The remote CPU's IPI handler wrote into the caller's buffer directly,
which may not be reachable from the target CPU's address environment
under CONFIG_ARCH_ADDRENV.
Signed-off-by: liang.huang <liang.huang@houmo.ai>
Documents the configuration for the barometer dashboard example, and
explains how to set up a fake barometer to test it.
Signed-off-by: Matteo Golin <matteo.golin@gmail.com>
Users can try the barometer dashboard example on the simulator. The
recommended way of simulating the barometer is using uorb_generator,
like in the following command:
uorb_generator -n 10000 -r 1 -s -t sensor_baro0 timestamp:23191100,pressure:999.12,temperature:26.34 &
Signed-off-by: Matteo Golin <matteo.golin@gmail.com>
Adds a new configuration which allows users to try the barometer
monitoring example with a connected barometer over I2C.
Signed-off-by: Matteo Golin <matteo.golin@gmail.com>
Documents how to use the baromonitor example, shows its visualization
and explains its default behaviour.
Signed-off-by: Matteo Golin <matteo.golin@gmail.com>
A crash was observed when running ps: a BusFault in nxtask_argvstr
dereferencing tl_argv, because a thread's stack overflow had silently
corrupted the TLS region where tl_argv resides.
On ARMv8-M with CONFIG_ARMV8M_STACKCHECK_HARDWARE, PSPLIM was set to
stack_alloc_ptr -- the bottom of the allocation where TLS begins. The
stack grows downward and TLS occupies [stack_alloc_ptr, stack_alloc_ptr
+ tls_info_size()), so an overflow crossed into TLS and clobbered
tl_argv before SP reached the limit, going undetected until code that
read the corrupted TLS data (such as ps) hit the bad pointer.
Set the limit to stack_alloc_ptr + tls_info_size() -- the top of the
TLS region and the usable stack base -- so an overflow faults at the
TLS boundary, before any TLS byte is touched. Include <tls/tls.h>
for the tls_info_size() macro, which is the value sched reserves for the
TLS region via up_stack_frame().
Signed-off-by: Junbo Zheng <zhengjunbo1@xiaomi.com>
dump_stacks() only checked kernelstack_sp != 0 || force, so for tasks
with no kernel stack (e.g. idle, kernelstack_base == 0) the force path
passed base 0 to dump_stackinfo() and dumped raw memory from address 0,
triggering a secondary fault that truncated the panic log. Guard with
kernelstack_base != 0.
Signed-off-by: liang.huang <liang.huang@houmo.ai>
Ignores Python defconfig from esp32p4-tab5 board.
Python builds are excluded due to its long build time.
Signed-off-by: Filipe Cavalcanti <filipe.cavalcanti@espressif.com>
Add NSH and OSTest configurations, the DRAM linker script, and the minimal board initialization and reset hooks for RK3588S.
Signed-off-by: Emre Cecanpunar <emreleno@gmail.com>
Drop the esp32c3-devkit:dropbear defconfig and its documentation.
The companion apps#3636 (Dropbear over /dev/crypto for this board)
is stuck on an unrelated Espressif CI dependency issue, and the
port is moving to different hardware.
Signed-off-by: Felipe Moura <moura.fmo@gmail.com>
Document the new stm32f746g-disco:dropbear configuration, mirroring
the existing esp32c3-devkit Dropbear documentation.
Signed-off-by: Felipe Moura <moura.fmo@gmail.com>
Add a stm32f746g-disco:dropbear config for NSH over SSH on the
board's Ethernet, with the password file and Dropbear host key
persisted on QSPI flash (LittleFS) instead of RAM.
Signed-off-by: Felipe Moura <moura.fmo@gmail.com>
Add a LittleFS mount option for the on-board N25Q QSPI flash,
mirroring the existing NXFFS/LittleFS toggle already used by the
sibling stm32_w25q.c driver. Needed because NXFFS does not support
rename(), which the companion Dropbear config depends on.
Signed-off-by: Felipe Moura <moura.fmo@gmail.com>
ice40_endwrite() computes how many dummy SPI bytes to clock out after
the bitstream to finish FPGA configuration with:
for (size_t i = 0; i < ICE40_SPI_FINAL_CLK_CYCLES + 7 / 8; i++)
`/` binds tighter than `+` in C, so this parses as
ICE40_SPI_FINAL_CLK_CYCLES + (7 / 8) = 160 + 0 = 160, i.e. the "+ 7 / 8"
is a silent no-op. The macro name and the classic `(n + 7) / 8`
ceiling-division idiom (used elsewhere in embedded code to convert a
bit/cycle count into a byte count) make clear the intent was to send
ceil(ICE40_SPI_FINAL_CLK_CYCLES / 8) = 20 bytes (160 SPI clock cycles,
matching the macro name). Instead the unmodified code sends 160 bytes,
i.e. 1280 clock cycles - 8x more than intended.
Fix by parenthesizing the ceiling-division: (ICE40_SPI_FINAL_CLK_CYCLES
+ 7) / 8, which evaluates to 20, restoring the intended 160-clock-cycle
finalization sequence.
Fixes#19367
Assisted-by: Claude Code:claude-sonnet-5
Signed-off-by: yi chen <94xhn1@gmail.com>
riscv_fault_handler() only checked the task type and SYSCALL flag, so a
fault taken inside an interrupt handler (running in kernel mode) was
blamed on the user task that happened to be interrupted and killed with
SIGSEGV, hiding the real kernel bug. Use the STATUS_PPP bit of the trap
frame to tell whether the fault originated from user mode: only then is
it safe to kill the task.
Signed-off-by: liang.huang <liang.huang@houmo.ai>
If user passes NULL as buffer, the driver may crash. This is problematic
for NuttX protected and kernel builds.
Details in the issue: https://github.com/apache/nuttx/issues/19473
While this fixes the issue with a typical NULL pointer, fundamentally this
will be addressed with the implementation of access_ok().
https://man7.org/linux/man-pages/man2/access.2.html
Signed-off-by: Catalin Visinescu <catalin_visinescu@yahoo.com>
Building Zig applications on sim:x86_64 with Zig 0.13.0 fails because
the generated target "x86_64-freestanding-sysv" is not recognized by
Zig. Introduce a Zig-specific ABI mapping that translates "sysv" to
"gnu" without affecting other toolchains.
After correcting the target ABI, linking still fails due to unresolved
references to __zig_probe_stack. Add -fcompiler-rt so Zig includes the
required compiler runtime during linking.
Verified on sim:nsh with CONFIG_EXAMPLES_HELLO_ZIG=y:
nsh> hello_zig
[sim]: Hello, Zig!
Fixes#19475
Signed-off-by: Ansh Rai <anshrai331@gmail.com>
Dropbear's NSH PTY session reaps the child task with waitpid() and needs
CONFIG_SCHED_CHILD_STATUS (which depends on SCHED_HAVE_PARENT). Without it
the session fails with ECHILD right after authentication
("NSH session wait failed: Unknown error 10").
netutils/dropbear now "depends on SCHED_CHILD_STATUS" per the project's
depends-on-over-select policy (apache/nuttx-apps#3648), so enable it in the
sim and esp32c3-devkit Dropbear defconfigs (SCHED_HAVE_PARENT is already
enabled there).
Signed-off-by: Felipe Moura <moura.fmo@gmail.com>
qemu-rv's S-mode/non-SMP setintstack unconditionally reloaded sp to
the top of the per-cpu interrupt stack. A trap taken while already
running on that stack rewound sp back to the same address, so the
nested trap's frame overwrote the still-live outer trap's frame.
Port the bounds check already used by the canonical setintstack in
riscv_macros.S: only move sp when it is outside the interrupt stack
range.
Other vendor chip.h files have the same unconditional-reload pattern
and are left for a follow-up.
Signed-off-by: liang.huang <liang.huang@houmo.ai>
Dropbear's NSH PTY session reaps the child task with waitpid() and needs
CONFIG_SCHED_CHILD_STATUS, which depends on SCHED_HAVE_PARENT. The
netutils/dropbear Kconfig now depends on SCHED_HAVE_PARENT and selects
SCHED_CHILD_STATUS (apache/nuttx-apps#3648); set SCHED_HAVE_PARENT here so
the dropbear defconfig stays consistent and the session no longer fails
with ECHILD after authentication.
Signed-off-by: Felipe Moura <moura.fmo@gmail.com>
The MemBrowse analyze job intermittently failed unpacking the CI image
with "no space left on device". Free /usr/local/lib/android before the
docker pull, mirroring .github/workflows/build.yml.
Signed-off-by: Michael Rogov Papernov <michael@membrowse.com>
Introduce networking capabilities to the Creator CI20 board by leveraging
the pre-existing dm9000 ethernet driver.
To achieve this, the following changes were made:
- Integrated the jz4780 GPIO module to properly configure and enable the
interrupt pin required by the ethernet controller.
- Added `dm90x0.h` to export the dm9000 initialization function, allowing
the board-specific setup code to initialize the network interface.
Signed-off-by: Lwazi Dube <lwazeh@gmail.com>
When porting external projects to NuttX using uncrustify could help
to convert "alien code" (maybe we are the aliens) to NuttX coding
style.
Signed-off-by: Alan C. Assis <acassis@gmail.com>
Assisted-by: Hermes Agent using Deepseek-4-pro
Program names containing '-' (for example, renaming hello to
hello-world via PROGNAME) previously generated an invalid identifier
<NAME>_main when constructing the main= compiler definition and the
APP_MAIN target property used during builtin list generation. This
caused the CMake build to fail because '-' is not a valid character in
a C identifier.
This mirrors the Make-based fix (Application.mk's PROGSYM) for the
traditional build.
Introduce NAME_SYM, a sanitized copy of NAME with '-' replaced by '_',
and use it only where an internal C identifier is required: the
main= COMPILE_DEFINITIONS property and the APP_MAIN target property.
Leave NAME unchanged everywhere else, including CMake target/output
names and the APP_NAME property, where hyphens are valid.
The standalone/loadable executable path (MODULE/DYNLIB/kernel build)
does not rename main() and therefore requires no sanitization because
each executable is linked independently rather than merged into a
shared builtin image.
Testing (WSL2 Ubuntu, x86_64):
- BOARD_CONFIG=sim/nsh, CONFIG_EXAMPLES_HELLO_PROGNAME="hello-world":
clean CMake configure/build; 'hello-world' runs and prints
'Hello, World!!'
- Reverted to CONFIG_EXAMPLES_HELLO_PROGNAME="hello": reconfigured
and rebuilt; 'hello' runs and prints 'Hello, World!!' (no
regression)
Fixes#19447
Signed-off-by: Ansh Rai <anshrai331@gmail.com>
The make PREBUILD packed the fwlib/wifi static archives with `ar crs <a>
<objdir>/*.o`. The glob also picks up stale objects left in the obj dir from a
previous configuration (e.g. a renamed/removed SDK source), which can pull a
duplicate/old translation unit into the image (seen on RTL8720F as a spurious
ROM-overlay symbol from an old log.o). Accumulate the exact object list the
loop compiled and `ar` that instead, removing the archive first so it is
rebuilt from precisely the current sources.
Assisted-by: Claude Code:claude-opus-4-8
Signed-off-by: raul_chen <raul_chen@realsil.com.cn>
Each ameba IC pins its asdk (arm-none-eabi) version in the SDK
(component/soc/<soc>/project/CMakeLists.txt): RTL8720F needs 12.3.1 while
RTL8721Dx needs 10.3.1. Both share the same arm-none-eabi triple and differ
only by install directory. The make + cmake setup previously read only the
global default, so the NuttX objects for an IC pinning a newer asdk were built
with the wrong compiler (not the one its SDK archives were built with).
Resolve the version per-IC from a single helper (ameba_asdk_version.sh, keyed
by the SoC) used by every caller:
- toolchain.mk / ameba_board.mk: make picks the right asdk automatically
(it already knows the SoC), no user action.
- ameba_fetch_toolchain.sh: fetches the version the SoC pins.
- tools/ameba/env.sh: takes an optional board (`. tools/ameba/env.sh
<board>`) so cmake, which locks the compiler at project() time, gets the
matching asdk on PATH before it probes. No board -> the global default.
- ameba_sdk.cmake: fail configure with a fix-it message if the on-PATH
compiler is not the version this IC needs (e.g. a stale env from another
board), instead of silently mis-compiling.
Assisted-by: Claude Code:claude-opus-4-8
Signed-off-by: raul_chen <raul_chen@realsil.com.cn>
Without SCHED_WAITPID, NSH cannot waitpid() on a spawned builtin application,
so every foreground builtin (e.g. wapi) is run in the background and NSH echoes
"<cmd> [pid:priority]" instead of blocking until it finishes. Enable
CONFIG_SCHED_WAITPID (the setting used by the large majority of nsh defconfigs)
so foreground builtins run synchronously with a correct exit status and no
spurious [pid:priority] echo.
Assisted-by: Claude Code:claude-opus-4-8
Signed-off-by: raul_chen <raul_chen@realsil.com.cn>
Both Ameba WHC boards (pke8721daf, rtl8720f_evb) previously built only via the
make build; the board CMakeLists fell back to a FATAL_ERROR. Wire up the full
vendor-SDK machinery for CMake so `cmake --build` produces the same flashable
nuttx.bin as make, with no change to any shared/arch-common file:
- tools/ameba/env.sh: source it once before cmake. It resolves/auto-fetches
the ameba-rtos SDK + its pinned asdk toolchain (reusing the same helper
scripts the make build uses) and puts the toolchain on PATH, so cmake's
normal compiler probe finds it -- exactly like every other NuttX board's
toolchain. No per-chip hook is added to the shared arch Toolchain.cmake.
- common/ameba/cmake/ameba_sdk.cmake: resolve AMEBA_SDK + asdk dir from that
environment (fall back to the in-tree checkout) and sanity-check the
compiler; included by each arch chip CMakeLists before its SDK-relative
source lists.
- common/ameba/cmake/ameba_board.cmake: the shared mechanism -- autoconf,
libameba_fwlib.a / libameba_wifi.a compiled with the isolated SDK include
set, the image2 linker script, the image2 link flags + EXTRA_LIBS, nuttx.bin
packaging and the flash target. Per-IC inputs are set by each arch chip
CMakeLists.
- common/ameba/tools/{ameba_gen_ldscript,ameba_package,ameba_flash}.sh:
shared shell steps used by both the make and cmake paths so the two produce
identical output; tools/ameba/Config.mk now flashes via ameba_flash.sh too.
- Fix a latent rtl8720f CMakeLists source list bug (ameba_ipc.c was missing
for the WiFi / flash-fs configs).
The make build is unchanged (it still auto-fetches everything, so sourcing
env.sh is optional there and required only for cmake). Verified on hardware:
both boards build, flash and boot with WiFi over the CMake path.
Assisted-by: Claude Code:claude-opus-4-8
Signed-off-by: raul_chen <raul_chen@realsil.com.cn>
CI builds with -Werror and the board's build carried thousands of
warnings, all rooted in the vendor SDK integration:
- The NMSIS riscv_encoding.h redefines 32 CSR macros that NuttX's
<arch/csr.h> (pulled in through <nuttx/irq.h>) already defines with
its own encodings. No -Wno flag covers macro redefinitions, so the
SDK patch now undefines those names right before the NMSIS
definitions. Same treatment for COMPILE_TIME_ASSERT in
wifi_management.h.
- The vendor sources are not NuttX-warning-clean (undefined macros in
#if, %d for uint32_t, shadowed locals, K&R prototypes, ...); add the
matching -Wno suppressions scoped to this chip's build.
- Fix the port's own warnings properly: gd32vw55x_eclic.h redefined
CSR_MINTSTATUS with the Nuclei address (0x346) over the standard
CLIC one in csr.h (renamed to CSR_NUCLEI_MINTSTATUS), an unused
variable in gdwifi_transmit() and a dead function in
wrapper_nuttx.c.
All seven configurations now build with "-Wno-cpp -Werror" (the CI
flags). Smoke-validated on hardware: Wi-Fi WPA2 association and ping,
BLE advertising, connect and GATT write.
Assisted-by: Claude Opus 4.8
Signed-off-by: Jorge Guzman <jorge.gzm@gmail.com>
A connection stops the legacy advertising set and the vendor stack
leaves it stopped, so after the first central connected (or aborted
the attempt) the device was never discoverable again until a reset.
Register a connection callback and restart the advertising set with
ble_adv_restart() on every disconnection event. This covers both the
clean disconnect and the aborted-connection case: an incomplete
connection holds the (single) link until the supervision timeout, and
its disconnection event then restarts the advertising the same way.
Validated on hardware (GD32VW553K-START): repeated
scan/connect/write/disconnect cycles from a Linux central all find the
device advertising again after the previous cycle, where it previously
required a reset after the first connection.
Assisted-by: Claude Opus 4.8
Signed-off-by: Jorge Guzman <jorge.gzm@gmail.com>
Associating to a WPA3 (SAE) network faulted inside the prebuilt vendor
supplicant (load access fault in the elliptic-curve math of the SAE
handshake, wifi_mgmt task). The port is WPA2-only, so refuse what the
supplicant cannot complete:
- Undefine CONFIG_WPA3_SAE in the build_config.h shim. This activates
the vendor's own fallback in wifi_netlink.c: the SAE/OWE AKMs are
stripped from the connection config and the SAE auth algorithm is
never selected, so a WPA3-transition AP (WPA2/WPA3 mixed) now
associates through WPA2-PSK. The flag only gates code, not struct
layout, so the prebuilt libraries are unaffected.
- Refuse an SAE/OWE/802.1X-only network up front in the connect path
with ENOTSUP and a console message naming the unsupported AKM bitmap,
instead of an obscure association failure.
Validated on hardware (GD32VW553K-START), all three cases: a WPA2
network still associates (four-way handshake, DHCP, ping); a
WPA2/WPA3 transition hotspot ([RSN:WPA-PSK,SAE CCMP/CCMP][MFP])
associates through WPA2-PSK, gets a lease and pings the gateway
(it crashed before this change); and a WPA3-only hotspot is now
refused with
gdwifi: 'wpa3test' offers no supported AKM (bitmap 0x200): WPA3/SAE,
OWE and 802.1X are not supported, WPA2-PSK only
where it previously crashed.
Assisted-by: Claude Opus 4.8
Signed-off-by: Jorge Guzman <jorge.gzm@gmail.com>
Explain how drivertest applications are selected and run, list the current test categories, and document the watchdog reset and notifier test behavior.
Assisted-by: OpenAI Codex
Signed-off-by: hanzhijian <hanzhijian@zepp.com>
Provide per-instance capture automonitor lookup for watchdog lower halves
that pass callback context, and avoid selecting an unrelated watchdog when
legacy lower halves provide no context. Update STM32 WWDG lower halves to pass
their instance context so multiple watchdog devices remain distinguishable.
Signed-off-by: hanzhijian <hanzhijian@zepp.com>
Assisted-by: OpenAI Codex
The NP and bootloader images are built from the vendored ameba-rtos SDK.
Rework how that sub-build is configured and driven:
- Materialize the SDK menuconfig once, guarded by a stamp (SDK revision +
board overlay). A no-change rebuild no longer rewrites the SDK .config, so
the SDK stops reconfiguring and recompiling most of the NP image every time;
only the AP-driven "noused" file is regenerated. (ameba_sdk_config.sh)
- Configure the SDK from a two-tier prj.conf-style overlay per board:
ameba_sdk.conf (user-editable) layered under ameba_sdk_force.conf (forced
options such as CONFIG_SHELL=n, always applied last and re-applied after an
edit), so options that must stay fixed cannot be overridden.
- Add "make ameba_menuconfig": edit the SDK options in the SDK's own native
menuconfig UI and save the diff back to the board overlay.
- Silence -Wint-conversion for the vendored SDK sources (both the NuttX fwlib
compile and the SDK NP/boot build): the SDK passes NULL to irq_register()'s
u32 "Data" argument in many places; the warning is suppressed for vendor
code instead of editing every call site.
Signed-off-by: raul_chen <raul_chen@realsil.com.cn>
blksize_t is currently defined as int16_t, which overflows when a
filesystem reports a block size larger than 32767 bytes. This causes
st_blksize to become zero, leading to an integer divide-by-zero when
st_blocks is calculated in stat().
Widen blksize_t to int32_t to support larger filesystem block sizes.
Update nuttx_blksize_t in include/nuttx/fs/hostfs.h to keep it
consistent with include/sys/types.h.
struct geometry.geo_sectorsize (include/nuttx/fs/ioctl.h) is also
typed blksize_t, so every debug print of that field using a 16-bit
format specifier is updated to PRId32 to match the new width:
drivers/misc/ramdisk.c, drivers/mmcsd/mmcsd_spi.c, drivers/mtd/ftl.c,
fs/driver/fs_blockmerge.c, drivers/mtd/smart.c,
drivers/usbhost/usbhost_storage.c, drivers/mmcsd/mmcsd_sdio.c,
arch/arm/src/s32k1xx/s32k1xx_eeeprom.c,
arch/arm/src/lc823450/lc823450_mmcl.c.
Signed-off-by: Ansh Rai <anshrai331@gmail.com>
Signed-off-by: root <root@LAPTOP-9C7LKDC5.localdomain>
New RISC-V chip port for the GigaDevice GD32VW55x (Nuclei N307, Wi-Fi 6
and BLE 5.3 combo), with the GD32VW553K-START board.
Core:
- ECLIC interrupt controller, clock tree (160 MHz / 40 MHz HXTAL),
64-bit machine timer, serial (USART0/UART1/UART2) and RTC.
- The instruction cache must be enabled in head.S or the UART drops
characters under load; the mask ROM uses the first 0x200 bytes of SRAM
so the image is linked at 0x20000200; the RTC needs PMU_CTL0.BKPWEN or
the register writes are silently discarded.
- The ECLIC only auto-clears the interrupt pending bit in hardware-vectored
mode, so the trap dispatch clears it for edge-triggered sources or they
re-fire forever (level-triggered peripherals clear their own).
Peripherals: DMA (8 channels), GPIO + EXTI, SPI (optional DMA), I2C0/I2C1
(the new STM32-v2-style IP, not the GD32F4 one), ADC, PWM and input
capture on the timers, both watchdogs, PROGMEM, TRNG and CRC. All use
the standard NuttX lower-half interfaces and direct register access, not
the vendor SPL. Three user LEDs (GPIOC), and a software reset through the
Nuclei SysTimer.
Internal flash: it is a system-in-package NOR die behind the real-time
decryption block, so it is not programmed through the FMC registers -- the
driver goes through the mask ROM API (rom_flash_*), the same way the
vendor code does. PROGMEM can be mounted as LittleFS; the region sits
below the Wi-Fi NVDS and must not overlap it.
Wi-Fi (wlan0), station and softAP:
- The MAC/PHY, RF and WPA supplicant are linked as prebuilt BSD-3
libraries. They are RTOS-agnostic, so the OS binding is a sys_* facade
on NuttX primitives (gdwifi/wrapper_nuttx.c). Critical sections mask by
ECLIC priority threshold, not by disabling every interrupt, or the MAC
misses its microsecond deadlines.
- The lwIP stack of the SDK is not used: the interface is a
netdev_lowerhalf driver driven by the standard tools (wapi, ifup, renew,
ping, dhcpd). EAPOL is handed to the supplicant instead of the IP
stack. The lowerhalf "priority" field is the work-queue id (HPWORK/
LPWORK), not a task priority -- a wrong value makes receive() never run
and every packet is dropped.
- The vendor gives the radio 32 KB of shared SRAM as an extra heap; this
needs CONFIG_MM_REGIONS >= 2 or the kernel silently drops the region.
- The DHCP client needs CONFIG_NETUTILS_DHCPC_BOOTP_FLAGS=0x8000 so the
server answers the OFFER by broadcast.
- softAP (wapi master mode -> wifi_management_ap_start): the single-VIF
firmware does station or AP at a time. Use WPA2, not WPA3: the SAE
handshake is deep on the stack and overflows the elliptic-curve crypto
with the default task stacks, so the Wi-Fi configs raise
CONFIG_INIT_STACKSIZE/DEFAULT_TASK_STACKSIZE.
Vendor SDK: cloned by the build at "context" time, pinned to a validated
commit and patched in place -- so CI can build with nothing preinstalled,
the same pattern as esp-hal-3rdparty. The prebuilt libraries are built
for the hard-float ilp32f ABI.
BLE 5.3, marked EXPERIMENTAL and off by default: the prebuilt libble is an
all-in-one controller plus RivieraWaves host (GAP/GATT/SMP inside the blob)
with no HCI transport, so the port drives the vendor host directly
(ble_adp_*, ble_adv_*, ble_gap_*) instead of registering a bt_driver_s.
The SDK's radio interrupt handlers must be attached to the NuttX IRQ table
(they are reached through the ECLIC hardware vector table in the vendor
build); attaching also keeps --gc-sections from dropping them. It ships
with no configuration; enabling it advertises as "NuttX", connectable.
Boards: gd32vw553k-start with nsh, wapi, sta_softap, periph and littlefs
configurations, and the board added to the CI build list.
Tested on hardware (GD32VW553K-START): NSH, the peripheral drivers
(TRNG entropy and the LEDs exercised), LittleFS (write, read, survives a
reboot), the full Wi-Fi station path (scan, WPA2, DHCP, ping to the
internet), the softAP (a client associates with WPA2, gets an address
from the board's DHCP server, and pings the board), and BLE (advertises as
"NuttX"; a central connects and enumerates the GATT database).
Assisted-by: Claude Opus 4.8
Signed-off-by: Jorge Guzman <jorge.gzm@gmail.com>
Summary
Permissions (Part 3)
Description:
In kernel builds, any unprivileged process running on the NuttX device can
open /dev/efuse and attempt to read/write fuse content. Reading the fuses
may provide valuable information to an attacker controlling the user process.
The write operation, in extreme cases where the fuse blocks are not locked,
may brick the device.
DISCLAIMER: I tried to be strict with the settings, better to relax them
later if it's needed.
This is part of https://github.com/apache/nuttx/issues/19410
Impact
See https://github.com/apache/nuttx/issues/19410
Testing
Compiles ok.
Signed-off-by: Catalin Visinescu <catalin_visinescu@yahoo.com>
Three defects that together prevented macOS from ever mounting a
composite USBMSC function (Linux was mostly unaffected because its
probe sequence and recovery timing never exercised these paths):
1. usbmsc_setup() compared the class-request wIndex against the
compile-time constant USBMSC_INTERFACEID (= CONFIG_USBMSC_IFNOBASE,
i.e. 0) instead of the composite-assigned priv->devinfo.ifnobase.
In composite mode the MSC interface number is nonzero, so
GET MAX LUN, Bulk-Only Mass Storage Reset, and GET/SET INTERFACE
all failed the index check and stalled EP0. Standalone MSC is
unaffected (ifnobase == 0), which is why this went unnoticed.
2. usbmsc_deferredresponse() has its entire body inside
#ifndef CONFIG_USBMSC_COMPOSITE, so the deferred EP0 status stage
for MSRESET/SETINTERFACE was never sent in composite mode and the
host's Bulk-Only reset timed out. (Unreachable before fix 1 --
MSRESET used to stall at the wrong-interface check.) Compile the
body in composite mode too, but suppress the worker's deferred
response for SETCONFIGURATION there: the composite driver answers
that request itself, and a duplicate zero-length packet corrupts
the EP0 state.
3. usbmsc_cmdfinishstate() stalled the bulk IN endpoint whenever a
device-to-host command left a residue, even when the response had
already been sent and terminated by a short packet (or ZLP). The
stall is BOT-legal (USB MSC BOT 6.7.2) but gratuitous: the short
packet already ended the data phase and the residue is reported in
dCSWDataResidue. Hosts such as macOS answer any bulk-IN halt during
device probing with a full Bulk-Only reset sequence, which costs
seconds per command or aborts the probe entirely (macOS probes
MODE SENSE(6) with allocation lengths that exceed the response;
Linux's probe does not). Only halt the endpoint when nothing
terminated the data phase.
Root-cause analysis and host traces in apache/nuttx#19435.
Validated on RP2350 silicon (Raspberry Pi Pico 2 W, composite
CDC-ACM + CDC-NCM + USBMSC): GET MAX LUN answers 1 LUN (previously
EP0 stall and a garbage LUN count on macOS), MSRESET completes 10/10
(previously ETIMEDOUT), MODE SENSE(6) alloc=0xC0 returns short data
plus a CSW with dCSWDataResidue and zero bulk-IN stalls across the
exact-length suite, and macOS now mounts the volume (together with the
companion DCD fixes).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Signed-off-by: Ricard Rosson <ricard@groundbits.com>
usbdev_register() calls CLASS_BIND, which ends with DEV_CONNECT
(composite_bind/cdcacm_bind) and sets SIE_CTRL.PULLUP_EN, and then
performs a wholesale putreg32 of SIE_CTRL to set EP0_INT_1BUF --
clobbering the pull-up microseconds after it was asserted.
Enumeration only ever succeeded because the host happened to latch the
microsecond pull-up blip and issued a bus reset, whose handler
(CLASS_DISCONNECT -> DEV_CONNECT) re-arms the pull-up. A warm host
port catches the blip; a cold-plugged port is still in attach debounce,
misses it, and never resets -- PULLUP_EN stays 0 forever and the device
is totally silent on the bus while NuttX runs normally underneath.
This presented as an intermittent, image-dependent "cold boot brick"
(boot timing shifts the blip in or out of the host's blind window).
Fix: set EP0_INT_1BUF with setbits_reg32 so PULLUP_EN survives.
Validated on RP2350 silicon (Raspberry Pi Pico 2 W): an image that
failed 0/10 cold plugs enumerated 10/10 with the fix; a second board
that had never enumerated at all was recovered by it. The rp2040
driver has the identical code and receives the identical fix
(build-tested; the RP2350 validation exercised the shared logic).
Fixesapache/nuttx#19434
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Signed-off-by: Ricard Rosson <ricard@groundbits.com>
