this is a fairly major re-org of where key constants go that
define platform features. things that were in xous-rs that were
platform specific (namely precursor) were moved into a boards file,
and things that are generic to the system (like PAGE_SIZE) are moved
to a public location in xous-rs::arch.
this is probably the most significant source of consternation but
also this code path has been fairly well-trodden.
That being said it might be worth considering if there is any
way to use some of the new Rust const based reasoning logic
to see if we can't tighten this up someday, but today is not
that day.
So in Rust 1.83, we now get a strongly worded warning telling
us to really, really don't use static muts. They aren't wrong,
except that in some places like the kernel we have few options:
we are conjuring pointers out of thin air, creating memory mappings,
and then doing things with them that are hard for the compiler
to reason about.
I think the newly minted warning was made because the intention
is that we could use the new fancy `const` semantics to take
the place of static mut usage by wrapping things in UnsafeCell,
and I think maaaaybe in some
cases this could apply here, but as a simple example a dive
into the kernel debug UART indicates that to initialize the
shared variable we have to allocate pages in the page table,
which involves calling the memory manager and doing some
decidedly non-const type of things. So one option is we could
just push the debug UART initialization into the loader and
paper over the whole thing by pretending it's static.
Instead of that, we adopt a pattern of casting all our static
muts to a raw pointer, and then back into what we want. The
cast to raw pointer is like an "uber unsafe" marker that says
"no we really mean that this pointer is where it is and we
conjured it out of thin air and we promise that the behavior
is defined and values are representable, etc.".
In general we're fairly judicious about the use of static
mut in the kernel, and when in the kernel there's no thread
pre-emption (although we could take an interrupt or page
fault) so generally we are single-threaded. The trickiest
spots are when we have to take a page fault while handling
a page fault (for example, allocating a new L1 page table
entry would require something like this) but this code path
is fairly carefully vetted.
So instead of just doing a global lint silence, we use an
`&raw` idiom to call out the fact that we're doing something
naughty wherever we do it, which makes the compiler "happy"
(for now) while still making the code ugly enough that it
looks sufficiently scary and you have to apply some
cognitive burden to even reason about what's going on,
which I *think* is the intention of Rust in this case.
Basically you get a get out of jail free card but you can't
simply wear it on a lanyard and pass through the gate -- every
time we need to use it, we have to do a little dance and
wash ourselves in the waters of unsafety and recite the
mantras about defined behavior, representable numbers, thread
safety, etc.
not doing a reformat of the entire project to match
nightly formatting changes, but capturing the published
crates so we can maybe save a version bump later on to get
the project clean.
We no longer send messages to the swapper via the server interface.
All calls go through the blocking handler; in general, there are
no scenarios where it makes sense to have a swapper operation
pre-emptable. We always want our swapper ops to complete quickly,
deterministically, and atomically.
I think it's more Xous-y to punt to userland in the case that
no consecutive memory is found, rather than trying to implement
an evictor in the kernel itself.
For now, the blunt hammer we use is to simply request some
blocks be freed and we retry; this works well enough to find
blocks of a few pages in sequence. If we needed larger blocks,
we may want to consider modifying the swapper userland algorithm
to have some API for finding consecutive runs of non-wired
memory to swap out.
"Device RAM" is a block of RAM whose physical address is not
important, but the block must be consecutively allocated in
physical address space.
This is used to allocate blocks of memory that are intended
for hardware DMA targets and other peripheral shared-memory
applications.
Note that this also marks the allocated block as "wired", so
it can't be swapped out.
apply the same techniques in the loader key generator to
the kernel TRNG. Every pull of data from the kernel reseeds
the TRNG state as well. This makes server ID creation somewhat
more expensive, but should greatly improve the security of
the system in the case of a TRNG with occassional drop-outs.
Shoot for 256 bits minimum entropy in the seed pool, gives us
some safety margin over our required 128.
note that the pool only gets more entropy over time, as every
call to the pool folds more entropy in (roughly 2 bits per call).
