diff --git a/CMakeLists.txt b/CMakeLists.txt
index 841dcb60e49..54c5611cf00 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -628,18 +628,22 @@ process_all_directory_romfs()
 # Get linker script to use
 get_property(ldscript GLOBAL PROPERTY LD_SCRIPT)
 
-# Pre-compile linker script
+# Pre-compile linker script(s)
 if(NOT CONFIG_ARCH_SIM)
-  get_filename_component(LD_SCRIPT_NAME ${ldscript} NAME)
-  set(LD_SCRIPT_TMP "${CMAKE_BINARY_DIR}/${LD_SCRIPT_NAME}.tmp")
+  set(ldscript_tmp_list)
+  foreach(ld ${ldscript})
+    get_filename_component(LD_SCRIPT_NAME ${ld} NAME)
+    set(LD_SCRIPT_TMP "${CMAKE_BINARY_DIR}/${LD_SCRIPT_NAME}.tmp")
 
-  nuttx_generate_preprocess_target(SOURCE_FILE ${ldscript} TARGET_FILE
-                                   ${LD_SCRIPT_TMP})
+    nuttx_generate_preprocess_target(SOURCE_FILE ${ld} TARGET_FILE
+                                     ${LD_SCRIPT_TMP})
 
-  add_custom_target(ldscript_tmp DEPENDS ${LD_SCRIPT_TMP})
-  add_dependencies(nuttx ldscript_tmp)
+    add_custom_target(ldscript_tmp_${LD_SCRIPT_NAME} DEPENDS ${LD_SCRIPT_TMP})
+    add_dependencies(nuttx ldscript_tmp_${LD_SCRIPT_NAME})
 
-  set(ldscript ${LD_SCRIPT_TMP})
+    list(APPEND ldscript_tmp_list -T ${LD_SCRIPT_TMP})
+  endforeach()
+  set(ldscript ${ldscript_tmp_list})
 endif()
 
 # Perform link
@@ -679,7 +683,6 @@ if(NOT CONFIG_ARCH_SIM)
     target_link_libraries(
       nuttx
       PRIVATE ${NUTTX_EXTRA_FLAGS}
-              -T
               ${ldscript}
               $<$<NOT:$<BOOL:${DISABLE_LINK_GROUP}>>:-Wl,--start-group>
               ${nuttx_libs}
@@ -811,14 +814,19 @@ if(CONFIG_BUILD_PROTECTED)
 
   get_property(user_ldscript GLOBAL PROPERTY LD_SCRIPT_USER)
 
-  # Pre-compile linker script
-  get_filename_component(LD_SCRIPT_USER_NAME ${user_ldscript} NAME)
-  set(LD_SCRIPT_USER_TMP "${CMAKE_BINARY_DIR}/${LD_SCRIPT_USER_NAME}.tmp")
-  nuttx_generate_preprocess_target(SOURCE_FILE ${user_ldscript} TARGET_FILE
-                                   ${LD_SCRIPT_USER_TMP})
-  add_custom_target(user_ldscript_tmp DEPENDS ${LD_SCRIPT_USER_TMP})
-  add_dependencies(nuttx_user user_ldscript_tmp)
-  set(user_ldscript ${LD_SCRIPT_USER_TMP})
+  # Pre-compile linker script(s)
+  set(user_ldscript_tmp_list)
+  foreach(ldscript ${user_ldscript})
+    get_filename_component(LD_SCRIPT_USER_NAME ${ldscript} NAME)
+    set(LD_SCRIPT_USER_TMP "${CMAKE_BINARY_DIR}/${LD_SCRIPT_USER_NAME}.tmp")
+    nuttx_generate_preprocess_target(SOURCE_FILE ${ldscript} TARGET_FILE
+                                     ${LD_SCRIPT_USER_TMP})
+    add_custom_target(user_ldscript_tmp_${LD_SCRIPT_USER_NAME}
+                      DEPENDS ${LD_SCRIPT_USER_TMP})
+    add_dependencies(nuttx_user user_ldscript_tmp_${LD_SCRIPT_USER_NAME})
+    list(APPEND user_ldscript_tmp_list -T ${LD_SCRIPT_USER_TMP})
+  endforeach()
+  set(user_ldscript ${user_ldscript_tmp_list})
 
   # reset link options that don't fit userspace
   get_target_property(nuttx_user_LINK_OPTIONS nuttx_user LINK_OPTIONS)
@@ -848,8 +856,7 @@ if(CONFIG_BUILD_PROTECTED)
 
   target_link_libraries(
     nuttx_user
-    PRIVATE -T
-            ${user_ldscript}
+    PRIVATE ${user_ldscript}
             $<$<NOT:$<BOOL:${DISABLE_LINK_GROUP}>>:-Wl,--start-group>
             ${nuttx_system_libs}
             ${nuttx_apps_libs}
diff --git a/boards/arm/stm32/stm32f4discovery/configs/kostest/Make.defs b/boards/arm/stm32/stm32f4discovery/configs/kostest/Make.defs
new file mode 100644
index 00000000000..8905673c979
--- /dev/null
+++ b/boards/arm/stm32/stm32f4discovery/configs/kostest/Make.defs
@@ -0,0 +1,42 @@
+############################################################################
+# boards/arm/stm32/stm32f4discovery/configs/kostest/Make.defs
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements.  See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.  The
+# ASF licenses this file to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance with the
+# License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.  See the
+# License for the specific language governing permissions and limitations
+# under the License.
+#
+############################################################################
+
+include $(TOPDIR)/.config
+include $(TOPDIR)/tools/Config.mk
+include $(TOPDIR)/arch/arm/src/armv7-m/Toolchain.defs
+
+LDSCRIPT1 = memory.ld
+LDSCRIPT2 = kernel-space.ld
+
+ARCHSCRIPT += $(BOARD_DIR)$(DELIM)scripts$(DELIM)$(LDSCRIPT1)
+ARCHSCRIPT += $(BOARD_DIR)$(DELIM)scripts$(DELIM)$(LDSCRIPT2)
+
+ARCHPICFLAGS = -fpic -msingle-pic-base -mpic-register=r10
+
+CFLAGS := $(ARCHCFLAGS) $(ARCHOPTIMIZATION) $(ARCHCPUFLAGS) $(ARCHINCLUDES) $(ARCHDEFINES) $(EXTRAFLAGS)
+CPICFLAGS = $(ARCHPICFLAGS) $(CFLAGS)
+CXXFLAGS := $(ARCHCXXFLAGS) $(ARCHOPTIMIZATION) $(ARCHCPUFLAGS) $(ARCHXXINCLUDES) $(ARCHDEFINES) $(EXTRAFLAGS)
+CXXPICFLAGS = $(ARCHPICFLAGS) $(CXXFLAGS)
+CPPFLAGS := $(ARCHINCLUDES) $(ARCHDEFINES) $(EXTRAFLAGS)
+AFLAGS := $(CFLAGS) -D__ASSEMBLY__
+
+NXFLATLDFLAGS1 = -r -d -warn-common
+NXFLATLDFLAGS2 = $(NXFLATLDFLAGS1) -T$(TOPDIR)/binfmt/libnxflat/gnu-nxflat-pcrel.ld -no-check-sections
+LDNXFLATFLAGS = -e main -s 2048
diff --git a/boards/arm/stm32/stm32f4discovery/configs/kostest/defconfig b/boards/arm/stm32/stm32f4discovery/configs/kostest/defconfig
index c5ee7e18d9a..a3c0680c14b 100644
--- a/boards/arm/stm32/stm32f4discovery/configs/kostest/defconfig
+++ b/boards/arm/stm32/stm32f4discovery/configs/kostest/defconfig
@@ -5,7 +5,6 @@
 # You can then do "make savedefconfig" to generate a new defconfig file that includes your
 # modifications.
 #
-# CONFIG_ARCH_FPU is not set
 CONFIG_ARCH="arm"
 CONFIG_ARCH_BOARD="stm32f4discovery"
 CONFIG_ARCH_BOARD_STM32F4_DISCOVERY=y
@@ -23,8 +22,10 @@ CONFIG_DEBUG_HARDFAULT_ALERT=y
 CONFIG_DEBUG_SYMBOLS=y
 CONFIG_DISABLE_ENVIRON=y
 CONFIG_DISABLE_MOUNTPOINT=y
+CONFIG_IDLETHREAD_STACKSIZE=2048
 CONFIG_INIT_ENTRYPOINT="ostest_main"
 CONFIG_INTELHEX_BINARY=y
+CONFIG_MM_KERNEL_HEAPSIZE=16384
 CONFIG_MM_REGIONS=2
 CONFIG_NUTTX_USERSPACE=0x08020000
 CONFIG_PASS1_BUILDIR="boards/arm/stm32/stm32f4discovery/kernel"
@@ -38,6 +39,7 @@ CONFIG_STACK_COLORATION=y
 CONFIG_START_DAY=22
 CONFIG_START_MONTH=3
 CONFIG_START_YEAR=2013
+CONFIG_STM32_CCMEXCLUDE=y
 CONFIG_STM32_JTAG_SW_ENABLE=y
 CONFIG_STM32_USART2=y
 CONFIG_SYMTAB_ORDEREDBYNAME=y
diff --git a/boards/arm/stm32/stm32f4discovery/kernel/CMakeLists.txt b/boards/arm/stm32/stm32f4discovery/kernel/CMakeLists.txt
index ce2f7aa2bfa..9691ef02692 100644
--- a/boards/arm/stm32/stm32f4discovery/kernel/CMakeLists.txt
+++ b/boards/arm/stm32/stm32f4discovery/kernel/CMakeLists.txt
@@ -20,4 +20,4 @@
 #
 # ##############################################################################
 
-nuttx_add_aux_library(userspace stm32_userspace.c)
+target_sources(nuttx_user PRIVATE stm32_userspace.c)
diff --git a/boards/arm/stm32/stm32f4discovery/scripts/memory.ld b/boards/arm/stm32/stm32f4discovery/scripts/memory.ld
index 7296ff33894..d82501ffb65 100644
--- a/boards/arm/stm32/stm32f4discovery/scripts/memory.ld
+++ b/boards/arm/stm32/stm32f4discovery/scripts/memory.ld
@@ -57,18 +57,19 @@
  *
  * A detailed memory map for the 112KB SRAM region is as follows:
  *
- *   0x20000 0000:  Kernel .data region.  Typical size: 0.1KB
- *   ------- ----   Kernel .bss  region.  Typical size: 1.8KB
- *   0x20000 0800:  Kernel IDLE thread stack (approximate).  Size is
- *                  determined by CONFIG_IDLETHREAD_STACKSIZE and
- *                  adjustments for alignment.  Typical is 1KB.
- *   ------- ----   Padded to 4KB
- *   0x20000 1000:  User .data region.  Size is variable.
- *   ------- ----   User .bss region  Size is variable.
- *   0x20000 2000:  Beginning of kernel heap.  Size determined by
- *                  CONFIG_MM_KERNEL_HEAPSIZE.
- *   ------- ----   Beginning of user heap.  Can vary with other settings.
- *   0x20001 c000:  End+1 of CPU RAM
+ *   0x2000 0000:  Kernel .data region.  Typical size: 0.1KB
+ *   ------ ----   Kernel .bss  region.  Typical size: 1.8KB
+ *   0x2000 0800:  Kernel IDLE thread stack (approximate).  Size is
+ *                 determined by CONFIG_IDLETHREAD_STACKSIZE and
+ *                 adjustments for alignment.  Typical is 1KB.
+ *   ------ ----   Padded to 8KB
+ *   0x2000 2000:  User .data region.  Size is variable.
+ *   ------ ----   User .bss region  Size is variable.
+ *   0x2000 4000:  Beginning of kernel heap.  Size determined by
+ *                 CONFIG_MM_KERNEL_HEAPSIZE which must be set to 16Kb.
+ *   0x2000 8000:  Beginning of 32Kb user heap.
+ *   0x2001 0000:  The remainder of SRAM is, unfortunately, wasted.
+ *   0x2001 c000:  End+1 of CPU RAM
  */
 
 MEMORY
@@ -81,7 +82,7 @@ MEMORY
 
     /* 112Kb of contiguous SRAM */
 
-  ksram (rwx)      : ORIGIN = 0x20000000, LENGTH = 4K
-  usram (rwx)      : ORIGIN = 0x20001000, LENGTH = 4K
-  xsram (rwx)      : ORIGIN = 0x20002000, LENGTH = 104K
+  ksram (rwx)      : ORIGIN = 0x20000000, LENGTH = 16K
+  usram (rwx)      : ORIGIN = 0x20004000, LENGTH = 16K
+  xsram (rwx)      : ORIGIN = 0x20008000, LENGTH = 80K
 }
diff --git a/boards/arm/stm32/stm32f4discovery/scripts/user-space.ld b/boards/arm/stm32/stm32f4discovery/scripts/user-space.ld
index b49efe6e7f6..b237e8b15d1 100644
--- a/boards/arm/stm32/stm32f4discovery/scripts/user-space.ld
+++ b/boards/arm/stm32/stm32f4discovery/scripts/user-space.ld
@@ -24,11 +24,24 @@
  * this script.
  */
 
+/* Make sure that the critical memory management functions are in user-space.
+ * the user heap memory manager will reside in user-space but be usable both
+ * by kernel- and user-space code
+ */
+
+EXTERN(umm_initialize)
+EXTERN(umm_addregion)
+
+EXTERN(malloc)
+EXTERN(realloc)
+EXTERN(zalloc)
+EXTERN(free)
+
 OUTPUT_ARCH(arm)
 SECTIONS
 {
     .userspace : {
-        *(.userspace)
+        KEEP(*(.userspace))
     } > uflash
 
     .text : {
diff --git a/boards/arm/stm32/stm32f4discovery/src/CMakeLists.txt b/boards/arm/stm32/stm32f4discovery/src/CMakeLists.txt
index 60217b1bf60..2784309d2c1 100644
--- a/boards/arm/stm32/stm32f4discovery/src/CMakeLists.txt
+++ b/boards/arm/stm32/stm32f4discovery/src/CMakeLists.txt
@@ -177,8 +177,13 @@ endif()
 
 target_sources(board PRIVATE ${SRCS})
 
-# TODO: make this the default and then allow boards to redefine
-set_property(GLOBAL PROPERTY LD_SCRIPT "${NUTTX_BOARD_DIR}/scripts/ld.script")
+# Set linker script based on build type
+if(CONFIG_BUILD_PROTECTED)
+  set_property(GLOBAL PROPERTY LD_SCRIPT "${NUTTX_BOARD_DIR}/scripts/memory.ld"
+                               "${NUTTX_BOARD_DIR}/scripts/kernel-space.ld")
+else()
+  set_property(GLOBAL PROPERTY LD_SCRIPT "${NUTTX_BOARD_DIR}/scripts/ld.script")
+endif()
 
 # TODO:move this to appropriate arch/toolchain level
 set_property(
@@ -195,11 +200,13 @@ set_property(
 # -funwind-tables ARCHCXXFLAGS += -fno-rtti -funwind-tables ifneq
 # ($(CONFIG_DEBUG_NOOPT),y) ARCHOPTIMIZATION += -fno-strength-reduce endif endif
 
-set_property(
-  TARGET nuttx
-  APPEND
-  PROPERTY NUTTX_COMPILE_OPTIONS -funwind-tables)
-set_property(GLOBAL APPEND PROPERTY COMPILE_OPTIONS -fno-strength-reduce)
+if(CONFIG_UNWINDER_ARM)
+  set_property(
+    TARGET nuttx
+    APPEND
+    PROPERTY NUTTX_COMPILE_OPTIONS -funwind-tables)
+  set_property(GLOBAL APPEND PROPERTY COMPILE_OPTIONS -fno-strength-reduce)
+endif()
 
 # TODO: nxflat NXFLATLDFLAGS1 = -r -d -warn-common NXFLATLDFLAGS2 =
 # $(NXFLATLDFLAGS1) -T$(TOPDIR)/binfmt/libnxflat/gnu-nxflat-pcrel.ld