Repository navigation
loader: enable stack protection and null pointer detection - #692
Merged
Merged
Conversation
Built
|
| Artifact | Board | Core | Tests | RAM | Sketches | Warnings | Errors |
|---|---|---|---|---|---|---|---|
✅ zephyr_contrib |
ek_ra8d1
| 2 🏷️ | ✅ |
12.0% |
2 | - | - |
frdm_mcxn947
| 7 🏷️ | ✅ |
53.4% |
2 | - | - | |
frdm_rw612
| 3 🏷️ | ✅ |
76.5% |
2 | - | - | |
✅* zephyr_main |
giga
| 10 🏷️ | ✅* |
45.9% |
86 | 2 | - |
nano33ble
| 6 🏷️ | ✅ |
78.8% |
44 | - | - | |
nano_connect
| 8 🏷️ | ✅* |
68.9% |
38 | 6 | - | |
nano_matter
| 3 🏷️ | ✅ |
|
22 | - | - | |
nicla_sense
| 4 🏷️ | ✅ |
|
18 | - | - | |
nicla_vision
| 11 🏷️ | ✅ |
40.3% |
68 | - | - | |
opta
| 11 🏷️ | ✅ |
42.3% |
76 | - | - | |
portentac33
| 6 🏷️ | ✅ |
|
72 | - | - | |
portentah7
| 10 🏷️ | ✅* |
51.2% |
102 | 8 | - | |
✅ zephyr_unoq |
unoq
| 2 🏷️ | ✅ |
43.5% |
56 | - | - |
ventunoq
| 5 🏷️ | ✅ |
23.7% |
48 | - | - |
Legend
Board Test Status description 🔥 🔥 Test run failed to complete. ❌ 🔴 Test completed with unexpected errors. ⁉️ ⁉️ Test was expected to fail but passed; exception entry is outdated. ✔️* 🚫 Test completed with errors, but all are known/expected. ✅* 🟡 Test completed with some warnings; no errors detected. ✅ 🟢 Test passed successfully, with no warnings or errors. 🌑 🌑 Test was skipped.
dani-clo
force-pushed
the
security
branch
2 times, most recently
from
October 13, 2026 15:36
d53b475 to
ffd0a58
Compare
Member
|
I suggest to put some kind of warning in the changelog for this for:
|
Use "reset halt" instead of separate "reset" and "halt" commands in the sketch and bootloader flashing scripts. The separate commands allow Zephyr to start before the CPU is halted, leaving CPU state that causes the RAM-resident flash algorithm to time out. Halting during reset prevents this.
Use "reset halt" instead of separate "reset" and "halt" commands in the sketch and bootloader flashing scripts. The separate commands allow Zephyr to start before the CPU is halted, leaving CPU state that causes the RAM-resident flash algorithm to time out. Halting during reset prevents this.
…e size Avoid accessing address 0 by comparing memory starting at 0x400. This avoids the DWT null-pointer detection region. Also remove the memory flush logic, because the code was never compiled (the C33 did not have DCACHE, ICACHE or MPU in its final .config).
Enable HW_STACK_PROTECTION and NULL_POINTER_EXCEPTION_DETECTION_DWT in the loader Kconfig. Kconfig drops them where unsupported: hardware stack protection needs the built-in stack guard (ARMv8-M) or the MPU, so it stays off on the M4/M0+ variants that keep CONFIG_ARM_MPU=n; DWT null pointer detection is unavailable on cores without DWT (RP2040, RA8D1). Building the DWT option on STM32U5/H5 requires the Zephyr fix "arch: arm: cortex_m: fix DWT COMP1 clash with vendor macros". Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
These variants kept the loader default CONFIG_ARM_MPU=n, so CONFIG_HW_STACK_PROTECTION was dropped by Kconfig: on ARMv7-M and ARMv6-M it needs the MPU stack guard. Enable the MPU so they get MPU_STACK_GUARD like the H7 variants. disable_mpu_rasr_xn() already keeps RAM executable for LLEXT sketches when the MPU is on. Remove disable_bootloader_mpu() for nano33ble: it ran at PRE_KERNEL_1, after Zephyr's own MPU init, and cleared MPU->CTRL, which would turn the stack guard back off. Zephyr already disables and reprograms the MPU left enabled by the bootloader. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Most variants now enable the MPU, so make CONFIG_ARM_MPU=y the loader default and drop the per-variant CONFIG_ARM_MPU=y lines. Variants that do not use the MPU yet (nano_matter, ek_ra8d1, frdm_mcxn947, frdm_rw612; portentac33, unoq and ventunoq already did) now set CONFIG_ARM_MPU=n explicitly, with a note on why: all are ARMv8-M and get HW_STACK_PROTECTION from the built-in stack guard. No functional change: the generated .config is identical for all boards in boards.txt. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Author
|
v2:
|
Built
|
| Artifact | Board | Core | Tests | RAM | Sketches | Warnings | Errors |
|---|---|---|---|---|---|---|---|
✅ zephyr_contrib |
ek_ra8d1
| 2 🏷️ | ✅ |
12.0% |
2 | - | - |
frdm_mcxn947
| 7 🏷️ | ✅ |
53.4% |
2 | - | - | |
frdm_rw612
| 3 🏷️ | ✅ |
76.5% |
2 | - | - | |
✅* zephyr_main |
giga
| 10 🏷️ | ✅* |
45.9% |
86 | 2 | - |
nano33ble
| 5 🏷️ | ✅ |
79.2% |
44 | - | - | |
nano_connect
| 6 🏷️ | ✅ |
69.5% |
38 | - | - | |
nano_matter
| 3 🏷️ | ✅ |
|
22 | - | - | |
nicla_sense
| 3 🏷️ | ✅ |
|
18 | - | - | |
nicla_vision
| 11 🏷️ | ✅ |
40.4% |
68 | - | - | |
opta
| 11 🏷️ | ✅ |
42.3% |
76 | - | - | |
portentac33
| 6 🏷️ | ✅ |
|
72 | - | - | |
portentah7
| 10 🏷️ | ✅* |
51.2% |
102 | 2 | - | |
✅ zephyr_unoq |
unoq
| 2 🏷️ | ✅ |
43.5% |
56 | - | - |
ventunoq
| 5 🏷️ | ✅ |
23.7% |
48 | - | - |
Legend
Board Test Status description 🔥 🔥 Test run failed to complete. ❌ 🔴 Test completed with unexpected errors. ⁉️ ⁉️ Test was expected to fail but passed; exception entry is outdated. ✔️* 🚫 Test completed with errors, but all are known/expected. ✅* 🟡 Test completed with some warnings; no errors detected. ✅ 🟢 Test passed successfully, with no warnings or errors. 🌑 🌑 Test was skipped.
With CONFIG_ASSERT=y the k_current_get() inline asserts !k_is_pre_kernel(), which reads the kernel-internal z_sys_post_kernel. That symbol is not exported to sketches, so any sketch calling k_current_get() failed to link with "undefined reference to `z_sys_post_kernel'".
OpenOCD sets DHCSR.C_DEBUGEN when it connects and never clears it on shutdown; it stays set until a power-on reset. With halting debug enabled, a DWT watchpoint hit (NULL_POINTER_EXCEPTION_DETECTION_DWT) halts the core instead of raising the DebugMonitor exception, so a null pointer access freezes the board with no fault dump and no error LED. Replace the final "reset"/"reset run" with "reset halt" + "resume", so OpenOCD finishes its reset handling before the firmware runs, and clear C_DEBUGEN before shutdown.
facchinm
approved these changes
Oct 19, 2026
Built
|
| Artifact | Board | Core | Tests | RAM | Sketches | Warnings | Errors |
|---|---|---|---|---|---|---|---|
✅ zephyr_contrib |
ek_ra8d1
| 2 🏷️ | ✅ |
12.0% |
2 | - | - |
frdm_mcxn947
| 7 🏷️ | ✅ |
53.4% |
2 | - | - | |
frdm_rw612
| 3 🏷️ | ✅ |
74.6% |
2 | - | - | |
✅* zephyr_main |
giga
| 10 🏷️ | ✅* |
45.9% |
86 | 2 | - |
nano33ble
| 5 🏷️ | ✅ |
79.2% |
44 | - | - | |
nano_connect
| 6 🏷️ | ✅ |
69.5% |
38 | - | - | |
nano_matter
| 3 🏷️ | ✅ |
|
22 | - | - | |
nicla_sense
| 3 🏷️ | ✅ |
|
18 | - | - | |
nicla_vision
| 11 🏷️ | ✅ |
40.4% |
68 | - | - | |
opta
| 11 🏷️ | ✅ |
42.3% |
76 | - | - | |
portentac33
| 6 🏷️ | ✅ |
|
72 | - | - | |
portentah7
| 10 🏷️ | ✅* |
51.2% |
102 | 2 | - | |
✅ zephyr_unoq |
unoq
| 2 🏷️ | ✅ |
43.5% |
56 | - | - |
ventunoq
| 5 🏷️ | ✅ |
23.7% |
48 | - | - |
Legend
Board Test Status description 🔥 🔥 Test run failed to complete. ❌ 🔴 Test completed with unexpected errors. ⁉️ ⁉️ Test was expected to fail but passed; exception entry is outdated. ✔️* 🚫 Test completed with errors, but all are known/expected. ✅* 🟡 Test completed with some warnings; no errors detected. ✅ 🟢 Test passed successfully, with no warnings or errors. 🌑 🌑 Test was skipped.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Enable Zephyr's runtime memory-safety checks in the loader (
loader/prj.conf):CONFIG_HW_STACK_PROTECTION=y– hardware stack overflow detection (PSPLIM/MSPLIM on ARMv8-M, MPU guard on ARMv7-M variants with the MPU on)CONFIG_STACK_CANARIES=y– compiler stack canariesCONFIG_NULL_POINTER_EXCEPTION_DETECTION_DWT=y– DWT watchpoint on the null pageKconfig turns these off where the hardware can't support them. That gives a warning, not a build failure:
CONFIG_ARM_MPU=nCONFIG_STACK_CANARIES_TLSwas considered and left out: Cortex-M does not provideARCH_HAS_STACK_CANARIES_TLS.Dependency
On STM32U5/H5 (UNO Q, VENTUNO Q), the DWT option needs the Zephyr fix "arch: arm: cortex_m: fix DWT COMP1 clash with vendor macros", now on
zephyr-arduino-v4.4.2. Without it,debug.cfails withexpected identifier before '(' token.Testing
extra/build_all.sh -fagainstzephyr-arduino-v4.4.2@1050db55acd: all 14 variants build.