up_idlepm() (esp32s3_idle.c/esp32_idle.c/esp32s2_idle.c and the
shared risc-v esp_idle.c for esp32c3/esp32c6) has a recovery branch
that forces the domain back to PM_NORMAL when oldstate is not
PM_NORMAL and nothing is currently staying at it:
pm_stay(PM_IDLE_DOMAIN, PM_NORMAL);
pm_changestate(PM_IDLE_DOMAIN, PM_NORMAL);
newstate = PM_NORMAL;
pm_stay() here has no matching pm_relax() anywhere in any of the
four files. The first time this branch runs, the stay count for
PM_NORMAL never returns to 0, and pm_checkstate() (called
unconditionally right after this block) can never recommend
anything deeper than PM_NORMAL again for the rest of uptime -- the
idle loop keeps running, but the governor is permanently pinned at
full power, with no further light or deep sleep.
Confirmed on real ESP32-S3 hardware (XIAO ESP32-S3,
CONFIG_ESPRESSIF_WIFI + CONFIG_PM + CONFIG_SCHED_TICKLESS): reading
g_pmdomains[0] live via JTAG/GDB showed a "system" wakelock stuck at
state=PM_NORMAL, count=1, acquired a few seconds after boot (right
when Wi-Fi coming up briefly moves the domain off PM_NORMAL and this
branch then forces it back). Reproduced 4/4 times before this fix
(never a single PM_STANDBY transition or light-sleep-return log line
across a 40+ minute run), 0/4 after.
The trigger is timing-dependent (whether anything else already
holds PM_NORMAL at the moment this branch runs), which is likely why
it does not reproduce on every single boot.
Fix: release the stay right after the one pm_changestate() call it
exists to force, matching the comment already there ("Keep working
in normal stage") -- a one-shot nudge, not a standing hold.
Touching the switch statement right below the fix in all four files
exposed a pre-existing nxstyle violation (case labels indented level
with the switch's opening brace instead of one level in from it, per
NuttX style); reindented alongside since checkpatch lints the whole
file. esp32s3_idle.c also had two unrelated stray-indented lines
("Perform IDLE mode power management" / up_idlepm()) in up_idle();
fixed those too, same reason.
Signed-off-by: Felipe Moura <moura.fmo@gmail.com>
Assisted-by: Claude:claude-sonnet-5
Refine the atomic Kconfig to support multiple backends:
LIBC_ATOMIC_TOOLCHAIN (compiler builtins), LIBC_ATOMIC_ARCH (arch
instructions), and LIBC_ATOMIC_IRQ (interrupt disable). Rename
arch_atomic.c to arch_atomic_irq.c since it supports the IRQ backend.
Signed-off-by: zhangyu117 <zhangyu117@xiaomi.com>
Description:
In kernel builds, any unprivileged process running on the NuttX device
can open /dev/efuse and attempt to read/write fuse content. Reading the
fuses may provide valuable information to an attacker controlling the user
process. The write operation, in extreme cases where the fuse blocks are
not locked, may brick the device.
This is part of https://github.com/apache/nuttx/issues/19410
Compiles ok.
Signed-off-by: Catalin Visinescu <catalin_visinescu@yahoo.com>
All I2S driver operation functions say in their signature description
that negative errno values are returned on failure. However, some of
these same functions had `uint32_t` return types. This would result in
incorrect comparison of the return value against signed error code
values.
Signed-off-by: Matteo Golin <matteo.golin@gmail.com>
This commit updates Espressif's common source code to ensure that
critical sections are properly handled by the common source code.
Signed-off-by: Tiago Medicci Serrano <tiago.medicci@espressif.com>
The RWDT register offsets were incorrectly set to ESP32-S3 values
instead of ESP32 values. This was introduced when the code was
refactored from using the local NuttX header hardware/esp32_rtccntl.h
(which had the correct offsets) to using the HAL library headers, and
the offsets were moved inline into esp32_wdt.c with wrong values.
Correct the offsets to match the actual ESP32 register layout from
soc/rtc_cntl_reg.h (RTC_CNTL_WDTCONFIG0_REG at 0x8c, INT_ENA at
0x3c, etc). Without this fix, all RWDT operations (enable, configure
timeout, enable interrupt, acknowledge interrupt, feed, write-protect)
were targeting wrong memory addresses, rendering the RWDT completely
non-functional.
Signed-off-by: Tiago Medicci Serrano <tiago.medicci@espressif.com>
Under the BOARD_LATE_INITIALIZE boot flow, rtc_clk_xtal_freq_get()
may return 0 (SOC_XTAL_FREQ_AUTO) because the XTAL frequency has
not yet been stored to the RTC register when the WDT driver is
initialized. This causes rtc_clk_cal() to divide by zero
internally (EXCCAUSE=0006) when computing the RTC slow clock
period.
Fix by explicitly calling rtc_clk_xtal_freq_update() with the
board's configured crystal frequency if rtc_clk_xtal_freq_get()
returns 0. Also add a guard in esp32_wdt_settimeout() to return
-EIO if ESP32_RWDT_CLK() still returns 0 cycles/ms, preventing
a subsequent divide-by-zero when computing the maximum timeout.
Signed-off-by: Tiago Medicci Serrano <tiago.medicci@espressif.com>
Same issue as ESP32-S3/S2: with BOARD_LATE_INITIALIZE, the
constructor function enable_timer_group0_for_calibration() resets
Timer Group 0 registers after board_late_initialize() has
configured the MWDT0 prescaler, causing the watchdog to fire at an
incorrect rate.
Re-apply the prescaler, timeout, and feed the WDT counter in
esp32_wdt_start() just before enabling the timer.
Signed-off-by: Tiago Medicci Serrano <tiago.medicci@espressif.com>
Now that time_t is unconditionally 64-bit (signed int64_t) and the
struct timespec fields tv_sec / tv_nsec are wide enough on their own,
the explicit (uint64_t)/(int64_t)/(int) casts that used to guard the
multiplications and subtractions in *_us / *_ms / *_ns helpers are no
longer needed. Drop them to keep the timekeeping math readable and
consistent with the previous sclock_t/time_t cleanup.
In the same spirit, this commit also:
* Normalises the printf-style format specifiers and casts used to
print tv_sec / tv_nsec / tv_usec values across arch/, drivers/,
fs/, sched/ and libs/. The prior code was a mix of
"%d"/"%u"/"%ld"/"%lu"/"%lld"/PRIu32/PRIu64 with matching
(int)/(unsigned long)/(long long)/PRIu* casts; some formats
truncated time_t on 32-bit hosts, others mismatched signedness or
width. Replace all such cases with the portable POSIX-recommended
forms:
- tv_sec (time_t, signed, impl-defined width) -> %jd + (intmax_t)
- tv_nsec (long, signed) -> %ld (no cast)
- tv_usec (suseconds_t / long) -> %ld (no cast)
Add #include <stdint.h> where required.
* Drops a few stale `(FAR const time_t *)&ts.tv_sec` casts and
related `(FAR struct tm *)` / `(const time_t *)` casts in
gmtime_r() / localtime_r() / gmtime() callers; ts.tv_sec is plain
time_t now and the casts only obscured the type.
* Fixes one overflow in fs/procfs/fs_procfscritmon.c where
all_time.tv_sec * 1000000 could overflow on 32-bit time_t before
being multiplied again; cast to uint64_t at the start.
No behavioural change.
Signed-off-by: Xiang Xiao <xiaoxiang@xiaomi.com>
POSIX leaves the signedness of time_t and clock_t unspecified, but
mainstream implementations (Linux glibc/musl, the BSDs, macOS, RTEMS,
Zephyr's POSIX layer, Windows _time64) expose time_t as signed 64-bit.
NuttX has historically used uint64_t only because it was tied to the
CONFIG_SYSTEM_TIME64 knob; with that gone, switch:
time_t : uint64_t -> int64_t
clock_t : uint64_t -> int64_t
CLOCK_MAX: UINT64_MAX -> INT64_MAX
This lets (time_t)-1 sentinels, negative tick deltas, and host-side
headers behave as on every other POSIX system without source churn.
Headers updated:
- include/sys/types.h, include/limits.h, include/nuttx/clock.h
- include/nuttx/fs/hostfs.h (nuttx_time_t alias)
- include/nuttx/{mqueue.h,wdog.h,wqueue.h,timers/clkcnt.h}
Because clock_t is now signed 64-bit, the NuttX-internal sclock_t
alias becomes redundant: every sclock_t/SCLOCK_MAX use is folded
back to clock_t/CLOCK_MAX (notably in sched/wdog, sched/mqueue,
sched/sched, sched/clock, sched/timer, libs/libc/time, fs/vfs and
the drivers/arch consumers below).
Tick/period constants (NSEC_PER_SEC, USEC_PER_SEC, MSEC_PER_SEC,
SEC_PER_MIN, ...) in include/nuttx/clock.h are retyped from "long"
literals to INT64_C(...) so that 64-bit arithmetic no longer
depends on the host's long width.
Strip now-redundant (time_t)/(clock_t)/(unsigned long) casts and
unsigned-only branches across the tree:
- arch RTC / oneshot / tickless lowerhalfs:
arm: cxd56xx, efm32, imxrt, lc823450, max326xx, sam34, sama5,
samd5e5, samv7, stm32, stm32f7, stm32h7, stm32l4, stm32wb,
xmc4
mips: pic32mz sparc: bm3803 x86_64: intel64
risc-v/xtensa: espressif (esp_i2c[_slave], esp_rtc,
esp32c3{_i2c,_rtc,_wifi_adapter}, esp32{,s2,s3}_*),
mpfs_perf
- drivers: audio/tone, input/aw86225, power/pm/{activity,
stability}_governor, rpmsg/rpmsg_ping,
timers/{ds3231,mcp794xx,pcf85263,rx8010},
wireless/ieee80211/bcm43xxx, wireless/spirit/spirit_spi
- core: fs/vfs/{fs_poll,fs_timerfd}, mm/iob/iob_alloc,
libs/libc/{netdb/lib_dnscache,time/{lib_calendar2utc,
lib_time}}, net/icmp/icmp_pmtu, net/icmpv6/icmpv6_pmtu,
net/ipfrag, net/tcp/{tcp.h,tcp_timer},
net/utils/net_snoop, net/mld/mld_query (drop the now-dead
mld_mrc2mrd helper since signed math handles it directly),
sched/clock/{clock,clock_initialize},
sched/sched/{sched_profil,sched_setparam,sched_setscheduler},
sched/pthread/pthread_create,
sched/wdog/{wd_gettime,wd_start,wdog.h},
sched/timer/timer_gettime, sched/mqueue/*
Flip the few in-tree printf format strings that assumed an
unsigned 64-bit tv_sec:
* drivers/rpmsg/rpmsg_ping.c PRIu64 -> PRId64
* arch/xtensa/src/esp32{,s2,s3}/esp32*_oneshot_lowerhalf.c
PRIu32 (already wrong) -> PRId64
Signed-off-by: Xiang Xiao <xiaoxiang@xiaomi.com>
The 32-bit system clock has a limited range (~497 days) and the
configuration knob is no longer worth the complexity given that
practically every modern target already enables it. Make 64-bit
time_t/clock_t/sclock_t/nuttx_time_t the only supported flavor.
Specifically:
- Drop the SYSTEM_TIME64 Kconfig option and its dependent
PERF_OVERFLOW_CORRECTION/HRTIMER guards in sched/Kconfig.
- Remove every #ifdef CONFIG_SYSTEM_TIME64 branch in headers
(include/{sys/types.h,limits.h,inttypes.h,nuttx/clock.h,
nuttx/fs/hostfs.h}) and core code paths
(sched/clock/clock.h, drivers/power/pm/pm_procfs.c,
drivers/rpmsg/rpmsg_ping.c, fs/procfs/fs_procfsuptime.c,
libs/libc/wqueue/work_usrthread.c,
arch/avr/src/avrdx/avrdx_timerisr_tickless_alarm.c).
- Strip CONFIG_SYSTEM_TIME64=y from every board defconfig.
- Update Documentation/guides/rust.rst accordingly.
Signed-off-by: Xiang Xiao <xiaoxiang@xiaomi.com>
BREAKING CHANGE: remove PWM_MULTICHAN option
PWM_MULTICHAN option is redundant, we can just set CONFIG_PWM_NCHANNELS > 1.
At default CONFIG_PWM_NCHANNELS is set to 1, so the default behavior is preserved.
Access to single channel API is now `info->channels[0].XXX` instead of `info->XXX`
This is the first step to simplify PWM implementation and make it more portable.
Signed-off-by: raiden00pl <raiden00@railab.me>
After recent changes on the event handler for the RISC-V-based
Espressif SoCs, the same set of changes were ported back to xtensa
devices.
Signed-off-by: Tiago Medicci Serrano <tiago.medicci@espressif.com>
During startup we should avoid using _info since the system is not
fully initialized. Default to use ets_printf which is safe for
this scenario.
Signed-off-by: Filipe Cavalcanti <filipe.cavalcanti@espressif.com>
When ESP32's flat build mode is selected with the external PSRAM
on USER_HEAP mode, the ROM strdup internally calls malloc which may
be mapped to a different heap than lib_free, causing cross-heap
allocation issues and system crashes.
This commit adds a new Kconfig option ESP32_DONT_USE_ROM_LIBC to
allow using NuttX libc instead of ROM newlib functions. When
USER_HEAP mode is selected, this option is automatically enabled.
Signed-off-by: Tiago Medicci Serrano <tiago.medicci@espressif.com>
Wi-Fi used a locally allocated vector_desc, so those CPU interrupt lines
were never recorded in the HAL non_iram_int_mask.
During SPI flash, esp_intr_noniram_disable() therefore did not mask them,
and Wi-Fi ISRs could still run with the cache off.
Now, Wi-Fi IRQs are treated as non-IRAM and get masked while flash/cache is suspended.
Signed-off-by: Filipe Cavalcanti <filipe.cavalcanti@espressif.com>
This adds support for the PBKDF2 algorithm in the ESP32 crypto
driver. Here, it will take advantage of the hardware-accelerated
implementation of SHA.
Signed-off-by: Vlad Pruteanu <pruteanuvlad1611@yahoo.com>
debug.h is a NuttX-specific, non-POSIX header. Placing it in the
top-level include/ directory creates naming conflicts with external
projects that define their own debug.h.
This commit moves the canonical header to include/nuttx/debug.h,
following the NuttX convention for non-POSIX/non-standard headers,
and updates all in-tree references.
A backward-compatibility shim is left at include/debug.h that
emits a deprecation #warning and re-includes <nuttx/debug.h>,
allowing out-of-tree code to continue building while migrating.
Signed-off-by: Piyush Patle <piyushpatle228@gmail.com>
This commit updates the common-source integration for Xtensa-based
Espressif devices (ESP32, ESP32-S2, and ESP32-S3). This is part of a larger
common-source update split by architecture for better maintainability.
Major components updated:
- IRQ allocator refactoring with intr_alloc integration
- Common-source drivers (GPIO, RMT, I2C, SPI, UART, etc.)
- Espressif components upgrade to release/master.b-test
- Peripheral drivers (ADC, PWM, LEDC, MCPWM, PCNT, Temperature Sensor, etc.)
- Wireless adapters (Wi-Fi and BLE)
- esp_timer migration to the common-source path for Xtensa devices
- Common-source power management implementation (auto-sleep and wakeup paths)
- Board defconfigs for all Xtensa Espressif boards
- SMP support improvements for ESP32-S3
- Critical section handling improvements
Key architectural changes:
- IRQ Allocator: The new interrupt allocator enables multiple mapping
options from interrupt sources to CPU interrupts, providing flexibility
required by modern peripherals. Although this introduces breaking changes
to the interrupt handling API, the required ARCH_MINIMAL_VECTORTABLE
Kconfig option is explicitly checked during startup to ensure proper
configuration. This validation prevents runtime issues from configuration
mismatches.
- Xtensa-specific interrupt handling via esp_xtensa_intr.c providing
NuttX-native implementations of xt_ints_on/off and interrupt handlers,
avoiding conflicts with NuttX's core Xtensa macros.
- Timer/RTC unification: ESP32/ESP32-S2/ESP32-S3 move from chip-specific
RTC/RT-timer code to common-source Espressif integration, including
esp_timer_adapter/esp_rtc paths and the required bringup/defconfig updates.
- Power management consolidation: Xtensa PM follows the common-source
implementation, including common-source auto-sleep behavior, UART/Wi-Fi
wakeup coordination, and tickless-safe sleep flow compatibility.
Note: This is a large commit to maintain bisectability. Breaking the
changes into smaller commits would result in non-building intermediate
states across the common-source infrastructure update.
Tested configurations:
- All defconfigs were tested, including `ostest`.
Signed-off-by: Tiago Medicci Serrano <tiago.medicci@espressif.com>
Fix 269 occurrences of duplicate "the" word typo found in 209 files
across source code, header files, and configuration.
Signed-off-by: Huang Qi <huangqi3@xiaomi.com>
The esp32_spi_poll_exchange() function previously used a hardcoded
length of sizeof(uint32_t) (4 bytes) for memcpy() operations and
pointer increments, disregarding the actual remaining transfer_size.
When an SPI transaction involved a data length not aligned to 4 bytes
(such as a 1-byte payload commonly used in sub-GHz radio drivers),
the driver forced a 4-byte memory transfer. This caused out-of-bounds
reads and writes, leading to stack smashing and fatal CPU exceptions
(e.g., EXCCAUSE=0000).
This patch resolves the memory corruption vulnerability by:
1. Calculating a precise `chunk` size for each iteration, strictly
bounded by the remaining `transfer_size`.
2. Limiting the memcpy() operations and the subsequent pointer
increments (tp and rp) to this exact chunk size.
3. Zero-initializing the temporary TX register (w_wd) before copying
to clear padding and prevent reading uninitialized memory.
4. Adding a NULL check for the receive pointer (rp) prior to the
memcpy operation to prevent unintended memory writes.
Signed-off-by: Chip L. <chplee@gmail.com>
When using a key that is longer than the block size of the hashing
algorithm used, the key must be hashed before it is used.
Signed-off-by: Vlad Pruteanu <pruteanuvlad1611@yahoo.com>
since the judgment for network card selection was changed from IS_UP to
IS_RUNNING, drivers that lack carrier_on need to add the carrier_on
operation; otherwise, network access issues will occur.
Signed-off-by: zhanghongyu <zhanghongyu@xiaomi.com>
This commit add the option that was missing in the esp32_start.c
to ignore the chip version for boards with old ESP32 silicon tape out.
Signed-off-by: Alan C. Assis <acassis@gmail.com>
Modifies Kconfig and build tools to support flash encryption
and E-Fuse burning when flash encryption is enabled.
Signed-off-by: Filipe Cavalcanti <filipe.cavalcanti@espressif.com>
This add support for using the cryptographic accelerator
within the ESP32 for HMAC-SHA operations. The supported
algorithms are: SHA1 and SHA512.
Signed-off-by: Vlad Pruteanu <pruteanuvlad1611@yahoo.com>
Directly downloading the Git repository is inconvenient for local debugging.
This will allow to automatically download external packages from the Internet.
If not set, the repo need to be download will need to provide them manually,
otherwise an error will occur and the build will be aborted.
Add `USE_NXTMPDIR_ESP_REPO_DIRECTLY`, with this we can use
`USE_NXTMPDIR_ESP_REPO_DIRECTLY=y make` which can directly use esp-hal-3rdparty
under nxtmpdir without CLONE, CHECK_COMMITSHA, reset, checkout and update. Just
`cp -rf nxtmpdir/esp-hal-3rdparty chip/$(ESP_HAL_3RDPARTY_REPO)`.
Signed-off-by: v-tangmeng <v-tangmeng@xiaomi.com>
Replace the spinlock/sched_lock pair in xtensa/esp32 with
spin_lock_irqsave_nopreempt() to improve code clarity and consistency.
Signed-off-by: Chengdong Wang wangchengdong@lixiang.com
Updates the SPI Flash driver used for user storage MTD.
Moves ESP32 and ESP32S3 to use common driver.
Updates KConfig options to keep backwards compatibility.
Signed-off-by: Filipe Cavalcanti <filipe.cavalcanti@espressif.com>
Curently, the driver code for HW accelerated AES is not usable
since it's not registered within esp32_crypto. This commit fixes
it as well as a few bugs.
Signed-off-by: Vlad Pruteanu <pruteanuvlad1611@yahoo.com>
Fix exception issue when PM and DEBUG_ASSERTIONS enabled for esp32 and esp32s3.
This error happens due to PM system workflow, when system gets into sleep-modes with
removing PM_NORMAL count, system is raising an exception for not having
enough number of PM_NORMAL state count if DEBUG_ASSERTIONS enabled.
Signed-off-by: Eren Terzioglu <eren.terzioglu@espressif.com>
Nuttx currently has 2 types of sleep interfaces:
1. Signal-scheduled sleep: nxsig_sleep() / nxsig_usleep() / nxsig_nanosleep()
Weaknesses:
a. Signal-dependent: The signal-scheduled sleep method is bound to the signal framework, while some driver sleep operations do not depend on signals.
b. Timespec conversion: Signal-scheduled sleep involves timespec conversion, which has a significant impact on performance.
2. Busy sleep: up_mdelay() / up_udelay()
Weaknesses:
a. Does not actively trigger scheduling, occupy the CPU loading.
3. New interfaces: Scheduled sleep: nxsched_sleep() / nxsched_usleep() / nxsched_msleep() / nxsched_ticksleep()
Strengths:
a. Does not depend on the signal framework.
b. Tick-based, without additional computational overhead.
Currently, the Nuttx driver framework extensively uses nxsig_* interfaces. However, the driver does not need to rely on signals or timespec conversion.
Therefore, a new set of APIs is added to reduce dependencies on other modules.
(This PR also aims to make signals optional, further reducing the code size of Nuttx.)
Signed-off-by: chao an <anchao.archer@bytedance.com>
Updates MCUBoot version and default address for virtual E-Fuse, depending
if MCUBoot is enabled.
Signed-off-by: Filipe Cavalcanti <filipe.cavalcanti@espressif.com>
Make sure interrupt stack is colored before IRQ is enabled.
Currently, after calling irq_initialize in nx_start to
enable interrupts, there is still a period of execution
path before the interrupt stack is colored.
Signed-off-by: guoshengyuan1 <guoshengyuan1@xiaomi.com>
Fixes low and inconsistent bandwidth issues.
Adds new configuration options for buffer management.
Moves code around to make the implementation cleaner and easier to debug.
Signed-off-by: Filipe Cavalcanti <filipe.cavalcanti@espressif.com>
Updates E-Fuse driver for ESP32, now sharing a common implementation across Xtensa devices.
Signed-off-by: Filipe Cavalcanti <filipe.cavalcanti@espressif.com>
