avr/bootloader
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

audit: the port's pass — the scan that could not walk, and the drift a generator ends

Browse Source 
--scan's walk was unwalkable on POSIX: probe rates have no termios
B-constant, so the first off-nominal probe raised out of the loop. The port
speaks termios2 BOTHER now (red-proven on a pty at 9984 Bd), the probe's
open lives inside the walk's error handling, an fd no longer leaks on an
unmakeable rate, and the swallowed unknown-signature reply is named at
timeout instead of reported as silence. CMakePresets.json's generator emits
the submodule toolchain path it had drifted from — a hand edit on a
generated file, exactly the class rule 10 exists for — and presets.generated
gates the pair from here on (the  marker CMake rejects at the
presets root stayed out; the check is the guard). The over-slot image guard
the tsb runner gained reaches the pureboot runner too; the GPIO bridge's
delivery comment states the hardware truth (RXC at the stop bit's sampling
point); the hardware suite gains the scan check — the one place the rate
physics is real; and the libavr pin advances over both audit rounds.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
BlackMark
2026-07-28 10:12:17 +02:00
parent 1b18f10f4e
commit 7716e1e291
8 changed files with 193 additions and 53 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
test/pureboot_device.c
View File

@@ -193,10 +193,11 @@ static avr_cycle_count_t tx_sample(avr_t *mcu, avr_cycle_count_t when, void *par
tx_shift = (uint8_t)((tx_shift >> 1) | (tx_level ? 0x80 : 0));
if (++tx_bit < 8)
return when + bit_cycles;
/* The byte is not delivered until its stop bit has passed. A real
* receiver cannot answer sooner, and a host that did would put its
* start bit on the wire while the device is still driving the stop
* bit — which the device, transmitting, is not watching for. */
/* The byte is delivered at the stop bit's sampling point (9.5 bit
* times), where a hardware receiver raises its RXC — not sooner: a
* host answering before the stop bit would put its start bit on the
* wire while the device is still driving, which the device,
* transmitting, is not watching for. */
return when + bit_cycles;
}
if (write(pty_master, &tx_shift, 1) != 1)
@@ -412,6 +413,14 @@ int main(int argc, char *argv[])
fprintf(stderr, "device: cannot read %s\n", argv[1]);
return 1;
}
// An image past flash end would smash the simulator's heap and turn
// into phantom peripheral behavior (lessons: believe the size gate
// first) — refuse it loudly instead.
if (base + fw.flashsize > avr->flashend + 1) {
fprintf(stderr, "device: %u B at 0x%x runs past flash end 0x%x — image does not fit its slot\n",
(unsigned)fw.flashsize, base, avr->flashend);
return 1;
}
memcpy(avr->flash + base, fw.flash, fw.flashsize);
}
// The boot-sectioned megas enter the loader in hardware (BOOTRST, not