fw/syscall: run syscalls on a dedicated stack on ARMv7-M (FIRM-4306)

[gmarull]

Summary

Two fixes for App-task stack overflows on ARMv7-M (asterix, flint), found while analysing the FIRM-4306 coredumps, plus a new case in the MPU violation demo that exercises them.

1. kernel: keep empty MPU slots from wiping the previous region — since the native kernel (v4.37.0+), arch_thread_regions_set() writes RBAR=0 for unused per-thread slots. With VALID clear that write lands on the region RNR already points at, so the empty slot 3 disables region 6 = the App/Worker stack guard. On v4.37+ ARMv7-M builds an app stack overflow no longer faults at all; it walks into the kernel heap. The FreeRTOS port ORed VALID|region into every slot, which is why v4.36 devices still fault on the guard. Worth backporting on its own.

2. fw/syscall: run syscalls on the dedicated stack on ARMv7-M too — be4d98d's privileged syscall stack was ARMv8-M only (PSPLIM). FIRM-4306's coredumps show the App task's 2 KiB stack exhausted inside the privileged chain graphics_draw_text → text_resources (glyph miss on an app font) → sys_resource_load_range → resource_storage → pfs_open → FTL → flash (~1.3 KB kernel-side, ~0.5 KB app), so the overflow is privileged and the watch reboots (StackOverflow: Task #3, or HardFault: LR 0x..1bffdd when the exception frame itself hits the guard — that "LR" is SRAM residue read out of the never-written guard). This enables the relocation on ARMv7-M with a 32 B no-access MPU region under each syscall stack (free MemoryRegion_Task4 slot) instead of PSPLIM, and teaches the fault handler about it.

3. apps/demo: probe the syscall stack from the MPU violation test — adds "Syscall near limit" (burn the app stack down to 160 B, then load an unused system font) and lets a test declare that surviving is the expected outcome.

Validation (qemu_flint)

CONFIG_DEMO_APP_MPU_VIOLATION_TEST=y, all cases driven over the QEMU monitor, reboot detected via the kernel tick counter:

case	upstream/main	+ commit 1	+ commit 2
1–6 (worker/kernel RAM, RO BSS, flash)	fault, app killed	fault, app killed	fault, app killed
7 Stack guard W	SURVIVED! (MPU MISS)	fault, app killed	fault, app killed
8 Stack overflow	killed only once it reaches the heap	fault, app killed	fault, app killed
9 Syscall near limit	"survives" — guard region and kernel heap overwritten	reboot	SURVIVED (expected), guard untouched

Stress pbw: custom font, Up burns 64 B more app stack (VLA) before graphics_draw_text with a rotating string (glyph misses → pfs → FTL). Measured with QMP xp (the QEMU gdb stub reads through the MPU with the current privilege, so it lies in app context).

build	burn 0	burn 512 B	burn 768 B
main (guard wiped)	app peak 1704/2016	2016, guard + heap overwritten, no fault	app dies from the fallout
+ commit 1 (= real device)	1704	reboot, privileged overflow in the syscall	—
+ commit 2	1480, syscall stack 608	1968, no fault	app killed, no reboot

WeatherGraph (the watchface from the ticket) runs unchanged. pbl test passes; asterix builds. Not yet run on hardware.

Cost: 2 × 2080 B of kernel RAM. System apps run privileged and still use their own stack for everything (unchanged).

Test plan

• asterix: run a text-heavy watchface with a custom font (WeatherGraph) for a day; no StackOverflow/HardFault reboots
• asterix: an app that overflows its own stack shows the crash dialog instead of rebooting
• stack_free_app_syscall_bytes heartbeat stays well above 0 on asterix

Fixes FIRM-4306

🤖 Generated with Claude Code