merged aes_hil_update

Author: theonlytruealex

.vscode/settings.json

@@ -3,7 +3,7 @@
     "editor.defaultFormatter": "rust-lang.rust-analyzer",
     "editor.formatOnSave": true,
     "rust-analyzer.server.extraEnv": {
-        "RUSTUP_TOOLCHAIN": "nightly-2025-11-03"
+        "RUSTUP_TOOLCHAIN": "nightly-2026-04-21"
     },
     "rust-analyzer.check.allTargets": false,
 }

Cargo.toml

@@ -233,7 +233,8 @@ result_unit_err = "allow"
 unusual-byte-groupings = "allow"
 # We widely use upper case acronyms for hardware registers and fields.
 upper_case_acronyms = "allow"
-
+# Condensing match statements can make code harder to read and inconsistent.
+collapsible-match = "allow"
 
 missing_safety_doc = "allow"
 doc_lazy_continuation = "allow"

Makefile

@@ -407,9 +407,15 @@ ci-job-clippy:
 	@cargo clippy -- -D warnings
 	# Run `cargo clippy` in select boards so we run clippy with targets that
 	# actually check the arch-specific functions.
+	# 
+	# - nrf52840dk: cortex-m4
+	# - raspberry_pi_pico: cortex-m0
+	# - hifive1: riscv
+	# - qemu_i486_q35: x86
 	@cd boards/nordic/nrf52840dk && cargo clippy -- -D warnings
+	@cd boards/raspberry_pi_pico && cargo clippy -- -D warnings
 	@cd boards/hifive1 && cargo clippy -- -D warnings
-	@cd boards/qemu_i486_q35 && cargo clippy -- -D warnings
+	@cd boards/qemu_i486_q35 && cargo clippy -Zjson-target-spec -- -D warnings
 
 
 

README.md

@@ -106,8 +106,48 @@ Amit Levy, Bradford Campbell, Branden Ghena, Daniel B. Giffin, Pat Pannuto, Prab
 <details>
   <summary>Other Tock-related papers</summary>
 
+  <p>In SOSP'25 we reflected on 10 years of Tock development.</p>
+
+  <h4><a href="https://dl.acm.org/doi/10.1145/3731569.3764828">[SOSP'25] Tock: From Research To Securing 10 Million Computers</a></h4>
+<pre>
+@inproceedings{10.1145/3731569.3764828,
+  author = {Schuermann, Leon and Campbell, Brad and Ghena, Branden and Levis, Philip and Levy, Amit and Pannuto, Pat},
+  title = {Tock: From Research To Securing 10 Million Computers},
+  year = {2025},
+  isbn = {9798400718700},
+  publisher = {Association for Computing Machinery},
+  address = {New York, NY, USA},
+  url = {https://doi.org/10.1145/3731569.3764828},
+  doi = {10.1145/3731569.3764828},
+  booktitle = {Proceedings of the ACM SIGOPS 31st Symposium on Operating Systems Principles},
+  pages = {36–49},
+  numpages = {14},
+  location = {Lotte Hotel World, Seoul, Republic of Korea},
+  series = {SOSP '25}
+}</pre>
+
+  <p>There is a paper on the Tock security model. The threat model documentation in the docs/ folder is the source of truth for the current Tock threat model, but this paper represents a snapshot of the reasoning behind the Tock threat model and details how it compares to those in similar embedded OSes.</p>
+  <h4><a href="https://dx.doi.org/10.1145/3517208.3523752">[EuroSec'22] Tiered Trust for useful embedded systems security</a></h4>
+<pre>
+@inproceedings{10.1145/3517208.3523752,
+	author = {Ayers, Hudson and Dutta, Prabal and Levis, Philip and Levy, Amit and Pannuto, Pat and Van Why, Johnathan and Watson, Jean-Luc},
+	title = {Tiered Trust for Useful Embedded Systems Security},
+	year = {2022},
+	isbn = {9781450392556},
+	publisher = {Association for Computing Machinery},
+	address = {New York, NY, USA},
+	url = {https://doi.org/10.1145/3517208.3523752},
+	doi = {10.1145/3517208.3523752},
+	booktitle = {Proceedings of the 15th European Workshop on Systems Security},
+	pages = {15–21},
+	numpages = {7},
+	keywords = {security, embedded systems, operating systems, IoT},
+	location = {Rennes, France},
+	series = {EuroSec '22}
+}</pre>
+
   <p>There are two shorter papers that look at potential limitations of the Rust language for embedded software development. The earlier PLOS paper lays out challenges and the later APSys paper lays out potential solutions. Some persons describing work on programming languages and type theory may benefit from these references, but generally, most work should cite the SOSP paper above.</p>
-  <h4><a href="http://doi.acm.org/10.1145/3124680.3124717">APSys: The Case for Writing a Kernel in Rust</a></h4>
+  <h4><a href="http://doi.acm.org/10.1145/3124680.3124717">[APSys'17] The Case for Writing a Kernel in Rust</a></h4>
 <pre>
 @inproceedings{levy17rustkernel,
 	title = {The Case for Writing a Kernel in Rust},
@@ -129,7 +169,7 @@ Amit Levy, Bradford Campbell, Branden Ghena, Daniel B. Giffin, Pat Pannuto, Prab
 	author = {Levy, Amit and Campbell, Bradford and Ghena, Branden and Pannuto, Pat and Dutta, Prabal and Levis, Philip},
 }</pre>
 
-  <h4><a href="http://dx.doi.org/10.1145/2818302.2818306">PLOS: Ownership is Theft: Experiences Building an Embedded OS in Rust</a></h4>
+  <h4><a href="http://dx.doi.org/10.1145/2818302.2818306">[PLOS'15] Ownership is Theft: Experiences Building an Embedded OS in Rust</a></h4>
 <pre>
 @inproceedings{levy15ownership,
 	title = {Ownership is Theft: Experiences Building an Embedded {OS} in {R}ust},
@@ -145,25 +185,6 @@ Amit Levy, Bradford Campbell, Branden Ghena, Daniel B. Giffin, Pat Pannuto, Prab
 	address = {New York, NY, USA},
 	conference-url = {http://plosworkshop.org/2015/},
 	author = {Levy, Amit and Andersen, Michael P and Campbell, Bradford and Culler, David and Dutta, Prabal and Ghena, Branden and Levis, Philip and Pannuto, Pat},
-}</pre>
-  <p>There is also a paper on the Tock security model. The threat model documentation in the docs/ folder is the source of truth for the current Tock threat model, but this paper represents a snapshot of the reasoning behind the Tock threat model and details how it compares to those in similar embedded OSes.</p>
-  <h4><a href="https://dx.doi.org/10.1145/3517208.3523752">EuroSec: Tiered Trust for useful embedded systems security</a></h4>
-<pre>
-@inproceedings{10.1145/3517208.3523752,
-	author = {Ayers, Hudson and Dutta, Prabal and Levis, Philip and Levy, Amit and Pannuto, Pat and Van Why, Johnathan and Watson, Jean-Luc},
-	title = {Tiered Trust for Useful Embedded Systems Security},
-	year = {2022},
-	isbn = {9781450392556},
-	publisher = {Association for Computing Machinery},
-	address = {New York, NY, USA},
-	url = {https://doi.org/10.1145/3517208.3523752},
-	doi = {10.1145/3517208.3523752},
-	booktitle = {Proceedings of the 15th European Workshop on Systems Security},
-	pages = {15–21},
-	numpages = {7},
-	keywords = {security, embedded systems, operating systems, IoT},
-	location = {Rennes, France},
-	series = {EuroSec '22}
 }</pre>
 </details>
 

arch/cortex-m/src/syscall.rs

@@ -58,7 +58,7 @@ const SVC_FRAME_SIZE: usize = 32;
 /// Values for encoding the stored state buffer in a binary slice.
 const VERSION: usize = 1;
 const STORED_STATE_SIZE: usize = size_of::<CortexMStoredState>();
-const TAG: [u8; 4] = [b'c', b't', b'x', b'm'];
+const TAG: [u8; 4] = *b"ctxm";
 const METADATA_LEN: usize = 3;
 
 const VERSION_IDX: usize = 0;
@@ -181,7 +181,7 @@ impl<A: CortexMVariant> kernel::syscall::UserspaceKernelBoundary for SysCall<A>
         }
 
         let sp = state.psp as *mut u32;
-        let (r0, r1, r2, r3) = (sp.offset(0), sp.offset(1), sp.offset(2), sp.offset(3));
+        let (r0, r1, r2, r3) = (sp.add(0), sp.add(1), sp.add(2), sp.add(3));
 
         // These operations are only safe so long as
         // - the pointers are properly aligned. This is guaranteed because the
@@ -245,13 +245,13 @@ impl<A: CortexMVariant> kernel::syscall::UserspaceKernelBoundary for SysCall<A>
         //  - Instruction addresses require `|1` to indicate thumb code
         //  - Stack offset 4 is R12, which the syscall interface ignores
         let stack_bottom = state.psp as *mut usize;
-        ptr::write(stack_bottom.offset(7), state.psr); //......... -> APSR
-        ptr::write(stack_bottom.offset(6), callback.pc.addr() | 1); //... -> PC
-        ptr::write(stack_bottom.offset(5), state.yield_pc | 1); // -> LR
-        ptr::write(stack_bottom.offset(3), callback.argument3.as_usize()); // -> R3
-        ptr::write(stack_bottom.offset(2), callback.argument2); // -> R2
-        ptr::write(stack_bottom.offset(1), callback.argument1); // -> R1
-        ptr::write(stack_bottom.offset(0), callback.argument0); // -> R0
+        ptr::write(stack_bottom.add(7), state.psr); //......... -> APSR
+        ptr::write(stack_bottom.add(6), callback.pc.addr() | 1); //... -> PC
+        ptr::write(stack_bottom.add(5), state.yield_pc | 1); // -> LR
+        ptr::write(stack_bottom.add(3), callback.argument3.as_usize()); // -> R3
+        ptr::write(stack_bottom.add(2), callback.argument2); // -> R2
+        ptr::write(stack_bottom.add(1), callback.argument1); // -> R1
+        ptr::write(stack_bottom.add(0), callback.argument0); // -> R0
 
         Ok(())
     }
@@ -296,26 +296,26 @@ impl<A: CortexMVariant> kernel::syscall::UserspaceKernelBoundary for SysCall<A>
             // syscall (i.e. we return a value to the app immediately) then this
             // will have no effect. If we are doing something like `yield()`,
             // however, then we need to have this state.
-            state.yield_pc = ptr::read(new_stack_pointer.offset(6));
-            state.psr = ptr::read(new_stack_pointer.offset(7));
+            state.yield_pc = ptr::read(new_stack_pointer.add(6));
+            state.psr = ptr::read(new_stack_pointer.add(7));
 
             // Get the syscall arguments and return them along with the syscall.
             // It's possible the app did something invalid, in which case we put
             // the app in the fault state.
-            let r0 = ptr::read(new_stack_pointer.offset(0));
-            let r1 = ptr::read(new_stack_pointer.offset(1));
-            let r2 = ptr::read(new_stack_pointer.offset(2));
-            let r3 = ptr::read(new_stack_pointer.offset(3));
+            let r0 = ptr::read(new_stack_pointer.add(0));
+            let r1 = ptr::read(new_stack_pointer.add(1));
+            let r2 = ptr::read(new_stack_pointer.add(2));
+            let r3 = ptr::read(new_stack_pointer.add(3));
 
             // Get the actual SVC number.
             // Read the PC from the stack as a *const u16 (i.e. we're treating instructions as
             // u16).
             let pcptr_ptr: *const usize = new_stack_pointer;
             let pcptr_ptr: *const *const u16 = pcptr_ptr.cast();
-            let pcptr = ptr::read(pcptr_ptr.offset(6));
+            let pcptr = ptr::read(pcptr_ptr.add(6));
             // The svc instruction is the last instruction before the PC, and should be 16 bits.
             // Read it by offsetting the PC.
-            let svc_instr = ptr::read(pcptr.offset(-1));
+            let svc_instr = ptr::read(pcptr.sub(1));
             let svc_num = (svc_instr & 0xff) as u8;
 
             // Use the helper function to convert these raw values into a Tock
@@ -367,14 +367,14 @@ impl<A: CortexMVariant> kernel::syscall::UserspaceKernelBoundary for SysCall<A>
                 0xBAD00BAD,
             )
         } else {
-            let r0 = ptr::read(stack_pointer.offset(0));
-            let r1 = ptr::read(stack_pointer.offset(1));
-            let r2 = ptr::read(stack_pointer.offset(2));
-            let r3 = ptr::read(stack_pointer.offset(3));
-            let r12 = ptr::read(stack_pointer.offset(4));
-            let lr = ptr::read(stack_pointer.offset(5));
-            let pc = ptr::read(stack_pointer.offset(6));
-            let xpsr = ptr::read(stack_pointer.offset(7));
+            let r0 = ptr::read(stack_pointer.add(0));
+            let r1 = ptr::read(stack_pointer.add(1));
+            let r2 = ptr::read(stack_pointer.add(2));
+            let r3 = ptr::read(stack_pointer.add(3));
+            let r12 = ptr::read(stack_pointer.add(4));
+            let lr = ptr::read(stack_pointer.add(5));
+            let pc = ptr::read(stack_pointer.add(6));
+            let xpsr = ptr::read(stack_pointer.add(7));
             (r0, r1, r2, r3, r12, lr, pc, xpsr)
         };
 

arch/cortex-m0/src/lib.rs

@@ -33,14 +33,14 @@ struct HardFaultStackedRegisters {
 /// by the naked hard_fault_handler function.
 unsafe extern "C" fn hard_fault_handler_kernel(faulting_stack: *mut u32) -> ! {
     let hardfault_stacked_registers = HardFaultStackedRegisters {
-        r0: *faulting_stack.offset(0),
-        r1: *faulting_stack.offset(1),
-        r2: *faulting_stack.offset(2),
-        r3: *faulting_stack.offset(3),
-        r12: *faulting_stack.offset(4),
-        lr: *faulting_stack.offset(5),
-        pc: *faulting_stack.offset(6),
-        xpsr: *faulting_stack.offset(7),
+        r0: *faulting_stack.add(0),
+        r1: *faulting_stack.add(1),
+        r2: *faulting_stack.add(2),
+        r3: *faulting_stack.add(3),
+        r12: *faulting_stack.add(4),
+        lr: *faulting_stack.add(5),
+        pc: *faulting_stack.add(6),
+        xpsr: *faulting_stack.add(7),
     };
 
     panic!(

arch/cortex-v7m/src/lib.rs

@@ -288,14 +288,14 @@ unsafe extern "C" fn hard_fault_handler_arm_v7m_kernel(
         panic!("kernel stack overflow");
     } else {
         // Show the normal kernel hardfault message.
-        let stacked_r0: u32 = *faulting_stack.offset(0);
-        let stacked_r1: u32 = *faulting_stack.offset(1);
-        let stacked_r2: u32 = *faulting_stack.offset(2);
-        let stacked_r3: u32 = *faulting_stack.offset(3);
-        let stacked_r12: u32 = *faulting_stack.offset(4);
-        let stacked_lr: u32 = *faulting_stack.offset(5);
-        let stacked_pc: u32 = *faulting_stack.offset(6);
-        let stacked_xpsr: u32 = *faulting_stack.offset(7);
+        let stacked_r0: u32 = *faulting_stack.add(0);
+        let stacked_r1: u32 = *faulting_stack.add(1);
+        let stacked_r2: u32 = *faulting_stack.add(2);
+        let stacked_r3: u32 = *faulting_stack.add(3);
+        let stacked_r12: u32 = *faulting_stack.add(4);
+        let stacked_lr: u32 = *faulting_stack.add(5);
+        let stacked_pc: u32 = *faulting_stack.add(6);
+        let stacked_xpsr: u32 = *faulting_stack.add(7);
 
         let mode_str = "Kernel";
 

arch/riscv/src/lib.rs

@@ -173,18 +173,18 @@ pub unsafe fn configure_trap_handler() {
     // Indicate to the trap handler that we are executing kernel code.
     csr::CSR.mscratch.set(0);
 
-    // Set the machine-mode trap handler. By not configuing an S-mode or U-mode
+    // Set the machine-mode trap handler. By not configuring an S-mode or U-mode
     // trap handler, this should ensure that all traps are handled by the M-mode
     // handler.
     csr::CSR.mtvec.write(
-        csr::mtvec::mtvec::trap_addr.val(_start_trap as usize >> 2)
+        csr::mtvec::mtvec::trap_addr.val(_start_trap as extern "C" fn() -> ! as usize >> 2)
             + csr::mtvec::mtvec::mode::CLEAR,
     );
 }
 
 // Mock implementation for tests on Travis-CI.
 #[cfg(not(any(doc, all(target_arch = "riscv32", target_os = "none"))))]
-pub extern "C" fn _start_trap() {
+pub extern "C" fn _start_trap() -> ! {
     unimplemented!()
 }
 
@@ -291,7 +291,7 @@ pub extern "C" fn _start_trap() {
 // symbol name.
 #[export_name = "_start_trap"]
 #[unsafe(naked)]
-pub extern "C" fn _start_trap() {
+pub extern "C" fn _start_trap() -> ! {
     use core::arch::naked_asm;
     naked_asm!(
         "

arch/riscv/src/syscall.rs

@@ -49,7 +49,7 @@ const R_A4: usize = 13;
 /// Values for encoding the stored state buffer in a binary slice.
 const VERSION: u32 = 1;
 const STORED_STATE_SIZE: u32 = size_of::<Riscv32iStoredState>() as u32;
-const TAG: [u8; 4] = [b'r', b'v', b'5', b'i'];
+const TAG: [u8; 4] = *b"rv5i";
 const METADATA_LEN: usize = 3;
 
 const VERSION_IDX: usize = 0;

arch/rv32i/src/lib.rs

@@ -11,16 +11,16 @@ pub mod machine_timer;
 
 // Re-export shared libraries so that dependent crates do not have to have
 // both rv32i and riscv as dependencies.
+pub use riscv::_start_trap;
+pub use riscv::configure_trap_handler;
 pub use riscv::csr;
+pub use riscv::dma_fence;
 pub use riscv::initialize_ram_jump_to_main;
 pub use riscv::pmp;
+pub use riscv::print_mcause;
 pub use riscv::print_riscv_state;
+pub use riscv::semihost_command;
 pub use riscv::support;
 pub use riscv::syscall;
 pub use riscv::thread_id;
 pub use riscv::PermissionMode;
-pub use riscv::_start_trap;
-pub use riscv::configure_trap_handler;
-pub use riscv::dma_fence;
-pub use riscv::print_mcause;
-pub use riscv::semihost_command;