This is the weirdest damn thing. All the crates say 0.4.19 as
the chrono version, but the actual version in the lockfile
is 0.4.33. And there isn't an error about it?
Anyways, this update the pins to reflect what's in the lockfile.
Mark `MemoryRange::as_slice()` and `MemoryRange::as_slice_mut()` as
unsafe.
This is due to the fact that not all representable types can be cast to
an arbitrary value. For example, if Process A sends random values to
Process B, then Process B casts the memory to a slice of `bool`, then
any values that are not 0 or 1 are undefined.
Because these functions can leak UB into the program, they are marked as
unsafe.
This patch adds `unsafe {}` blocks to all instances where this function
is called. Additionally, all instances have been checked to verify that
they do not cast to any invalid types -- most use `u8` or `u32`.
Additionally, the long-deprecated `MemoryRange::from_parts()` call was
removed, since that causes UB without being marked as unsafe.
Signed-off-by: Sean Cross <sean@xobs.io>
This change is made with the intention of making the xous-rs crate a bit
more freestanding without depending on the xtask build system.
Signed-off-by: Jean-Pierre De Jesus DIAZ <me@jeandudey.tech>
- make the "base" field no longer public. It is accessible, but only
through an `unsafe` method, because, it is unsafe.
- add accessors to offest/mask fields. Because, it's not at all
unsafe to access these, and it can be useful for bit-ops that are
not part of the generic set of UTRA.
- add Arc to AtomicCSR, and require `std` for AtomicCSR types.
This should not break anything, I checked inside @foundation-devices
keyOS and they don't seem to be using AtomicCSR anywhere.
The Arc makes it a bit safer to clone the AtomicCSR base pointer
and share it between threads, but it will have an impact on performance.
The USB stack (which requires AtomicCSR) was regression testing and the
impact seems minimal.
Recall that the main purpose of AtomicCSR is to provide a CSR accessor
that does not require a mutable reference to the base object. This
can make certain Rust idioms a bit cleaner. We wrap the base accessor
in Arc+Atomic to try and improve the safety of throwing the borrow
checker under the bus, but it's still not perfect because hardware
mutable state can have side-effects within hardware itself that cannot
be modeled or checked by Rust's borrow checker.
Time services are moved into the DNS crate so that the EC
update thread can remain running and consuming resources.
The problem is that we are out of connections in the connection table
(it's limited to 32 total), and in order to allow a "force update"
function for the EC we need to hold on to more connections than
are possible.
The "time" service is fairly self contained and could be moved
elsewhere. It sort of logically fit in the status crate initially
because the status crate manages preferences and displays the
current time on the screen, but it's modular enough that we could
put the service in any process space, at a minor trade-off of
the time UX function being public. This was avoided for a long
time because it could be a security risk but in the end the records
that store time zone and offsets are in the PDDB, which are accessible
to anyone who knows the names of these records, which is in the end
equivalent to knowing the name of the time UX server.
Thus the time UX server was made a dynamically registered "public"
server with just one connection (so only a minor downgrade in security,
the only vector exists in between boot and when the time servers
connect up), and the time server itself was slotted into the DNS
server's process space.
The DNS server was chosen because the DNS service itself is
very lightweight and will be unlikely to grow any heavier, so there
is little risk in merging the time service into the DNS crate's
process connection allocation.
