ra8_sbrk_trap.c File Reference

newlib _sbrk() trap stub – enforces NASA Power of 10 Rule 3 More...

#include "ra8_sbrk_trap.h"
#include <stddef.h>
#include "ra8_error_handler.h"

Include dependency graph for ra8_sbrk_trap.c:

Go to the source code of this file.

Functions
void *	_sbrk (ptrdiff_t incr)
	Trap that replaces newlib's heap-extension syscall.

Detailed Description

newlib _sbrk() trap stub – enforces NASA Power of 10 Rule 3

Tag

[Ring 1 / Core] {World: S}

Target firmware is freestanding and links with -nostdlib without newlib or libnosys. General-purpose allocators (malloc, free, etc.) are unavailable and fail closed at link time with undefined symbol errors.

This file provides a strong _sbrk stub as defense-in-depth:

1. If any legacy object or external routine attempts to resolve or invoke _sbrk, it halts loudly via ra8_fatal_error rather than silently corrupting memory or resolving to an unbounded bump allocator.
2. In clean freestanding target firmware with zero heap callers, this object's sections are automatically discarded by linker garbage collection (--gc-sections).
3. Linker scripts define no end anchor and no .heap section.

Project policy (NASA Power of 10 Rule 3: "No dynamic memory after initialisation") forbids any heap use in libs/ and src/.

Copyright

Copyright (c) 2026 Brighton Sikarskie SPDX-License-Identifier: MIT

Definition in file ra8_sbrk_trap.c.

Function Documentation

_sbrk()

void * _sbrk

(

ptrdiff_t

incr

)

Trap that replaces newlib's heap-extension syscall.

Reports a fatal error and never returns. Reaching this means something called malloc, calloc, realloc, strdup or a C++ operator new on the target, which the firmware's zero-heap design forbids – so it halts at the call site rather than handing back storage that does not exist.

Parameters

[in]

incr

Bytes newlib wants the program break advanced by. Ignored: the trap never satisfies the request.

Returns

Never returns. The signature matches newlib's expectation so the strong definition overrides the library's own.

Return values

NULL	Unreachable; present only to satisfy the newlib contract.

Precondition

The fatal-error sink is available (it is from reset).

The image linked this TU, so the trap overrides newlib's _sbrk.

Postcondition

Control never returns to the caller; the firmware halts.

The fatal-error sink has emitted the violation tag.

Note

Not thread-safe and not intended to be – it never returns.

Warning

Do not call this directly. It exists for the C library to resolve and for the host death-test to drive.

Example:

// Host death test: prove the trap never returns.
(void)_sbrk(32);  // does not come back

See also

ra8_fatal_error()

Since

0.1.0

Definition at line 45 of file ra8_sbrk_trap.c.

References ra8_fatal_error().