Add NULL check for g_uart_devs[i] before accessing ->priv in
arm_earlyserialinit() loop. When a USART is not enabled in defconfig,
g_uart_devs[i] is NULL, causing a HardFault crash during early boot.
The bug occurs because the original code only checked g_uart_devs[i]->priv
without first verifying g_uart_devs[i] is not NULL. On Cortex-M4, NULL
pointer dereference reads from Flash vector table (0x00000000 maps to
0x08000000), returning a function pointer that causes BusFault when
written to.
This fix matches the existing NULL check pattern used in arm_serialinit()
at line 2835 of the same file.
Tested on mplant-gd32f450 board with only USART5 enabled in defconfig.
Before fix: HardFault at boot (IPSR=3, PC=0x080003e0)
After fix: System boots normally to NSH Shell
Signed-off-by: lccosy <1191294205@qq.com>
Add `EXTRA_LIB_DEPS` to the simulator nuttx target prerequisites.
This lets Make notice when an extra application library, such as a Rust
static library rebuilt by Cargo, has changed and ensures the final
simulator binary is relinked.
Signed-off-by: Shoji Tokunaga <toku@mac.com>
The previous up_backtrace() relied entirely on host_backtrace() (a thin
wrapper around glibc's backtrace()), which can only unwind the host
thread that calls it. As a result, when assert / dump_tasks() walked the
task list and called sched_dumpstack() for every task, every task other
than the currently-running one returned a zero-length backtrace, and the
output was silently dropped. In practice this meant that on sim only
the crashing task ever produced a usable trace.
Fix this by walking the frame-pointer chain ourselves whenever the
target tcb is not the running task. Because sim's setjmp/longjmp is
provided by NuttX itself (libs/libc/machine/sim/arch_setjmp_*.S) and not
by host libc, the rbp/rsp/rip (or arm fp/sp/pc) saved in tcb->xcp.regs
are plain unmangled pointers, identical across Linux, macOS and Windows
hosts. The frame layout ([fp]=prev fp, [fp+1]=return address) is also
shared by every host ABI sim supports (x86, x86_64, ARM, ARM64).
The walker validates that fp lies inside the task's stack and is
properly aligned, and stops when fp[0] is NULL, so a corrupted stack
cannot make us read out of bounds. The running-task path is unchanged
and still uses host_backtrace() so DWARF unwinding through host
libraries continues to work.
Requires CONFIG_FRAME_POINTER=y so the compiler emits a usable fp link.
Signed-off-by: Lingao Meng <menglingao@xiaomi.com>
nrf91_usrsock_ioctl_handler() copies req->arglen bytes from the
request payload into the fixed-size usrsock->out buffer without
validating that the payload actually fits either the received
request or the destination buffer. A crafted ioctl request with
an inflated arglen triggers:
1. OOB read — memcpy reads past the end of the received request.
2. OOB write — memcpy writes past the end of usrsock->out.
Add three checks before the copy:
- len >= sizeof(*req): ensure the full request header is present.
- copylen <= len - sizeof(*req): payload must fit the received data.
- copylen <= sizeof(usrsock->out) - sizeof(*ack): payload must fit
the destination buffer.
The recvfrom handler in the same file already performs the equivalent
buffer-size check (line 892). Fixes#18515.
Signed-off-by: hanzj <hanzjian@zepp.com>
usrsock_ioctl_handler() copies req->arglen bytes from the request
payload into the fixed-size usrsock->out buffer without validating
that the payload fits either the received request or the destination
buffer. This is the same class of vulnerability as the one already
fixed in nrf91_modem_sock.c (commit a43fb69283).
Add three checks before the copy:
- len >= sizeof(*req): ensure the full request header is present.
- copylen <= len - sizeof(*req): payload must fit the received data.
- copylen <= SIM_USRSOCK_BUFSIZE - sizeof(*ack): payload must fit
the destination buffer.
Signed-off-by: hanzj <hanzjian@zepp.com>
This change causes the frame buffer allocation to use the connected
device's physical resolution by default. The user also has the option to
force a request for a different, compile-time selected resolution if the
physical display can support something else the user would prefer.
Signed-off-by: Matteo Golin <matteo.golin@gmail.com>
Add a custom aarch64 Mach-O Rust target for macOS sim builds and use it
instead of an Apple Darwin Rust target. This keeps Rust cfg values aligned
with NuttX while producing Mach-O objects required by the simulator link.
Also align sim host handling for aarch64 Linux by detecting `aarch64` as
`HOST_ARM64` and avoiding x86-specific `-mcmodel` and `-no-pie` options
on ARM64 hosts.
Signed-off-by: Shoji Tokunaga <toku@mac.com>
Add the AM62x architecture support needed to boot NuttX on TI K3
AM62x platforms. This includes the chip integration, memory map, IRQ
definitions, low-level console support, boot code, and the AM62x 16550
serial lower half.
Signed-off-by: Piyush Patle <piyushpatle228@gmail.com>
AM62x enters NuttX through EL2 before dropping to EL1. Enable the
GICv3 system register interface for lower exception levels during the
EL2 handoff so EL1 can use the CPU interface without depending on
firmware state.
Signed-off-by: Piyush Patle <piyushpatle228@gmail.com>
Guard CMN_UCSRCS += arm_perf.c in arch/arm/src/armv7-r/Make.defs so that arm_perf.o is not added twice during flat builds, preventing the duplicate target make error.
Signed-off-by: Nazmi Aras <nazmi.aras@t3gemstone.org>
This commit introduces basic support for the T3 Gemstone O1 (t3-gem-o1)
development board, including board configuration, linker scripts, and
drivers for NSH. Currently only UART console is supported.
All necessary files and configurations are added to enable building and
running NuttX on this TI AM67-based board.
Co-authored-by: Emre Cecanpunar <emreleno@gmail.com>
Co-authored-by: Abdullah Türkmen <abdullahturkmen@protonmail.com>
Co-authored-by: Muhammet Onur Bayraktar <mobayraktar@t3gemstone.org>
Co-authored-by: Bayram Akay <bakay@t3gemstone.org>
Co-authored-by: Nazmi Aras <nazmi.aras@t3gemstone.org>
Signed-off-by: Erkan Vatan <evatan@t3gemstone.org>
This commit introduces basic support for running NuttX on
main domain R5F core of TI AM67 chips, including irq, mpu, pinmux,
timer, and serial configurations. Currently only UART console is
supported. NuttX can be loaded into R5F core from U-Boot or Linux
via RemoteProc.
Co-authored-by: Emre Cecanpunar <emreleno@gmail.com>
Co-authored-by: Abdullah Türkmen <abdullahturkmen@protonmail.com>
Co-authored-by: Muhammet Onur Bayraktar <mobayraktar@t3gemstone.org>
Co-authored-by: Bayram Akay <bakay@t3gemstone.org>
Signed-off-by: Erkan Vatan <evatan@t3gemstone.org>
Previously, arm_mpu.c was only compiled when CONFIG_BUILD_PROTECTED
was enabled. This caused build failures when CONFIG_ARM_MPU was set
without CONFIG_BUILD_PROTECTED. The build logic has been updated to
include arm_mpu.c whenever either CONFIG_ARM_MPU or
CONFIG_BUILD_PROTECTED is enabled.
Signed-off-by: Erkan Vatan <evatan@t3gemstone.org>
The previous use of `%u` and `%X` for `uint32_t` values triggered
compiler warnings. These have been replaced with the appropriate
format‑specifier macros to ensure type‑correctness and eliminate the
warnings.
Signed-off-by: Erkan Vatan <evatan@t3gemstone.org>
The STM32 serial drivers already treat 0 as not present for optional
GPIO fields (CTS, RTS), guarding each call site with a != 0 check.
TX and RX GPIO fields lacked this guard, so boards that
define GPIO_UARTx_TX or GPIO_UARTx_RX as 0 (pin not routed) caused
stm32_configgpio(0) to be called, which silently configures PA0 as a
floating input, corrupting any other peripheral using that pin.
Having an optional TX/RX UART is useful for several cases:
* RX-only connections: e.g. radio control input on flight-controllers where no TX is wired.
* Single-wire (half-duplex) connections: e.g. ESC telemetry connections.
* Output-only NSH which prints output but does not allow entering inputs.
Without a sentinel value for these cases one must assign the unused GPIO to
a NC pin, which is misleading when reading board configuration files.
Add != 0 guards for tx_gpio and rx_gpio across all STM32 serial driver
families.
Using 0 as the sentinel is safe for TX/RX because any valid UART config requires
GPIO_ALT bits set in the config word, so 0 can never represent a real
TX or RX pin configuration.
Signed-off-by: alexcekay <alexander@auterion.com>
sim_x11events() polls g_display from the idle loop while the
framebuffer teardown path closes the X connection. Clear the global
Display handle before teardown so the event path stops using it, but
keep the saved local Display pointer for XShmDetach(), XUngrabButton(),
and XCloseDisplay().
This only changes the sim X11 framebuffer shutdown ordering and does
not change user-visible APIs or build configuration.
Signed-off-by: hanzhijian <hanzhijian@zepp.com>
The RWDT register offsets were incorrectly set to ESP32-S3 values
instead of ESP32 values. This was introduced when the code was
refactored from using the local NuttX header hardware/esp32_rtccntl.h
(which had the correct offsets) to using the HAL library headers, and
the offsets were moved inline into esp32_wdt.c with wrong values.
Correct the offsets to match the actual ESP32 register layout from
soc/rtc_cntl_reg.h (RTC_CNTL_WDTCONFIG0_REG at 0x8c, INT_ENA at
0x3c, etc). Without this fix, all RWDT operations (enable, configure
timeout, enable interrupt, acknowledge interrupt, feed, write-protect)
were targeting wrong memory addresses, rendering the RWDT completely
non-functional.
Signed-off-by: Tiago Medicci Serrano <tiago.medicci@espressif.com>
Under the BOARD_LATE_INITIALIZE boot flow, rtc_clk_xtal_freq_get()
may return 0 (SOC_XTAL_FREQ_AUTO) because the XTAL frequency has
not yet been stored to the RTC register when the WDT driver is
initialized. This causes rtc_clk_cal() to divide by zero
internally (EXCCAUSE=0006) when computing the RTC slow clock
period.
Fix by explicitly calling rtc_clk_xtal_freq_update() with the
board's configured crystal frequency if rtc_clk_xtal_freq_get()
returns 0. Also add a guard in esp32_wdt_settimeout() to return
-EIO if ESP32_RWDT_CLK() still returns 0 cycles/ms, preventing
a subsequent divide-by-zero when computing the maximum timeout.
Signed-off-by: Tiago Medicci Serrano <tiago.medicci@espressif.com>
Same issue as ESP32-S3/S2: with BOARD_LATE_INITIALIZE, the
constructor function enable_timer_group0_for_calibration() resets
Timer Group 0 registers after board_late_initialize() has
configured the MWDT0 prescaler, causing the watchdog to fire at an
incorrect rate.
Re-apply the prescaler, timeout, and feed the WDT counter in
esp32_wdt_start() just before enabling the timer.
Signed-off-by: Tiago Medicci Serrano <tiago.medicci@espressif.com>
Same issue as ESP32-S3: with BOARD_LATE_INITIALIZE, the constructor
function enable_timer_group0_for_calibration() resets Timer Group 0
registers after board_late_initialize() has configured the MWDT0
prescaler, causing the watchdog to fire at an incorrect rate.
Re-apply the prescaler, timeout, and feed the WDT counter in
wdt_lh_start() just before enabling the timer.
Signed-off-by: Tiago Medicci Serrano <tiago.medicci@espressif.com>
With the BOARD_LATE_INITIALIZE flow, board_late_initialize() runs
on a kernel thread and sets the MWDT0 prescaler. However, after it
returns, the init task (NSH) is spawned and lib_cxx_initialize()
invokes constructor functions, including
enable_timer_group0_for_calibration() from esp-hal-3rdparty which
calls timg_ll_reset_register(0), resetting all Timer Group 0
registers (including the WDT prescaler) back to their defaults.
Re-apply the prescaler, timeout, and feed the WDT counter in
wdt_lh_start() just before enabling the timer. This ensures
correct WDT configuration regardless of any intermediate register
resets by external code.
Signed-off-by: Tiago Medicci Serrano <tiago.medicci@espressif.com>
When CONFIG_MM_UMM_CUSTOMIZE_MANAGER is enabled, the sim heap
bypasses mm_heap/tlsf entirely and calls host malloc/free directly,
so MM_FILL_ALLOCATIONS has no effect. Add fill pattern support
directly in sim_ummheap.c:
- malloc: fill user region with 0xaa
- free: fill user region with 0x55
- realloc: fill extended region with 0xaa
This helps detect uninitialized reads in sim environment,
which ASan does not support.
Signed-off-by: yushuailong <yyyusl@qq.com>
remove PULSECOUNT references from PWM drivers that not implemet PWM feature.
PULSECOUNT for these architectures was not implemented, so we just remove all references to it.
Signed-off-by: raiden00pl <raiden00@railab.me>
BREAKING CHANGE: separate pulse count from PWM driver
Pulse count handling was removed from PWM driver and moved to a separate driver.
For details about this change, look at previous commit.
Signed-off-by: raiden00pl <raiden00@railab.me>
BREAKING CHANGE: separate pulse count from PWM driver
Pulse count handling was removed from PWM driver and moved to a separate driver.
For details about this change, look at previous commit.
Signed-off-by: raiden00pl <raiden00@railab.me>
BREAKING CHANGE: separate pulse count from PWM driver
Pulse count handling was removed from PWM driver and moved to a separate driver.
For details about this change, look at previous commit.
Signed-off-by: raiden00pl <raiden00@railab.me>
BREAKING CHANGE: separate pulse count from PWM driver
Pulse count handling was removed from PWM driver and moved to a separate driver.
For details about this change, look at previous commit.
Signed-off-by: raiden00pl <raiden00@railab.me>
BREAKING CHANGE: separate pulse count from PWM driver
Pulse count handling was removed from PWM driver and moved to a separate driver.
For details about this change, look at previous commit.
Signed-off-by: raiden00pl <raiden00@railab.me>
BREAKING CHANGE: separate pulse count from PWM driver
Pulse count handling was removed from PWM driver and moved to a separate driver.
For details about this change, look at previous commit.
Signed-off-by: raiden00pl <raiden00@railab.me>
BREAKING CHANGE: separate pulse count from PWM driver
Pulse count handling was removed from PWM driver and moved to a separate driver.
For details about this change, look at previous commit.
Signed-off-by: raiden00pl <raiden00@railab.me>
BREAKING CHANGE: separate pulse count from PWM driver
Pulse count handling was removed from PWM driver and moved to a separate driver.
For details about this change, look at previous commit.
Signed-off-by: raiden00pl <raiden00@railab.me>
BREAKING CHANGE: separate pulse count from PWM driver
Pulse count handling was removed from PWM driver and moved to a separate driver.
For details about this change, look at previous commit.
Signed-off-by: raiden00pl <raiden00@railab.me>
Fixed three bugs in the RP23XX PWM driver:
* setup_period: The previous divisor calculation used integer arithmetic
that caused overflow and loss of precision. The divider is now computed
as a 16-bit fixed-point value (div16) using 64-bit arithmetic, and
clamped to the valid hardware range (0x10 to 0xFFF).
* setup_pulse: The compare value was incorrectly scaled by TOP instead
of 65535, producing wrong duty cycles. The formula is now corrected
to ((duty * (top + 1)) / 65535) with an overflow guard.
* pwm_start: The driver was not updated as part of the breaking change
introduced in commit 4df80e19 ("!drivers/pwm: remove PWM_MULTICHAN
option"). Access to single channel API is now info->channels[0].duty
instead of info[0].duty.
Signed-off-by: Brunocor26 <bruno.correia@ubi.pt>
The previous implementation just passed X11 key codes to the NuttX
keyboard driver, which only really worked correctly for the letter keys.
Now, special keys are translated into the NuttX codec (like Enter, arrow
keys, etc.) so that they can be used properly by NuttX applications
relying on keyboard input.
Signed-off-by: Matteo Golin <matteo.golin@gmail.com>
Add the autoleds driver for the three on-board user LEDs (LD5 red
PG10, LD6 green PG0, LD7 blue PG8; all active-low). Structure
mirrors boards/arm/stm32h5/nucleo-h563zi with the polarity and
initial-OFF state corrected for the active-low wiring.
* boards/Kconfig: ARCH_BOARD_NUCLEO_N657X0_Q selects ARCH_HAVE_LEDS
so the ARCH_LEDS prompt becomes available.
* arch/arm/src/stm32n6/stm32_idle.c: include <arch/board/board.h>
so LED_IDLE is defined and up_idle() actually calls into the
autoleds driver around WFI.
The existing nsh and ostest defconfigs do not pin CONFIG_ARCH_LEDS
and therefore inherit its Kconfig default (y when ARCH_HAVE_LEDS is
selected), so after this patch they include the autoleds driver by
default. This matches the convention on the comparable H5 and H7
Nucleo defconfigs, which also leave ARCH_LEDS at its default.
Tested on Nucleo-N657X0-Q: nsh and ostest still build, flash and
run. With CONFIG_ARCH_LEDS=y, green is steady at the NSH idle
prompt; red pulses on each IRQ but the on-time is too brief to be
clearly visible to the eye.
Signed-off-by: ImBonkers <samuelnlinden@pm.me>
Fix Espressif timer registering ID. Espressif's general purpose
timers are grouped in different Timer Groups, which may contain
more than one general purpose timer. The current implementation is
related to the timer groups (timer0 refers to Timer Group 0, for
instance), but previous registering method was referring to the
timer inside each group, which caused it to fail when more than
one timer group was being selected because only the first timer
on each group is being actually registered.
Signed-off-by: Tiago Medicci Serrano <tiago.medicci@espressif.com>
Always clear the BSS section before calling `bootloader_init`.
This is necessary because, otherwise, `bootloader_init` may fail
even before `bootloader_clear_bss_section` is called again by that
function.
Signed-off-by: Tiago Medicci Serrano <tiago.medicci@espressif.com>
Implement hardware breakpoint and watchpoint support for TriCore
architecture using the Trigger Event (TREVT) registers. This enables
the standard NuttX debugpoint API (up_debugpoint_add/remove) on TriCore
processors, supporting read/write/execute watchpoints and breakpoints
via the on-chip debug unit.
Signed-off-by: zhangyu117 <zhangyu117@xiaomi.com>
The Ethernet MAC (57.11.4) was already configured in the code,
but it was necessary to configure the Transmit Descriptor (57.10.3)
in read format:
- Checksum Interface Control for IP, payload and pseudo-header
Add checks for Recceive Descriptor (57.10.4) in read format:
- Receive Descriptor 1 is valid from Receive Descriptor 3
- IP checksum was not bypassed
- IP header checksum error op IP payload checkerror is set
Testing with STM32 Nucleo-144 using iperf, improved transmission from
35 MBits/s to 50MBits/s.
Signed-off-by: Patrick José Pereira <patrickelectric@gmail.com>
Add support for the i.MX9 SAR ADC block.
Based on the arm64 version but slightly different init due to SCMI and
different channel mask for i.MX95.
The driver provides initialization, deinitialization, channel-mask
validation, and one-shot reads for the supported ADC channels. It also
handles the ADC clock bring-up, power-up sequence, calibration, and raw
12-bit result extraction from the per-channel data registers.
Signed-off-by: Peter van der Perk <peter.vanderperk@nxp.com>
