Noteworthy Changes

• Subscribe and allow operations are no longer handled by capsules themselves, but through the kernel's Grant logic itself (#2906). This change has multiple implications for users of Tock:
  • The Grant type accepts the number of read-only and read-write allow buffers, as well as the number of subscribe upcalls. It will reserve a fixed amount of space per Grant to store the respective allow and subscribe state. Thus, to make efficient use of Grant space, allow buffer and subscribe upcall numbers should be assigned in a non-sparse fashion.
  • Legal allow and subscribe calls can no longer be refused by a capsule. This implies that it is always possible for an application to cause the kernel to relinquish a previously shared buffer through an allow operation. Similarly, subscribe can now be used to infallibly ensure that a given upcall will not be scheduled by the kernel any longer, although already enqueued calls to a given upcall function can still be delivered even after a subscribe operation. The precise semantics around these system calls are described in TRD 104.
• Introduction of a new userspace-readable allow system call, where apps are explicitly allowed to read buffers shared with the kernel (defined in a draft TRD).
• Introduction of a read-only state mechanism to convey information to processes without explicit system calls (#2381).
• Improvements to kernel code size (e.g., #2836, #2849, #2759, #2823).

New HILs

• hasher
• public_key_crypto

New Platforms

• OpenTitan EarlGrey CW310
• Redboard Red-V B
• STM32F429I Discovery development board
• QEMU RISC-V 32-bit "virt" Platform

Deprecated Platforms

• OpenTitan EarlGrey NexysVideo

Known Issues

This release was tagged despite several known bugs in non-tier-1 boards, so as to avoid delaying the release. These include:

• Raspberry Pi Pico: process faults when running IPC examples: https://github.com/tock/tock/issues/3183
• The cortex-m exception handler does not correctly handle all possible exception entry cases. This is not known to currently manifest on any examples, but could with unlucky timing: https://github.com/tock/tock/issues/3109
• STM32F303 Discovery: adc app runs, but eventually hangs in the app (seems to be caught in the exit loop, but not sure why it gets there)
• STM32F303 Discovery: kernel panics lead to only a partial printout of the panic message before the board enters a reboot loop
• weact_f401ccu6: gpio example fails to generate interrupts on the input pin. This board is likely to be deprecated soon anyway, as it is no longer available for sale.

All Merged PRs