Tracking: Make Tock Architecture Agnostic

[bradjc]

Since we only currently support Cortex-M class devices it hasn't been a problem to have cortex-m specific things in the kernel crate. However, our longer terms goals require that the kernel crate be architecture agnositic.

• Remove support/arm.rs from kernel crate (Move some cortex-m specific code to arch/ #962)
• Remove assembly from kernel crate (kernel: remove asm #1029)
• Remove arch specific stack/register handling from process.rs. (Move architecture-dependent syscall code to arch/cortex-m #1113)
  • Template Process across architectures. (Move architecture-dependent syscall code to arch/cortex-m #1113)
    • Remove the static PROCS variable. (Kernel: Move PROCS array to Kernel struct #1111)
• Remove arm register specifics from panic print. (Move architecture-dependent debugging print code to arch/cortex-m #1115)
• Support more generic MPU interface. (New MPU Interface #1159)
• Move SyscallInterface to the Chip trait. (kernel: make user-kernel boundary in Chip #1191)
• Update changelog with new interface(s) after these changes. (Add undocumented changes to the CHANGELOG #1136, Changelog Updates #1194)

[alevy]

/cc @dverhaert

[bradjc]

To get this going I took a first pass stab at what an interface might look like that an architecture needs to implement to support a syscall interface between processes and the kernel:

tock/kernel/src/syscall.rs

Lines 23 to 43 in ea39ca7

	/// This trait must be implemented by the architecture of the chip Tock is
	/// running on. It allows the kernel to manage processes in an
	/// architecture-agnostic manner.
	pub trait SyscallInterface {
	/// Allows the kernel to query the architecture to see if a syscall occurred
	/// for the currently running process.
	fn get_syscall_fired(&self) -> bool;
	/// Get the syscall that the process called.
	fn get_syscall_number(&self, stack_pointer: *const u8) -> Option<Syscall>;
	/// Get the four u32 values that the process can pass with the syscall.
	fn get_syscall_data(&self, stack_pointer: *const u8) -> (u32, u32, u32, u32);
	/// Replace the last stack frame with the new function call. This function
	/// is what should be executed when the process is resumed.
	fn replace_function_call(&self, stack_pointer: *const u8, callback: FunctionCall);
	/// Context switch to a specific process.
	fn switch_to_process(&self, stack_pointer: *const u8) -> *mut u8;
	}

Please comment or add commits as needed. My goal was not to copy the exact interface we are using now. There is also this issue of the stored_regs that I'm not sure how to handle.

[ppannuto]

This motivated me to resurrect a branch I had lying around towards a Tock native port ( https://github.com/tock/tock/tree/native-port ) -- its fairly immature (currently it'll get as far as segfaulting when it tries to panic from the first of many unimplemented!'s that it hits), but it compiles a native binary! Which is a start.

[Update: Now it'll make it as far a unimplemented! when the kernel tries to go to sleep]

I'll try to see what implementing this interface for a non-MCU case looks like, which hopefully will be a good stress test of its flexibility.

[bradjc]

I got started on this on the https://github.com/tock/tock/tree/arch-agnostic2 branch that builds off of the change to add a Kernel struct.

From what I posted before:

• I merged the APP_FAULT and SYSCALL_FIRED global usize values and instead used two bits of a single variable. This makes the logic cleaner.
• I had to add a set_syscall_return_value() function to the interface.

[bradjc]

Each process needs a way to keep around architecture-dependent state when that process is not running (for cortex-m we save a bunch of registers). This means the Process struct must be templated across architectures, but doing that makes the static PROCS array pointer hard (impossible?) to define. Therefore, this is blocked on removing the PROCS static variable in process.rs.

[bradjc]

Templating Process across architectures means process looks like:

pub struct Process<'a, S: SyscallInterface> { ... }

and since the Kernel struct has to hold it, that looks like:

/// Main object for the kernel. Each board will need to create one.
pub struct Kernel<S: SyscallInterface> {
    /// How many "to-do" items exist at any given time. These include
    /// outstanding callbacks and processes in the Running state.
    work: Cell<usize>,
    /// This holds a pointer to the static array of Process pointers.
    processes: &'static [Option<&'static mut Process<'static, S>>],
}

but now anything that holds a kernel pointer must also have that template, which is fine except that AppId or Callback needs a &kernel so that a capsule can schedule a callback for a process. Right now that means AppId looks like:

/// Userspace app identifier.
#[derive(Clone, Copy)]
pub struct AppId<S> {
    kernel: &'static Kernel<S>,
    idx: usize,
}

The issue becomes that AppId is in the Driver interface. Which means that Driver would also need to be templated as well, and at that point it seems kind of ridiculous. Why should every capsule that wants to provide a Driver interface also be templated across architectures?

Is there a way to avoid this? Maybe some rust trick or some way to structure this that isn't popping into my head?

[phil-levis]

Each process needs a way to keep around architecture-dependent state when that process is not running (for cortex-m we save a bunch of registers). This means the Process struct must be templated across architectures, but doing that makes the static PROCS array pointer hard (impossible?) to define.

This is also true for MPUs -- each process will need to store state on how to restore the MPU when it's switched in. That state is chip-specific (e.g., the state kept for the K66 MPU is different than the standard CortexM MPU).

[bradjc]

Should we move the KernelUserlandBoundary into the Chip? We would end up with something like:

tock/kernel/src/platform/mod.rs

Lines 19 to 33 in a2c3347

	pub trait Chip {
	type MPU: mpu::MPU;
	type UserspaceKernelBoundary: syscall::UserspaceKernelBoundary;
	type SysTick: systick::SysTick;
	fn service_pending_interrupts(&self);
	fn has_pending_interrupts(&self) -> bool;
	fn mpu(&self) -> &Self::MPU;
	fn systick(&self) -> &Self::SysTick;
	fn userspace_kernel_boundary(&self) -> &Self::UserspaceKernelBoundary;
	fn sleep(&self);
	unsafe fn atomic<F, R>(&self, f: F) -> R
	where
	F: FnOnce() -> R;
	}

I think this is cleaner, as there is really no reason the board file should have to pick a chip and an arch.

This board file then looks like:

tock/boards/hail/src/main.rs

Lines 591 to 601 in a2c3347

	kernel::procs::load_processes(
	board_kernel,
	chip,
	&_sapps as *const u8,
	&mut APP_MEMORY,
	&mut PROCESSES,
	FAULT_RESPONSE,
	&process_management_capability,
	);
	board_kernel.kernel_loop(&hail, chip, Some(&hail.ipc), &main_loop_capability);
	}

The full implementation is here: https://github.com/tock/tock/compare/new-mpu-new-chip?expand=1

[bradjc]

Ok! For the first pass this is done. We have to actually try to use Tock on a new architecture to really evaluate this, but all of the goals for this issue have been met.