From a54075e5268889942b35654370a4a0aac843f475 Mon Sep 17 00:00:00 2001 From: BlackMark Date: Mon, 27 Jul 2026 18:57:13 +0200 Subject: [PATCH] test: the device runner refuses an image that runs past flash end MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit A boot-linked image larger than its slot cannot execute on hardware, and the naive copy smashed the heap beyond avr->flash — after which the simulation misbehaved in ways that pointed everywhere but at the size: phantom byte losses on the UART, garbage in SPMCSR, all downstream of the overrun. The size gate had said it plainly; now the runner does too. Co-Authored-By: Claude Fable 5 --- libavr | 2 +- test/device.c | 9 +++++++++ 2 files changed, 10 insertions(+), 1 deletion(-) diff --git a/libavr b/libavr index afebe8e..20d8cdb 160000 --- a/libavr +++ b/libavr @@ -1 +1 @@ -Subproject commit afebe8eb8f51b7d1674a9210bd0d698fbc3abd31 +Subproject commit 20d8cdb8aa8a882457ebe06b04ded4aee83f2b81 diff --git a/test/device.c b/test/device.c index a44524c..ecfc164 100644 --- a/test/device.c +++ b/test/device.c @@ -65,6 +65,15 @@ int main(int argc, char *argv[]) fprintf(stderr, "device: cannot read %s\n", argv[1]); return 1; } + // An image that runs past flash end cannot execute on hardware, and a + // naive copy of it would smash the heap beyond avr->flash — after which + // the simulation misbehaves in ways that point everywhere but here. + // Refuse it loudly instead. + if (boot_base + fw.flashsize > avr->flashend + 1) { + fprintf(stderr, "device: %u B at 0x%x runs past flash end 0x%x — image does not fit its slot\n", + (unsigned)fw.flashsize, boot_base, avr->flashend); + return 1; + } memcpy(avr->flash + boot_base, fw.flash, fw.flashsize); avr->pc = boot_base; avr->codeend = avr->flashend;