Skip to content

boards/lm3s6965-ek: Make the protected configuration fit the part. - #19837

Open
casaroli wants to merge 2 commits into
apache:masterfrom
casaroli:lm3s6965-protected-fit
Open

boards/lm3s6965-ek: Make the protected configuration fit the part.#19837
casaroli wants to merge 2 commits into
apache:masterfrom
casaroli:lm3s6965-protected-fit

Conversation

@casaroli

Copy link
Copy Markdown
Contributor

Summary

lm3s6965-ek:qemu-protected does not fit the part any more. The kernel image is 132456 bytes and the user image is 130668 bytes, which is 1308 bytes more than the 256 KiB of flash on the LM3S6965, so the kernel .data initialiser runs 1384 bytes into 0x00020000, where the user image is programmed.

Nothing reported this. memory.ld splits the flash in two halves and bounds the user link, but ARCHSCRIPT selected ld.script, which declares the whole flash as one region, so nothing held the kernel to its half.

This PR makes the configuration fit and makes the boundary enforceable. It removes what QEMU cannot use, and what other configurations of this board already cover: MMC/SD over SPI with SSI0, because the QEMU model has no SSI; semihosting hostfs; the GPIO interrupt ports, which no driver here uses; and the wget example with its web client. It then links the protected kernel against kflash, so a kernel that does not fit is a link error.

The result, measured with arm-none-eabi-gcc 14.2.rel1: kernel 132456 -> 124580 bytes, user image 130668 -> 125500 bytes. Each 128 KiB half now has more than 5 KiB free.

The split itself stays at 128 KiB / 128 KiB. The ARMv7-M MPU maps the user flash as one power-of-two region with eight sub-regions, and mpu_subregion_ls() rounds the offset down to the sub-region grid, so a boundary off that grid would give user code read and execute access to the end of the kernel flash.

apache/nuttx-apps#3685 needs this room: it builds testing/ostest/vfork.c wherever ARCH_HAVE_VFORK is set, and that is 328 bytes the user half does not have today.

Impact

Board lm3s6965-ek only. qemu-protected loses the MMC/SD driver, hostfs and wget; the nsh, discover and qemu-flat configurations of the same board still build the MMC/SD driver. qemu-kostest, the other protected configuration of this board, is unchanged. Flat configurations still link against ld.script.

Testing

Host: macOS 15.5 on Apple Silicon, arm-none-eabi-gcc 14.2.rel1.

Built lm3s6965-ek:qemu-protected, lm3s6965-ek:qemu-kostest and lm3s6965-ek:qemu-flat, each from make distclean.

Sizes of qemu-protected before and after, from readelf -lW:

before  kernel  0x00000000..0x00020568   132456 B   1384 B past the 128 KiB half
        user    0x00020000..0x0003fe6c   130668 B    404 B free
after   kernel  0x00000000..0x0001e8a4   124580 B   6492 B free
        user    0x00020000..0x0003ea3c   125500 B   5572 B free

With this branch, qemu-protected also builds against apache/nuttx-apps#3685, which fails against master with region uflash overflowed by 128 bytes.

To show that the new kernel bound works, a build with kflash set to 120 KiB reports the overflow instead of silently crossing the boundary:

arm-none-eabi-ld: nuttx section `.text' will not fit in region `kflash'
arm-none-eabi-ld: region `kflash' overflowed by 2212 bytes

The protected build gives the kernel the first 128 KiB of flash and the
user image the second.  Both halves were full.  The kernel image was
132456 bytes and the user image 130668, which is 1308 bytes more than
the 256 KiB the LM3S6965 has.  The two images overlapped.

Remove from the configuration what QEMU cannot use, and what other
configurations of this board already cover:  MMC/SD over SPI with SSI0,
because the QEMU model has no SSI; semihosting hostfs; the GPIO
interrupt ports, which no driver in this configuration uses; and the
wget example with its web client.

The kernel image is now 124580 bytes and the user image 125500.  Each
half has more than 5 KiB free.

Assisted-by: Claude Code:claude-opus-5
Signed-off-by: Marco Casaroli <marco.casaroli@gmail.com>
In a protected build the kernel must stay in the flash half that
memory.ld gives it.  ARCHSCRIPT selected ld.script, which declares the
whole 256 KiB of flash as one region, so nothing held the kernel to its
half.  The kernel image grew past the boundary unseen:  its .data
initialiser ran 1384 bytes into 0x00020000, where the user image is
programmed.

Select memory.ld and kernel-space.ld when CONFIG_BUILD_PROTECTED is set.
The link now fails when the kernel does not fit.

Assisted-by: Claude Code:claude-opus-5
Signed-off-by: Marco Casaroli <marco.casaroli@gmail.com>
@github-actions

Copy link
Copy Markdown

MemBrowse Memory Report

No memory changes detected for:

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Board: arm Size: S The size of the change in this PR is small

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants