avr/bootloader
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

build: the libavr pin advances past the audit sweep, and two gates start meaning something

Browse Source 
The pin crosses libavr's phase-6 close and the guideline sweep behind it.
All 37 chips green, 43 tests each, the README size table matching every
built image, and all 13602 flash images byte-identical to the previous pin.

The bump broke one gate and exposed another as ornamental.

`check_unit.cmake` matched the autobaud loader's measured unit by the symbol
`unit_E`; libavr's rule-46 sweep renamed the member to `m_unit`, which the
mangling spells `6m_unitE`. On the RAM-home chips the check went red and said
so. On the GPIOR chips it went green - the branch that asserts the unit is
*not* in RAM passes on an empty match, and an empty match is what a stale
regex returns for every image. Both branches mean something again.

`tools/check.sh` ran the 37-chip loop under `set -e`, so the first red chip
ended the gate and the 36 behind it were never built - a stale size canary on
attiny13 would have been an alibi for every loader after it. It accumulates
now and fails at the end naming every red preset, which is the shape libavr's
own check.sh carries and the reason it carries it.

The port's own sweep, verified by byte identity: the four TSB tiers' 16-byte
info block is `std::to_array` rather than an extent written beside the
sixteen elements the compiler can count, the three-member serial and loader
configs break one member per line, the turn-around loops are braced, and the
test fixture's config pair is a deduced `std::array` (rules 36, 40, 34). Two
comments stop narrating how the code came to be and one stops citing a repro
at a path it left two phases ago (rules 12, 13).

pureboot's identity stamp stays the raw array rule 36 bans, and now says why:
its reads must fold to immediates because the bytes are in program memory and
a formed address is dereferenced as data space. As a `std::array` the read
loop stopped unrolling and emitted exactly that - measured at +8 B and a
wrong answer on the wire.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
BlackMark
2026-08-12 15:05:07 +02:00
parent d3d8d07905
commit be78f38f3f
12 changed files with 78 additions and 49 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
tsb/tsb_asm.cpp
View File

@@ -4,11 +4,11 @@
// The complete TinySafeBoot feature set - watchdog-reset bail, one-wire
// half-duplex UART, a config-page activation timeout, the password gate,
// emergency erase, and config/flash/EEPROM read-write - at 510 bytes in the
// 512-byte BOOTSZ=11 section the hand-written oracle occupies (500 B). This tier used to be one
// monolithic inline-asm routine; it is now the tricks tier's C++ (same
// register protocol, same structure - see tsb_tricks.cpp, including the
// global-register miscompile rules) with exactly two routines kept in
// assembly, the two whose remaining cost *is* the calling convention:
// 512-byte BOOTSZ=11 section the hand-written oracle occupies (500 B). The
// body is the tricks tier's C++ (same register protocol, same structure - see
// tsb_tricks.cpp, including the global-register miscompile rules) with exactly
// two routines kept in assembly, the two whose remaining cost *is* the calling
// convention:
//
// rx the bounded receive: C++ must re-floor the timeout window on every
// call (the global-register-store miscompile) and split it across
@@ -75,7 +75,7 @@ constexpr auto baud = avr::uart::solve_baud(16_MHz, 115200_Bd, 8, avr::uart::par
// The 16-byte device-info block, streamed out on activation.
// clang-format off
[[gnu::progmem]] constexpr std::uint8_t info[16] = {
[[gnu::progmem]] constexpr auto info = std::to_array<std::uint8_t>({
'T', 'S', 'B',
build_date & 0xFF, build_date >> 8,
0xF3, // status: native-UART fixed-baud lineage
@@ -84,7 +84,7 @@ constexpr auto baud = avr::uart::solve_baud(16_MHz, 115200_Bd, 8, avr::uart::par
(app_end / 2) & 0xFF, (app_end / 2) >> 8,
eeprom_end & 0xFF, eeprom_end >> 8,
0xAA, 0xAA,
};
});
// clang-format on
register std::uint16_t g_addr asm("r28");
@@ -141,8 +141,8 @@ const std::uint8_t *flash_ptr(std::uint16_t addr)
if (g_receiving) {
g_receiving = 0;
hw::ucsr0b::write(hw::ucsr0b::txen0(1));
for (std::uint8_t guard = 46; guard; --guard)
;
for (std::uint8_t guard = 46; guard; --guard) {
}
}
hw::udr0::write(byte);
std::uint8_t status;
@@ -300,7 +300,7 @@ extern "C" [[noreturn]] void tsb_app(); // the application's reset vector: --def
std::uint8_t expected = avr::flash_load(flash_ptr(g_addr)) & mask;
++g_addr;
if (expected == 0xff) {
g_addr = reinterpret_cast<std::uint16_t>(&info[0]);
g_addr = reinterpret_cast<std::uint16_t>(info.data());
g_cnt = sizeof(info);
sendf();
break;

12
tsb/tsb_policy.cpp
View File

@@ -35,7 +35,11 @@ using dev = avr::device<{.clock = 16_MHz}>;
// 115200 at 16 MHz lands +2.1 % off, past the receiver-tolerance table the
// solver holds rates to - the oracle's own deployment has run there for a
// decade, so the override states that it is meant.
using serial_t = dev::uart0<{.baud = 115200_Bd, .allow_baud_error = true, .half_duplex = true}>;
using serial_t = dev::uart0<{
.baud = 115200_Bd,
.allow_baud_error = true,
.half_duplex = true,
}>;
inline constexpr serial_t serial{};
namespace tsb {
@@ -74,7 +78,7 @@ constexpr std::uint16_t build_date = 26 * 512 + 7 * 32 + 27;
// The 16-byte device-info block, streamed out on activation.
// clang-format off
[[gnu::progmem]] constexpr std::uint8_t info[16] = {
[[gnu::progmem]] constexpr auto info = std::to_array<std::uint8_t>({
'T', 'S', 'B',
build_date & 0xFF, build_date >> 8,
0xF3, // status: native-UART fixed-baud lineage
@@ -83,7 +87,7 @@ constexpr std::uint16_t build_date = 26 * 512 + 7 * 32 + 27;
(app_end / 2) & 0xFF, (app_end / 2) >> 8, // app-flash boundary, words
eeprom_end & 0xFF, eeprom_end >> 8,
0xAA, 0xAA, // ATmega processor-type marker (bytes 14 == 15)
};
});
// clang-format on
// The receive window, pre-floored where it is set. In .noinit: there is no
@@ -240,7 +244,7 @@ extern "C" [[noreturn]] void tsb_app(); // the application's reset vector: --def
std::uint8_t expected = avr::flash_load(flash_ptr(at)) & mask;
++at;
if (expected == 0xff) {
send_block(false, reinterpret_cast<std::uint16_t>(&info[0]), sizeof info);
send_block(false, reinterpret_cast<std::uint16_t>(info.data()), info.size());
break;
}
std::uint8_t got = rx();

6
tsb/tsb_pure.cpp
View File

@@ -23,7 +23,11 @@ using dev = avr::device<{.clock = 16_MHz}>;
// 115200 at 16 MHz lands +2.1 % off, past the receiver-tolerance table the
// solver holds rates to - the oracle's own deployment has run there for a
// decade, so the override states that it is meant.
using serial_t = dev::uart0<{.baud = 115200_Bd, .allow_baud_error = true, .half_duplex = true}>;
using serial_t = dev::uart0<{
.baud = 115200_Bd,
.allow_baud_error = true,
.half_duplex = true,
}>;
inline constexpr serial_t serial{};
namespace tsb {

12
tsb/tsb_tricks.cpp
View File

@@ -19,7 +19,7 @@
// remaining uses all hide inside callees is deleted whenever a CALL follows it
// before any jump/ret (the backend's liveness walk lumps fixed registers with
// call-clobbered ones - minimal repro in libavr's
// local/scratch/probes/gcc-avr-globalreg-repro.cpp, lessons.md entry). Every
// test/upstream/gcc-avr-globalreg-repro.cpp). Every
// g_* update below therefore sits where a *local* read or a jump/ret follows
// it - the helpers advance g_addr immediately before returning, and rx()
// re-floors the window on every call instead of storing the floored value
@@ -75,7 +75,7 @@ constexpr auto baud = avr::uart::solve_baud(16_MHz, 115200_Bd, 8, avr::uart::par
// The 16-byte device-info block, streamed out on activation.
// clang-format off
[[gnu::progmem]] constexpr std::uint8_t info[16] = {
[[gnu::progmem]] constexpr auto info = std::to_array<std::uint8_t>({
'T', 'S', 'B',
build_date & 0xFF, build_date >> 8,
0xF3, // status: native-UART fixed-baud lineage
@@ -84,7 +84,7 @@ constexpr auto baud = avr::uart::solve_baud(16_MHz, 115200_Bd, 8, avr::uart::par
(app_end / 2) & 0xFF, (app_end / 2) >> 8,
eeprom_end & 0xFF, eeprom_end >> 8,
0xAA, 0xAA,
};
});
// clang-format on
register std::uint16_t g_addr asm("r28");
@@ -134,8 +134,8 @@ const std::uint8_t *flash_ptr(std::uint16_t addr)
if (g_receiving) {
g_receiving = 0;
hw::ucsr0b::write(hw::ucsr0b::txen0(1));
for (std::uint8_t guard = 46; guard; --guard)
;
for (std::uint8_t guard = 46; guard; --guard) {
}
}
hw::udr0::write(byte);
std::uint8_t status;
@@ -279,7 +279,7 @@ extern "C" [[noreturn]] void tsb_app(); // the application's reset vector: --def
std::uint8_t expected = avr::flash_load(flash_ptr(g_addr)) & mask;
++g_addr;
if (expected == 0xff) {
g_addr = reinterpret_cast<std::uint16_t>(&info[0]);
g_addr = reinterpret_cast<std::uint16_t>(info.data());
g_cnt = sizeof(info);
sendf();
break;