From 5102a25d811d936b1a426286784a878d1261191e Mon Sep 17 00:00:00 2001 From: BlackMark Date: Mon, 27 Jul 2026 18:57:13 +0200 Subject: [PATCH] test: the device runner refuses an image that runs past flash end MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit A boot-linked image larger than its slot cannot execute on hardware, and the naive copy smashed the heap beyond avr->flash — after which the simulation misbehaved in ways that pointed everywhere but at the size: phantom byte losses on the UART, garbage in SPMCSR, all downstream of the overrun. The size gate had said it plainly; now the runner does too. Co-Authored-By: Claude Fable 5 --- test/device.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/test/device.c b/test/device.c index a44524c..ecfc164 100644 --- a/test/device.c +++ b/test/device.c @@ -65,6 +65,15 @@ int main(int argc, char *argv[]) fprintf(stderr, "device: cannot read %s\n", argv[1]); return 1; } + // An image that runs past flash end cannot execute on hardware, and a + // naive copy of it would smash the heap beyond avr->flash — after which + // the simulation misbehaves in ways that point everywhere but here. + // Refuse it loudly instead. + if (boot_base + fw.flashsize > avr->flashend + 1) { + fprintf(stderr, "device: %u B at 0x%x runs past flash end 0x%x — image does not fit its slot\n", + (unsigned)fw.flashsize, boot_base, avr->flashend); + return 1; + } memcpy(avr->flash + boot_base, fw.flash, fw.flashsize); avr->pc = boot_base; avr->codeend = avr->flashend;