dns_recv_response() checked for room using sizeof(struct dns_answer_s),
but that structure is the 10-byte header plus a union holding the largest
address it can carry. With IPv6 built the union is 16 bytes, so the check
demanded 26 bytes where 10 were needed, and any answer sitting at the end
of a response was rejected as truncated.
An A record answer supplies 14 bytes, so whether a lookup worked depended
on how much padding the server happened to send after it:
$ dig +noedns @10.1.1.2 github.com A # ANSWER 1, AUTHORITY 0, ADDITIONAL 0
-> answer is last in the packet, 14 bytes remain, rejected
$ dig +noedns @10.11.5.254 github.com A # ANSWER 1, AUTHORITY 13, ADDITIONAL 7
-> 26+ bytes remain, accepted
On the board, before and after, against the first of those servers:
nsh> nslookup apache.org
[CPU1] dns_recv_response: DNS answer header truncated
Host: apache.org Addr: 2a04:4e42::644 <- A record lost
nsh> nslookup apache.org
Host: apache.org Addr: 2a04:4e42::644
Host: apache.org Addr: 151.101.2.132 <- both returned
The address that follows the header is already bounds checked separately,
where its real length is known, so only the header check was wrong. The
size is now a named constant next to the structure, since the rest of this
function already used the literal 10 for the same quantity.
Only IPv4-only builds escaped it, where sizeof happens to equal 14 and an
A record fits exactly.
Assisted-by: Claude:claude-opus-5
Signed-off-by: Justin Hammond <justin@dynam.ac>
nxsig_timedwait parked a pointer to the caller's siginfo buffer in the
TCB, for whoever eventually posts the signal to fill in. But the
poster fills it in from its own context (another task, a kernel
thread, an interrupt), and in a kernel build the caller's buffer is
an address in the caller's private address space, which the poster
does not share. The write lands wherever the currently active
mappings put it: the waiter wakes to find garbage where the signal
number should be, and some other process is left with a corrupted
page. Flat builds share one address space, which is why this never
showed there.
Park the stack local in the TCB instead. That is kernel memory,
mapped in every context, and it is copied out to the caller's buffer
after waking, in the caller's own context, exactly where the
pending-signal path already does the same thing.
Found on the EIC7700X port by an RTC alarm: the alarm signal, posted
from the low-priority work queue, woke a sigwaitinfo caller into an
assertion on the unblocking signal number while the init process,
whose address space had received the stray write, died of a jump to
address zero. With this change the same test arms, waits and wakes
cleanly, repeatedly.
Assisted-by: Claude:claude-opus-5
Signed-off-by: Justin Hammond <justin@dynam.ac>
Add CONFIG_NRF52_SAADC_CONTINUOUS for gapless timer-triggered sampling
with double-buffered EasyDMA. The SAADC is auto-restarted directly from
the END event through a PPI channel (no CPU in the loop) and each
completed buffer is delivered to the ADC upper half via the batch
interface. Enables high-rate single-channel streaming.
Signed-off-by: raiden00pl <raiden00@railab.me>
Assisted-by: Claude Code
The registry is a singly linked list of static structures, so registering
one of them a second time does not add a second entry: it points that
entry's own link at itself, and the list stops having an end.
Nothing notices while every device that turns up matches something near
the head, because the search returns before it reaches the loop. The
first device that matches nothing at all, meaning anything without a
class driver built in, walks the list to look for it and never comes back,
holding the registry lock. On a multiprocessor the rest of the system
follows it down: every other processor that touches the registry spins,
and on the one measured here that included the console, so a board with a
USB keyboard and no keyboard driver came up and then answered nothing.
Registering twice is easy to do by accident. drivers_initialize() calls
usbhost_drivers_initialize(), which registers every class the
configuration selected, and board code that also registers one, which
many boards do, gets a second call for free.
So look before linking, and treat a repeat registration as the no-op the
caller expected it to be.
Assisted-by: Claude:claude-opus-5
Signed-off-by: Justin Hammond <justin@dynam.ac>
The control transfer trace entry names the controller "HXCI", so a log of
an enumeration reads as though a different controller were involved. One
neighbouring entry also spells the port "RHport" where the rest of the
table spells it "RHPort".
Text only. No trace identifier or argument changes.
Assisted-by: Claude:claude-opus-5
Signed-off-by: Justin Hammond <justin@dynam.ac>
The xHCI driver traces endpoint allocation with XHCI_VTRACE2_EPALLOC, but
that id is in neither the enumeration nor the string table, so the driver
does not compile once verbose tracing is turned on:
usbhost_xhci_pci.c:3285: 'XHCI_VTRACE2_EPALLOC' undeclared
It builds today only because usbhost_vtrace2() collapses to a macro that
discards its arguments unless HAVE_USBHOST_TRACE_VERBOSE is defined, which
is what stops anyone finding this until they go looking for a trace.
Add the id and the string to match, keeping the two tables in step.
Assisted-by: Claude:claude-opus-5
Signed-off-by: Justin Hammond <justin@dynam.ac>
After simplifications in NuttX init process, app core boots too fast so that
net core doesn't have time to initialize HCI service.
Let's add a short sleep before BLE initialization in app core as a temporary
fix, in the future it should be done better.
Signed-off-by: raiden00pl <raiden00@railab.me>
A drive that has been anywhere near another operating system almost
always carries a partition table rather than a filesystem starting at
sector zero, so the single block device this driver registers is usually
the one thing nobody can mount. A USB stick written with an installer
image is a good example: sector zero holds a protective MBR, and what
somebody wants is the EFI system partition several gigabytes in.
Read the table and give each partition a block device of its own beside
the whole drive, named the way every other system names them. The
parsing is already in the tree and understands both MBR and GPT; this
only calls it and registers what it finds.
The whole-drive node stays exactly where it was, for anyone who wants
the raw thing or whose drive really does hold a bare filesystem.
Assisted-by: Claude:claude-opus-5
Signed-off-by: Justin Hammond <justin@dynam.ac>
Add a lower-half driver for the Microchip MCP4451 quad digital
potentiometer. Wiper and terminal control access is provided through
the common potentiometer interface, raw register access through
chip-specific ioctl commands.
Signed-off-by: raiden00pl <raiden00@railab.me>
Assisted-by: Claude Code
Add a common upper-half character driver for digital potentiometers
with a generic set of ioctl commands (wiper set/get, terminal control,
device properties) that can be shared by chip-specific lower halves.
Signed-off-by: raiden00pl <raiden00@railab.me>
Assisted-by: Claude Code
fat_path2dirname() marks a parsed name as needing long file name
entries by clearing the first byte of the short name buffer, and
fat_dirnamewrite() writes the long name entries only while that marker
survives. Since commit bc9e1ffb01, a name short enough to fit the 8.3
form is speculatively re-parsed as a short name, and the re-parse
fills the short name buffer with spaces before it examines a single
character. When it then rejects the name (lower case, for example) the
spaces stay behind, the marker is gone, and the file is created with
eleven spaces for a name: no long name entries, a blank alias.
Every such file aliases to every other, since every rejected name
converts to the same blank entry. Create a.txt, then create big1, and
both names now open one file; a directory of them lists as a single
nameless entry. Any application that writes two lowercase short-named
files and reads the first back gets the second's contents.
Restore the marker when the speculative parse fails.
Tested on FAT32 with CONFIG_FAT_LFN: lower case, upper case, mixed
case and over-length names now create distinct, correctly named
entries that survive unmount and reboot; upper case 8.3 names still
produce plain short entries with no long name chain.
Assisted-by: Claude:claude-opus-5
Signed-off-by: Justin Hammond <justin@dynam.ac>
Adds documentation entries to the tab5 board, mentioning the new
defconfigs and updates support features.
Signed-off-by: Filipe Cavalcanti <filipe.cavalcanti@espressif.com>
Adds two examples on esp32p4-tab5 that use LCD and touchscreen.
Both redirect the serial console to UART0 instead of USB.
Signed-off-by: Filipe Cavalcanti <filipe.cavalcanti@espressif.com>
Adds support for ST7123 touchscreen controller on esp32p4-tab5.
Includes new KConfig option and additions to hmi_power source.
Signed-off-by: Filipe Cavalcanti <filipe.cavalcanti@espressif.com>
Adds support for st7121 and st7123 variants for LCD support
on the esp32p4-tab5 board. Includes power management though IO
expander under 'hmi_power' and new board KConfig options.
Signed-off-by: Filipe Cavalcanti <filipe.cavalcanti@espressif.com>
Adds support for bringup of the two IO Expanders available on the
esp32p4-tab5 board. Those IO Expanders allow for control of many
peripherals such as radio, camera, display and touch.
Signed-off-by: Filipe Cavalcanti <filipe.cavalcanti@espressif.com>
Adds lowerhalf MIPI DSI driver for RISC-V Espressif devices,
including KConfig options for LDO and MIPI_DSI.
Signed-off-by: Filipe Cavalcanti <filipe.cavalcanti@espressif.com>
cdcuart_txempty() held priv->lock across EP_POLL(), which re-enters the
class through cdcacm_wrcomplete() and takes that same non-recursive lock,
and then took it a second time to read nwrq. Release it after the
disconnected check, matching cdcuart_txready()/cdcuart_rxavailable().
Fixes: cc067ab199 ("drivers/usbdev/cdcacm.c: Use small lock to protect cdcacm")
Signed-off-by: Felipe Moura <moura.fmo@gmail.com>
Grow the in-memory pseudofile buffer by doubling instead of
1<<LOG2_CEIL, which can under-allocate on 32-bit targets for large
expand sizes. Also:
* reject size_t wrap before expand on write (-EFBIG)
* clear newly addressed bytes when the file grows
* route truncate growth through the same expand path
Impact: CONFIG_PSEUDOFS_FILE expand/write/truncate only; no API or
build-system change.
Testing: host arithmetic PoC blocked; WSL sim:pseudofile-poc
(SIM_M32+KASAN) write returns -ENOMEM instead of SIGSEGV in memcpy.
Signed-off-by: ywhkkx <2076064543@qq.com>
The task and pthread entry points were entered with the stack pointer
left by the kernel side of the startup path, not aligned to the 16
bytes the ABI requires: applications calling a variadic function with
floating point arguments crashed with a general protection exception
on the first SSE store of the argument save area. Align the stack
pointer when returning to user space, where the value is known.
Signed-off-by: raiden00pl <raiden00@railab.me>
Assisted-by: Claude Code
The disconnect handler only reconnects when the reported reason is
WIFI_REASON_ASSOC_LEAVE, so an AP-initiated deauth (beacon timeout, auth or
assoc expire) leaves the station down forever. Restore the intent flag the
driver used before 1f7c3a32e5 and 20ff68bd65, matching the ESP-IDF rule of
reconnecting unless the disconnection was requested locally.
Signed-off-by: Felipe Moura <moura.fmo@gmail.com>
A packet received while the request queue was empty was silently dropped
and the transfer deadlocked. Hold it in the endpoint buffer until the
class driver submits a read request.
Signed-off-by: raiden00pl <raiden00@railab.me>
Assisted-by: Claude Code
A data IN endpoint has a single hardware buffer, but the driver armed
the next packet before the host had read the previous one, silently
overwriting it and dropping data under sustained bulk IN traffic. Track
an armed-packet-in-flight state per endpoint (epinflight) and defer
re-arming until the host read completes (EPDATASTATUS), sending the next
packet from nrf52_epdatainterrupt(). Also release the DMA lock right
after the busy-wait for ENDEPIN on data endpoints so other endpoints do
not stall on an interrupt round-trip.
Signed-off-by: raiden00pl <raiden00@railab.me>
Assisted-by: Claude Code
igmp_input() validated the IGMP checksum with:
if (net_chksum((FAR uint16_t *)igmp, IGMP_HDRLEN) != 0)
but net_chksum() returns the raw one's complement sum of the 16-bit
words (it does NOT take the one's complement of that sum). For a valid
IGMP packet whose checksum field holds ~S (as written by igmp_send()),
the sum of all 16-bit words is S + ~S = 0xffff, never 0.
So the existing check `!= 0` was always true for any well-formed IGMP
message, sending every valid packet down the "Checksum error" path to
be silently dropped and breaking IGMP membership query/report processing.
Compare against 0xffff instead, matching the convention used by the
other transport input handlers:
- ipv4_input.c: (ipv4_chksum(IPv4BUF) != 0xffff)
- tcp_input.c: (tcp_chksum(dev) != 0xffff)
This is also consistent with the sender side in igmp_send.c, which
stores `igmp->chksum = ~igmp_chksum(...)`.
Signed-off-by: zhekunren <zhekunren@qq.com>
Assisted-by: GLM-5.2 <noreply@z.ai>
Remove the manual mkimage step because CONFIG_UBOOT_UIMAGE=y already
generates a valid uImage. This brings the documentation up to date
with the uImage usage that was already standard in practice.
build will fail with the following error
arm-none-eabi-ld: /awork/android/NuttX/nuttx/nuttx section flash'
arm-none-eabi-ld: region .text' will not fit in region flash' overflowed by 1144 bytes
before
Register: qe
Register: nsh
Register: sh
LD: nuttx
arm-none-eabi-ld: /awork/android/NuttX/nuttx/nuttx section .text will not fit in region flash
arm-none-eabi-ld: region flash overflowed by 1144 bytes
Memory region Used Size Region Size %age Used
flash: 66680 B 64 KB 101.75%
sram: 5136 B 16 KB 31.35%
make[1]: *** [Makefile:230: nuttx] Error 1
make: *** [tools/Unix.mk:569: nuttx] Error 2
after
Register: qe
Register: nsh
Register: sh
LD: nuttx
Memory region Used Size Region Size %age Used
flash: 38008 B 64 KB 58.00%
sram: 4132 B 16 KB 25.22%
CP: nuttx.hex
CP: nuttx.bin
Signed-off-by: Alin Jerpelea <alin.jerpelea@sony.com>
Restore the esp32c3-devkit:dropbear defconfig and its documentation, now that
the AES symbol collision between the Wi-Fi stack and crypto/aes.c is fixed in
the ESP HAL. netutils/dropbear depends on CRYPTO_CRYPTODEV_SOFTWARE_CRYPTO,
so the defconfig enables the cryptodev software backend and base64 codecs.
Signed-off-by: Felipe Moura <moura.fmo@gmail.com>
The HAL's wpa_supplicant defines aes_encrypt()/aes_decrypt(), which collide
at link time with the same symbols from crypto/aes.c whenever a Wi-Fi
configuration also enables CRYPTO_CRYPTODEV_SOFTWARE_CRYPTO. Bump the HAL to
the revision that prefixes them on NuttX (espressif/esp-hal-3rdparty#13).
Signed-off-by: Felipe Moura <moura.fmo@gmail.com>
Initialize i2c_ll_hw_cmd_t in sendstart/startrecv so ack_exp/done are
not left with stack garbage that can NACK or skip the address byte.
Program i2c_hal_set_bus_timing() with the requested bus_freq instead of
the board default so msg frequency is applied.
Affects only Espressif devices.
Co-authored-by: Cursor <cursoragent@cursor.com>
Signed-off-by: Filipe Cavalcanti <filipe.cavalcanti@espressif.com>
The 32 MHz TCXO that clocks the SX1276 is powered from PA12 and was never
driven, so the radio had no clock at all. The user button was copied from
the Nucleo L073RZ and left on PC13, which carries DIO3 of the radio on this
board; it is PB2.
Adds lorawan_tx and lorawan_beacon, with the radio defaults of a public
LoRaWAN network in the 915 MHz band, and fills in the board page.
Assisted-by: Claude Code 4.8
Signed-off-by: Jorge Guzman <jorge.gzm@gmail.com>
- The frequency step was truncated to 61 Hz, while it is FXOSC/(2**19),
about 61.035 Hz. The error puts a 915 MHz channel more than 500 kHz away
from the requested frequency, outside its own bandwidth.
- The low or high frequency front end was left at its reset value, so a board
wired for 868 or 915 MHz neither transmitted nor received.
- sx127x_rx_watchdog() is only used by the FSK and OOK path but was compiled
whenever receive support was on, so a LoRa only configuration failed to
build with -Werror. nrf52840-dk:sx127x is such a configuration.
Adds the sync word, the default bandwidth and the default spreading factor as
configuration options, all defaulting to the previous behaviour, and a page
for the driver under components/drivers.
Assisted-by: Claude Code 4.8
Signed-off-by: Jorge Guzman <jorge.gzm@gmail.com>
Character driver for the Semtech SX1301, the baseband processor of a LoRaWAN
gateway, and the two SX125x radios it drives. Received packets come from
read(), downlinks go to write(), and the channel plan, the start and the stop
are ioctls.
The interface is device independent, in nuttx/wireless/lpwan/lora_gw.h with
the commands in the common WLIOC_GW_* space, so another concentrator driver
can implement it and the same application drive it.
Adds a lorawan_gw configuration for the Nucleo F746ZG with a shield of the
LRWAN_GS_HF1 family. Off by default (LPWAN_SX1301).
Assisted-by: Claude Code 4.8
Signed-off-by: Jorge Guzman <jorge.gzm@gmail.com>
STM32_STM32L0 does not select STM32_HAVE_SYSCFG, so STM32_SYSCFG does not
exist for this family and the clock of the peripheral is never enabled. The
mapping of a pin to an EXTI line lives in SYSCFG_EXTICR, so every write to it
was dropped and a GPIO interrupt on any port other than port A never fired.
STM32_SYSCFG is default y, so no configuration changes.
Assisted-by: Claude Code 4.8
Signed-off-by: Jorge Guzman <jorge.gzm@gmail.com>
Allow zero-length I2C transfers when DEBUGASSERT is enabled.
Zero-length transfers (used for I2C bus scanning) never access the
transfer buffer, so any EasyDMA pointer is valid.
Signed-off-by: raiden00pl <raiden00@railab.me>
Assisted-by: Claude Code
stm32_i2c_init() and stm32_i2c_deinit() hardcoded APB1LENR/APB1LRSTR
while taking the enable and reset bits from the per-instance config.
That is correct for I2C1-3, but I2C4 is on APB4: its clk_bit and
reset_bit are RCC_APB4ENR_I2C4EN and RCC_APB4RSTR_I2C4RST, both bit 7,
and bit 7 of APB1LENR/APB1LRSTR is TIM13.
So for I2C4 the driver enabled and pulsed the reset of TIM13 instead,
and never reset the I2C4 peripheral at all. I2C4 still works because
rcc_enableapb4() enables I2C4EN at boot, but the peripheral reset that
stm32_i2c_reset() (CONFIG_I2C_RESET) relies on to clear a wedged I2C
state machine never happens, and deinit gates TIM13 while leaving the
I2C4 clock running.
Store the clock enable and reset register addresses in
struct stm32_i2c_config_s next to the bits, and use them in
stm32_i2c_init() and stm32_i2c_deinit().
Signed-off-by: Jacob Dahl <dahl.jakejacob@gmail.com>
The CMake build referenced arm64_physpgaddr.c and arm64_virtpgaddr.c,
which no longer exist (consolidated into arm64_pgalloc.c, already
listed).
Signed-off-by: raiden00pl <raiden00@railab.me>
Assisted-by: Claude Code
igmp_input() verified the packet length with:
if (dev->d_len < NET_LL_HDRLEN(dev) + (iphdrlen + IGMP_HDRLEN))
but dev->d_len at this point holds the IPv4 total length (IP header plus
payload) without the link-layer header, consistent with the convention
established in ipv4_in()/ipv6_in() (which do `dev->d_len -=
NET_LL_HDRLEN(dev)`) and used by all other transport input handlers
(icmp, tcp, udp), none of which reference NET_LL_HDRLEN.
Adding NET_LL_HDRLEN(dev) to the right-hand side made the check always
true for valid IGMP packets:
iphdrlen + IGMP_HDRLEN < NET_LL_HDRLEN + iphdrlen + IGMP_HDRLEN
(= 0 < NET_LL_HDRLEN)
so every well-formed IGMP message hit the "Length error" path and was
silently dropped, breaking IGMP membership query/report processing.
Drop the extra NET_LL_HDRLEN(dev) so the check matches the other
protocol handlers.
Signed-off-by: zhekunren <zhekunren@qq.com>
Adds documentation to input and touchscreen controller files, regarding
support for ST7123 IC.
Signed-off-by: Filipe Cavalcanti <filipe.cavalcanti@espressif.com>
Add support for ST7123 touchscreen controller (I2C only).
It requires board level init to register a callback, as polling
mode is not supported.
Signed-off-by: Filipe Cavalcanti <filipe.cavalcanti@espressif.com>
Add support for the Microchip 24CW160 (2048B, 32-byte pages, 2-byte
data address)
Signed-off-by: raiden00pl <raiden00@railab.me>
Assisted-by: Claude Code
The CMake build had no STARTUP_OBJS (crt0) target and no elf.cmake, so
applications were linked without crt0 and without '-e _start': the ELF
entry defaulted to main and applications crashed on exit returning to
a NULL address.
Add STARTUP_OBJS and elf.cmake with the LDELFFLAGS equivalents from
Toolchain.defs, following the other architectures.
Signed-off-by: raiden00pl <raiden00@railab.me>
Assisted-by: Claude Code
Use CONFIG_STM32_UART8_SERIALDRIVER so g_uart8rxbuffer and
g_uart8txbuffer are compiled when UART8 is enabled.
Signed-off-by: Joao Mario Lago <joao.mario.lago@hotmail.com>
The CMake build does not need the manual export/import/mkromfsimg
steps: applications and the ROMFS image are generated by the normal
build. Document the CMake invocation and how to run the image.
Signed-off-by: raiden00pl <raiden00@railab.me>
Assisted-by: Claude Code
The CMake build compiled no ROMFS source, so kernel-mode
configurations (knsh_romfs) failed to link with undefined references
to romfs_img. Generate the ROMFS image from the applications in
<build>/bin with genromfs/xxd and compile it into the board library;
other configurations keep the empty stub.
Signed-off-by: raiden00pl <raiden00@railab.me>
Assisted-by: Claude Code
