imx95_a55: assert the stage 1 stack top clears the OCRAM image region

Author: dgarske

hal/imx95_a55_stage1.ld

@@ -4,10 +4,10 @@
 MEMORY
 {
     /* The boot ROM loads this image here and enters it at EL3. LENGTH is the
-     * same 192 KiB budget U-Boot gives SPL, so growth is a link error rather
-     * than a silent overrun into the stack below. Both come from
-     * WOLFBOOT_STAGE1_BASE_ADDR / WOLFBOOT_STAGE1_SIZE, so the same sources
-     * can also be linked somewhere else for bring-up. */
+     * same 192 KiB budget U-Boot gives SPL, so growth past it is a link error
+     * rather than a silent overrun. Both come from WOLFBOOT_STAGE1_BASE_ADDR /
+     * WOLFBOOT_STAGE1_SIZE, so the same sources can also be linked somewhere
+     * else for bring-up. The stack is NOT inside this region; see END_STACK. */
     OCRAM(rwx): ORIGIN = @WOLFBOOT_STAGE1_BASE_ADDR@, LENGTH = @WOLFBOOT_STAGE1_SIZE@
 }
 ENTRY(_boot);
@@ -45,7 +45,13 @@ SECTIONS
     } > OCRAM
 }
 
-/* Stack top, above the loaded image and below the end of the region. At the
- * OCRAM base this is 0x204D6000, the same address U-Boot SPL uses, so it is
- * known to be clear of anything the ROM or the OEI left behind. */
+/* Stack top. This deliberately sits ABOVE the region declared in MEMORY, in the
+ * part of OCRAM that extends past this image's budget: at the OCRAM base it is
+ * 0x204D6000, the same address U-Boot SPL uses, so it is known both to exist and
+ * to be clear of anything the ROM or the OEI left behind. Being a bare symbol
+ * assignment it is not placed in OCRAM and gets no bounds check, so the assert
+ * below stands in for one - the stack grows down towards the image, and the gap
+ * between the end of the region and this address is all the headroom there is. */
 END_STACK = @WOLFBOOT_STAGE1_BASE_ADDR@ + 0x56000;
+ASSERT(END_STACK > @WOLFBOOT_STAGE1_BASE_ADDR@ + @WOLFBOOT_STAGE1_SIZE@,
+       "stage 1 stack top must stay above the OCRAM image region")