Do buffers which are used by capsules need to be declared static?

[potto216]

I wrote a UDP example which works by creating buffers on the stack that are passed to the UDP capsule. I was able to verify the code successfully ran. However, I recently read in the docs that all buffers passed to capsules must be static. Since my buffers were not declared with static does this mean I got lucky or was I misunderstanding the documentation? Since some of the buffers are mutable I didn't want to use static and be forced to use the unsafe keyword.

[jrvanwhy]

However, I recently read in the docs that all buffers passed to capsules must be static.

What docs are you referring to?

[potto216]

This section under 3.3 How do capsules get created?

Also in the book "Getting Started with Secure Embedded Systems—Developing IoT Systems for micro:bit and Raspberry Pi Pico Using Rust and Tock" in chapter 4 the section "Buffer Lifetimes" says
"The most important difference between Tock and other embedded operating systems is that the kernel does not use any heap. All the used memory has to be statically allocated. From the programming language’s point of view, this means that all the used buffers must have a ‘static lifetime. Whenever the kernel or a capsule requires a buffer, its lifetime has to be ‘static."

Thanks!

[jrvanwhy]

Both of those are referring to buffers internal to the kernel. That does not apply to buffers shared with capsules by userspace processes, which may have shorter lifetimes.

[potto216]

Oh I see. So in libtock-c the udp tx/rx buffers passed to the UDP capsule are global i.e. static unsigned char BUF_BIND_CFG[2 * sizeof(sock_addr_t)];, but this is design decision for the user level code, not a requirement for the capsule?

Also not to get to far off the topic of this question, but my understanding is that when the process passes a buffer to a capsule it is not allowed to use it again until an unallow is issued. However in the libtock-c udp bind function it has

  allow_rw_return_t aval = allow_readwrite(UDP_DRIVER, ALLOW_RX_CFG, (void *) buf_bind_cfg, 2 * bytes);
  if (!aval.success) return tock_status_to_returncode(aval.status);

  memcpy(buf_bind_cfg + bytes, &(handle->addr), bytes);

and allow_readwrite doesn't call unallow before the user level process writes to buf_bind_cfg

[hudson-ayers]

Correct, the capsule does not require the buffers to be static, it is just simpler to write that way in libtock-c. Otherwise you have to manually ensure that the buffer is unallowed from the kernel before it goes out of scope in the application. libtock-rs has machinery that ensures that for you as part of its scope mechanics.

You are also correct that the libtock-c UDP file is violating the recommendations regarding writing to allowed buffers and should be updated to not do that