Skip to content

"Extra Sections" example is potentially unsound #498

Open
@jamesmunns

Description

@jamesmunns

In the cortex-m-rt docs, the extra sections example shows the definition of a zero-initialized static mut array in a section outside of RAM.

I believe this to be unsound, and difficult, if not impossible, to use totally soundly.

The CRT is required to initialize all statics, either to their default value (in .data), or to zero (in .bss). cortex-m-rt explicitly only performs initialization for data and bss sections in the RAM region, meaning the CCRAM must be considered to be uninitialized in the example as currently written.

At the very least if we include an example like this, we should discuss this deficiency, and state that pre_init must be used to guarantee that the static is initialized at the start of the program.

I personally am of the opionion that we cannot soundly perform this initialization in a pre_init in Rust, as that means that Rust code is running without all statics initialized, which violates the agreement the language makes with the platform environment.

This argument is part of why we switched to an assembly CRT, rather than the previously Rust-based init sequence.

Metadata

Metadata

Assignees

No one assigned

    Labels

    I-unsoundIssue: A soundness hole (worst kind of bug), see: https://en.wikipedia.org/wiki/Soundness

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions