mirror of
https://github.com/apache/nuttx.git
synced 2026-08-01 20:28:58 +00:00
ea78802f8d
Lets a NOMMU target execute downloadable modules in place from memory-mapped NOR flash, so a module's text and rodata never consume RAM. It is the consumer of xipfs: the loader maps a module's read-only segment with MAP_XIP_STRICT, which resolves to a direct flash pointer or fails with -ENXIO rather than falling back to a RAM copy, and pins the extent for as long as the module is loaded so the defragmenter cannot relocate code that is executing. Only the writable segment is copied to RAM, once per running instance. The loader follows DT_NEEDED so a module can use shared libraries, each object getting its own GOT and its own data. FDPIC is what makes this possible: text is position-independent and each LOAD segment is placed independently, with the text-to-data offset communicated at load time through function descriptors and the GOT. A descriptor is a pair -- entry pointer plus data base -- so a module function handed back to the firmware carries the data base it needs. r9 holds that base at runtime, per the ARM FDPIC ABI. Reserving r9 across the base firmware is what allows a firmware routine to call back into module code and still arrive with the module's data base intact. Toolchain.defs puts --fixed-r9 in ARCHCPUFLAGS rather than CFLAGS, because almost every board Make.defs assigns CFLAGS with ':=' after including it, which would discard the flag; ARCHCPUFLAGS is re-expanded by that same assignment and so survives it. The CONFIG_PIC --fixed-r10 case is skipped under FDPIC, since reserving both registers would cost one for nothing. The DT_NEEDED walk is depth capped. fdpic_loaddepends() recursed once per link of a dependency chain with a path buffer on each frame and nothing to stop it, so a malformed module set overflowed the stack of whichever task called the loader instead of being rejected. A dependency *cycle* was never the hazard -- an object joins the load's list before its own dependencies are walked, so a library naming something already loaded finds it there and stops -- what was unbounded is a chain of distinct names, which the list cannot bound, hence an explicit cap rather than cycle detection. A module's .rofixup section is skipped, and the file header records why. .rofixup is the FDPIC self-relocation list a static executable's crt0 walks to derive its own GOT when no loader is present. A module links -shared -nostartfiles, so no crt0 runs, and the built objects hold exactly one entry there -- the address of the GOT itself, which this loader computes and installs at every entry into module code anyway. Assisted-by: Claude Code:claude-opus-5 Signed-off-by: Marco Casaroli <marco.casaroli@gmail.com> |
||
|---|---|---|
| .. | ||
| CMakeLists.txt | ||
| Kconfig | ||
| lib_abort.c | ||
| lib_abs.c | ||
| lib_aligned_alloc.c | ||
| lib_arc4random.c | ||
| lib_atexit.c | ||
| lib_atof.c | ||
| lib_atoi.c | ||
| lib_atol.c | ||
| lib_atoll.c | ||
| lib_bsearch.c | ||
| lib_checkbase.c | ||
| lib_div.c | ||
| lib_exit.c | ||
| lib_getprogname.c | ||
| lib_itoa.c | ||
| lib_labs.c | ||
| lib_ldiv.c | ||
| lib_llabs.c | ||
| lib_lldiv.c | ||
| lib_mblen.c | ||
| lib_mbstowcs.c | ||
| lib_mbtowc.c | ||
| lib_mkdtemp.c | ||
| lib_mkstemp.c | ||
| lib_mktemp.c | ||
| lib_openpty.c | ||
| lib_posix_memalign.c | ||
| lib_ptsname.c | ||
| lib_ptsnamer.c | ||
| lib_qsort.c | ||
| lib_rand.c | ||
| lib_rand48.c | ||
| lib_reallocarray.c | ||
| lib_realpath.c | ||
| lib_srand.c | ||
| lib_strtol.c | ||
| lib_strtold.c | ||
| lib_strtoll.c | ||
| lib_strtoul.c | ||
| lib_strtoull.c | ||
| lib_unlockpt.c | ||
| lib_valloc.c | ||
| lib_wcstombs.c | ||
| lib_wctomb.c | ||
| Make.defs | ||