Add an ICACHE section to the STM32H5 platform page. With
CONFIG_STM32_ICACHE the OTP, read-only and EDATA flash areas are mapped
non-cacheable with an MPU region, so they can be read like any other
memory.
The MPU is not applied in the HardFault and NMI handlers (HFNMIENA=0),
so these areas must not be read from NMI or HardFault context: with the
ICACHE enabled such a read raises a bus fault.
Assisted-by: Claude:claude-sonnet-5-5
Signed-off-by: Ricardo Maurizio Paul <ricardopaul@geotab.com>
The ICACHE driver now maps the OTP, read-only and EDATA flash areas
non-cacheable with an MPU region. Say so in the peripheral support
table.
Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Ricardo Maurizio Paul <ricardopaul@geotab.com>
An enabled ICACHE does not manage write transactions: it flags cacheable
writes as errors (ICACHE_SR.ERRF), and RM0481 8.4.5 recommends modifying
the memory with the ICACHE disabled. On an STM32H563, erasing and
programming a flash block with the ICACHE enabled leaves ICACHE_SR at
0x6 (BSYENDF and ERRF set).
The ICACHE also keeps serving lines cached before the change. When the
block had been read through the ICACHE just before it was programmed,
up_progmem_write() failed its read-back check with -EIO: the flash held
the new data, with no flash or ECC error flagged, but the read-back hit
the cached erased data. up_progmem_eraseblock() fails its erased-range
check the same way when programmed data of the block is cached.
Disable the ICACHE for the duration of up_progmem_eraseblock() and
up_progmem_write(), and enable it again afterwards if it was enabled on
entry. Disabling it invalidates it, so the refill after re-enabling it
sees the new flash content.
If the ICACHE cannot be re-enabled because its invalidate times out, it
is left disabled, which is safe but slower, and an error is logged.
Assisted-by: Claude:claude-sonnet-5-5
Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Ricardo Maurizio Paul <ricardopaul@geotab.com>
A bootloader may hand over with the ICACHE enabled, and nothing waits for
the invalidate that runs when the ICACHE is disabled. The driver also
polled BUSYF without a bound, so a stuck flag would hang the boot, and it
ignored an invalidate that never finished.
- stm32_enable_icache(): on first use, disable and invalidate the ICACHE
before the associativity and region registers are written (they are
only writable while EN=0), and wait for any pending invalidate before
enabling it (RM0481 8.4.5).
- stm32_disable_icache(): wait for the invalidate that EN=0 starts and
clear BSYENDF and ERRF.
- Bound every BUSYF wait with STM32_ICACHE_BUSY_TIMEOUT. RM0481 gives no
invalidate duration, so the value is a margin, not a measured limit.
- stm32_enable_icache() now returns OK or -ETIMEDOUT instead of void. On
a timeout the ICACHE is left disabled: with BUSYF stuck it would not
cache anything anyway (RM0481 8.4.5). Existing callers ignore the result
and keep working.
- __start: when CONFIG_STM32_ICACHE is not set, disable an ICACHE left on
by a bootloader, so reads of the OTP and UID cannot fault. On an
STM32H563 with the ICACHE left enabled this way, a 16-bit read of the
UID raised a precise bus fault and up_progmem_write() failed its
read-back check with -EIO.
Assisted-by: Claude:claude-sonnet-5-5
Signed-off-by: Ricardo Maurizio Paul <ricardopaul@geotab.com>
stm32_get_uniqueid() and flash_read_eccsafe16() (OTP and EDATA word
reads) disabled the ICACHE around their reads and enabled it again
afterwards, so that the read did not go through the ICACHE. The MPU
region added by the previous commit makes these areas non-cacheable, so
the reads bypass the ICACHE anyway.
Remove the disable/enable pairs. Each pair also invalidated the whole
ICACHE, and flash_read_eccsafe16() did it with interrupts disabled, twice
for every 32-bit OTP read.
The MPU is not applied in the HardFault and NMI handlers (HFNMIENA=0),
so a UID read from those handlers is no longer protected. Nothing in the
tree does that.
Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Ricardo Maurizio Paul <ricardopaul@geotab.com>
The OTP, read-only (UID, flash size, package) and high-cycle data (EDATA)
flash areas only accept 16/32-bit accesses and return a bus error
otherwise (RM0481 Table 77). The manual requires the MPU to disable local
cacheability for them (RM0481 7.3.2); with the ICACHE enabled and no such
region, reading them raises a precise bus error.
Until now this was worked around piecemeal: the driver disabled the
ICACHE around stm32_get_uniqueid() and the OTP and EDATA word reads, and
nucleo-h563zi mapped the 4 KB OTP/RO area non-cacheable in its board
code. Other reads, for example stm32_otp_read() or an application
reading the OTP on another board, still raised a precise bus error when
the ICACHE was enabled.
Map 0x08fff000-0x09017fff, which covers the three contiguous areas, as
Normal non-cacheable and execute-never with a single MPU region before
the ICACHE is enabled. STM32_ICACHE now selects ARM_MPU so that
stm32_mpuinitialize() has reset and enabled the MPU by then.
Remove the nucleo-h563zi OTP region in the same commit: the Armv8-M MPU
faults on an address that matches more than one region, so keeping both
would make OTP and UID reads fault on that board.
Assisted-by: Claude:claude-sonnet-5-5
Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Ricardo Maurizio Paul <ricardopaul@geotab.com>
An ICACHE build with no ICACHE region configured warns about two unused
symbols:
- stm32_icache_setup_region() is only called when one of the
CONFIG_STM32_ICACHE_REGION0..3 options is set, so build it only then.
- 'regval' in stm32_icache_initialize() is only used with
CONFIG_STM32_ICACHE_DIRECT, so declare it only then. The interrupt
block gets its own local variable.
No functional change.
Assisted-by: Claude:claude-sonnet-5-5
Signed-off-by: Ricardo Maurizio Paul <ricardopaul@geotab.com>
Marks DTC as supported in the peripheral table (normal mode only, used
by SCI) and documents the SCI driver features: the per-instance
FIFO/DTC mutual exclusion and the measured overrun-margin trade-off
between them, termios TCGETS/TCSETS support (tested up to 2 Mbps), and
TIOCGICOUNT's frame/overrun/parity counters. Adds SCI0's pinout and
the new serial-test config to the EK-RA8M1 board page.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Assisted-by: Claude:claude-sonnet-5
Signed-off-by: leocafonso <leocafonso@gmail.com>
board.h gains GPIO_SCI0_RX/TX (P610/P609, SCI0 pin group 3), needed to
exercise CONFIG_RA_SCI0_UART on this board at all -- previously only
SCI9's console pins existed.
The new serial-test defconfig builds on nsh with SCI0 enabled as
/dev/ttyS1 with its FIFO (CONFIG_RA_SCI0_FIFO, measured on hardware as
the best overrun-resistant setting: TTRG=15, RXTRG=0), 1024-byte RX/TX
ring buffers (up from the 256-byte default, to better absorb bursts
during testing), CONFIG_SERIAL_TERMIOS + apps/system/stty (to change
its baud rate live), and apps/examples/serialblaster + serialrx
pointed at it, for exercising the SCI_B driver's FIFO/overrun-recovery
paths independently of the SCI9 console.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Assisted-by: Claude:claude-sonnet-5
Signed-off-by: leocafonso <leocafonso@gmail.com>
Adds the Data Transfer Controller (DTC) as a generic register-triggered
DMA engine (ra_dtc.c/.h, hardware/ra8m1_dtc.h, CONFIG_RA_DTC, normal
mode only), and generalizes SCI_B's 16-stage FIFO and DTC support from
SCI9-only to every instance (SCI0-4, SCI9): CONFIG_RA_SCIn_FIFO and
CONFIG_RA_SCIn_TXDTC/RXDTC are mutually exclusive, not combinable --
TX DTC moves queued ring-buffer data in the background through
CONFIG_SERIAL_TXDMA, RX DTC moves each byte as it arrives, and measured
on hardware the FIFO's standing multi-byte buffer gives far better
high-baud overrun margin than this one-byte-per-activation RX DTC
design, which also had a real arming bug fixed here (up_rxint()'s old
"first enable" check could never fire, so the DTC was never armed),
alongside a FIFO register-clear/ordering fix. up_ioctl() also gains
TCGETS/TCSETS (baud rate, parity, stop bits), board.h gains SCI0's
GPIO pins (P609/P610) to exercise it on this board, and comments
throughout ra_serial.c/Kconfig are condensed from the narrative
debugging form they accumulated down to the essential fact each one
needs. Tested on hardware: SCI0 and SCI9 simultaneously, FIFO and DTC
independently and mutually exclusive; FIFO (TTRG=15/RTRG=0) holds up
cleanly to 3 Mbps for transfers within the RX ring buffer, well past
RX DTC's ceiling (see below).
A separate, more serious bug was also found and fixed while hardware-
testing the overrun path at high baud: up_erinterrupt() never cleared
its ICU IELSRn.IR flag (RA8M1 User's Manual section 13.5.1 is explicit
that this causes the NVIC to re-enter the handler indefinitely), which
livelocked the whole system on any receive error, in every
configuration, not something specific to this series. Fixed by
clearing it like the other two SCI interrupt handlers already did, by
draining RDR/the FIFO on an error before clearing it (SCIn_ERI fires
instead of SCIn_RXI for every receive error, so data already received
was otherwise never picked up), and by having the RX DTC path also
recognize a byte stuck via CSR.RDRF directly, not just its own
bookkeeping, since its event can be silently dropped by the ICU while
an earlier byte's IR is still pending. Also added CONFIG_SERIAL_
TIOCGICOUNT (frame/overrun/parity counters via the standard
TIOCGICOUNT ioctl), matching stm32's precedent, since nothing in the
generic NuttX serial core surfaces a receive error to an application
otherwise. Confirmed on hardware: nsh on SCI9 stays fully responsive
through a sustained 3 Mbps overrun on SCI0 that previously froze the
whole board.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Assisted-by: Claude:claude-sonnet-5
Signed-off-by: leocafonso <leocafonso@gmail.com>
Add an opt-in STM32N6_DEBUG setting to reopen the debug access port and
secure/non-secure debug at the current BSEC protection level. Enable the
BSEC clock and configure access before clock and memory initialization so
a debugger can attach to a flash-booted development image.
Assisted-by: Codex:GPT-6
Signed-off-by: raiden00pl <raiden00@railab.me>
In the nominal ROM clock configuration, flash boot leaves PLL1 driving
the CPU at 400 MHz. Skipping clock setup when PLL1 is already selected
makes SysTick run twice as fast as the board's 200 MHz configuration
expects.
Switch CPU and system clocks to HSI before reconfiguring PLL1, then apply
the board clock tree.
Remove the incorrect comments claiming CFGR1 and CFGR2 lock after the first
clock switch.
Assisted-by: Codex:GPT-6
Signed-off-by: raiden00pl <raiden00@railab.me>
Add stm32h7s8-dk board support for nsh running out of internal flash,
including LEDs and user button.
Signed-off-by: Peter Barada <peter.barada@gmail.com>
spi_setfrequency() in pic32mz_spi.c rounded the baud rate divisor down,
so the SCK frequency could be higher than the one requested by the
device driver (e.g. 20 MHz requested with a 100 MHz PBCLK2 gave 25 MHz).
A request above PBCLK/2 gave a zero divisor and a division by zero when
computing the actual frequency; the SST26 driver's default of 64 MHz
does that with any peripheral bus clock below 128 MHz.
Round the divisor up instead, so the actual frequency never exceeds the
requested one and the divisor is never zero. Boards whose requested
frequency is not an exact divisor of PBCLK/2 now run SPI at a lower
clock than before.
Assisted-by: Claude Code:claude-opus-5-5
Signed-off-by: Daniel P. Carvalho <danieloak@gmail.com>
Indent the case labels of switch statements, wrap long lines, align
braces and add blank lines after declarations so that both files pass
checkpatch.sh. No functional change.
Assisted-by: Claude Code:claude-opus-5-5
Signed-off-by: Daniel P. Carvalho <danieloak@gmail.com>
Re-indent the case labels of up_ioctl() and fix the remaining nxstyle
errors (long comment line, missing blank lines after declarations).
No functional change.
Assisted-by: Claude Code:claude-opus-5-5
Signed-off-by: Daniel P. Carvalho <danieloak@gmail.com>
A task woken from a semaphore, a signal wait, a message queue or an event
wait gets its timeout watchdog cancelled, but most waiters set none, and
wd_cancel() then only takes the critical section to find that out.
Check WDOG_ISACTIVE() first at these call sites. Each already holds the
critical section, so wd_expiration() cannot be running the watchdog on
another CPU and the check is exact on SMP too. wd_cancel() itself keeps
its locked check.
Assisted-by: Claude Code:claude-opus-5-5
Signed-off-by: Marco Casaroli <marco.casaroli@gmail.com>
Add the blank line nxstyle wants after three declarations. No code
change.
Assisted-by: Claude Code:claude-opus-5-5
Signed-off-by: Marco Casaroli <marco.casaroli@gmail.com>
If the `etc_romfs.c` file already exists (and therefore the `etc` folder does not exist), there is no need to use this function.
Signed-off-by: simbit18 <simbit18@gmail.com>
ttyname_r() passed the caller buffer straight to fcntl(F_GETPATH)
whenever buflen >= TTY_NAME_MAX, but every FIOC_FILEPATH handler
writes the path bounded by PATH_MAX and ignores the caller buffer
size. A tty registered under a nested /dev path, or reached through
rpmsgfs, has a path longer than TTY_NAME_MAX and overwrote the caller
buffer, silently corrupting memory behind a zero return code. The
small-buffer branch had the same defect against its own stack local
char name[TTY_NAME_MAX]. Gate the direct write on PATH_MAX instead
and stage the path through a PATH_MAX path buffer obtained via
lib_get_tempbuffer(), returning ERANGE when it does not fit.
Verified on sim:nsh with a test driver registered at an 85-character
tty path: pre-fix, ttyname_r(buf, TTY_NAME_MAX) returned 0 and
smashed the canaries behind the buffer, and the small-buffer branch
panicked; post-fix both cases return ERANGE with the canaries intact.
Assisted-by: Claude Code (glm-5.3) <claude@anthropic.com>
Signed-off-by: Junbo Zheng <zhengjunbo1@xiaomi.com>
The Config.K0 cache algorithm applies to both the I- and the D-Cache,
but the startup code only initialized the tags of the caches that were
selected in Kconfig. With only MIPS32_ICACHE the D-Cache was enabled
with indeterminate tags. Initialize the tags of both caches whenever
K0 is made cacheable (like the XC32 startup code does), and add the
missing hazard barrier after writing Config.
MIPS32_ICACHE now selects MIPS32_DCACHE when the chip has one, so that
the D-Cache maintenance needed for DMA is built whenever the D-Cache is
in use.
Assisted-by: Claude Code:claude-opus-5-5
Signed-off-by: Daniel P. Carvalho <danieloak@gmail.com>
Several bugs made the MIPS32 cache functions unusable:
- The range functions rounded the end address down instead of up and
stopped before it, so the last line was never handled. A range
within a single line started a loop that only ended when the address
wrapped around 4 GB, which took seconds.
- HIT_WRITEBACK_D was 0x15, which is Hit_Writeback_Inv_D. Hit
Writeback D is 0x19. up_clean_dcache() now uses it and
up_flush_dcache() uses Hit_Writeback_Inv_D.
- The *_all functions used Hit operations over a KSEG0 range the size of
the cache, which only affects lines caching that range. Use index
operations instead: Index_Invalidate_I, Index_Writeback_Inv_D and, to
discard the D-Cache, Index_Store_Tag_D with a zero tag.
- With CONFIG_MIPS32_CACHE_AUTOINFO the line size was computed with a
right shift instead of a left shift.
- The CACHE_OP loop label was "1", the same label the callers use to
skip the operation, and the branch delay slot was left to whatever
instruction followed.
- up_coherent_dcache() called up_invalidate_icache_all() even when it is
not built.
Assisted-by: Claude Code:claude-opus-5-5
Signed-off-by: Daniel P. Carvalho <danieloak@gmail.com>
A carrier with a switch port wired MAC to MAC has no PHY on MDIO, and
ifup failed. With IMXRT_ENET_FIXED_LINK the configured PHY, or the
board's PHY list, is tried first; if none answers the MAC runs at
100 Mbps full duplex and SIOCGMIIREG reports the link up, so the
network monitor keeps the interface up.
Signed-off-by: Royyan Zahir <royzah@gmail.com>
This adds support for the OTP flash region in the STM32H5 via both
low-level functions and an eFuse lower half driver.
Assisted-by: Claude:claude-sonnet-5
Signed-off-by: Darryl Ring <darryl@bluerobotics.com>
Since the ELF linker script keeps .eh_frame, a relocatable --gc-sections
link leaves R_X86_64_NONE relocations for collected functions. The loader
rejected them, so no kernel-mode program could be loaded on x86_64.
Assisted-by: Claude:claude-opus-5.5
Signed-off-by: raiden00pl <raiden00@railab.me>
Add CONFIG_STM32_DAC_LL_OPS support to the common STM32 DAC driver
(stm32_dac_m3m4_v1). This provides low-level ops (llops) and helper
macros (DAC_ENABLE, DAC_WRITE_DRO, DAC_START_DMA, DAC_STOP_DMA,
DAC_DUMP_REGS) matching the existing interface in stm32l4 and stm32h7.
This allows real-time control applications (such as power converters,
inverters, and function generators) to operate the DAC peripheral directly
without char driver VFS overhead.
Assisted-by: Antigravity:gemini-3.8-flash
Signed-off-by: Daniel P. Carvalho <danieloak@gmail.com>
nxsig_abnormal_termination() popped the thread's pthread cleanup
handlers in the kernel, so in the protected and kernel builds a process
could get its own code called with kernel privilege by raising a fatal
signal. POSIX runs cleanup handlers on pthread_exit() and on acting upon
a cancellation; termination by a signal is as if by _exit(), which runs
none.
Signed-off-by: Royyan Zahir <royzah@gmail.com>
Add the blank line required by nxstyle between the local declaration and the following statement in task_restart().
Signed-off-by: yushuailong <yyyusl@qq.com>
Kernel threads use the statically allocated g_kthread_group. If initialization of the first kernel thread fails, the common error path currently passes that static object to kmm_free(), corrupting the kernel heap.
Only free dynamically allocated task groups and detach the failed group from the TCB before returning.
Assisted-by: OpenAI Codex
Signed-off-by: yushuailong <yyyusl@qq.com>
group_kill_children() marks the task group as exiting, but task restart reuses that same group. Leaving the flag set causes later group shutdown to skip child termination and changes cancellation behavior for threads created after the restart.
Clear GROUP_FLAG_EXITING after the old child threads have been removed so the reused group starts in its normal state.
Assisted-by: OpenAI Codex
Signed-off-by: yushuailong <yyyusl@qq.com>
Add support for high-cycle flash which can be used for EEPROM emulation.
Assisted-by: Claude:claude-opus-5.5
Signed-off-by: Darryl Ring <darryl@bluerobotics.com>
Select the cache line size from either ARMV7M_DCACHE_LINESIZE or
ARMV8M_DCACHE_LINESIZE, so the driver can also be used with D-cache
enabled on the i.MX RT1180 Cortex-M33.
Also fix the imxrt1180-evk USB DMA allocator alignment. Pad the header
to the 32-byte DMA alignment, so that the buffer remains aligned.
Signed-off-by: Jukka Laitinen <jukka.laitinen@tii.ae>
Fix the usb phy pll bring-up sequence to match the imxrt1170 and
imxrt1180 RM:
1 enable the reference clock for the pll
2 enable the pll regulator
3 release the phy from reset
4 power up the pll
5 configure the pll_sic[pll_div_sel]
Signed-off-by: Jukka Laitinen <jukka.laitinen@tii.ae>
Use Floyd cycle detection on the mutex wait-for chain so only threads that actually participate in a cycle are reported. This avoids omitting the last cycle member and incorrectly including threads that merely lead into a deadlock.
Also handle empty output buffers and document truncation semantics.
Assisted-by: OpenAI Codex
Signed-off-by: yushuailong <yyyusl@qq.com>
Any ecall below CONFIG_SYS_RESERVED reached the context switch and signal
return paths from U-mode: a process could crash the kernel or return to
S-mode through a signal return nobody dispatched.
Signed-off-by: Royyan Zahir <royzah@gmail.com>
Any svc below CONFIG_SYS_RESERVED reached the context switch and signal
return paths from EL0: a process could crash the kernel or return to
EL1 through a signal return nobody dispatched.
Signed-off-by: Royyan Zahir <royzah@gmail.com>
STM32G0B1 devices provide SPI2, but their chip configuration does not
select STM32_HAVE_SPI2. Since STM32_SPI2 depends on that capability,
an explicit CONFIG_STM32_SPI2=y request is dropped by Kconfig.
Select the capability for STM32G0B1 so boards can enable the existing
SPI2 driver. SPI2 remains disabled unless requested. Other chip
families and the driver implementation are unchanged.
The STM32G0B1 datasheet DS13560, section 3.23, documents SPI2:
https://www.st.com/resource/en/datasheet/stm32g0b1re.pdf
Verified before/after configuration on STM32G0B1RE and STM32G0B1CE,
with STM32G071RB as an unchanged control. The same one-line fix is
included in the Golgi STM32G0B1CE firmware build 7248, whose build and
hardware acceptance were recorded on September 25, 2026.
Assisted-by: Codex:GPT-6
Signed-off-by: jsanchez-2g <jsanchez@2g-eng.com>
Describe the GPT timer support on the RA8M1 platform page and the
Arduino shield header's D2-D13 GPIO mapping on the EK-RA8M1 board page,
including the ek-ra8m1:timer-gpio configuration used to test them.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Assisted-by: Claude:claude-sonnet-5
Signed-off-by: leocafonso <leocafonso@gmail.com>
Register GPT0 (32-bit) as /dev/timer0 and GPT9 (16-bit) as /dev/timer1
during bring-up.
Register the Arduino Uno shield header's D2-D5 as inputs and D6-D13 as
outputs through the generic GPIO expander driver, as /dev/gpio0-3 and
/dev/gpio4-11.
Add the ek-ra8m1:timer-gpio configuration (nsh plus both GPT channels,
the GPIO support above, and apps/examples/gpio and
apps/examples/timer_gpio), used to validate the GPT timer driver on
hardware with an oscilloscope.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Assisted-by: Claude:claude-sonnet-5
Signed-off-by: leocafonso <leocafonso@gmail.com>
Add the General PWM Timer (GPT) as a generic timer, registered as
/dev/timerN through the upper-half timer driver. GPT0-7 are 32-bit,
GPT8-13 are 16-bit, and the timeout can be changed while running.
Give each ICU event used by GPT its own enum value instead of a
__COUNTER__-based macro, since the latter can hand out a different
number at every use.
Live period changes to the same prescaler now reload through GTPBR
(the buffered period register) instead of stopping the counter,
matching Renesas's own FSP driver, and fix a hardware-confirmed bug
where an uninitialized GTPBR silently corrupted the period after the
first cycle.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Assisted-by: Claude:claude-sonnet-5
Signed-off-by: leocafonso <leocafonso@gmail.com>
