Revamped memory management system

Cargo.toml

@@ -61,6 +61,7 @@ members = [
     "boards/configurations/nrf52840dk/nrf52840dk-test-kernel",
     "boards/configurations/nrf52840dk/nrf52840dk-test-dynamic-app-load",
     "boards/configurations/microbit_v2/microbit_v2-test-dynamic-app-load",
+    "boards/tutorials/nrf52840dk-root-of-trust-tutorial",
     "boards/tutorials/nrf52840dk-dynamic-apps-and-policies",
     "boards/tutorials/nrf52840dk-hotp-tutorial",
     "boards/tutorials/nrf52840dk-thread-tutorial",
@@ -136,84 +137,108 @@ codegen-units = 1
 # Tock does not comply with or we do not want to use.
 #
 # For each group there are three sections:
-# 1. The first section are lints we almost certainly don't want.
+# 1. The first section are lints we don't want with a comment explaining our use
+#    case for not enabling that lint.
 # 2. The second section are lints we may not want, we probably have to see the
 #    resulting diff.
 # 3. The third section are lints that we do want we just need to fixup the code
 #    to pass the lint checks.
-#
-# There are some lints we specifically do not want:
-#
-# - `clippy::if_same_then_else`: There are often good reasons to enumerate
-#   different states that have the same effect.
-# - `clippy::manual_unwrap_or_default`: As of Apr 2024, this lint has many false
-#   positives.
 [workspace.lints.clippy]
 restriction = "allow"
 
-if_same_then_else = "allow"
-manual_unwrap_or_default = "allow"
-
-
 # COMPLEXITY LINTS
 complexity = { level = "deny", priority = -1 }
 
+# Subjective, and complex functions may need many arguments.
 too_many_arguments = "allow"
+# This is pretty sensitive, even `Result`s with returned buffers trigger this.
+# It is not worth us creating types for all of these.
 type_complexity = "allow"
+# We use options extensively and they can be as clear as if let statements.
 option_map_unit_fn = "allow"
+# Sometimes the semantic meaning of variables means it is more clear to use
+# nonminimal if statements, particularly when matching hardware or datasheets.
 nonminimal_bool = "allow"
+# Particularly for setting register values, expressing a zero offset can be
+# semantically meaningful and encourage consistency between several lines of
+# code.
 identity-op = "allow"
-while-let-loop = "allow"
+# Subjective, and for SyscallDrivers sometimes enumerating the specific command
+# numbers rather than using a range is semantically more clear.
 manual-range-patterns = "allow"
+# Particularly when interactive with hardware, including a leading zero can
+# often be semantically more clear.
+zero_prefixed_literal = "allow"
+
+
 manual-flatten = "allow"
 
-zero_prefixed_literal = "allow"
 
 # STYLE
 style = { level = "deny", priority = -1 }
 
-blocks_in_conditions = "allow"
+# Sometimes an if block is standalone and shouldn't be merged with an else.
 collapsible_else_if = "allow"
+# Multiple if blocks can be clearer to express a particular logical flow.
 collapsible_if = "allow"
-collapsible_match = "allow"
+# Sometimes if statements are easier to read than match statements.
 comparison_chain = "allow"
+# Sometimes it's more clear to have repetition in enum names.
 enum-variant-names = "allow"
-field-reassign-with-default = "allow"
+# For buffers, `.get(0)` (using byte index) makes more sense than `.first()`.
 get_first = "allow"
+# There are often good reasons to enumerate different states that have the same
+# effect.
+if_same_then_else = "allow"
+# Buffers and objects can have a length of 0, but it isn't necessarily intuitive
+# to think of a buffer or those objects as "empty".
 len_without_is_empty = "allow"
+# Buffer logic often makes more sense with lengths, and not `is_empty()`.
 len_zero = "allow"
+# Sometimes the borrow checker works better with `match` instead of `.map()`.
 manual-map = "allow"
+# Syntax like `!(-17..=4).contains(&x)` is just not clear.
 manual_range_contains = "allow"
+# Match statement is clear, using `matches!()` is not an improvement.
 match_like_matches_macro = "allow"
+# Sometimes it makes sense to have module in a folder of the same name.
 module_inception = "allow"
-new-ret-no-self = "allow"
+# Maybe someday we want this, but right now `for i in 0..4` is much more clear
+# than using `.iter()` functions like `.skip(n)`.
+needless-range-loop = "allow"
+# We don't need unused Default implementations.
 new_without_default = "allow"
-redundant_closure = "allow"
+# Using `Result()` is good practice, even if there is no meaning to the error.
 result_unit_err = "allow"
-single_match = "allow"
+# For hardware registers it can make sense to group bits semantically and not
+# just in multiples of four.
+unusual-byte-groupings = "allow"
+# We widely use upper case acronyms for hardware registers and fields.
 upper_case_acronyms = "allow"
 
 
-declare-interior-mutable-const = "allow"
-let_and_return = "allow"
 missing_safety_doc = "allow"
-needless-range-loop = "allow"
-option_map_or_none = "allow"
-redundant_pattern_matching = "allow"
-unusual-byte-groupings = "allow"
 doc_lazy_continuation = "allow"
 
 
 # PERF
 perf = { level = "deny", priority = -1 }
 
+# Tock extensively uses enums for state machines, and it often is much clearer
+# to store objects between states in the state enum rather than as "global"
+# variables in the struct itself. Therefore, some enums end up quite large.
 large-enum-variant = "allow"
 
 
 # CARGO
 cargo = { level = "deny", priority = -1 }
 
+# Tock includes over 100 crates, and it is just too pedantic to expect each one
+# to have full and correct metadata.
 cargo_common_metadata = "allow"
+# We generally avoid all cargo features, and therefore it isn't intuitive that
+# we would expect some features to be enabled by default, so it can make sense
+# to have a feature to disable something.
 negative-feature-names = "allow"
 
 

arch/cortex-m/src/lib.rs

@@ -5,6 +5,10 @@
 //! Generic support for all Cortex-M platforms.
 
 #![no_std]
+// This feature is almost stable. There is an ongoing discussion on whether the
+// method should accept non power of two values. Tock is not concerned by this
+// discussion. It also produces better code than the manual check.
+#![feature(pointer_is_aligned_to)]
 
 use core::fmt::Write;