Add support for wolfSSL in CHERIoT

.gitmodules

@@ -10,3 +10,7 @@
 [submodule "third_party/coreMQTT"]
 	path = third_party/coreMQTT
 	url = https://github.com/FreeRTOS/coreMQTT
+[submodule "third_party/wolfssl"]
+	path = third_party/wolfssl
+	url = https://github.com/The-Capable-Hub/wolfssl.git
+	branch = wbeasley/cheriot-changes

README.md

@@ -18,6 +18,7 @@ The network stack includes components from a variety of third parties:
  - [FreeRTOS coreSNTP](https://github.com/FreeRTOS/coreSNTP) provides the SNTP client.
  - [FreeRTOS coreMQTT](https://github.com/FreeRTOS/coreMQTT) provides the MQTT client.
  - [BearSSL](https://www.bearssl.org) provides the TLS 1.2 stack.
+ - [wolfSSL](https://www.wolfssl.com) provides an alternative TLS stack (TLS 1.3 capable).
 
 This demonstrates the CHERIoT platform's ability to adopt existing codebases.
 We are building around 100 KLoC of third-party code into this stack.
@@ -39,6 +40,14 @@ Four are mostly existing third-party code with thin wrappers:
  - The TLS stack is, again, mostly unmodified BearSSL code, with just some thin wrappers added around the edges.
  - The MQTT compartment, like the SNTP compartment, is just another consumer of the network stack (the TLS layer, specifically) and provides a simple interface for connecting to MQTT servers, publishing messages and receiving notifications of publish events.
 
+Two additional compartments provide an alternative TLS stack based on wolfSSL (TLS 1.3):
+
+ - The `WolfSSLTLS` compartment wraps wolfSSL and mirrors the BearSSL TLS compartment's interface.
+ - The `WolfSSLMQTT` compartment provides a wolfSSL-backed MQTT client equivalent to the existing BearSSL `MQTT` compartment.
+
+Examples `06.HTTPS-wolfssl`, `07.HTTPS-wolfssl-concurrent`, and `08.MQTT-wolfssl` demonstrate these compartments.
+See [`tests/wolfssl/wolfcrypt/README.md`](tests/wolfssl/wolfcrypt/README.md) for the wolfCrypt test and benchmark application.
+
 These are joined by three new compartments:
 
  - The firewall compartment is the only thing that talks directly to the network device.
@@ -84,7 +93,7 @@ It is fault-tolerant: when an error is triggered (CHERI spatial or temporal safe
 We expand on this capability [below](#automatic-restart-of-the-tcpip-stack).
 
 Unlike the TCP/IP stack, the TLS compartment is almost completely stateless.
-This makes resetting the compartment trivial, and gives strong flow isolation properties: Even if an attacker compromises the TLS compartment by sending malicious data over one connection that triggers a bug in BearSSL (unlikely), it is extraordinarily difficult for them to interfere with any other TLS connection.
+This makes resetting the compartment trivial, and gives strong flow isolation properties: Even if an attacker compromises the TLS compartment by sending malicious data over one connection that triggers a bug in the TLS library (unlikely), it is extraordinarily difficult for them to interfere with any other TLS connection.
 
 All inbound and outbound data go through the on-device firewall, which is controlled by the Network API compartment.
 The TCP/IP stack has no access to the NetAPI control-plane interface.

THIRD_PARTY_NOTICES.txt

@@ -6,6 +6,7 @@ This repository includes several submodules with their own licenses:
  - FreeRTOS+TCP (third_party/freertos-plus-tcp/LICENSE.md)
  - coreMQTT (MIT, see third_party/coreMQTT/LICENSE)
  - coreSNTP (MIT, see third_party/coreSNTP/LICENSE)
+ - wolfSSL (GPLv3 or commercial license, see third_party/wolfSSL/LICENSING)
 
 New code in this repository is covered by the MIT license, as listed in
 LICENSE and in per-file copyright headers.

examples/06.HTTPS-wolfssl/Comodo_AAA_Services_root.h

@@ -0,0 +1,103 @@
+// Comodo AAA Certificate Services root CA self-signed, valid 2004–2028 (used by example.com)
+// self-signed RSA-SHA1
+//
+// To regen:
+//   1. Get the root cert from the system trust store:
+//        cp /etc/ssl/certs/Comodo_AAA_Services_root.pem comodo_aaa.pem
+//   2. Convert PEM → DER:
+//        openssl x509 -in comodo_aaa.pem -outform DER -out comodo_aaa.der
+//   3. Convert to C byte array:
+//    xxd -i comodo_aaa.der | sed -e '1s/.*/static const unsigned char COMODO_AAA_SERVICES_ROOT_DER[] = {/'-e '/^unsigned int/d'
+//
+static const unsigned char COMODO_AAA_SERVICES_ROOT_DER[] = {
+  0x30, 0x82, 0x04, 0x32, 0x30, 0x82, 0x03, 0x1a, 0xa0, 0x03, 0x02, 0x01,
+  0x02, 0x02, 0x01, 0x01, 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86,
+  0xf7, 0x0d, 0x01, 0x01, 0x05, 0x05, 0x00, 0x30, 0x7b, 0x31, 0x0b, 0x30,
+  0x09, 0x06, 0x03, 0x55, 0x04, 0x06, 0x13, 0x02, 0x47, 0x42, 0x31, 0x1b,
+  0x30, 0x19, 0x06, 0x03, 0x55, 0x04, 0x08, 0x0c, 0x12, 0x47, 0x72, 0x65,
+  0x61, 0x74, 0x65, 0x72, 0x20, 0x4d, 0x61, 0x6e, 0x63, 0x68, 0x65, 0x73,
+  0x74, 0x65, 0x72, 0x31, 0x10, 0x30, 0x0e, 0x06, 0x03, 0x55, 0x04, 0x07,
+  0x0c, 0x07, 0x53, 0x61, 0x6c, 0x66, 0x6f, 0x72, 0x64, 0x31, 0x1a, 0x30,
+  0x18, 0x06, 0x03, 0x55, 0x04, 0x0a, 0x0c, 0x11, 0x43, 0x6f, 0x6d, 0x6f,
+  0x64, 0x6f, 0x20, 0x43, 0x41, 0x20, 0x4c, 0x69, 0x6d, 0x69, 0x74, 0x65,
+  0x64, 0x31, 0x21, 0x30, 0x1f, 0x06, 0x03, 0x55, 0x04, 0x03, 0x0c, 0x18,
+  0x41, 0x41, 0x41, 0x20, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63,
+  0x61, 0x74, 0x65, 0x20, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73,
+  0x30, 0x1e, 0x17, 0x0d, 0x30, 0x34, 0x30, 0x31, 0x30, 0x31, 0x30, 0x30,
+  0x30, 0x30, 0x30, 0x30, 0x5a, 0x17, 0x0d, 0x32, 0x38, 0x31, 0x32, 0x33,
+  0x31, 0x32, 0x33, 0x35, 0x39, 0x35, 0x39, 0x5a, 0x30, 0x7b, 0x31, 0x0b,
+  0x30, 0x09, 0x06, 0x03, 0x55, 0x04, 0x06, 0x13, 0x02, 0x47, 0x42, 0x31,
+  0x1b, 0x30, 0x19, 0x06, 0x03, 0x55, 0x04, 0x08, 0x0c, 0x12, 0x47, 0x72,
+  0x65, 0x61, 0x74, 0x65, 0x72, 0x20, 0x4d, 0x61, 0x6e, 0x63, 0x68, 0x65,
+  0x73, 0x74, 0x65, 0x72, 0x31, 0x10, 0x30, 0x0e, 0x06, 0x03, 0x55, 0x04,
+  0x07, 0x0c, 0x07, 0x53, 0x61, 0x6c, 0x66, 0x6f, 0x72, 0x64, 0x31, 0x1a,
+  0x30, 0x18, 0x06, 0x03, 0x55, 0x04, 0x0a, 0x0c, 0x11, 0x43, 0x6f, 0x6d,
+  0x6f, 0x64, 0x6f, 0x20, 0x43, 0x41, 0x20, 0x4c, 0x69, 0x6d, 0x69, 0x74,
+  0x65, 0x64, 0x31, 0x21, 0x30, 0x1f, 0x06, 0x03, 0x55, 0x04, 0x03, 0x0c,
+  0x18, 0x41, 0x41, 0x41, 0x20, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69,
+  0x63, 0x61, 0x74, 0x65, 0x20, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65,
+  0x73, 0x30, 0x82, 0x01, 0x22, 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48,
+  0x86, 0xf7, 0x0d, 0x01, 0x01, 0x01, 0x05, 0x00, 0x03, 0x82, 0x01, 0x0f,
+  0x00, 0x30, 0x82, 0x01, 0x0a, 0x02, 0x82, 0x01, 0x01, 0x00, 0xbe, 0x40,
+  0x9d, 0xf4, 0x6e, 0xe1, 0xea, 0x76, 0x87, 0x1c, 0x4d, 0x45, 0x44, 0x8e,
+  0xbe, 0x46, 0xc8, 0x83, 0x06, 0x9d, 0xc1, 0x2a, 0xfe, 0x18, 0x1f, 0x8e,
+  0xe4, 0x02, 0xfa, 0xf3, 0xab, 0x5d, 0x50, 0x8a, 0x16, 0x31, 0x0b, 0x9a,
+  0x06, 0xd0, 0xc5, 0x70, 0x22, 0xcd, 0x49, 0x2d, 0x54, 0x63, 0xcc, 0xb6,
+  0x6e, 0x68, 0x46, 0x0b, 0x53, 0xea, 0xcb, 0x4c, 0x24, 0xc0, 0xbc, 0x72,
+  0x4e, 0xea, 0xf1, 0x15, 0xae, 0xf4, 0x54, 0x9a, 0x12, 0x0a, 0xc3, 0x7a,
+  0xb2, 0x33, 0x60, 0xe2, 0xda, 0x89, 0x55, 0xf3, 0x22, 0x58, 0xf3, 0xde,
+  0xdc, 0xcf, 0xef, 0x83, 0x86, 0xa2, 0x8c, 0x94, 0x4f, 0x9f, 0x68, 0xf2,
+  0x98, 0x90, 0x46, 0x84, 0x27, 0xc7, 0x76, 0xbf, 0xe3, 0xcc, 0x35, 0x2c,
+  0x8b, 0x5e, 0x07, 0x64, 0x65, 0x82, 0xc0, 0x48, 0xb0, 0xa8, 0x91, 0xf9,
+  0x61, 0x9f, 0x76, 0x20, 0x50, 0xa8, 0x91, 0xc7, 0x66, 0xb5, 0xeb, 0x78,
+  0x62, 0x03, 0x56, 0xf0, 0x8a, 0x1a, 0x13, 0xea, 0x31, 0xa3, 0x1e, 0xa0,
+  0x99, 0xfd, 0x38, 0xf6, 0xf6, 0x27, 0x32, 0x58, 0x6f, 0x07, 0xf5, 0x6b,
+  0xb8, 0xfb, 0x14, 0x2b, 0xaf, 0xb7, 0xaa, 0xcc, 0xd6, 0x63, 0x5f, 0x73,
+  0x8c, 0xda, 0x05, 0x99, 0xa8, 0x38, 0xa8, 0xcb, 0x17, 0x78, 0x36, 0x51,
+  0xac, 0xe9, 0x9e, 0xf4, 0x78, 0x3a, 0x8d, 0xcf, 0x0f, 0xd9, 0x42, 0xe2,
+  0x98, 0x0c, 0xab, 0x2f, 0x9f, 0x0e, 0x01, 0xde, 0xef, 0x9f, 0x99, 0x49,
+  0xf1, 0x2d, 0xdf, 0xac, 0x74, 0x4d, 0x1b, 0x98, 0xb5, 0x47, 0xc5, 0xe5,
+  0x29, 0xd1, 0xf9, 0x90, 0x18, 0xc7, 0x62, 0x9c, 0xbe, 0x83, 0xc7, 0x26,
+  0x7b, 0x3e, 0x8a, 0x25, 0xc7, 0xc0, 0xdd, 0x9d, 0xe6, 0x35, 0x68, 0x10,
+  0x20, 0x9d, 0x8f, 0xd8, 0xde, 0xd2, 0xc3, 0x84, 0x9c, 0x0d, 0x5e, 0xe8,
+  0x2f, 0xc9, 0x02, 0x03, 0x01, 0x00, 0x01, 0xa3, 0x81, 0xc0, 0x30, 0x81,
+  0xbd, 0x30, 0x1d, 0x06, 0x03, 0x55, 0x1d, 0x0e, 0x04, 0x16, 0x04, 0x14,
+  0xa0, 0x11, 0x0a, 0x23, 0x3e, 0x96, 0xf1, 0x07, 0xec, 0xe2, 0xaf, 0x29,
+  0xef, 0x82, 0xa5, 0x7f, 0xd0, 0x30, 0xa4, 0xb4, 0x30, 0x0e, 0x06, 0x03,
+  0x55, 0x1d, 0x0f, 0x01, 0x01, 0xff, 0x04, 0x04, 0x03, 0x02, 0x01, 0x06,
+  0x30, 0x0f, 0x06, 0x03, 0x55, 0x1d, 0x13, 0x01, 0x01, 0xff, 0x04, 0x05,
+  0x30, 0x03, 0x01, 0x01, 0xff, 0x30, 0x7b, 0x06, 0x03, 0x55, 0x1d, 0x1f,
+  0x04, 0x74, 0x30, 0x72, 0x30, 0x38, 0xa0, 0x36, 0xa0, 0x34, 0x86, 0x32,
+  0x68, 0x74, 0x74, 0x70, 0x3a, 0x2f, 0x2f, 0x63, 0x72, 0x6c, 0x2e, 0x63,
+  0x6f, 0x6d, 0x6f, 0x64, 0x6f, 0x63, 0x61, 0x2e, 0x63, 0x6f, 0x6d, 0x2f,
+  0x41, 0x41, 0x41, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61,
+  0x74, 0x65, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x2e, 0x63,
+  0x72, 0x6c, 0x30, 0x36, 0xa0, 0x34, 0xa0, 0x32, 0x86, 0x30, 0x68, 0x74,
+  0x74, 0x70, 0x3a, 0x2f, 0x2f, 0x63, 0x72, 0x6c, 0x2e, 0x63, 0x6f, 0x6d,
+  0x6f, 0x64, 0x6f, 0x2e, 0x6e, 0x65, 0x74, 0x2f, 0x41, 0x41, 0x41, 0x43,
+  0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x53, 0x65,
+  0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x2e, 0x63, 0x72, 0x6c, 0x30, 0x0d,
+  0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x05, 0x05,
+  0x00, 0x03, 0x82, 0x01, 0x01, 0x00, 0x08, 0x56, 0xfc, 0x02, 0xf0, 0x9b,
+  0xe8, 0xff, 0xa4, 0xfa, 0xd6, 0x7b, 0xc6, 0x44, 0x80, 0xce, 0x4f, 0xc4,
+  0xc5, 0xf6, 0x00, 0x58, 0xcc, 0xa6, 0xb6, 0xbc, 0x14, 0x49, 0x68, 0x04,
+  0x76, 0xe8, 0xe6, 0xee, 0x5d, 0xec, 0x02, 0x0f, 0x60, 0xd6, 0x8d, 0x50,
+  0x18, 0x4f, 0x26, 0x4e, 0x01, 0xe3, 0xe6, 0xb0, 0xa5, 0xee, 0xbf, 0xbc,
+  0x74, 0x54, 0x41, 0xbf, 0xfd, 0xfc, 0x12, 0xb8, 0xc7, 0x4f, 0x5a, 0xf4,
+  0x89, 0x60, 0x05, 0x7f, 0x60, 0xb7, 0x05, 0x4a, 0xf3, 0xf6, 0xf1, 0xc2,
+  0xbf, 0xc4, 0xb9, 0x74, 0x86, 0xb6, 0x2d, 0x7d, 0x6b, 0xcc, 0xd2, 0xf3,
+  0x46, 0xdd, 0x2f, 0xc6, 0xe0, 0x6a, 0xc3, 0xc3, 0x34, 0x03, 0x2c, 0x7d,
+  0x96, 0xdd, 0x5a, 0xc2, 0x0e, 0xa7, 0x0a, 0x99, 0xc1, 0x05, 0x8b, 0xab,
+  0x0c, 0x2f, 0xf3, 0x5c, 0x3a, 0xcf, 0x6c, 0x37, 0x55, 0x09, 0x87, 0xde,
+  0x53, 0x40, 0x6c, 0x58, 0xef, 0xfc, 0xb6, 0xab, 0x65, 0x6e, 0x04, 0xf6,
+  0x1b, 0xdc, 0x3c, 0xe0, 0x5a, 0x15, 0xc6, 0x9e, 0xd9, 0xf1, 0x59, 0x48,
+  0x30, 0x21, 0x65, 0x03, 0x6c, 0xec, 0xe9, 0x21, 0x73, 0xec, 0x9b, 0x03,
+  0xa1, 0xe0, 0x37, 0xad, 0xa0, 0x15, 0x18, 0x8f, 0xfa, 0xba, 0x02, 0xce,
+  0xa7, 0x2c, 0xa9, 0x10, 0x13, 0x2c, 0xd4, 0xe5, 0x08, 0x26, 0xab, 0x22,
+  0x97, 0x60, 0xf8, 0x90, 0x5e, 0x74, 0xd4, 0xa2, 0x9a, 0x53, 0xbd, 0xf2,
+  0xa9, 0x68, 0xe0, 0xa2, 0x6e, 0xc2, 0xd7, 0x6c, 0xb1, 0xa3, 0x0f, 0x9e,
+  0xbf, 0xeb, 0x68, 0xe7, 0x56, 0xf2, 0xae, 0xf2, 0xe3, 0x2b, 0x38, 0x3a,
+  0x09, 0x81, 0xb5, 0x6b, 0x85, 0xd7, 0xbe, 0x2d, 0xed, 0x3f, 0x1a, 0xb7,
+  0xb2, 0x63, 0xe2, 0xf5, 0x62, 0x2c, 0x82, 0xd4, 0x6a, 0x00, 0x41, 0x50,
+  0xf1, 0x39, 0x83, 0x9f, 0x95, 0xe9, 0x36, 0x96, 0x98, 0x6e
+};

examples/06.HTTPS-wolfssl/https_wolfssl.cc

@@ -0,0 +1,122 @@
+// Copyright The Good Penguin Ltd
+// SPDX-License-Identifier: MIT
+//
+// wolfSSL HTTPS example, mirrors examples/03.HTTPS/https.cc but uses the WolfSSLTLS compartment instead of BearSSL TLS.
+//
+
+#include <NetAPI.h>
+#if __has_include(<allocator.h>)
+#	include <allocator.h>
+#endif
+#include <debug.hh>
+#include <errno.h>
+#include <fail-simulator-on-error.h>
+#include <memory>
+#include <string_view>
+#include <thread.h>
+#include <tick_macros.h>
+#include <sntp.h>
+#include <tls_wolfssl.h>
+
+#include "Comodo_AAA_Services_root.h"
+
+using Debug            = ConditionalDebug<true, "WolfTLS Example">;
+constexpr bool UseIPv6 = CHERIOT_RTOS_OPTION_IPv6;
+
+DECLARE_AND_DEFINE_CONNECTION_CAPABILITY(ExampleComTLS,
+                                         "example.com",
+                                         443,
+                                         ConnectionTypeTCP);
+
+DECLARE_AND_DEFINE_ALLOCATOR_CAPABILITY(TestMalloc, 32 * 1024);
+#define TEST_MALLOC STATIC_SEALED_VALUE(TestMalloc)
+
+void __cheri_compartment("https_wolfssl_example") example()
+{
+    Debug::log("Waiting for network...");
+    network_start();
+
+    // Cert date validation requires correct time.
+    {
+        Timeout t{MS_TO_TICKS(5000)};
+        while (sntp_update(&t) != 0)
+        {
+            Debug::log("Waiting for NTP...");
+            t = Timeout{MS_TO_TICKS(5000)};
+        }
+    }
+
+    Debug::log("Attempting to connect to example.com:443 via wolfSSL TLS 1.3");
+
+    static const WolfSSLTrustAnchor trustAnchors[] = {
+      {COMODO_AAA_SERVICES_ROOT_DER, sizeof(COMODO_AAA_SERVICES_ROOT_DER)},
+    };
+
+    Timeout unlimited{UnlimitedTimeout};
+    auto    tlsConn = wolftls_connection_create(
+      &unlimited,
+      TEST_MALLOC,
+      CONNECTION_CAPABILITY(ExampleComTLS),
+      trustAnchors,
+      1);
+
+    if (!__builtin_cheri_tag_get(tlsConn))
+    {
+        Debug::log("Failed to create TLS connection");
+        return;
+    }
+    Debug::log("TLS handshake complete");
+
+    static char request[] = "GET / HTTP/1.1\r\n"
+                            "Host: example.com\r\n"
+                            "User-Agent: cheriot-wolfssl\r\n"
+                            "Connection: close\r\n"
+                            "Accept: */*\r\n"
+                            "\r\n";
+    constexpr size_t toSend = sizeof(request) - 1;
+    size_t           sent   = 0;
+    while (sent < toSend)
+    {
+        ssize_t r = wolftls_connection_send(
+          &unlimited, tlsConn, &request[sent], toSend - sent);
+        if (r > 0)
+            sent += r;
+        else
+        {
+            Debug::log("Send failed: {}", r);
+            break;
+        }
+    }
+    Debug::log("Sent {} bytes, waiting for response", sent);
+
+    while (true)
+    {
+        auto [received, buffer] =
+          wolftls_connection_receive(&unlimited, tlsConn);
+        if (received > 0)
+        {
+            Debug::log(
+              "Received {} bytes:\n{}",
+              received,
+              std::string_view(reinterpret_cast<char *>(buffer), received));
+            heap_free(TEST_MALLOC, buffer);
+        }
+        else if (received == 0 || received == -ENOTCONN)
+        {
+            Debug::log("Connection closed");
+            break;
+        }
+        else if (received == -ETIMEDOUT)
+        {
+            Debug::log("Receive timed out");
+        }
+        else
+        {
+            Debug::log("Receive error: {}", received);
+            break;
+        }
+    }
+
+    wolftls_connection_close(&unlimited, tlsConn);
+    Debug::log("Done. Free heap: {}", heap_available());
+}

examples/06.HTTPS-wolfssl/xmake.lua

@@ -0,0 +1,50 @@
+-- Copyright The Good Penguin Ltd
+-- SPDX-License-Identifier: MIT
+
+sdkdir = path.absolute("../../../cheriot-rtos/sdk")
+
+set_project("CHERIoT wolfSSL HTTPS Example")
+
+includes(sdkdir)
+set_toolchains("cheriot-clang")
+includes(path.join(sdkdir, "lib"))
+includes("../../lib")
+
+option("board")
+  set_default("sonata-1.3")
+
+compartment("https_wolfssl_example")
+  add_includedirs("../../include")
+  add_deps("freestanding", "DNS", "TCPIP", "NetAPI", "WolfSSLTLS", "Firewall", "SNTP", "time_helpers", "debug")
+  add_files("https_wolfssl.cc")
+  add_rules("cheriot.network-stack.ipv6")
+
+firmware("06.https_wolfssl_example")
+  set_policy("build.warning", true)
+  add_deps("https_wolfssl_example")
+  on_load(function(target)
+    target:values_set("board", "$(board)")
+    target:values_set("threads", {
+      {
+        compartment = "https_wolfssl_example",
+        priority = 1,
+        entry_point = "example",
+        stack_size = 0x2000,
+        trusted_stack_frames = 6
+      },
+      {
+        compartment = "TCPIP",
+        priority = 1,
+        entry_point = "ip_thread_entry",
+        stack_size = 0xe00,
+        trusted_stack_frames = 5
+      },
+      {
+        compartment = "Firewall",
+        priority = 2,
+        entry_point = "ethernet_run_driver",
+        stack_size = 0x1000,
+        trusted_stack_frames = 5
+      }
+    }, {expand = false})
+  end)