Skip to content

Commit be2ec6a

Browse files
nashifteburd
authored andcommitted
tests: drivers: reset: mmio: keep the fake registers out of kernel RAM
The qemu_cortex_m3 overlay placed the fake reset-mmio registers at 0x20000004/0x20000008, inside the SRAM the kernel links into. The words they occupy are owned by whatever .data the linker places at the start of RAM, so every write through the reset driver corrupts live kernel state, and the test only ever passed by layout luck. A recent timer-core change added an 8-byte .data variable that landed at 0x20000000, which pushed libc's _char_out console output function pointer to exactly 0x20000008: the active-low test case then wrote its register patterns over the pointer, console output jumped through the corrupted value into a HardFault, the fault handler's own print re-took the fault, and QEMU stopped with "Lockup: can't escalate 3 to HardFault". Any future .data layout change could break this test the same way. Shrink the kernel's view of the 64 KiB SRAM by one KiB in the overlay and move the fake registers into the carved-out tail, so no linker layout can ever place kernel data under them. Assisted by Claude (claude-opus-4-8). Signed-off-by: Anas Nashif <anas.nashif@intel.com>
1 parent 4f6aebf commit be2ec6a

1 file changed

Lines changed: 22 additions & 4 deletions

File tree

tests/drivers/reset/mmio/boards/qemu_cortex_m3.overlay

Lines changed: 22 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,31 @@
1+
/*
2+
* Copyright (c) 2025 Google LLC.
3+
*
4+
* SPDX-License-Identifier: Apache-2.0
5+
*/
6+
7+
/*
8+
* The fake reset registers below are backed by plain SRAM, so the words
9+
* they occupy must not be part of the RAM the kernel links into: a write
10+
* through the reset driver would clobber whatever data or function
11+
* pointer the linker happened to place there (moving with every layout
12+
* change). Shrink the kernel's view of the 64 KiB SRAM by one KiB and
13+
* place the registers in the carved-out tail.
14+
*/
15+
&sram0 {
16+
reg = <0x20000000 0xfc00>;
17+
};
18+
119
/ {
2-
reset0: reset@20000004 {
20+
reset0: reset@2000fc00 {
321
compatible = "reset-mmio";
4-
reg = <0x20000004 0x4>;
22+
reg = <0x2000fc00 0x4>;
523
num-resets = <16>;
624
};
725

8-
reset1: reset@20000008 {
26+
reset1: reset@2000fc04 {
927
compatible = "reset-mmio";
10-
reg = <0x20000008 0x4>;
28+
reg = <0x2000fc04 0x4>;
1129
num-resets = <16>;
1230
active-low;
1331
};

0 commit comments

Comments
 (0)