Skip to content

Introduce Kernel Partitioning#419

Open
etiaro wants to merge 5 commits intofeature/partitioningfrom
etiaro/partitioning
Open

Introduce Kernel Partitioning#419
etiaro wants to merge 5 commits intofeature/partitioningfrom
etiaro/partitioning

Conversation

@etiaro
Copy link

@etiaro etiaro commented Mar 6, 2026

Description

Add loader-side support for kernel partitioning.

Key changes:

  • Introduce part command for creating partitions with configurable memory maps (allocable and accessible) and flags (e.g. IPC permission)
  • Introduce sched command for scheduler temporal windows configuration
  • Rework mpu command to show per-app MPU configuration
  • Move MPU configuration originally somewhat dynamicly created inside kernel to plo-created syspage_part_t
  • Add optional partition name argument to app command
    backward-compatible partition is created by default for each app.

Motivation and Context

This is the companion change to the kernel partitioning support. Currently system configuration mechanisms are based on plo-scripts, so partitioning configuration follows that convetion.

Types of changes

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to change)
  • Chore (refactoring, style fixes, git/CI config, submodule management, no code logic changes)

How Has This Been Tested?

  • Already covered by automatic testing.
  • New test added: (add PR link here).
  • Tested by hand on: (list targets here).

Checklist:

  • My change requires a change to the documentation.
  • I have updated the documentation accordingly.
  • I have added tests to cover my changes.
  • All new and existing linter checks and tests passed.
  • My changes generate no new compilation warnings for any of the targets.

Special treatment

  • This PR needs additional PRs to work (list the PRs, preferably in merge-order).
  • I will merge this PR by myself when appropriate.

@gemini-code-assist
Copy link

Summary of Changes

Hello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request introduces a fundamental change to the kernel's memory and resource management by implementing kernel partitioning. This new capability allows for the creation of isolated execution environments, enhancing system robustness and security by strictly controlling memory access and scheduling for different applications. The changes include new commands for partition and scheduler window management, alongside significant updates to the underlying HAL and syspage structures to support this new architecture.

Highlights

  • Kernel Partitioning Introduction: Introduced the concept of kernel partitioning, allowing applications to be assigned to specific memory partitions with defined access rights and resource limits.
  • New part Command: Added a new command-line utility part to create and configure kernel partitions, specifying allocation maps, access maps, scheduler windows, and memory limits.
  • New sched Command: Implemented a new command-line utility sched for configuring scheduler windows, enabling time-sliced scheduling for different partitions.
  • MPU Configuration Refactoring: Refactored the Memory Protection Unit (MPU) configuration logic across various hardware abstraction layers (HALs) to support per-partition MPU settings, ensuring memory isolation for applications within their assigned partitions.
  • Application Loading with Partitions: Modified the app command to allow specifying a target partition when loading an application, integrating the new partitioning mechanism into application deployment.
Changelog
  • cmds/Makefile
    • Added 'part' and 'sched' to the list of available commands.
  • cmds/app.c
    • Introduced cmd_partitionCreate to dynamically create new kernel partitions.
    • Modified cmd_appLoad to accept an optional partition name, allowing applications to be loaded into specific partitions.
    • Updated cmd_app to parse the new partition argument and pass it to cmd_appLoad.
  • cmds/mpu.c
    • Refactored cmd_mpu to display MPU region information on a per-partition basis, rather than a global view.
    • Updated cmd_mpuInfo to reflect the new usage for displaying MPU regions by program name.
  • cmds/part.c
    • Added a new command part for creating kernel partitions.
    • Implemented functions cmd_mapsAdd2Part, cmd_schedWindowAdd2Part, and cmd_listParse to handle argument parsing and data population for partition creation.
  • cmds/sched.c
    • Added a new command sched for configuring scheduler windows.
    • Implemented cmd_listParse to process scheduler window duration lists.
  • hal/aarch64/zynqmp/hal.c
    • Renamed hal_memoryAddMap to hal_getPartData and updated its function signature.
  • hal/armv7a/imx6ull/hal.c
    • Renamed hal_memoryAddMap to hal_getPartData and updated its function signature.
  • hal/armv7a/zynq7000/hal.c
    • Renamed hal_memoryAddMap to hal_getPartData and updated its function signature.
  • hal/armv7m/imxrt/hal.c
    • Renamed hal_memoryAddMap to hal_getPartData and updated its function signature.
    • Added a call to mpu_kernelEntryPoint to set the kernel's entry point for MPU configuration.
  • hal/armv7m/mpu.c
    • Refactored MPU region management to operate on a per-partition basis, removing global MPU common structures.
    • Introduced mpu_kernelEntryPoint to store the kernel's entry point for MPU configuration.
    • Added mpu_getHalPartData to populate MPU data for a specific partition.
    • Modified mpu_regionSet, mpu_checkOverlap, mpu_regionCalculateAndSet, mpu_regionGenerate, mpu_regionInvalidate, and mpu_regionAssignMap to accept a hal_syspage_part_t argument.
    • Implemented mpu_isMapAlloced and mpu_mapsAlloc for managing map allocations within partitions.
    • Added mpu_allocKernelMap to ensure kernel code maps are allocated for each partition.
  • hal/armv7m/mpu.h
    • Removed old mpu_region_t and mpu_common_t structures.
    • Added declarations for mpu_getMaxRegionsCount, mpu_kernelEntryPoint, and mpu_getHalPartData.
  • hal/armv7m/stm32/hal.c
    • Renamed hal_memoryAddMap to hal_getPartData and updated its function signature.
    • Added a call to mpu_kernelEntryPoint to set the kernel's entry point for MPU configuration.
  • hal/armv7r/mpu.c
    • Refactored MPU region management to operate on a per-partition basis, removing global MPU common structures.
    • Introduced mpu_kernelEntryPoint to store the kernel's entry point for MPU configuration.
    • Added mpu_getHalPartData to populate MPU data for a specific partition.
    • Modified mpu_regionSet, mpu_checkOverlap, mpu_regionCalculateAndSet, mpu_regionGenerate, mpu_regionInvalidate, and mpu_regionAssignMap to accept a hal_syspage_part_t argument.
    • Implemented mpu_isMapAlloced and mpu_mapsAlloc for managing map allocations within partitions.
    • Added mpu_allocKernelMap to ensure kernel code maps are allocated for each partition.
  • hal/armv7r/mpu.h
    • Removed old mpu_region_t and mpu_common_t structures.
    • Added declarations for mpu_getMaxRegionsCount, mpu_kernelEntryPoint, and mpu_getHalPartData.
  • hal/armv7r/tda4vm/hal.c
    • Renamed hal_memoryAddMap to hal_getPartData and updated its function signature.
    • Added a call to mpu_kernelEntryPoint to set the kernel's entry point for MPU configuration.
  • hal/armv7r/zynqmp/hal.c
    • Renamed hal_memoryAddMap to hal_getPartData and updated its function signature.
    • Added a call to mpu_kernelEntryPoint to set the kernel's entry point for MPU configuration.
  • hal/armv8m/mcx/hal.c
    • Renamed hal_memoryAddMap to hal_getPartData and updated its function signature.
    • Added a call to mpu_kernelEntryPoint to set the kernel's entry point for MPU configuration.
  • hal/armv8m/mcx/n94x/Makefile
    • Removed mpu from the PLO_COMMANDS list.
  • hal/armv8m/mpu.c
    • Refactored MPU region management to operate on a per-partition basis, removing global MPU common structures.
    • Introduced mpu_kernelEntryPoint to store the kernel's entry point for MPU configuration.
    • Added mpu_getHalPartData to populate MPU data for a specific partition.
    • Modified mpu_regionSet, mpu_regionInvalidate to accept a hal_syspage_part_t argument.
    • Implemented mpu_isMapAlloced and mpu_mapsAlloc for managing map allocations within partitions.
    • Added mpu_allocKernelMap to ensure kernel code maps are allocated for each partition.
  • hal/armv8m/mpu.h
    • Removed old mpu_region_t and mpu_common_t structures and MPU base/max region definitions.
    • Added declarations for mpu_kernelEntryPoint, mpu_getHalData, and mpu_getHalPartData.
  • hal/armv8m/nrf/hal.c
    • Renamed hal_memoryAddMap to hal_getPartData and updated its function signature.
    • Added a call to mpu_kernelEntryPoint to set the kernel's entry point for MPU configuration.
  • hal/armv8m/stm32/hal.c
    • Renamed hal_memoryAddMap to hal_getPartData and updated its function signature.
    • Added a call to mpu_kernelEntryPoint to set the kernel's entry point for MPU configuration.
  • hal/armv8r/mps3an536/hal.c
    • Renamed hal_memoryAddMap to hal_getPartData and updated its function signature.
  • hal/hal.h
    • Updated the declaration of hal_memoryAddMap to hal_getPartData with a new signature to support partition-specific data.
  • hal/ia32/memory.c
    • Renamed hal_memoryAddMap to hal_getPartData and updated its function signature.
  • hal/riscv64/gaisler/hal.c
    • Renamed hal_memoryAddMap to hal_getPartData and updated its function signature.
  • hal/riscv64/generic/hal.c
    • Renamed hal_memoryAddMap to hal_getPartData and updated its function signature.
  • hal/sparcv8leon/gaisler/generic/hal.c
    • Renamed hal_memoryAddMap to hal_getPartData and updated its function signature.
  • hal/sparcv8leon/gaisler/gr712rc/hal.c
    • Renamed hal_memoryAddMap to hal_getPartData and updated its function signature.
  • hal/sparcv8leon/gaisler/gr716/hal.c
    • Renamed hal_memoryAddMap to hal_getPartData and updated its function signature.
  • hal/sparcv8leon/gaisler/gr740/hal.c
    • Renamed hal_memoryAddMap to hal_getPartData and updated its function signature.
  • syspage.c
    • Initialized syspage_common.syspage->partitions and syspage_common.syspage->schedWindows to NULL.
    • Added initialization for a background scheduler window during syspage_init.
    • Removed the direct call to hal_memoryAddMap from syspage_mapAdd.
    • Implemented syspage_mapAddrResolve to find a map name based on an address.
    • Added syspage_schedWindowAdd and syspage_schedulerWindowCount for managing scheduler windows.
    • Implemented syspage_partAdd, syspage_partResolve, and syspage_partsGet for managing kernel partitions.
  • syspage.h
    • Added declarations for syspage_mapAddrResolve.
    • Added declarations for scheduler window management functions: syspage_schedWindowAdd and syspage_schedulerWindowCount.
    • Added declarations for partition management functions: syspage_partAdd, syspage_partsGet, and syspage_partResolve.
Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature Command Description
Code Review /gemini review Performs a code review for the current pull request in its current state.
Pull Request Summary /gemini summary Provides a summary of the current pull request in its current state.
Comment @gemini-code-assist Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help /gemini help Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Footnotes

  1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution.

Copy link

@gemini-code-assist gemini-code-assist bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request introduces kernel partitioning, a significant architectural change, adding new commands part and sched and updating the app command. The MPU handling is refactored to be per-partition. A high-severity out-of-bounds write vulnerability was identified in the MPU HAL implementations for ARMv7-M and ARMv7-R, where hardware-reported region counts are trusted without validation against software buffer sizes. Furthermore, logic errors in the part command's argument parsing prevent it from functioning correctly when flags are used, and there are minor issues related to documentation and code clarity.

@github-actions
Copy link

github-actions bot commented Mar 6, 2026

Unit Test Results

9 553 tests  +28   8 961 ✅ +28   57m 59s ⏱️ + 5m 33s
  591 suites + 8     592 💤 ± 0 
    1 files   ± 0       0 ❌ ± 0 

Results for commit f7f21ab. ± Comparison against base commit 0747a54.

♻️ This comment has been updated with latest results.

@etiaro etiaro force-pushed the etiaro/partitioning branch from 95269e1 to 3fbe3eb Compare March 9, 2026 11:13
@etiaro etiaro marked this pull request as ready for review March 11, 2026 13:20
@etiaro etiaro requested review from Darchiv and adamgreloch March 11, 2026 13:20
Comment on lines +530 to +540
if (syspage_common.syspage->schedWindows == NULL) {
window->next = window;
window->prev = window;
syspage_common.syspage->schedWindows = window;
}
else {
window->prev = syspage_common.syspage->schedWindows->prev;
syspage_common.syspage->schedWindows->prev->next = window;
window->next = syspage_common.syspage->schedWindows;
syspage_common.syspage->schedWindows->prev = window;
}
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Couldn't you use LIST_ADD from lib/list.h instead? Same in syspage_partAdd()

Copy link
Author

@etiaro etiaro Mar 23, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cannot be used due to packed attribute of syspage_t

This commit introduces loader support for full MPU regions reconfiguration
on context switch, allowing for more flexibile configuration of memory maps
on MPU targets.

Changes include
* MPU configuration during app command, based on hal_syspage_prog_t structure
  with program configuration of MPU regions in form of ready-to-copy register values
* reimplementation of mpu command, showing generated mpu configuration on per-app basis
* passing all maps at once to hal/mpu module, allowing future map merging to reduce
  count of used MPU regions

JIRA: RTOS-1149
@etiaro etiaro force-pushed the etiaro/partitioning branch from 3fbe3eb to 6a769f0 Compare March 24, 2026 10:00
@etiaro etiaro force-pushed the etiaro/partitioning branch from 6a769f0 to c95a845 Compare March 24, 2026 10:03
Introduce part command to create partitions, for now only holding memory
configuration on NOMMU targets. Move MPU configuration from
syspage_prog_t to new syspage_part_t, add allocable and accessible maps
for each partition. For backward compatibility of configuration, by
default app command creates a partition with first dmap being the only
allocable map, and flags allowing IPC to all other partitions and
spawning processes inside other partitions

JIRA: RTOS-1149
@etiaro etiaro force-pushed the etiaro/partitioning branch from c95a845 to d1e0621 Compare March 24, 2026 13:35
etiaro added 3 commits March 25, 2026 15:42
Introduce command for scheduler configuration

JIRA: RTOS-1149
Enable part command to allow for lwip configuration with uncached maps.

JIRA: RTOS-1149
@etiaro etiaro force-pushed the etiaro/partitioning branch from d1e0621 to f7f21ab Compare March 25, 2026 14:47
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants