Clean up linker scripts; detect out-of-flash problem.

The VMA of the .data segment is in RAM, but we actually put it into FLASH.
The linker doesn't notice if it runs out of flash, so it creates an invalid
image.

This adds an explicit check to be sure it all fits. It also refactors the
region declarations to be more explicit. For vboot-enabled configurations,

  CONFIG_SECTION_*      - describes the extent of flash for one entire image
  CONFIG_FW_*           - the region within the SECTION for the firmware only
  CONFIG_VBLOCK_*       - the region within the RW SECTIONs for the vblocks
  CONFIG_VBOOT_ROOTKEY  - the region within the RO SECTION for the root key

Look at chip/lm4/config.h for the best example.

BUG=chrome-os-partner:9839
TEST=manual

Build it, run it.

Change-Id: I3c652e82d58a5328115cc750c80ecba6a3fd99a3
Signed-off-by: Bill Richardson <wfrichar@chromium.org>

9 files changed, 192 insertions, 86 deletions

diff --git a/chip/lm4/config.h b/chip/lm4/config.h
index 15bfb6b205..43d393304d 100644
--- a/chip/lm4/config.h
+++ b/chip/lm4/config.h
@@ -9,38 +9,6 @@
 /* 16.000 Mhz internal oscillator frequency (PIOSC) */
 #define INTERNAL_CLOCK 16000000
 
-/* Memory mapping */
-#define CONFIG_FLASH_BASE       0x00000000
-#define CONFIG_FLASH_SIZE       0x00040000
-#define CONFIG_FLASH_BANK_SIZE  0x00000800  /* Protect bank size */
-#define CONFIG_RAM_BASE         0x20000000
-#define CONFIG_RAM_SIZE         0x00008000
-
-/* Size of one firmware image in flash */
-#define CONFIG_FW_IMAGE_SIZE    (80 * 1024)
-#define CONFIG_FW_RO_OFF        0
-#define CONFIG_FW_A_OFF         CONFIG_FW_IMAGE_SIZE
-#define CONFIG_FW_B_OFF         (2 * CONFIG_FW_IMAGE_SIZE)
-
-/* We'll put the vboot stuff at the top of each image, since the vector table
- * has to go at the start. 4K should be enough for what we need. 2K isn't. */
-#define CONFIG_VBOOT_REGION_SIZE     0x1000
-#define CONFIG_VBOOT_ROOTKEY_SIZE    0x800
-#define CONFIG_VBOOT_REGION_OFF      (CONFIG_FW_IMAGE_SIZE \
-					- CONFIG_VBOOT_REGION_SIZE)
-/* Specifics for each image */
-#define CONFIG_FW_RO_SIZE            CONFIG_VBOOT_REGION_OFF
-#define CONFIG_FW_A_SIZE             CONFIG_VBOOT_REGION_OFF
-#define CONFIG_FW_B_SIZE             CONFIG_VBOOT_REGION_OFF
-#define CONFIG_VBOOT_ROOTKEY_OFF     (CONFIG_FW_RO_OFF \
-					+ CONFIG_VBOOT_REGION_OFF)
-#define CONFIG_FMAP_OFF              (CONFIG_VBOOT_ROOTKEY_OFF \
-					+ CONFIG_VBOOT_ROOTKEY_SIZE)
-#define CONFIG_VBLOCK_A_OFF          (CONFIG_FW_A_OFF + CONFIG_FW_A_SIZE)
-#define CONFIG_VBLOCK_B_OFF          (CONFIG_FW_B_OFF + CONFIG_FW_B_SIZE)
-#define CONFIG_VBLOCK_A_SIZE         CONFIG_VBOOT_REGION_SIZE
-#define CONFIG_VBLOCK_B_SIZE         CONFIG_VBOOT_REGION_SIZE
-
 /* Number of IRQ vectors on the NVIC */
 #define CONFIG_IRQ_COUNT 132
 
@@ -50,10 +18,79 @@
 #define CONFIG_UART_SR_OFFSET  0x18
 #define CONFIG_UART_SR_TXEMPTY 0x80
 
+/****************************************************************************/
+/* Memory mapping */
+
+#define CONFIG_RAM_BASE             0x20000000
+#define CONFIG_RAM_SIZE             0x00008000
+
 /* System stack size */
-#define CONFIG_STACK_SIZE 4096
+#define CONFIG_STACK_SIZE           4096
+
+#define CONFIG_FLASH_BASE           0x00000000
+#define CONFIG_FLASH_BANK_SIZE      0x00000800  /* protect bank size */
+
+/* This is the physical size of the flash on the chip. We'll reserve one bank
+ * in order to emulate per-bank write-protection UNTIL REBOOT. The hardware
+ * doesn't support a write-protect pin, and if we make the write-protection
+ * permanent, it can't be undone easily enough to support RMA. */
+#define CONFIG_FLASH_PHYSICAL_SIZE  0x00040000
+
+/* This is the size that we pretend we have. This is what flashrom expects,
+ * what the FMAP reports, and what size we build images for. */
+#define CONFIG_FLASH_SIZE (CONFIG_FLASH_PHYSICAL_SIZE - CONFIG_FLASH_BANK_SIZE)
+
+/****************************************************************************/
+/* Define our flash layout. */
+
+/* The EC needs its own region for run-time vboot stuff. We can put
+ * that up at the top */
+#define CONFIG_SECTION_ROLLBACK_SIZE  (1 * CONFIG_FLASH_BANK_SIZE)
+#define CONFIG_SECTION_ROLLBACK_OFF   (CONFIG_FLASH_SIZE \
+					- CONFIG_FLASH_ROLLBACK_SIZE)
+
+/* Then there are the three major sections. */
+#define CONFIG_SECTION_RO_SIZE	    (40 * CONFIG_FLASH_BANK_SIZE)
+#define CONFIG_SECTION_RO_OFF       CONFIG_FLASH_BASE
+
+#define CONFIG_SECTION_A_SIZE       (40 * CONFIG_FLASH_BANK_SIZE)
+#define CONFIG_SECTION_A_OFF        (CONFIG_SECTION_RO_OFF \
+					+ CONFIG_SECTION_RO_SIZE)
+
+#define CONFIG_SECTION_B_SIZE       (40 * CONFIG_FLASH_BANK_SIZE)
+#define CONFIG_SECTION_B_OFF        (CONFIG_SECTION_A_OFF \
+					+ CONFIG_SECTION_A_SIZE)
+
+/* The top of each section will hold the vboot stuff, since the firmware vector
+ * table has to go at the start. The root key will fit in 2K, but the vblocks
+ * need 4K. */
+#define CONFIG_VBOOT_ROOTKEY_SIZE   0x800
+#define CONFIG_VBLOCK_SIZE          0x1000
+
+/* RO: firmware (+ FMAP), root keys */
+#define CONFIG_FW_RO_OFF            CONFIG_SECTION_RO_OFF
+#define CONFIG_FW_RO_SIZE           (CONFIG_SECTION_RO_SIZE \
+					- CONFIG_VBOOT_ROOTKEY_SIZE)
+#define CONFIG_VBOOT_ROOTKEY_OFF    (CONFIG_FW_RO_OFF + CONFIG_FW_RO_SIZE)
+
+/* A: firmware, vblock */
+#define CONFIG_FW_A_OFF             CONFIG_SECTION_A_OFF
+#define CONFIG_FW_A_SIZE            (CONFIG_SECTION_A_SIZE \
+					- CONFIG_VBLOCK_SIZE)
+#define CONFIG_VBLOCK_A_OFF         (CONFIG_FW_A_OFF + CONFIG_FW_A_SIZE)
+
+/* B: firmware, vblock */
+#define CONFIG_FW_B_SIZE            (CONFIG_SECTION_B_SIZE \
+					- CONFIG_VBLOCK_SIZE)
+#define CONFIG_FW_B_OFF             (CONFIG_SECTION_A_OFF \
+					+ CONFIG_SECTION_A_SIZE)
+#define CONFIG_VBLOCK_B_OFF         (CONFIG_FW_B_OFF + CONFIG_FW_B_SIZE)
+
+
+/****************************************************************************/
+/* Customize the build */
 
-/* build with assertions and debug messages */
+/* Build with assertions and debug messages */
 #define CONFIG_DEBUG
 
 /* Optional features present on this chip */
diff --git a/chip/stm32/config-stm32f100.h b/chip/stm32/config-stm32f100.h
index 7eabe2b173..ecc16e0652 100644
--- a/chip/stm32/config-stm32f100.h
+++ b/chip/stm32/config-stm32f100.h
@@ -12,10 +12,22 @@
 
 /* Size of one firmware image in flash */
 #define CONFIG_FW_IMAGE_SIZE    (32 * 1024)
-#define CONFIG_FW_RO_OFF        0
+
 #define CONFIG_NO_RW_B
+
+#define CONFIG_FW_RO_OFF        0
+#define CONFIG_FW_RO_SIZE       CONFIG_FW_IMAGE_SIZE
 #define CONFIG_FW_A_OFF         CONFIG_FW_IMAGE_SIZE
+#define CONFIG_FW_A_SIZE        CONFIG_FW_IMAGE_SIZE
 #define CONFIG_FW_B_OFF         (2 * CONFIG_FW_IMAGE_SIZE)
+#define CONFIG_FW_B_SIZE        CONFIG_FW_IMAGE_SIZE
+
+#define CONFIG_SECTION_RO_OFF   CONFIG_FW_RO_OFF
+#define CONFIG_SECTION_RO_SIZE  CONFIG_FW_RO_SIZE
+#define CONFIG_SECTION_A_OFF    CONFIG_FW_A_OFF
+#define CONFIG_SECTION_A_SIZE   CONFIG_FW_A_SIZE
+#define CONFIG_SECTION_B_OFF    CONFIG_FW_B_OFF
+#define CONFIG_SECTION_B_SIZE   CONFIG_FW_B_SIZE
 
 /* Number of IRQ vectors on the NVIC */
 #define CONFIG_IRQ_COUNT 61
diff --git a/chip/stm32/config-stm32l15x.h b/chip/stm32/config-stm32l15x.h
index 7185505e21..e576758cba 100644
--- a/chip/stm32/config-stm32l15x.h
+++ b/chip/stm32/config-stm32l15x.h
@@ -12,9 +12,20 @@
 
 /* Size of one firmware image in flash */
 #define CONFIG_FW_IMAGE_SIZE    (32 * 1024)
+
 #define CONFIG_FW_RO_OFF        0
+#define CONFIG_FW_RO_SIZE       CONFIG_FW_IMAGE_SIZE
 #define CONFIG_FW_A_OFF         CONFIG_FW_IMAGE_SIZE
+#define CONFIG_FW_A_SIZE        CONFIG_FW_IMAGE_SIZE
 #define CONFIG_FW_B_OFF         (2 * CONFIG_FW_IMAGE_SIZE)
+#define CONFIG_FW_B_SIZE        CONFIG_FW_IMAGE_SIZE
+
+#define CONFIG_SECTION_RO_OFF   CONFIG_FW_RO_OFF
+#define CONFIG_SECTION_RO_SIZE  CONFIG_FW_RO_SIZE
+#define CONFIG_SECTION_A_OFF    CONFIG_FW_A_OFF
+#define CONFIG_SECTION_A_SIZE   CONFIG_FW_A_SIZE
+#define CONFIG_SECTION_B_OFF    CONFIG_FW_B_OFF
+#define CONFIG_SECTION_B_SIZE   CONFIG_FW_B_SIZE
 
 /* Number of IRQ vectors on the NVIC */
 #define CONFIG_IRQ_COUNT 45
diff --git a/common/firmware_image.lds.S b/common/firmware_image.lds.S
index 98bbb7cb62..cf1e79ff39 100644
--- a/common/firmware_image.lds.S
+++ b/common/firmware_image.lds.S
@@ -14,23 +14,22 @@ MEMORY
 SECTIONS
 {
     . = ALIGN(CONFIG_FLASH_BANK_SIZE);
-    .image.RO : AT(CONFIG_FLASH_BASE + CONFIG_FW_RO_OFF) {
+    .image.RO : AT(CONFIG_FLASH_BASE + CONFIG_SECTION_RO_OFF) {
         *(.image.RO)
     } > FLASH =0xff
     . = ALIGN(CONFIG_FLASH_BANK_SIZE);
-    .image.A : AT(CONFIG_FLASH_BASE + CONFIG_FW_A_OFF) {
+    .image.A : AT(CONFIG_FLASH_BASE + CONFIG_SECTION_A_OFF) {
         *(.image.A)
         BYTE(0xEA)                      /* Mark end explicitly */
     } > FLASH =0xff
 #ifndef CONFIG_NO_RW_B
     . = ALIGN(CONFIG_FLASH_BANK_SIZE);
-    .image.B : AT(CONFIG_FLASH_BASE + CONFIG_FW_B_OFF) {
+    .image.B : AT(CONFIG_FLASH_BASE + CONFIG_SECTION_B_OFF) {
         *(.image.B)
         BYTE(0xEB)                      /* Mark end explicitly */
     } > FLASH =0xff
 #endif
-    /* NOTE: EC implementation reserves one bank for itself */
-    .padding : AT(CONFIG_FLASH_BASE + CONFIG_FLASH_SIZE - CONFIG_FLASH_BANK_SIZE - 1) {
+    .padding : AT(CONFIG_FLASH_BASE + CONFIG_FLASH_SIZE - 1) {
         BYTE(0xff);
     } > FLASH =0xff
 }
diff --git a/common/flash_common.c b/common/flash_common.c
index 466742a66f..2582a32621 100644
--- a/common/flash_common.c
+++ b/common/flash_common.c
@@ -14,7 +14,7 @@
 #define PERSIST_STATE_VERSION 1
 #define MAX_BANKS (CONFIG_FLASH_SIZE / CONFIG_FLASH_BANK_SIZE)
 
-/* Persistent protection state */
+/* Persistent protection state - emulates a SPI status register for flashrom */
 struct persist_state {
 	uint8_t version;            /* Version of this struct */
 	uint8_t lock;               /* Lock flags */
@@ -337,7 +337,7 @@ int flash_get_protect_lock(void)
 int flash_pre_init(void)
 {
 	/* Calculate usable flash size.  Reserve one protection block
-	 * at the top to hold the write protect data. */
+	 * at the top to hold the "pretend SPI" write protect data. */
 	usable_flash_size = flash_physical_size() -
 		flash_get_protect_block_size();
 
diff --git a/common/fmap.c b/common/fmap.c
index 40524c21ef..00b127a1b7 100644
--- a/common/fmap.c
+++ b/common/fmap.c
@@ -13,7 +13,6 @@
 #define FMAP_SIGNATURE_SIZE 8
 #define FMAP_VER_MAJOR 1
 #define FMAP_VER_MINOR 0
-#define FMAP_SEARCH_STRIDE 64		/* Spec revision 1.01 */
 
 typedef struct _FmapHeader {
 	char        fmap_signature[FMAP_SIGNATURE_SIZE];
@@ -48,8 +47,7 @@ const struct _ec_fmap {
 		.fmap_ver_major = FMAP_VER_MAJOR,
 		.fmap_ver_minor = FMAP_VER_MINOR,
 		.fmap_base = CONFIG_FLASH_BASE,
-		/* NOTE: EC implementation reserves one bank for itself */
-		.fmap_size = CONFIG_FLASH_SIZE - CONFIG_FLASH_BANK_SIZE,
+		.fmap_size = CONFIG_FLASH_SIZE,
 		.fmap_name = "EC_FMAP",
 		.fmap_nareas = NUM_EC_FMAP_AREAS,
 	},
@@ -58,8 +56,8 @@ const struct _ec_fmap {
 	/* RO Firmware */
 		{
 			.area_name = "RO_SECTION",
-			.area_offset = CONFIG_FW_RO_OFF,
-			.area_size = CONFIG_FW_IMAGE_SIZE,
+			.area_offset = CONFIG_SECTION_RO_OFF,
+			.area_size = CONFIG_SECTION_RO_SIZE,
 			.area_flags = FMAP_AREA_STATIC | FMAP_AREA_RO,
 		},
 		{
@@ -91,7 +89,7 @@ const struct _ec_fmap {
 		{
 			/* A dummy region to identify it as EC firmware */
 			.area_name = "EC_IMAGE",
-			.area_offset = CONFIG_FW_RO_OFF,
+			.area_offset = CONFIG_SECTION_RO_OFF,
 			.area_size = 0, /* Always zero */
 			.area_flags = FMAP_AREA_STATIC | FMAP_AREA_RO,
 		},
@@ -99,31 +97,32 @@ const struct _ec_fmap {
 			/* The range for write protect, for lagecy firmware
 			 * updater. Should be identical to 'WP_RO'. */
 			.area_name = "EC_RO",
-			.area_offset = CONFIG_FW_RO_OFF,
-			.area_size = CONFIG_FW_IMAGE_SIZE,
+			.area_offset = CONFIG_SECTION_RO_OFF,
+			.area_size = CONFIG_SECTION_RO_SIZE,
 			.area_flags = FMAP_AREA_STATIC | FMAP_AREA_RO,
 		},
 		{
 			/* The range for autoupdate to update A/B at once. */
 			.area_name = "EC_RW",
-			.area_offset = CONFIG_FW_A_OFF,
-			.area_size = CONFIG_FW_IMAGE_SIZE * 2,
+			.area_offset = CONFIG_SECTION_A_OFF,
+			.area_size = CONFIG_SECTION_A_SIZE
+					+ CONFIG_SECTION_B_SIZE,
 			.area_flags = FMAP_AREA_STATIC | FMAP_AREA_RO,
 		},
 		{
 			/* The range for write protect, for factory finalize
 			 * test case. Should be identical to 'EC_RO'. */
 			.area_name = "WP_RO",
-			.area_offset = CONFIG_FW_RO_OFF,
-			.area_size = CONFIG_FW_IMAGE_SIZE,
+			.area_offset = CONFIG_SECTION_RO_OFF,
+			.area_size = CONFIG_SECTION_RO_SIZE,
 			.area_flags = FMAP_AREA_STATIC | FMAP_AREA_RO,
 		},
 
 		/* Firmware A */
 		{
 			.area_name = "RW_SECTION_A",
-			.area_offset = CONFIG_FW_A_OFF,
-			.area_size = CONFIG_FW_IMAGE_SIZE,
+			.area_offset = CONFIG_SECTION_A_OFF,
+			.area_size = CONFIG_SECTION_A_SIZE,
 			.area_flags = FMAP_AREA_STATIC,
 		},
 		{
@@ -141,15 +140,15 @@ const struct _ec_fmap {
 		{
 			.area_name = "VBLOCK_A",
 			.area_offset = CONFIG_VBLOCK_A_OFF,
-			.area_size = CONFIG_VBLOCK_A_SIZE,
+			.area_size = CONFIG_VBLOCK_SIZE,
 			.area_flags = FMAP_AREA_STATIC,
 		},
 
 		/* Firmware B */
 		{
 			.area_name = "RW_SECTION_B",
-			.area_offset = CONFIG_FW_B_OFF,
-			.area_size = CONFIG_FW_IMAGE_SIZE,
+			.area_offset = CONFIG_SECTION_B_OFF,
+			.area_size = CONFIG_SECTION_B_SIZE,
 			.area_flags = FMAP_AREA_STATIC,
 		},
 		{
@@ -167,7 +166,7 @@ const struct _ec_fmap {
 		{
 			.area_name = "VBLOCK_B",
 			.area_offset = CONFIG_VBLOCK_B_OFF,
-			.area_size = CONFIG_VBLOCK_B_SIZE,
+			.area_size = CONFIG_VBLOCK_SIZE,
 			.area_flags = FMAP_AREA_STATIC,
 		},
 	}
diff --git a/common/system_common.c b/common/system_common.c
index 2cdbf0e626..8e71052b23 100644
--- a/common/system_common.c
+++ b/common/system_common.c
@@ -164,18 +164,21 @@ const char *system_get_reset_cause_string(void)
 
 enum system_image_copy_t system_get_image_copy(void)
 {
-	int copy = ((uint32_t)system_get_image_copy - CONFIG_FLASH_BASE) /
-		   CONFIG_FW_IMAGE_SIZE;
-	switch (copy) {
-	case 0:
+	uint32_t my_addr = (uint32_t)system_get_image_copy;
+
+	if (my_addr >= CONFIG_SECTION_RO_OFF &&
+	    my_addr < (CONFIG_SECTION_RO_OFF + CONFIG_SECTION_RO_SIZE))
 		return SYSTEM_IMAGE_RO;
-	case 1:
+
+	if (my_addr >= CONFIG_SECTION_A_OFF &&
+	    my_addr < (CONFIG_SECTION_A_OFF + CONFIG_SECTION_A_SIZE))
 		return SYSTEM_IMAGE_RW_A;
-	case 2:
+
+	if (my_addr >= CONFIG_SECTION_B_OFF &&
+	    my_addr < (CONFIG_SECTION_B_OFF + CONFIG_SECTION_B_SIZE))
 		return SYSTEM_IMAGE_RW_B;
-	default:
-		return SYSTEM_IMAGE_UNKNOWN;
-	}
+
+	return SYSTEM_IMAGE_UNKNOWN;
 }
 
 
@@ -184,10 +187,25 @@ enum system_image_copy_t system_get_image_copy(void)
  * We only care the runtime code since the EC is running over it.
  * We don't care about the vector table, FMAP, and init code. */
 int system_unsafe_to_overwrite(uint32_t offset, uint32_t size) {
-	int copy = ((uint32_t)system_unsafe_to_overwrite - CONFIG_FLASH_BASE) /
-	           CONFIG_FW_IMAGE_SIZE;
-	uint32_t r_offset = copy * CONFIG_FW_IMAGE_SIZE;
-	uint32_t r_size = CONFIG_FW_IMAGE_SIZE;
+	uint32_t r_offset;
+	uint32_t r_size;
+
+	switch (system_get_image_copy()) {
+	case SYSTEM_IMAGE_RO:
+		r_offset = CONFIG_FW_RO_OFF;
+		r_size = CONFIG_FW_RO_SIZE;
+		break;
+	case SYSTEM_IMAGE_RW_A:
+		r_offset = CONFIG_FW_A_OFF;
+		r_size = CONFIG_FW_A_SIZE;
+		break;
+	case SYSTEM_IMAGE_RW_B:
+		r_offset = CONFIG_FW_B_OFF;
+		r_size = CONFIG_FW_B_SIZE;
+		break;
+	default:
+		return 0;
+	}
 
 	if ((offset >= r_offset && offset < (r_offset + r_size)) ||
 	    (r_offset >= offset && r_offset < (offset + size)))
@@ -251,6 +269,23 @@ static uint32_t get_base(enum system_image_copy_t copy)
 	}
 }
 
+/* Return the size of the image copy, or 0 if error. */
+static uint32_t get_size(enum system_image_copy_t copy)
+{
+	switch (copy) {
+	case SYSTEM_IMAGE_RO:
+		return CONFIG_FW_RO_SIZE;
+	case SYSTEM_IMAGE_RW_A:
+		return CONFIG_FW_A_SIZE;
+#ifndef CONFIG_NO_RW_B
+	case SYSTEM_IMAGE_RW_B:
+		return CONFIG_FW_B_SIZE;
+#endif
+	default:
+		return 0;
+	}
+}
+
 
 int system_run_image_copy(enum system_image_copy_t copy,
 			  int recovery_required)
@@ -273,7 +308,7 @@ int system_run_image_copy(enum system_image_copy_t copy,
 
 	/* Make sure the reset vector is inside the destination image */
 	init_addr = *(uint32_t *)(base + 4);
-	if (init_addr < base || init_addr >= base + CONFIG_FW_IMAGE_SIZE)
+	if (init_addr < base || init_addr >= base + get_size(copy))
 		return EC_ERROR_UNKNOWN;
 
 	CPRINTF("[%T Jumping to image %s]\n", image_names[copy]);
diff --git a/common/vboot.c b/common/vboot.c
index 429170d224..c3825c11c9 100644
--- a/common/vboot.c
+++ b/common/vboot.c
@@ -142,7 +142,7 @@ int vboot_init(void)
 
 	ts1 = get_time();
 	r = good_image((uint8_t *)CONFIG_VBOOT_ROOTKEY_OFF,
-		       (uint8_t *)CONFIG_VBLOCK_A_OFF, CONFIG_VBLOCK_A_SIZE,
+		       (uint8_t *)CONFIG_VBLOCK_A_OFF, CONFIG_VBLOCK_SIZE,
 		       (uint8_t *)CONFIG_FW_A_OFF, CONFIG_FW_A_SIZE);
 	ts2 = get_time();
 
@@ -170,7 +170,7 @@ int vboot_init(void)
 
 	ts1 = get_time();
 	r = good_image((uint8_t *)CONFIG_VBOOT_ROOTKEY_OFF,
-		       (uint8_t *)CONFIG_VBLOCK_B_OFF, CONFIG_VBLOCK_B_SIZE,
+		       (uint8_t *)CONFIG_VBLOCK_B_OFF, CONFIG_VBLOCK_SIZE,
 		       (uint8_t *)CONFIG_FW_B_OFF, CONFIG_FW_B_SIZE);
 	ts2 = get_time();
 
diff --git a/core/cortex-m/ec.lds.S b/core/cortex-m/ec.lds.S
index 12406aa3f9..910b254f75 100644
--- a/core/cortex-m/ec.lds.S
+++ b/core/cortex-m/ec.lds.S
@@ -4,16 +4,19 @@
  */
 #include "config.h"
 
-#define CONFIG_FW_SECT_OFF(section) CONFIG_FW_##section##_OFF
-#define CONFIG_FW_BASE(section) (CONFIG_FLASH_BASE + CONFIG_FW_SECT_OFF(section))
-#define CONFIG_FMAP_BASE(section) CONFIG_FW_BASE(section) + CONFIG_FMAP_OFF
+#define FW_OFF_(section) CONFIG_FW_##section##_OFF
+#define FW_OFF(section) FW_OFF_(section)
+
+#define FW_SIZE_(section) CONFIG_FW_##section##_SIZE
+#define FW_SIZE(section) FW_SIZE_(section)
+
 
 OUTPUT_FORMAT("elf32-littlearm", "elf32-littlearm", "elf32-littlearm")
 OUTPUT_ARCH(arm)
 ENTRY(reset)
 MEMORY
 {
-    FLASH (rx) : ORIGIN = CONFIG_FW_BASE(SECTION), LENGTH = CONFIG_FW_IMAGE_SIZE
+    FLASH (rx) : ORIGIN = FW_OFF(SECTION), LENGTH = FW_SIZE(SECTION)
     IRAM (rw)  : ORIGIN = CONFIG_RAM_BASE, LENGTH = CONFIG_RAM_SIZE
 }
 SECTIONS
@@ -82,7 +85,11 @@ SECTIONS
 
         . = ALIGN(4);
         *(.rodata*)
-        . = ALIGN(4);
+
+#if defined(SECTION_IS_RO) && defined(CONFIG_VBOOT)
+        . = ALIGN(64);
+        *(.google)
+#endif
 #ifdef COMPILE_FOR_RAM
     } > IRAM
     __ro_end = . ;
@@ -101,11 +108,17 @@ SECTIONS
         . = ALIGN(4);
         __data_end = .;
     } > IRAM
-#if defined(SECTION_IS_RO) && defined(CONFIG_VBOOT)
-    .google CONFIG_FMAP_BASE(SECTION) : AT(CONFIG_FMAP_BASE(SECTION)) {
-        *(.google)
-    } > FLASH
-#else
+    /* The linker won't notice if the .data section is too big to fit,
+     * apparently because we're sending it into IRAM, not FLASH. The following
+     * symbol isn't used by the code, but running "objdump -t *.elf | grep hey"
+     * will let us check how much flash space we're actually using. The
+     * explicit ASSERT afterwards will cause the linker to abort if we use too
+     * much. */
+    __hey_flash_used = LOADADDR(.data) + SIZEOF(.data) - FW_OFF(SECTION);
+    ASSERT(FW_SIZE(SECTION) >
+                 (LOADADDR(.data) + SIZEOF(.data) - FW_OFF(SECTION)),
+                 "No room left in the flash")
+#if !(defined(SECTION_IS_RO) && defined(CONFIG_VBOOT))
     /DISCARD/ : {
               *(.google)
               }