Revamped memory management system by Ioan-Cristian · Pull Request #10 · OxidosAutomotive/tock

Ioan-Cristian · 2025-06-05T07:35:38Z

Pull Request Overview

This pull request revamps the memory management system completely. The goals of the new memory management are:

Make Tock MMU-capable
Preserve compatibility with MPU architectures
Improve memory safety through abstractions types
Extract any non-architecture specific logic from arch crates to the kernel crate
Same kernel runs on different architectures: MMU-capable, MPU-capable or without memory protection
No overhead for MPU architectures
Configurable memory granule
No changes required for chips and capsule crates.

Testing Strategy

This pull request was tested by running libtock-rs applications on Raspberry Pi Pico, QEMU RISC-V 32-bit and QEMU x86.

TODO or Help Wanted

This pull request still needs to clarify the following points:

The current implementation supports only two regions for each process: PROG and RAM. This breaks IPC support (unusued in libtock-rs). A future patch will address this issue.
ARMv*-M architectures have limited capabilities due to hardware restrictions: if the region is not a power a two, then only the greatest power of two smaller than the region size is covered, and only if the start of the region is properly aligned. A better algorithm that makes use of subregions could soft the size restriction.
Broken process restart. ProcessStandard::create() needs to be refactored in several functions that can be reused by ProcessStandard::reset().
Currently, there is some overhead for MPU architectures:
- ASIDs are useless. They could be simply be (). Impossible to implement since the kernel needs &dyn Process, which in turn means that Process needs to be object-safe.
- Userspace virtual pointer -> kernel virtual pointer is still performed on allows. This could be a no-op.
The granule is currently hard-coded as a 4KiB page. Impossible to make it generic since the kernel needs dyn Process, which in turn means that Process needs to be object-safe.
Kernel address space should be mapped at higher addresses on MMU-capable architectures to allow the entire low virtual address space to processes. This feature is architecture dependent. A solution to cover both MPU-capable and MMU-capable architectures needs to be found.

Documentation Updated

Add documentation comments on each public method.

Formatting

Ran make prepush.

This allows the checker to try multiple keys when verifying a signature.

This generalizes setting the sig verification key from just once at init to being able to set dynamically, allowing for multiple keys to be used with signature verification.

This module provides the signature verification but can hold multiple keys and supports switching between them.

Enable the test ecdsa sig check to support switching between keys.

There are now two signature keys that can be used to verify app signatures. I've checked that I can install apps signed with both keys and they both run.

This means the implementor isn't required to hold the slice that could contain a private key.

Not sure why that was there.

If a caller selects a key that is already active just set that key again. Do not return an error.