Fix security issue where uninitialized kernel stack contents could be
leaked to userspace when mfrc522_picc_select() fails.
In mfrc522_read(), the local variable 'uid' was not initialized before
being passed to mfrc522_picc_select(). If the function fails (e.g., due
to bad data on the SPI bus), the uninitialized uid.sak value could pass
the PICC_TYPE_NOT_COMPLETE check, causing snprintf() to copy
uninitialized kernel stack data to the userspace buffer.
Fixes#19417
Signed-off-by: hanzhijian <hanzhijian@zepp.com>
Author: hanzhijian <hanzhijian@zepp.com>
Description:
In kernel builds, any unprivileged process running on the NuttX device
can open /dev/efuse and attempt to read/write fuse content. Reading the
fuses may provide valuable information to an attacker controlling the user
process. The write operation, in extreme cases where the fuse blocks are
not locked, may brick the device.
This is part of https://github.com/apache/nuttx/issues/19410
Compiles ok.
Signed-off-by: Catalin Visinescu <catalin_visinescu@yahoo.com>
Add a "Performance tuning" section to the network driver guide covering the
knobs that matter most for throughput on Wi-Fi lower-half drivers whose MAC
runs on a companion core: RX quota as backpressure, keeping the RX thread
priority at or below the vendor packet-delivery task, and capping the TCP
window / send buffer (backed by the shared IOB pool) on lossy wireless paths.
Signed-off-by: raul_chen <raul_chen@realsil.com.cn>
Connecting to an open AP after having connected to a secured one failed in
pre-auth: the stored passphrase (priv->psk) was kept forever, so a later
open-AP connect was still driven as WPA2 and rejected by the AP.
Clear the stored passphrase on explicit disconnect (SIOCSIWESSID with
flags == 0) only; it is still kept across normal reconnects so a secured
network does not need the key re-entered on every join. Also set key_id = -1
(non-WEP) instead of leaving the memset-zero default, and print the security
type in the connect log to aid diagnosis.
Signed-off-by: raul_chen <raul_chen@realsil.com.cn>
Tune the TCP stack and driver resources for the WHC Wi-Fi data path on both
rtl8720f_evb and pke8721daf (NuttX runs on the application core; the Wi-Fi MAC
runs on a companion core reached over an on-chip IPC):
- Cap the advertised TCP receive window (NET_RECV_BUFSIZE=10000) to about the
out-of-order reassembly capacity and bound in-flight TX
(NET_SEND_BUFSIZE=16384). The stock unbounded window/queue let the peer and
the local stack burst far more than the Wi-Fi path can smooth, causing
bursty loss/reordering and RTO stalls (RX), and starving incoming-ACK
processing so the peer window collapses and spurious retransmits tear the
link down (TX).
- Keep out-of-order reassembly (NET_TCP_OUT_OF_ORDER) but disable selective
ACK. PR #19353 enabled NET_TCP_SELECTIVE_ACK on both boards; on the lossy
Wi-Fi TX path the sender-side selective-ACK recovery does not reliably
repair multi-segment holes and stalls TX, so NewReno with out-of-order
reassembly is used instead -- same steady-state throughput, robust recovery.
- Widen IOB buffers to 512 bytes; the window and out-of-order buffers draw
from the shared IOB pool at run time and add no static memory.
- Drop the busy-wait retry in the transmit path (the send-buffer cap makes it
dead code) and lower the forced host TX skb count (skb_num_ap) to 8, which
covers the NP's transient TX backlog without over-reserving AP heap.
Signed-off-by: raul_chen <raul_chen@realsil.com.cn>
Describe how to build and use the Dropbear SSH server configuration on
the simulator, including host TAP network setup, user creation and the
volatile /tmp host key/passwd caveat.
Signed-off-by: Felipe Moura <moura.fmo@gmail.com>
This commit adds some documentation about the audio tone driver, how to
use it and links to it from the main audio component page. I also added
some back links to other audio docs there for convenience.
Signed-off-by: Matteo Golin <matteo.golin@gmail.com>
fix
Error: Refusing to load formula px4/px4/genromfs from untrusted tap px4/px4.
Run `brew trust --formula px4/px4/genromfs` or `brew trust px4/px4` to trust it.
Error: Process completed with exit code 1.
Homebrew 6.0+ refuses to load formulae from third-party taps unless they
are explicitly trusted ("Refusing to load formula ... from untrusted tap").
Trust each tap non-interactively before installing from it. Without this,
`brew install` aborts before pouring any package (including ccache).
`brew trust` only exists on Homebrew 6.0+; guard it so older versions,
which don't gate untrusted taps, skip it silently.
50161b1f09/Tools/setup/macos.sh (L54-L64)
Signed-off-by: simbit18 <simbit18@gmail.com>
Rework the RTL8721Dx / RTL8720F flashable-image handling to match the common
NuttX convention:
- Name the packed application image nuttx.bin (was app.bin) and leave only it
plus the map files in the top-level build directory; the prebuilt bootloader
boot.bin stays in the board prebuilt/ directory. Drop the redundant per-core
and OTA image copies from the top-level directory.
- Read the boot and application flash offsets from the SDK flash layout
(platform_autoconf.h) instead of hardcoding them, and write boot.bin and
nuttx.bin each at its own offset. A flash-layout change is then tracked
automatically and no offsets are entered by hand.
- Update the board documentation to match.
Signed-off-by: raul_chen <raul_chen@realsil.com.cn>
This configuration has PWM audio output over the audio jack and built-in
examples to play with it.
Signed-off-by: Matteo Golin <matteo.golin@gmail.com>
This adds the requirement for the 'Assisted-by' commit field as voted in
the mailing list to the contribution guide. This allows commits created
with generative tooling to be easily filtered/tracked using automated
tooling, and adopts the guidelines from the ASF with semantics similar
to the Linux kernel recommendation.
Signed-off-by: Matteo Golin <matteo.golin@gmail.com>
Wire the remaining STM32 families (L5, U5, WB, WL5, N6, H5) to the shared
boards/arm/common/stm32 board-common directory.
No functional change: these boards do not yet use any shared driver, but the
shared board-common features are now available to the families.
Signed-off-by: raiden00pl <raiden00@railab.me>
Merge the six near-identical pulse count drivers (two common, plus
the F7/H7/H5/L4 copies) into a single common/stm32/stm32_pulsecount.c.
Signed-off-by: raiden00pl <raiden00@railab.me>
fs_getfilep()/fs_putfilep() were renamed to file_get()/file_put().
The PTP clock paths still used the old names, breaking the PTP_CLOCK build.
Signed-off-by: raiden00pl <raiden00@railab.me>
CRYPTO_CHACHA20 implements the RFC 8439/IETF parameterization (32-bit
counter + 96-bit nonce). SSH's chacha20-poly1305@openssh.com uses the
original DJB construction instead: a 64-bit block counter in state
words 12..13 and a 64-bit nonce in words 14..15 (libtomcrypt's
chacha_ivctr64). The two layouts produce different keystreams for the
same key, so an SSH server cannot interoperate with OpenSSH clients
through the IETF variant.
Signed-off-by: Felipe Moura <moura.fmo@gmail.com>
Wire the STM32H7 family to the shared boards/arm/common/stm32 board-common
directory.
Drop the local copies that are already provided by the shared directory:
- stm32_reset.c from nucleo-h723zg, nucleo-h743zi, nucleo-h743zi2,
nucleo-h753zi, stm32h745i-disco and stm32h750b-dk
- stm32_romfs_initialize.c and stm32_romfs.h from nucleo-h743zi (identical
to the shared versions)
Enable CONFIG_ARCH_BOARD_COMMON=y in the configs that use CONFIG_BOARDCTL_RESET
or CONFIG_STM32_ROMFS so board_reset()/romfs are pulled from the shared
directory.
Signed-off-by: raiden00pl <raiden00@railab.me>
uart_putxmitchar() manipulates dev->xmit.head/buffer directly with
no internal locking - every other caller (uart_write()) takes
dev->xmit.lock first. uart_readv()'s ECHO handling (both the
backspace/delete erase sequence and the normal character echo)
calls uart_putxmitchar() without taking that lock, so a concurrent
uart_write() and a local echo can race on the same circular buffer
state, corrupting it.
Take dev->xmit.lock around each echo's uart_putxmitchar() calls,
matching what uart_write() already does. uart_readv() holds
dev->recv.lock for its own duration, but no other code path ever
acquires recv.lock while holding xmit.lock, so nesting xmit.lock
inside the existing recv.lock scope here doesn't introduce a new
lock-ordering cycle.
Fixes#14845
Signed-off-by: yi chen <94xhn1@gmail.com>
The pico-sdk-derived rp23xx linker scripts place .got/.got.plt as orphan
sections after the .data output section, so the boot-time .data copy
(which runs to _edata) never copies the GOT into RAM. Any position-
independent (-fPIC) object linked into an application then reads an
uninitialised GOT full of NULLs: the first GOT-indirected access
branches to 0 and the board hardfaults before main(). A PIC static
library (for example liboqs, whose SHA3 dispatch reads its function
pointers through the GOT) triggers this deterministically.
Fold *(.got)/*(.got.plt) into the .data{} section, before _edata, in all
three boot-mode scripts (memmap_default/copy_to_ram/no_flash) for every
rp23xx board, so the GOT is initialised in RAM by the standard startup
copy. No effect on non-PIC images (the GOT is empty).
Reproduced and fixed on a Raspberry Pi Pico 2 W: an app linking a -fPIC
liboqs.a wedged the board on its first crypto call before the change and
runs correctly after it.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Signed-off-by: Ricard Rosson <ricard@groundbits.com>
Reading /proc/<pid>/group/env for another task dereferenced tg_envp
under the caller's own address environment instead of the target
task's, since tg_envp lives in the target's user heap. Switch to the
target's address environment around the traversal, and to the
caller's own environment only around the copy into the caller's
buffer.
Signed-off-by: liang.huang <liang.huang@houmo.ai>
STM32_ETHMAC selects NETDEVICES, but NETDEVICES depends on NET. Enabling
ETHMAC without NET produced an invalid Kconfig
Signed-off-by: raiden00pl <raiden00@railab.me>
Expose the ChaCha20 stream cipher and the ChaCha20-Poly1305 AEAD through
the OCF crypto framework (/dev/crypto) so applications such as an SSH
server (chacha20-poly1305) can use them directly, and fix the underlying
ChaCha nonce/counter layout so both match RFC 8439.
RFC 8439 nonce layout fix
-------------------------
chacha_ivsetup() previously used the original DJB layout: a 64-bit block
counter (input[12..13]) followed by a 64-bit nonce (input[14..15]). RFC
8439 defines a 32-bit block counter (input[12]) and a 96-bit / 12-byte
nonce (input[13..15]). With the old layout the existing ChaCha20-Poly1305
AEAD could not reproduce the RFC 8439 test vectors (the last 4 bytes of a
12-byte nonce were consumed as the high half of the counter). This
commit switches chacha_ivsetup() to the RFC 8439 layout and updates the
ChaCha20-Poly1305 one-shot helpers to pass a 12-byte nonce accordingly.
Standalone ChaCha20 on the unified enc path
-------------------------------------------
Instead of introducing a separate multi-buffer stream path (parallel
encrypt_multi/decrypt_multi callbacks), extend the existing enc_xform
encrypt/decrypt callback signature with a length argument:
void (*encrypt)(caddr_t, FAR uint8_t *, size_t len);
void (*decrypt)(caddr_t, FAR uint8_t *, size_t len);
With that single change every cipher, block or stream, flows through the
same swcr_encdec path. swcr_encdec already handles a short final block
via buflen = MIN(i, blocksize), so arbitrary-length data works without a
second code path. This is exactly how the existing stream ciphers
(AES-CTR/OFB/CFB) already behave: the cipher keeps its own counter in the
context and swcr_encdec feeds it whole blocks (only the last one may be
shorter). chacha20_crypt likewise relies on the underlying chacha state
block counter (input[12]) to continue the keystream across calls, so no
per-call keystream caching is needed.
* chacha_private.h: chacha_ivsetup uses a 4-byte counter and a 12-byte
nonce (RFC 8439).
* chachapoly.c / chachapoly.h: split reinit into chacha20_reinit (raw,
counter 0) and chachapoly_reinit (AEAD, counter 1); chacha20_crypt
takes a length and encrypts it in one pass, mirroring aes_ctr_crypt;
12-byte nonce for the one-shot AEAD helpers.
* xform.h / xform.c: add size_t len to encrypt/decrypt; add
enc_xform_chacha20 (blocksize 64, 12-byte IV).
* cryptodev.c / cryptosoft.c: register CRYPTO_CHACHA20 as a txform
cipher, route new sessions to enc_xform_chacha20, feed the AEAD AAD
through crp_aad/crp_aadlen, and handle the short final block in
swcr_encdec.
* cryptodev.h: add CRYPTO_CHACHA20; bump EALG_MAX_BLOCK_LEN to 64.
This keeps all ciphers on one uniform path instead of maintaining two,
and any future stream cipher drops in with just an xform table entry.
Impact: extends an internal kernel callback signature (enc_xform
encrypt/decrypt). All in-tree implementations are updated in the same
commit and the user-facing /dev/crypto ABI is unchanged, so this is
self-contained and not a breaking change for existing configurations.
Testing:
Build host: Ubuntu Linux x86_64, GCC (host sim toolchain)
Target: sim:crypto (CONFIG_ARCH=sim)
Ran the crypto test apps. ChaCha20 uses RFC 8439 2.4.2 vectors
(including a 375-byte multi-block vector exercising cross-block counter
continuity); ChaCha20-Poly1305 uses the RFC 8439 2.8.2 AEAD vector.
A full regression of the other ciphers was run to confirm the extended
encrypt/decrypt signature does not change their behaviour:
nsh> chacha20
chacha20: 2/2 vectors passed
nsh> chachapoly
OK test vector 0
chachapoly: 1/1 vectors passed
nsh> des3cbc -> all vectors OK
nsh> aescbc -> all vectors OK
nsh> aesctr -> all vectors OK
nsh> aesxts -> 14 vectors OK (encrypt + decrypt)
nsh> hmac -> md5 / sha1 / sha256 all success
Signed-off-by: makejian <makejian@xiaomi.com>
The top command was added to nshlib in 2024 but was never documented.
Add a section to the NSH commands page covering syntax, options,
example output and configuration dependencies, including the
Linux-like summary header.
Also enable the command in the linum-stm32h753bi:nsh config: procfs,
CPU load measurement, stack coloration and task names, so that top
and ps are fully functional out of the box. This requires a dedicated
interrupt stack and larger IDLE/init task stacks: with SCHED_CPULOAD
the per-tick accounting runs in interrupt context, and with
ARCH_INTERRUPTSTACK=0 it lands on the stack of the interrupted task,
overflowing the 1 KiB IDLE stack and corrupting the adjacent heap.
Also add the VT100 escape sequences used by the top command screen
refresh as string literals in include/nuttx/vt100.h (VT100_STR_*),
next to the existing VT100_FMT_* definitions.
Tested on hardware.
Signed-off-by: Jorge Guzman <jorge.gzm@gmail.com>
Document how to transfer files with scp on the Dropbear server port,
which requires the legacy protocol (scp -O) since the port has no SFTP
server. Recent OpenSSH clients default to SFTP and fail otherwise.
Signed-off-by: Felipe Moura <moura.fmo@gmail.com>
riscv_fillpage() unconditionally panics the kernel on an unmappable
or invalid access, even when the fault is caused by a user task. A
user-space fault should terminate that task with SIGSEGV instead of
taking down the whole system, matching the existing behavior for
other exceptions in riscv_exception().
Signed-off-by: liang.huang <liang.huang@houmo.ai>
scan_dir() checked name_len before assigning it. Directory entries already compute and validate strlen(a_dirent->d_name) before allocating the dir item, while the root path passed to scan_dir() is not encoded as a directory entry name.
Remove the stale pre-opendir check so scan_dir() no longer branches on an uninitialized local variable.
Generated-by: OpenAI Codex
Signed-off-by: aineoae86-sys <ai.neo.ae86@gmail.com>
coredump_dump_tcb() copied tcb->name unconditionally, but the tcb_s name
member only exists when CONFIG_TASK_NAME_SIZE > 0
Signed-off-by: raiden00pl <raiden00@railab.me>
Run update_romfs_password.sh, check_passwd_keys.sh, and
gen_passwd_keys.sh through an explicit sh/bash interpreter so CMake
configure works on Linux, macOS, MSYS2, and Cygwin instead of relying
on direct script execution.
Signed-off-by: Abhishek Mishra <mishra.abhishek2808@gmail.com>
Support NUTTX_ROMFS_PASSWD_PASSWORD via update_romfs_password.sh for
configs that enable ROMFS passwd without a defconfig password (sim/login
CI). Enable RANDOMIZE_KEYS in sim/login defconfig. Update mkpasswd.c
header, platform docs, and the mkpasswd_autogen guide.
Signed-off-by: Abhishek Mishra <mishra.abhishek2808@gmail.com>
Remove implicit default credentials and add build-time validation.
Add check_passwd_keys.sh and gen_passwd_keys.sh; run key setup via
passwd_keys.mk before config.h is generated. Mirror the same logic in
cmake/nuttx_add_romfs.cmake for CMake builds.
BREAKING CHANGE: Builds with CONFIG_BOARD_ETC_ROMFS_PASSWD_ENABLE=y now
require an explicit admin password and non-default TEA keys. The
Kconfig default password "Administrator" and default TEA keys are no
longer accepted. Fix: run make menuconfig, set Admin password under
Board Selection -> Auto-generate /etc/passwd, enable random TEA keys or
set CONFIG_FSUTILS_PASSWD_KEY1..4 manually, and use NSH login with
Encrypted password file verification.
Signed-off-by: Abhishek Mishra <mishra.abhishek2808@gmail.com>
switch stm32f7 board common to boards/arm/common/stm32.
Move the STM32F7-only board-common features into the shared directory
so they are available to every STM32 family:
- bmi270, cs4344, can_setup, cansock_setup, reset, romfs_initialize and
spitest
- the duplicate stm32_bh1750 is removed (already present in common).
Signed-off-by: raiden00pl <raiden00@railab.me>
Enabling STM32_FOC without MOTOR_FOC failed to build with
"unknown type name 'foc_current_t'". Add the dependency on MOTOR_FOC.
Signed-off-by: raiden00pl <raiden00@railab.me>
stm32h5/stm32_i2c.c selected the I2C2/3/4 kernel clock with
RCC_CCIPR4_I2CnSEL_PCLKx, but the H5 RCC header names those values
RCC_CCIPR4_I2CnSEL_RCCPCLKx.
Signed-off-by: raiden00pl <raiden00@railab.me>
Add ReStructuredText documentation for the MPU6050 6-axis IMU uORB driver under Special Sensor Drivers. Includes device registration, Kconfig options, uORB topic descriptions, and bring-up examples.
Signed-off-by: Shriyans S Sahoo <shriyans.s.sahoo@gmail.com>
Add lower-half uORB sensor driver for the InvenSense MPU6050 over I2C. Supports accelerometer and gyroscope sensor types, register read/write, fetch, and control operations.
All internal register definitions and full-scale range constants are placed in the private driver C file (drivers/sensors/mpu6050_uorb.c) for clean encapsulation. The device struct uses explicit named members ('accel' and 'gyro') for high readability.
Add Kconfig option CONFIG_SENSORS_MPU6050 under Sensor Drivers, and add build integration to drivers/sensors/Make.defs and CMakeLists.txt.
Signed-off-by: Shriyans S Sahoo <shriyans.s.sahoo@gmail.com>
Added a Mixed case exclusion for MQTTErrors defined in
apps/netutils/mqttc/MQTT-C/include/mqtt.h
Signed-off-by: Mihai Pacuraru <mpacuraru@protonmail.com>
Update the DNS stream send and receive helpers to advance their buffers
by the number of bytes actually transferred. Advancing by the original
remaining length skips data when send() or recv() completes partially.
Signed-off-by: Old-Ding <ai.neo.ae86@gmail.com>
