Provide per-instance capture automonitor lookup for watchdog lower halves
that pass callback context, and avoid selecting an unrelated watchdog when
legacy lower halves provide no context. Update STM32 WWDG lower halves to pass
their instance context so multiple watchdog devices remain distinguishable.
Signed-off-by: hanzhijian <hanzhijian@zepp.com>
Assisted-by: OpenAI Codex
stm32h5/stm32_i2c.c selected the I2C2/3/4 kernel clock with
RCC_CCIPR4_I2CnSEL_PCLKx, but the H5 RCC header names those values
RCC_CCIPR4_I2CnSEL_RCCPCLKx.
Signed-off-by: raiden00pl <raiden00@railab.me>
All I2S driver operation functions say in their signature description
that negative errno values are returned on failure. However, some of
these same functions had `uint32_t` return types. This would result in
incorrect comparison of the return value against signed error code
values.
Signed-off-by: Matteo Golin <matteo.golin@gmail.com>
Limit modem version tokens parsed from AT command responses to the LTE version field sizes. Also require both HWVERSION fields before copying them so a partial parse does not read an uninitialized temporary buffer.
Signed-off-by: Old-Ding <35417409+Old-Ding@users.noreply.github.com>
The XMC_VADC_* constants describe counts, so the valid register, group, and channel indexes are below those values. The current checks allow the count itself through and then use it to index VADC group, channel, and result registers.
Reject those boundary values before the register array access.
Generated-by: OpenAI Codex
Signed-off-by: aineoae86-sys <ai.neo.ae86@gmail.com>
Replace the per-family stm32_get_uniqueid() implementations and the two
IP-versioned common variants with a single generic byte-array reader,
arch/arm/src/common/stm32/stm32_uid.c.
BREAKING CHANGE for STM32 M0 families: stm32_get_uniqueid() now always
takes a uint8_t[12] buffer.
Out-of-tree Cortex-M0 code that used the previous prototype
"void stm32_get_uniqueid(uint32_t *uid)" must change its buffer to
"uint8_t uniqueid[12]".
Signed-off-by: raiden00pl <raiden00@railab.me>
This commit updates Espressif's common source code to ensure that
critical sections are properly handled by the common source code.
Signed-off-by: Tiago Medicci Serrano <tiago.medicci@espressif.com>
The fence.i instruction is only available when the Zifencei extension
(CONFIG_ARCH_RV_ISA_ZICSR_ZIFENCEI) is supported by the hardware.
This commit adds a macro wrapper around fence.i usages to prevent
compilation errors on toolchains or targets where the Zifencei
extension is absent.
Signed-off-by: Chengdong Wang <wangcd91@gmail.com>
An unchecked integer assignment in the CAN driver may result in a division-by-zero which would result in a kernel crash (denial of service).
Tested locally, builds fine.
An unchecked integer assignment in the CAN driver may result in a division-by-zero which would result in a kernel crash (denial of service).
The CAN driver `can_ioctl` function, shown below (drivers/can/can.c), receives commands from user processes. Its received arguments `cmd` and content of `arg` are under attacker's control. In the CAN driver, some `ioctl` commands are hardware specific and are processed by calling `dev_ioctl()`. Subsequently, depending on the hardware (STM32 or AT32), this function calls `fdcan_ioctl` or `at32can_ioctl`, as shown in the snippets that follow.
```c
static int can_ioctl(FAR struct file *filep, int cmd, unsigned long arg)
{
FAR struct inode *inode = filep->f_inode;
FAR struct can_dev_s *dev = inode->i_private;
FAR struct can_reader_s *reader = filep->f_priv;
...
flags = enter_critical_section();
/* Handle built-in ioctl commands */
switch (cmd)
{
...
/* Not a "built-in" ioctl command.. perhaps it is unique to this
* lower-half, device driver. */
default:
{
ret = dev_ioctl(dev, cmd, arg);
}
break;
}
leave_critical_section(flags);
return ret;
}
```
There are a few instances where the user can trigger a kernel crash, caused by a division by zero on `CANIOC_SET_BITTIMING` command. On STM32 platforms (arch/arm/src/stm32/stm32_fdcan.c), while there is a `DEBUGASSERT` assertion for `bt->bt_baud`, the check does not cover value `0`.
```c
static const struct can_ops_s g_fdcanops =
{
...
.co_ioctl = fdcan_ioctl,
...
};
static int fdcan_ioctl(struct can_dev_s *dev, int cmd, unsigned long arg)
{
...
switch (cmd)
{
...
case CANIOC_SET_BITTIMING:
{
const struct canioc_bittiming_s *bt = (const struct canioc_bittiming_s *)arg;
uint32_t nbrp;
uint32_t ntseg1;
uint32_t ntseg2;
uint32_t nsjw;
uint32_t ie;
uint8_t state;
DEBUGASSERT(bt != NULL);
DEBUGASSERT(bt->bt_baud < STM32_FDCANCLK_FREQUENCY); // <- not valid
DEBUGASSERT(bt->bt_sjw > 0 && bt->bt_sjw <= 16);
DEBUGASSERT(bt->bt_tseg1 > 1 && bt->bt_tseg1 <= 64);
DEBUGASSERT(bt->bt_tseg2 > 0 && bt->bt_tseg2 <= 16);
/* Extract bit timing data */
ntseg1 = bt->bt_tseg1 - 1;
ntseg2 = bt->bt_tseg2 - 1;
nsjw = bt->bt_sjw - 1;
nbrp = (uint32_t)
( ((float) STM32_FDCANCLK_FREQUENCY /
((float)(ntseg1 + ntseg2 + 3) * (float)bt->bt_baud)) - 1 ); // <- div by 0
```
Similarly, another division by zero was found in Artery Technology AT32 (arch/arm/src/stm32/stm32_can.c) driver:
```c
static const struct can_ops_s g_canops =
{
...
.co_ioctl = at32can_ioctl,
...
};
static int at32can_ioctl(struct can_dev_s *dev, int cmd, unsigned long arg)
{
...
/* Handle the command */
switch (cmd)
{
...
case CANIOC_SET_BITTIMING:
{
const struct canioc_bittiming_s *bt = (const struct canioc_bittiming_s *)arg;
...
uint32_t tmp;
uint32_t regval;
DEBUGASSERT(bt != NULL);
DEBUGASSERT(bt->bt_baud < AT32_PCLK1_FREQUENCY); // <- not valid
DEBUGASSERT(bt->bt_sjw > 0 && bt->bt_sjw <= 4);
DEBUGASSERT(bt->bt_tseg1 > 0 && bt->bt_tseg1 <= 16);
DEBUGASSERT(bt->bt_tseg2 > 0 && bt->bt_tseg2 <= 8);
regval = at32can_getreg(priv, AT32_CAN_BTMG_OFFSET);
/* Extract bit timing data tmp is in clocks per bit time */
tmp = AT32_PCLK1_FREQUENCY / bt->bt_baud; // <- div by 0
```
Instances found are listed in the *Location* section below. They are not shown in detail to reduce the length of the issue.
Ensure the attacker-controlled data is properly validated before use, to stop division by zero situations. For instance:
```c
DEBUGASSERT(bt->bt_baud > 0 && bt->bt_baud < AT32_PCLK1_FREQUENCY);
```
* arch/arm/src/stm32/stm32_fdcan.c
* arch/arm/src/stm32/stm32_can.c
* arch/arm/src/sama5/sam_mcan.c
* arch/arm/src/at32/at32_can.c
* arch/arm/src/samv7/sam_mcan.c
* arch/arm/src/stm32f0l0g0/stm32_fdcan.c
* arch/arm/src/stm32f7/stm32_can.c
* arch/arm/src/stm32h5/stm32_fdcan.c
* arch/arm/src/stm32l4/stm32l4_can.c
* arch/arm/src/tiva/common/tiva_can.c
* drivers/can/mcp2515.c
Signed-off-by: Catalin Visinescu <catalin_visinescu@yahoo.com>
On ARMv7-M/ARMv8-M, the hardware exception return determines the final
SP from the physical location of the HW exception frame, ignoring any
software modification to REG_R13 in the saved register context. This
means signal handlers that adjust SP have their change silently
discarded.
Fix this by relocating the saved context in arm_sigdeliver before
calling arm_fullcontextrestore. If the desired SP (regs[REG_R13])
differs from the implied SP, memmove the entire context frame so that
the hardware exception return produces the correct final SP.
The fix runs only in the signal return path, adding zero overhead to the
normal exception return hot path.
Signed-off-by: Andrew Au <cshung@gmail.com>
When the buffer to send has a size not multiple of 4 bytes, 4-byte words
are sent correctly, but when the code reaches the section to send the
remaining bytes (1, 2 or 3) it was taking the remaining byte count as origin
of the copy, instead of the buffer (as it should). This commit fixes it
to correctly copy from the buffer pointer.
Signed-off-by: Carlos Sanchez <carlossanchez@geotab.com>
Align the NuttX open(2) flag constants with the Linux asm-generic
values so that the FUSE wire protocol and other cross-platform
interfaces work without conversion.
All code that used '(flags & O_RDONLY)' as a bitmask check (always 0
now that O_RDONLY=0) has been updated to use '(flags & O_ACCMODE)'
comparisons.
The NUTTX_O_* constants in include/nuttx/fs/hostfs.h are updated to
match, and the sim hostfs open flag mapping is fixed.
Signed-off-by: Xiang Xiao <xiaoxiang@xiaomi.com>
Add QSPIMEM_QUADDATA to the QSPI memory flags. This flag selects quad
data width while keeping the address phase on a single line (1-1-4),
which QSPIMEM_QUADIO cannot express (it forces quad on both address and
data phases). Update stm32_qspi_memory() to honour the new flag by
setting CCR_DMODE_QUAD without touching the address mode.
Signed-off-by: Sammy Tran <sammytran@geotab.com>
Move the stm32l1 sources, headers and boards into arch/arm/src/stm32l1,
arch/arm/include/stm32l1 and boards/arm/stm32l1, then finalize the split:
source each split family directly in arch/arm/Kconfig and boards/Kconfig and
remove the now-empty combined arch/arm/src/stm32 and boards/arm/stm32 trees.
BREAKING CHANGE: The legacy STM32 architecture and board paths were split into
stm32f1, stm32l1, stm32f2, stm32f3, stm32f4, and stm32g4 directories.
Out-of-tree boards must move from stm32 to the matching split family.
Signed-off-by: raiden00pl <raiden00@railab.me>
BREAKING CHANGE:
Part of splitting the legacy stm32 super-directory; relocates
the stm32g4 sources, headers and boards into arch/arm/src/stm32g4,
arch/arm/include/stm32g4 and boards/arm/stm32g4.
Signed-off-by: raiden00pl <raiden00@railab.me>
BREAKING CHANGE:
Part of splitting the legacy stm32 super-directory; relocates
the stm32f4 sources, headers and boards into arch/arm/src/stm32f4,
arch/arm/include/stm32f4 and boards/arm/stm32f4.
Signed-off-by: raiden00pl <raiden00@railab.me>
BREAKING CHANGE:
Part of splitting the legacy stm32 super-directory; relocates
the stm32f3 sources, headers and boards into arch/arm/src/stm32f3,
arch/arm/include/stm32f3 and boards/arm/stm32f3.
Signed-off-by: raiden00pl <raiden00@railab.me>
BREAKING CHANGE:
Part of splitting the legacy stm32 super-directory; relocates
the stm32f2 sources, headers and boards into arch/arm/src/stm32f2,
arch/arm/include/stm32f2 and boards/arm/stm32f2.
Signed-off-by: raiden00pl <raiden00@railab.me>
BREAKING CHANGE:
Part of splitting the legacy stm32 super-directory; relocates
the stm32f1 sources, headers and boards into arch/arm/src/stm32f1,
arch/arm/include/stm32f1 and boards/arm/stm32f1.
Signed-off-by: raiden00pl <raiden00@railab.me>
Move the stm32c0 sources, headers and boards into arch/arm/src/stm32c0,
arch/arm/include/stm32c0 and boards/arm/stm32c0, then finalize the split:
source each split family directly in arch/arm/Kconfig and boards/Kconfig and
remove the now-empty combined arch/arm/src/stm32f0l0g0 and
boards/arm/stm32f0l0g0 trees.
BREAKING CHANGE: The combined STM32F0/L0/G0/C0 architecture and board
paths were split into stm32f0, stm32l0, stm32g0, and stm32c0 directories.
Out-of-tree boards, include paths, source paths, and defconfigs must move
from stm32f0l0g0 to the matching split family.
Signed-off-by: raiden00pl <raiden00@railab.me>
BREAKING CHANGE:
Part of splitting the legacy stm32 super-directory; relocates
the stm32g0 sources, headers and boards into arch/arm/src/stm32g0,
arch/arm/include/stm32g0 and boards/arm/stm32g0.
Signed-off-by: raiden00pl <raiden00@railab.me>
BREAKING CHANGE:
Part of splitting the legacy stm32 super-directory; relocates
the stm32l0 sources, headers and boards into arch/arm/src/stm32l0,
arch/arm/include/stm32l0 and boards/arm/stm32l0.
Signed-off-by: raiden00pl <raiden00@railab.me>
BREAKING CHANGE:
Part of splitting the legacy stm32 super-directory; relocates
the stm32f0 sources, headers and boards into arch/arm/src/stm32f0,
arch/arm/include/stm32f0 and boards/arm/stm32f0.
Signed-off-by: raiden00pl <raiden00@railab.me>
BREAKING CHANGE: Common STM32 source and private header files moved to
arch/arm/src/common/stm32. Out-of-tree code that references family-local
common source paths must update includes, build rules, and source paths
to the new common STM32 location.
Signed-off-by: raiden00pl <raiden00@railab.me>
BREAKING CHANGE: Convert the legacy STM32 F1/F2/F3/F4/G4/L1 port to the concrete
family selectors while keeping the shared STM32 selector hidden.
Legacy STM32 family selector Kconfig symbols were split by
concrete STM32 sub-family. Out-of-tree defconfigs and code must update
CONFIG_ARCH_CHIP_* selections to the new family-specific selectors.
Signed-off-by: raiden00pl <raiden00@railab.me>
BREAKING CHANGE: STM32N6 Kconfig symbols were renamed from CONFIG_STM32N6_* to CONFIG_STM32_*.
Out-of-tree code must update defconfigs and Kconfig references to the new CONFIG_STM32_* names.
Signed-off-by: raiden00pl <raiden00@railab.me>
BREAKING CHANGE: STM32WL5 Kconfig symbols were renamed from CONFIG_STM32WL5_* to CONFIG_STM32_*.
Out-of-tree code must update defconfigs and Kconfig references to the new CONFIG_STM32_* names.
Signed-off-by: raiden00pl <raiden00@railab.me>
BREAKING CHANGE: STM32WB Kconfig symbols were renamed from CONFIG_STM32WB_* to CONFIG_STM32_*.
Out-of-tree code must update defconfigs and Kconfig references to the new CONFIG_STM32_* names.
The custom clock option is a special breaking case that does not follow the family-to-common pattern:
CONFIG_ARCH_BOARD_STM32WB_CUSTOM_CLOCKCONFIG was renamed to CONFIG_ARCH_BOARD_STM32_CUSTOM_CLOCKCONFIG.
Signed-off-by: raiden00pl <raiden00@railab.me>
BREAKING CHANGE: STM32U5 Kconfig symbols were renamed from CONFIG_STM32U5_* to CONFIG_STM32_*.
Out-of-tree code must update defconfigs and Kconfig references to the new CONFIG_STM32_* names.
The custom clock option is a special breaking case that does not follow the family-to-common pattern:
CONFIG_ARCH_BOARD_STM32U5_CUSTOM_CLOCKCONFIG was renamed to CONFIG_ARCH_BOARD_STM32_CUSTOM_CLOCKCONFIG.
Signed-off-by: raiden00pl <raiden00@railab.me>
BREAKING CHANGE: STM32L5 Kconfig symbols were renamed from CONFIG_STM32L5_* to CONFIG_STM32_*.
Out-of-tree code must update defconfigs and Kconfig references to the new CONFIG_STM32_* names.
The custom clock option is a special breaking case that does not follow the family-to-common pattern:
CONFIG_ARCH_BOARD_STM32L5_CUSTOM_CLOCKCONFIG was renamed to CONFIG_ARCH_BOARD_STM32_CUSTOM_CLOCKCONFIG.
Signed-off-by: raiden00pl <raiden00@railab.me>
BREAKING CHANGE: STM32L4 Kconfig symbols were renamed from CONFIG_STM32L4_* to CONFIG_STM32_*.
Out-of-tree code must update defconfigs and Kconfig references to the new CONFIG_STM32_* names.
The custom clock option is a special breaking case that does not follow the family-to-common pattern:
CONFIG_ARCH_BOARD_STM32L4_CUSTOM_CLOCKCONFIG was renamed to CONFIG_ARCH_BOARD_STM32_CUSTOM_CLOCKCONFIG.
Signed-off-by: raiden00pl <raiden00@railab.me>
BREAKING CHANGE: STM32H7 Kconfig symbols were renamed from CONFIG_STM32H7_* to CONFIG_STM32_*.
Out-of-tree code must update defconfigs and Kconfig references to the new CONFIG_STM32_* names.
The custom clock option is a special breaking case that does not follow the family-to-common pattern:
CONFIG_STM32H7_CUSTOM_CLOCKCONFIG was renamed to CONFIG_ARCH_BOARD_STM32_CUSTOM_CLOCKCONFIG.
Signed-off-by: raiden00pl <raiden00@railab.me>
BREAKING CHANGE: STM32H5 Kconfig symbols were renamed from CONFIG_STM32H5_* to CONFIG_STM32_*.
Out-of-tree code must update defconfigs and Kconfig references to the new CONFIG_STM32_* names.
The custom clock option is a special breaking case that does not follow the family-to-common pattern:
CONFIG_ARCH_BOARD_STM32H5_CUSTOM_CLOCKCONFIG was renamed to CONFIG_ARCH_BOARD_STM32_CUSTOM_CLOCKCONFIG.
Signed-off-by: raiden00pl <raiden00@railab.me>
BREAKING CHANGE: STM32F7 Kconfig symbols were renamed from CONFIG_STM32F7_* to CONFIG_STM32_*.
Out-of-tree code must update defconfigs and Kconfig references to the new CONFIG_STM32_* names.
The custom clock option is a special breaking case that does not follow the family-to-common pattern:
CONFIG_STM32F7_CUSTOM_CLOCKCONFIG was renamed to CONFIG_ARCH_BOARD_STM32_CUSTOM_CLOCKCONFIG.
Signed-off-by: raiden00pl <raiden00@railab.me>
Shared STM32 Kconfig option definitions from the stm32 (F1/F2/F3/F4/G4/L1)
and stm32f0l0g0 (F0/L0/G0/C0) families moved into arch/arm/src/common/stm32.
Signed-off-by: raiden00pl <raiden00@railab.me>
BREAKING CHANGE: STM32F0/L0/G0/C0 Kconfig symbols were renamed from
CONFIG_STM32F0L0G0_* to CONFIG_STM32_*. Out-of-tree code must update defconfigs
and Kconfig references to the new CONFIG_STM32_* names.
The custom clock option is a special breaking case that does not follow the
family-to-common pattern:
CONFIG_ARCH_BOARD_STM32F0G0L0_CUSTOM_CLOCKCONFIG was renamed to CONFIG_ARCH_BOARD_STM32_CUSTOM_CLOCKCONFIG.
Signed-off-by: raiden00pl <raiden00@railab.me>
Add the shared STM32 Kconfig include and introduce the hidden
common ARCH_CHIP_STM32 selector used by concrete STM32 families.
Signed-off-by: raiden00pl <raiden00@railab.me>
BREAKING CHANGE: CONFIG_STM32F7_QUADSPI and CONFIG_STM32H7_QUADSPI are
renamed to CONFIG_STM32F7_QSPI and CONFIG_STM32H7_QSPI. Out-of-tree F7/H7
board configurations must update the symbol name.
Standardize the F7/H7 QSPI enable symbol on the QSPI name (the QUADSPI and
QSPI peripherals are the same IP block). Only the Kconfig enable symbol and
its CONFIG_ references are renamed; the QUADSPI hardware register/pin/DMA
macros are unchanged.
Signed-off-by: raiden00pl <raiden00@railab.me>
Fixed three bugs in the RP23XX (RISC-V) PWM driver, mirroring the fix
previously applied to the ARM variant:
* setup_period: The previous divisor calculation used integer arithmetic
that caused overflow and loss of precision. The divider is now computed
as a 16-bit fixed-point value (div16) using 64-bit arithmetic, and
clamped to the valid hardware range (0x10 to 0xFFF).
* setup_pulse: The compare value was incorrectly scaled by TOP instead
of 65535, producing wrong duty cycles. The formula is now corrected
to ((duty * (top + 1)) / 65535) with an overflow guard.
* pwm_start: The driver was not updated as part of the breaking change
introduced in commit 4df80e19 ("!drivers/pwm: remove PWM_MULTICHAN
option"). Access to single channel API is now info->channels[0].duty
instead of info[0].duty.
Signed-off-by: Brunocor26 <bruno.correia@ubi.pt>
up_disableusartint() saves USART interrupt state from hardware CTL0-CTL3
registers but omits the CTL selector bits (bits 24-27) in the encoded
ie value. When up_restoreusartint() later restores interrupts, it uses
ie >> 24 to determine which CTL register to write. Without selector bits
this evaluates to 0, so no CTL register is updated and all interrupt
enables (including RBNEIE) are permanently lost.
This causes RX interrupts to never fire after any call to up_putc()
(e.g. via syslog), making the serial console unable to receive input.
Fix by adding the corresponding CTL selector bit (USART_CFG_CTLx_INT
<< USART_CFG_SHIFT) whenever a CTL register has active interrupt bits.
Signed-off-by: lccosy <1191294205@qq.com>
Add NULL check for g_uart_devs[i] before accessing ->priv in
arm_earlyserialinit() loop. When a USART is not enabled in defconfig,
g_uart_devs[i] is NULL, causing a HardFault crash during early boot.
The bug occurs because the original code only checked g_uart_devs[i]->priv
without first verifying g_uart_devs[i] is not NULL. On Cortex-M4, NULL
pointer dereference reads from Flash vector table (0x00000000 maps to
0x08000000), returning a function pointer that causes BusFault when
written to.
This fix matches the existing NULL check pattern used in arm_serialinit()
at line 2835 of the same file.
Tested on mplant-gd32f450 board with only USART5 enabled in defconfig.
Before fix: HardFault at boot (IPSR=3, PC=0x080003e0)
After fix: System boots normally to NSH Shell
Signed-off-by: lccosy <1191294205@qq.com>
In arm_addrenv_create_region(), the inner loop already advances vaddr by
MM_PGSIZE for each mapped page, so after filling one L2 page table
(i.e., ENTRIES_PER_L2TABLE pages), vaddr has naturally advanced to the
start of the next 1MB section. The old code additionally added
i * SECTION_SIZE, causing the L1 entry for the second and subsequent
sections to skip one section each iteration—leaving virtual address
holes in the mapping.
Remove the redundant i * SECTION_SIZE offset so that the L1 entry tracks
the vaddr already maintained by the inner loop, producing contiguous
section mappings.
Signed-off-by: leisiji <2265215145@qq.com>
