi4. I was able to get it to work on RPi4 with one minor change to the instructions, but I could not boot it on the x86_64-desktop or the x86_64-server. Below is my experience and the issues I faced. RPi4 ------ Spec: 8GB standard Rpi4 The final command "fatload mmc 0 0x10000000 sel4test-driver-image-arm-bcm2711" gave the following error: ** Reading file would overwrite reserved memory ** Failed to load 'sel4test-driver-image-arm-bcm2711 I could get around it by using a load address that was smaller by a factor of 0x10.( 0x1000000 instead of 0x10000000 i.e. one less zero). I cannot claim I understand why the first address failed and the second worked. Any pointers on that would help. After the change in the address, I saw the sel4 tests run as expected. x86_64 server ------------------ Spec: Dell R520, two quad-core Xeons (E5-2407 v2 @ 2.40GHz), 32GB of memory. The server's serial is redirected to the IPMI console. On the IPMI console, I see many messages related to the bios, etc. And finally, I see this: MBR SYSLINUX 6.04 EDD [...] Loading sel4kernel... ok Loading rootserver... ok But nothing after this. Any thoughts of what could be going wrong here? I did not see any sel4 prints. x86_64 Desktop ---------------------- Spec: Core 2 Quad, 4 GB ram It was able to find the pinout for the serial port on the motherboard and connected to it(just like for RP). There was no output on the serial console. Even when bios-related messages were printed on the monitor, there was no output on the serial pins. I might need to enable the serial output on those pins in the bios or something similar. Fortunately, even though the serial pins did not have any output, the monitor output was the same as for the server. Unfortunately, it did not get any farther along than the server. MBR SYSLINUX 6.04 EDD [...] Loading sel4kernel... ok Loading rootserver... ok Any pointers here would be helpful. Thanks, Sid UBC Graduate Student ARM Research Intern [1] https://docs.sel4.systems/Hardware/IA32 [2] https://docs.sel4.systems/Hardware/Rpi4.html

2 5

Implementation of SeL4
by Sriram 10 Jun '22

10 Jun '22

Greetings This is Sriram Prakash, currently working on a project on secure system applications for avioics and found the concept and key use case of seL4 microkernel aligned to our main application : creating a secure OS on bareboard application We are facing certain issues as follows: - Booting via flashdrive, Output on Screen shows "Loading sel4 OK","Loading rootserver OK" and no other output in display, we recieved junk values using serial port Output. - We have put up a query on sel4Discourse : https://sel4.discourse.group/t/sel4-vm-linux-boot-in-x86-64-platform-pc/527, about the issues we are facing. - How to receive output in Display - Booting Linux VM on top of seL4 Any insights regarding the issues would be grateful, thank you for your time Regards R.Sriram Prakash

3 2

Running RISC-V seL4 in QEMU 7.0.50
by porter.188＠osu.edu 03 Jun '22

03 Jun '22

Hello, I'm trying to run sel4test in QEMU 7.0.50. I can compile successfully but sel4test hangs at "Jumping to kernel-image entry point...". Is there something different required now that sel4 is using OpenSBI? $ qemu-system-riscv64 -nographic -serial mon:stdio -m size=4095M -bios none -kernel images/sel4test-driver-image-riscv-spike OpenSBI v0.8 ____ _____ ____ _____ / __ \ / ____| _ \_ _| | | | |_ __ ___ _ __ | (___ | |_) || | | | | | '_ \ / _ \ '_ \ \___ \| _ < | | | |__| | |_) | __/ | | |____) | |_) || |_ \____/| .__/ \___|_| |_|_____/|____/_____| | | |_| Platform Name : ucbbar,spike-bare,qemu Platform Features : timer,mfdeleg Platform HART Count : 1 Boot HART ID : 0 Boot HART ISA : rv64imafdcsuh BOOT HART Features : pmp,scounteren,mcounteren BOOT HART PMP Count : 16 Firmware Base : 0x80000000 Firmware Size : 96 KB Runtime SBI Version : 0.2 MIDELEG : 0x0000000000001666 MEDELEG : 0x0000000000f0b509 PMP0 : 0x0000000080000000-0x000000008001ffff (A) PMP1 : 0x0000000000000000-0xffffffffffffffff (A,R,W,X) ELF-loader started on (HART 0) (NODES 1) paddr=[80200000..8066a037] Looking for DTB in CPIO archive...found at 802d2128. Loaded DTB from 802d2128. paddr=[84020000..84020fff] ELF-loading image 'kernel' to 84000000 paddr=[84000000..8401ffff] vaddr=[ffffffff84000000..ffffffff8401ffff] virt_entry=ffffffff84000000 ELF-loading image 'sel4test-driver' to 84021000 paddr=[84021000..843f6fff] vaddr=[10000..3e5fff] virt_entry=1b982 Enabling MMU and paging Jumping to kernel-image entry point...

3 4

UNSW tenure-track position
by Gernot Heiser 01 Jun '22

01 Jun '22

Any recent or soon PhD graduates whose work is around seL4? If os you might be interested in the operating system faculty position we have open at UNSW: https://external-careers.jobs.unsw.edu.au/cw/en/job/502766/lecturersenior-l… Gernot

1 0

Re: Reminder seL4 developer hangout
by Isaac Beckett 31 May '22

31 May '22

Oh boy, 3AM! I hope to make it, but if I sound tired, that’s why. > Date: Mon, 30 May 2022 00:08:16 +0000 > From: Birgit Brecknell <birgit.brecknell(a)unsw.edu.au> > Subject: [seL4] Reminder seL4 developer hangout > To: "devel(a)sel4.systems" <devel(a)sel4.systems> > Message-ID: <MEAPR01MB44693624005ED9CB8CFDD3A7DEDD9(a)MEAPR01MB4469.aus > prd01.prod.outlook.com> > Content-Type: text/plain; charset="iso-8859-1" > > Hi all > > A friendly reminder that the seL4 developer hangout is on again this week: > > Wed, Jun 1, 7am (UTC), Topics: (open) > > * Sydney: Wed, Jun 1, 5pm > * Central Europe: Wed, Jun 1, 9am > * US Pacific Time: Wed, Jun 1, 12 midnight > > Zoom link: https://unsw.zoom.us/j/82640784431 > > cheers > Birg > > > > --- > > Dr. Birgit Brecknell > > Project Officer > > Trustworthy Systems, UNSW, birgit.brecknell(a)unsw.edu.au<mailto:birgit.brecknell@unsw.edu.au> > > seL4 Foundation, birgit(a)sel4.systems<mailto:birgit@sel4.systems> > > 0433 880 571 > > > > Mon 9am-5pm > > Wed 9am-12pm > > Fri 9am-5pm

2 1

Reminder seL4 developer hangout
by Birgit Brecknell 30 May '22

30 May '22

Hi all A friendly reminder that the seL4 developer hangout is on again this week: Wed, Jun 1, 7am (UTC), Topics: (open) * Sydney: Wed, Jun 1, 5pm * Central Europe: Wed, Jun 1, 9am * US Pacific Time: Wed, Jun 1, 12 midnight Zoom link: https://unsw.zoom.us/j/82640784431 cheers Birg --- Dr. Birgit Brecknell Project Officer Trustworthy Systems, UNSW, birgit.brecknell(a)unsw.edu.au<mailto:birgit.brecknell@unsw.edu.au> seL4 Foundation, birgit(a)sel4.systems<mailto:birgit@sel4.systems> 0433 880 571 Mon 9am-5pm Wed 9am-12pm Fri 9am-5pm

1 0

Running RISC-V seL4 in QEMU 7.0.50
by porter.188＠osu.edu 28 May '22

28 May '22

Hello, I am trying to run a simple hello world project in seL4 RISC-V in QEMU. It seems to hang at "Jumping to kernel-image entry point..." This same behavior happens on sel4test as well. In the past this was due to a bios option in QEMU changing. Is there something else going on here? I know seL4 uses OpenSBI instead of BBL for RISC-V but is there something else in QEMU or some other switch we need to add? The commands I run are: $ qemu-system-riscv64 -machine spike -cpu rv64 -nographic -serial mon:stdio -m size=4095M -bios none -kernel images/sel4test-driver-image-riscv-spike OpenSBI v0.8 ____ _____ ____ _____ / __ \ / ____| _ \_ _| | | | |_ __ ___ _ __ | (___ | |_) || | | | | | '_ \ / _ \ '_ \ \___ \| _ < | | | |__| | |_) | __/ | | |____) | |_) || |_ \____/| .__/ \___|_| |_|_____/|____/_____| | | |_| Platform Name : ucbbar,spike-bare,qemu Platform Features : timer,mfdeleg Platform HART Count : 1 Boot HART ID : 0 Boot HART ISA : rv64imafdcsuh BOOT HART Features : pmp,scounteren,mcounteren BOOT HART PMP Count : 16 Firmware Base : 0x80000000 Firmware Size : 96 KB Runtime SBI Version : 0.2 MIDELEG : 0x0000000000001666 MEDELEG : 0x0000000000f0b509 PMP0 : 0x0000000080000000-0x000000008001ffff (A) PMP1 : 0x0000000000000000-0xffffffffffffffff (A,R,W,X) ELF-loader started on (HART 0) (NODES 1) paddr=[80200000..8066a037] Looking for DTB in CPIO archive...found at 802d2128. Loaded DTB from 802d2128. paddr=[84020000..84020fff] ELF-loading image 'kernel' to 84000000 paddr=[84000000..8401ffff] vaddr=[ffffffff84000000..ffffffff8401ffff] virt_entry=ffffffff84000000 ELF-loading image 'sel4test-driver' to 84021000 paddr=[84021000..843f6fff] vaddr=[10000..3e5fff] virt_entry=1b982 Enabling MMU and paging Jumping to kernel-image entry point...

1 0

Getting Badge Value of a badged EP capability
by Sid Agrawal 22 May '22

22 May '22

Hi seL4-devs and users, I have a question about implementing server and client using badged endpoints. Below I have laid out the scenario, the issue, and some questions. *Scenario* I have a userspace server that implements the functionality for an object(say type obj_T1). The server hands out badged-endpoints to clients to interact with this object. The badge is the virtual address of the object's struct in the server’s virtual address space. A client can interact with the object by sending messages on this badged endpoint. The client never learns the badge value. The kernel extracts the badged value when the server receives a message on this endpoint. By using the badge value, the server knows which object the client is trying to manipulate. The same PD, which implements the 1st server, also implements another server(in a separate thread, but same address space) for another object type (say type obj_T2). The server follows the same paradigm of handing out badged endpoints and using the badges values to keep track of the object. *Issue* I have a scenario where the client wants to invoke the functionality of obj_T1. This functionality needs access to obj_T2 as well. The client has badged EP caps to both objects. The client can invoke the badged EP handed out by server-1 for obj_T1 and give the badged EP of obj_T2 as an extraCap in the IPC message(or vice versa). Since the server has no way to look up the badge of the second cap, it cannot look up the underlying object for obj_T2. So my questions are: 1. Is there a way for a PD to look up the badge value of badged EP? I think the answer is no, but I thought I would still ask. 2. Is my idea of using the badge to keep track of the underlying object on the right track? Is there a better way of going about doing it? 3. As a potential solution, I can extend my server to add a new function, say GETID, which returns the badge value of a given object(i.e., EP). Since I know that the server always badges the EP with the virtual address of the struct, it is a trivial call to implement. But I somehow feel like this is not a neat idea, not quite sure why. Thanks for the help, everyone! Sid CS Graduate Student @ UBC sid-agrawal.ca

3 7

Untyped tutorial on RISC-V
by inf19109＠lehre.dhbw-stuttgart.de 18 May '22

18 May '22

Dear seL4 devs and community, I'm trying to do the seL4-tutorials on a RISC-V architecture. Now I'm stuck on the untyped tutorial. I tried to run the solution of the tutorial but I get the following error: <<seL4(CPU 0) [decodeUntypedInvocation/128 T0xffffffc17fee7200 "rootserver" @103fc]: Untyped Retype: Destination cap invalid or read-only.>> main@main.c:48 [Cond failed: error != seL4_NoError] Failed to retype seL4 root server abort()ed Debug halt syscall from user thread 0xffffffc17fee7200 "rootserver" halting... I'm calling the function as follows: seL4_Untyped_Retype(parent_untyped, seL4_UntypedObject, // type untyped_size_bits, //size seL4_CapInitThreadCNode, // root 0, // node_index 0, // node_depth child_untyped, // node_offset 1 // num_caps ); parent_untyped = info->untyped.start + i (where i is incremented until (info->untypedList[i].sizeBits >= untyped_size_bits && !info->untypedList[i].isDevice) untyped_size_bits = seL4_TCBBits+1 child_untyped = info->empty.start It seams as if the function is not allowed for RISC-V. I don't know where the problem lies and I would appreciate any help or ideas. Best regards Miriam

2 3

Reminder seL4 developer hangout
by Birgit Brecknell 16 May '22

16 May '22

Hi all A friendly reminder that the seL4 developer hangout is on again this week: Tue, May 17, 10pm (UTC), Topics: (open) * Sydney: Wed, May 18, 8am * Central Europe: Wed, May 18, 12 midnight * US Pacific Time: Tue, May 17, 3pm Zoom link: https://unsw.zoom.us/j/82640784431 cheers Birg --- Dr. Birgit Brecknell Project Officer Trustworthy Systems, UNSW, birgit.brecknell(a)unsw.edu.au<mailto:birgit.brecknell@unsw.edu.au> seL4 Foundation, birgit(a)sel4.systems<mailto:birgit@sel4.systems> 0433 880 571 Mon 9am-5pm Wed 9am-12pm Fri 9am-5pm

1 0

VPPI IRQ 27 dropped on vcpu 3
by Han JingLong 韩景龙 11 May '22

11 May '22

Dear seL4 devs and community, I had made VMM work well on my platform(armv8, six A55 cpus, RAM is 8G) based on vm_multi with Linux Guest OS(vm0.num_vcpus = 4;) and Android Guest OS(vm1.num_vcpus = 6;). But I meet an error(vm_vppi_event_handler@vm.c:97 VPPI IRQ 27 dropped on vcpu 3) when I enable SMP support with -DNUM_NODES=6. Actually, VPPI IRQ 27 dropped on some vcpu number is not fixed, maybe 1 or 2 or 3. Once this error appears, it will brush the screen crazily, the recurrence rate is about 10%. 1.Some logs are added for debugging this issue: --- a/seL4_projects_libs/libsel4vmmplatsupport/src/arch/arm/psci.c +++ b/seL4_projects_libs/libsel4vmmplatsupport/src/arch/arm/psci.c @@ -53,18 +53,24 @@ int handle_psci(vm_vcpu_t *vcpu, seL4_Word fn_number, bool convention) uintptr_t target_cpu = smc_get_arg(&regs, 1); uintptr_t entry_point_address = smc_get_arg(&regs, 2); uintptr_t context_id = smc_get_arg(&regs, 3); + printf("[hjl] handle_psci target_cpu:%d\n", target_cpu); vm_vcpu_t *target_vcpu = vm_vcpu_for_target_cpu(vcpu->vm, target_cpu); if (target_vcpu == NULL) { target_vcpu = vm_find_free_unassigned_vcpu(vcpu->vm); if (target_vcpu && start_new_vcpu(target_vcpu, entry_point_address, context_id, target_cpu) == 0) { + printf("[hjl] handle_psci vm:%p vcpu_id:%d on success\n", vcpu->vm, target_vcpu->vcpu_id); smc_set_return_value(&regs, PSCI_SUCCESS); } else { + printf("[hjl] handle_psci vm:%p vcpu_id:%d on failure\n", vcpu->vm, target_vcpu->vcpu_id); smc_set_return_value(&regs, PSCI_INTERNAL_FAILURE); } } else { if (is_vcpu_online(target_vcpu)) { + printf("[hjl] handle_psci vm:%p target_cpu is online\n", vcpu->vm); smc_set_return_value(&regs, PSCI_ALREADY_ON); } else { + printf("[hjl] handle_psci vm:%p target_cpu is not online\n", vcpu->vm); smc_set_return_value(&regs, PSCI_INTERNAL_FAILURE); } } --- a/seL4_projects_libs/libsel4vm/src/arch/arm/vgic/vgic.c +++ b/seL4_projects_libs/libsel4vm/src/arch/arm/vgic/vgic.c @@ -570,6 +570,9 @@ static int vgic_dist_enable_irq(struct vgic_dist_device *d, vm_vcpu_t *vcpu, int vgic = vgic_device_get_vgic(d); DDIST("enabling irq %d\n", irq); set_enable(gic_dist, irq, true, vcpu->vcpu_id); + if (irq == 27) { + printf("[hjl] enabling irq:%d on vcpu:%d\n", irq, vcpu->vcpu_id); + } virq_data = virq_find_irq_data(vgic, vcpu, irq); if (virq_data) { /* STATE b) */ @@ -619,6 +622,7 @@ static int vgic_dist_set_pending_irq(struct vgic_dist_device *d, vm_vcpu_t *vcpu return err; } else { + printf("[hjl] virq_data:%p, gic_dist->enable:%d, is_enabled:%d\n", virq_data, gic_dist->enable, is_enabled(gic_dist, irq, vcpu->vcpu_id)); /* No further action */ DDIST("IRQ not enabled (%d) on vcpu %d\n", irq, vcpu->vcpu_id); return -1; } 2.The detailed log is as follows: [hjl] enabling irq 27, vcpu->vcpu_id:0 [hjl] handle_psci target_cpu:256 [hjl] handle_psci vm:0x1584bbb0 vcpu_id:1 on success [hjl] enabling irq 27, vcpu->vcpu_id:1 [hjl] handle_psci target_cpu:512 [hjl] handle_psci vm:0x1584bbb0 vcpu_id:2 on success [hjl] enabling irq 27, vcpu->vcpu_id:2 [hjl] handle_psci target_cpu:768 [hjl] handle_psci vm:0x1584bbb0 vcpu_id:3 on success [hjl] enabling irq 27, vcpu->vcpu_id:3 [hjl] enabling irq 27, vcpu->vcpu_id:0 [hjl] handle_psci target_cpu:256 [hjl] handle_psci vm:0x1584fbb0 vcpu_id:1 on success [hjl] enabling irq 27, vcpu->vcpu_id:1 [hjl] handle_psci target_cpu:512 [hjl] handle_psci vm:0x1584fbb0 vcpu_id:2 on success [hjl] enabling irq 27, vcpu->vcpu_id:2 [hjl] handle_psci target_cpu:768 [hjl] handle_psci vm:0x1584fbb0 vcpu_id:3 on success [hjl] enabling irq 27, vcpu->vcpu_id:3 [hjl] IRQ not enabled (27) on vcpu 3 virq_data:0x15794ad0, gic_dist->enable:1, is_enabled:0 vm_vppi_event_handler@vm.c:97 VPPI IRQ 27 dropped on vcpu 3 [hjl] IRQ not enabled (27) on vcpu 3 virq_data:0x15794ad0, gic_dist->enable:1, is_enabled:0 vm_vppi_event_handler@vm.c:97 VPPI IRQ 27 dropped on vcpu 3 ...... 3.Present situation: At present, I tracked and found that secondary cpus has been on by Host, but Guest OS's secondary_start_kernel function seem like not excuted. Does anyone know what caused it? BR. Allen 邮件免责申明 Email Disclaimer 本邮件仅供本邮件指定收件人使用，其所载内容可能因含有保密信息或其它原因而不得披露。除本公司及本邮件指定收件人外，任何人不得公开、传播、分发、复制、印刷或使用本邮件之任何部分或其所载之任何内容。如您误收到本邮件，请立即通知本公司，并将原始邮件、附件及其所有复本从系统中删除，切勿使用。 This email is for the use of the designated receivers only，and the content is not allowed to be disclosed due to the confidential information or other reasons. Except for the Company and the designated receivers of this email, no one shall disclose, disseminate, distribute, copy, print or use any part of this email or any content contained therein. If you receive this email by mistake, please notify the Company immediately, and delete the original email, attachments and all copies from the system. Do not use it. 网络通信可能含有计算机病毒或其它缺陷，可能无法准确和/或及时送达其它系统，亦可能受阻而不为本公司或本邮件指定收件人所知。本公司对此类错误或遗漏以及任何因使用本邮件而引致之任何损失概不承担责任。 Network communication may contain computer viruses or other defects, which may not be delivered to other systems accurately and / or in time, or may be blocked by the Company or the designated receivers of this email. The Company shall not be liable for such errors or omissions and for any loss arising from this email. 本邮件所载任何内容仅作为业务层面交流与参考，除非明确说明，本公司不对邮件所载内容之准确性、完整性或公平性等承担任何法律责任。 Any contents contained in this email are only for the purpose of business communication and reference only. Unless explicitly stated otherwise, the Company shall not assume any legal responsibility for the accuracy, completeness or fairness of the content contained in the email. 本邮件指定收件人应特别注意：本邮件所载任何内容不构成本公司对本邮件指定收件人和/或其所属商业实体的任何要约、要约邀请或承诺，任何权利义务皆以双方签字盖章的书面文件为准。除经本公司以签字盖章的书面文件确认外，收件人和/或其所属商业实体不得以本邮件所载任何内容作为其向本公司主张任何权利或利益的正式依据。 The designated receivers should pay special attention to the fact that nothing contained in this email shall constitute an offer, invitation or acceptance by the Company to the designated receivers of this email and/or its affiliated business entities, and any rights and obligations are subject to the written documents signed and sealed by both parties. Except from the written document signed ,sealed and confirmed by the Company, the receivers and / or its affiliated business entity shall not rely on anything contained in this email as the formal basis for claiming any rights or interests to the Company.

1 0

camkes q's
by Sam Leffler 11 May '22

11 May '22

1. I need multiple VSpace "holes" to map page frames. This is the equivalent of what capdl_loader_app sets up in init_copy_frame. To do this I setup named static arrays and unmap the frame caps in camkes.c:post_main. This works but using a per-component attribute to enable this was awkward so I ended up adding a "copyregion" primitive to camkes. Is there a way to do this without adding to the camkes' syntax? It would also be nice not to allocate page frames only to release them at start but I didn't see a way to do this in capdl; is it possible (e.g. an easy way to leave an empty slot in the pt/pd)? 2. I pass capabilities with ipc msgs using camkes' rpc-connector templates. This requires multiple small changes that I want to enable only when being used (e.g. parameters to seL4_MessageInfo_new). My current plan is to add an optional keyword to a connection defn to enable support; e.g. connection seL4RPCCall foo(xfer_caps, from a, to b); Does this make sense or is there a better way? I rejected creating new connector templates that enable xfer_caps because I see this as a concept that applies to any ipc-based connector.

2 2

Information for Smmuv3 support of Sel4
by Tao Heng 陶恒-SW 06 May '22

06 May '22

Hi, list We are trying to porting Sel4 Vmm project on our platform.But we found there was no information about smmuv3 support of Sel4. Do you have some related development work for supporting this? Or can you give us some advice for supporting Smmuv3 on Sel4? 邮件免责申明 Email Disclaimer 本邮件仅供本邮件指定收件人使用，其所载内容可能因含有保密信息或其它原因而不得披露。除本公司及本邮件指定收件人外，任何人不得公开、传播、分发、复制、印刷或使用本邮件之任何部分或其所载之任何内容。如您误收到本邮件，请立即通知本公司，并将原始邮件、附件及其所有复本从系统中删除，切勿使用。 This email is for the use of the designated receivers only，and the content is not allowed to be disclosed due to the confidential information or other reasons. Except for the Company and the designated receivers of this email, no one shall disclose, disseminate, distribute, copy, print or use any part of this email or any content contained therein. If you receive this email by mistake, please notify the Company immediately, and delete the original email, attachments and all copies from the system. Do not use it. 网络通信可能含有计算机病毒或其它缺陷，可能无法准确和/或及时送达其它系统，亦可能受阻而不为本公司或本邮件指定收件人所知。本公司对此类错误或遗漏以及任何因使用本邮件而引致之任何损失概不承担责任。 Network communication may contain computer viruses or other defects, which may not be delivered to other systems accurately and / or in time, or may be blocked by the Company or the designated receivers of this email. The Company shall not be liable for such errors or omissions and for any loss arising from this email. 本邮件所载任何内容仅作为业务层面交流与参考，除非明确说明，本公司不对邮件所载内容之准确性、完整性或公平性等承担任何法律责任。 Any contents contained in this email are only for the purpose of business communication and reference only. Unless explicitly stated otherwise, the Company shall not assume any legal responsibility for the accuracy, completeness or fairness of the content contained in the email. 本邮件指定收件人应特别注意：本邮件所载任何内容不构成本公司对本邮件指定收件人和/或其所属商业实体的任何要约、要约邀请或承诺，任何权利义务皆以双方签字盖章的书面文件为准。除经本公司以签字盖章的书面文件确认外，收件人和/或其所属商业实体不得以本邮件所载任何内容作为其向本公司主张任何权利或利益的正式依据。 The designated receivers should pay special attention to the fact that nothing contained in this email shall constitute an offer, invitation or acceptance by the Company to the designated receivers of this email and/or its affiliated business entities, and any rights and obligations are subject to the written documents signed and sealed by both parties. Except from the written document signed ,sealed and confirmed by the Company, the receivers and / or its affiliated business entity shall not rely on anything contained in this email as the formal basis for claiming any rights or interests to the Company.

1 0

One week left to propose a talk at the seL4 summit 2022!
by June Andronick (seL4 Foundation) 06 May '22

06 May '22

A reminder that you have until Monday 9th of May 2022 to propose a talk for the seL4 Summit 2022 :) http://sel4.systems/news/2022 <http://sel4.systems/news/2022> http://sel4.systems/Foundation/Summit/ <http://sel4.systems/Foundation/Summit/> http://sel4.systems/Foundation/Summit/cfp <http://sel4.systems/Foundation/Summit/cfp>

1 1

Reminder seL4 developer hangout
by Birgit Brecknell 02 May '22

02 May '22

Hi all A friendly reminder that the seL4 developer hangout is on again this week: Wed, May 4, 7am (UTC), Topics: (open) * Sydney: Wed, May 4, 5pm * Central Europe: Wed, May 4, 9am * US Pacific Time: Wed, May 4, 12 midnight Zoom link: https://unsw.zoom.us/j/82640784431 cheers Birg --- Dr. Birgit Brecknell Project Officer Trustworthy Systems, UNSW, birgit.brecknell(a)unsw.edu.au<mailto:birgit.brecknell@unsw.edu.au> seL4 Foundation, birgit(a)sel4.systems<mailto:birgit@sel4.systems> 0433 880 571 Mon 9am-5pm Wed 9am-12pm Fri 9am-5pm

1 0

The seL4 Summit 2022 will be in Munich, Germany, on 10-12 Oct 2022
by June Andronick (seL4 Foundation) 29 Apr '22

29 Apr '22

It is our pleasure to confirm that the seL4 Summit 2022 will be in: Munich, Germany in the week of Oct 10th, 2022 It will be hosted by seL4 Foundation member Hensoldt Cyber. It will be a hybrid in-person/online event (if you'd like to propose a talk to be delivered remotely, please notify it in the submission). Remember that you have until Monday 9th of May 2022 to propose a talk. https://sel4.systems/news/2022 https://sel4.systems/Foundation/Summit/ https://sel4.systems/Foundation/Summit/cfp

1 0

Sending extraCaps over IPC | Unable to send 2 caps
by Sid Agrawal 29 Apr '22

29 Apr '22

Hello seL4 devs and users, I am trying to send two capabilities from one process to another via the extraCaps mechanism in the IPC. I can get it working when I send just 1 cap, but when I am sending 2 caps, the 2nd one never makes it. The extraCaps field on the receiver side is somehow always 1. Looking at the seL4 manual, I understood that I could send more than 1 capability via an IPC. But since on the receiver side, I can only specify one receive slot, I assumed that if more than 1 capability is received, it will be put in the consecutive slots. Not sure if this is a valid assumption. Looking at kerne/libsel4/include/sel4/constants.h <https://github.com/seL4/seL4/blob/master/libsel4/include/sel4/constants.h#L…>, I see that seL4_MsgMaxExtraCaps is set to 2, so I think I should be able to send 2 caps. I have spent about 3 days trying to make this work and thought that at this stage, it would be best to ask :) My C code on the sender side looks something like this: seL4_CPtr cap1 = <alloc some capability> seL4_CPtr cap2 = <alloc some capability> seL4_SetMR(0, 0xabcd); seL4_SetCap(0, cap1); seL4_SetCap(1, cap2); seL4_MessageInfo_t tag = seL4_MessageInfo_new(0, 0, 2, 1); tag = seL4_Call(receivers_ep_cap, tag); On the receive side, the code looks something like this: /* Allocate one csapce slot */ cspacepath_t received_cap_path_1; error = vka_cspace_alloc_path(simple-vka, &received_cap_path_1); <- slot = 2786 assert(error == 0); /* Allocate another csapce slot */ cspacepath_t received_cap_path_2; error = vka_cspace_alloc_path(simple-vka, &received_cap_path_2); <- slot = 2785(somehow decreasing) assert(error == 0); /* Since the allocated slots are decreasing in count, I pick the lesser one as my first slot * assuming that if more than 1 cap is received it will be put in the next slot */ seL4_CPtr min_cptr = MIN(received_cap_path_1.capPtr, received_cap_path_2.capPtr); seL4_SetCapReceivePath( /* _service */ received_cap_path.root, /* index */ min_cptr, /* depth */ received_cap_path.capDepth); tag = recv(&sender_badge); assert(seL4_MessageInfo_get_extraCaps(tag) == 2); <--- This asser fails. Thanks again!! Sid Graduate Student @ UBC

2 2

RTReply and cap xfer
by Sam Leffler 22 Apr '22

22 Apr '22

The kernel supports attaching a capability to an RTReply xfer. sel4test even checks this WAI. But capdl doesn't seem to support it as I see no way to express the set of rights associated with a capability to an RTReply object. I added capdl support so I can mark the Grant right and verified cap xfer works. TWas this intentional? -Sam

1 0

Running vm_multi app on qemu-arm-virt platform, udhcpc can not return
by ybbekele＠aggies.ncat.edu 22 Apr '22

22 Apr '22

Hi, I tried to build vm_multi for qemu-arm-virt using the procedures in this link https://docs.sel4.systems/projects/camkes-vm/. After building, I used the generated simulation file to do ./simulate in my build directory. After displaying 'welcome to buildroot', the console always prints the log "udhcpc: sending discover",which indicates udhcpc can not return. The related log was shown below: Starting syslogd: OK Starting syslogd: OK Starting syslogd: OK Starting klogd: OK Starting klogd: OK Starting klogd: OK Running sysctl: OK Running sysctl: OK Running sysctl: OK Initializing random number generator... [ 7.195263] random: dd: uninitialized urandom read (512 bytes read) done. Initializing random number generator... [ 7.315113] random: dd: uninitialized urandom read (512 bytes read) done. Initializing random number generator... [ 7.300770] random: dd: uninitialized urandom read (512 bytes read) done. Starting network: OK Starting network: OK Starting network: OK udhcpc: started, v1.31.0 udhcpc: started, v1.31.0 ifconfig: SIOCGIFFLAGS: No such device [ 9.077855] random: mktemp: uninitialized urandom read (6 bytes read) [ 9.177878] random: mktemp: uninitialized urandom read (6 bytes read) Welcome to Buildroot udhcpc: sending discover udhcpc: sending discover udhcpc: sending discover udhcpc: sending discover As the simulation process progresses there was an error: _utspace_split_alloc@split.c:266 Failed to find any untyped capable of creating an object at address 0x10080000 alloc_vm_device_cap@main.c:938 Grabbing the entire cap for device memory alloc_vm_device_cap@main.c:941 Failed to grab the entire cap My question is: 1. Is the two things have dependencies (The error and the hang at booting the system up)? 2. How can this issue be solved? 3. Is this issue related to the TimeServer component being imported to Qemu (as this is indicated as a requirement to run multi_vm on qemu-arm-virt)? Thank you for your time

1 0

Why vppi is sent from kernel to vmm by fault endpoint but not by notification ?
by wtliang785 21 Apr '22

21 Apr '22

hello devel, Why vppi , such as vtimer interrupt to guest, is sent from kernel to vmm by fault endpoint but not by notification? I see that spi to guest is sent from kernel to vmm by notification. thank you.

1 0

Reminder seL4 developer hangout/video call
by Gerwin Klein 19 Apr '22

19 Apr '22

Hi all A friendly reminder that the seL4 developer hangout is on again this week: Tue, Apr 19, 10pm (UTC) * Sydney: Wed, Apr 20, 8am * Central Europe: Wed, Apr 20, 12 midnight * US Pacific Time: Tue, Apr 19, 3pm Zoom link: https://unsw.zoom.us/j/82640784431 Cheers, Gerwin

1 0

Re: Combatting spam on this list
by Isaac Beckett 13 Apr '22

13 Apr '22

Thanks Peter! In my experience posts like that, linking to pornographic websites, are not made by humans anyway, but rather by bots. I don’t think this will effect humans too much except at the very beginning. It may make sense to implement a different captcha, as often the developers of those bots can outsource solving common captcha providers to underpaid humans. Using an uncommon or home-grown captcha solution will make it less likely that bots will be able to get around them using that method. And attacks like these aren’t targeted, usually, so I doubt the bot writers will adapt for one specific mailing list. That will stop bots from signing up in the first place, hopefully. We could also maybe report abuse of free email services like Gmail or Hotmail or similar in a semi-automated fashion. Would not surprise me if there is some sort of API for that. But on the other hand with the way those companies work it could be a waste of time and effort, since they might not do anything. And it may also make sense to keep track of which domains non-malicious users are sending email from. That way we can ban entire domains without worrying about getting rid of legitimate users unintentionally. For example, a small webmail service that we may not realize is a public email service at first, could be used by both a malicious user and a legitimate one. That way we’re only banning domains controlled by spammers exclusively. There’s lots of resources for this stuff thankfully, you can go on a whole tangent reading about email spam prevention on Wikipedia. I wish you luck with figuring out how to stop this annoying nonsense.

3 2

Unrecognized OPCODE fence.i/csrw
by porter.188＠osu.edu 13 Apr '22

13 Apr '22

I'm trying to setup a development machine for seL4 work. I would like to use v12.1.0. I setup seL4test-manifest per instructions here https://docs.sel4.systems/Hardware/spike.html repo init -u https://github.com/seL4/sel4test-manifest.git repo sync mkdir cbuild cd cbuild ../init-build.sh -DPLATFORM=spike -DRISCV64=1 # The default cmake wrapper sets up a default configuration for the target platform. # To change individual settings, run `ccmake` and change the configuration # parameters to suit your needs. ninja # If your target binaries can be executed in an emulator/simulator, and if # our build system happens to support that target emulator, then this script # might work for you: ./simulate I used repo init -u https://github.com/seL4/sel4test-manifest.git -b refs/tags/12.1.0 to be sure I got 12.1.0 but it doesn't matter, both branches/tags give the same error when I configure/compile. $ ../init-build.sh -DPLATFORM=spike -DRISCV64=1 -DSIMULATION=1 loading initial cache file /mnt/data/sel4test/projects/sel4test/settings.cmake -- Set platform details from PLATFORM=spike -- KernelPlatform: spike -- Setting from flags KernelSel4Arch: riscv64 -- Found seL4: /mnt/data/sel4test/kernel -- Found GCC with prefix riscv64-unknown-linux-gnu- -- Found GCC with prefix riscv64-unknown-linux-gnu- -- The C compiler identification is GNU 10.2.0 -- The CXX compiler identification is GNU 10.2.0 -- The ASM compiler identification is GNU -- Found assembler: /mnt/data/opt/riscv/bin/riscv64-unknown-linux-gnu-gcc -- Detecting C compiler ABI info -- Detecting C compiler ABI info - done -- Check for working C compiler: /mnt/data/opt/riscv/bin/riscv64-unknown-linux-gnu-gcc - skipped -- Detecting C compile features -- Detecting C compile features - done -- Detecting CXX compiler ABI info -- Detecting CXX compiler ABI info - done -- Check for working CXX compiler: /mnt/data/opt/riscv/bin/riscv64-unknown-linux-gnu-g++ - skipped -- Detecting CXX compile features -- Detecting CXX compile features - done -- Found elfloader-tool: /mnt/data/sel4test/tools/seL4/elfloader-tool -- /mnt/data/sel4test/build/kernel/gen_headers/plat/machine/devices_gen.h is out of date. Regenerating... -- CPIO test cpio_reproducible_flag PASSED -- Found musllibc: /mnt/data/sel4test/projects/musllibc -- Found util_libs: /mnt/data/sel4test/projects/util_libs -- Found seL4_libs: /mnt/data/sel4test/projects/seL4_libs -- Found sel4_projects_libs: /mnt/data/sel4test/projects/sel4_projects_libs -- Found sel4runtime: /mnt/data/sel4test/projects/sel4runtime -- Performing Test compiler_arch_test -- Performing Test compiler_arch_test - Success -- libmuslc architecture: 'riscv' (from KernelSel4Arch 'riscv64') -- Detecting cached version of: musllibc -- Found Git: /usr/bin/git (found version "2.25.1") -- Not found cache entry for musllibc - will build from source -- Found PythonInterp: /usr/bin/python (found version "2.7.18") CMake Warning (dev) at /home/user/.local/lib/python3.8/site-packages/cmake/data/share/cmake-3.22/Modules/FindPackageHandleStandardArgs.cmake:438 (message): The package name passed to `find_package_handle_standard_args` (NANOPB) does not match the name of the calling package (Nanopb). This can lead to problems in calling code that expects `find_package` result variables (e.g., `_FOUND`) to follow a certain pattern. Call Stack (most recent call first): /mnt/data/sel4test/tools/nanopb/extra/FindNanopb.cmake:340 (FIND_PACKAGE_HANDLE_STANDARD_ARGS) /mnt/data/sel4test/tools/seL4/cmake-tool/helpers/nanopb.cmake:29 (find_package) /mnt/data/sel4test/projects/sel4_projects_libs/libsel4nanopb/CMakeLists.txt:11 (include) This warning is for project developers. Use -Wno-dev to suppress it. -- Found NANOPB: /mnt/data/sel4test/tools/nanopb -- Configuring done -- Generating done -- Build files have been written to: /mnt/data/sel4test/build user@user-KVM:/mnt/data/sel4test/build$ ninja [42/267] Building ASM object kernel/CMakeFiles/kernel.elf.dir/src/arch/riscv/head.S.obj FAILED: kernel/CMakeFiles/kernel.elf.dir/src/arch/riscv/head.S.obj /usr/bin/ccache /mnt/data/opt/riscv/bin/riscv64-unknown-linux-gnu-gcc --sysroot=/mnt/data/sel4test/build -I/mnt/data/sel4test/kernel/include/plat/default -I/mnt/data/sel4test/kernel/include -I/mnt/data/sel4test/kernel/include/64 -I/mnt/data/sel4test/kernel/include/arch/riscv -I/mnt/data/sel4test/kernel/include/arch/riscv/arch/64 -I/mnt/data/sel4test/kernel/include/plat/spike -I/mnt/data/sel4test/kernel/include/plat/spike/plat/64 -I/mnt/data/sel4test/kernel/libsel4/include -I/mnt/data/sel4test/kernel/libsel4/arch_include/riscv -I/mnt/data/sel4test/kernel/libsel4/sel4_arch_include/riscv64 -I/mnt/data/sel4test/kernel/libsel4/sel4_plat_include/spike -I/mnt/data/sel4test/kernel/libsel4/mode_include/64 -I/mnt/data/sel4test/build/kernel/gen_config -I/mnt/data/sel4test/build/kernel/autoconf -I/mnt/data/sel4test/build/kernel/gen_headers -I/mnt/data/sel4test/build/kernel/generated -march=rv64imac -mabi=lp64 -D__KERNEL_64__ -O2 -g -DNDEBUG -nostdinc -nostdlib -O2 -DHAVE_AUTOCONF -DDEBUG -g -ggdb -mcmodel=medany -fno-pic -fno-pie -fno-stack-protector -fno-asynchronous-unwind-tables -std=c99 -Wall -Werror -Wstrict-prototypes -Wmissing-prototypes -Wnested-externs -Wmissing-declarations -Wundef -Wpointer-arith -Wno-nonnull -ffreestanding -MD -MT kernel/CMakeFiles/kernel.elf.dir/src/arch/riscv/head.S.obj -MF kernel/CMakeFiles/kernel.elf.dir/src/arch/riscv/head.S.obj.d -o kernel/CMakeFiles/kernel.elf.dir/src/arch/riscv/head.S.obj -c /mnt/data/sel4test/kernel/src/arch/riscv/head.S /mnt/data/sel4test/kernel/src/arch/riscv/head.S: Assembler messages: /mnt/data/sel4test/kernel/src/arch/riscv/head.S:24: Error: unrecognized opcode `fence.i' /mnt/data/sel4test/kernel/src/arch/riscv/head.S:31: Error: unrecognized opcode `csrw sscratch,x0' [44/267] Invoking muslc build system /mnt/data/sel4test/projects/musllibc/src/unistd/getcwd.c: In function 'getcwd': cc1: warning: function may return address of local variable [-Wreturn-local-addr] /mnt/data/sel4test/projects/musllibc/src/unistd/getcwd.c:9:7: note: declared here 9 | char tmp[PATH_MAX]; | ^~~ ninja: build stopped: subcommand failed. I tried riscv-gcc 10.2.0 and 11.1.0 with the same results. $ riscv64-unknown-linux-gnu-gcc --version riscv64-unknown-linux-gnu-gcc (gca312387ab1) 10.2.0 Copyright (C) 2020 Free Software Foundation, Inc. This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. Is there some extension I need to add to get this working? Where do I do that?

2 2

答复: Report "Failed to touch ram region" error using virtio_console when assigned for Arm-VM more than 3G memory
by Han JingLong 韩景龙 12 Apr '22

12 Apr '22

Hi The root cause of this problem has been found, when Guest OS do the virtio console driver probe, if virtqueue's desc addr allocated by alloc_pages_exact() in the setup_vq() function is >= 0x100000000 (it is common when the memory of VM allocated exceeds 3G), at first It will be shifted right 12 bits by Guest OS(turn into a value >= 0x100000), and then use iowrite32(iobase + VIRTIO_PCI_QUEUE_PFN) to notify Host, after unsigned int type data be shifted left 12 bits by Host, the higest bits 0x1 of virtqueue's desc addr will be lost. I have submitted a PR for the amendment, waiting for the review and merge into the main branch. https://github.com/seL4/seL4_projects_libs/pull/43 BR. Allen 发件人: Han JingLong 韩景龙发送时间: 2022年3月21日 20:27 收件人: 'devel(a)sel4.systems' <devel(a)sel4.systems> 主题: Report "Failed to touch ram region" error using virtio_console when assigned for Arm-VM more than 3G memory Hi I had make virtio_console work well on my environment(armv8, RAM is 8G) based on vm_multi with Linux Guest OS(512M) and Android Guest OS(<= 3G) But I meet an error(vm_ram_touch@guest_ram.c:157<mailto:vm_ram_touch@guest_ram.c:157> Failed to touch ram region: Not registered RAM region) when assign for a VM(Android Guest OS) more than 3G memory. 1. Some logs are added for debugging this issue： +++ b/seL4_projects_libs/libsel4vmmplatsupport/src/drivers/virtio_emul.c @@ -86,6 +86,7 @@ static int emul_io_out(virtio_emul_t *emul, unsigned int offset, unsigned int si assert(size == 4); int queue = emul->virtq.queue; emul->virtq.queue_pfn[queue] = value; + printf("[hjl] queue_size:%d desc:%p\n", emul->virtq.queue_size[queue], (void *)(uintptr_t)(value << 12)); vring_init(&emul->virtq.vring[queue], emul->virtq.queue_size[queue], (void *)(uintptr_t)(value << 12), VIRTIO_PCI_VRING_ALIGN); break; +++ b/seL4_projects_libs/libsel4vmmplatsupport/src/drivers/virtio_emul_helpers.c @@ -25,10 +25,43 @@ static int write_guest_mem(vm_t *vm, uintptr_t phys, void *vaddr, size_t size, s int vm_guest_write_mem(vm_t *vm, void *data, uintptr_t address, size_t size) { + bool is_inram = false; + vm_mem_t *guest_memory = &vm->mem; + for (int i = 0; i < guest_memory->num_ram_regions; i++) { + if (guest_memory->ram_regions[i].start <= address && + guest_memory->ram_regions[i].start + guest_memory->ram_regions[i].size >= address + size) { + /* We are within a ram region*/ + is_inram = true; + } + } + + if (!is_inram) { + printf("[hjl] write mem addr:%p size:0x%lx\n", address, size); + for (int index = 0; index < guest_memory->num_ram_regions; index++) { + printf("[hjl] write mem ram_regions start:%p size:0x%lx\n", guest_memory->ram_regions[index].start, guest_memory->ram_regions[index].size); + } + } + return vm_ram_touch(vm, address, size, write_guest_mem, data); } int vm_guest_read_mem(vm_t *vm, void *data, uintptr_t address, size_t size) { + bool is_inram = false; + vm_mem_t *guest_memory = &vm->mem; + for (int i = 0; i < guest_memory->num_ram_regions; i++) { + if (guest_memory->ram_regions[i].start <= address && + guest_memory->ram_regions[i].start + guest_memory->ram_regions[i].size >= address + size) { + /* We are within a ram region*/ + is_inram = true; + } + } + + if (!is_inram) { + printf("[hjl] read mem addr:%p size:0x%lx\n", address, size); + for (int index = 0; index < guest_memory->num_ram_regions; index++) { + printf("[hjl] read mem ram_regions start:%p size:0x%lx\n", guest_memory->ram_regions[index].start, guest_memory->ram_regions[index].size); + } + } return vm_ram_touch(vm, address, size, read_guest_mem, data); } 2. The detailed log is as follows: [hjl] queue_size:128 desc:0x8eb6000 [hjl] queue_size:128 desc:0x8eb8000 [hjl] read mem addr:0x8eb8802 size:0x2 [hjl] read mem ram_regions start:0x80000000 size:0x80000 [hjl] read mem ram_regions start:0x80080000 size:0x17cda00 [hjl] read mem ram_regions start:0x8184da00 size:0xa5b2600 [hjl] read mem ram_regions start:0x8be00000 size:0x83ae98 [hjl] read mem ram_regions start:0x8c63ae98 size:0x29c5168 [hjl] read mem ram_regions start:0x8f000000 size:0x26d35 [hjl] read mem ram_regions start:0x8f026d35 size:0xc0fd92cb vm_ram_touch@guest_ram.c:157<mailto:vm_ram_touch@guest_ram.c:157> Failed to touch ram region: Not registered RAM region 3. devices.camkes configuration reference is as follows: #define VM1_RAM_BASE 0x80000000 #define VM1_RAM_SIZE 0xD0000000 #define VM1_DTB_ADDR 0x8F000000 //VM1_RAM_BASE + 0xF000000 #define VM1_INITRD_ADDR 0x8BE00000 //VM1_DTB_ADDR - VM1_INITRD_MAX_SIZE vm1.untyped_mmios = [ "0x80000000:28", // RAM "0x90000000:28", // RAM "0xa0000000:28", // RAM "0xb0000000:28", // RAM "0xc0000000:28", // RAM "0xd0000000:28", // RAM "0xe0000000:28", // RAM "0xf0000000:28", // RAM "0x100000000:28", // RAM "0x110000000:28", // RAM "0x120000000:28", // RAM "0x130000000:28", // RAM "0x140000000:28", // RAM /* "0x150000000:28", // RAM "0x160000000:28", // RAM "0x170000000:28", // RAM "0x180000000:28", // RAM "0x190000000:28", // RAM "0x1a0000000:28", // RAM "0x1b0000000:28", // RAM */ ]; 4. Present situation: At present, I tracked and found that When the Guest OS's virtio_console driver do the probe, it created the vring and iowrite to notify VMM of the virtqueue desc 's physical address in setup_vq() /* create the vring */ static void *vring_alloc_queue(struct virtio_device *vdev, size_t size, dma_addr_t *dma_handle, gfp_t flag) { ...... void *queue = alloc_pages_exact(PAGE_ALIGN(size), flag); if (queue) { phys_addr_t phys_addr = virt_to_phys(queue); *dma_handle = (dma_addr_t)phys_addr; /* activate the queue */ iowrite32(virtqueue_get_desc_addr(vq) >> VIRTIO_PCI_QUEUE_ADDR_SHIFT, vp_dev->ioaddr + VIRTIO_PCI_QUEUE_PFN); I'm very confused why is the physical memory allocated for virtqueue desc not within the effective memory range of VM when assign the memory to it exceeds 3G? BR. Allen 邮件免责申明 Email Disclaimer 本邮件仅供本邮件指定收件人使用，其所载内容可能因含有保密信息或其它原因而不得披露。除本公司及本邮件指定收件人外，任何人不得公开、传播、分发、复制、印刷或使用本邮件之任何部分或其所载之任何内容。如您误收到本邮件，请立即通知本公司，并将原始邮件、附件及其所有复本从系统中删除，切勿使用。 This email is for the use of the designated receivers only，and the content is not allowed to be disclosed due to the confidential information or other reasons. Except for the Company and the designated receivers of this email, no one shall disclose, disseminate, distribute, copy, print or use any part of this email or any content contained therein. If you receive this email by mistake, please notify the Company immediately, and delete the original email, attachments and all copies from the system. Do not use it. 网络通信可能含有计算机病毒或其它缺陷，可能无法准确和/或及时送达其它系统，亦可能受阻而不为本公司或本邮件指定收件人所知。本公司对此类错误或遗漏以及任何因使用本邮件而引致之任何损失概不承担责任。 Network communication may contain computer viruses or other defects, which may not be delivered to other systems accurately and / or in time, or may be blocked by the Company or the designated receivers of this email. The Company shall not be liable for such errors or omissions and for any loss arising from this email. 本邮件所载任何内容仅作为业务层面交流与参考，除非明确说明，本公司不对邮件所载内容之准确性、完整性或公平性等承担任何法律责任。 Any contents contained in this email are only for the purpose of business communication and reference only. Unless explicitly stated otherwise, the Company shall not assume any legal responsibility for the accuracy, completeness or fairness of the content contained in the email. 本邮件指定收件人应特别注意：本邮件所载任何内容不构成本公司对本邮件指定收件人和/或其所属商业实体的任何要约、要约邀请或承诺，任何权利义务皆以双方签字盖章的书面文件为准。除经本公司以签字盖章的书面文件确认外，收件人和/或其所属商业实体不得以本邮件所载任何内容作为其向本公司主张任何权利或利益的正式依据。 The designated receivers should pay special attention to the fact that nothing contained in this email shall constitute an offer, invitation or acceptance by the Company to the designated receivers of this email and/or its affiliated business entities, and any rights and obligations are subject to the written documents signed and sealed by both parties. Except from the written document signed ,sealed and confirmed by the Company, the receivers and / or its affiliated business entity shall not rely on anything contained in this email as the formal basis for claiming any rights or interests to the Company.

1 0

Combatting spam
by David Barrass 12 Apr '22

12 Apr '22

Hi Peter, Thank you for raising this issue - it is an annoying distraction. The general standard of the list is very high as one would expect and it is a shame to see this kind of behaviour polluting the discussions. I am very happy to have to earn a privilege to post and am happy for anything I post to be moderated. I would welcome any proposition to keep spammers off the list whilst keeping it open but I don't think any solution should impose additional burdens on the moderators. I think that this warrants a bit of thought and will give this some consideration. Your proposal sounds good and I support it. In the meantime thank you and many thanks to all the team who make this happen. I find the work on seL4 very valuable and relevant. best regards to all, David

1 0

Combatting spam on this list
by Peter Chubb 12 Apr '22

12 Apr '22

Hi Folks, We're trying hard to avoid spam coming through this list. In particular we moderate all emails coming from non-members, and only let through on-topic postings. Recently, however, we've had some people join the list, and then posting spam. I'm proposing that the first post a person makes will always be moderated; and we'll turn off the moderation after the first on-topic posting. Anyone who posts spam will have that address marked as discard immediately. This means that *all* next posts will be moderated until I or one of the other moderators lets them through, because I'll be changing the default processing. Comments? I'd rather keep things as open as possible, but spammers are making it hard. Peter C -- Dr Peter Chubb https://trustworthy.systems/ Trustworthy Systems Group CSE, UNSW Core hours: Mon 8am-3pm; Wed: 8am-5pm; Fri 8am-12pm.

1 0

RFC 10
by Gerwin Klein 11 Apr '22

11 Apr '22

This is a last call for comments for RFC-10 before the TSC votes on it this week: https://sel4.atlassian.net/browse/RFC-10 The RFC is about consolidating AArch64 page table objects and has been uncontroversial so far, just wanted to make sure people are aware of it. Cheers, Gerwin

2 1

Does the lastest master branch support gic v3 virtulization?
by wtliang785 10 Apr '22

10 Apr '22

hello devel, We want to use Sel4 in our project, but the gic version is v3. I know sel4 kernel 12.1.0 version does not support v3 virtuliazation. My question is that what is the status for supporting the v3 virtulization in lastest sel4 kernel master branch? Does the lastest master branch support gic v3 virtulization? thank you Peter Wang

2 1

capDL-tool fix for empty CNode slots
by Sam Leffler 07 Apr '22

07 Apr '22

If you generate capdl for a CNode with empty slots, capDL-tool incorrectly calculates CDL_CapMap::num because it uses Map.size which doesn't include empty slots. The right way to calculate "num" is by taking the max of the key values +1. diff --git a/capDL-tool/CapDL/PrintC.hs b/capDL-tool/CapDL/PrintC.hs index ec0eda9..b4a2cbb 100644 --- a/capDL-tool/CapDL/PrintC.hs +++ b/capDL-tool/CapDL/PrintC.hs @@ -224,7 +224,7 @@ memberSlots objs obj_id slots irqNode cdt ms = showSlots objs obj_id (Map.toList slots) irqNode cdt ms +++ "}," where - slot_count = Map.size slots + slot_count = if Map.null slots then 0 else (fst $ Map.findMax slots) + 1 printInit :: [Word] -> String printInit argv = -Sam

2 3

Interrupt handling - General Purpose Timer
by JENKINSON Mark 07 Apr '22

07 Apr '22

Hi seL4 Devel, We are trying to use the General Purpose Timer1 for our i.MX8MQ-based board within a simple CAmkES app. GPT1 is initialising and starting OK, but the interrupt handler for handling rollover is not being triggered. Through instrumenting the code with printf's, the GPT initialisation looks reasonable, and the expected rollover interrupt is being generated and seen within handleInterrupt(); however, the interrupt handler routine that has been registered is not being called. I'm hoping that someone can give me some ideas where to investigate next please? A few more details: From gpt_init() (in util_libs/libplatsupport/src/mach/imx/gpt.c), instrumentation within allocate_irq_callback() confirms that, for: gpt->irq_id = ps_irq_register(&gpt->io_ops.irq_ops, irq, gpt_handle_irq, gpt); our values are: irq->type = 3; // PS_INTERRUPT irq->irq.number = 87 (0x57); // 55 (0x37) + 32 = 87 (0x57) which agrees with the GPT1 entry from our dts file (when combined with the offset of 32, which I've seen explained elsewhere): gpt@302d0000 {... reg = < 0x302d0000 0x10000 >; interrupts = < 0x00 0x37 0x04 >;... And gpt_handle_irq() is registered as the interrupt handler, which resets the rollover flag and manages the counter's high_bits variable. Resulting from this call to ps_irq_register(), gpt->irq_id = 27 (0x1b), although I'm not sure of the significance of this irq_id value. Our test app starts GPT1. After ~3 mins, the timer rolls over, as expected. Instrumentation in handleInterrupt(irq) is triggered with: irq = 87 (0x57); // as expected, the GPT1 rollover interrupt However, gpt_handle_irq() is never called, despite being associated with irq 87 back in the ps_irq_register() call. Instrumentation in handleInterrupt() shows that the IRQSignal case is executed and sendSignal() is called. Within sendSignal, the NtfnState_Idle case is executed, calling ntfn_set_active(ntfnPtr, badge), with badge = 1. I stop tracking the flow there, but pick up again that ackInterrupt() is visited with irq = 87 (0x57). Everything looks in order (the right interrupt is generated at the right time and is detected) except gpt_handle_irq() is not called. The timer app keeps ticking away, but without the rollover management, time ends up skipping. Thanks for your help, Mark. This message contains information that may be privileged or confidential and is the property of the Capgemini Group. It is intended only for the person to whom it is addressed. If you are not the intended recipient, you are not authorized to read, print, retain, copy, disseminate, distribute, or use this message or any part thereof. If you receive this message in error, please notify the sender immediately and delete all copies of this message.

1 0

OpenPower/PowerPC/ppc64le port: major concerns and obstacles
by Isaac Beckett 06 Apr '22

06 Apr '22

Hello seL4 devel! Recently I was on the developer hangout meeting and brought up a ppc port. Interest seemed low, and some even called ppc a “niche” architecture which seems unfair. There was also the much more concrete concerns of funding and overall maintenance. I believe an PPC port would be very valuable, and I plan to do a whole essay/write up of some sort, but I am also not the most familiar with the technical challenges, and could use more information on those. I do think there is definitely people who would want to run seL4 on PowerPC platforms. PowerPC is one of the few ISAs that has existing, modern hardware without closed-source binary blobs, which I believe pose a real threat to the trustworthiness of the hardware seL4 is currently capable of running on.

2 1

A way to reclaim initial thread resources
by Marcin Witkowski 06 Apr '22

06 Apr '22

Hey, I am currently looking for a way to reclaim resources allocated by kernel for the rootserver thread, i.e. memory for CNode, TCB, BootInfo, etc. My current approach looks like this: * in rootserver instead of calling seL4_TCB_Suspend, call custom syscall seL4_ReclaimRootserverResources. This sycall as parameters takes CNode and slot no. after which kernel should be able to freely write new caps. This CNode is main CNode of some component initialized by the rootserver. * implmenetation of this syscall then suspends initial thread, schedules new thread, revokes most of rootserver's resources, notably TCB, BootInfo, IPCBuffer, VSpace and CNode. Then for those now free memory regions new untyped capabilities are created, with the same sizes as the original objects. Lastly, new capabilities are written to subsequent slots in CNode a'la boot.c, so with null MDBNode; mdbRevocable and mdbFirstBadged set to true. This solution has couple of problems. First and foremost, it requires creating additional syscall to handle this. Secondly, even though the component _technically_ has access to this newly created capabilities, it doesn't know where they are, or how big they are. This could be partially band-aided by hardcoding this information in relevant component, but that is far from elegant. This component also recives rest of the untyped memory from rootserver, including bootinfo entries about this memory specification, so that renders solution with hardcoding spec even worse. Last but not least, before the seL4_ReclaimRootserverResources is called, all the components are resumed using seL4_TCB_Resume as part of rootserver's work, so there could be race-condition between calling reclaiming syscall, and component initialization (although I am not 100% sure about that part) Is there maybe a better way to do it, and I am doing it all round? The perfect solution would be to somehow extend bootinfo and/or remaining untypeds that were given by the kernel to the rootserver.

2 3

Reminder seL4 developer hangout/video call
by Birgit Brecknell 04 Apr '22

04 Apr '22

Hi all A friendly reminder that the seL4 developer hangout is on this week: Wed, Apr 6, 7am (UTC), Topics: (open) * Sydney: Wed, Apr 6, 5pm * Central Europe: Wed, Apr 6, 9am * US Pacific Time: Wed, Apr 6, 12 midnight (There are too many time zones in the world to cite them all :-)) Zoom link: https://unsw.zoom.us/j/82640784431 Cheers, Birg --- Dr. Birgit Brecknell Project Officer Trustworthy Systems, UNSW, birgit.brecknell(a)unsw.edu.au<mailto:birgit.brecknell@unsw.edu.au> seL4 Foundation, birgit(a)sel4.systems<mailto:birgit@sel4.systems> 0433 880 571 Mon 9am-5pm Wed 9am-12pm Fri 9am-5pm

3 2

The Call for Presentations for the seL4 summit 2022 is out!
by June Andronick (seL4 Foundation) 01 Apr '22

01 Apr '22

We are calling for proposals to present at the seL4 Summit 2022! Share your seL4 work. Share your seL4 experience. Share your seL4 thoughts. Share your seL4 questions. Check the full Call For Presentations and topics of interest at: https://sel4.systems/Foundation/Summit/cfp <https://sel4.systems/Foundation/Summit/cfp> To propose a talk, send an abstract of one page or less by Monday 9th of May 2022 to summit(a)sel4.systems <mailto:summit@sel4.systems>. Please do spread the word and also encourage others to submit a talk if you like their work! Thanks, June

1 0

Overlapping pointer returned by memalign
by WILLIAMS Stephen 01 Apr '22

01 Apr '22

Hi, I’m currently working on a project porting drivers from U-Boot to seL4 and have run into an unexpected problem seemingly triggered by use of the memalign within the U-Boot drivers. What I am seeing is that calls to memalign from within my CAmkES component can return pointers to regions which overlap with those previously returned by malloc. Obviously this leads to the two allocated regions trampling over each other and resulting corruption of data. I’m at a complete loss to explain this behaviour and would be very grateful to receive any suggestions or pointers. Thanks for your help, Stephen This message contains information that may be privileged or confidential and is the property of the Capgemini Group. It is intended only for the person to whom it is addressed. If you are not the intended recipient, you are not authorized to read, print, retain, copy, disseminate, distribute, or use this message or any part thereof. If you receive this message in error, please notify the sender immediately and delete all copies of this message.

3 9

Re: How to switch virtual machines linux in vm_multi from camkes-vm-example?
by Peter Chubb 31 Mar '22

31 Mar '22

>>>>> "yjy" == yjy <yjy7894(a)126.com> writes: yjy> `screen /dev/ttyUSB0 115200`. I have a shell terminal that can yjy> see the output from VM0. I input @1 to shell, which is useless. It only works at the start of a line. Peter C yjy> At 2022-03-31 14:12:16, peter(a)chubb.wattle.id.au wrote: >>>>>>> "yjy" == yjy <yjy7894(a)126.com> writes: >> yjy> Hi, I have already run the camkes-vm-example vm_multi on my yjy> board, but i don't know how to switch linux vm shell from another yjy> linux vm, Can anyone help me solve this? >> >> If you're talking about controlling the serial console to talk to >> different VMs, the instructions are >> https://github.com/seL4/camkes-vm in the README.md under 'Serial' >> >> >> In brief, output from different VMs is colour coded. Switch >> between them for input with @0, @1, @2 etc. >> >> Peter C _______________________________________________ Devel >> mailing list -- devel(a)sel4.systems To unsubscribe send an email to >> devel-leave(a)sel4.systems yjy> [2 <text/html; GBK (base64)>] -- Dr Peter Chubb https://trustworthy.systems/ Trustworthy Systems Group CSE, UNSW Core hours: Mon 8am-3pm; Wed: 8am-5pm; Fri 8am-12pm.

1 0

How to switch virtual machines linux in vm_multi from camkes-vm-example?
by yjy 31 Mar '22

31 Mar '22

Hi, I have already run the camkes-vm-example vm_multi on my board, but i don't know how to switch linux vm shell from another linux vm, Can anyone help me solve this? Best, Comet

2 1

Question for student research
by Seth Nielson 31 Mar '22

31 Mar '22

Hi. I am mentoring a student group trying to do some work on SEL4. We are trying to setup basic TCP/IP networking and are really struggling to find documentation or up-to-date guides. We found a project that has networking (it even has some filesystem and a small webserver as part of the project). We thought we just about had the networking component working for QEMU but there seems to be issues with QEMU and networking, at least the way we did it. Does anyone have any how-to guides for getting basic networking up and running? If QEMU is not great for networking, please suggest a development board. Thanks much.

2 2

Information for Additional Virtio Driver Support of Sel4
by Tao Heng 陶恒-SW 28 Mar '22

28 Mar '22

Hi list， Is there any specific plan or some related development for supporting the Additional Virtio Driver (* e.g Virtio Blk, Virtio RNG, Virtio Balloon), as you mentioned in READ.md of libsel4vmmplatsupport, especially for the Virtio Blk? 邮件免责申明 Email Disclaimer 本邮件仅供本邮件指定收件人使用，其所载内容可能因含有保密信息或其它原因而不得披露。除本公司及本邮件指定收件人外，任何人不得公开、传播、分发、复制、印刷或使用本邮件之任何部分或其所载之任何内容。如您误收到本邮件，请立即通知本公司，并将原始邮件、附件及其所有复本从系统中删除，切勿使用。 This email is for the use of the designated receivers only，and the content is not allowed to be disclosed due to the confidential information or other reasons. Except for the Company and the designated receivers of this email, no one shall disclose, disseminate, distribute, copy, print or use any part of this email or any content contained therein. If you receive this email by mistake, please notify the Company immediately, and delete the original email, attachments and all copies from the system. Do not use it. 网络通信可能含有计算机病毒或其它缺陷，可能无法准确和/或及时送达其它系统，亦可能受阻而不为本公司或本邮件指定收件人所知。本公司对此类错误或遗漏以及任何因使用本邮件而引致之任何损失概不承担责任。 Network communication may contain computer viruses or other defects, which may not be delivered to other systems accurately and / or in time, or may be blocked by the Company or the designated receivers of this email. The Company shall not be liable for such errors or omissions and for any loss arising from this email. 本邮件所载任何内容仅作为业务层面交流与参考，除非明确说明，本公司不对邮件所载内容之准确性、完整性或公平性等承担任何法律责任。 Any contents contained in this email are only for the purpose of business communication and reference only. Unless explicitly stated otherwise, the Company shall not assume any legal responsibility for the accuracy, completeness or fairness of the content contained in the email. 本邮件指定收件人应特别注意：本邮件所载任何内容不构成本公司对本邮件指定收件人和/或其所属商业实体的任何要约、要约邀请或承诺，任何权利义务皆以双方签字盖章的书面文件为准。除经本公司以签字盖章的书面文件确认外，收件人和/或其所属商业实体不得以本邮件所载任何内容作为其向本公司主张任何权利或利益的正式依据。 The designated receivers should pay special attention to the fact that nothing contained in this email shall constitute an offer, invitation or acceptance by the Company to the designated receivers of this email and/or its affiliated business entities, and any rights and obligations are subject to the written documents signed and sealed by both parties. Except from the written document signed ,sealed and confirmed by the Company, the receivers and / or its affiliated business entity shall not rely on anything contained in this email as the formal basis for claiming any rights or interests to the Company.

2 2

propagating initial thread's capabilities
by Sam Leffler 28 Mar '22

28 Mar '22

The rootserver gets various caps setup for it by the kernel (see Table 9.1 in the manual). This includes the gobal ASID, IRQ, Domain, and Sched controllers. I need these caps in a process created by the rootserver. This is within a CAmkES environment. So far I've created CAmkES component attributes that signal the rootserver should hand-off a cap by moving the rootserver's cap to the designated CNode just before it terminates. This involves modifications to CAmkES, capDL, and the rootserver. Is there a better way? Is there an existing example of doing this? Are any of these global objects accessible some other way than hand-off from the rootserver? -Sam

2 4

Questions about Kscurdomain variable.
by 603644559＠qq.com 25 Mar '22

25 Mar '22

In the case of multiple cores, is the scheduling of each core judged according to the kscurdomain, that is, the scheduling table of the domain is maintained by an operating system, rather than an independent kscurdomain in a core and a scheduling table of the domain in each core?

1 0

Hi,
by ezabujpz＠uuf.me 23 Mar '22

23 Mar '22

Hi, https://www.assortlist.com I would like to use network (TCP) on seL4, I know that I should probably be using lwip, however I have no idea how to properly initialize it (this is the first time I'm working in such a hardware close environment), so I need some help or some kind of example, but I don't know where to look. I'm working on ia32.

1 0

Reminder seL4 developer hangout
by Birgit Brecknell 22 Mar '22

22 Mar '22

Hi all A friendly reminder that the seL4 developer hangout is on this week: Tue, Mar 22, 9pm (UTC), Topics: (open) * Sydney: Wed, Mar 23, 8am * Central Europe: Tue, Mar 22, 10pm * US Pacific Time: Tue, Mar 22, 2pm (There are too many time zones in the world to cite them all :-)) Zoom link: https://unsw.zoom.us/j/82640784431 Cheers, Birg --- Dr. Birgit Brecknell Project Officer Trustworthy Systems, UNSW, birgit.brecknell(a)unsw.edu.au<mailto:birgit.brecknell@unsw.edu.au> seL4 Foundation, birgit(a)sel4.systems<mailto:birgit@sel4.systems> 0433 880 571 Mon 9am-5pm Wed 9am-12pm Fri 9am-5pm

3 2

Report "Failed to touch ram region" error using virtio_console when assigned for Arm-VM more than 3G memory
by Han JingLong 韩景龙 21 Mar '22

21 Mar '22

Hi I had make virtio_console work well on my environment(armv8, RAM is 8G) based on vm_multi with Linux Guest OS(512M) and Android Guest OS(<= 3G) But I meet an error(vm_ram_touch@guest_ram.c:157 Failed to touch ram region: Not registered RAM region) when assign for a VM(Android Guest OS) more than 3G memory. 1. Some logs are added for debugging this issue： +++ b/seL4_projects_libs/libsel4vmmplatsupport/src/drivers/virtio_emul.c @@ -86,6 +86,7 @@ static int emul_io_out(virtio_emul_t *emul, unsigned int offset, unsigned int si assert(size == 4); int queue = emul->virtq.queue; emul->virtq.queue_pfn[queue] = value; + printf("[hjl] queue_size:%d desc:%p\n", emul->virtq.queue_size[queue], (void *)(uintptr_t)(value << 12)); vring_init(&emul->virtq.vring[queue], emul->virtq.queue_size[queue], (void *)(uintptr_t)(value << 12), VIRTIO_PCI_VRING_ALIGN); break; +++ b/seL4_projects_libs/libsel4vmmplatsupport/src/drivers/virtio_emul_helpers.c @@ -25,10 +25,43 @@ static int write_guest_mem(vm_t *vm, uintptr_t phys, void *vaddr, size_t size, s int vm_guest_write_mem(vm_t *vm, void *data, uintptr_t address, size_t size) { + bool is_inram = false; + vm_mem_t *guest_memory = &vm->mem; + for (int i = 0; i < guest_memory->num_ram_regions; i++) { + if (guest_memory->ram_regions[i].start <= address && + guest_memory->ram_regions[i].start + guest_memory->ram_regions[i].size >= address + size) { + /* We are within a ram region*/ + is_inram = true; + } + } + + if (!is_inram) { + printf("[hjl] write mem addr:%p size:0x%lx\n", address, size); + for (int index = 0; index < guest_memory->num_ram_regions; index++) { + printf("[hjl] write mem ram_regions start:%p size:0x%lx\n", guest_memory->ram_regions[index].start, guest_memory->ram_regions[index].size); + } + } + return vm_ram_touch(vm, address, size, write_guest_mem, data); } int vm_guest_read_mem(vm_t *vm, void *data, uintptr_t address, size_t size) { + bool is_inram = false; + vm_mem_t *guest_memory = &vm->mem; + for (int i = 0; i < guest_memory->num_ram_regions; i++) { + if (guest_memory->ram_regions[i].start <= address && + guest_memory->ram_regions[i].start + guest_memory->ram_regions[i].size >= address + size) { + /* We are within a ram region*/ + is_inram = true; + } + } + + if (!is_inram) { + printf("[hjl] read mem addr:%p size:0x%lx\n", address, size); + for (int index = 0; index < guest_memory->num_ram_regions; index++) { + printf("[hjl] read mem ram_regions start:%p size:0x%lx\n", guest_memory->ram_regions[index].start, guest_memory->ram_regions[index].size); + } + } return vm_ram_touch(vm, address, size, read_guest_mem, data); } 2. The detailed log is as follows: [hjl] queue_size:128 desc:0x8eb6000 [hjl] queue_size:128 desc:0x8eb8000 [hjl] read mem addr:0x8eb8802 size:0x2 [hjl] read mem ram_regions start:0x80000000 size:0x80000 [hjl] read mem ram_regions start:0x80080000 size:0x17cda00 [hjl] read mem ram_regions start:0x8184da00 size:0xa5b2600 [hjl] read mem ram_regions start:0x8be00000 size:0x83ae98 [hjl] read mem ram_regions start:0x8c63ae98 size:0x29c5168 [hjl] read mem ram_regions start:0x8f000000 size:0x26d35 [hjl] read mem ram_regions start:0x8f026d35 size:0xc0fd92cb vm_ram_touch@guest_ram.c:157 Failed to touch ram region: Not registered RAM region 3. devices.camkes configuration reference is as follows: #define VM1_RAM_BASE 0x80000000 #define VM1_RAM_SIZE 0xD0000000 #define VM1_DTB_ADDR 0x8F000000 //VM1_RAM_BASE + 0xF000000 #define VM1_INITRD_ADDR 0x8BE00000 //VM1_DTB_ADDR - VM1_INITRD_MAX_SIZE vm1.untyped_mmios = [ "0x80000000:28", // RAM "0x90000000:28", // RAM "0xa0000000:28", // RAM "0xb0000000:28", // RAM "0xc0000000:28", // RAM "0xd0000000:28", // RAM "0xe0000000:28", // RAM "0xf0000000:28", // RAM "0x100000000:28", // RAM "0x110000000:28", // RAM "0x120000000:28", // RAM "0x130000000:28", // RAM "0x140000000:28", // RAM /* "0x150000000:28", // RAM "0x160000000:28", // RAM "0x170000000:28", // RAM "0x180000000:28", // RAM "0x190000000:28", // RAM "0x1a0000000:28", // RAM "0x1b0000000:28", // RAM */ ]; 4. Present situation: At present, I tracked and found that When the Guest OS's virtio_console driver do the probe, it created the vring and iowrite to notify VMM of the virtqueue desc 's physical address in setup_vq() /* create the vring */ static void *vring_alloc_queue(struct virtio_device *vdev, size_t size, dma_addr_t *dma_handle, gfp_t flag) { ...... void *queue = alloc_pages_exact(PAGE_ALIGN(size), flag); if (queue) { phys_addr_t phys_addr = virt_to_phys(queue); *dma_handle = (dma_addr_t)phys_addr; /* activate the queue */ iowrite32(virtqueue_get_desc_addr(vq) >> VIRTIO_PCI_QUEUE_ADDR_SHIFT, vp_dev->ioaddr + VIRTIO_PCI_QUEUE_PFN); I'm very confused why is the physical memory allocated for virtqueue desc not within the effective memory range of VM when assign the memory to it exceeds 3G? BR. Allen 邮件免责申明 Email Disclaimer 本邮件仅供本邮件指定收件人使用，其所载内容可能因含有保密信息或其它原因而不得披露。除本公司及本邮件指定收件人外，任何人不得公开、传播、分发、复制、印刷或使用本邮件之任何部分或其所载之任何内容。如您误收到本邮件，请立即通知本公司，并将原始邮件、附件及其所有复本从系统中删除，切勿使用。 This email is for the use of the designated receivers only，and the content is not allowed to be disclosed due to the confidential information or other reasons. Except for the Company and the designated receivers of this email, no one shall disclose, disseminate, distribute, copy, print or use any part of this email or any content contained therein. If you receive this email by mistake, please notify the Company immediately, and delete the original email, attachments and all copies from the system. Do not use it. 网络通信可能含有计算机病毒或其它缺陷，可能无法准确和/或及时送达其它系统，亦可能受阻而不为本公司或本邮件指定收件人所知。本公司对此类错误或遗漏以及任何因使用本邮件而引致之任何损失概不承担责任。 Network communication may contain computer viruses or other defects, which may not be delivered to other systems accurately and / or in time, or may be blocked by the Company or the designated receivers of this email. The Company shall not be liable for such errors or omissions and for any loss arising from this email. 本邮件所载任何内容仅作为业务层面交流与参考，除非明确说明，本公司不对邮件所载内容之准确性、完整性或公平性等承担任何法律责任。 Any contents contained in this email are only for the purpose of business communication and reference only. Unless explicitly stated otherwise, the Company shall not assume any legal responsibility for the accuracy, completeness or fairness of the content contained in the email. 本邮件指定收件人应特别注意：本邮件所载任何内容不构成本公司对本邮件指定收件人和/或其所属商业实体的任何要约、要约邀请或承诺，任何权利义务皆以双方签字盖章的书面文件为准。除经本公司以签字盖章的书面文件确认外，收件人和/或其所属商业实体不得以本邮件所载任何内容作为其向本公司主张任何权利或利益的正式依据。 The designated receivers should pay special attention to the fact that nothing contained in this email shall constitute an offer, invitation or acceptance by the Company to the designated receivers of this email and/or its affiliated business entities, and any rights and obligations are subject to the written documents signed and sealed by both parties. Except from the written document signed ,sealed and confirmed by the Company, the receivers and / or its affiliated business entity shall not rely on anything contained in this email as the formal basis for claiming any rights or interests to the Company.

1 0

A question about capability derivation tree
by Chang Liu 18 Mar '22

18 Mar '22

Hi list, Here is a question about capability derivation trees, in particular when it comes to seL4_CNode_Copy and seL4_CNode_Mint. Suppose I have an untyped cap Untyped0, and I create a page cap by retyping Untyped0 into Frame0 (with seL4_AllRights). I then call CNode_Mint to mint Frame0 into Frame1 with restricted rights (say read-only). Finally, I call CNode_Copy to copy Frame1 into Frame2. What would the capability derivation tree look like at the end? Case 1: |--------| |Untyped0| |--------| / | \ / | \ / | \ |------| |------| |------| |Frame0| |Frame1| |Frame2| |------| |------| |------| Case 2: |--------| |Untyped0| |--------| | |------| |Frame0| |------| | |------| |Frame1| |------| | |------| |Frame2| |------| Case 3: |--------| |Untyped0| |--------| | |------| |Frame0| |------| / \ / \ |------| |------| |Frame1| |Frame2| |------| |------| Which one of the above is the correct answer? I suspect it's case 3, but I'm not sure. Best, Chang

1 0

Sel4 VMM Virtio Net Related Porting on Other SOC
by Tao Heng 陶恒-SW 11 Mar '22

11 Mar '22

Finally, I figured out the root cause of this issue. It happened when I changed the mac address of the virtio net probed for the vm guest. According to the issue, It seemed that the virtio_net driver of the libsel4vmmsupport did not support emulating the io control for changing the mac addess of the virtio net in the guest. 发件人: Tao Heng 陶恒-SW 发送时间: 2022年3月9日 14:49 收件人: 'devel(a)sel4.systems' <devel(a)sel4.systems> 主题: Sel4 VMM Virtio Net Related Porting on Other SOC Hi everyone , Background: I was porting vm_virtio_net project on other platforms with Cortex-A55. I met a run error with : ----------------------------------------- Unhandled offset of 0x14 of size 1, writing 0x2 Assertion failed: !"panic" (/home/kuang/workspace/penoy/system/core/seL4_projects_libs/seL4_projects_libs/libsel4vmmplatsupport/src/drivers/virtio_emul.c: emul_io_out: 109) --------------------------------------------------- While it ran well on qemu with linux kernel version 4.9.189, my linux kernel version for the SOC is 4.14.61. If I replaced the qemu linux kernel with my kernel, the vm_virtio_net project also ran well on the qemu platform. To my analyzation, your virtio_net driver should be able to support for my platform. Is this related to my dts configuration for PCI node? 邮件免责申明 Email Disclaimer 本邮件仅供本邮件指定收件人使用，其所载内容可能因含有保密信息或其它原因而不得披露。除本公司及本邮件指定收件人外，任何人不得公开、传播、分发、复制、印刷或使用本邮件之任何部分或其所载之任何内容。如您误收到本邮件，请立即通知本公司，并将原始邮件、附件及其所有复本从系统中删除，切勿使用。 This email is for the use of the designated receivers only，and the content is not allowed to be disclosed due to the confidential information or other reasons. Except for the Company and the designated receivers of this email, no one shall disclose, disseminate, distribute, copy, print or use any part of this email or any content contained therein. If you receive this email by mistake, please notify the Company immediately, and delete the original email, attachments and all copies from the system. Do not use it. 网络通信可能含有计算机病毒或其它缺陷，可能无法准确和/或及时送达其它系统，亦可能受阻而不为本公司或本邮件指定收件人所知。本公司对此类错误或遗漏以及任何因使用本邮件而引致之任何损失概不承担责任。 Network communication may contain computer viruses or other defects, which may not be delivered to other systems accurately and / or in time, or may be blocked by the Company or the designated receivers of this email. The Company shall not be liable for such errors or omissions and for any loss arising from this email. 本邮件所载任何内容仅作为业务层面交流与参考，除非明确说明，本公司不对邮件所载内容之准确性、完整性或公平性等承担任何法律责任。 Any contents contained in this email are only for the purpose of business communication and reference only. Unless explicitly stated otherwise, the Company shall not assume any legal responsibility for the accuracy, completeness or fairness of the content contained in the email. 本邮件指定收件人应特别注意：本邮件所载任何内容不构成本公司对本邮件指定收件人和/或其所属商业实体的任何要约、要约邀请或承诺，任何权利义务皆以双方签字盖章的书面文件为准。除经本公司以签字盖章的书面文件确认外，收件人和/或其所属商业实体不得以本邮件所载任何内容作为其向本公司主张任何权利或利益的正式依据。 The designated receivers should pay special attention to the fact that nothing contained in this email shall constitute an offer, invitation or acceptance by the Company to the designated receivers of this email and/or its affiliated business entities, and any rights and obligations are subject to the written documents signed and sealed by both parties. Except from the written document signed ,sealed and confirmed by the Company, the receivers and / or its affiliated business entity shall not rely on anything contained in this email as the formal basis for claiming any rights or interests to the Company.

2 1

Sel4 VMM Virtio Net Related Porting on Other SOC
by Tao Heng 陶恒-SW 09 Mar '22

09 Mar '22

Hi everyone , Background: I was porting vm_virtio_net project on other platforms with Cortex-A55. I met a run error with : ----------------------------------------- Unhandled offset of 0x14 of size 1, writing 0x2 Assertion failed: !"panic" (/home/kuang/workspace/penoy/system/core/seL4_projects_libs/seL4_projects_libs/libsel4vmmplatsupport/src/drivers/virtio_emul.c: emul_io_out: 109) --------------------------------------------------- While it ran well on qemu with linux kernel version 4.9.189, my linux kernel version for the SOC is 4.14.61. If I replaced the qemu linux kernel with my kernel, the vm_virtio_net project also ran well on the qemu platform. To my analyzation, your virtio_net driver should be able to support for my platform. Is this related to my dts configuration for PCI node? 邮件免责申明 Email Disclaimer 本邮件仅供本邮件指定收件人使用，其所载内容可能因含有保密信息或其它原因而不得披露。除本公司及本邮件指定收件人外，任何人不得公开、传播、分发、复制、印刷或使用本邮件之任何部分或其所载之任何内容。如您误收到本邮件，请立即通知本公司，并将原始邮件、附件及其所有复本从系统中删除，切勿使用。 This email is for the use of the designated receivers only，and the content is not allowed to be disclosed due to the confidential information or other reasons. Except for the Company and the designated receivers of this email, no one shall disclose, disseminate, distribute, copy, print or use any part of this email or any content contained therein. If you receive this email by mistake, please notify the Company immediately, and delete the original email, attachments and all copies from the system. Do not use it. 网络通信可能含有计算机病毒或其它缺陷，可能无法准确和/或及时送达其它系统，亦可能受阻而不为本公司或本邮件指定收件人所知。本公司对此类错误或遗漏以及任何因使用本邮件而引致之任何损失概不承担责任。 Network communication may contain computer viruses or other defects, which may not be delivered to other systems accurately and / or in time, or may be blocked by the Company or the designated receivers of this email. The Company shall not be liable for such errors or omissions and for any loss arising from this email. 本邮件所载任何内容仅作为业务层面交流与参考，除非明确说明，本公司不对邮件所载内容之准确性、完整性或公平性等承担任何法律责任。 Any contents contained in this email are only for the purpose of business communication and reference only. Unless explicitly stated otherwise, the Company shall not assume any legal responsibility for the accuracy, completeness or fairness of the content contained in the email. 本邮件指定收件人应特别注意：本邮件所载任何内容不构成本公司对本邮件指定收件人和/或其所属商业实体的任何要约、要约邀请或承诺，任何权利义务皆以双方签字盖章的书面文件为准。除经本公司以签字盖章的书面文件确认外，收件人和/或其所属商业实体不得以本邮件所载任何内容作为其向本公司主张任何权利或利益的正式依据。 The designated receivers should pay special attention to the fact that nothing contained in this email shall constitute an offer, invitation or acceptance by the Company to the designated receivers of this email and/or its affiliated business entities, and any rights and obligations are subject to the written documents signed and sealed by both parties. Except from the written document signed ,sealed and confirmed by the Company, the receivers and / or its affiliated business entity shall not rely on anything contained in this email as the formal basis for claiming any rights or interests to the Company.

1 0

Does the CSpace needs to have a cap to the TCB
by Sid Agrawal 09 Mar '22

09 Mar '22

Hi, We roughly do the following steps when setting up a new process in seL4: - Allocate a new TCB - Allocate new CSpace - Make the TCB point to the CSpace - Construct the VSpace and add the relevant caps in the new CSpace - Update the VSpace cap in the TCB. - Add a copy of the TCB cap in the new CSpace. (I am looking at the process spawn function in libesel4utils at: https://github.com/seL4/seL4_libs/blob/master/libsel4utils/src/process.c#L4…) My question is about the last point i.e. copying of TCB to the new CSpace. If I want to restrict the new domain from changing its VSpace, suspend itself, and change its fault handlers, I would simply not do the last step. Will that work? Is there any fundamental need for the TCB cap to be in the cspace it points to? Thanks, Sidhartha Agrawal

2 1

vm_multi usage
by Michael Neises 08 Mar '22

08 Mar '22

Hi, I'm just beginning to use multiple VMs at once, and I have a simple question. When I simulate my image, two VMs are running, and I get a terminal interface to one of them. Can I also switch my terminal to interface with the second VM? Cheers, Michael Neises

2 1

Re: I Have some questions about the domain mechanism in the seL4
by Isaac Beckett 08 Mar '22

08 Mar '22

> Date: Sat, 5 Mar 2022 19:15:05 +1100 > From: Kent Mcleod <kent.mcleod72(a)gmail.com> > Subject: [seL4] Re: I Have some questions about the domain mechanism > in the seL4 > To: 603644559(a)qq.com > Cc: devel <devel(a)sel4.systems> > Message-ID: > <CA+-ozWdgMgBin34WBUoVL+uHSNfU=e852ekPgrNGZ5J7+nyN0g(a)mail.gmail.com> > Content-Type: text/plain; charset="UTF-8" > >> On Sat, Mar 5, 2022 at 6:11 PM 603644559--- via Devel >> <devel(a)sel4.systems> wrote: >> >> For some reason, i m learning the scheduling module in seL4. I have read the manual and the source code, and i have already read the answer in the link https://lists.sel4.systems/hyperkitty/list/devel@sel4.systems/thread/VYRTG3… >> But i still do not know the purpose of adding the domain mechanism in seL4, >> Can anyone explain what kind of requirement led to the design of the domain mechanism? >> Please explain it more specifically, and it would be best if there were relevant documents and papers on the domain mechanism. > > It was added in order to enable the completion of the info-flow proofs. > >> From the infoflow proof paper > (https://trustworthy.systems/publications/nicta_full_text/6464.pdf) > where it is called the partition scheduler: > "Similarly, the original seL4 scheduler, before partition > scheduling was implemented, was known not to enforce > isolation. We could not prove information flow security until > we had fully and correctly specified the partition scheduler > in the updated abstract specification. Proving information > flow security then required us to show that the scheduler’s > choice about which partition to schedule next can never be > affected by any other partition, as one would expect." Hello! It was my understanding that seL4 used to not have an in-kernel scheduler, and scheduling was up to the root task. How did that work? And why was the choice made to add the MCS features? Basically, why the change from having scheduling in the kernel vs. in userspace? It’s probably more convenient, especially since most operating systems are used to having scheduling in the kernel itself (so easier for people to think about). There are probably more technical reasons too. What are those?

2 3

I Have some questions about the domain mechanism in the seL4
by 603644559＠qq.com 07 Mar '22

07 Mar '22

For some reason, i m learning the scheduling module in seL4. I have read the manual and the source code, and i have already read the answer in the link https://lists.sel4.systems/hyperkitty/list/devel@sel4.systems/thread/VYRTG3… But i still do not know the purpose of adding the domain mechanism in seL4, Can anyone explain what kind of requirement led to the design of the domain mechanism? Please explain it more specifically, and it would be best if there were relevant documents and papers on the domain mechanism.

2 2

Reminder: sel4 developer hangout
by Birgit Brecknell 07 Mar '22

07 Mar '22

Hi all A friendly reminder that the seL4 developer hangout is on this week: Tue, Mar 22, 9pm (UTC), Topics: (open) * Sydney: Wed, Mar 23, 8am * Central Europe: Tue, Mar 22, 10pm * US Pacific Time: Tue, Mar 22, 1pm (There are too many time zones in the world to cite them all :)) Zoom link: https://unsw.zoom.us/j/82640784431 Cheers, Birg --- Dr. Birgit Brecknell Project Officer Trustworthy Systems, UNSW, birgit.brecknell(a)unsw.edu.au seL4 Foundation, birgit(a)sel4.systems 0433 880 571 Mon 9am-5pm Wed 9am-12pm Fri 9am-5pm

1 0

Questions about shared page tables and Intel's MPK
by Sid Agrawal 06 Mar '22

06 Mar '22

Hi, I have a couple of questions about the virtual memory subsystem in seL4. 1. Intel's Memory Protection keys let a process restrict the access to given virtual address ranges based on a key. This key is the bit 62:59 of the virtual address. It is stored in the PTE of the level 4/5 Page Table. I want to use this feature in my project. Does seL4 support the setting of Memory Protection keys for virtual addresses? I couldn't find any mention of it in the source. I understand that if I use the current API of "seL4_X86_PageTable_Map" with those higher bits of the vaddr set, the kernel will ignore them. Is my understanding correct? Furthermore, was a decision made not to support MPK at some point? 2. As per section 7.3 of the seL4 manual, seL4 doesn't allow sharing of page tables. I am trying to understand the reasoning behind this. Was this done to aid verification? Thanks, Sidhartha S Agrawal

3 4

libsel4muslcsys: Error attempting syscall 215
by skydivebcn＠gmail.com 05 Mar '22

05 Mar '22

Hi guys, I was trying to boot a custom Linux 4.9.302 Kernel and fot this horrible message: "libsel4muslcsys: Error attempting syscall 215" hugo@dev:~/seL4/sel4webserver_hugusmaximus_fork/build$ sudo ./simulate --extra-qemu-args="-netdev tap,id=mynet0,ifname=tap0,script=no,downscript=no -device virtio-net,netdev=mynet0,mac=52:55:00:d1:55:01,disable-modern=on,disable-legacy=off" [sudo] contraseña para hugo: ./simulate: qemu-system-aarch64 -machine virt,virtualization=on,highmem=off,secure=off -cpu cortex-a53 -nographic -m size=2048 -netdev tap,id=mynet0,ifname=tap0,script=no,downscript=no -device virtio-net,netdev=mynet0,mac=52:55:00:d1:55:01,disable-modern=on,disable-legacy=off -kernel images/capdl-loader-image-arm-qemu-arm-virt ELF-loader started on CPU: ARM Ltd. Cortex-A53 r0p4 paddr=[61bf9000..631120af] No DTB passed in from boot loader. Looking for DTB in CPIO archive...found at 61d3a2b8. Loaded DTB from 61d3a2b8. paddr=[60243000..60244fff] ELF-loading image 'kernel' to 60000000 paddr=[60000000..60242fff] vaddr=[ff8060000000..ff8060242fff] virt_entry=ff8060000000 ELF-loading image 'capdl-loader' to 60245000 paddr=[60245000..617fdfff] vaddr=[400000..19b8fff] virt_entry=408f38 Enabling hypervisor MMU and paging Jumping to kernel-image entry point... Bootstrapping kernel Warning: Could not infer GIC interrupt target ID, assuming 0. Booting all finished, dropped to user space <<seL4(CPU 0) [decodeUntypedInvocation/205 T0xff80bf815400 "rootserver" @4006f8]: Untyped Retype: Insufficient memory (1 * 2097152 bytes needed, 0 bytes available).>> Loading Linux: 'linux' dtb: 'linux-dtb' install_linux_devices@main.c:655 module name: map_frame_hack install_linux_devices@main.c:655 module name: init_ram install_linux_devices@main.c:655 module name: cross_vm_connections libsel4muslcsys: Error attempting syscall 215 libsel4muslcsys: Error attempting syscall 215 _utspace_split_alloc@split.c:266 Failed to find any untyped capable of creating an object at address 0x8020000 as this is purely an seL4 error message (musl libc seL4 code?) then I would appreciate any hint about what can be going on. P.S.: I have run my seL4 qemu aarch64 with several Linux kernel versions and never had this problem until now.

2 1

Sel4 VMM Virtio Net Related Porting on Other SOC
by Tao Heng 陶恒-SW 04 Mar '22

04 Mar '22

Hi everyone , Background: I was porting vm_virtio_net project on other platforms with Cortex-A55. I met a run error with : ----------------------------------------- Unhandled offset of 0x14 of size 1, writing 0x2 Assertion failed: !"panic" (/home/kuang/workspace/penoy/system/core/seL4_projects_libs/seL4_projects_libs/libsel4vmmplatsupport/src/drivers/virtio_emul.c: emul_io_out: 109) --------------------------------------------------- While it ran well on qemu with linux kernel version 4.9.189, my linux kernel version for the SOC is 4.14.61. If I replaced the qemu linux kernel with my kernel, the vm_virtio_net project also ran well on the qemu platform. To my analyzation, your virtio_net driver should be able to support for my platform. Is this related to my dts configuration for PCI node? 邮件免责申明 Email Disclaimer 本邮件仅供本邮件指定收件人使用，其所载内容可能因含有保密信息或其它原因而不得披露。除本公司及本邮件指定收件人外，任何人不得公开、传播、分发、复制、印刷或使用本邮件之任何部分或其所载之任何内容。如您误收到本邮件，请立即通知本公司，并将原始邮件、附件及其所有复本从系统中删除，切勿使用。 This email is for the use of the designated receivers only，and the content is not allowed to be disclosed due to the confidential information or other reasons. Except for the Company and the designated receivers of this email, no one shall disclose, disseminate, distribute, copy, print or use any part of this email or any content contained therein. If you receive this email by mistake, please notify the Company immediately, and delete the original email, attachments and all copies from the system. Do not use it. 网络通信可能含有计算机病毒或其它缺陷，可能无法准确和/或及时送达其它系统，亦可能受阻而不为本公司或本邮件指定收件人所知。本公司对此类错误或遗漏以及任何因使用本邮件而引致之任何损失概不承担责任。 Network communication may contain computer viruses or other defects, which may not be delivered to other systems accurately and / or in time, or may be blocked by the Company or the designated receivers of this email. The Company shall not be liable for such errors or omissions and for any loss arising from this email. 本邮件所载任何内容仅作为业务层面交流与参考，除非明确说明，本公司不对邮件所载内容之准确性、完整性或公平性等承担任何法律责任。 Any contents contained in this email are only for the purpose of business communication and reference only. Unless explicitly stated otherwise, the Company shall not assume any legal responsibility for the accuracy, completeness or fairness of the content contained in the email. 本邮件指定收件人应特别注意：本邮件所载任何内容不构成本公司对本邮件指定收件人和/或其所属商业实体的任何要约、要约邀请或承诺，任何权利义务皆以双方签字盖章的书面文件为准。除经本公司以签字盖章的书面文件确认外，收件人和/或其所属商业实体不得以本邮件所载任何内容作为其向本公司主张任何权利或利益的正式依据。 The designated receivers should pay special attention to the fact that nothing contained in this email shall constitute an offer, invitation or acceptance by the Company to the designated receivers of this email and/or its affiliated business entities, and any rights and obligations are subject to the written documents signed and sealed by both parties. Except from the written document signed ,sealed and confirmed by the Company, the receivers and / or its affiliated business entity shall not rely on anything contained in this email as the formal basis for claiming any rights or interests to the Company.

1 0

seL4 Native Web-browser
by Daniel Douglas Dyrseth 04 Mar '22

04 Mar '22

Hi, everyone What parts are needed besides seL4 to get a fully functioning Chromium browser running in a Wayland server? (No virtual OS inside seL4). I'm talking native seL4 OS capable of running Chromium with all features. Hoping for some insightful answers, and at least a list from a Pro - of the minimum parts needed for this. Regards, Daniel Douglas Dyrseth

2 1

Call for support contract to the seL4 Foundation
by Birgit Brecknell 25 Feb '22

25 Feb '22

A friendly reminder that bids are due before March 4th, 2022 AOE: The seL4 foundation is seeking to contract support for the following duties: - address open github issues in the seL4 organisation repositories, with prioritisation directed by the TSC delegates; this includes: - documentation, tutorials - bugs - tests - docsite and possibly website in coordination with Foundation people - help keeping an eye on making sure questions on mailing lists, discourse and github issues are answered (by someone) Requirement for the person working on these tasks are: - multiple years of experience with seL4, both at kernel level and user-level code - good familiarity with the seL4 organisation repositories - active contributor to one or more seL4 repositories - fluent in written and spoken English The seL4 foundation would contract a service company, initially for 6 months. The service company should identify the person that will be performing the work, ideally on a full-time basis. To bid for the contract, send email to foundation(a)sel4.systems before March 4th, 2022 AOE, with the resume of the person that will be performing the work and a cover letter addressing the requirements. --- Dr. Birgit Brecknell Project Officer Trustworthy Systems, UNSW, birgit.brecknell(a)unsw.edu.au seL4 Foundation, birgit(a)sel4.systems 0433 880 571 Mon 9am-5pm Wed 9am-12pm Fri 9am-5pm

1 0

Re: Announcing Neptune OS release v0.1.1: A Windows NT personality for seL4
by Chang Liu 24 Feb '22

24 Feb '22

Thank you both for the discussion on licensing. Seems that GPLv3 is a good choice for now. Wikipedia seems to claim that ReactOS is licensed under "GPLv2 or any later version" but I didn't find this on the reactos source code itself. If the ReactOS foundation has an objection later I can always change it to v2. Best, Chang On Wed, Feb 23, 2022 at 12:09 AM G. Branden Robinson < g.branden.robinson(a)gmail.com> wrote: > Hi Chamg, > > At 2022-02-22T23:29:21-0500, Chang Liu wrote: > > I just added a LICENSE file which is GPLv3. > > Good choice! > > > I'm honestly not sure what the difference between GPLv2 and GPLv3 > > There are modest differences, but the general thrust of both versions of > the license is the same: guaranteed access to source code under a "share > and share alike" principle. > > > is so I went with the latest version (I assume they are compatible?) > > Technically, no. But most GPLv2 software is licensed under terms that > allow promotion of the license to "any later version". One famous > example of an exception that is GPLv2-only is the Linux kernel. > So is seL4 itself[1]. Consider whether you expect to need to share code > with a GPLv2-only project. (Even if you do, I would only revisit your > decision once concrete code-sharing is imminent.) > > You're not stuck with a choice of a single license forever. The GPLv3 > is a good selection to start with (in my opinion) because most > organizations that would like to exploit a work for proprietary > advantage are allergic to that license. > > You can always relicense a work under more permissive terms later if > doing so would align better with your goals. Going from more permissive > terms (like a BSD-style license) to a copyleft (like any version of the > GPL) can be impractical, or result in unintended consequences, because > it is arguably impossible to rescind the permissive license on the older > versions of the code--unless you have an Apple- or Oracle-sized budget > for lawyers to intimidate rivals maintaining the old code base. > > There is probably a better forum for licensing discussions, but my view > is that you've made a perfectly reasonable choice, one that situates > your project squarely and clearly within the Free Software community, > while still leaving you the option to reconsider later. > > Regards, > Branden > > [1] https://microkerneldude.org/2019/12/09/what-does-sel4s-license-imply/ >

1 0

Announcing Neptune OS release v0.1.1: A Windows NT personality for seL4
by Chang Liu 23 Feb '22

23 Feb '22

Hi list, For the past several months I have been working on a project which is to implement a Windows NT personality for the seL4 microkernel, which I have now taken to call “Neptune OS”, named after the codename for Windows 2000. The project has reached the point where I have implemented enough NT primitives such that a keyboard driver stack (taken from the ReactOS source code) can be loaded (as a user process), as well as a command prompt (shell), which is also taken from the ReactOS source code (albeit a very early version of ReactOS). These are all kernel-mode Windows device drivers that I’m running as user processes under seL4. The project is now on github: github.com/cl91/NeptuneOS. The entire system fits in a floppy (download link: github.com/cl91/NeptuneOS/releases/tag/v0.1.0001) Check it out! I think it’s cool! For the next release I’m planning to port the PCI stack, the AHCI stack, and a basic file system (probably fastfat.sys).

4 5

seL4 developer hangout/video call
by Birgit Brecknell 21 Feb '22

21 Feb '22

Hi all A friendly reminder that the seL4 developer hangout is on this week: * Sydney: Wed, Feb 23, 8am * Central Europe: Tue, Feb 22, 10pm * US Pacific Time: Tue, Feb 22, 1pm (There are too many time zones in the world to cite them all :)) Zoom link: https://unsw.zoom.us/j/82640784431 Cheers, Birg --- Dr. Birgit Brecknell Project Officer Trustworthy Systems, UNSW, birgit.brecknell(a)unsw.edu.au seL4 Foundation, birgit(a)sel4.systems 0433 880 571 Mon 9am-5pm Wed 9am-12pm Fri 9am-5pm

1 0

Ability to change bench app options for RiscV
by Nataliya Korovkina 12 Feb '22

12 Feb '22

Hi, Does anyone remember why sel4bench configuration for RiscV was not allowed to change bench app options? If it was skipped because it was not necessary then I'd like to fix it. I would add a line to https://github.com/seL4/sel4bench/blob/master/apps/sel4bench/CMakeLists.txt --- a/apps/sel4bench/CMakeLists.txt +++ b/apps/sel4bench/CMakeLists.txt @@ -35,14 +35,15 @@ config_string( # Default dependencies on kernel benchmarking features. Declared here so that # all the benchmark applications can use it if( (KernelArchX86 AND KernelExportPMCUser AND KernelX86DangerousMSR) OR (KernelArchARM AND KernelArmExportPMUUser) OR (KernelArchArmCortexA8 AND KernelDangerousCodeInjection) + OR (KernelArchRiscV) ) set(DefaultBenchDeps TRUE) else() set(DefaultBenchDeps FALSE) endif() find_package(musllibc REQUIRED) Thanks, Nataliya

2 1

How to build compile seL4 along with another C++ project that includes <stdlib.h>
by christinefragoso＠protonmail.com 12 Feb '22

12 Feb '22

I want to run my C++ project in a camkes image for i.mx6. This image should be statically linked. I have a camkes app in https://github.com/seL4/camkes-manifest. The app's CMakeLists.txt includes my project with add_subdirectory("${CMAKE_CURRENT_LIST_DIR}/workspace_DDSHelloWorld"), which is a simple DDS example https://fast-dds.docs.eprosima.com/en/latest/fastdds/getting_started/simple… that also uses CMake as its build system. The entire app is built with ../init-build.sh -DPLATFORM=sabre -DCAMKES_APP=dds. However, the build fails. 1. My project includes <stdint.h>, but sel4 uses the -nostdinc and -nostdinc++ flags, so I get the error "stdint.h: No such file or directory". How do I make my C++ project include seL4's musllibc instead? 2. My project includes other C++ headers like <functional>. Is there any way to build seL4 with C++ headers?

2 1

testing rust program in sel4webserver example project
by lfern70＠gmail.com 12 Feb '22

12 Feb '22

Hi, I am trying to compile a simple rust web server to be executed in the virtual machine (as lighthttpd works in this webserver project). This server works perfect (I am using qemu for testing -aarch64), but when I try to get some random bytes using the rand crate the program hangs: .... let mut key = vec![0u8; 32]; rand::thread_rng().fill_bytes(&mut key); ... Do anybody knows if this could be related to some missing settings (in qemu command line or in some device.camkes file) or some rust features that don't work in a sel4 VM?? Thanks

2 1

Call for support contract to the seL4 Foundation
by June Andronick (seL4 Foundation) 11 Feb '22

11 Feb '22

The seL4 foundation is seeking to contract support for the following duties: - address open github issues in the seL4 organisation repositories, with prioritisation directed by the TSC delegates; this includes: - documentation, tutorials - bugs - tests - docsite and possibly website in coordination with Foundation people - help keeping an eye on making sure questions on mailing lists, discourse and github issues are answered (by someone) Requirement for the person working on these tasks are: - multiple years of experience with seL4, both at kernel level and user-level code - good familiarity with the seL4 organisation repositories - active contributor to one or more seL4 repositories - fluent in written and spoken English The seL4 foundation would contract a service company, initially for 6 months. The service company should identify the person that will be performing the work, ideally on a full-time basis. To bid for the contract, send email to foundation(a)sel4.systems before March 4th, 2022 AOE, with the resume of the person that will be performing the work and a cover letter addressing the requirements.

1 0

picoserver and qemu
by lfern70＠gmail.com 08 Feb '22

08 Feb '22

Hi, I am trying to test picoserver app in qemu, but I am not able to connect to the echo component on port 1234. These are the steps I am following, please, let me know if I am doing something wrong. Thanks in advance: $ repo init -u https://github.com/seL4/camkes-manifest.git $ repo sync # use docker container to compile $ container @in-container:/host$ mkdir build @in-container:/host$ cd build @in-container:/host$ ../init_build.sh -DCAMKES_APP=picoserver -DPICOSERVER_IP_ADDR=127.0.0.1 -DSIMULATION=1 @in-container:/host$ ninja Everything seems to be ok, but when I tried to execute in qemu: $ sudo ./simulate --machine q35,accel=kvm,kernel-irqchip=split --mem-size 2G --extra-cpu-opts "+vmx" --extra-qemu-args="--enable-kvm -device intel-iommu,intremap=on,caching-mode=on -netdev user,id=network0,hostfwd=tcp::1234-:1234 -device e1000e,netdev=network0" It seems the echo component is listening on port 1234, but if I try to send data with "netcat 127.0.0.1 1234" I can't reach the echo component ...... IOMMU 0x0: enabling... enabled Booting all finished, dropped to user space Protocol ethernet registered (layer: 2). Protocol ipv4 registered (layer: 3). Protocol ipv6 registered (layer: 3). Protocol icmp4 registered (layer: 4). Protocol icmp6 registered (layer: 4). Protocol igmp registered (layer: 4). Protocol udp registered (layer: 4). Protocol tcp registered (layer: 4). listener instance starting up, going to be listening on 192.168.0.21:4321 echo instance starting up, going to be listening on 192.168.0.21:1234

2 3

seL4 developer hangout/video call
by June Andronick (seL4 Foundation) 07 Feb '22

07 Feb '22

Friendly reminder that the seL4 developer hangout is on this week: - Sydney: Wed, Feb 9, 8am - Central Europe: Tue, Feb 8, 10pm - US Pacific Time: Tue, Feb 8, 1pm (There are too many time zones in the world to cite them all :)) Zoom link: https://unsw.zoom.us/j/82640784431 Cheers, June

1 0

seL4 on TX1
by yjy 31 Jan '22

31 Jan '22

Help me! I am running sel4test on my TX1 according to the official tutorial, but I get a problem again and again. For the newly purchased TX1, I directly connected my Ubuntu host with UART serial port. At the same time, I follow this instruction ( https://docs.sel4.systems/Hardware/jetsontx1.html ), pulled the latest sel4test project code, successfully ran ninja command and built images "sel4test-driver-image-arm-tx1". Everything seemed to be going very smoothly. I use the newly purchased SanDisk 64GB SD card to boot my image, which has been formatted in ext4 format. Then I use command `sudo screen / dev / ttyusb0 115200` to open the UART serial port. After pressing and holding the power key for 1 second, and TX1 starts. Then I hit the Enter key to make TX1 cancel the auto boot default image and enter the u-boot interactive command line. Then, according to the instruction, under uboot, I typed the following command to load the image and start from the address 0x82000000: ``` ext4load mmc 1 0x82000000 sel4test-driver-image-arm-tx1 go 0x82000000 ``` Finally, I failed to start sel4test as I wanted. After many repetitions, I got the same error. This is my output： ------------------------------------------------------------------------------------------------------------------------------------------ Tegra210 (P2371-2180) # ext4load mmc 1 0x82000000 sel4test-driver-image-arm-tx1 5247256 bytes read in 260 ms (19.2 MiB/s) Tegra210 (P2371-2180) # go 0x82000000 ## Starting application at 0x82000000 ... ELF-loader started on CPU: ARM Ltd. Cortex-A57 r1p1 paddr=[80a57000..80f58117] No DTB passed in from boot loader. Looking for DTB in CPIO archive...found at 80b825e0. Loaded DTB from 80b825e0. paddr=[8023d000..8024afff] ELF-loading image 'kernel' to 80000000 paddr=[80000000..8023cfff] vaddr=[ffffff8080000000..ffffff808023cfff] virt_entry=ffffff8080000000 ELF-loading image 'sel4test-driver' to 8024b000 paddr=[8024b000..80661fff] vaddr=[400000..816fff] virt_entry=40f0b8 Enabling MMU and paging Jumping to kernel-image entry point... Warning: gpt_cntfrq 19200000, expected 12000000 Bootstrapping kernel available phys memory regions: 2 [80000000..ff000000] [100000000..180000000] reserved virt address space regions: 3 [ffffff8080000000..ffffff808023d000] [ffffff808023d000..ffffff808024b000] [ffffff808024b000..ffffff8080662000] seL4 failed assertion 'cap_get_capType(destSlot->cap) == cap_null_cap' at /home/yjy/Desktop/sel4-rpi/sel4test_newv2/kernel/src/object/cnode.c:426 in function cteInsert halting... Kernel entry via Interrupt, irq 0 ------------------------------------------------------------------------------------------------------------------------------------------ I'm about to collapse. I really need your help. How can I solve this problem? 1. Why did I get this warning？ "Warning: gpt_cntfrq 19200000, expected 12000000" , It exists in this file "/sel4test/kernel/src/drivers/timer/generic_timer.c:21" 2. About reporting errors "failed assertion 'cap_get_capType(destSlot->cap) == cap_null_cap'". I found that the variable "(slot_ptr_t) (rootserver.tcb) ) -> cap.words[0] " is equals to 0xffffffffffffffff, so that the cap_get_capType(destSlot->cap) <=> (slot_ptr_t) (rootserver.tcb) ) -> cap.words[0] & 0x1full != 0 . I guess it caused the mistake, but i don't know why. I'm about to collapse. I really need your help. How can I solve this problem? I'm sorry for sending this email again!

2 3

Re: seL4 on TX1
by 杨竣轶 30 Jan '22

30 Jan '22

I did’t get any difference about my error except the address. Is my Uboot precedure errored? 从 Windows 版邮件发送

1 0

seL4test on Nvidia TX1
by yjy7894＠126.com 28 Jan '22

28 Jan '22

Help me! I am running sel4test on my TX1 according to the official tutorial, but I get a problem again and again. For the newly purchased TX1, I directly connected my Ubuntu host with UART serial port. At the same time, I follow this instruction ( https://docs.sel4.systems/Hardware/jetsontx1.html ), pulled the latest sel4test project code, successfully ran ninja command and built images "sel4test-driver-image-arm-tx1". Everything seemed to be going very smoothly. I use the newly purchased SanDisk 64GB SD card to boot my image, which has been formatted in ext4 format. Then I use command `sudo screen / dev / ttyusb0 115200` to open the UART serial port. After pressing and holding the power key for 1 second, and TX1 starts. Then I hit the Enter key to make TX1 cancel the auto boot default image and enter the u-boot interactive command line. Then, according to the instruction, under uboot, I typed the following command to load the image and start from the address 0x82000000: ``` ext4load mmc 1 0x82000000 sel4test-driver-image-arm-tx1 go 0x82000000 ``` Finally, I failed to start sel4test as I wanted. After many repetitions, I got the same error. This is my output： ------------------------------------------------------------------------------------------------------------------------------------------ Tegra210 (P2371-2180) # ext4load mmc 1 0x82000000 sel4test-driver-image-arm-tx1 5247256 bytes read in 260 ms (19.2 MiB/s) Tegra210 (P2371-2180) # go 0x82000000 ## Starting application at 0x82000000 ... ELF-loader started on CPU: ARM Ltd. Cortex-A57 r1p1 paddr=[80a57000..80f58117] No DTB passed in from boot loader. Looking for DTB in CPIO archive...found at 80b825e0. Loaded DTB from 80b825e0. paddr=[8023d000..8024afff] ELF-loading image 'kernel' to 80000000 paddr=[80000000..8023cfff] vaddr=[ffffff8080000000..ffffff808023cfff] virt_entry=ffffff8080000000 ELF-loading image 'sel4test-driver' to 8024b000 paddr=[8024b000..80661fff] vaddr=[400000..816fff] virt_entry=40f0b8 Enabling MMU and paging Jumping to kernel-image entry point... Warning: gpt_cntfrq 19200000, expected 12000000 Bootstrapping kernel available phys memory regions: 2 [80000000..ff000000] [100000000..180000000] reserved virt address space regions: 3 [ffffff8080000000..ffffff808023d000] [ffffff808023d000..ffffff808024b000] [ffffff808024b000..ffffff8080662000] seL4 failed assertion 'cap_get_capType(destSlot->cap) == cap_null_cap' at /home/yjy/Desktop/sel4-rpi/sel4test_newv2/kernel/src/object/cnode.c:426 in function cteInsert halting... Kernel entry via Interrupt, irq 0 ------------------------------------------------------------------------------------------------------------------------------------------ Help me! I am running sel4test on my TX1 according to the official tutorial, but I get a problem again and again. For the newly purchased TX1, I directly connected my Ubuntu host with UART serial port. At the same time, I follow this instruction ( https://docs.sel4.systems/Hardware/jetsontx1.html ), pulled the latest sel4test project code, successfully ran ninja command and built images "sel4test-driver-image-arm-tx1". Everything seemed to be going very smoothly. I use the newly purchased SanDisk 64GB SD card to boot my image, which has been formatted in ext4 format. Then I use command `sudo screen / dev / ttyusb0 115200` to open the UART serial port. After pressing and holding the power key for 1 second, and TX1 starts. Then I hit the Enter key to make TX1 cancel the auto boot default image and enter the u-boot interactive command line. Then, according to the instruction, under uboot, I typed the following command to load the image and start from the address 0x82000000: ``` ext4load mmc 1 0x82000000 sel4test-driver-image-arm-tx1 go 0x82000000 ``` Finally, I failed to start sel4test as I wanted. After many repetitions, I got the same error. This is my output： ------------------------------------------------------------------------------------------------------------------------------------------ Tegra210 (P2371-2180) # ext4load mmc 1 0x82000000 sel4test-driver-image-arm-tx1 5247256 bytes read in 260 ms (19.2 MiB/s) Tegra210 (P2371-2180) # go 0x82000000 ## Starting application at 0x82000000 ... ELF-loader started on CPU: ARM Ltd. Cortex-A57 r1p1 paddr=[80a57000..80f58117] No DTB passed in from boot loader. Looking for DTB in CPIO archive...found at 80b825e0. Loaded DTB from 80b825e0. paddr=[8023d000..8024afff] ELF-loading image 'kernel' to 80000000 paddr=[80000000..8023cfff] vaddr=[ffffff8080000000..ffffff808023cfff] virt_entry=ffffff8080000000 ELF-loading image 'sel4test-driver' to 8024b000 paddr=[8024b000..80661fff] vaddr=[400000..816fff] virt_entry=40f0b8 Enabling MMU and paging Jumping to kernel-image entry point... Warning: gpt_cntfrq 19200000, expected 12000000 Bootstrapping kernel available phys memory regions: 2 [80000000..ff000000] [100000000..180000000] reserved virt address space regions: 3 [ffffff8080000000..ffffff808023d000] [ffffff808023d000..ffffff808024b000] [ffffff808024b000..ffffff8080662000] seL4 failed assertion 'cap_get_capType(destSlot->cap) == cap_null_cap' at /home/yjy/Desktop/sel4-rpi/sel4test_newv2/kernel/src/object/cnode.c:426 in function cteInsert halting... Kernel entry via Interrupt, irq 0 ------------------------------------------------------------------------------------------------------------------------------------------ I'm about to collapse. I really need your help. How can I solve this problem? 1. Why did I get this warning？ "Warning: gpt_cntfrq 19200000, expected 12000000" , It exists in this file "/sel4test/kernel/src/drivers/timer/generic_timer.c:21" 2. About reporting errors "failed assertion 'cap_get_capType(destSlot->cap) == cap_null_cap'". I found that the variable "(slot_ptr_t) (rootserver.tcb) ) -> cap.words[0] " is equals to 0xffffffffffffffff, so that the cap_get_capType(destSlot->cap) <=> (slot_ptr_t) (rootserver.tcb) ) -> cap.words[0] & 0x1full != 0 . I guess it caused the mistake, but i don't know why. I'm about to collapse. I really need your help. How can I solve this problem?

1 0

Re: seL4 developer hangout/video call
by Isaac Beckett 27 Jan '22

27 Jan '22

Hello all! If you’re reading this at the time it was sent, then the developer hangout is in roughly an hour. See you there! > > On Jan 25, 2022, at 8:02 PM, devel-request(a)sel4.systems wrote: > > Send Devel mailing list submissions to > devel(a)sel4.systems > > To subscribe or unsubscribe via email, send a message with subject or > body 'help' to > devel-request(a)sel4.systems > > You can reach the person managing the list at > devel-owner(a)sel4.systems > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Devel digest..." > > Today's Topics: > > 1. Re: seL4 developer hangout/video call (Gerwin Klein) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Tue, 25 Jan 2022 06:52:21 +0000 > From: Gerwin Klein <kleing(a)unsw.edu.au> > Subject: [seL4] Re: seL4 developer hangout/video call > To: devel <devel(a)sel4.systems> > Message-ID: <7F36F76C-E596-4A51-9419-785AB723CC03(a)unsw.edu.au> > Content-Type: text/plain; charset="us-ascii" > > Just a reminder that seL4 dev hangout is not tomorrow, but shifted by one day. > > Cheers, > Gerwin > >> On 23 Jan 2022, at 18:13, Gerwin Klein <kleing(a)unsw.edu.au> wrote: >> >> An earlier-than-usual heads-up that the seL4 developer hangout this week will be shifted by one day, because of the public holiday in Australia. >> >> This means, we're meeting on Wed for Europe/US and on Thu for Australia: >> >> - Sydney: Thu, Jan 27, 8am >> - Central Europe: Wed, Jan 26, 10pm >> - US West Coast: Wed, Jan 26, 1pm >> >> Zoom link: https://unsw.zoom.us/j/82640784431 >> >> Cheers, >> Gerwin >> > > > ------------------------------ > > Subject: Digest Footer > > _______________________________________________ > Devel mailing list -- devel(a)sel4.systems > To unsubscribe send an email to devel-leave(a)sel4.systems > > > ------------------------------ > > End of Devel Digest, Vol 135, Issue 2 > *************************************

3 2

📣 2022 SUMMIT - Trusted Computing Center of Excellence
by Griffiss Institute 27 Jan '22

27 Jan '22

NEXT WEEK! Register TODAY! NEXT WEEK! | SUMMIT 2022 View email in browser https://griffissinstitute.us6.list-manage.com/track/click?u=f0470275265f498… https://griffissinstitute.us6.list-manage.com/track/click?u=f0470275265f498… REGISTER NOW! (https://griffissinstitute.us6.list-manage.com/track/click?u=f0470275265f498…) NEXT WEEK! 2022 SUMMIT BEGINS JAN 31! The Trusted Computing Center of Excellence (https://griffissinstitute.us6.list-manage.com/track/click?u=f0470275265f498…) (TCCoE) is excited to announce that our annual Summit (https://griffissinstitute.us6.list-manage.com/track/click?u=f0470275265f498…) will be held virtually on January 31 - February 3, 2022! The TCCoE has been established with support from DARPA (https://griffissinstitute.us6.list-manage.com/track/click?u=f0470275265f498…) , AFRL (https://griffissinstitute.us6.list-manage.com/track/click?u=f0470275265f498…) , and the Griffiss Institute (https://griffissinstitute.us6.list-manage.com/track/click?u=f0470275265f498…) . Many of you may be familiar with the annual seL4® Summit, which we’ve successfully hosted for the past three years in coordination with the seL4 Foundation. Planning for the next annual seL4 Summit has begun under the leadership of seL4 Foundation, tentatively scheduled for October 2022 at a site in Europe. Beginning in January 2022, the TCCoE will host an annual Summit in the US, a complementary multi-day event focused on trusted computing technologies with a current emphasis on the secure embedded L4 (seL4) microkernel. seL4 is the world’s first open source operating system kernel with an end-to-end proof of implementation correctness and security enforcement. The main theme of this year’s TCCoE Summit is to provide a forum to discuss measurable security, resilience and assurance, via organic integration of hardware and software security features, for current and future platforms and systems. Specifically, the Summit scope includes, (but is not limited to), discussions on hardware security features, kernel, hypervisor and Virtual Machine Managers (VMMs), operating systems, containers, software security, etc. The TCCoE Summit will provide attendees the opportunity to attend presentations by government, industry, and academia experts; interact with discussion panels; and obtain tutorial training related to the seL4 microkernel. Come join us for 4 days packed with thought provoking keynotes, insightful presentations, lively panel discussions, and educational tutorials - an event that anyone interested in embedded systems and trust-based computing cannot miss! We look forward to your attendance! REGISTRATION IS LIVE! Registration | 13 January 2022 - 3 Feb 2022 | $250 (US) REGISTER NOW! (https://griffissinstitute.us6.list-manage.com/track/click?u=f0470275265f498…) REMINDER #1: Some levels of TCCoE Membership include discounted and free attendance at the Summit, so check with your organization about membership status! REMINDER #2: Tutorials will take place on Monday, January 31, starting at 8:00 am EST. These tutorials are included with your 2022 TCCoE Summit registration. You can join these one day tutorials for free just by registering below. TUTORIAL REGISTRATION (https://griffissinstitute.us6.list-manage.com/track/click?u=f0470275265f498…) MEMBERSHIP Have you and/or your company considered Trusted Computing Center of Excellence membership? Through membership, you gain an opportunity to influence the CoE’s priorities and technical direction, share ideas and network among peers in our community, and gain leverage from the latest trusted computing (e.g. seL4®) based innovations. The specific member benefits vary by membership class, but in general, membership benefits include: * Complimentary (or discounted) registration fee for CoE workshops and events * Advertising on the CoE’s website, in CoE publications, and at CoE sponsored events * Voting privileges for the election of the CoE Board of Directors, and other matters * Representation on CoE Committees * Tutorials for developers of trusted systems * Connect and collaborate securely and privately with other CoE members (chat, etc.) * Curated Software Distributions * Access to the CoE Private Code Repository (ITAR restrictions may apply) JOIN NOW! (https://griffissinstitute.us6.list-manage.com/track/click?u=f0470275265f498…) https://griffissinstitute.us6.list-manage.com/track/click?u=f0470275265f498… seL4 is a trademark of LF Projects, LLC. ============================================================ Copyright © 2022 Griffiss Institute, All rights reserved. You are receiving this email because of your interest in the Trusted Computing Center of Excellence.. Our mailing address is: Griffiss Institute 592 Hangar Rd Rome, NY 13441-4506 USA Want to change how you receive these emails? You can ** update your preferences (https://griffissinstitute.us6.list-manage.com/profile?u=f0470275265f4981c83…) or ** unsubscribe from this list (https://griffissinstitute.us6.list-manage.com/unsubscribe?u=f0470275265f498…)

1 0

seL4 developer hangout/video call
by Gerwin Klein 25 Jan '22

25 Jan '22

Hi seL4 devs, a few of us thought it might be nice to talk more directly from time to time rather than only via pull requests, so we're trialling a seL4 developer hangout/video chat. The idea for this is to be: - informal, about 1h - for technical discussions about seL4 and related repositories - anyone can join - every two weeks, initially for 3 times, then we can decide how we like it At least one or two technical steering committee (TSC) members will try to be at every one of these, but these are not TSC meetings where formal decisions are made, just technical discussions about whatever people have on their minds. To provide a starting topic, one thing we'd be interested in is: seL4 boot code There have been quite a few pull requests in that area, and it'd be nice to know what people's plans are and how we can keep this part of seL4 high assurance while making it more flexible. Other topics for future meetings could be better support for other language bindings (e.g. Rust), any RFCs that are open or people are thinking about opening, or just discussions about current pull requests or issues. The first hangout is on - Sydney: Wed, Nov 3, 8am - Central Europe: Tue, Nov 2, 10pm - US East Coast: Tue, Nov 2, 2pm Zoom link: https://unsw.zoom.us/j/82640784431 Cheers, Gerwin

2 9

Re: seL4 developer hangout/video call
by Isaac Beckett 25 Jan '22

25 Jan '22

Other US time zones: PST (West Coast): 1pm MST (Mountain Time): 2pm CST (Central Time): 3pm EST (East Coast): 4pm We have a lot of time zones here, it’s a bit of a pain sometimes. > > On Jan 23, 2022, at 8:01 PM, devel-request(a)sel4.systems wrote: > > Send Devel mailing list submissions to > devel(a)sel4.systems > > To subscribe or unsubscribe via email, send a message with subject or > body 'help' to > devel-request(a)sel4.systems > > You can reach the person managing the list at > devel-owner(a)sel4.systems > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Devel digest..." > > Today's Topics: > > 1. Re: seL4 developer hangout/video call (Gerwin Klein) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Sun, 23 Jan 2022 07:13:27 +0000 > From: Gerwin Klein <kleing(a)unsw.edu.au> > Subject: [seL4] Re: seL4 developer hangout/video call > To: devel <devel(a)sel4.systems> > Message-ID: <678C2D4C-EEE5-4D79-82BD-256BC78B3BFC(a)unsw.edu.au> > Content-Type: text/plain; charset="us-ascii" > > An earlier-than-usual heads-up that the seL4 developer hangout this week will be shifted by one day, because of the public holiday in Australia. > > This means, we're meeting on Wed for Europe/US and on Thu for Australia: > > - Sydney: Thu, Jan 27, 8am > - Central Europe: Wed, Jan 26, 10pm > - US West Coast: Wed, Jan 26, 1pm > > Zoom link: https://unsw.zoom.us/j/82640784431 > > Cheers, > Gerwin > > > ------------------------------ > > Subject: Digest Footer > > _______________________________________________ > Devel mailing list -- devel(a)sel4.systems > To unsubscribe send an email to devel-leave(a)sel4.systems > > > ------------------------------ > > End of Devel Digest, Vol 134, Issue 1 > *************************************

2 1

Sel4 Vmm Project Supporting on memory resources configure
by Tao Heng 陶恒-SW 19 Jan '22

19 Jan '22

Hi Sel4: While portinging Android Guest based on Sel4 Vmm project, I met some problems .In my porting steps, I increased the reserved memory for Android Guest to 2G on my platform. Then there were some parts of Sel4 Vmm project that confused me. 1. the principle to determin the static pool size for bootstrap with allocman n In bootstrap.h, I found your explanation for the value that it is based on the work with trial and error.Is that still the case? n If I incease this size, the frame_vm0_group_bin showed in vm_minimal.cdl file will obviously increase together.What’s the relationship of the two value? 2. How is the staic memory pool created? Is this memory pool created from untyped memory, so as treated untyped object? 3. the principle to determin the vm.simple_untyped24_pool size and nums n What’s the usage of the untyped_pool memory? n How can I make sure a reasonable size and nums of this value ? Much apprecitated, if you can give some feedbacks. Tao Heng | Taoer * +8618800230581 * taoheng(a)saicmotor.com<mailto:taoheng@saicmotor.com> Basic Software Platform SAIC Motor Z-ONE Software Company Auto Innovation Park | 201 Anyan Road, Jiading, Shanghai 邮件免责申明 Email Disclaimer 本邮件仅供本邮件指定收件人使用，其所载内容可能因含有保密信息或其它原因而不得披露。除本公司及本邮件指定收件人外，任何人不得公开、传播、分发、复制、印刷或使用本邮件之任何部分或其所载之任何内容。如您误收到本邮件，请立即通知本公司，并将原始邮件、附件及其所有复本从系统中删除，切勿使用。 This email is for the use of the designated receivers only，and the content is not allowed to be disclosed due to the confidential information or other reasons. Except for the Company and the designated receivers of this email, no one shall disclose, disseminate, distribute, copy, print or use any part of this email or any content contained therein. If you receive this email by mistake, please notify the Company immediately, and delete the original email, attachments and all copies from the system. Do not use it. 网络通信可能含有计算机病毒或其它缺陷，可能无法准确和/或及时送达其它系统，亦可能受阻而不为本公司或本邮件指定收件人所知。本公司对此类错误或遗漏以及任何因使用本邮件而引致之任何损失概不承担责任。 Network communication may contain computer viruses or other defects, which may not be delivered to other systems accurately and / or in time, or may be blocked by the Company or the designated receivers of this email. The Company shall not be liable for such errors or omissions and for any loss arising from this email. 本邮件所载任何内容仅作为业务层面交流与参考，除非明确说明，本公司不对邮件所载内容之准确性、完整性或公平性等承担任何法律责任。 Any contents contained in this email are only for the purpose of business communication and reference only. Unless explicitly stated otherwise, the Company shall not assume any legal responsibility for the accuracy, completeness or fairness of the content contained in the email. 本邮件指定收件人应特别注意：本邮件所载任何内容不构成本公司对本邮件指定收件人和/或其所属商业实体的任何要约、要约邀请或承诺，任何权利义务皆以双方签字盖章的书面文件为准。除经本公司以签字盖章的书面文件确认外，收件人和/或其所属商业实体不得以本邮件所载任何内容作为其向本公司主张任何权利或利益的正式依据。 The designated receivers should pay special attention to the fact that nothing contained in this email shall constitute an offer, invitation or acceptance by the Company to the designated receivers of this email and/or its affiliated business entities, and any rights and obligations are subject to the written documents signed and sealed by both parties. Except from the written document signed ,sealed and confirmed by the Company, the receivers and / or its affiliated business entity shall not rely on anything contained in this email as the formal basis for claiming any rights or interests to the Company.

1 0

Virtual Machine and scheduling query
by Sidhartha 12 Jan '22

12 Jan '22

Hi, I am a 2nd-year grad student at the Systopia Lab in UBC. I am using seL4 for the OS research project at I have a few independent questions: 1. Virtual Machines can be implemented with different levels of support from the hardware. If we talk about x86_64, in the most basic terms, you could have VMs without or without VT-X extensions. Looking at the resources available on the seL4 site, I think the given VMM libraries assume VT-X. Is there an example that does not use VT-X? 2. The scheduler inside seL4 is relatively simple. I have heard(Thanks Nick!) that if a complicated scheduling policy is desired, it can be done in userspace. A user-level component that has the capabilities to all the TCB's can play with the priority, resume/pause, and achieve any arbitrary scheduling. Is there an example available which I could look at? 3. I would like to implement a new functionality of memory quota, where different user-apps can be assigned memory quota and not just the physical pages. Does such a functionality belong in the kernel or the userspace component(say memory quota manager)? In the latter case, it would be just an endPoint capability to the quota manager service, so how does one split it - say split a quota of 100MB into two separate 50MB quotas. This is more a generic micro-kernel query rather than seL4 specific, but any insights would help. Thanks, Sid sid-agrawal.ca

1 0

sel4test AARCH64 on imx8mm-evk
by Zippy Manaic 07 Jan '22

07 Jan '22

Hi, I have tried running sel4test built for AARCH64 (https://docs.sel4.systems/Hardware/imx8mm.html) on my imx8mm-evk dev board. I am on the 12.1.0 branch of sel4test-manifest.git. Firstly I have to add "set(KernelAArch64SErrorIgnore ON)" to my build config in order to get the tests running and unfortunately things go awry during the test run ... Starting test 47: FRAMEEXPORTS0001 Running test FRAMEEXPORTS0001 (Test that we can access all exported frames) Pagefault from [FRAMEEXPORTS0001]: read fault at PC: 0x41c4ec vaddr: 0x11000000, FSR 0x92000210 Register of root thread in test (may not be the thread that faulted) Register dump: pc: 0x41c4ec sp: 0x100118a0 spsr: 0x80000040 x0: 0x11000000 x1: 0x11000000 x2: 0x55 x3: 0x15 x4: 0xe6 x5: 0x0 x6: 0x0 x7: 0xffffffffffffffff x8: 0x10011a48 x16: 0x0 x17: 0x0 x18: 0x0 x29: 0x100118a0 x30: 0x41c9f0 x9: 0x2b x10: 0x2b x11: 0xffffffff x12: 0x0 x13: 0x0 x14: 0x0 x15: 0x0 x19: 0xe7 x20: 0x8 x21: 0x11000000 x22: 0x0 x23: 0x0 x24: 0x0 x25: 0x0 x26: 0x0 x27: 0x0 x28: 0x0 tpidr_el0: 0x616f60 tpidrro_el0: 0x0 Failure: result == SUCCESS at line 291 of file /host/projects/sel4test/apps/sel4test-driver/src/testtypes.c Error: result == SUCCESS at line 217 of file /host/projects/sel4test/apps/sel4test-driver/src/main.c ... Starting test 55: IPC1001 Running test IPC1001 (Test SMP inter-AS seL4_Send + seL4_Recv) KERNEL DATA ABORT! Faulting instruction: 0xffffff804001e2ac FAR: 0xffffff80bf800020 ESR (DFSR): 0x96000210 halting... Kernel entry via Syscall, number: 1, Call Cap type: 10, Invocation tag: 20 Is this something that should just work? Or am I missing something. Cheers, Zippy

3 9

答复: Devel Digest, Vol 130, Issue 2
by yadong.li 03 Jan '22

03 Jan '22

Hi Matthew: Firstly, thank you for your information. form your answer, we understand the design intention of group, we Iook at compilation proces and may be find the probelm of compiler, we the assume the following scenario: The client A and client B are in the same group, they all have the same global variable like "global_buf", when use objcopy with "--keep-global-symbol" param, it will change the "global_buf" symbol form "gloabl" to "local", this change make the same name global variable of different client in same space can work well, they can access their own global variable as local variable. But In out test, we find if the "global_buf" not be initialized, in the group, there is only one "global_buf", if client A change the value of "global_buf", client B also can see the change, this is may be wrong, we find the gcc objcopy with "--keep-global-symbol" can only affect ".data" and ".bss" section, but "global_buf" which not be initialized, will place in ".common" section, "--keep-global-symbol" will not change the symbol of ".common" form global to local, this may be solved by add "-fno-common" when linker in camkes project related to "group" scenario ________________________________ 发件人: devel-request(a)sel4.systems <devel-request(a)sel4.systems> 发送时间: 2021年12月28日 9:00:05 收件人: devel(a)sel4.systems 主题: Devel Digest, Vol 130, Issue 2 Send Devel mailing list submissions to devel(a)sel4.systems To subscribe or unsubscribe via email, send a message with subject or body 'help' to devel-request(a)sel4.systems You can reach the person managing the list at devel-owner(a)sel4.systems When replying, please edit your Subject line so it is more specific than "Re: Contents of Devel digest..." Today's Topics: 1. Re: Some questions about group of camkes (adjust the format) (Matthew Fernandez) ---------------------------------------------------------------------- Message: 1 Date: Mon, 27 Dec 2021 16:26:26 -0800 From: Matthew Fernandez <matthew.fernandez(a)gmail.com> Subject: [seL4] Re: Some questions about group of camkes (adjust the format) To: "yadong.li" <yadong.li(a)horizon.ai> Cc: "devel(a)sel4.systems" <devel(a)sel4.systems>, "xiaonan.wang" <xiaonan.wang(a)horizon.ai>, "lei.mao" <lei.mao(a)horizon.ai> Message-ID: <DA97FC78-B670-4CF7-88AC-9810B31D1015(a)gmail.com> Content-Type: text/plain; charset=utf-8 > On Dec 23, 2021, at 08:50, yadong.li <yadong.li(a)horizon.ai> wrote: > > Hi > > * We learn the group of camkes from the https://github.com/seL4/camkes-tool/blob/master/docs/index.md > * group can colocate two component instances in a single address space, we want to use the share var by this way, like directcall transfer string virtual address, But we feel confused about the global symbols who have the same symbol name include function and variable in a single address space, Their behavior seems undefined 。 My information on how this works is out of date and I can’t answer all your questions, but I can tell you how this feature was originally implemented. Single address space components were originally implemented using post-compilation symbol mangling. As you’ve noticed, naive linking of two component instances together presents two problems: 1. Unrelated homonyms between the instances now conflict. A symbol called `foo` in component instance A and a symbol called `foo` in component instance B now refer to the same thing when linked together. 2. References to glue code have the opposite problem: their names may differ in component instance A and component instance B, but need to refer to the same functions when the two are linked together. Both problems were solved with the same mechanism: GNU objcopy. The invocations to objcopy were template-generated so they could take advantage of knowledge about the system begin compiled. A generated objcopy invocation would do the following: 1. Adjust all non-generated symbols to have internal visibility. Component instance A and component instance B have already been (partially) linked, so at this point the only unresolved symbols that need to remain externally visible are those related to the connection(s) between them. This solves problem 1 above. 2. Name-mangle all remaining symbols to something prefixed with the relevant connection instance’s name. IIRC the name mangling scheme was something like ‘<connection instance name><space><original symbol name>’. This guaranteed uniqueness because <space> is not a character that existed in C or assembly symbols. Whether using a space in a symbol name is legal or not, I don’t know, but all the binutils seemed fine with this. 3. Rename the second component in the name mangling above to a common name. I don’t recall exactly how this name was chosen, but this solves problem 2 above. This sounds pretty unorthodox and brittle, but it actually worked surprisingly well. All combinations of single address space component systems seemed to Just Work, with a few notable sharp edges: * Anything involving MMIO was tricky. These symbols frequently needed to remain externally visible and the two component instances would often have differing names but the same addresses for them. * GNU ld was more or less required. The multiple steps involving partial linking was only supported by GNU ld and Gold at the time. LLVM’s lld may have caught up in the interim years. * The objcopy name mangling broke cross-section references used by GCC’s implementation of Link-Time Optimization. As a result, any LTO compilation degraded to LTO being disabled. This wouldn’t have been a big deal except that one of the primary reasons to put two components in a single address space is to enable cross-component inlining, usually facilitated by LTO. AFAICT this (playing objcopy tricks and expecting LTO to still work) was simply not a supported use case. We explored how to work around this and got some one-off efforts working for benchmarking, but proper support would have involved altering the way binutils work. ------------------------------ Subject: Digest Footer _______________________________________________ Devel mailing list -- devel(a)sel4.systems To unsubscribe send an email to devel-leave(a)sel4.systems ------------------------------ End of Devel Digest, Vol 130, Issue 2 *************************************

2 1

Question about the Real-time of the SEL4.
by 刘跃 Jeff Liu 01 Jan '22

01 Jan '22

Hi; As we know, seL4 is a non preemptive kernel. Is it because the kernel of seL4 is an event based model? Then why not use the thread based kernel? As far as I know, VxWorks and QNX are thread based. SeL4's view is that for non preemptive kernel, real-time performance focuses on WCET, and the faster kernel does not guarantee the real-time performance of the system. I partially agree with this view. I want to know if there are real-time comparison data?, The comparison test with VxWorks or QNX is about the real-time performance of the system. the worst case interrupt latency is the sum of both the longest region with interrupts disabled, and the time to dispatch an interrupt to a user thread. How are these two parts of time calculated? Is it the method of WCET static analysis? And Then how to improve the interrupt response time, What is the specific method to reduce interrupt latency? I think most users of seL4 are more concerned about this. I look forward to communicating and discussing with you, experts. Thanks;

2 1

Some questions about group of camkes (adjust the format)
by yadong.li 28 Dec '21

28 Dec '21

Hi * We learn the group of camkes from the https://github.com/seL4/camkes-tool/blob/master/docs/index.md * group can colocate two component instances in a single address space, we want to use the share var by this way, like directcall transfer string virtual address, But we feel confused about the global symbols who have the same symbol name include function and variable in a single address space, Their behavior seems undefined 。 * Our camkes project test below, clien1 and client2 in the same group: " import <std_connector.camkes>; procedure MyInterface { void print(in string message); } component Client { control; uses MyInterface iface; } component Server { provides MyInterface iface; } assembly { composition { group g { component Client client_1; component Client client_2; } component Server server; connection seL4RPCCall conn(from g.client_1.iface, from g.client_2.iface, to server.iface); } configuration { client_1.iface_attributes = 11; client_2.iface_attributes = 22; } } * 1. We test function in group (a single address space): * the client code below: " #include <camkes.h> int run(void) { char *name = get_instance_name(); iface_print(name); return 0; } " * the server code below: " #include <camkes.h> #include <stdio.h> void iface_print(const char *name) { printf("[%s] ping, the badge is [%d]\n", name, iface_get_sender_id()); } " * From the cameks project, we have two client, they are client_1 and client_2, they have the same they can all “iface_print” to access server function，In this scene，we have two quesiton: * Question 1. After compiled the test project, we found in the symbol table of g_group_bin, we have two "iface_print" symbol, they have different address even though they have the same name, it look like the componet can call their own "iface_print", I think in a single address space, component like thread, Why two symbols with the same name(iface_print) will not conflict in one address space * Question 2: when client access server, we offer the _attributes(badge) for the interface of client, by test, the two client can call their own "iface_print", but the server can only recevice one badge 22, below is our test: " [client_2] ping, the badge is [22] [client_1] ping, the badge is [22] " * The attribute(badge) of client1 is covered by the attribute(badge) of client2, The iface_print of two client have only one capability to access IPC endpoint object * We can not understand in single address space,the "iface_print" of two component is behavior as one or two different ? * 2. We test function in global variable (a single address space): * We found whether global variables are initialized will have completely different behavior， out test code below: * scene1 :Client code below: " int temp_value; int run(void) { char *name = get_instance_name(); iface_print(name); printf("at start, in %s, the temp_value address is [%p], value is [0x%lx]\n", name, &temp_value, temp_value); if (strcmp(name, "client_1") == 0) { int count = 1000000000; while(count--) { asm volatile(""); } /* client1 read the temp_value*/ printf("at last, in %s, the temp_value address is [%p], value is [0x%lx]\n", name, &temp_value, temp_value); } else { /* client2 change the val of temp_value */ temp_value = 0x12345; printf("at last, in %s, the temp_value address is [%p], value is [0x%lx]\n", name, &temp_value, temp_value); } return 0; } " * Phenomenon: client1 and client2 are different instances of the same code in same group，form the above code，the symbol of "temp_value" is bss section, the temp_value of client1 and the temp_value of client2 have the same virtual address, and if the client2 change the value, client1 can perceive the change， test as below： " at start, in client_1, the temp_value address is [0x659e70], value is [0x0] at start, in client_2, the temp_value address is [0x659e70], value is [0x0] at last, in client_2, the temp_value address is [0x659e70], value is [0x12345] at last, in client_1, the temp_value address is [0x659e70], value is [0x12345] " * scene2 :Client code below: " int temp_value = 1; int run(void) { char *name = get_instance_name(); iface_print(name); printf("at start, in %s, the temp_value address is [%p], value is [0x%lx]\n", name, &temp_value, temp_value); if (strcmp(name, "client_1") == 0) { int count = 1000000000; while(count--) { asm volatile(""); } /* client1 read the temp_value*/ printf("at last, in %s, the temp_value address is [%p], value is [0x%lx]\n", name, &temp_value, temp_value); } else { /* client2 change the val of temp_value */ temp_value = 0x12345; printf("at last, in %s, the temp_value address is [%p], value is [0x%lx]\n", name, &temp_value, temp_value); } return 0; } " * Phenomenon: client1 and client2 are different instances of the same code in same group，form the above code，the symbol of "temp_value" is data section, the temp_value of client1 and the temp_value of client2 have the different virtual address, and if the client2 change the value, client1 can not get the change， test as below： " at last, in client_2, the temp_value address is [0x445ba8], value is [0x12345] at last, in client_1, the temp_value address is [0x444008], value is [0x1] " * The code of scene1 and scene2 are almost the same, except whether temp_value is initialized， the bss section or data section，but the symbol table completely different, scene1 the symbol table of g_group_bin has only one "temp_value" symbol, But scene1 the symbol table of g_group_bin has two symbols named temp_value, we also do not understand why the same name symbols of global variable should be one or two in a single address of group. It looks like random. Thank you very much

2 1

Some questions about group of camkes
by yadong.li 24 Dec '21

24 Dec '21

Hi * We learn the group of camkes from the https://github.com/seL4/camkes-tool/blob/master/docs/index.md * group can colocate two component instances in a single address space, we want to use the share var by this way, like directcall transfer string virtual address, But we feel confused about the global symbols who have the same symbol name include function and variable in a single address space, Their behavior seems undefined 。 * Our camkes project test below, clien1 and client2 in the same group: import <std_connector.camkes>; procedure MyInterface { void print(in string message); } component Client { control; uses MyInterface iface; } component Server { provides MyInterface iface; } assembly { composition { group g { component Client client_1; component Client client_2; } component Server server; connection seL4RPCCall conn(from g.client_1.iface, from g.client_2.iface, to server.iface); } configuration { client_1.iface_attributes = 11; client_2.iface_attributes = 22; } } * 1. We test function in group (a single address space): * the client code below: #include <camkes.h> int run(void) { char *name = get_instance_name(); iface_print(name); return 0; } * the server code below: #include <camkes.h> #include <stdio.h> void iface_print(const char *name) { printf("[%s] ping, the badge is [%d]\n", name, iface_get_sender_id()); } * From the cameks project, we have two client, they are client_1 and client_2, they have the same they can all “iface_print” to access server function，In this scene，we have two quesiton: * Question 1. After compiled the test project, we found in the symbol table of g_group_bin, we have two "iface_print" symbol, they have different address even though they have the same name, it look like the componet can call their own "iface_print", I think in a single address space, component like thread, Why two symbols with the same name(iface_print) will not conflict in one address space * Question 2: when client access server, we offer the _attributes(badge) for the interface of client, by test, the two client can call their own "iface_print", but the server can only recevice one badge 22, below is our test: [client_2] ping, the badge is [22] [client_1] ping, the badge is [22] * The attribute(badge) of client1 is covered by the attribute(badge) of client2, The iface_print of two client have only one capability to access IPC endpoint object * We can not understand in single address space,the "iface_print" of two component is behavior as one or two different ? * 2. We test function in global variable (a single address space): * We found whether global variables are initialized will have completely different behavior， out test code below: * scene1 :Client code below: int temp_value; int run(void) { char *name = get_instance_name(); iface_print(name); printf("at start, in %s, the temp_value address is [%p], value is [0x%lx]\n", name, &temp_value, temp_value); if (strcmp(name, "client_1") == 0) { int count = 1000000000; while(count--) { asm volatile(""); } /* client1 read the temp_value*/ printf("at last, in %s, the temp_value address is [%p], value is [0x%lx]\n", name, &temp_value, temp_value); } else { /* client2 change the val of temp_value */ temp_value = 0x12345; printf("at last, in %s, the temp_value address is [%p], value is [0x%lx]\n", name, &temp_value, temp_value); } return 0; } * Phenomenon: client1 and client2 are different instances of the same code in same group，form the above code，the symbol of "temp_value" is bss section, the temp_value of client1 and the temp_value of client2 have the same virtual address, and if the client2 change the value, client1 can perceive the change， test as below： at start, in client_1, the temp_value address is [0x659e70], value is [0x0] at start, in client_2, the temp_value address is [0x659e70], value is [0x0] at last, in client_2, the temp_value address is [0x659e70], value is [0x12345] at last, in client_1, the temp_value address is [0x659e70], value is [0x12345] * scene2 :Client code below: int temp_value = 1; int run(void) { char *name = get_instance_name(); iface_print(name); printf("at start, in %s, the temp_value address is [%p], value is [0x%lx]\n", name, &temp_value, temp_value); if (strcmp(name, "client_1") == 0) { int count = 1000000000; while(count--) { asm volatile(""); } /* client1 read the temp_value*/ printf("at last, in %s, the temp_value address is [%p], value is [0x%lx]\n", name, &temp_value, temp_value); } else { /* client2 change the val of temp_value */ temp_value = 0x12345; printf("at last, in %s, the temp_value address is [%p], value is [0x%lx]\n", name, &temp_value, temp_value); } return 0; } * Phenomenon: client1 and client2 are different instances of the same code in same group，form the above code，the symbol of "temp_value" is data section, the temp_value of client1 and the temp_value of client2 have the different virtual address, and if the client2 change the value, client1 can not get the change， test as below： at last, in client_2, the temp_value address is [0x445ba8], value is [0x12345] at last, in client_1, the temp_value address is [0x444008], value is [0x1] * The code of scene1 and scene2 are almost the same, except whether temp_value is initialized， the bss section or data section，but the symbol table completely different, scene1 the symbol table of g_group_bin has only one "temp_value" symbol, But scene1 the symbol table of g_group_bin has two symbols named temp_value, we also do not understand why the same name symbols of global variable should be one or two in a single address of group. It looks like random.

1 0

Can't locate VM at virtual 0?
by Richard Clark 22 Dec '21

22 Dec '21

My VM's can't seem to be untied from actual physical memory.... I've got a nice old moldy version of sel4, around version 8 I think, but it's got some life left if we can figure out how to remap our VMs to 0 instead of mapping virtual directly equal physical... In other words, for some reason, we map virtual == physical, and have to tell the VM that it is up at some high-level address. We would like to be able to pick a physical patch of memory, and map it to zero in the VM, so the VM can believe it is at 0. Honestly I don't understand why that isn't the default anyway... But I've found examples where I can specify a physical address and get back an arbitrary virtual address, and other examples where I can specify a virtual address and get back an arbitrary physical page. What I need, is a way to specify both the physical and the virtual addresses into my VM vspace. Would you happen to have an example or two on hand? For a little more context, I've got the following code, which appears to map the first page ok, but then fails trying to map the next page when called a second time: map_ram_to(vspace_t *vspace, vspace_t *vmm_vspace, vka_t* vka, uintptr_t paddr, uintptr_t vaddr) { vka_object_t frame_obj; cspacepath_t frame[2]; reservation_t res; int err; /* reserve vspace */ printf("map_ram_to, reserve phys mem at %p to vaddr %p\n", (void *)paddr, (void *)vaddr); res = vspace_reserve_range_at(vspace, (void *)paddr, 0x1000, seL4_AllRights, 1); if (!res.res) { ZF_LOGF("Failed to reserve range"); return NULL; } /* map phys addr ro frame obj */ printf("map_ram_to, alloc phys mem at %p\n", (void *)paddr); err = vka_alloc_frame_at(vka, 12, paddr, &frame_obj); if (err) { printf("ERROR VKA alloc ptr: %p\n", vka->data); ZF_LOGF("Failed vka_alloc_frame_maybe_device in devices.c"); vspace_free_reservation(vspace, res); return NULL; } vka_cspace_make_path(vka, frame_obj.cptr, &frame[0]); printf("map_ram vka_cspace_alloc_path\n"); err = vka_cspace_alloc_path(vka, &frame[1]); if (err) { ZF_LOGF("Failed vka_cspace_alloc_path"); vka_free_object(vka, &frame_obj); vspace_free_reservation(vspace, res); return NULL; } printf("map_ram vka_cnode_copy\n"); err = vka_cnode_copy(&frame[1], &frame[0], seL4_AllRights); if (err) { ZF_LOGF("Failed vka_cnode_copy"); vka_cspace_free(vka, frame[1].capPtr); vka_free_object(vka, &frame_obj); vspace_free_reservation(vspace, res); return NULL; } err = map_page(vspace, frame_obj.cptr, (void *)vaddr, seL4_AllRights, 1, 12); vspace_free_reservation(vspace, res); if (err) { printf("FAILED Failed vspace_map_pages_at_vaddr\n"); vka_cspace_free(vka, frame[1].capPtr); vka_free_object(vka, &frame_obj); return NULL; } printf("map_ram_to, worked and zeroed at %p\n", (void *)paddr); return (void *)paddr; } Help is greatly appreciated! Richard H. Clark

2 1

vm physaddr != virtual?
by Richard Clark 22 Dec '21

22 Dec '21

My VM's can't seem to be untied from actual physical memory.... I've got a nice old moldy version of sel4, around version 8 I think, but it's got some life left if we can figure out how to remap our VMs to 0 instead of mapping virtual directly equal physical... In other words, for some reason, we map virtual == physical, and have to tell the VM that it is up at some high-level address. We would like to be able to pick a physical patch of memory, and map it to zero in the VM, so the VM can believe it is at 0. Honestly I don't understand why that isn't the default anyway... But I've found examples where I can specify a physical address and get back an arbitrary virtual address, and other examples where I can specify a virtual address and get back an arbitrary physical page. What I need, is a way to specify both the physical and the virtual addresses into my VM vspace. Would you happen to have an example or two on hand? For a little more context, I've got the following code, which appears to map the first page ok, but then fails trying to map the next page when called a second time: map_ram_to(vspace_t *vspace, vspace_t *vmm_vspace, vka_t* vka, uintptr_t paddr, uintptr_t vaddr) { vka_object_t frame_obj; cspacepath_t frame[2]; reservation_t res; int err; /* reserve vspace */ printf("map_ram_to, reserve phys mem at %p to vaddr %p\n", (void *)paddr, (void *)vaddr); res = vspace_reserve_range_at(vspace, (void *)paddr, 0x1000, seL4_AllRights, 1); if (!res.res) { ZF_LOGF("Failed to reserve range"); return NULL; } /* map phys addr ro frame obj */ printf("map_ram_to, alloc phys mem at %p\n", (void *)paddr); err = vka_alloc_frame_at(vka, 12, paddr, &frame_obj); if (err) { printf("ERROR VKA alloc ptr: %p\n", vka->data); ZF_LOGF("Failed vka_alloc_frame_maybe_device in devices.c"); vspace_free_reservation(vspace, res); return NULL; } vka_cspace_make_path(vka, frame_obj.cptr, &frame[0]); printf("map_ram vka_cspace_alloc_path\n"); err = vka_cspace_alloc_path(vka, &frame[1]); if (err) { ZF_LOGF("Failed vka_cspace_alloc_path"); vka_free_object(vka, &frame_obj); vspace_free_reservation(vspace, res); return NULL; } printf("map_ram vka_cnode_copy\n"); err = vka_cnode_copy(&frame[1], &frame[0], seL4_AllRights); if (err) { ZF_LOGF("Failed vka_cnode_copy"); vka_cspace_free(vka, frame[1].capPtr); vka_free_object(vka, &frame_obj); vspace_free_reservation(vspace, res); return NULL; } err = map_page(vspace, frame_obj.cptr, (void *)vaddr, seL4_AllRights, 1, 12); vspace_free_reservation(vspace, res); if (err) { printf("FAILED Failed vspace_map_pages_at_vaddr\n"); vka_cspace_free(vka, frame[1].capPtr); vka_free_object(vka, &frame_obj); return NULL; } printf("map_ram_to, worked and zeroed at %p\n", (void *)paddr); return (void *)paddr; } Help is greatly appreciated! Richard H. Clark

1 0

mapping tutorial answers?
by Richard Clark 22 Dec '21

22 Dec '21

I'm interested in the ANSWERS to the MAPPING tutorial. I have my own virtual/physical memory management system and need only the ability to map a specific physical address to a specific virtual address. I can find no such thing in all the sel4 code that I have, but it appears that the mapping tutorial is what I need. Does anyone have this? (preferably arm64 and/or x64) Richard Clark

1 0

sel4-sys support
by kgugala＠antmicro.com 16 Dec '21

16 Dec '21

Hi All, We’ve been working on reviving the sel4-sys Rust crate and getting it usable again. Currently, we have it working correctly with RISC-V, we’re working on ARM (including aarch64) and X86. We’d like to contribute this work, but to have it landed we need to extend the test suite to include crate tests - especially the syscalls API. During the build, the crate generates the syscalls functions accessible from Rust code based on seL4 config. We use standard sel4test-tests suite to handle the tests: * We build the crate as static library * Sel4test is built with `-DLibSel4FunctionAttributes=public` and while linking we overwrite the original symbols with the ones from a static library from the crate This allows us to run the standard test suite against Rust syscall stubs. For now the crate generates the syscall stubs with Rust flavor, so functions signatures between Rust and C do not match. To handle this we additionally generate a thin glue code adopting Rust signatures to the C ones. We generate the Rust syscalls with a slightly modified version of the `syscall_stub_gen.py` script - we copied it into the crate’s codebase. Copying the code doesn’t seem to be the best idea - we’d need to maintain the code in both places - seL4 kernel and the crate. We’d like to merge the Rust generator with the current set of tools - is this something you’d be willing to land in the kernel code? If not, how would you see the way forward here? Thanks and best regards Karol

4 5

Re: seL4 developer hangout/video call
by Isaac Beckett 15 Dec '21

15 Dec '21

This is 4pm east coast US/EST. > The next instalment of the seL4 developer hangout is happening as planned tomorrow. It's the last one for this year: > > - Sydney: Wed, Dec 15, 8am > - Central Europe: Tue, Dec 14, 10pm > - US West Coast: Tue, Dec 14, 1pm > > Zoom link: https://unsw.zoom.us/j/82640784431 > > (There is also a separate meeting of the technical steering committee end of this week) > > Cheers > Gerwin

1 0

two questions about cteDelete of sel4 kernel 12.0.0 ?
by yadong.li 12 Dec '21

12 Dec '21

Hi： I have two questions about cteDelete of sel4 kernel 12.0.0？ IF I want to delete slot that slot->cap is cnode object(I called it level 1 cnode). The finaliseSlot function will create zombie capability and call reduceZombie(), param "immediate" is ture. the reduceZombie() call cteDelete() delete the endSlot, if the endSlot->cap is cnode capability again(I call it level 2 cnode), this time param "immediate" is false. and cteDelete() will call reduceZombie again, but because param "immediate " is false ,this time reduceZombie will not call cteDelete recursively. the reduceZombie will call capSwapForDelete, if Swap cap is not cnode or tcb, when it return to finaliseSlot, finaliseSlot will check finaliseCap, because swap cap is not cnode or tcb, almost it capRemovable, and it return directly. 1. I think when call capSwapForDelete in reduceZombie, the level 2 cnode become Cyclic zombie, but when return finaliseSlot, I do not think it will deal with below branch: if (!immediate && capCyclicZombie(fc_ret.remainder, slot)) { } because this time ,slot ->cap is not cnode or tcb, it will not create zombie cap. Who will delete level 2 cnode ? Is it lost as "Cyclic zombie", memory leak? 2. when delete cnode, it will check "preemptionPoint", if our delete is beak, even though fs_ret.success is false, but this false is not deliver to caller, who will delete cnode object again? Thank you very much

2 3

seL4 kernel does not receive PCI interrupts
by hamed_ganji＠aut.ac.ir 12 Dec '21

12 Dec '21

Hi all, I have created a simple CAMKES-VM-x86 app for a PC but its PCI devices are not working due to not receiving corresponding interrupts. By adding a printf to the function "handleInterrupt" inside the seL4 kernel I found that only some limited interrupts such as timer and serial are received. However, capdl_spec.c file contains all necessary declaration of capabilities and objects for the required interrupts such as follows, ... [19625] = { #ifdef CONFIG_DEBUG_BUILD .name = "vm0_irq_10", #endif .type = CDL_IOAPICInterrupt, .slots.num = 1, .slots.slot = (CDL_CapSlot[]) { {0, {.type = CDL_NotificationCap, .obj_id = 19567 /* vm0_irq_notification_obj_10 */, .is_orig = true, .rights = (CDL_CanRead), .data = { .tag = CDL_CapData_Badge, .badge = 0}}}, }, .ioapicirq_extra = { .ioapic = 0, .ioapic_pin = 10, .level = 1, .polarity = 1, }, }, ... and the host endpoint of the VMM thread is properly set to receive IRQ notifications and route them to VM, and the IOAPIC pin number (source) is also true, I checked. How can I solve the problem? Any pointers would be appreciated. Kind regards, Hamed

1 0

Nvidia Tegra SoCs: Has anyone tried running seL4 on them?
by Isaac Beckett 12 Dec '21

12 Dec '21

Has anyone experimented with running seL4 on Tegra SoCs? I’m interested mainly because I own a Nintendo Switch console that is vulnerable to an exploit in the boot rom that allows for booting arbitrary payloads. Most people use it to run modified versions of the official firmware, or to run Linux or Android, so the hardware is at least decently well reverse engineered at this point, and there are even proper Linux drivers for the joy-con detachable controllers. I’m interested in attempting to run seL4 on this device, mostly to see if I can, but I figured I’d ask here first to see if anyone’s attempted similar hardware.

2 2

next seL4 TSC meeting on Fri 17 Dec (16 Dec in US and Europe)
by Gerwin Klein 11 Dec '21

11 Dec '21

The Technical Steering Committee (TSC) of the seL4 Foundation will hold its next public meting on: - Sydney: Fri, 17 Dec, 8am - Central Europe: Tue, 16 Dec, 10pm - US West Coast: Tue, 16 Dec, 1pm The meeting is by Zoom, and you can join from here: https://unsw.zoom.us/j/82827057586 Anyone interested can join the meeting and listen to the discussion and request to speak, which will be granted if time permits. Only TSC members can vote. The seL4 code of conduct applies to the meeting [1]. The agenda for the meeting so far is: - update on GitHub status, test stability, etc - release schedule - change main verification platform to imx8? - RFCs: - Core Platform https://sel4.atlassian.net/browse/RFC-5 - Removing CNode Mutate https://sel4.atlassian.net/browse/RFC-7 - SMC calls https://sel4.atlassian.net/browse/RFC-9 If there are other items that I missed or you think should be on the agenda, please let me know. If we can't get to an item this time, we can still schedule another meeting. Cheers, Gerwin (TSC chair) [1]: https://docs.sel4.systems/processes/conduct.html

1 0

two questions about cteDelete of sel4 kernel？
by yadong.li 11 Dec '21

11 Dec '21

Hi： I have two questions about cteDelete of sel4 kernel？ IF I want to delete slot that slot->cap is cnode object(I called it level 1 cnode). The finaliseSlot function will create zombie capability and call reduceZombie(), param "immediate" is ture. the reduceZombie() call cteDelete() delete the endSlot, if the endSlot->cap is cnode capability again(I call it level 2 cnode), this time param "immediate" is false. and cteDelete() will call reduceZombie again, but because param "immediate " is false ,this time reduceZombie will not call cteDelete recursively. the reduceZombie will call capSwapForDelete，it will swap zombie cap with slot 0 of level 2 cnode, if Swap cap(slot0 of level 2 cnode) is not cnode or tcb(the cnode object slot 0 must point to cnode self ? I did not find this limitation), when it return to finaliseSlot, finaliseSlot will check finaliseCap, because swap cap is not cnode or tcb, almost it call be capRemovable, and it return directly. 1. I think when call capSwapForDelete in reduceZombie, the level 2 cnode become Cyclic zombie, but when return finaliseSlot, I do not think it will deal with below branch: if (!immediate && capCyclicZombie(fc_ret.remainder, slot)) { } because this time ,slot ->cap is not cnode or tcb, it will not create zombie cap. then Who will delete level 2 cnode ? Is it lost as "Cyclic zombie", memory leak? 2. when delete cnode, it will check "preemptionPoint", if our delete is beak, even though fs_ret.success is false, but this false is not deliver to caller who will delete it again? thank you for your help

1 0

How can I port the seL4 microkernel to my unofficially verified hardware？
by yjy 10 Dec '21

10 Dec '21

Does the document provide relevant information or project? I read related articles and I can be sure that my instruction set is common. Thank you.

2 1

Troubles booting VM with large memory(e.g VM_RAM_SIZE >= 2048MB)
by Han JingLong 韩景龙 09 Dec '21

09 Dec '21

Hello all, Reference to seL4 Docs/Projects/CAmkES ARM VMM, I have successfully run a VM (a Linux guest OS and config VM_RAM_SIZE = 1024MB) on a new ARM(ArmV8a CortexA55) platform. But when I tried to increase the ram size assigned to VM, I encountered the following error: ============================================================================== ram_ut_alloc_iterator@guest_ram.c:295 Failed to allocate page map_vm_memory_reservation@guest_memory.c:470 Failed to get frame for reservation address 0xae7c0000 reservation_size:60000000 …… vm_ram_touch@guest_ram.c:160 Failed to touch ram region: Not registered RAM region 32 bit ARM insts not decoded Pagefault from [Linux]: write fault @ PC: 0xffff000008d9132c IPA: 0xaffff000, FSR: 0x92000046 Context: x0: 0xffff7dfffe639000 x1: 0x0 x2: 0xfc0 x3: 0x4 x4: 0x0 x5: 0x40 x6: 0x3f x7: 0x0 x8: 0xffff7dfffe639000 x9: 0x0 x10: 0x1000 x11: 0x6f01c3b8 x12: 0xc0000000 pc: 0xffff000008d9132c x14: 0x0 sp: 0xffff000009668d80 spsr: 0x40000085 x13: 0x60000000 x15: 0x4 x16: 0x1800 x17: 0xffff7dfffe81c3b4 x18: 0x8 x19: 0xaffff000 x20: 0xffff0000096a1fd0 x21: 0xffff7dfffe80009c x22: 0x58389df x23: 0xffff0000091ce000 x24: 0x4b78e0 x25: 0x47b87c x26: 0x0 x27: 0xa0000000047b818 x28: 0x614f0018 x29: 0xffff000009643eb0 x30: 0xffff0000094f7ad0 m-------- Assertion failed: rt >= 0 (/home/hjl/workdir/vmm_sel4_sdx_android/projects/seL4_projects_libs/libsel4vm/src/arch/arm/fault.c: fault_get_width: 623) Attach config file for reference： 1. overlay dts reserved-memory { #address-cells = < 0x02 >; #size-cells = < 0x02 >; ranges; vm-memory@60000000 { reg = < 0x00 0x60000000 0x00 0x60000000 >; no-map; }; }; 1. devices.camkes #define VM_INITRD_MAX_SIZE 0x5000000 //80 MB #define VM_RAM_BASE 0x60000000 #define VM_RAM_OFFSET 0 #define VM_RAM_SIZE 0x60000000 #define VM_DTB_ADDR 0x6F000000 #define VM_INITRD_ADDR 0x6A000000 vm0.untyped_mmios = [ “0x35436000:12”, // Interrupt Controller Virtual CPU interface (Virtual Machine view) /* The purpose of these untyped regions is to force the untyped * allocator to treat this memory region as reserved so that when we * try to ensure that the VMM is placed into this region in RAM, it * will definitely be available for placement. * * This address pertains to vm-memory@60000000 in the overlay DTS */ “0x60000000:28”, // RAM “0x70000000:28”, // RAM “0x80000000:28”, // RAM “0x90000000:28”, // RAM “0xa0000000:28”, // RAM “0xb0000000:28”, // RAM ]; 1. guest linux dts memory@60000000 { device_type = “memory”; reg = <0x00 0x60000000 0x00 0x60000000>; }; ============================================================================== In contrast, I tried to expand the VM memory based on QEMU and encountered the same problem. Attach config file for reference： 1. settings.cmake if(${PLATFORM} STREQUAL “qemu-arm-virt”) set(QEMU_MEMORY “4096”) set(KernelArmCPU cortex-a53 CACHE STRING “” FORCE) set(VmInitRdFile ON CACHE BOOL “” FORCE) endif() 1. overlay-reserve-vm-memory.dts reserved-memory { #address-cells = < 0x02 >; #size-cells = < 0x02 >; ranges; vm-memory@40000000 { reg = <0x0 0x40000000 0x0 0x50000000>; no-map; }; }; 1. devices.camkes #define VM_INITRD_MAX_SIZE 0x1900000 //25 MB #define VM_RAM_BASE 0x40000000 #define VM_RAM_SIZE 0x50000000 #define VM_RAM_OFFSET 0x00000000 #define VM_DTB_ADDR 0x4F000000 #define VM_INITRD_ADDR 0x4D700000 vm0.untyped_mmios = [ “0x8040000:12”, // Interrupt Controller Virtual CPU interface (Virtual Machine view) “0x40000000:29”, // Linux kernel memory regions “0x60000000:29”, // Linux kernel memory regions “0x80000000:28”, // Linux kernel memory regions ]; 1. guest linux dts memory@40000000 { reg = <0x0 0x40000000 0x0 0x50000000>; device_type = “memory”; }; Is there any memory limit for VM? or Configuration problem? Anyways anyone any help can provide would be awesome and thanks in advance for any help! 邮件免责申明 Email Disclaimer 本邮件仅供本邮件指定收件人使用，其所载内容可能因含有保密信息或其它原因而不得披露。除本公司及本邮件指定收件人外，任何人不得公开、传播、分发、复制、印刷或使用本邮件之任何部分或其所载之任何内容。如您误收到本邮件，请立即通知本公司，并将原始邮件、附件及其所有复本从系统中删除，切勿使用。 This email is for the use of the designated receivers only，and the content is not allowed to be disclosed due to the confidential information or other reasons. Except for the Company and the designated receivers of this email, no one shall disclose, disseminate, distribute, copy, print or use any part of this email or any content contained therein. If you receive this email by mistake, please notify the Company immediately, and delete the original email, attachments and all copies from the system. Do not use it. 网络通信可能含有计算机病毒或其它缺陷，可能无法准确和/或及时送达其它系统，亦可能受阻而不为本公司或本邮件指定收件人所知。本公司对此类错误或遗漏以及任何因使用本邮件而引致之任何损失概不承担责任。 Network communication may contain computer viruses or other defects, which may not be delivered to other systems accurately and / or in time, or may be blocked by the Company or the designated receivers of this email. The Company shall not be liable for such errors or omissions and for any loss arising from this email. 本邮件所载任何内容仅作为业务层面交流与参考，除非明确说明，本公司不对邮件所载内容之准确性、完整性或公平性等承担任何法律责任。 Any contents contained in this email are only for the purpose of business communication and reference only. Unless explicitly stated otherwise, the Company shall not assume any legal responsibility for the accuracy, completeness or fairness of the content contained in the email. 本邮件指定收件人应特别注意：本邮件所载任何内容不构成本公司对本邮件指定收件人和/或其所属商业实体的任何要约、要约邀请或承诺，任何权利义务皆以双方签字盖章的书面文件为准。除经本公司以签字盖章的书面文件确认外，收件人和/或其所属商业实体不得以本邮件所载任何内容作为其向本公司主张任何权利或利益的正式依据。 The designated receivers should pay special attention to the fact that nothing contained in this email shall constitute an offer, invitation or acceptance by the Company to the designated receivers of this email and/or its affiliated business entities, and any rights and obligations are subject to the written documents signed and sealed by both parties. Except from the written document signed ,sealed and confirmed by the Company, the receivers and / or its affiliated business entity shall not rely on anything contained in this email as the formal basis for claiming any rights or interests to the Company.

1 0

getKernelWcetUs: where does the 10us return value come from?
by Jack Chen 09 Dec '21

09 Dec '21

Hi all, Quick questions regarding the return value of getKernelWcetUs(): 1. For ARM the value is assigned during build process taking config.cmake files, where KERNEL_WCET's are all 10us (except for tk1 it's 100us, typo?) For x86 the function returns 10 directly, and for risc-v, comment suggests it's copied from x86 hoping it's an overestimate. Where does this "10us" come from? Based on static estimate done previously on Armv6 (imx31)? AOS lecture mentioned a "378us" kernel WCET estimate and 99.5us observed WCET for Armv6. 2. Is this 10us WCET value the one used as padding in the Temporal Partitioning routine? ("worst-case flushing time"?) Regards, Jack

3 5

Incorporating seL4 into your project, risc-v architecture
by so_s＠gmx.de 08 Dec '21

08 Dec '21

Dear seL4 devs and community. I try to create a simple project using the seL4 micro kernel. For setting up my environment I followed this (https://github.com/manu88/SeL4_101) and this (https://docs.sel4.systems/projects/buildsystem/incorporating.html) article. As kernel I'm using the last release of SeL4 (https://github.com/seL4/seL4/releases/tag/12.1.0) I created some kind of user application, like Manu88 did with a simple Hello World C-Program. While building with the delivered init-build.sh script I got a lot of repeating errors like this: CMake Error at tools/cmake-tool/helpers/simulation.cmake:179 (add_custom_command): Error evaluating generator expression: $<TARGET_PROPERTY:rootserver_image,KERNEL_IMAGE_NAME> Target "rootserver_image" not found. Call Stack (most recent call first): CMakeLists.txt:22 (GenerateSimulateScript) While going through Manu88s guide I saw that he also got this errors. But after adding a CMakeList.txt file inside his user code, and declaring it as rootserver inside the CMakeList.txt file (I just copied the contents from here: https://github.com/manu88/SeL4_101/blob/master/projects/Hello/CMakeLists.txt) he got rid of the errors. I still get them and searching through the internet could not find a solution for me. Bellow I added the folder structure of my project. Project/ ├── kernel/ ├── projects/ │ ├── Hello/ │ ├── musllibc/ │ ├── utils_libs/ │ ├── seL4_libs/ ├── build/ ├── tools/ │ └── cmake-tool/ │ └── elfloader-tool/ ├── init-build.sh -> tools/cmake-tool/init-build.sh ├── CMakeLists.txt ├── application_settings.cmake -> tools/cmake-tool/helpers/application_settings.cmake ├── settings.cmake So I cannot tell where the issue lies. Any pointers would be appreciated. Kind regards, Sophia

2 3

capdl-loader questions
by Sam Leffler 08 Dec '21

08 Dec '21

I've been investigating how capd-loader works and have some questions. My apologies if these were previously discussed. 1. CDL_Model is mutable. The capDL specification looks like a perfect candidate for being in .rodata but it's stored+treated as mutable. Why? I see capdl-loader uses the mutability to store mapped page frame caps and, for risc-v, VSpace roots, but both can be easily handled w/o modifying the spec. Having this immutable has many benefits. 2. All page frames are treated as shared. CAPDL_SHARED_FRAMES is #define'd in the code so every frame is treated as shared. This inflates the size of the orig_caps array and the kernel capabilities table but seems unnecessary. Why? I've verified that instead of doing the Copy op on each page you can just check the return of the seL4_Page_Map call and if necessary clone the cap. Better would be for camkes to identify shared page frames so this doesn't require 2x syscalls (which spam's the console w/ CONFIG_PRINTING enabled). 3. Why does copy_addr_with_pt exist? There are two memory regions created for mapping page frames into the rootserver address space for doing fill ops. One is 64KB and the other is 1 page (nominally 4KB). init_frame tries the 4KB region first then falls back to the 64K region if mapping into the 4KB region fails. Why (i.e. why would the 1st mapping call fail)? On my risc-v system I never use the 64K region and I'm not sure when it might be used? Even if it were used, why is 64K always allocated; seems like the region should be sized according to the target platform. Having this extra region has a cost that can be significant on small systems. 4. console output. Why is sel4_DebugPutChar (or similar) not a standard part of the kernel? This forces capdl-loader to depend on libsel4platsupport for console output which in turn affects cap space. I can't imagine an seL4 system that cannot write to the console and I think it's entirely reasonable to have a critical system service like the rootserver use that. 5. duplicate_caps. The scheme for constructing a running system from a spec is straightforward except for duplicating caps. Why are all TCB's and CNode caps dup'd? Why does init_tcbs call init_tcb on the original object but immediately configure_tcb on the dup? There are other places where the dup cap is used instead of the original cap (e.g. init_cnode_slot). None of this seems to matter on risc-v; maybe this matters on some other architectures? 6. On risc-v all pages appear to be marked executable--including ipc buffers! This seems just wrong and a potential security hole. 7. Why does seL4_TCB_WriteRegisters take a _mutable_ seL4_UserContext? I'm guessing this is a mistake in the xml spec (but haven't looked). 8. init_cspaces mystifies me. There are two loops over all CNodes; one that does "COPY" operations and one that does "MOVE" operations. I see nothing explaining what's happening. I've read this code many times and still don't get it; please explain. 9. According to comments, the use of a global static to setup the UserContext for a new TCB is done because one cannot take the address of a local variable. On what architecture is this true? On risc-v the context is copied into "registers" before calling the kernel so this doesn't appear to be an issue with crossing the user-kernel protection boundary. 10. Memory reclamation. I'm unclear what happens to the memory used by capdl-loader. The process does a TCB_Suspend call when it's done. Does this cause the CSpace & VSpace to be reclaimed? For CAmkES this doesn't matter as there's no support for allocating memory but I'm building a system where this isn't true. How do I release memory (in particular) back to the untyped pool? I have a bunch of niggly code complaints/questions but let's start with the above. -Sam

2 4

Re: some performance problem when test 4 cores SMP答复: Devel Digest, Vol 127, Issue 5
by yadong.li 07 Dec '21

07 Dec '21

Hi: > So you would expect that the reported metric would scale following Amdahl's law based on the proportion of an operation that is serialized inside the kernel lock which would potentially vary across platforms. > It cannot simply be throughput, else the doubled delay should be reflected in a significantly reduced throughput, but it has almost no effect. 1. This is what I also feel confused, I think whether it is depend on the implementation of ipc_normal_delay ipc_normal_delay will call below code: delay = OVERHEAD_FIXUP(REXP(id) * current_delay_cycle, overhead); insert a command such as 'zigset(...)'for every core, The ziggurat method for generating random variables, when double delay, the random variables coefficient will reduce the delay influence? 2. " the proportion of an operation that is serialized inside the kernel lock ", CLH lock is serialized between cores, if 4 cores will have big different performance on different ARM platform? > For 3 or 4 cores the combined latency of two IPCs is larger than the 500cy delay and you expect lock contention, resulting in reduced scaling, while it should still scale almost perfectly with the 1000cy delay. > > > Addition： > > Our seL4_Call performance is same with other platform > > XXXX IMX8MM_EVK_64 TX2_64 > > seL4_Call 367(0) 378(2) 492(16) client->server, same vspace, ipc_len is 0 > > seL4_ReplyRecv 396(0) 402(2) 513(16) server->client, same vspace, ipc_len is 0 1. the seL4_Call and seL4_ReplyRecv are measured on SMP kernel 2. or 3 or 4 cores the combined latency of two IPCs is larger than the 500cy delay and you expect lock contention ---- that's what I thought at first, But It can't be explained very well on IMX8MM_EVK_64, base on the test seL4_Call data, when run on 3 cores and 4cores, IMX8MM_EVK_64 still have a good scalability, so I think not all seL4_Call and ReplyRecv flow which cost maybe 300 or 400 is locked(like el trap), TX2 should have a good scalability as expected when run on 3 or 4 cores, but it did not show good, from data below：1497740（3core， 500cycles），1545872（4core） > > My test results below: > > ARM platform > > Test item XXX IMX8MM_EVK_64 TX2 > > mean(Stddev) > > 500 cycles, 1 core 636545(46) 625605(29) 598142(365) > > 500 cycles, 2 cores 897900(2327) 1154209(44) 994298(94) > > 500 cycles, 3 cores 1301679(2036) 1726043(65) 1497740(127) > > 500 cycles, 4 cores 1387678(549) 2172109(12674) 1545872(109) > > 1000 cycles, 1 core 636529(42) 625599(22) 597627(161) > > 1000 cycles, 2 cores 899212(3384) 1134110(34) 994437(541) > > 1000 cycles, 3 cores 1297322(5028) 1695385(45) 1497547(714) > > 1000 cycles, 4 cores 1387149(456) 2174605(81) 1545716(614) > I notice your standard deviations for 2 and 3 cores are surprisingly high (although still small in relative terms). > > Did you try running the same again? Are the numbers essentially the same or are multiple runs all over the shop? 1. Yes，I test several times，I always get the same results, have little different 2. I think the stddev is small relative to our test results, IMX8MM_EVK_64 also have a big stddev(500 cycles, 3core) from the data. -----邮件原件----- 发件人: devel-request(a)sel4.systems [mailto:devel-request@sel4.systems] 发送时间: 2021年12月7日 11:45 收件人: devel(a)sel4.systems 主题: Devel Digest, Vol 127, Issue 5 Send Devel mailing list submissions to devel(a)sel4.systems To subscribe or unsubscribe via email, send a message with subject or body 'help' to devel-request(a)sel4.systems You can reach the person managing the list at devel-owner(a)sel4.systems When replying, please edit your Subject line so it is more specific than "Re: Contents of Devel digest..." Today's Topics: 1. Re: Use TimeServer by Group Components Questions (Kent Mcleod) 2. Re: Incorporating seL4 into your project, risc-v architecture (Kent Mcleod) 3. Re: some performance problem when test 4 cores SMP benchmark of seL4bench project 答复: Devel Digest, Vol 127, Issue 1 (Kent Mcleod) 4. Re: Use TimeServer by Group Components Questions (15852538526(a)139.com) 5. Re: Use TimeServer by Group Components Questions (Kent Mcleod) 6. Re: some performance problem when test 4 cores SMP benchmark of seL4bench project 答复: Devel Digest, Vol 127, Issue 1 (Gernot Heiser) ---------------------------------------------------------------------- Message: 1 Date: Tue, 7 Dec 2021 13:03:00 +1100 From: Kent Mcleod <kent.mcleod72(a)gmail.com> Subject: [seL4] Re: Use TimeServer by Group Components Questions To: 15852538526(a)139.com Cc: devel <devel(a)sel4.systems> Message-ID: <CA+-ozWeJgZm3B902EKBU6dUGxy6wU3Cp92jEUYwRKNFcVS=7DA(a)mail.gmail.com> Content-Type: text/plain; charset="UTF-8" On Fri, Dec 3, 2021 at 2:51 PM <15852538526(a)139.com> wrote: > > I got an problem when I use TimeServer with Group Components. I wish more than one component in the same Group Components, that can use TimeServer. While the cdl only have one ep for all components in the Group to communicate to TimeServer with an badge value that not equal to zero. And TimeServer must to distinguish requester by the badge, so only one component can receive TimeServer's response. How can I resolve this problem? The TimeServer component cannot be used as part of a Group component. The Group component mechanism isn't designed to transparently work for any component and the Connection types that the TimeServer uses are not compatible with the Group mechanism. > _______________________________________________ > Devel mailing list -- devel(a)sel4.systems To unsubscribe send an email > to devel-leave(a)sel4.systems ------------------------------ Message: 2 Date: Tue, 7 Dec 2021 13:14:30 +1100 From: Kent Mcleod <kent.mcleod72(a)gmail.com> Subject: [seL4] Re: Incorporating seL4 into your project, risc-v architecture To: so_s(a)gmx.de Cc: devel <devel(a)sel4.systems> Message-ID: <CA+-ozWeU7Bi-byXhsvo9jnQ_tcn90U7QRa8_hh39p2rVgUcKzA(a)mail.gmail.com> Content-Type: text/plain; charset="UTF-8" On Fri, Dec 3, 2021 at 8:14 AM <so_s(a)gmx.de> wrote: > > Dear seL4 devs and community. > > I try to create a simple project using the seL4 micro kernel. For setting up my environment I followed this (https://github.com/manu88/SeL4_101) and this (https://docs.sel4.systems/projects/buildsystem/incorporating.html) article. As kernel I'm using the last release of SeL4 (https://github.com/seL4/seL4/releases/tag/12.1.0) I created some kind of user application, like Manu88 did with a simple Hello World C-Program. While building with the delivered init-build.sh script I got a lot of repeating errors like this: > CMake Error at tools/cmake-tool/helpers/simulation.cmake:179 (add_custom_command): > Error evaluating generator expression: > > $<TARGET_PROPERTY:rootserver_image,KERNEL_IMAGE_NAME> > > Target "rootserver_image" not found. > Call Stack (most recent call first): > CMakeLists.txt:22 (GenerateSimulateScript) While going through > Manu88s guide I saw that he also got this errors. But after adding a CMakeList.txt file inside his user code, and declaring it as rootserver inside the CMakeList.txt file (I just copied the contents from here: https://github.com/manu88/SeL4_101/blob/master/projects/Hello/CMakeLists.txt) he got rid of the errors. I still get them and searching through the internet could not find a solution for me. Bellow I added the folder structure of my project. > Project/ > ├── kernel/ > ├── projects/ > │ ├── Hello/ > │ ├── musllibc/ > │ ├── utils_libs/ > │ ├── seL4_libs/ > ├── build/ > ├── tools/ > │ └── cmake-tool/ > │ └── elfloader-tool/ > ├── init-build.sh -> tools/cmake-tool/init-build.sh > ├── CMakeLists.txt > ├── application_settings.cmake -> > tools/cmake-tool/helpers/application_settings.cmake > ├── settings.cmake > > So I cannot tell where the issue lies. Any pointers would be appreciated. If you are using https://github.com/manu88/SeL4_101/blob/master/projects/Hello/CMakeLists.txt inside projects/Hello/ then you need to make sure that the top level CMakeLists inside Project/ is either a symlink to tools/cmake-tool/default-CMakeLists.txt or is similar to https://github.com/manu88/SeL4_101/blob/master/CMakeLists.txt. With this file layout, ../init-build.sh will end up calling the following CMake invocation: `cmake -DCMAKE_TOOLCHAIN_FILE=../kernel/gcc.cmake -G Ninja -DSEL4_CACHE_DIR=../.sel4_cache -C "../settings.cmake" "../"`. What is the contents of your settings.cmake file? > > Kind regards, > Sophia > _______________________________________________ > Devel mailing list -- devel(a)sel4.systems To unsubscribe send an email > to devel-leave(a)sel4.systems ------------------------------ Message: 3 Date: Tue, 7 Dec 2021 13:43:48 +1100 From: Kent Mcleod <kent.mcleod72(a)gmail.com> Subject: [seL4] Re: some performance problem when test 4 cores SMP benchmark of seL4bench project 答复: Devel Digest, Vol 127, Issue 1 To: Gernot Heiser <gernot(a)unsw.edu.au> Cc: "devel(a)sel4.systems" <devel(a)sel4.systems> Message-ID: <CA+-ozWcihN6my4WOyPbpCcfp3=rksYSnnEgZE2kc6c-BV4Kymw(a)mail.gmail.com> Content-Type: text/plain; charset="UTF-8" On Thu, Dec 2, 2021 at 9:28 PM Gernot Heiser <gernot(a)unsw.edu.au> wrote: > > > > > On 2 Dec 2021, at 16:17, yadong.li <yadong.li(a)horizon.ai> wrote: > > > > First, I got the data of IMX8MM_EVK_64 and TX2 from > > https://github.com/seL4/sel4bench/actions/runs/1469475721#artifacts, > > the sel4bench-results-imx8mm_evk file and sel4bench-results-tx2 file, unpack the file out, I find xxxx_SMP_64.json Secondly, the test is the smp benchmark form sel4bench-manifest project, the source file is sel4bench/apps/smp/src/main.c The test scenario look like below: > > A pair thread of ping-pong on the same core, the ping thread will > > wait for "ipc_normal_delay" time then send 0 len ipc message to pong > > thread, then return. I think the 500 cycles mean how long > > ipc_normal_delay will really delay > > > The above scenario will test on one core, or mutil core. If we run 4 cores, every core will have a ping thread and a pong thread run like above description, then record the sum of all cores ping-pong counts. > > ok, but what is the metric reported? [Apologies for not being on top > of the details of our benchmarking setups.] Looking at the sel4bench smp benchmark implementation, the metric is the total number of "operations" in a single second. An operation is a round trip intra address space seL4_Call + seL4_ReplyRecv between 2 threads on the same core with each thread delaying for the cycle count before performing the next operation. After 1 second of all cores performing these operations continuously and maintaining a core-local (on a separate cache line) count, the total number of operations is added together and reported as the final number. So you would expect that the reported metric would scale following Amdahl's law based on the proportion of an operation that is serialized inside the kernel lock which would potentially vary across platforms. > > It cannot simply be throughput, else the doubled delay should be reflected in a significantly reduced throughput, but it has almost no effect. > > > I think this experiment is used to illustrate in multi core, our seL4 kernel big lock will not affect mutli-core performance, am I right ? > > Not quite. As there’s only one big lock, only one core can execute the kernel at any time. If one core is in the IPC while another core is trying to IPC, even though both IPCs are core-local, the second will have to wait until the first gets out of the lock. > > As the delay is higher than the syscall latency, you’d expect perfect scalability from one core to two (with the lock essentially synchronising the threads). For 3 or 4 cores the combined latency of two IPCs is larger than the 500cy delay and you expect lock contention, resulting in reduced scaling, while it should still scale almost perfectly with the 1000cy delay. This is exactly what you see for the i.MX8 and the TX2. > > > Addition： > > Our seL4_Call performance is same with other platform > > XXXX IMX8MM_EVK_64 TX2_64 > > seL4_Call 367(0) 378(2) 492(16) client->server, same vspace, ipc_len is 0 > > seL4_ReplyRecv 396(0) 402(2) 513(16) server->client, same vspace, ipc_len is 0 > > OK, so baseline performance is good. But are these measured on a single-core or SMP kernel (i.e. is locking included)? > > > My test results below: > > ARM platform > > Test item XXX IMX8MM_EVK_64 TX2 > > mean(Stddev) > > 500 cycles, 1 core 636545(46) 625605(29) 598142(365) > > 500 cycles, 2 cores 897900(2327) 1154209(44) 994298(94) > > 500 cycles, 3 cores 1301679(2036) 1726043(65) 1497740(127) > > 500 cycles, 4 cores 1387678(549) 2172109(12674) 1545872(109) > > 1000 cycles, 1 core 636529(42) 625599(22) 597627(161) > > 1000 cycles, 2 cores 899212(3384) 1134110(34) 994437(541) > > 1000 cycles, 3 cores 1297322(5028) 1695385(45) 1497547(714) > > 1000 cycles, 4 cores 1387149(456) 2174605(81) 1545716(614) > > I notice your standard deviations for 2 and 3 cores are surprisingly high (although still small in relative terms). > > Did you try running the same again? Are the numbers essentially the same or are multiple runs all over the shop? > > There are some issues with our benchmarking methodology. Fixing up sel4bench is one of the projects I’d like to do if I got a student for it, or maybe someone from the community would want to help? > > But just from looking at the data I’m not sure that’s the issue here. > > Gernot > _______________________________________________ > Devel mailing list -- devel(a)sel4.systems To unsubscribe send an email > to devel-leave(a)sel4.systems ------------------------------ Message: 4 Date: Tue, 07 Dec 2021 03:06:38 -0000 From: 15852538526(a)139.com Subject: [seL4] Re: Use TimeServer by Group Components Questions To: devel(a)sel4.systems Message-ID: <163884639883.1070957.2394639262660252936(a)mattermost.seL4.systems> Content-Type: text/plain; charset="utf-8" Thank you very much for answering my question. I still have a doubt about the TimeServer. I can manually modify the cdl file and then I get the the expected source file(capdl_spec.c) from using capdl-parse. I also need to change the return value of timeserver <IF>_notification API. I have try and I can run the program as I expected. Is there any way to create adapted cdl file automatic by modifying the ADL parse project? I am looking forward to getting your answer again. Thank you very much. my ADL file: import <std_connector.camkes>; import <global-connectors.camkes>; import <TimeServer/TimeServer.camkes>; component Client { control; uses Timer timeout; } assembly { composition { group grp { component Client c1; component Client c2; } component TimeServer time_server; connection seL4TimeServer ts1( from grp.c1.timeout, to time_server.the_timer); connection seL4TimeServer ts2( from grp.c2.timeout, to time_server.the_timer); } configuration { time_server.timers_per_client = 1; } } ------------------------------ Message: 5 Date: Tue, 7 Dec 2021 14:23:54 +1100 From: Kent Mcleod <kent.mcleod72(a)gmail.com> Subject: [seL4] Re: Use TimeServer by Group Components Questions To: 15852538526(a)139.com Cc: devel <devel(a)sel4.systems> Message-ID: <CA+-ozWestyqAM4wy+x359CLZLf13PzdCRBNFSfPY-3nyo9Y6wA(a)mail.gmail.com> Content-Type: text/plain; charset="UTF-8" On Tue, Dec 7, 2021 at 2:09 PM <15852538526(a)139.com> wrote: > > Thank you very much for answering my question. I still have a doubt about the TimeServer. I can manually modify the cdl file and then I get the the expected source file(capdl_spec.c) from using capdl-parse. I also need to change the return value of timeserver <IF>_notification API. I have try and I can run the program as I expected. Is there any way to create adapted cdl file automatic by modifying the ADL parse project? There isn't a supported way to modify the generated cdl file as CAmkES expects to generate a full system specification. What is your motivation for trying to make the timeserver a group component instead of a separate component? As part of a group component it will still have its own kernel objects for its threads, code, data and heap memories so you still have the costs of isolation but without the benefits because it still shares the virtual address space and capability space with other components in the same group. > I am looking forward to getting your answer again. Thank you very much. > > my ADL file: > import <std_connector.camkes>; > import <global-connectors.camkes>; > import <TimeServer/TimeServer.camkes>; > > component Client { > control; > uses Timer timeout; > } > > assembly { > composition { > group grp { > component Client c1; > component Client c2; > } > component TimeServer time_server; > > connection seL4TimeServer ts1( > from grp.c1.timeout, to time_server.the_timer); > connection seL4TimeServer ts2( > from grp.c2.timeout, to time_server.the_timer); > } > > configuration { > time_server.timers_per_client = 1; > } > } > _______________________________________________ > Devel mailing list -- devel(a)sel4.systems To unsubscribe send an email > to devel-leave(a)sel4.systems ------------------------------ Message: 6 Date: Tue, 7 Dec 2021 03:45:09 +0000 From: Gernot Heiser <gernot(a)unsw.edu.au> Subject: [seL4] Re: some performance problem when test 4 cores SMP benchmark of seL4bench project 答复: Devel Digest, Vol 127, Issue 1 To: "devel(a)sel4.systems" <devel(a)sel4.systems> Message-ID: <17FC6BC4-3407-44AE-B7AA-4623EFF76988(a)unsw.edu.au> Content-Type: text/plain; charset="utf-8" On 7 Dec 2021, at 13:43, Kent Mcleod <kent.mcleod72(a)gmail.com> wrote: > > Looking at the sel4bench smp benchmark implementation, the metric is > the total number of "operations" in a single second. An operation is > a round trip intra address space seL4_Call + seL4_ReplyRecv between 2 > threads on the same core with each thread delaying for the cycle count > before performing the next operation. After 1 second of all cores > performing these operations continuously and maintaining a core-local > (on a separate cache line) count, the total number of operations is > added together and reported as the final number. So you would expect > that the reported metric would scale following Amdahl's law based on > the proportion of an operation that is serialized inside the kernel > lock which would potentially vary across platforms. Thanks for the explanation, Kent. Observations: 1) The metric is essentially independent of the delay. Looking at the single-core figures for the i/MX8, I get 1598.5 ns in both cases, the difference being 15ps. Doesn’t make sense to me. 2) Assuming this processor runs at the 1.8GHz it seems speced for, this corresponds to 2877 cycles, which is huge, even if the 1000cy delay is subtracted! 3) As I said before, intra-AS IPC is a meaningless metric we should never use (but that’s incidental to the particular thing we want to measure here). 4) Having to do these calculations to understand the numbers is a sure indication that the results are presented in an unsuitable form. I can’t see how these figures make sense. Gernot ------------------------------ Subject: Digest Footer _______________________________________________ Devel mailing list -- devel(a)sel4.systems To unsubscribe send an email to devel-leave(a)sel4.systems ------------------------------ End of Devel Digest, Vol 127, Issue 5 *************************************

1 0

CfP: Microkernel and Component-based OS Devroom at FOSDEM 2022
by Alexander Boettcher 07 Dec '21

07 Dec '21

Hello seL4 community, FOSDEM 2022 will be an online event (again) with the traditional Microkernel devroom as part of it. Thanks to Martin Decky & my colleague Sebastian Sumpf for engagement! The original Call for Papers follows. Best regards, Alexander. -- Alexander Boettcher Genode Labs https://www.genodians.org - https://www.genode.org ------------------------------------------------------------------------------------------------------ Microkernel and Component-based OS Devroom at FOSDEM 2022 CALL FOR PARTICIPATION On-line version of this CfP: http://fosdem.microkernel.info/ The developers and users of several free and open source microkernel-based and component-based operating systems will meet on-line as part of FOSDEM 2022 [1] and will share a developer room. The devroom is currently looking for content in the form of talks and activities related to the area of microkernel-based, unikernel-based, component-based operating systems and similar topics. The devroom has been preliminarily scheduled to Saturday February 5th 2022. The devroom will take place during European day hours. Possible topics of the devroom include, but are not limited to: * introduction of a specific OS or framework * design of subsystems and the general architecture of an OS * languages, tools and toolchains used * enabling support for hardware (architectures, device drivers) and programming languages * development processes, debugging * maintenance, testing and release engineering * safety, security and robustness * trends and challenges * research and open questions * community and governance * use cases, experiences and status updates * best practices and lessons learned * demos This is a call for your participation. We kindly ask you to submit your proposals no later than on December 28th 2021. Please use the Pentabarf web site [2] to submit your proposals. If you already have a user account in Pentabarf, please do not create a new one. Addtionally, make sure to select the Microkernel and Component-based OS Devroom as the track when submitting your talk and include at least the following information in your proposal: * title of your talk * your full name * short abstract of your talk (one or two paragraphs) * duration of your talk (at least 20 minutes and no longer than 50 minutes) * your short bio * your photo The talks will be pre-recorded in advance in January and streamed automatically during the event. This means that you will need to complete and submit your talk recording by January 15th 2022. However, each speaker should be also present on-line just after the streaming of their talk for a live Q&A. You can specify your prefered time slot of your talk. The communication language of the devroom is English. The official devroom schedule (along with the accepted talks) will be announced on December 31st 2021 on the devroom's mailing list [3] and the speakers will be notified via e-mail. The schedule will also be published on the FOSDEM web site. For any comments, questions and suggestions (e.g. suggestions for a different type of event during the devroom), please do not hesitate to use the devroom's mailing list [3]. About the Devroom Since the first Microkernel OS Devroom at FOSDEM 2012 [4], this devroom has been a part of each following FOSDEM (with slight variations of the name). The focus gradually widened to include component-based, unikernel-based and other operating systems. By now, it has become a somewhat institutionalized tradition for the open source operating systems community and it is one of the few places where microkernel enthusiasts and people with different views on how operating systems should work meet regularly. To this date, over a dozen projects have participated in one way or another. Many of the projects face similar challenges but come up with partially different solutions. Therefore, the goal of the devroom is to bring the various projects together, let them exchange ideas, cross-pollinate and socialize. Extraordinary Circumstances in 2022 (Again) Due to the extraordinary mode of organization of FOSDEM 2022 (being an on-line event again), the devroom talks will be required to be pre-recorded in January and streamed during the event (with a live Q&A). The talk videos will be published under Creative Commons license by FOSDEM. By submitting a recorded talk, the speaker agrees to have it made available publicly indefinitively. For organizational purposes, we also need contact information of the speakers of accepted talks. Please check the official CfP page [5] of the devroom regularly. We will keep updating it as technical guidelines will be set by the FOSDEM organizers. Microkernel Dinner Sadly, it will not be possible to arrange our traditional microkernel dinner and other in-person social gatherings in Brussels this time again. However, we plan a closing event of the devroom as a loose approximation of the microkernel dinner. The details will be announced later. We encourage the on-line participats to bring their own food and beverages. About FOSDEM FOSDEM [6] is a two-day event organized by volunteers to promote the widespread use of free and open source software. FOSDEM is widely recognized as one of the best such conferences worldwide. FOSDEM covers a wide spectrum of free and open source software and hardware projects and offers a platform for people to collaborate. To this end, FOSDEM has set up developer rooms (devrooms) where teams can meet and showcase their projects. Devrooms are a place for teams to discuss, hack and publicly present latest directions, lightning talks, news and proposals. Besides developer rooms, FOSDEM also offers main tracks, lightning talks, certification exams and project stands. In recent years, FOSDEM has been hosting more than 5000 developers annually at the ULB Solbosch campus. Due to the circumstances, FOSDEM 2022 will be organized as an on-line event. The participation in FOSDEM is totally free, although the organizers gratefully accept donations and sponsorship. No registration is necessary, but attendees are expected to follow the FOSDEM's code of conduct [7]. Important Dates Recap * 2021-12-28: Deadline for talk proposal submission * 2021-12-31: Schedule published and speakers notified of acceptance * 2022-01-15: Deadline for talk pre-recoding submission * 2022-02-05: Devroom taking place on-line Contact In case of any comments, questions and suggestions, please do not hesitate to contact the devroom organizers via the devroom's mailing list [3]. The primary organizers of the devroom in 2022 are: * Sebastian Sumpf * Martin Decky Links [1] https://fosdem.org/2022/ [2] https://penta.fosdem.org/submission/FOSDEM22/ [3] https://lists.fosdem.org/listinfo/microkernel-devroom [4] https://archive.fosdem.org/2012/schedule/track/microkernel_os_devroom.html [5] http://fosdem.microkernel.info/ [6] https://fosdem.org/ [7] https://fosdem.org/2022/practical/conduct/

1 0

Use TimeServer by Group Components Questions
by 15852538526＠139.com 07 Dec '21

07 Dec '21

I got an problem when I use TimeServer with Group Components. I wish more than one component in the same Group Components, that can use TimeServer. While the cdl only have one ep for all components in the Group to communicate to TimeServer with an badge value that not equal to zero. And TimeServer must to distinguish requester by the badge, so only one component can receive TimeServer's response. How can I resolve this problem?

2 4

Re: some performance problem when test 4 cores SMP benchmark of seL4bench project 答复: Devel Digest, Vol 127, Issue 1
by yadong.li 07 Dec '21

07 Dec '21

Hi professor Heiser： To understand what’s going on I’d need to know what these numbers are: - what is being measured, and what’s the 500/100cy parameter? - which web site are the “official” numbers from, they aren’t at https://sel4.systems/About/Performance/ First, I got the data of IMX8MM_EVK_64 and TX2 from https://github.com/seL4/sel4bench/actions/runs/1469475721#artifacts, the sel4bench-results-imx8mm_evk file and sel4bench-results-tx2 file, unpack the file out, I find xxxx_SMP_64.json Secondly, the test is the smp benchmark form sel4bench-manifest project, the source file is sel4bench/apps/smp/src/main.c The test scenario look like below: A pair thread of ping-pong on the same core, the ping thread will wait for "ipc_normal_delay" time then send 0 len ipc message to pong thread, then return. I think the 500 cycles mean how long ipc_normal_delay will really delay The above scenario will test on one core, or mutil core. If we run 4 cores, every core will have a ping thread and a pong thread run like above description, then record the sum of all cores ping-pong counts. I think this experiment is used to illustrate in multi core, our seL4 kernel big lock will not affect mutli-core performance, am I right ? Addition： Our seL4_Call performance is same with other platform XXXX IMX8MM_EVK_64 TX2_64 seL4_Call 367(0) 378(2) 492(16) client->server, same vspace, ipc_len is 0 seL4_ReplyRecv 396(0) 402(2) 513(16) server->client, same vspace, ipc_len is 0 Thank you for your help -----邮件原件----- 发件人: devel-request(a)sel4.systems [mailto:devel-request@sel4.systems] 发送时间: 2021年12月2日 9:00 收件人: devel(a)sel4.systems 主题: Devel Digest, Vol 127, Issue 1 Send Devel mailing list submissions to devel(a)sel4.systems To subscribe or unsubscribe via email, send a message with subject or body 'help' to devel-request(a)sel4.systems You can reach the person managing the list at devel-owner(a)sel4.systems When replying, please edit your Subject line so it is more specific than "Re: Contents of Devel digest..." Today's Topics: 1. Subscription (Xin Wang) 2. some performance problem when test 4 cores SMP benchmark of seL4bench project (yadong.li) 3. Re: some performance problem when test 4 cores SMP benchmark of seL4bench project (Gernot Heiser) ---------------------------------------------------------------------- Message: 1 Date: Wed, 1 Dec 2021 06:52:45 +0000 From: Xin Wang <xin.wang(a)bst.ai> Subject: [seL4] Subscription To: "devel(a)sel4.systems" <devel(a)sel4.systems> Message-ID: <BL0PR18MB2146092BCA3DBADBC26984ADF7689(a)BL0PR18MB2146.nam prd18.prod.outlook.com> Content-Type: text/plain; charset="gb2312" Hi sirs, Subscription Thanks, 从 Windows 版邮件<https://go.microsoft.com/fwlink/?LinkId=550986>发送 ------------------------------ Message: 2 Date: Wed, 1 Dec 2021 14:58:17 +0000 From: yadong.li <yadong.li(a)horizon.ai> Subject: [seL4] some performance problem when test 4 cores SMP benchmark of seL4bench project To: "devel(a)sel4.systems" <devel(a)sel4.systems> Message-ID: <2ae9929de02e481796d3d697182842c3(a)horizon.ai> Content-Type: text/plain; charset="gb2312" Hi, Now, I meet some performance problem when test 4 cores SMP benchmark of seL4bench on our platform. Out platform is XXX, But I get the test data of IMX8MM_EVK_64 and TX2 platform from seL4 website, I think they are official statistics. My test results below: ARM platform Test item XXX IMX8MM_EVK_64 TX2 mean(Stddev) 500 cycles, 1 core 636545(46) 625605(29) 598142(365) 500 cycles, 2 cores 897900(2327) 1154209(44) 994298(94) 500 cycles, 3 cores 1301679(2036) 1726043(65) 1497740(127) 500 cycles, 4 cores 1387678(549) 2172109(12674) 1545872(109) 1000 cycles, 1 core 636529(42) 625599(22) 597627(161) 1000 cycles, 2 cores 899212(3384) 1134110(34) 994437(541) 1000 cycles, 3 cores 1297322(5028) 1695385(45) 1497547(714) 1000 cycles, 4 cores 1387149(456) 2174605(81) 1545716(614) From these compare data: 1. When test smp bench on one core, the performance of several platform is similar 2. When test smp bench on muti core, the result of IMX8MM_EVK_64 is beauty, the result of 4 cores is 3.47 times as good as 1 core, I think it’s good 3. But the platform of TX2 has some different performance, the result of 2 cores is 1.66 times as good as 1 core, I still think is good, But the result of 3 cores almost have the same ping-pong count with 4 cores, why add one core, the count result not add as our expected ? 4. The performance of our platform is badly, on our platform, the result of 3 cores almost also have the same ping-pong count with 4 cores, and our count result of 4 cores just 2 times as good as one core, I think it is very bad 5. I want to know what are the possible causes of the badly performance about our platform XXX and TX2 ? ------------------------------ Message: 3 Date: Wed, 1 Dec 2021 21:09:41 +0000 From: Gernot Heiser <gernot(a)unsw.edu.au> Subject: [seL4] Re: some performance problem when test 4 cores SMP benchmark of seL4bench project To: "devel(a)sel4.systems" <devel(a)sel4.systems> Message-ID: <720E9728-1079-4455-BB0E-34A7C5CE88F4(a)unsw.edu.au> Content-Type: text/plain; charset="utf-8" Hi Yandong, To understand what’s going on I’d need to know what these numbers are: - what is being measured, and what’s the 500/100cy parameter? - which web site are the “official” numbers from, they aren’t at https://sel4.systems/About/Performance/ Gernot On 2 Dec 2021, at 01:58, yadong.li<http://yadong.li/> <yadong.li(a)horizon.ai<mailto:yadong.li@horizon.ai>> wrote: Hi, Now, I meet some performance problem when test 4 cores SMP benchmark of seL4bench on our platform. Out platform is XXX, But I get the test data of IMX8MM_EVK_64 and TX2 platform from seL4 website, I think they are official statistics. My test results below: ARM platform Test item XXX IMX8MM_EVK_64 TX2 mean(Stddev) 500 cycles, 1 core 636545(46) 625605(29) 598142(365) 500 cycles, 2 cores 897900(2327) 1154209(44) 994298(94) 500 cycles, 3 cores 1301679(2036) 1726043(65) 1497740(127) 500 cycles, 4 cores 1387678(549) 2172109(12674) 1545872(109) 1000 cycles, 1 core 636529(42) 625599(22) 597627(161) 1000 cycles, 2 cores 899212(3384) 1134110(34) 994437(541) 1000 cycles, 3 cores 1297322(5028) 1695385(45) 1497547(714) 1000 cycles, 4 cores 1387149(456) 2174605(81) 1545716(614) From these compare data: 1. When test smp bench on one core, the performance of several platform is similar 2. When test smp bench on muti core, the result of IMX8MM_EVK_64 is beauty, the result of 4 cores is 3.47 times as good as 1 core, I think it’s good 3. But the platform of TX2 has some different performance, the result of 2 cores is 1.66 times as good as 1 core, I still think is good, But the result of 3 cores almost have the same ping-pong count with 4 cores, why add one core, the count result not add as our expected ? 4. The performance of our platform is badly, on our platform, the result of 3 cores almost also have the same ping-pong count with 4 cores, and our count result of 4 cores just 2 times as good as one core, I think it is very bad 5. I want to know what are the possible causes of the badly performance about our platform XXX and TX2 ? _______________________________________________ Devel mailing list -- devel(a)sel4.systems<mailto:devel@sel4.systems> To unsubscribe send an email to devel-leave(a)sel4.systems<mailto:devel-leave@sel4.systems> ------------------------------ Subject: Digest Footer _______________________________________________ Devel mailing list -- devel(a)sel4.systems To unsubscribe send an email to devel-leave(a)sel4.systems ------------------------------ End of Devel Digest, Vol 127, Issue 1 *************************************

3 3

some performance problem when test 4 cores SMP benchmark of seL4bench project
by yadong.li 02 Dec '21

02 Dec '21

Hi, Now, I meet some performance problem when test 4 cores SMP benchmark of seL4bench on our platform. Out platform is XXX, But I get the test data of IMX8MM_EVK_64 and TX2 platform from seL4 website, I think they are official statistics. My test results below: ARM platform Test item XXX IMX8MM_EVK_64 TX2 mean(Stddev) 500 cycles, 1 core 636545(46) 625605(29) 598142(365) 500 cycles, 2 cores 897900(2327) 1154209(44) 994298(94) 500 cycles, 3 cores 1301679(2036) 1726043(65) 1497740(127) 500 cycles, 4 cores 1387678(549) 2172109(12674) 1545872(109) 1000 cycles, 1 core 636529(42) 625599(22) 597627(161) 1000 cycles, 2 cores 899212(3384) 1134110(34) 994437(541) 1000 cycles, 3 cores 1297322(5028) 1695385(45) 1497547(714) 1000 cycles, 4 cores 1387149(456) 2174605(81) 1545716(614) From these compare data: 1. When test smp bench on one core, the performance of several platform is similar 2. When test smp bench on muti core, the result of IMX8MM_EVK_64 is beauty, the result of 4 cores is 3.47 times as good as 1 core, I think it’s good 3. But the platform of TX2 has some different performance, the result of 2 cores is 1.66 times as good as 1 core, I still think is good, But the result of 3 cores almost have the same ping-pong count with 4 cores, why add one core, the count result not add as our expected ? 4. The performance of our platform is badly, on our platform, the result of 3 cores almost also have the same ping-pong count with 4 cores, and our count result of 4 cores just 2 times as good as one core, I think it is very bad 5. I want to know what are the possible causes of the badly performance about our platform XXX and TX2 ?

2 1

Subscription
by Xin Wang 01 Dec '21

01 Dec '21

Hi sirs, Subscription Thanks, 从 Windows 版邮件<https://go.microsoft.com/fwlink/?LinkId=550986>发送

1 0

VM Kernel Modules
by Michael Neises 20 Nov '21

20 Nov '21

Hello all, I recently spent a lot of time getting the camkes-vm-linux tutorial to work, because it is the only example I could find of compiling a kernel module for the linux vm as a part of the camkes build process. Unfortunately, the kernel module doesn't seem to work. For more information, see the previous email chain as well as https://github.com/NeisesResearch/vm_measure/wiki/Building-the-camkes_vm_li… . In lieu of doing things the right way, I believe I could compile a kernel module for the linux kernel that is provided as part of the camkes build system. I believe this is how the introspect-app accomplishes its work. However, I need to have the exact kernel and exact configuration in order to compile the kernel module correctly. Can anyone point me to the correct kernel version and configuration, so that I can target the provided linux kernel for module compilation? Or if there's a better way to get a kernel module in there, please let me know. Cheers, Michael Neises

4 5

the security whiltelist of smc call 答复: Devel Digest, Vol 124, Issue 1
by yadong.li 19 Nov '21

19 Nov '21

Hi: In our ARMv8 platform，we access secure world not only from the VM guest OS， but also form native compont like config clk register In ARMv8 platform, SMC instructions are not allowed from EL0. So in camkes-vm project, I create a new smc capability and a new syscall as a temporary solution, like below: "LIBSEL4_INLINE seL4_ARM_SMC_CallFunc_t seL4_ARM_SMC_CallFunc(seL4_ARM_SMC _service, seL4_Word function_id, seL4_Word arg0, seL4_Word arg1, seL4_Word arg2)" But I did not pay much attention to security, it is just meet our current work. I didnot really understand the essence of kernel whitelist mentioned by "https://sel4.atlassian.net/browse/RFC-9"? I have some question below, I feel the smc cap should like schedcontrol cap belong every core. 1. what is the whiltelist describe ? sip command smc function id? 2. how are the members of whilelist represented in the kernel , check the invLabel of syscall in kernel if we provide one smc cap not every function id? or just check the range of function id ? 3. Does each TCB have its own whitelist or does the entire system have a whitelist? thank you very much. -----邮件原件----- 发件人: devel-request(a)sel4.systems [mailto:devel-request@sel4.systems] 发送时间: 2021年11月10日 9:00 收件人: devel(a)sel4.systems 主题: Devel Digest, Vol 124, Issue 1 Send Devel mailing list submissions to devel(a)sel4.systems To subscribe or unsubscribe via email, send a message with subject or body 'help' to devel-request(a)sel4.systems You can reach the person managing the list at devel-owner(a)sel4.systems When replying, please edit your Subject line so it is more specific than "Re: Contents of Devel digest..." Today's Topics: 1. RFC-9: new capability for seL4 SMC Forwarding on Arm (Gerwin Klein) ---------------------------------------------------------------------- Message: 1 Date: Tue, 9 Nov 2021 21:52:58 +0000 From: Gerwin Klein <kleing(a)unsw.edu.au> Subject: [seL4] RFC-9: new capability for seL4 SMC Forwarding on Arm To: devel <devel(a)sel4.systems> Message-ID: <613858AC-3DB1-4D7C-A892-9ABDB5B31D58(a)unsw.edu.au> Content-Type: text/plain; charset="utf-8" I’d like to solicit discussion on the new RFC on forwarding Secure Monitor Calls on Arm: https://sel4.atlassian.net/browse/RFC-9 Relevant Arm documentation (SMC calling conventions): https://developer.arm.com/documentation/den0028/latest?_ga=2.116565828.3903… Any opinions, concerns, alternative designs? Cheers, Gerwin ------------------------------ Subject: Digest Footer _______________________________________________ Devel mailing list -- devel(a)sel4.systems To unsubscribe send an email to devel-leave(a)sel4.systems ------------------------------ End of Devel Digest, Vol 124, Issue 1 *************************************

1 0

Got it, Thank you for your help. 答复: Devel Digest, Vol 125, Issue 2
by yadong.li 18 Nov '21

18 Nov '21

-----邮件原件----- 发件人: devel-request(a)sel4.systems [mailto:devel-request@sel4.systems] 发送时间: 2021年11月18日 5:56 收件人: devel(a)sel4.systems 主题: Devel Digest, Vol 125, Issue 2 Send Devel mailing list submissions to devel(a)sel4.systems To subscribe or unsubscribe via email, send a message with subject or body 'help' to devel-request(a)sel4.systems You can reach the person managing the list at devel-owner(a)sel4.systems When replying, please edit your Subject line so it is more specific than "Re: Contents of Devel digest..." Today's Topics: 1. Re: some question about seL4 performance (Gerwin Klein) 2. Re: some question about seL4 performance (Gernot Heiser) 3. Re: some question about seL4 performance (Gerwin Klein) ---------------------------------------------------------------------- Message: 1 Date: Wed, 17 Nov 2021 21:24:57 +0000 From: Gerwin Klein <kleing(a)unsw.edu.au> Subject: [seL4] Re: some question about seL4 performance To: yadong.li <yadong.li(a)horizon.ai> Cc: "devel(a)sel4.systems" <devel(a)sel4.systems> Message-ID: <CA210292-C334-42C1-9FB4-48CAFDE8CCC6(a)unsw.edu.au> Content-Type: text/plain; charset="utf-8" > On 18 Nov 2021, at 02:06, yadong.li <yadong.li(a)horizon.ai> wrote: > > Hi： > I learn the sel4 performance form > https://sel4.systems/About/Performance/ > I focus on the ARMv8 platform, from the website, the parameters are as follows: > ISA Mode Core/SoC/Board Clock IRQ Invoke IPC call IPC reply > "Armv8a 64 A57/Tx1/Jetson 1.9 GHz 863 (18) 396(15) 397(4)" > > I want to know what is the length of IPC for the record provided on the web page , when test IPC call and reply? 0 or 10? The page reports the 0-length numbers. The idea is that IPC should fit into registers, the 10 case is the one that make it spill into memory deliberately. That number is good to know for development, but should not be the main performance characteristic. Cheers, Gerwin ------------------------------ Message: 2 Date: Wed, 17 Nov 2021 21:36:39 +0000 From: Gernot Heiser <gernot(a)unsw.edu.au> Subject: [seL4] Re: some question about seL4 performance To: "devel(a)sel4.systems" <devel(a)sel4.systems> Message-ID: <9885F4AB-61C0-46CD-B239-595E38482673(a)unsw.edu.au> Content-Type: text/plain; charset="utf-8" On 18 Nov 2021, at 08:24, Gerwin Klein <kleing(a)unsw.edu.au> wrote: > > The page reports the 0-length numbers. The idea is that IPC should fit into registers, the 10 case is the one that make it spill into memory deliberately. That number is good to know for development, but should not be the main performance characteristic. Note that whether data is transferred solely in registers or using a memory buffer does not make a big difference on contemporary hardware. However, our present implementation reverts to the slow path as soon as the message size overflows the physical message registers, which will make the PIC much slower. This is something that could be fixed by widening the fastpath conditions without much complications. However, we haven’t yet come across an important use case where this matters, so there isn’t much motivation for investing time in it. Gernot ------------------------------ Message: 3 Date: Wed, 17 Nov 2021 21:56:06 +0000 From: Gerwin Klein <kleing(a)unsw.edu.au> Subject: [seL4] Re: some question about seL4 performance To: Gernot Heiser <gernot(a)unsw.edu.au> Cc: "devel(a)sel4.systems" <devel(a)sel4.systems> Message-ID: <FFD95815-9F62-4A90-A3D0-59671152494D(a)unsw.edu.au> Content-Type: text/plain; charset="us-ascii" On 18 Nov 2021, at 08:36, Gernot Heiser <gernot(a)unsw.edu.au<mailto:gernot@unsw.edu.au>> wrote: On 18 Nov 2021, at 08:24, Gerwin Klein <kleing(a)unsw.edu.au<mailto:kleing@unsw.edu.au>> wrote: The page reports the 0-length numbers. The idea is that IPC should fit into registers, the 10 case is the one that make it spill into memory deliberately. That number is good to know for development, but should not be the main performance characteristic. Note that whether data is transferred solely in registers or using a memory buffer does not make a big difference on contemporary hardware. However, our present implementation reverts to the slow path as soon as the message size overflows the physical message registers, which will make the PIC much slower. Yes I should have mentioned that. If you look at the raw numbers for x86, eg. at https://github.com/seL4/sel4bench/actions/runs/1469475721#artifacts, fast path/no fast path is almost equal for length 10. You get a tiny bit better performance for length 10 when the fast path is switched off completely, because it doesn't first have to test whether to take the fast path or not. Cheers, Gerwin ------------------------------ Subject: Digest Footer _______________________________________________ Devel mailing list -- devel(a)sel4.systems To unsubscribe send an email to devel-leave(a)sel4.systems ------------------------------ End of Devel Digest, Vol 125, Issue 2 *************************************

1 0

some question about seL4 performance
by yadong.li 18 Nov '21

18 Nov '21

Hi： I learn the sel4 performance form https://sel4.systems/About/Performance/ I focus on the ARMv8 platform, from the website, the parameters are as follows: ISA Mode Core/SoC/Board Clock IRQ Invoke IPC call IPC reply "Armv8a 64 A57/Tx1/Jetson 1.9 GHz 863 (18) 396(15) 397(4)" I want to know what is the length of IPC for the record provided on the web page , when test IPC call and reply? 0 or 10? thank you very much

3 3

Crash problem, CAmkES-VM app with Ethernet passthrough
by hamed_ganji＠aut.ac.ir 18 Nov '21

18 Nov '21

Hello everyone, I attempt to make a simple CAmkES-VM app to load a Linux VM with Ethernet passthrough. After running, Linux kernel crashes while initializing the device (e1000). Can anyone guide me how to fix the problem, please. Thanks in advance. The used qemu command: ------------------------------------------------------------ $ qemu-system-x86_64 -machine q35,accel=kvm,kernel-irqchip=split -cpu Nehalem,+vme,+pdpe1gb,+xsave,+xsaveopt,+xsavec,+fsgsbase,+pcid,+invpcid,enforce,+vmx -nographic -serial mon:stdio -m size=4G -enable-kvm -device intel-iommu,intremap=off -net nic,model=e1000 -net tap,script=no,ifname=tap0 -kernel images/kernel-x86_64-pc99 -initrd images/capdl-loader-image-x86_64-pc99 ------------------------------------------------------------ Here is my CAmkES app definition: ------------------------------------------------------------ import <VM/vm.camkes>; #include <configurations/vm.h> #define VM_GUEST_CMDLINE "earlyprintk=ttyS0,115200 console=ttyS0,115200 i8042.nokbd=y i8042.nomux=y \ i8042.noaux=y io_delay=udelay noisapnp pci=nomsi debug root=/dev/mem" // nosmap acpi=off" component Init0 { VM_INIT_DEF() } assembly { composition { VM_COMPOSITION_DEF() VM_PER_VM_COMP_DEF(0) } configuration { VM_CONFIGURATION_DEF() VM_PER_VM_CONFIG_DEF(0) vm0.simple_untyped25_pool = 75; vm0.cnode_size_bits = 24; vm0.heap_size = 0x2000000; vm0.guest_ram_mb = 2048; vm0.kernel_cmdline = VM_GUEST_CMDLINE; vm0.kernel_image = "bzimage"; vm0.kernel_relocs = "bzimage"; vm0.initrd_image = "rootfs.cpio"; vm0.iospace_domain = 0x0f; vm0.pci_devices_iospace = 1; vm0.vm_ioports = [ {"start":0xc000, "end":0xc040, "pci_device":2, "name":"eth"}, ]; vm0.pci_devices = [ { "name":"eth", "bus":0, "dev":2, "fun":0, "irq":"eth_irq", "memory":[ {"paddr":0xfeb00000, "size":0x80000, "page_bits":12}, {"paddr":0xfeb80000, "size":0x20000, "page_bits":12} ] }, ]; vm0.vm_irqs = [ {"name":"eth_irq", "source":1, "level_trig":1, "active_low":1, "dest":11}, ]; } } ------------------------------------------------------------ The output lines: ------------------------------------------------------------ Booting from ROM..Boot config: debug_port = 0x3f8 Boot config: disable_iommu = false Detected 1 boot module(s): module #0: start=0xa1f000 end=0x1edbe18 size=0x14bce18 name='images/capdl-loader-image-x86_64-pc99' Parsing GRUB physical memory map Physical Memory Region from 0 size 9fc00 type 1 Physical Memory Region from 9fc00 size 400 type 2 Physical Memory Region from f0000 size 10000 type 2 Physical Memory Region from 100000 size 7fedf000 type 1 Adding physical memory region 0x100000-0x7ffdf000 Physical Memory Region from 7ffdf000 size 21000 type 2 Physical Memory Region from b0000000 size 10000000 type 2 Physical Memory Region from fed1c000 size 4000 type 2 Physical Memory Region from feffc000 size 4000 type 2 Physical Memory Region from fffc0000 size 40000 type 2 Physical Memory Region from 100000000 size 80000000 type 1 Adding physical memory region 0x100000000-0x180000000 Multiboot gave us no video information ACPI: RSDP paddr=0xf5ac0 ACPI: RSDP vaddr=0xf5ac0 ACPI: RSDT paddr=0x7ffe2140 ACPI: RSDT vaddr=0x7ffe2140 Kernel loaded to: start=0x100000 end=0xa1e000 size=0x91e000 entry=0x1012db ACPI: RSDT paddr=0x7ffe2140 ACPI: RSDT vaddr=0x7ffe2140 ACPI: FADT paddr=0x7ffe1f18 ACPI: FADT vaddr=0x7ffe1f18 ACPI: FADT flags=0x84a5 ACPI: DMAR paddr=0x7ffe20f8 ACPI: DMAR vaddr=0x7ffe20f8 ACPI: IOMMU host address width: 39 ACPI: 1 IOMMUs detected ACPI: MADT paddr=0x7ffe200c ACPI: MADT vaddr=0x7ffe200c ACPI: MADT apic_addr=0xfee00000 ACPI: MADT flags=0x1 ACPI: MADT_APIC apic_id=0x0 ACPI: MADT_IOAPIC ioapic_id=0 ioapic_addr=0xfec00000 gsib=0 ACPI: MADT_ISO bus=0 source=0 gsi=2 flags=0x0 ACPI: MADT_ISO bus=0 source=5 gsi=5 flags=0xd ACPI: MADT_ISO bus=0 source=9 gsi=9 flags=0xd ACPI: MADT_ISO bus=0 source=10 gsi=10 flags=0xd ACPI: MADT_ISO bus=0 source=11 gsi=11 flags=0xd ACPI: 1 CPU(s) detected ELF-loading userland images from boot modules: size=0x294b000 v_entry=0x408619 v_start=0x400000 v_end=0x2d4b000 p_start=0x1edc000 p_end=0x4827000 Moving loaded userland images to final location: from=0x1edc000 to=0xa1e000 size=0x294b000 Starting node #0 with APIC ID 0 Mapping kernel window is done IOMMU 0x0: 16-bit domain IDs supported IOMMU: Using 3 page-table levels (max. supported: 3) IOMMU: Create VTD context table for PCI bus 0x0 (pptr=0xffffff817e01d000) IOMMU: Create VTD context table for PCI bus 0x1 (pptr=0xffffff817e01e000) IOMMU: Create VTD context table for PCI bus 0x2 (pptr=0xffffff817e01f000) IOMMU: Create VTD context table for PCI bus 0x3 (pptr=0xffffff817e020000) IOMMU: Create VTD context table for PCI bus 0x4 (pptr=0xffffff817e021000) IOMMU: Create VTD context table for PCI bus 0x5 (pptr=0xffffff817e022000) IOMMU: Create VTD context table for PCI bus 0x6 (pptr=0xffffff817e023000) IOMMU: Create VTD context table for PCI bus 0x7 (pptr=0xffffff817e024000) IOMMU: Create VTD context table for PCI bus 0x8 (pptr=0xffffff817e025000) IOMMU: Create VTD context table for PCI bus 0x9 (pptr=0xffffff817e026000) IOMMU: Create VTD context table for PCI bus 0xa (pptr=0xffffff817e027000) IOMMU: Create VTD context table for PCI bus 0xb (pptr=0xffffff817e028000) IOMMU: Create VTD context table for PCI bus 0xc (pptr=0xffffff817e029000) IOMMU: Create VTD context table for PCI bus 0xd (pptr=0xffffff817e02a000) IOMMU: Create VTD context table for PCI bus 0xe (pptr=0xffffff817e02b000) IOMMU: Create VTD context table for PCI bus 0xf (pptr=0xffffff817e02c000) IOMMU: Create VTD context table for PCI bus 0x10 (pptr=0xffffff817e02d000) IOMMU: Create VTD context table for PCI bus 0x11 (pptr=0xffffff817e02e000) IOMMU: Create VTD context table for PCI bus 0x12 (pptr=0xffffff817e02f000) IOMMU: Create VTD context table for PCI bus 0x13 (pptr=0xffffff817e030000) IOMMU: Create VTD context table for PCI bus 0x14 (pptr=0xffffff817e031000) IOMMU: Create VTD context table for PCI bus 0x15 (pptr=0xffffff817e032000) IOMMU: Create VTD context table for PCI bus 0x16 (pptr=0xffffff817e033000) IOMMU: Create VTD context table for PCI bus 0x17 (pptr=0xffffff817e034000) IOMMU: Create VTD context table for PCI bus 0x18 (pptr=0xffffff817e035000) IOMMU: Create VTD context table for PCI bus 0x19 (pptr=0xffffff817e036000) IOMMU: Create VTD context table for PCI bus 0x1a (pptr=0xffffff817e037000) IOMMU: Create VTD context table for PCI bus 0x1b (pptr=0xffffff817e038000) IOMMU: Create VTD context table for PCI bus 0x1c (pptr=0xffffff817e039000) IOMMU: Create VTD context table for PCI bus 0x1d (pptr=0xffffff817e03a000) IOMMU: Create VTD context table for PCI bus 0x1e (pptr=0xffffff817e03b000) IOMMU: Create VTD context table for PCI bus 0x1f (pptr=0xffffff817e03c000) IOMMU: Create VTD context table for PCI bus 0x20 (pptr=0xffffff817e03d000) IOMMU: Create VTD context table for PCI bus 0x21 (pptr=0xffffff817e03e000) IOMMU: Create VTD context table for PCI bus 0x22 (pptr=0xffffff817e03f000) IOMMU: Create VTD context table for PCI bus 0x23 (pptr=0xffffff817e040000) IOMMU: Create VTD context table for PCI bus 0x24 (pptr=0xffffff817e041000) IOMMU: Create VTD context table for PCI bus 0x25 (pptr=0xffffff817e042000) IOMMU: Create VTD context table for PCI bus 0x26 (pptr=0xffffff817e043000) IOMMU: Create VTD context table for PCI bus 0x27 (pptr=0xffffff817e044000) IOMMU: Create VTD context table for PCI bus 0x28 (pptr=0xffffff817e045000) IOMMU: Create VTD context table for PCI bus 0x29 (pptr=0xffffff817e046000) IOMMU: Create VTD context table for PCI bus 0x2a (pptr=0xffffff817e047000) IOMMU: Create VTD context table for PCI bus 0x2b (pptr=0xffffff817e048000) IOMMU: Create VTD context table for PCI bus 0x2c (pptr=0xffffff817e049000) IOMMU: Create VTD context table for PCI bus 0x2d (pptr=0xffffff817e04a000) IOMMU: Create VTD context table for PCI bus 0x2e (pptr=0xffffff817e04b000) IOMMU: Create VTD context table for PCI bus 0x2f (pptr=0xffffff817e04c000) IOMMU: Create VTD context table for PCI bus 0x30 (pptr=0xffffff817e04d000) IOMMU: Create VTD context table for PCI bus 0x31 (pptr=0xffffff817e04e000) IOMMU: Create VTD context table for PCI bus 0x32 (pptr=0xffffff817e04f000) IOMMU: Create VTD context table for PCI bus 0x33 (pptr=0xffffff817e050000) IOMMU: Create VTD context table for PCI bus 0x34 (pptr=0xffffff817e051000) IOMMU: Create VTD context table for PCI bus 0x35 (pptr=0xffffff817e052000) IOMMU: Create VTD context table for PCI bus 0x36 (pptr=0xffffff817e053000) IOMMU: Create VTD context table for PCI bus 0x37 (pptr=0xffffff817e054000) IOMMU: Create VTD context table for PCI bus 0x38 (pptr=0xffffff817e055000) IOMMU: Create VTD context table for PCI bus 0x39 (pptr=0xffffff817e056000) IOMMU: Create VTD context table for PCI bus 0x3a (pptr=0xffffff817e057000) IOMMU: Create VTD context table for PCI bus 0x3b (pptr=0xffffff817e058000) IOMMU: Create VTD context table for PCI bus 0x3c (pptr=0xffffff817e059000) IOMMU: Create VTD context table for PCI bus 0x3d (pptr=0xffffff817e05a000) IOMMU: Create VTD context table for PCI bus 0x3e (pptr=0xffffff817e05b000) IOMMU: Create VTD context table for PCI bus 0x3f (pptr=0xffffff817e05c000) IOMMU: Create VTD context table for PCI bus 0x40 (pptr=0xffffff817e05d000) IOMMU: Create VTD context table for PCI bus 0x41 (pptr=0xffffff817e05e000) IOMMU: Create VTD context table for PCI bus 0x42 (pptr=0xffffff817e05f000) IOMMU: Create VTD context table for PCI bus 0x43 (pptr=0xffffff817e060000) IOMMU: Create VTD context table for PCI bus 0x44 (pptr=0xffffff817e061000) IOMMU: Create VTD context table for PCI bus 0x45 (pptr=0xffffff817e062000) IOMMU: Create VTD context table for PCI bus 0x46 (pptr=0xffffff817e063000) IOMMU: Create VTD context table for PCI bus 0x47 (pptr=0xffffff817e064000) IOMMU: Create VTD context table for PCI bus 0x48 (pptr=0xffffff817e065000) IOMMU: Create VTD context table for PCI bus 0x49 (pptr=0xffffff817e066000) IOMMU: Create VTD context table for PCI bus 0x4a (pptr=0xffffff817e067000) IOMMU: Create VTD context table for PCI bus 0x4b (pptr=0xffffff817e068000) IOMMU: Create VTD context table for PCI bus 0x4c (pptr=0xffffff817e069000) IOMMU: Create VTD context table for PCI bus 0x4d (pptr=0xffffff817e06a000) IOMMU: Create VTD context table for PCI bus 0x4e (pptr=0xffffff817e06b000) IOMMU: Create VTD context table for PCI bus 0x4f (pptr=0xffffff817e06c000) IOMMU: Create VTD context table for PCI bus 0x50 (pptr=0xffffff817e06d000) IOMMU: Create VTD context table for PCI bus 0x51 (pptr=0xffffff817e06e000) IOMMU: Create VTD context table for PCI bus 0x52 (pptr=0xffffff817e06f000) IOMMU: Create VTD context table for PCI bus 0x53 (pptr=0xffffff817e070000) IOMMU: Create VTD context table for PCI bus 0x54 (pptr=0xffffff817e071000) IOMMU: Create VTD context table for PCI bus 0x55 (pptr=0xffffff817e072000) IOMMU: Create VTD context table for PCI bus 0x56 (pptr=0xffffff817e073000) IOMMU: Create VTD context table for PCI bus 0x57 (pptr=0xffffff817e074000) IOMMU: Create VTD context table for PCI bus 0x58 (pptr=0xffffff817e075000) IOMMU: Create VTD context table for PCI bus 0x59 (pptr=0xffffff817e076000) IOMMU: Create VTD context table for PCI bus 0x5a (pptr=0xffffff817e077000) IOMMU: Create VTD context table for PCI bus 0x5b (pptr=0xffffff817e078000) IOMMU: Create VTD context table for PCI bus 0x5c (pptr=0xffffff817e079000) IOMMU: Create VTD context table for PCI bus 0x5d (pptr=0xffffff817e07a000) IOMMU: Create VTD context table for PCI bus 0x5e (pptr=0xffffff817e07b000) IOMMU: Create VTD context table for PCI bus 0x5f (pptr=0xffffff817e07c000) IOMMU: Create VTD context table for PCI bus 0x60 (pptr=0xffffff817e07d000) IOMMU: Create VTD context table for PCI bus 0x61 (pptr=0xffffff817e07e000) IOMMU: Create VTD context table for PCI bus 0x62 (pptr=0xffffff817e07f000) IOMMU: Create VTD context table for PCI bus 0x63 (pptr=0xffffff817e080000) IOMMU: Create VTD context table for PCI bus 0x64 (pptr=0xffffff817e081000) IOMMU: Create VTD context table for PCI bus 0x65 (pptr=0xffffff817e082000) IOMMU: Create VTD context table for PCI bus 0x66 (pptr=0xffffff817e083000) IOMMU: Create VTD context table for PCI bus 0x67 (pptr=0xffffff817e084000) IOMMU: Create VTD context table for PCI bus 0x68 (pptr=0xffffff817e085000) IOMMU: Create VTD context table for PCI bus 0x69 (pptr=0xffffff817e086000) IOMMU: Create VTD context table for PCI bus 0x6a (pptr=0xffffff817e087000) IOMMU: Create VTD context table for PCI bus 0x6b (pptr=0xffffff817e088000) IOMMU: Create VTD context table for PCI bus 0x6c (pptr=0xffffff817e089000) IOMMU: Create VTD context table for PCI bus 0x6d (pptr=0xffffff817e08a000) IOMMU: Create VTD context table for PCI bus 0x6e (pptr=0xffffff817e08b000) IOMMU: Create VTD context table for PCI bus 0x6f (pptr=0xffffff817e08c000) IOMMU: Create VTD context table for PCI bus 0x70 (pptr=0xffffff817e08d000) IOMMU: Create VTD context table for PCI bus 0x71 (pptr=0xffffff817e08e000) IOMMU: Create VTD context table for PCI bus 0x72 (pptr=0xffffff817e08f000) IOMMU: Create VTD context table for PCI bus 0x73 (pptr=0xffffff817e090000) IOMMU: Create VTD context table for PCI bus 0x74 (pptr=0xffffff817e091000) IOMMU: Create VTD context table for PCI bus 0x75 (pptr=0xffffff817e092000) IOMMU: Create VTD context table for PCI bus 0x76 (pptr=0xffffff817e093000) IOMMU: Create VTD context table for PCI bus 0x77 (pptr=0xffffff817e094000) IOMMU: Create VTD context table for PCI bus 0x78 (pptr=0xffffff817e095000) IOMMU: Create VTD context table for PCI bus 0x79 (pptr=0xffffff817e096000) IOMMU: Create VTD context table for PCI bus 0x7a (pptr=0xffffff817e097000) IOMMU: Create VTD context table for PCI bus 0x7b (pptr=0xffffff817e098000) IOMMU: Create VTD context table for PCI bus 0x7c (pptr=0xffffff817e099000) IOMMU: Create VTD context table for PCI bus 0x7d (pptr=0xffffff817e09a000) IOMMU: Create VTD context table for PCI bus 0x7e (pptr=0xffffff817e09b000) IOMMU: Create VTD context table for PCI bus 0x7f (pptr=0xffffff817e09c000) IOMMU: Create VTD context table for PCI bus 0x80 (pptr=0xffffff817e09d000) IOMMU: Create VTD context table for PCI bus 0x81 (pptr=0xffffff817e09e000) IOMMU: Create VTD context table for PCI bus 0x82 (pptr=0xffffff817e09f000) IOMMU: Create VTD context table for PCI bus 0x83 (pptr=0xffffff817e0a0000) IOMMU: Create VTD context table for PCI bus 0x84 (pptr=0xffffff817e0a1000) IOMMU: Create VTD context table for PCI bus 0x85 (pptr=0xffffff817e0a2000) IOMMU: Create VTD context table for PCI bus 0x86 (pptr=0xffffff817e0a3000) IOMMU: Create VTD context table for PCI bus 0x87 (pptr=0xffffff817e0a4000) IOMMU: Create VTD context table for PCI bus 0x88 (pptr=0xffffff817e0a5000) IOMMU: Create VTD context table for PCI bus 0x89 (pptr=0xffffff817e0a6000) IOMMU: Create VTD context table for PCI bus 0x8a (pptr=0xffffff817e0a7000) IOMMU: Create VTD context table for PCI bus 0x8b (pptr=0xffffff817e0a8000) IOMMU: Create VTD context table for PCI bus 0x8c (pptr=0xffffff817e0a9000) IOMMU: Create VTD context table for PCI bus 0x8d (pptr=0xffffff817e0aa000) IOMMU: Create VTD context table for PCI bus 0x8e (pptr=0xffffff817e0ab000) IOMMU: Create VTD context table for PCI bus 0x8f (pptr=0xffffff817e0ac000) IOMMU: Create VTD context table for PCI bus 0x90 (pptr=0xffffff817e0ad000) IOMMU: Create VTD context table for PCI bus 0x91 (pptr=0xffffff817e0ae000) IOMMU: Create VTD context table for PCI bus 0x92 (pptr=0xffffff817e0af000) IOMMU: Create VTD context table for PCI bus 0x93 (pptr=0xffffff817e0b0000) IOMMU: Create VTD context table for PCI bus 0x94 (pptr=0xffffff817e0b1000) IOMMU: Create VTD context table for PCI bus 0x95 (pptr=0xffffff817e0b2000) IOMMU: Create VTD context table for PCI bus 0x96 (pptr=0xffffff817e0b3000) IOMMU: Create VTD context table for PCI bus 0x97 (pptr=0xffffff817e0b4000) IOMMU: Create VTD context table for PCI bus 0x98 (pptr=0xffffff817e0b5000) IOMMU: Create VTD context table for PCI bus 0x99 (pptr=0xffffff817e0b6000) IOMMU: Create VTD context table for PCI bus 0x9a (pptr=0xffffff817e0b7000) IOMMU: Create VTD context table for PCI bus 0x9b (pptr=0xffffff817e0b8000) IOMMU: Create VTD context table for PCI bus 0x9c (pptr=0xffffff817e0b9000) IOMMU: Create VTD context table for PCI bus 0x9d (pptr=0xffffff817e0ba000) IOMMU: Create VTD context table for PCI bus 0x9e (pptr=0xffffff817e0bb000) IOMMU: Create VTD context table for PCI bus 0x9f (pptr=0xffffff817e0bc000) IOMMU: Create VTD context table for PCI bus 0xa0 (pptr=0xffffff817e0bd000) IOMMU: Create VTD context table for PCI bus 0xa1 (pptr=0xffffff817e0be000) IOMMU: Create VTD context table for PCI bus 0xa2 (pptr=0xffffff817e0bf000) IOMMU: Create VTD context table for PCI bus 0xa3 (pptr=0xffffff817e0c0000) IOMMU: Create VTD context table for PCI bus 0xa4 (pptr=0xffffff817e0c1000) IOMMU: Create VTD context table for PCI bus 0xa5 (pptr=0xffffff817e0c2000) IOMMU: Create VTD context table for PCI bus 0xa6 (pptr=0xffffff817e0c3000) IOMMU: Create VTD context table for PCI bus 0xa7 (pptr=0xffffff817e0c4000) IOMMU: Create VTD context table for PCI bus 0xa8 (pptr=0xffffff817e0c5000) IOMMU: Create VTD context table for PCI bus 0xa9 (pptr=0xffffff817e0c6000) IOMMU: Create VTD context table for PCI bus 0xaa (pptr=0xffffff817e0c7000) IOMMU: Create VTD context table for PCI bus 0xab (pptr=0xffffff817e0c8000) IOMMU: Create VTD context table for PCI bus 0xac (pptr=0xffffff817e0c9000) IOMMU: Create VTD context table for PCI bus 0xad (pptr=0xffffff817e0ca000) IOMMU: Create VTD context table for PCI bus 0xae (pptr=0xffffff817e0cb000) IOMMU: Create VTD context table for PCI bus 0xaf (pptr=0xffffff817e0cc000) IOMMU: Create VTD context table for PCI bus 0xb0 (pptr=0xffffff817e0cd000) IOMMU: Create VTD context table for PCI bus 0xb1 (pptr=0xffffff817e0ce000) IOMMU: Create VTD context table for PCI bus 0xb2 (pptr=0xffffff817e0cf000) IOMMU: Create VTD context table for PCI bus 0xb3 (pptr=0xffffff817e0d0000) IOMMU: Create VTD context table for PCI bus 0xb4 (pptr=0xffffff817e0d1000) IOMMU: Create VTD context table for PCI bus 0xb5 (pptr=0xffffff817e0d2000) IOMMU: Create VTD context table for PCI bus 0xb6 (pptr=0xffffff817e0d3000) IOMMU: Create VTD context table for PCI bus 0xb7 (pptr=0xffffff817e0d4000) IOMMU: Create VTD context table for PCI bus 0xb8 (pptr=0xffffff817e0d5000) IOMMU: Create VTD context table for PCI bus 0xb9 (pptr=0xffffff817e0d6000) IOMMU: Create VTD context table for PCI bus 0xba (pptr=0xffffff817e0d7000) IOMMU: Create VTD context table for PCI bus 0xbb (pptr=0xffffff817e0d8000) IOMMU: Create VTD context table for PCI bus 0xbc (pptr=0xffffff817e0d9000) IOMMU: Create VTD context table for PCI bus 0xbd (pptr=0xffffff817e0da000) IOMMU: Create VTD context table for PCI bus 0xbe (pptr=0xffffff817e0db000) IOMMU: Create VTD context table for PCI bus 0xbf (pptr=0xffffff817e0dc000) IOMMU: Create VTD context table for PCI bus 0xc0 (pptr=0xffffff817e0dd000) IOMMU: Create VTD context table for PCI bus 0xc1 (pptr=0xffffff817e0de000) IOMMU: Create VTD context table for PCI bus 0xc2 (pptr=0xffffff817e0df000) IOMMU: Create VTD context table for PCI bus 0xc3 (pptr=0xffffff817e0e0000) IOMMU: Create VTD context table for PCI bus 0xc4 (pptr=0xffffff817e0e1000) IOMMU: Create VTD context table for PCI bus 0xc5 (pptr=0xffffff817e0e2000) IOMMU: Create VTD context table for PCI bus 0xc6 (pptr=0xffffff817e0e3000) IOMMU: Create VTD context table for PCI bus 0xc7 (pptr=0xffffff817e0e4000) IOMMU: Create VTD context table for PCI bus 0xc8 (pptr=0xffffff817e0e5000) IOMMU: Create VTD context table for PCI bus 0xc9 (pptr=0xffffff817e0e6000) IOMMU: Create VTD context table for PCI bus 0xca (pptr=0xffffff817e0e7000) IOMMU: Create VTD context table for PCI bus 0xcb (pptr=0xffffff817e0e8000) IOMMU: Create VTD context table for PCI bus 0xcc (pptr=0xffffff817e0e9000) IOMMU: Create VTD context table for PCI bus 0xcd (pptr=0xffffff817e0ea000) IOMMU: Create VTD context table for PCI bus 0xce (pptr=0xffffff817e0eb000) IOMMU: Create VTD context table for PCI bus 0xcf (pptr=0xffffff817e0ec000) IOMMU: Create VTD context table for PCI bus 0xd0 (pptr=0xffffff817e0ed000) IOMMU: Create VTD context table for PCI bus 0xd1 (pptr=0xffffff817e0ee000) IOMMU: Create VTD context table for PCI bus 0xd2 (pptr=0xffffff817e0ef000) IOMMU: Create VTD context table for PCI bus 0xd3 (pptr=0xffffff817e0f0000) IOMMU: Create VTD context table for PCI bus 0xd4 (pptr=0xffffff817e0f1000) IOMMU: Create VTD context table for PCI bus 0xd5 (pptr=0xffffff817e0f2000) IOMMU: Create VTD context table for PCI bus 0xd6 (pptr=0xffffff817e0f3000) IOMMU: Create VTD context table for PCI bus 0xd7 (pptr=0xffffff817e0f4000) IOMMU: Create VTD context table for PCI bus 0xd8 (pptr=0xffffff817e0f5000) IOMMU: Create VTD context table for PCI bus 0xd9 (pptr=0xffffff817e0f6000) IOMMU: Create VTD context table for PCI bus 0xda (pptr=0xffffff817e0f7000) IOMMU: Create VTD context table for PCI bus 0xdb (pptr=0xffffff817e0f8000) IOMMU: Create VTD context table for PCI bus 0xdc (pptr=0xffffff817e0f9000) IOMMU: Create VTD context table for PCI bus 0xdd (pptr=0xffffff817e0fa000) IOMMU: Create VTD context table for PCI bus 0xde (pptr=0xffffff817e0fb000) IOMMU: Create VTD context table for PCI bus 0xdf (pptr=0xffffff817e0fc000) IOMMU: Create VTD context table for PCI bus 0xe0 (pptr=0xffffff817e0fd000) IOMMU: Create VTD context table for PCI bus 0xe1 (pptr=0xffffff817e0fe000) IOMMU: Create VTD context table for PCI bus 0xe2 (pptr=0xffffff817e0ff000) IOMMU: Create VTD context table for PCI bus 0xe3 (pptr=0xffffff817e100000) IOMMU: Create VTD context table for PCI bus 0xe4 (pptr=0xffffff817e101000) IOMMU: Create VTD context table for PCI bus 0xe5 (pptr=0xffffff817e102000) IOMMU: Create VTD context table for PCI bus 0xe6 (pptr=0xffffff817e103000) IOMMU: Create VTD context table for PCI bus 0xe7 (pptr=0xffffff817e104000) IOMMU: Create VTD context table for PCI bus 0xe8 (pptr=0xffffff817e105000) IOMMU: Create VTD context table for PCI bus 0xe9 (pptr=0xffffff817e106000) IOMMU: Create VTD context table for PCI bus 0xea (pptr=0xffffff817e107000) IOMMU: Create VTD context table for PCI bus 0xeb (pptr=0xffffff817e108000) IOMMU: Create VTD context table for PCI bus 0xec (pptr=0xffffff817e109000) IOMMU: Create VTD context table for PCI bus 0xed (pptr=0xffffff817e10a000) IOMMU: Create VTD context table for PCI bus 0xee (pptr=0xffffff817e10b000) IOMMU: Create VTD context table for PCI bus 0xef (pptr=0xffffff817e10c000) IOMMU: Create VTD context table for PCI bus 0xf0 (pptr=0xffffff817e10d000) IOMMU: Create VTD context table for PCI bus 0xf1 (pptr=0xffffff817e10e000) IOMMU: Create VTD context table for PCI bus 0xf2 (pptr=0xffffff817e10f000) IOMMU: Create VTD context table for PCI bus 0xf3 (pptr=0xffffff817e110000) IOMMU: Create VTD context table for PCI bus 0xf4 (pptr=0xffffff817e111000) IOMMU: Create VTD context table for PCI bus 0xf5 (pptr=0xffffff817e112000) IOMMU: Create VTD context table for PCI bus 0xf6 (pptr=0xffffff817e113000) IOMMU: Create VTD context table for PCI bus 0xf7 (pptr=0xffffff817e114000) IOMMU: Create VTD context table for PCI bus 0xf8 (pptr=0xffffff817e115000) IOMMU: Create VTD context table for PCI bus 0xf9 (pptr=0xffffff817e116000) IOMMU: Create VTD context table for PCI bus 0xfa (pptr=0xffffff817e117000) IOMMU: Create VTD context table for PCI bus 0xfb (pptr=0xffffff817e118000) IOMMU: Create VTD context table for PCI bus 0xfc (pptr=0xffffff817e119000) IOMMU: Create VTD context table for PCI bus 0xfd (pptr=0xffffff817e11a000) IOMMU: Create VTD context table for PCI bus 0xfe (pptr=0xffffff817e11b000) IOMMU: Create VTD context table for PCI bus 0xff (pptr=0xffffff817e11c000) IOMMU 0x0: enabling... enabled Booting all finished, dropped to user space <<seL4(CPU 0) [decodeUntypedInvocation/212 T0xffffff817e11d400 "rootserver" @4014bf]: Untyped Retype: Insufficient memory (1 * 33554432 bytes needed, 0 bytes available).>> <<seL4(CPU 0) [decodeUntypedInvocation/212 T0xffffff817e11d400 "rootserver" @4014bf]: Untyped Retype: Insufficient memory (1 * 33554432 bytes needed, 0 bytes available).>> <<seL4(CPU 0) [decodeUntypedInvocation/212 T0xffffff817e11d400 "rootserver" @4014bf]: Untyped Retype: Insufficient memory (1 * 33554432 bytes needed, 0 bytes available).>> <<seL4(CPU 0) [decodeUntypedInvocation/212 T0xffffff817e11d400 "rootserver" @4014bf]: Untyped Retype: Insufficient memory (1 * 33554432 bytes needed, 0 bytes available).>> <<seL4(CPU 0) [decodeUntypedInvocation/212 T0xffffff817e11d400 "rootserver" @4014bf]: Untyped Retype: Insufficient memory (1 * 33554432 bytes needed, 0 bytes available).>> Single bus detected lib_pci_scan_dev found pci device 0 0 PCI :: 00.00.00 : intel Unknown device ID. (vid 0x8086 did 0x29c0) line0 pin0 lib_pci_scan_dev found pci device 0 1 PCI :: 00.01.00 : Unknown vendor ID. Unknown device ID. (vid 0x1234 did 0x1111) line0 pin0 BAR0 : [ mem 0xfd000000 sz 0x1000000 szmask 0xff000000 prefetch ] BAR2 : [ mem 0xfebb0000 sz 0x1000 szmask 0xfffff000 ] lib_pci_scan_dev found pci device 0 2 PCI :: 00.02.00 : intel Unknown device ID. (vid 0x8086 did 0x100e) line11 pin1 BAR0 : [ mem 0xfeb80000 sz 0x20000 szmask 0xfffe0000 ] BAR1 : [ io 0xc000 sz 0x40 szmask 0xffffffc0 ] lib_pci_scan_dev found pci device 0 31 PCI :: 00.1f.00 : intel intel_ich9_8 (vid 0x8086 did 0x2918) line0 pin0 lib_pci_scan_dev found multi function device 0 31 PCI :: 00.1f.02 : intel Unknown device ID. (vid 0x8086 did 0x2922) line10 pin1 BAR4 : [ io 0xc080 sz 0x20 szmask 0xffffffe0 ] BAR5 : [ mem 0xfebb1000 sz 0x1000 szmask 0xfffff000 ] PCI :: 00.1f.03 : intel intel_ich9_6 (vid 0x8086 did 0x2930) line10 pin1 BAR4 : [ io 0x700 sz 0x40 szmask 0xffffffc0 ] Guest page dir allocated at 0x10000000. Creating 1-1 entries sel4utils_reserve_range_at_no_alloc@vspace.c:601 Range not available at 0x7e00, size 0x78200 vm_reserve_memory_at@guest_memory.c:328 Failed to allocate vm reservation: Unable to create vspace reservation at address 0x7e00 of size 492032 vm_ram_register_at@guest_ram.c:355 Unable to reserve ram region at addr 0x7e00 of size 0x78200 guest_elf_relocate@guest_image.c:129 50000 relocs done. guest_elf_relocate@guest_image.c:129 100000 relocs done. Constructing guest cmdline at 0x500 of size 142 Guest boot info allocated at 0x58f. Populating... Final e820 map is: 0x0 - 0x500 type 2 0x500 - 0x7c00 type 1 0x7c00 - 0x80000 type 2 0x80000 - 0x9fc00 type 1 0x9fc00 - 0x10001000 type 2 0x10001000 - 0x90001000 type 1 Initializing guest to start running at 0x10400000 [ 0.000000] Linux version 4.8.16 (alisonf@carbon) (gcc version 7.4.0 (Ubuntu 7.4.0-1ubuntu1~18.04.1) ) #1 Wed Oct 23 17:26:59 AEDT 2019 [ 0.000000] Disabled fast string operations [ 0.000000] x86/fpu: Legacy x87 FPU detected. [ 0.000000] x86/fpu: Using 'eager' FPU context switches. [ 0.000000] e820: BIOS-provided physical RAM map: [ 0.000000] BIOS-e820: [mem 0x0000000000000000-0x00000000000004ff] reserved [ 0.000000] BIOS-e820: [mem 0x0000000000000500-0x0000000000007bff] usable [ 0.000000] BIOS-e820: [mem 0x0000000000007c00-0x000000000007ffff] reserved [ 0.000000] BIOS-e820: [mem 0x0000000000080000-0x000000000009fbff] usable [ 0.000000] BIOS-e820: [mem 0x000000000009fc00-0x0000000010000fff] reserved [ 0.000000] BIOS-e820: [mem 0x0000000010001000-0x0000000090000fff] usable [ 0.000000] bootconsole [earlyser0] enabled [ 0.000000] Notice: NX (Execute Disable) protection missing in CPU! [ 0.000000] DMI not present or invalid. [ 0.000000] e820: update [mem 0x00000000-0x00000fff] usable ==> reserved [ 0.000000] e820: remove [mem 0x000a0000-0x000fffff] usable [ 0.000000] e820: last_pfn = 0x90001 max_arch_pfn = 0x100000 [ 0.000000] MTRR: Disabled [ 0.000000] x86/PAT: MTRRs disabled, skipping PAT initialization too. [ 0.000000] x86/PAT: Configuration [0-7]: WB WT UC- UC WB WT UC- UC [ 0.000000] Warning only 895MB will be used. [ 0.000000] Use a HIGHMEM enabled kernel. [ 0.000000] Scanning 1 areas for low memory corruption [ 0.000000] initial memory mapped: [mem 0x00000000-0x10ffffff] [ 0.000000] Base memory trampoline at [c009b000] 9b000 size 16384 [ 0.000000] BRK [0x10b8f000, 0x10b8ffff] PGTABLE [ 0.000000] BRK [0x10b90000, 0x10b90fff] PGTABLE [ 0.000000] RAMDISK: [mem 0x10c71000-0x11279fff] [ 0.000000] 895MB LOWMEM available. [ 0.000000] mapped low ram: 0 - 37fe2000 [ 0.000000] low ram: 0 - 37fe2000 [ 0.000000] Zone ranges: [ 0.000000] DMA [mem 0x0000000000001000-0x0000000000ffffff] [ 0.000000] Normal [mem 0x0000000001000000-0x0000000037fe1fff] [ 0.000000] Movable zone start for each node [ 0.000000] Early memory node ranges [ 0.000000] node 0: [mem 0x0000000000001000-0x0000000000006fff] [ 0.000000] node 0: [mem 0x0000000000080000-0x000000000009efff] [ 0.000000] node 0: [mem 0x0000000010001000-0x0000000090000fff] [ 0.000000] Initmem setup node 0 [mem 0x0000000000001000-0x0000000090000fff] [ 0.000000] On node 0 totalpages: 163846 [ 0.000000] free_area_init_node: node 0, pgdat d0a7ce40, node_mem_map f7466020 [ 0.000000] DMA zone: 32 pages used for memmap [ 0.000000] DMA zone: 0 pages reserved [ 0.000000] DMA zone: 37 pages, LIFO batch:0 [ 0.000000] Normal zone: 1760 pages used for memmap [ 0.000000] Normal zone: 163809 pages, LIFO batch:31 [ 0.000000] e820: [mem 0x90001000-0xffffffff] available for PCI devices [ 0.000000] clocksource: refined-jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns [ 0.000000] pcpu-alloc: s0 r0 d32768 u32768 alloc=1*32768 [ 0.000000] pcpu-alloc: [0] 0 [ 0.000000] Built 1 zonelists in Zone order, mobility grouping on. Total pages: 162054 [ 0.000000] Kernel command line: earlyprintk=ttyS0,115200 console=ttyS0,115200 i8042.nokbd=y i8042.nomux=y i8042.noaux=y io_delay=udelay noisapnp pci=nomsi debug root=/dev/mem [ 0.000000] PID hash table entries: 4096 (order: 2, 16384 bytes) [ 0.000000] Dentry cache hash table entries: 131072 (order: 7, 524288 bytes) [ 0.000000] Inode-cache hash table entries: 65536 (order: 6, 262144 bytes) [ 0.000000] Initializing CPU#0 [ 0.000000] Memory: 632784K/655384K available (4590K kernel code, 339K rwdata, 1744K rodata, 284K init, 496K bss, 22600K reserved, 0K cma-reserved) [ 0.000000] virtual kernel memory layout: [ 0.000000] fixmap : 0xfffe4000 - 0xfffff000 ( 108 kB) [ 0.000000] vmalloc : 0xf87e2000 - 0xfffe2000 ( 120 MB) [ 0.000000] lowmem : 0xc0000000 - 0xf7fe2000 ( 895 MB) [ 0.000000] .init : 0xd0a88000 - 0xd0acf000 ( 284 kB) [ 0.000000] .data : 0xd087bcae - 0xd0a86d40 (2092 kB) [ 0.000000] .text : 0xd0400000 - 0xd087bcae (4591 kB) [ 0.000000] Checking if this processor honours the WP bit even in supervisor mode...Ok. [ 0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1 [ 0.000000] NR_IRQS:16 nr_irqs:16 16 [ 0.000000] CPU 0 irqstacks, hard=f7008000 soft=f700a000 [ 0.000000] Console: colour dummy device 80x25 [ 0.000000] console [ttyS0] enabled [ 0.000000] console [ttyS0] enabled [ 0.000000] bootconsole [earlyser0] disabled [ 0.000000] bootconsole [earlyser0] disabled [ 0.000000] tsc: Fast TSC calibration failed [ 0.000000] tsc: Unable to calibrate against PIT [ 0.000000] tsc: No reference (HPET/PMTIMER) available [ 0.000000] tsc: Marking TSC unstable due to could not calculate TSC khz [ 0.040000] Calibrating delay loop... 7023.82 BogoMIPS (lpj=35119104) [ 0.070000] pid_max: default: 32768 minimum: 301 [ 0.080000] Security Framework initialized [ 0.080000] Mount-cache hash table entries: 2048 (order: 1, 8192 bytes) [ 0.090000] Mountpoint-cache hash table entries: 2048 (order: 1, 8192 bytes) [ 0.100000] Disabled fast string operations [ 0.100000] Last level iTLB entries: 4KB 0, 2MB 0, 4MB 0 [ 0.110000] Last level dTLB entries: 4KB 0, 2MB 0, 4MB 0, 1GB 0 [ 0.110000] CPU: Intel Core i7 9xx (Nehalem Class Core i7) (family: 0x6, model: 0x1a, stepping: 0x3) [ 0.150000] Performance Events: unsupported p6 CPU model 26 no PMU driver, software events only. [ 0.160000] devtmpfs: initialized [ 0.160000] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns [ 0.170000] kworker/u2:0 (11) used greatest stack depth: 7308 bytes left [ 0.180000] NET: Registered protocol family 16 [ 0.190000] cpuidle: using governor ladder [ 0.190000] cpuidle: using governor menu [ 0.200000] clocksource: pit: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 1601818034827 ns [ 0.210000] PCI: Using configuration type 1 for base access [ 0.220000] vgaarb: loaded [ 0.220000] SCSI subsystem initialized [ 0.230000] libata version 3.00 loaded. [ 0.230000] usbcore: registered new interface driver usbfs [ 0.240000] usbcore: registered new interface driver hub [ 0.240000] usbcore: registered new device driver usb [ 0.250000] pps_core: LinuxPPS API ver. 1 registered [ 0.250000] pps_core: Software ver. 5.3.6 - Copyright 2005-2007 Rodolfo Giometti <giometti(a)linux.it> [ 0.260000] PTP clock support registered [ 0.270000] dmi: Firmware registration failed. [ 0.270000] PCI: Probing PCI hardware [ 0.280000] PCI: root bus 00: using default resources [ 0.280000] PCI: Probing PCI hardware (bus 00) [ 0.290000] PCI host bridge to bus 0000:00 [ 0.290000] pci_bus 0000:00: root bus resource [io 0x0000-0xffff] [ 0.300000] pci_bus 0000:00: root bus resource [mem 0x00000000-0xffffffff] [ 0.310000] pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff] [ 0.320000] pci 0000:00:00.0: [5e14:0042] type 00 class 0x060000 [ 0.330000] pci 0000:00:01.0: [1234:1111] type 00 class 0x030000 [ 0.340000] pci 0000:00:01.0: reg 0x10: [mem 0x90001000-0x90001fff pref] [ 0.350000] pci 0000:00:01.0: reg 0x14: [mem 0x91001000-0x91001fff] [ 0.370000] pci 0000:00:01.0: reg 0x30: [mem 0xfeba0000-0xfebaffff pref] [ 0.380000] vgaarb: setting as boot device: PCI:0000:00:01.0 [ 0.380000] vgaarb: device added: PCI:0000:00:01.0,decodes=io+mem,owns=io+mem,locks=none [ 0.400000] pci 0000:00:02.0: [8086:100e] type 00 class 0x020000 [ 0.400000] pci 0000:00:02.0: reg 0x10: [mem 0x91002000-0x91003fff] [ 0.410000] pci 0000:00:02.0: reg 0x14: [io 0xc000-0xc03f] [ 0.420000] pci 0000:00:02.0: reg 0x30: [mem 0xfeb00000-0xfeb7ffff pref] [ 0.430000] pci 0000:00:03.0: [8086:2918] type 00 class 0x060100 [ 0.440000] pci 0000:00:03.0: quirk: [io 0x0600-0x067f] claimed by ICH6 ACPI/GPIO/TCO [ 0.450000] pci 0000:00:04.0: [8086:2922] type 00 class 0x010601 [ 0.460000] pci 0000:00:04.0: reg 0x10: [io 0xc080-0xc09f] [ 0.470000] pci 0000:00:04.0: reg 0x14: [mem 0x91022000-0x91022fff] [ 0.490000] pci 0000:00:05.0: [8086:2930] type 00 class 0x0c0500 [ 0.490000] pci 0000:00:05.0: reg 0x10: [io 0x0700-0x073f] [ 0.510000] pci_bus 0000:00: busn_res: [bus 00-ff] end is updated to 00 [ 0.520000] PCI: pci_cache_line_size set to 32 bytes [ 0.520000] e820: reserve RAM buffer [mem 0x00007c00-0x0000ffff] [ 0.530000] e820: reserve RAM buffer [mem 0x0009fc00-0x0009ffff] [ 0.540000] e820: reserve RAM buffer [mem 0x90001000-0x93ffffff] [ 0.540000] NetLabel: Initializing [ 0.550000] NetLabel: domain hash size = 128 [ 0.550000] NetLabel: protocols = UNLABELED CIPSOv4 [ 0.560000] NetLabel: unlabeled traffic allowed by default [ 0.570000] clocksource: Switched to clocksource pit [ 0.570000] VFS: Disk quotas dquot_6.6.0 [ 0.580583] VFS: Dquot-cache hash table entries: 1024 (order 0, 4096 bytes) [ 0.580583] hugetlbfs: disabling because there are no supported hugepage sizes [ 0.608902] pci_bus 0000:00: resource 4 [io 0x0000-0xffff] [ 0.622439] pci_bus 0000:00: resource 5 [mem 0x00000000-0xffffffff] [ 0.629178] NET: Registered protocol family 2 [ 0.629178] TCP established hash table entries: 8192 (order: 3, 32768 bytes) [ 0.643721] TCP bind hash table entries: 8192 (order: 3, 32768 bytes) [ 0.651068] TCP: Hash tables configured (established 8192 bind 8192) [ 0.651068] UDP hash table entries: 512 (order: 1, 8192 bytes) [ 0.664304] UDP-Lite hash table entries: 512 (order: 1, 8192 bytes) [ 0.673571] NET: Registered protocol family 1 [ 0.679034] RPC: Registered named UNIX socket transport module. [ 0.679034] RPC: Registered udp transport module. [ 0.691033] RPC: Registered tcp transport module. [ 0.691033] RPC: Registered tcp NFSv4.1 backchannel transport module. [ 0.702947] pci 0000:00:01.0: Video device with shadowed ROM at [mem 0x000c0000-0x000dffff] [ 0.713872] PCI: CLS 0 bytes, default 32 [ 0.719115] Unpacking initramfs... [ 0.728865] Freeing initrd memory: 6180K (d0c71000 - d127a000) [ 0.740017] platform rtc_cmos: registered platform RTC device (no PNP device found) [ 0.749380] Scanning for low memory corruption every 60 seconds [ 0.749380] futex hash table entries: 256 (order: -1, 3072 bytes) [ 0.765067] workingset: timestamp_bits=30 max_order=18 bucket_order=0 [ 0.788927] squashfs: version 4.0 (2009/01/31) Phillip Lougher [ 0.798908] NFS: Registering the id_resolver key type [ 0.798908] Key type id_resolver registered [ 0.812867] Key type id_legacy registered [ 0.818762] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 250) [ 0.831896] io scheduler noop registered [ 0.831896] io scheduler deadline registered [ 0.841111] io scheduler cfq registered (default) [ 0.841111] intel_idle: does not run on family 6 model 26 [ 0.854361] Serial: 8250/16550 driver, 4 ports, IRQ sharing enabled [ 0.877337] serial8250: ttyS0 at I/O 0x3f8 (irq = 4, base_baud = 115200) is a 16550A [ 0.888811] Non-volatile memory driver v1.3 [ 0.888811] [drm] Initialized drm 1.1.0 20060810 [ 0.900611] loop: module loaded [ 0.910483] lpc_ich 0000:00:03.0: I/O space for GPIO uninitialized [ 0.919536] ahci 0000:00:04.0: version 3.0 [ 0.919536] ahci: probe of 0000:00:04.0 failed with error -22 [ 0.931932] pcnet32: pcnet32.c:v1.35 21.Apr.2008 tsbogend(a)alpha.franken.de [ 0.940722] e100: Intel(R) PRO/100 Network Driver, 3.5.24-k2-NAPI [ 0.940722] e100: Copyright(c) 1999-2006 Intel Corporation [ 0.953860] e1000: Intel(R) PRO/1000 Network Driver - version 7.3.21-k8-NAPI [ 0.962047] e1000: Copyright (c) 1999-2006 Intel Corporation. [ 1.029745] BUG: unable to handle kernel paging request at f87f9820 [ 1.029745] IP: [<d06ecf45>] e1000_reset_hw+0x10f/0x180 [ 1.029745] *pde = 37021067 *pte = 00000000 [ 1.029745] Oops: 0000 [#1] [ 1.029745] Modules linked in: [ 1.029745] CPU: 0 PID: 1 Comm: swapper Not tainted 4.8.16 #1 [ 1.029745] task: f704c000 task.stack: f7050000 [ 1.029745] EIP: 0060:[<d06ecf45>] EFLAGS: 00210202 CPU: 0 [ 1.029745] EIP is at e1000_reset_hw+0x10f/0x180 [ 1.029745] EAX: f87f4000 EBX: f73f274c ECX: 00000000 EDX: 00000060 [ 1.029745] ESI: 04140240 EDI: 0000c000 EBP: f7051e38 ESP: f7051e2c [ 1.029745] DS: 007b ES: 007b FS: 0000 GS: 0000 SS: 0068 [ 1.029745] CR0: 80050033 CR2: f87f9820 CR3: 10ad2000 CR4: 00000680 [ 1.029745] Stack: [ 1.029745] f73f2000 00000000 00000000 f7051e78 d06e97c0 f7051e54 f73f2400 00000043 [ 1.029745] f73f274c 00000000 f7083800 00000000 f7051e78 d05bb85a f7051e6c d0a696d4 [ 1.029745] f7083800 f7083868 d0a69694 f7051e90 d05bbb48 d0a69660 f7083868 d0a69694 [ 1.029745] Call Trace: [ 1.029745] [<d06e97c0>] e1000_probe+0x556/0xb18 [ 1.029745] [<d05bb85a>] ? pci_match_device+0x5f/0x7c [ 1.029745] [<d05bbb48>] pci_device_probe+0x51/0x98 [ 1.029745] [<d06a48ed>] driver_probe_device+0xc9/0x1aa [ 1.029745] [<d06a4a26>] __driver_attach+0x58/0x74 [ 1.029745] [<d06a352c>] bus_for_each_dev+0x4f/0x63 [ 1.029745] [<d06a44c1>] driver_attach+0x14/0x16 [ 1.029745] [<d06a49ce>] ? driver_probe_device+0x1aa/0x1aa [ 1.029745] [<d06a4216>] bus_add_driver+0xab/0x18a [ 1.029745] [<d06a4e77>] driver_register+0x6e/0xa0 [ 1.029745] [<d05bb5a0>] __pci_register_driver+0x27/0x2a [ 1.029745] [<d0aa34b0>] ? e100_init_module+0x4d/0x4d [ 1.029745] [<d0aa34e8>] e1000_init_module+0x38/0x6e [ 1.029745] [<d0aa34b0>] ? e100_init_module+0x4d/0x4d [ 1.029745] [<d0400465>] do_one_initcall+0x7c/0xed [ 1.029745] [<d043744a>] ? parse_args+0x1b3/0x27d [ 1.029745] [<d0a88b40>] ? kernel_init_freeable+0xdf/0x17d [ 1.029745] [<d0a88b5d>] kernel_init_freeable+0xfc/0x17d [ 1.029745] [<d0878103>] kernel_init+0x8/0xcb [ 1.029745] [<d087a4e2>] ret_from_kernel_thread+0xe/0x24 [ 1.029745] [<d08780fb>] ? rest_init+0x59/0x59 [ 1.029745] Code: 8b 03 8b 40 18 80 cc 20 8b 13 89 42 18 8b 03 8b 40 08 b8 02 00 00 00 eb 05 b8 05 00 00 00 e8 22 d8 d5 ff 83 7b 0c 04 76 13 8b 03 <8b> 80 20 58 00 00 80 e4 df 8b 13 89 82 20 58 00 003 [ 1.029745] EIP: [<d06ecf45>] e1000_reset_hw+0x10f/0x180 SS:ESP 0068:f7051e2c [ 1.029745] CR2: 00000000f87f9820 [ 1.029745] ---[ end trace f9705abe48180ae4 ]--- [ 1.042868] Kernel panic - not syncing: Attempted to kill init! exitcode=0x00000009 [ 1.042868] [ 1.042868] Kernel Offset: disabled [ 1.042868] ---[ end Kernel panic - not syncing: Attempted to kill init! exitcode=0x00000009 [ 1.042868] [ 2.558940] random: fast init done [ 133.760986] random: crng init done ------------------------------------------------------------

1 0

PicoServer attributes
by christinefragoso＠protonmail.com 16 Nov '21

16 Nov '21

I am running on an i.MX6 the picoserver app https://github.com/seL4/camkes/tree/master/apps/picoserver Both the echo and listener components print out to serial: listener instance starting up, going to be listening on 10.0.0.2:4321 echo instance starting up, going to be listening on 10.0.0.2:1234 but only the echo component receives PicoTCP events: Assigned ipv4 10.0.0.2 to device eth0 IPv6: DAD verified valid address. echo: Connection established with 10.0.0.1 on socket 1 echo: Received a message on socket 3, going to echo to Listener echo: Received a message on socket 3, going to echo to Listener echo: Received a message on socket 3, going to echo to Listener Note that the listener component does not even print out "Connection established". I tried to figure out why, and found out that by editing this part of picoserver.camkes: /* * The attributes of the *_(control/send/recv) interfaces should be the same and unique between * different components, this determines the client ID of this component with respect to * the PicoServer component */ echo.echo_control_attributes = "1"; echo.echo_recv_attributes = "1"; echo.echo_recv_shmem_size = 0x1000; echo.echo_send_attributes = "1"; echo.echo_send_shmem_size = 0x1000; echo.ip_addr = PICOSERVER_IP_ADDR; /* * Listener config */ listener.listener_control_attributes = "2"; listener.listener_recv_attributes = "2"; listener.listener_recv_shmem_size = 0x1000; listener.listener_send_attributes = "2"; listener.listener_send_shmem_size = 0x1000; listener.ip_addr = PICOSERVER_IP_ADDR; and changing the attributes to this: /* * The attributes of the *_(control/send/recv) interfaces should be the same and unique between * different components, this determines the client ID of this component with respect to * the PicoServer component */ echo.echo_control_attributes = "0"; echo.echo_recv_attributes = "0"; echo.echo_recv_shmem_size = 0x1000; echo.echo_send_attributes = "0"; echo.echo_send_shmem_size = 0x1000; echo.ip_addr = PICOSERVER_IP_ADDR; /* * Listener config */ listener.listener_control_attributes = "1"; listener.listener_recv_attributes = "1"; listener.listener_recv_shmem_size = 0x1000; listener.listener_send_attributes = "1"; listener.listener_send_shmem_size = 0x1000; listener.ip_addr = PICOSERVER_IP_ADDR; then listener will print that it has connected to echo, but now echo will not print out anything. How do I make both echo and listener print out on the serial port? Which part of the code looks at echo.echo_recv_attributes = "1"; and listener.listener_recv_attributes = "2"; in order to determine the client ID of the echo and listener components with respect the PicoServer component? From what I can tell, attributes was not declared as an actual attribute.

1 0

RFC-9: new capability for seL4 SMC Forwarding on Arm
by Gerwin Klein 13 Nov '21

13 Nov '21

I’d like to solicit discussion on the new RFC on forwarding Secure Monitor Calls on Arm: https://sel4.atlassian.net/browse/RFC-9 Relevant Arm documentation (SMC calling conventions): https://developer.arm.com/documentation/den0028/latest?_ga=2.116565828.3903… Any opinions, concerns, alternative designs? Cheers, Gerwin

2 4

Camkes VMM configuration
by Jose Martins 10 Nov '21

10 Nov '21

Hello. I've been playing around with the camkes Arm VMM. However, the meaning of some of the configuration fields is not completely clear to me. For example: - what is the difference between "linux_ram_base" and "linux_ram_paddr_base" in the linux_address_config attribute? Are these supposed to define the virtual and physical addresses of the guest's ram region base, respectively? If so, can we have non-identity mappings by setting them to different values? From my experiments having different addresses on those does not always work (even if both are aligned to a 2M superpage boundary) . - what is the difference between the untyped_mmios and mmios attributes? They seem to serve pretty similar purposes. For example, in different vm-examples they are both used for assigning the virtual gic cpu interface to the guest. I probably have a few other questions. I couldn't find it, but I was hoping there was more thorough documentation for the vm configuration detailing the meaning of these fields (and others)? Best regards, José

2 1

Re: Runtime Measurement Hiccup
by Hugo V.C. 08 Nov '21

08 Nov '21

BTW, regarding to the nice trick suggested by Kent (using expect language to interact with console) just wanted to show you this expect script I wrote on 2007 (page 210 of https://www.pentest.es/checkpoint_hack.pdf) to exploit a vulnerability via interactive SSH shell in a very hardened device at that time (Check Point Secure Platform) which was an EAL4+ certified appliance with a locked down custom Linux, and patched kernel (Exec-Shield) with a painful set of memory protections, ASCII Armor, etc + a creative protection in their custom interactive shell (called CPSHELL) that only allowed a restricted set of ASCII chars... It took me 6 months to figure out how to bypass every single protection of that target, and chain all the different bypass techniques into a fully functional exploit. It was hard but I did it and I'm pretty sure anyone with somewhat creative offensive mind (there are thousands out there) would have achieved the same, after or before. Two things I want to highlight here is: 1) Anyone that is tempted to build "insecure" software solutions (Linux/non_verified_code) on top of secure solutions (seL4) must assume for the global design of the architecture that the "insecure" solution (Linux/non_verified_code) should be considered already broken. If you don't do this and expect other low level layers of security to solve root security issues, things may go horribly wrong. This is what happened in the case of Check Point Secure Platform, at that time, all the security was relying in the low level, multiple layers of the OS protections, but the source code of the vendor specific command line tools were full of security bugs... So, let's not expect seL4 host to solve the security problems of the guests (Linux, etc). seL4 can guarantee isolation of guests and it's own security, but as long there's an interaction with the guest (i.e. via console) there's lot of room for exploitation of the guest. 2) Going a step ahead, console interaction is just the most simple, but there are other ways to interact with guests as they are not physically isolated entities of the Universe.... I mean, if we consider chain supply attacks as a real possibility (i.e. an open source tool integrated into a Linux guest on top of seL4) we should be aware that it is not difficult to create a covert channel attack to extract information from the "isolated" guest... So even without any I/O available, the guest can play with multiple physical low level hardware details and physical environment variables to create a funny reliable stealth communication channel. I was just thinking loud but hope it helps someone else to have a wide vision of low level security. Expect scripting interaction with console suggestion by Kent reminded me about this old exploit I wrote and then I extrapolated it to any interaction in our beloved seL4 environments. Have a nice day. El mié, 3 nov 2021 a las 13:00, Hugo V.C. (<skydivebcn(a)gmail.com>) escribió: Very nice trick Kent! Thank you for sharing. That kind of information, from you guys the seL4 experts, is invaluable. El mié, 3 nov 2021 a las 12:15, Kent Mcleod (<kent.mcleod72(a)gmail.com>) escribió: Hi Michael, Just trying to answer your question about how to get data from a simulated system to a host system, the way we do it for sel4test and sel4bench is to use the serial console and grep for magic escape strings. It isn't foolproof but having something like: printf("<digest>%s</digest>\n", digest); from the simulated machine can be captured automatically by the host via matching the input character stream from the console looking to match <digest>.*</digest>. We use expect (https://en.wikipedia.org/wiki/Expect) or the python wrapper pexpect for scripting this and it's how we extract seL4test results and the sel4bench benchmark results that are automatically posted to https://sel4.systems/About/Performance/ via capturing the serial stream. ( https://github.com/seL4/sel4bench/runs/4064401581?check_suite_focus=true shows the output where the benchmark results are just dumped to the console). Kent.

1 0

Graph-refine Toolset Usability Issues (for WCET analysis)
by Jack Chen 06 Nov '21

06 Nov '21

Greetings I'm recently conducting research on WCET analysis of seL4-based systems. Graph-to-graph seems to be a good starting point. However the toolset doesn't seem to be fully working in my setup. My setup: x86, 16GB RAM, Windows10 WSL Ubuntu 20.04 Goal: To replicate the static WCET analysis decribed in the paper [Sewell et al. 2016], using graph-to-graph and graph-refine/seL4-example build. Steps taken: - repo setup with "verification-manifest" - fetched 2 versions: defalut (10/21/2021), and 12.1.0 - followed READMEs: preparing isabelle, HOL4, standalone c-parser, and their dependencies (according to graph-refine/seL4-example/readme) - L4V_ARCH=ARM - [./run_tests] in l4v - [make tar] in graph-refine/seL4-example - [python graph-refine.py <targetdir> all] Results (default version) : --------------------------- - seL4-example [make tar]: all things seem normal except - Graph spec failed in _start for pos 0xe0000008. - Graph spec failed in _start for pos 0xe0000008. - l4v run_tests: 43/51 passed - HaskellKernel STUCK (probably due to internet access issue for my region), CParserTest Failed - graph-refine: KeyError: 'kernel_devices' - This one is interesting. The seL4 code fetched with this "default" manifest contains a "kernel_device_frames", which I think is called "kernel_devices" in previous versions of seL4 kernel code. In kernel.elf.rodata they seem to be associated with the same block of assembly code. Results (12.1.0): --------------------------- - seL4-example [make tar]: same as default, graph spec fails - l4v run_tests: 29/51 passed - HaskellKernel STUCK as usual, CParserTest Failed, CBaseRefine TIMEOUT, AInvs TIMEOUT, a lot others SKIPPED due to dependency - graph-refine: There's no KeyError now because "kernel_devices" is present in this version of seL4 code, but I got this instead: ###======================================= ### Doing stack analysis for 'cap_get_capPtr'. (48 of 575) ### Traceback (most recent call last): ### File "graph-refine.py", line 31, in <module> ### args = target_objects.load_target_args () ### ... ### ... ### File "stack_logic.py", line 223, in get_ptr_offsets ### assert not fail_early, (v, ptr) ### AssertionError: ((3758178040, Expr ('Var', Type ('Word', 32), name = 'r13')), 'r13_after_3758178040_3758178040=i+0') ###===================================== Here are my questions: - Are these issues common, or is my setup & installations just wrong? Any way to resolve these issues? (big questions, and hence the long email, and hence I'm here asking the experts) - Is solver.py currently broken? (dug up some clues in seL4-example/Makefile) - for graph-to-graph, phantom_preempt.py seems required in the convert_loop_bounds step: Any guide on how to write this file, e.g. format, content? - To replicate the WCET experiment in the 2016 paper, should I download the specific version of the verification repo of that time? - static vs. measurement-based WCET analysis: Going forward, on more advanced ARM archs (e.g., Armv8), is static WCET analysis still worth it (or even feasible)? Is hybrid approach the way to go? Is the TS team still working on WCET tools for seL4 on ARM systems? (saw papers from the team many years ago discussing the combination of static cache analysis and probabilistic measurement) Regards, Jack

3 3

Too large messages
by Peter Chubb 05 Nov '21

05 Nov '21

There've been a few messages stuck in the queue recently because they're too large for the list. Please remember when sending to the Devel(a)sel4.systems list -- trim what you're replying to, to just the relevant bits -- reply in-line (no top-posting) -- send only plain text (not screen shots or HTML). Serial port output can be pasted in-line. This will maximise your chance of getting email through on first attempt. -- Dr Peter Chubb https://trustworthy.systems/ Trustworthy Systems Group CSE, UNSW

1 0

Re: Runtime Measurement Hiccup
by Hugo V.C. 05 Nov '21

05 Nov '21

Hi Michael! Adding the full list to the thread again (we missed them at some point...). "I appreciate the complete lack of partial credit, and I consider you find my work to be a waste." I don't think anyone thinks your work is a waste. Personally, I just gave my opinion about the architecture, but of course the final decision is yours, as it is your baby :) Maybe someone on the list can answer you with a more specific example you require (even if they already gave some hints...). Cheers, El lun, 25 oct 2021 a las 19:11, Michael Neises (<neisesmichael(a)gmail.com>) escribió: > Hugo (and Everyone), > > Thank you for the reminders. > > I believe it's trivial to provide or restrict caps to any IO device. So, > yes, I believe with the board's reference manual it should theoretically be > quite easy to restrict them all. > > I appreciate the complete lack of partial credit, and I consider you find > my work to be a waste. So with that in mind I'll ask once more: > > Has anyone on the planet ever performed such an independent measurement of > a virtual machine, or is seL4 really as unusable as indicated? > > I don't want to spend any amount of time barking up a tree that doesn't > exist. > > Cheers, > Michael Neises > > > > > > On Mon, Oct 25, 2021, 01:02 Hugo V.C. <skydivebcn(a)gmail.com> wrote: > >> Hi Michael, >> >> as I commented, it depends on the runtime environment. The scenario I >> described, even if challenging, it is just one of many you could face. Let >> me explain myself. >> >> Really, it is irrelevant if the full Linux (or whatever OS) VM is >> "inmutable". At some point you need to load code into memory and run it. >> Then, only formal verified code (like seL4) is reasonably secure. Being >> pedant, anything else simply it is not. >> Why? >> >> The reason is you will never be sure what interactions the VM OS (in your >> example Linux) will have with the outside World. Do you have NTP client...? >> HTTP clients...(wget)? DNS clients...? Are you absolutely sure you know >> every line of this VM OS (Linux) and can guarantee there will be no out of >> control interaction with the outside Word? >> >> Let's go a step ahead in the offensive mindset. Even in the case you are >> building a siloed "air gap" machine (no networking), do you have full >> awareness of all the I/O mechanisms of the device so you can guarantee >> there will be no interaction with the outside World...? >> >> For that reasons code is formally verified. That is the only way to be >> sure things are reasonably secure. >> >> If we accept the last statement as true, any integrity check done from >> inside of unverified code, is, by definition, not trustable. But of course >> you can do it. >> >> On the other side, what I don't get is, if you consider (for whatever >> reason) your guest OS is inmutable... then why you want to check integrity >> from inside...? >> >> In embedded World, integrity checks always need something (theoretically) >> really inmutable (i.e. CPU fuses). You need to check/anchor from the most >> trustable source you have. That's why in embedded devices there are those >> "funny" boot sequences with chain of trust where different parts of the >> system (from most simple to most complex) are used to verify the next step >> in the boot chain. >> >> Having said that, of course you can do integrity checks from inside the >> VM itself, but IMHO will be a waste of trusted computing power of seL4 >> platform. >> >> Please excuse me in advance if I misunderstood your message. >> >> A very interesting topic. >> >> Cheers, >> >> >> El lun., 25 oct. 2021 2:34, Michael Neises <neisesmichael(a)gmail.com> >> escribió: >> >>> Hugo and Everyone, >>> >>> Thanks for the response. This is something I've worried about as well. >>> >>> I've been under the impression that once I compile a seL4 image, that >>> image should be static no matter how many times I boot it. That is, I've >>> looked around for persistent storage to use, and my solution has so far >>> been to recompile the entire seL4 image in order to insert new data. So >>> even when I "touch" files in the Linux virtual machine, they are completely >>> forgotten when I reboot the system. For a time I thought of this as an >>> impediment, but I soon came to realize it as a benefit. So I suppose I >>> should clarify that when I said "Linux kernel" in that quote, I really >>> meant this particular Linux image which is prepared at compile-time and >>> virtualized by seL4 at runtime. >>> >>> For the last several months, I've been operating under the assumption >>> that there is no way for me, even as a developer, to "manipulate the seL4 >>> image I used to boot myself." Namely, I've been trying to jump through all >>> these virtual network hoops because I couldn't figure out a way to make >>> persistent changes to the image. So, as I said, I had taken it for granted >>> that a seL4 image was immutable in this way, but I recognize your point >>> that maybe it is not. My argument has been that the seL4 image is loaded >>> onto an SD card, and I can forbid access to that SD card, which means the >>> image should be guaranteed to be untouchable except maybe by the seL4 >>> kernel itself. >>> >>> I believe seL4's proofs uphold my argument regarding "capabilities" to >>> the SD card, but I admit a slim understanding of seL4's "caps." I will be >>> happy as always to be edified. >>> >>> Cheers and Good Evening to you, >>> Michael Neises >>> >>> On Sun, Oct 24, 2021 at 4:32 PM Hugo V.C. <skydivebcn(a)gmail.com> wrote: >>> >>>> Hi Michael, >>>> >>>> "Please correct me if I am wrong, but I think if the very first thing >>>> the Linux kernel does is measure itself, before it is even connected >>>> to a network, then there is simply no attack surface" >>>> >>>> My 5 cents: it is not so simple... it depends on the specfic run time >>>> environment. >>>> Anyway, just as an example, some years ago I was challenged with a >>>> similar scenario: an appliance running Linux firmware with an embedded >>>> integrity mechanism in the kernel code that checked its own integrity and >>>> also the integrity of all loaded kernel modules (that were doing integrity >>>> checks of the file system). Once initial modules were loaded no more were >>>> allowed to be loaded. >>>> Anyway, the running kernel was very outdated, so I was able to find a >>>> vulnerability that allowed me to inject my own data/code in the kernel >>>> space. The problem was persistence: most of the file system was read >>>> only... with the exception of some config files in the compact flash >>>> storage... a second bug in the parsing of the config files (that allowed >>>> user space command execution to trigger the kernel vuln) gave me the >>>> persistence I wanted for my kernel level vulnerability in that "inmutable" >>>> system. Game over. >>>> >>>> So, it really depends on your environment. As long you have I/O data >>>> operation were an attacker can interact to some persistent storage, then >>>> there's room for persistent intrusion no matter the runtime checks you do >>>> on the kernel or the file system. There have been plenty of even more >>>> elaborated attacks/tricks on heavily siloed and isolated and "inmutable" >>>> systems that have been carried out in the computing history. In fact, those >>>> are the interesting ones... :-) >>>> >>>> Hopes this helps. >>>> >>>> >>>> El dom., 24 oct. 2021 19:46, Michael Neises <neisesmichael(a)gmail.com> >>>> escribió: >>>> >>>>> Hello seL4 developers, >>>>> >>>>> Thank you for the replies. >>>>> >>>>> For the sake of clarity, the system works like this: >>>>> At compile time, some expected digest values are made available only >>>>> to a >>>>> distinct CAmkES component. At the time of first-Linux-boot, a kernel >>>>> module >>>>> takes several measurements of the other kernel modules present >>>>> (including >>>>> itself). It reports these digests outwards to CAmkES, where they are >>>>> compared against the expected values. It is the "pre-compile-time >>>>> provisioning of these expected digests" in which I am interested. At >>>>> this >>>>> time, I can simulate the system and compute these digests, but the >>>>> only way >>>>> I have to extract them is to copy them by hand off the screen. To be >>>>> totally explicit, I want to extract these values in order to re-compile >>>>> them into a system that knows its expected digest values. I want to >>>>> have an >>>>> initial simulation where I extract these digests, so that in the >>>>> subsequent compilation and simulations, the system is aware what values >>>>> these digests are required to take. >>>>> >>>>> Please correct me if I am wrong, but I think if the very first thing >>>>> the >>>>> Linux kernel does is measure itself, before it is even connected to a >>>>> network, then there is simply no attack surface. Of course I'm very >>>>> happy >>>>> to be wrong, but I don't see who the attacker is in this situation. >>>>> Certainly, there remains an open question of how to extend these >>>>> measurements meaningfully into the space where there is a viable attack >>>>> surface (after enabling a network adapter), but I consider that >>>>> question to >>>>> be beside the point for now (some future work). If there is some way >>>>> for me >>>>> to inspect the run-time data of the Linux system without relying >>>>> somewhat >>>>> on a tool inside the Linux instance, I would very much like to know >>>>> about >>>>> it. My strategy follows the same path as the vm-introspect example app >>>>> (which I'm under the impression was created for this explicit purpose), >>>>> which itself trusts implicitly the Linux instance. Again, to be >>>>> entirely >>>>> explicit, there does not appear to be any information anywhere on a >>>>> way to >>>>> meaningfully inspect a virtualized Linux system without trusting it >>>>> even >>>>> the slightest bit. I would be elated to be corrected; if someone can >>>>> show >>>>> me how to scrape (from the seL4 side exclusively) all the bits from a >>>>> virtual Linux system and reassemble those bits into >>>>> semantically-valuable >>>>> information, I'm sure you will not hear from me for several months >>>>> while I >>>>> rebuild everything I have. At this time that does not appear to be >>>>> possible. >>>>> >>>>> Cheers, >>>>> Michael Neises >>>>> >>>>> On Tue, Oct 19, 2021 at 3:46 PM Michael Neises < >>>>> neisesmichael(a)gmail.com> >>>>> wrote: >>>>> >>>>> > Hello seL4 developers, >>>>> > >>>>> > I want to be able to retrieve data from seL4's virtual Linux >>>>> machine, in >>>>> > order to store it in a persistent way. Namely, I want to be able to >>>>> > simulate a seL4 kernel, boot its Linux virtual machine, compute some >>>>> hash >>>>> > digests, and then export those hash digests. These digests are >>>>> valuable >>>>> > because they represent the "clean room" runtime-state of the linux >>>>> machine. >>>>> > Currently I can export these digests by way of hand-eye >>>>> coordination, but I >>>>> > consider this unusable as a piece of software. >>>>> > >>>>> > To date I've taken two main approaches: CAmkES FileServer or virtual >>>>> > networking. I'm under the impression that the FileServer changes are >>>>> not >>>>> > persistent through reboot, and even if they were, to change the boot >>>>> image >>>>> > after compile-time would seem to fly in the face of seL4's >>>>> principles. >>>>> > Virtual networking seems to promise I can host my digests on a >>>>> webpage that >>>>> > is visible to my "root host" machine; that is, the simulated seL4's >>>>> linux >>>>> > instance hosts a site available on my 192.168.x.x network. I know >>>>> there is >>>>> > a seL4webserver app as part of the seL4 repositories which claims to >>>>> do >>>>> > this, but unfortunately its prose is unhelpful and it doesn't seem >>>>> to work >>>>> > even when it compiles and simulates. >>>>> > >>>>> > I've taken two distinct strategies to investigate the virtual network >>>>> > approach. First, I tried to get it to work on my normal stack: >>>>> Windows 10 >>>>> > using WSL2 using a Docker container to simulate the seL4 image. The >>>>> problem >>>>> > with this approach is that it appears I'm required to blindly thread >>>>> 3 or 4 >>>>> > needles all at once, without getting feedback more descriptive than >>>>> "you >>>>> > didn't do it." In other words, there does not appear to be a partial >>>>> > success available, and without ICMP ping, I honestly have no idea >>>>> how to >>>>> > debug these "virtual" networks. >>>>> > >>>>> > Next, I tried simplifying my stack by installing the dependencies >>>>> natively >>>>> > on a Debian 10 machine, which should bypass several layers of the >>>>> virtual >>>>> > network I was suggesting in my first strategy. Unfortunately, I met >>>>> with >>>>> > the same "AttributeError: module 'yaml' has no attribute >>>>> 'FullLoader'" >>>>> > error that inspired me to begin using Docker several years ago. Of >>>>> course I >>>>> > should note that "pip/pip2/pip3 install pyyaml" all report that >>>>> pyyaml is >>>>> > already installed, so I would be in debt to anyone who has an idea >>>>> about >>>>> > that error. >>>>> > >>>>> > To conclude, I find virtual networks opaque, and I would be grateful >>>>> for >>>>> > any guidance. If you have a different idea how I might achieve my >>>>> goal, I >>>>> > would be similarly effusive in my thanks. >>>>> > >>>>> > Cheers, >>>>> > Michael Neises >>>>> > >>>>> _______________________________________________ >>>>> Devel mailing list -- devel(a)sel4.systems >>>>> To unsubscribe send an email to devel-leave(a)sel4.systems >>>>> >>>>

4 7

Pine64 PinePhone with seL4: any prior attempts?
by Isaac Beckett 03 Nov '21

03 Nov '21

Hello! I recently received a PinePhone for my birthday, and it finally arrived a few weeks later. It’s been fun to tinker with so far, although I haven’t yet replaced the Linux distro it came with yet, which I plan to do soon. But thinking about my options for that made me wonder, has anyone attempted to run seL4, even just a test program, on one of these before? It’s an aarch64 device using a quad-core Allwinner A64 SOC, so four Cortex CPU cores and an Arm Mali GPU. I don’t have any experience bringing up an OS in new hardware. It runs Linux fine, and while the included software setup is a bit sluggish, I’m pretty sure that’s just from Plasma mobile being very resource hungry. So, I’m curious, has anyone experimented with this in the past? I think this platform could be very useful, personally I’m hoping that as hobbyist type phones like this become more mature, that people will have more choices for software to run on it.

3 2

CAmkES: dataports larger than 4k
by Fabrizio Bertocci 01 Nov '21

01 Nov '21

Is it possible to use dataports that are larger than 4k? I tried with both typed dataports and "Buf" dataport but I can't find a way to do it. In the hello-camkes-2 tutorial, I tried to add a configuration for my dataports in the main assembly file to increase its size like this: // Typed dataport name: 'd_image' // Buf dataport name: 'd' configuration { echo.d_size=65536; // Buf dataport echo.d_image_size=65536; // Typed dataport } unfortunately that doesn't seem to do anything as d_get_size() keep returning 4k, and for the typed dataport, the build system triggers the static assert "typeof(from_0_d_image_data) size greater than dataport size" Thanks, Fabrizio

2 1