seL4/seL4

Features

• Formally Verified Microkernels - Provides a formally verified microkernel with machine-checked proofs of correctness, confidentiality, and integrity.
• Capability-Based Access Controls - Enforces fine-grained resource access through capabilities where each process holds explicit rights.
• Capability Transfers Between Slots - Transfers capabilities between CSpace slots.
• Capability Transfers via IPC - Provides kernel-level capability transfer between processes via IPC buffers for access right delegation.
• Verified Microkernel Deployments - Deploys a formally verified microkernel on a wide range of ARM, RISC-V, and x86 platforms.
• Interrupt-to-Notification Binding - Provides a kernel mechanism to bind notification objects to specific hardware interrupts for signal delivery.
• Protection Domain Scheduling Parameters - Assigns priority, period, and budget to protection domains for controlled CPU time allocation and round-robin execution.
• Microkernel Process Spawnings - Provides kernel API to create a VSpace, configure a process, badge capabilities, and spawn from an ELF binary.
• System Performance Benchmarking - Measures execution timing and counts hardware events to evaluate application performance on the microkernel.
• Kernel Notification Signaling - Sends signals between protection domains using kernel notification objects with badge-based source differentiation.
• Bitwise Badge Signal Differentiation - Uses bitwise badge values on notification objects to identify which sender triggered a signal.
• Sender-Identifying IPC - Implements synchronous IPC with sender-identifying badges for secure inter-process communication.
• Availability Sampling - Provides formal proofs that the kernel enforces access control policies and ensures resource availability.
• Derived Capability Revocations - Deletes all capabilities derived from a given capability.
• Declarative Object Hierarchies - Declares nested object structures with qualified names and dimensions for system capability specification.
• Scheduling Context Donation - Transfers a client's scheduling context to a passive server during an RPC call for CPU budget donation.
• Scheduling Context Bindings - Associates threads and notifications with scheduling contexts to manage CPU budget allocation and eligibility.
• Scheduling Context Parameter Configurations - Configures budget, period, and other parameters of scheduling contexts for CPU time allocation.
• Standalone Kernel Binary Builds - Generates a standalone kernel binary with configuration metadata for external build systems and formal verification.
• Static Component Instances - Instantiates a reusable component type within a system assembly and assigns it a unique instance name.
• Notification Object Blocking Waits - Provides a kernel mechanism to block a thread until a notification object is signalled.
• Notification Object Blocking Waits with Data - Provides a kernel mechanism to block a task until a notification object is signalled and receive signal data.
• Microkernel Root Tasks - Executes a root task written in Rust directly on the kernel.
• Component-Based System Composers - Models systems as interacting software components with explicit interfaces, then generates glue code and builds bootable images.
• Protection Domain Sandboxes - Creates sandboxed execution environments with dedicated threads, address spaces, and capability sets for isolation.
• Periodic Thread Schedulers - Provides kernel-level periodic thread scheduling with budgets and fault endpoints for mixed-criticality systems.
• Kernel Scheduling Policy Configurations - Configures kernel scheduling policy including timer tick period, preemption ticks, domain count, and priority levels.
• Thread Priority Controls - Implements priority-based thread scheduling with round-robin rotation across multiple cores.
• Kernel Thread Lifecycle Operations - Provides kernel API to configure thread control blocks, set priorities, start threads, and resolve faults.
• Capability Slot Placement - Addresses destination CNode slots for new capabilities, supporting multi-level CSpace layouts.
• ARM OS Deployment - Deploys the microkernel on a wide range of Armv7 and Armv8 single-board computers and SoCs.
• UART Drivers - Ships kernel-level UART drivers for serial communication on supported hardware platforms.
• Hardware Timer Controllers - Manages hardware timer lifecycle including allocation, initialization, interrupt handling, and cleanup.
• Microkernel RISC-V Board Deployments - Runs a formally verified microkernel on a range of RISC-V 64-bit single-board computers and emulators.
• Unified Hardware Interfaces - Provides a unified interface to platform-specific peripherals such as timers, serial ports, and clocks.
• Time-Partitioned Schedulers - Provides domain-based time partitioning for deterministic execution in mixed-criticality systems.
• Mixed-Criticality Scheduling Activations - Activates time-partitioned scheduling with per-thread budgets and domains for mixed-criticality workload support.
• Blocking Kernel Message Reception - Blocks the current thread until a message arrives on a kernel endpoint.
• Cross-Thread Object Synchronization - Blocks and wakes threads using kernel notification objects to coordinate concurrent work.
• Protection Domain - Creates communication links between isolated protection domains using notifications or protected procedure calls.
• Runtimes - Provides entry points, heaps, stacks, panic handling, and IPC abstractions for microkernel protection domains.
• Non-Blocking Kernel Message Reception - Checks for a pending message on a kernel endpoint and returns immediately if none is available.
• Reply Capability Storage - Stores reply capabilities from the last call into a CSpace slot for later use.
• One-Off Reply Capability Usage - Provides a kernel mechanism to send a message using the one-time reply capability from the last call.
• One-Time Reply Capability Responses - Provides a kernel mechanism to respond to a specific sender using a one-time reply capability.
• IPC Reply Operations - Provides a kernel mechanism to send replies to received IPC messages for request-response patterns.
• Reply-and-Wait Operations - Ships a kernel syscall that atomically replies to the last caller and blocks for a new message.
• Microkernel Hardware Abstraction Layers - Exposes hardware resources through a small set of system calls managing threads, address spaces, and IPC.
• Register-Based - Transfers up to 64 words of arguments and return values between protection domains using indexed message registers.
• Blocking Message Sends - Provides a kernel syscall that sends a message to a capability and blocks until the receiver is ready.
• IPC Send-and-Receive Operations - Provides kernel operations for allocating badged endpoints and performing send/receive IPC with reply semantics.
• Synchronous IPC Data Transfers - Provides kernel-level synchronous send and receive operations on endpoint capabilities for thread data transfer.
• Synchronous IPC Message Sends - Provides a kernel syscall that sends a synchronous IPC message across an endpoint with direct data copy.
• Labeled Procedure Calls - Uses numeric labels in message info to identify which service a protected procedure call targets.
• Cross-Domain Protected Procedure Calls - Calls functions in another protection domain by passing up to 64 words of data with context isolation.
• Guest Physical Memory Managers - Manages a guest VM's physical address space, including RAM allocation, registration, and data copying.
• Microkernel RPC Connections - Connects component interfaces using RPC to enable synchronous function calls between them.
• Bare-Metal Application Runtimes - seL4 builds user-level programs on top of the minimal hardware abstraction layer without requiring an operating system.
• Capability Rotations - Swaps capabilities between three slots with optional badge updates.
• Declarative System Image Builders - Combines isolated programs into a single bootable image using a declarative XML system description.
• CPU Affinity Binding - Binds threads to specific processor cores to optimize cache usage and control execution placement.
• CPU Budget Allocations - Allocates fixed CPU time budgets per period to threads and enforces upper bounds on execution time.
• Domain Schedule Configurations - Configures domain schedules and timeslice durations for time-partitioned execution in the microkernel.
• Domain Schedule Definitions - Defines domain scheduling parameters including schedule lists, start indices, and shift values for system initialization.
• ELF Binary Parsing - Parses Executable and Linkable Format files to inspect or load program data.
• Microkernel ELF Loaders - Provides kernel API to load an ELF binary into a virtual address space and execute it as a new process.
• Microkernel - Ships a minimal kernel providing thread management, address spaces, and IPC across ARM, RISC-V, and x86 platforms.
• Device Tree Blob Initializers - Uses device tree blobs to automatically allocate memory and interrupt resources for hardware components.
• Hardware Drivers - Provides low-level hardware drivers for connecting components to IO ports, interrupts, and memory-mapped registers.
• Inter-Process Shared Memory - Provides kernel-level shared memory buffers between protection domains with notification signaling for data availability.
• Interrupt Signal Binding - Binds notification objects to interrupt sources for user-level interrupt handling.
• System Call References - Provides a reference for every system call and interface the kernel exposes to user-space code.
• Verified - Restricts kernel configuration to only verified options, preventing use of features that would break formal verification guarantees.
• Hardware Interrupt Delivery - Delivers hardware interrupts to user-level protection domains as a core kernel capability.
• Hardware Interrupt Delivery - Delivers hardware interrupts to user-level protection domains as a core kernel capability.
• Power-of-Two Sized Allocations - Provides kernel object allocation with sizes specified as powers of two for efficient memory management.
• Watermark-Based Object Allocators - Manages physical memory through untyped regions and watermark-based allocation of kernel objects.
• Untyped Memory Retyping - Retypes untyped memory into kernel objects as a core kernel resource management mechanism.
• Capability-Based Memory Reclamation - Revokes child capabilities to free untyped memory for reuse in a capability-based system.
• Interrupt Acknowledgments - Responds to hardware timer interrupts by acknowledging and processing the event.
• Protection Domain Interrupt Routing - Routes hardware interrupts to protection domains as a core kernel isolation mechanism.
• IRQ Handler Capabilities - Provides capability-based IRQ handler management as a core kernel mechanism for interrupt control.
• Kernel Object Creation - Creates kernel objects from untyped memory as a core kernel resource management mechanism.
• x86 Microkernel Deployments - Deploys the microkernel on standard PC99-style Intel platforms with virtualization and IOMMU support.
• Virtual Machine Management - Runs guest operating systems as child protection domains with fault delivery to the parent for handling.
• Guest Memory and I/O Managers - Handles guest image loading, memory mapping, and I/O port event registration and dispatching for VM instances.
• Microkernel Platform Porting - Provides a formally verified microkernel that can be ported to new ARM and RISC-V platforms.
• Microkernel Process Bootstraps - Provides runtime initialization to bootstrap C processes from the _start entry point on the microkernel.
• Multi-Architecture Kernel Deployments - Supports a range of processor architectures and board configurations through a portable kernel design.
• Microkernel Arm Board Deployments - Runs a formally verified microkernel on a range of Arm AArch64 single-board computers and evaluation kits.
• Declarative Capability Specifications - Provides a declarative language to specify the initial capability distribution and memory layout for a verified system.
• Paged Memory Management - Maps, remaps, and unmaps page directories, page tables, and pages to control memory access.
• Page Table Mapping - Maps page tables into thread virtual address spaces to enable further page-level mappings.
• Intermediate Paging Structure Mappings - Maps intermediate paging structures like page directories into virtual address spaces for multi-level translation.
• Virtual Page Mappings - Maps physical frames into virtual address ranges with configurable access rights for process isolation.
• Page Permission Remapping - Changes access permissions of already-mapped pages by invoking page capabilities with new rights.
• Page Table Allocation - Allocates page table objects from untyped memory for virtual address space construction.
• Page Unmapping Operations - Removes page mappings by invoking unmap operations on pages or intermediate paging structures.
• Physical Device Pass-through - Grants virtual machines direct access to physical devices, bypassing the hypervisor for improved performance.
• Asynchronous Process Signaling - Provides kernel-level asynchronous signaling between processes using notification objects for synchronization.
• RISC-V Microkernel Deployments - Deploys the microkernel on RISC-V platforms including HiFive, PolarFire, and QEMU targets.
• Protection Domain Lifecycle Controls - Provides init, notified, and protected entry points that control startup, event handling, and privileged operations for each domain.
• Rust Systems Programming - Enables developing verified userspace applications using Rust bindings, runtimes, and target specifications.
• Microkernel Rust Runtimes - Provides Rust bindings and runtimes for writing userspace applications including root tasks and Microkit protection domains.
• Component-Based System Assemblers - Assembles isolated software components into a complete system using a framework that manages their communication and lifecycle.
• System Boot Initializers - Loads and initializes the kernel and hardware into a known state using a dedicated boot loader.
• Boot-Time Resource Discovery - Obtains the BootInfo structure from the kernel to discover available IRQs, memory regions, IO ports, and capability references.
• Declarative System Initializers - Creates kernel objects and capabilities from a formal capDL specification to establish the initial system state.
• Thread Domain Assignments - Assigns threads to scheduling domains to control their execution scope within time-partitioned schedules.
• Thread Context Configurations - Provides kernel API calls to configure a thread's fault endpoint, CSpace, VSpace, and IPC buffer.
• Virtio Device Emulators - Provides Virtio drivers for PCI, console, and net to enable standard paravirtualized device communication in guest VMs.
• Virtual Memory Management - Manages virtual address spaces for thread isolation as a core kernel capability.
• Virtual Memory Mapping - seL4 maps a physical frame into a thread's virtual address space by inserting a page table entry, requiring a page table to exist first.
• Virtual Machines - Boots and manages guest operating systems in isolated environments with a virtual machine monitor.
• Microkernel-Based Hypervisors - Creates, initialises, and configures virtual machine instances on a microkernel-based hypervisor.
• VCPU Execution Mode Switches - Switches threads into virtual machine mode to execute guest code via bound VCPU objects.
• Non-Blocking Message Sends - Provides a kernel syscall that attempts to send a message without blocking if the receiver is not ready.
• Kernel Performance Benchmarks - Measures the performance of core kernel operations including IPC, scheduling, signal delivery, and page mapping.
• Kernel Event Logging Benchmarks - Logs and counts performance-monitoring events to measure system timing and overhead within the kernel.
• Kernel Thread Context Initializations - Provides kernel API to create and configure a thread control block with priority, registers, and address space.
• Microkernel C Process Initializations - Provides runtime initialization to bootstrap C processes on the microkernel before calling main.
• Notification Object Allocations - Provides kernel-level allocation of notification objects from untyped memory for interrupt signal reception.
• Microkernel Rust Programs - Compiles and executes Rust programs on a formally verified microkernel, leveraging Rust's safety guarantees.
• Microkernel Rust Component Frameworks - Introduces Rust crates for writing root tasks and components that run on the microkernel.
• IPC Buffer Allocation - Allocates IPC buffers for inter-process communication as a core kernel mechanism.
• Verified System Bootstrapping - Bootstraps the user-level environment by creating objects and distributing capabilities from a verified specification.
• Capability Deletions - Removes capabilities from CSlots, freeing slots and revoking associated access.
• Capability Duplications - Duplicates capabilities between CSlots within a CNode, granting identical access rights.
• Capability-Based Access Control Descriptions - Declares kernel objects and capability distributions to define access control boundaries for integrity and confidentiality.
• Kernel-Level Confidentiality Verifications - Proves that the kernel prevents unauthorized information flow between isolated components.
• Capability Space Navigation - Navigates and references the root CNode of a thread's CSpace to control access to kernel objects.
• Capability Space Size Calculations - Calculates capability space sizes and manages capability placement between slots.
• Memory Mappings - Maps physical memory regions into protection domains with configurable permissions.
• Capability State Snapshots - Describes the complete capability distribution of a running system, specifying which entities have access to which capabilities.
• Capability Minting - Duplicates capabilities while setting access rights, badges, or guards.
• Declarative Capability Specifications - Declares objects and their capability slots using a formal language for automated bootstrapping and security analysis.
• Direct Capability Addressing - Specifies CNode, index, and depth to reference capabilities for cross-thread CSpace manipulation.
• Per-Type Access Right Definitions - Defines access rights for each capability type with configurable parameters.
• Capability Mutations with Guards - Moves capabilities while setting guards to preserve revocability.
• Kernel API References - Provides a downloadable PDF reference covering every kernel system call, capability, and interface.
• Kernel Thread Context Configurations - Provides kernel API to set a thread's priority, CSpace, VSpace, instruction pointer, and stack pointer.
• Mutual Exclusion Locks - Builds mutual-exclusion primitives from notification objects for concurrent code.
• Cross-VM Communication Channels - seL4 establishes shared memory and event channels between a guest OS and a native component for cross-domain data exchange.
• Budget Exhaustion Handlers - Provides timeout fault handlers triggered by scheduling budget exhaustion for custom recovery.
• Child Domain Fault Handlers - Provides a mechanism for parent domains to handle faults from child protection domains and virtual machines.
• VCPU Fault and Reboot Handlers - Processes ARM VCPU faults including HSR, SMC, and PSCI, and registers callbacks for guest VM reboot.
• MMU-Enforced Isolations - Enforces strict process isolation through hardware MMU-protected address spaces.
• Architecture Description Language Components - Defines a component instance and its interfaces in the Architecture Description Language to structure the application.
• Static Component Composition Frameworks - Provides CAmkES and Microkit frameworks for assembling isolated components into bootable system images.
• Scheduling Context to Thread Bindings - Attaches scheduling contexts to thread control blocks to make threads eligible for scheduling with budget enforcement.
• Kernel Thread Spawning - Provides kernel API to allocate, configure, and start execution of a new thread.
• Capability-Separated Thread Spawning - Creates threads with isolated capability spaces to enforce access control boundaries between execution contexts.
• Badged Fault Identifiers - Ships a capability-based fault identification mechanism using badges on endpoint capabilities.
• VCPU Fault Handlers - Queries and configures vCPU objects that have faulted during execution to manage guest context.
• Faulted Thread Resumers - Provides a mechanism to resume faulted threads after handler correction via reply or explicit resume.
• Thread Suspension - Pauses thread execution via TCB capability invocation, preventing it from running until explicitly resumed.
• IPC Fault Handlers - Implements IPC-based fault delivery to handler endpoints for thread anomaly recovery.
• Hardware Timer Integration - Measures elapsed time and schedules timeouts using platform-specific timer hardware.
• Inter-Process Communication - Provides kernel-level inter-process communication primitives for synchronous data and capability transfer between threads.
• IPC Message Receivers - Provides kernel-level blocking receive operations on endpoint and notification capabilities for inter-process communication.
• Kernel Notification Object Polling - Checks a kernel notification object's state without blocking, returning immediately whether a signal is pending.
• Kernel Notification Object Signaling - Provides a kernel mechanism to signal notification objects for waking waiting threads.
• Non-Blocking Notification Polling - Checks a notification object for a pending signal without blocking the calling thread.
• Formal Verification Frameworks - Provides a kernel whose C implementation is mathematically proven against its specification.
• System Correctness Verifiers - Proves that the kernel's C implementation matches its formal specification, including fast-path execution.
• Binary Correctness Verifiers - Checks that the compiled binary matches the verified C source code for critical functions.
• Capability Initializer Correctness Verifiers - Proves that the user-level system initialiser correctly sets up capability-based access control.
• Microkernel IPC Connectors - Defines how components interact by connecting their interfaces through connectors like RPC, events, or shared memory.
• Architecture Description Language Interfaces - Uses a dedicated language to define component interfaces, components, and their connections in a system design.
• Component Override Systems - Models a system as interacting software components with explicit interfaces and connections, then generates a bootable image.
• Timer Timeout Configurations - Configures timers to fire after specified durations and waits for interrupt notifications.
• Notification Object Bindings - Associates kernel notification objects with threads for receiving asynchronous signals.
• Capability Slot Addressing - Provides the addressing mechanism for referencing capabilities by CSlot index within a thread's capability space.
• Static System Compositions - Assembles static component-based systems from declarative architecture descriptions into bootable images.
• Kernel Notification Bindings - Attaches notification objects to thread control blocks for receiving both signals and IPC messages.
• C++ Prototyping Libraries - Provides libraries for rapid experimentation with the API, not intended for production code.
• Kernel API Prototyping Exercises - Provides exercises for using prototyping libraries to experiment with the microkernel's API.
• Kernel API Exercises - Walks through the core API primitives with short hands-on exercises and basic examples.
• Microkernel Rust Crate Demonstrations - Shows how to use Rust crates with the Microkit to build simple component systems.
• Badged Send Cancellations - Cancels outstanding send operations for a specific badge on an endpoint.
• Address Space Colocation - Groups multiple component instances into a single address space to reduce communication overhead.
• Protocol Buffers Serializers - Encodes and decodes structured messages using nanopb for inter-process communication.
• CPU Frequency Monitors - Calculates the time-stamp counter frequency using known timer hardware.
• Shared Memory Data Exchange - Transfers data between components using typed or untyped shared memory dataports.
• Timer Driver Configurators - Provides manual configuration of timer driver register addresses and IRQ numbers for platform-specific initialization.
• Component Interface Methods - Specifies a set of methods with typed parameters that components can provide or require for structured communication.
• Architecture Description Compilers - Generates component glue code from architecture descriptions to automate system construction.
• Virtual Interrupt Injectors - Injects virtual ARM interrupts into a virtual CPU with configurable priority and GIC parameters.
• Scheduling Context Consumption Reads - Returns the CPU time consumed by a scheduling context since the last query for budget tracking.
• Sporadic Server Replenishment Configurations - Configures sporadic server replenishment slots to control budget restoration after thread blocking or preemption.
• Debugging and Diagnostics - Prints diagnostic messages and inspects runtime state of unprivileged processes.
• Kernel Debug Facility Activators - Activates kernel debug symbols, assertions, and serial console printing.
• Emulated Application Debugging - Attaches GDB to a QEMU-emulated system to debug user-space applications on the microkernel.
• Kernel Debugging with GDB and QEMU - Connects GDB to QEMU for kernel breakpoints, register inspection, and single-stepping.
• Hardware Breakpoint Configurators - Sets per-thread hardware breakpoints on virtual addresses using kernel debug registers.
• Kernel - Walks through core kernel concepts like capabilities, IPC, threads, and interrupts using hands-on exercises.
• Serial Console Sessions - Routes guest VM serial console I/O through Virtio Console to a dedicated serial server component.
• Busy-Wait Delays - Provides calibrated busy-wait loops for short processor-level delays.
• Timer Driver Initializations - Provides library functions to initialize hardware timer drivers on supported platforms.
• Microkernel Thread Priorities - Sets the scheduling priority of a component to control its execution order on the microkernel.
• Cross-Process - Reserves hardware resources across process boundaries using a Protocol Buffer RPC protocol for distributed allocation.
• Hardware Pin Mappings - Assigns alternate functions to SoC pins so that internal peripherals connect to external pads.
• Hardware Reset Controllers - Asserts and de-asserts reset signals to bring SoC components into a known state.
• GPIO Pin Controllers - Sets or reads the logic level of general-purpose input/output pins on supported platforms.
• Ethernet Interface Configuration - Initializes and operates Ethernet MAC hardware to send and receive network packets.
• I2C Bus Interfaces - Provides I2C bus communication for reading and writing data to sensors and peripherals.
• Sensor Drivers - Queries temperature sensors and analog-to-digital converters built into the SoC.
• SPI Bus Drivers - Provides SPI bus drivers for synchronous data transfer to attached peripherals.
• USB Host Communications - Operates USB host controllers and enumerates connected devices on supported platforms.
• Fastpath IPC Optimizations - Accelerates common IPC patterns by bypassing kernel overhead under specific conditions.
• Ethernet Frame Switching - Switches Ethernet frames between virtual ports identified by MAC addresses for network connectivity.
• Guest-to-Component Notifications - Ships a kernel module enabling Linux guests to emit notifications to native CAmkES components via hypercalls.
• Host-Guest Communication Channels - Establishes shared memory and event channels for data exchange between virtual machines and native processes.
• Mailbox Co-Processor Communicators - Provides mailbox-based communication with a Boot and Power Management Processor for system control.
• Virtio Net Device Presenters - Exposes a Virtio Net device to a virtual machine and forwards its network traffic to native components.
• ACPI Table Injection Tools - Generates ACPI tables, BIOS boot info structures, and E820 memory maps for x86 guest VMs.
• Binary Disassembly - Generates human-readable assembly listings from kernel or application ELF files.
• Kernel Prototyping Libraries - Provides unverified C prototyping libraries for initializing the system, managing threads, and loading ELF binaries.
• Virtual CPU Register Accessors - Accesses virtual CPU register state on ARM and x86, including general-purpose registers and VMCS fields.
• DMA Memory Pools - Manages DMA-accessible memory pools for device I/O within protection domains.
• Verified Application Development - Supports writing applications in languages with strong static guarantees, leveraging formal verification of the kernel.
• x86 I/O Port Accessors - Provides capability-based access to x86 I/O port ranges for device interaction in protection domains.
• Guest-Component Shared Memory - Sets up page-aligned shared buffers between a Linux guest and a CAmkES component using a dataport kernel module and hypercalls.
• Device Tree Blob Generators - Produces flattened device tree blobs that describe hardware to a virtual machine.
• Pluggable UART Output Frameworks - Implements a pluggable driver framework for early UART console output during kernel boot.
• Kernel Mechanism Deconstructions - Walks through the microkernel's API with short exercises that demonstrate basic usage of its core primitives.
• Batch Object Allocation - Creates multiple kernel objects in a single retype invocation for efficient resource allocation.
• Inter-Core Interrupts - Delivers a software-generated interrupt to a specified core via inter-processor interrupts.
• PCI Bus Management - Discovers and interacts with PCI bus devices from user-level code.
• Single-Core Instance Deployments - Runs separate single-core kernel instances on each core for multi-core operation.
• Configuration Property Verifiers - Confirms that a specific kernel configuration on a given platform satisfies formally proven safety and security guarantees.
• System Initialization Verifiers - Proves that the loader produces only the capabilities and objects declared in the input specification.
• Runtime Protection Domain Loading - Loads protection domains at runtime with resources from a build-time known pool for flexible upgrades.
• Microkernel Guest Booters - Boots minimal Linux virtual machines as guests within a microkernel-based hypervisor environment.
• Hardware Power Controllers - Controls power management ICs and co-processors to set voltage and sleep states.
• Dynamic System Builders - Creates systems where software components can be added or changed at runtime by interacting directly with the kernel API.
• Hardware Watchpoints - seL4 monitors memory accesses by configuring hardware watchpoints that trigger on read or write operations to specified address ranges.
• Single-Step Debuggers - Advances a thread one instruction at a time by configuring hardware debug registers.
• Timed Execution Delays - Blocks threads for specified durations using timer interrupts and semaphore waiting for timed execution delays.
• Guest IO Space Managers - Registers and manages a guest VM's IO space for device access and memory-mapped I/O.
• Userspace Debug APIs - Provides a kernel API for userspace processes to set breakpoints, watchpoints, and single-step threads.
• Virtio Network Adapters - Provides a Virtio Net virtual network adapter for guest VMs, forwarding traffic to other components.
• Linux Guest Integration - Adds a Linux guest program and kernel module to a CAmkES VM configuration.
• Microkernel VM Constructors - Constructs fully functional guest VMs on a microkernel using VMM utilities, drivers, and memory helpers.
• Formal Proof Generators for Bitfield Code - Produces Isabelle/HOL formal proofs of correctness for generated C bitfield functions.
• Pointer-Aware Bitfield Field Generators - Generates pointer-aware bitfield fields that handle sign extension and canonical pointer sizes per architecture.
• Rust Function Bindings for C++ - Allows writing system components in either C or Rust with bindings and runtime support tailored to the kernel's isolation model.
• IOPort and VMCall Handlers - Registers handlers for IOPort faults and VMCall instructions on IA32 guest VMs.
• Rust Cross-Compilation Targets - Compiles Rust crates for any supported platform except 32-bit x86 using the kernel's full configuration matrix.
• Scheduler State Dumpers - Outputs all thread control block states to the kernel serial output.
• Custom Data Type Declarations - Defines structs, enums, or arrays for procedure arguments and ports using C header files.
• Capability Distribution Builders - Constructs and writes capability distribution specifications incrementally in memory using a Python library.
• Inter-Component Event Signals - Signals and waits for events between components to coordinate asynchronous data availability.
• Inter-Component Event Signals - Emits and consumes asynchronous signals between components with callback, blocking, and polling modes.
• Clock Generator Configurations - Configures clock generators and PLLs to set operating frequencies for SoC components.
• Interrupt Controller Emulators - Emulates GICv2 on ARM and PIC/LAPIC on IA32 interrupt controllers for guest virtual machines.
• Bitfield Type Generators from Specifications - Generates C bitfield types with accessor functions from declarative bit-level specifications.
• Thread and Process Synchronization - Uses mutexes, semaphores, and binary semaphores for mutual exclusion and coordination among component threads.
• Thread Fault Diagnosers - Prints fault type, program counter, and register state for crashed threads.
• Fault Endpoint Configurations - Assigns fault handler endpoints to threads so the kernel delivers fault IPC messages to designated handlers.
• Kernel Trace Event Recorders - Records kernel entries, tracepoints, and system call data into a user-provided in-kernel buffer.
• Serial I/O Forwarding - Routes guest VM serial console I/O through Virtio Console to a dedicated serial server component.
• Automated Test Execution - Executes test suites and formats results as human-readable text or XML.
• Microkernel Validation Suites - Executes a comprehensive set of tests against a custom kernel build to verify correctness and environment setup.
• Timer Driver Destructors - Provides cleanup and resource deallocation for timer drivers when no longer needed.
• Kernel API Walkthroughs - Ships walkthroughs with short exercises that demonstrate basic usage of kernel mechanisms.
• Operating Systems - Verified secure operating-system kernel.

Star 历史