Commit graph

24703 commits

Author SHA1 Message Date
raiden00pl
fa7d383206 arch/stm32: move stm32 and stm32f0l0g0 shared Kconfig options to common
Shared STM32 Kconfig option definitions from the stm32 (F1/F2/F3/F4/G4/L1)
and stm32f0l0g0 (F0/L0/G0/C0) families moved into arch/arm/src/common/stm32.

Signed-off-by: raiden00pl <raiden00@railab.me>
2026-06-14 11:35:31 -03:00
raiden00pl
f08267ce4c !arch/stm32f0l0g0: use common STM32 Kconfig symbols
BREAKING CHANGE: STM32F0/L0/G0/C0 Kconfig symbols were renamed from
CONFIG_STM32F0L0G0_* to CONFIG_STM32_*. Out-of-tree code must update defconfigs
and Kconfig references to the new CONFIG_STM32_* names.

The custom clock option is a special breaking case that does not follow the
family-to-common pattern:

CONFIG_ARCH_BOARD_STM32F0G0L0_CUSTOM_CLOCKCONFIG was renamed to CONFIG_ARCH_BOARD_STM32_CUSTOM_CLOCKCONFIG.

Signed-off-by: raiden00pl <raiden00@railab.me>
2026-06-14 11:35:31 -03:00
raiden00pl
c22a3d67d6 arch/stm32: add common STM32 Kconfig support
Add the shared STM32 Kconfig include and introduce the hidden
common ARCH_CHIP_STM32 selector used by concrete STM32 families.

Signed-off-by: raiden00pl <raiden00@railab.me>
2026-06-14 11:35:31 -03:00
raiden00pl
3271a44138 boards/nrf91/thingy91: ARCH_HAVE_IRQBUTTONS support
select ARCH_HAVE_IRQBUTTONS so ARCH_IRQBUTTONS can be enabled.

Signed-off-by: raiden00pl <raiden00@railab.me>
2026-06-14 08:50:18 -03:00
raiden00pl
a4c4774612 arch/nrf91: grant GPIOTE1 to the non-secure domain
Add CONFIG_NRF91_GPIOTE1_NS so the secure firmware can hand the non-secure
GPIOTE instance to the application, allowing a non-secure app to use GPIO
interrupts.

Signed-off-by: raiden00pl <raiden00@railab.me>
2026-06-14 08:50:18 -03:00
raiden00pl
5976e86c6b arch/nrf91: add GPIOTE driver
Port the GPIOTE driver from nrf53, which shares the same secure/non-secure
TrustZone split. The non-secure application uses GPIOTE1 (the register base
and interrupt are selected by the build security domain). This provides GPIO
edge interrupts, e.g. for board buttons.

Signed-off-by: raiden00pl <raiden00@railab.me>
2026-06-14 08:50:18 -03:00
raiden00pl
f9912abf5f arch/nrf91: expose GNSS priority as a control ioctl
Coexistence policy does not belong in the driver. Replace the in-driver
priority-boost arbitration (the NRF91_MODEM_GNSS_BOOST_PRIO knob and the
NOT_ENOUGH_WINDOW_TIME counter heuristic) with a user space mechanism:
SNIOC_GNSS_SET_PRIORITY toggles nrf_modem_gnss priority mode on request,
leaving the when-to-use-it decision to the application.

Signed-off-by: raiden00pl <raiden00@railab.me>
2026-06-14 08:46:46 -03:00
raiden00pl
3a8d4ba3dd arch/nrf91: convert GNSS UTC time with timegm() not mktime()
The GNSS datetime reported by the modem is UTC. mktime() interprets the
broken-down time as local time, so a configured timezone would skew the
reported epoch. Use timegm() to convert it directly as UTC.

Signed-off-by: raiden00pl <raiden00@railab.me>
2026-06-14 18:53:15 +08:00
raiden00pl
2bcc59b42f arch/nrf91: defer GNSS start until the modem is GNSS-capable
When the GNSS sensor is opened before the LTE stack has powered the modem
on, the modem is not yet in a GNSS-capable functional mode. Instead of
failing the activate with -EACCES, remember the request (priv->pending)
and let the GNSS thread poll the modem functional mode (AT+CFUN?) and
start GNSS once it becomes GNSS-capable. The LTE stack keeps ownership of
modem power.

Extract the configure/start sequence into nrf91_gnss_start() so it can be
used both from nrf91_gnss_enable() and from the thread's CFUN poll.

Signed-off-by: raiden00pl <raiden00@railab.me>
2026-06-14 18:53:15 +08:00
raiden00pl
80312dbb2d !arm/stm32wl5: standardize public API/type prefix to stm32_
BREAKING CHANGE: Public STM32WL5 interfaces were renamed from stm32wl5_*
forms to canonical stm32_* forms across arch and board headers/sources.

Public type names in STM32WL5 timer/GPIO/EXTI and related API-facing
declarations were normalized to stm32_* equivalents.

The STM32WL5 root family header was renamed from stm32wl5.h to stm32.h;
all STM32WL5 arch/board includes were updated accordingly.

Signed-off-by: raiden00pl <raiden00@railab.me>
2026-06-13 12:45:16 +08:00
raiden00pl
6e7db8dada !arm/stm32wb: standardize public API/type prefix to stm32_
BREAKING CHANGE: Public STM32WB interfaces were renamed from stm32wb_*
forms to canonical stm32_* forms across arch and board headers/sources.

Public type names in STM32WB timer/dma/freerun/oneshot/GPIO/EXTI and
related API-facing declarations were normalized to stm32_* equivalents.

The STM32WB root family header was renamed from stm32wb.h to stm32.h;
all STM32WB arch/board includes were updated accordingly.

Signed-off-by: raiden00pl <raiden00@railab.me>
2026-06-13 12:45:16 +08:00
raiden00pl
60dffa1004 !arm/stm32l5: standardize public API/type prefix to stm32_
BREAKING CHANGE: Public STM32L5 interfaces were renamed from stm32l5_* forms
to canonical stm32_* forms across arch and board headers/sources.

Public type names in STM32L5 timer/GPIO/EXTI and related API-facing
declarations were normalized to stm32_* equivalents.

The STM32L5 root family header was renamed from stm32l5.h to stm32.h;
all STM32L5 arch/board includes were updated accordingly.

Signed-off-by: raiden00pl <raiden00@railab.me>
2026-06-13 12:45:16 +08:00
raiden00pl
bc41d984cc !arm/stm32l4: standardize public API/type prefix to stm32_
BREAKING CHANGE: Public STM32L4 interfaces were renamed from stm32l4_* forms to
canonical stm32_* forms across arch and board headers/sources.

Public type names were normalized to stm32_*
equivalents (including timer/lptimer/dma/freerun API-facing types), and
stm32l4can_initialize() was renamed to stm32_caninitialize().

The STM32L4 root family header was renamed from stm32l4.h to stm32.h;
all STM32L4 arch/board includes were updated accordingly.

Signed-off-by: raiden00pl <raiden00@railab.me>
2026-06-13 12:45:16 +08:00
raiden00pl
fe42e755a1 !arm/stm32h7: standardize public API prefix to stm32_
BREAKING CHANGE: Public STM32H7 APIs were renamed from stm32h7_*
forms to canonical stm32_* forms.

Signed-off-by: raiden00pl <raiden00@railab.me>
2026-06-13 12:45:16 +08:00
raiden00pl
8ece56ff11 !arm/stm32h5: standardize public API prefix to stm32_
BREAKING CHANGE: Public STM32H5 APIs were renamed from stm32h5_*
forms to canonical stm32_* forms.

Signed-off-by: raiden00pl <raiden00@railab.me>
2026-06-13 12:45:16 +08:00
raiden00pl
3490eec26d !arm/stm32f7: standardize public API prefix to stm32_
BREAKING CHANGE: Public STM32F7 APIs were renamed from stm32f7_*
and stm32f7x9_* forms to canonical stm32_* names.

Signed-off-by: raiden00pl <raiden00@railab.me>
2026-06-13 12:45:16 +08:00
Kerogit
0b5bf6c2c5 arch/avr/src/avrdx/avrdx_delay: add custom up_udelay function
NuttX builtin up_udelay function uses BOARD_LOOPSPERMSEC configuration
value to determine how many loops need to be done to cause requested
delay. This does not match well with AVR DA/DB microcontrollers
because the CPU clock frequency is configurable.

A board configuration could therefore provide BOARD_LOOPSPERMSEC
valid for one frequency but for other frequencies, the user would
be required to calibrate the value and would still get incorrect
result when changing the clock speed during runtime.

This patch therefore implements dynamic architecture-specific
up_udelay function which determines current clock settings
and infers required loop count from that.

New function was tested by simple application that used up_udelay
to put delays between printf calls.

Signed-off-by: Kerogit <kr.git@kerogit.eu>
2026-06-12 09:55:11 -04:00
Kerogit
10dea61e23 arch/avr/src/avrdx: add support for reading CPU clock from other sources
This patch adds support for reading CPU clock frequency when the MCU
is driven by clock source other than high frequency oscillator.

Signed-off-by: Kerogit <kr.git@kerogit.eu>
2026-06-12 09:55:11 -04:00
Kerogit
689ed188c6 sched/clock/clock_delay: added config flag to remove weak up_udelay
While attempting to create architecture-specific implementation
of up_udelay, it was discovered that the overriding function is not
included in the final binary, the weak implementation was used instead.

Further investigation and experimentation showed that the linker
only overrides the weak implementation with the custom one if
the custom one is present in a .c source file that contains at least
one other function that is called from somewhere. Some additional
testing revealed that at least one other already present up_udelay
override (rv32m1-vega:nsh) is affected by this.

In a short mailing list discussion it was determined that this
is a likely result of using static libraries during the build process
and it was suggested to introduce configuration option that will
exclude weak implementations of the function from the build altogether.
This patch does that.

This patch does not enable this configuration option for any existing
board/chip because doing so would change its behaviour and needs
to be tested by users of the hardware.

Also changed is the static assertion in sched/clock/clock_delay.c
to not prevent building the code when architecture declares that
it does not use BOARD_LOOPSPERMSEC to determine required loop count.
BOARD_LOOPSPERMSEC is made undefined in such case.

Patch was tested by building breadxavr:nsh (identical binary by SHA256),
rv32m1-vega:nsh (identical text section) and rv-virt:nsh (text section
differs because of different ordering of functions in the binary, ostest
passed though.)

Signed-off-by: Kerogit <kr.git@kerogit.eu>
2026-06-12 09:55:11 -04:00
Kerogit
a7352902ae arch/avr/src/avrdx: fix Make.defs when CONFIG_ENABLE_ALL_SIGNALS unset
This patch amends commit dfd3426aa5 which added support for running
with some signals disabled to AVR architecture. AVR DA/DB architecture
was not covered by the commit and failed to build
with CONFIG_ENABLE_ALL_SIGNALS unset (which includes building
with CONFIG_ENABLE_PARTIAL_SIGNALS, the default value.)

Change is replicated from the commit and tested by a custom stress
application which spawns some always-busy threads and uses preemptive
multitasking to switch between them. Additionally, ability to sleep
in the application was tested by a simple LED blinking application.

Signed-off-by: Kerogit <kr.git@kerogit.eu>
2026-06-12 09:55:11 -04:00
raiden00pl
a788e3d436 !arch/stm32n6: unify non-standard hardware definition prefixes
BREAKING CHANGE: STM32N6 non-standard hardware definition macros
(IRQ, peripheral-count, SRAM and related) were renamed to the common
STM32_* prefix. Out-of-tree code must update the affected references.

Signed-off-by: raiden00pl <raiden00@railab.me>
2026-06-11 22:51:35 -03:00
raiden00pl
28c02dea3e !arch/stm32wl5: unify non-standard hardware definition prefixes
BREAKING CHANGE: STM32WL5 non-standard hardware definition macros
(IRQ, peripheral-count, SRAM and related) were renamed to the common
STM32_* prefix. Out-of-tree code must update the affected references.

Signed-off-by: raiden00pl <raiden00@railab.me>
2026-06-11 22:51:35 -03:00
raiden00pl
61e6b87dde !arch/stm32wb: unify non-standard hardware definition prefixes
BREAKING CHANGE: STM32WB non-standard hardware definition macros
(IRQ, peripheral-count, SRAM and related) were renamed to the common
STM32_* prefix. Out-of-tree code must update the affected references.

Signed-off-by: raiden00pl <raiden00@railab.me>
2026-06-11 22:51:35 -03:00
raiden00pl
65e3f68af8 !arch/stm32u5: unify non-standard hardware definition prefixes
BREAKING CHANGE: STM32U5 non-standard hardware definition macros
(IRQ, peripheral-count, SRAM and related) were renamed to the common
STM32_* prefix. Out-of-tree code must update the affected references.

Signed-off-by: raiden00pl <raiden00@railab.me>
2026-06-11 22:51:35 -03:00
raiden00pl
62e029cb0b !arch/stm32l5: unify non-standard hardware definition prefixes
BREAKING CHANGE: STM32L5 non-standard hardware definition macros
(IRQ, peripheral-count, SRAM and related) were renamed to the common
STM32_* prefix. Out-of-tree code must update the affected references.

Signed-off-by: raiden00pl <raiden00@railab.me>
2026-06-11 22:51:35 -03:00
raiden00pl
feb24082bd !arch/stm32l4: unify non-standard hardware definition prefixes
BREAKING CHANGE: STM32L4 non-standard hardware definition macros
(IRQ, peripheral-count, SRAM and related) were renamed to the common
STM32_* prefix. Out-of-tree code must update the affected references.

Signed-off-by: raiden00pl <raiden00@railab.me>
2026-06-11 22:51:35 -03:00
raiden00pl
8397881df4 !arch/stm32h7: unify non-standard hardware definition prefixes
BREAKING CHANGE: STM32H7 non-standard hardware definition macros
(IRQ, peripheral-count, SRAM and related) were renamed to the common
STM32_* prefix. Out-of-tree code must update the affected references.

Signed-off-by: raiden00pl <raiden00@railab.me>
2026-06-11 22:51:35 -03:00
raiden00pl
2ec8e5aa43 !arch/stm32h5: unify non-standard hardware definition prefixes
BREAKING CHANGE: STM32H5 non-standard hardware definition macros
(IRQ, peripheral-count, SRAM and related) were renamed to the common
STM32_* prefix. Out-of-tree code must update the affected references.

Signed-off-by: raiden00pl <raiden00@railab.me>
2026-06-11 22:51:35 -03:00
raiden00pl
4982f5016e !arch/stm32f7: unify non-standard hardware definition prefixes
BREAKING CHANGE: STM32F7 non-standard hardware definition macros
(IRQ, peripheral-count, SRAM and related) were renamed to the common
STM32_* prefix. Out-of-tree code must update the affected references.

Signed-off-by: raiden00pl <raiden00@railab.me>
2026-06-11 22:51:35 -03:00
raiden00pl
bb025be12d arch/nrf91: add PWM support
add PWM support for nrf91

Signed-off-by: raiden00pl <raiden00@railab.me>
2026-06-12 08:03:17 +08:00
lccosy
d7f168061b arch/arm/gd32f4: fix missing CTL selector bits in up_disableusartint.
up_disableusartint() saves USART interrupt state from hardware CTL0-CTL3
registers but omits the CTL selector bits (bits 24-27) in the encoded
ie value. When up_restoreusartint() later restores interrupts, it uses
ie >> 24 to determine which CTL register to write. Without selector bits
this evaluates to 0, so no CTL register is updated and all interrupt
enables (including RBNEIE) are permanently lost.

This causes RX interrupts to never fire after any call to up_putc()
(e.g. via syslog), making the serial console unable to receive input.

Fix by adding the corresponding CTL selector bit (USART_CFG_CTLx_INT
<< USART_CFG_SHIFT) whenever a CTL register has active interrupt bits.

Signed-off-by: lccosy <1191294205@qq.com>
2026-06-11 09:18:15 -03:00
raiden00pl
0574de1801 arch/arm/src/stm32f7: remove duplicated stm32_exti_alarm.c source
stm32_exti_alarm.c was added twice in Make.defs and CMakeLists.txt.
Drop the duplicate block

Signed-off-by: raiden00pl <raiden00@railab.me>
2026-06-11 10:21:11 +08:00
yushuailong
1a3185beeb arch/risc-v/esp32c3-legacy: Fix non-atomic clock read in up_rtc_rdalarm.
up_rtc_rdalarm() computed tv_sec and tv_nsec from two separate
evaluations of rt_timer_time_us() + offset + deadline. The RT timer
advances between the two calls, so a read that straddles a second
boundary yields an inconsistent timespec.

Compute the microsecond value once into a local variable and derive
both fields from that single snapshot.

Signed-off-by: yushuailong <yyyusl@qq.com>
2026-06-11 02:59:10 +08:00
yushuailong
1d08a9d019 arch/risc-v/espressif: Fix non-atomic clock read in esp_rtc_rdalarm.
esp_rtc_rdalarm() computed tv_sec and tv_nsec from two separate
evaluations of esp_hr_timer_time_us() + offset + deadline. The
high-resolution timer advances between the two calls, so a read that
straddles a second boundary yields an inconsistent timespec.

Compute the microsecond value once into a local variable and derive
both fields from that single snapshot.

Signed-off-by: yushuailong <yyyusl@qq.com>
2026-06-11 02:59:10 +08:00
yushuailong
c11029848e arch/xtensa/espressif: Fix non-atomic clock read in esp_rtc_rdalarm.
esp_rtc_rdalarm() computed tv_sec and tv_nsec from two separate
evaluations of esp_hr_timer_time_us() + offset + deadline. The
high-resolution timer advances between the two calls, so a read that
straddles a second boundary yields an inconsistent timespec.

Compute the microsecond value once into a local variable and derive
both fields from that single snapshot.

Signed-off-by: yushuailong <yyyusl@qq.com>
2026-06-11 02:59:10 +08:00
raiden00pl
46967df94f !arm/stm32: split legacy STM32 family selectors
BREAKING CHANGE: Convert the legacy STM32 F1/F2/F3/F4/G4/L1 port to the concrete
family selectors while keeping the shared STM32 selector hidden.

Legacy STM32 family selector Kconfig symbols were split by
concrete STM32 sub-family. Out-of-tree defconfigs and code must update
CONFIG_ARCH_CHIP_* selections to the new family-specific selectors.

Signed-off-by: raiden00pl <raiden00@railab.me>
2026-06-10 08:51:47 -03:00
raiden00pl
46d2306bf8 !arch/stm32: rename STM32F7/H7 QUADSPI Kconfig symbol to QSPI
BREAKING CHANGE: CONFIG_STM32F7_QUADSPI and CONFIG_STM32H7_QUADSPI are
renamed to CONFIG_STM32F7_QSPI and CONFIG_STM32H7_QSPI. Out-of-tree F7/H7
board configurations must update the symbol name.

Standardize the F7/H7 QSPI enable symbol on the QSPI name (the QUADSPI and
QSPI peripherals are the same IP block). Only the Kconfig enable symbol and
its CONFIG_ references are renamed; the QUADSPI hardware register/pin/DMA
macros are unchanged.

Signed-off-by: raiden00pl <raiden00@railab.me>
2026-06-10 08:49:59 -03:00
raiden00pl
165e7cb1ab arch/arm/stm32f3/stm32f33xxx_pinmap.h: fix compilation
fix compilation error

Signed-off-by: raiden00pl <raiden00@railab.me>
2026-06-09 11:33:02 -03:00
leisiji
8121b88666 cmake/elf: Fix ELF entry point from __start to _start
__start is the kernel boot entry for each chip, while _start (defined
in crt0.c) is the correct C runtime entry point for ELF executables.

Signed-off-by: leisiji <2265215145@qq.com>
2026-06-08 16:03:21 +08:00
raiden00pl
af371bbaa5 arch/nrf91: add more ioctl calls for modem socket
add support for these ioctl:

- LTE_CMDID_RADIOON
- LTE_CMDID_RADIOOFF
- LTE_CMDID_ACTPDN

Signed-off-by: raiden00pl <raiden00@railab.me>
2026-06-06 15:54:16 +08:00
raiden00pl
2cb1511602 arch/nrf91: fix broken modem initialization
fix broken modem initialization for nrf91

Signed-off-by: raiden00pl <raiden00@railab.me>
2026-06-06 15:53:50 +08:00
Shoji Tokunaga
e4fe1134bf arch/sim: Add dependencies for Rust cargo in make builds
Add `EXTRA_LIB_DEPS` to the simulator nuttx target prerequisites.

This lets Make notice when an extra application library, such as a Rust
static library rebuilt by Cargo, has changed and ensures the final
simulator binary is relinked.

Signed-off-by: Shoji Tokunaga <toku@mac.com>
2026-06-05 09:44:09 +08:00
lccosy
b07c61e0cd arch/arm/gd32f4: fix NULL pointer dereference in arm_earlyserialinit.
Add NULL check for g_uart_devs[i] before accessing ->priv in
arm_earlyserialinit() loop. When a USART is not enabled in defconfig,
g_uart_devs[i] is NULL, causing a HardFault crash during early boot.

The bug occurs because the original code only checked g_uart_devs[i]->priv
without first verifying g_uart_devs[i] is not NULL. On Cortex-M4, NULL
pointer dereference reads from Flash vector table (0x00000000 maps to
0x08000000), returning a function pointer that causes BusFault when
written to.

This fix matches the existing NULL check pattern used in arm_serialinit()
at line 2835 of the same file.

Tested on mplant-gd32f450 board with only USART5 enabled in defconfig.
Before fix: HardFault at boot (IPSR=3, PC=0x080003e0)
After fix: System boots normally to NSH Shell

Signed-off-by: lccosy <1191294205@qq.com>
2026-06-04 17:00:27 -04:00
Lingao Meng
2a6059a206 arch/sim: walk frame-pointer chain for non-running tasks in up_backtrace
The previous up_backtrace() relied entirely on host_backtrace() (a thin
wrapper around glibc's backtrace()), which can only unwind the host
thread that calls it.  As a result, when assert / dump_tasks() walked the
task list and called sched_dumpstack() for every task, every task other
than the currently-running one returned a zero-length backtrace, and the
output was silently dropped.  In practice this meant that on sim only
the crashing task ever produced a usable trace.

Fix this by walking the frame-pointer chain ourselves whenever the
target tcb is not the running task.  Because sim's setjmp/longjmp is
provided by NuttX itself (libs/libc/machine/sim/arch_setjmp_*.S) and not
by host libc, the rbp/rsp/rip (or arm fp/sp/pc) saved in tcb->xcp.regs
are plain unmangled pointers, identical across Linux, macOS and Windows
hosts.  The frame layout ([fp]=prev fp, [fp+1]=return address) is also
shared by every host ABI sim supports (x86, x86_64, ARM, ARM64).

The walker validates that fp lies inside the task's stack and is
properly aligned, and stops when fp[0] is NULL, so a corrupted stack
cannot make us read out of bounds.  The running-task path is unchanged
and still uses host_backtrace() so DWARF unwinding through host
libraries continues to work.

Requires CONFIG_FRAME_POINTER=y so the compiler emits a usable fp link.

Signed-off-by: Lingao Meng <menglingao@xiaomi.com>
2026-06-04 09:54:08 +08:00
Sammy Tran
3e3427d339 arch/arm/src/stm32h5/stm32_adc: Reset channel counter before conversions
Signed-off-by: Sammy Tran <sammytran@geotab.com>

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
AI-Model: claude-sonnet-4.6
2026-06-02 20:09:31 +08:00
Sammy Tran
5a03e04f21 arch/arm/src/stm32h7/stm32_adc: Reset channel counter before conversions
Signed-off-by: Sammy Tran <sammytran@geotab.com>

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
AI-Model: claude-sonnet-4.6
2026-06-02 20:09:31 +08:00
Eren Terzioglu
c188f3c934 arch/risc-v/espressif: Add BLE support for esp32[-c6|-h2]
Add BLE support for esp32c6 and esp32h2

Signed-off-by: Eren Terzioglu <eren.terzioglu@espressif.com>
2026-06-02 00:08:50 +08:00
hanzj
94fa220650 arch/sim: Fix OOB read/write in usrsock_ioctl_handler
usrsock_ioctl_handler() copies req->arglen bytes from the request
payload into the fixed-size usrsock->out buffer without validating
that the payload fits either the received request or the destination
buffer.  This is the same class of vulnerability as the one already
fixed in nrf91_modem_sock.c (commit a43fb69283).

Add three checks before the copy:

  - len >= sizeof(*req): ensure the full request header is present.
  - copylen <= len - sizeof(*req): payload must fit the received data.
  - copylen <= SIM_USRSOCK_BUFSIZE - sizeof(*ack): payload must fit
    the destination buffer.

Signed-off-by: hanzj <hanzjian@zepp.com>
2026-06-02 00:08:22 +08:00
hanzj
1736afa145 arch/arm/nrf91: Fix OOB read/write in nrf91_usrsock_ioctl_handler
nrf91_usrsock_ioctl_handler() copies req->arglen bytes from the
request payload into the fixed-size usrsock->out buffer without
validating that the payload actually fits either the received
request or the destination buffer.  A crafted ioctl request with
an inflated arglen triggers:

  1. OOB read — memcpy reads past the end of the received request.
  2. OOB write — memcpy writes past the end of usrsock->out.

Add three checks before the copy:

  - len >= sizeof(*req): ensure the full request header is present.
  - copylen <= len - sizeof(*req): payload must fit the received data.
  - copylen <= sizeof(usrsock->out) - sizeof(*ack): payload must fit
    the destination buffer.

The recvfrom handler in the same file already performs the equivalent
buffer-size check (line 892).  Fixes #18515.

Signed-off-by: hanzj <hanzjian@zepp.com>
2026-06-01 15:39:52 +02:00
Matteo Golin
0f14427658 bcm2711/fb: Use physical device resolution OR force resolution
This change causes the frame buffer allocation to use the connected
device's physical resolution by default. The user also has the option to
force a request for a different, compile-time selected resolution if the
physical display can support something else the user would prefer.

Signed-off-by: Matteo Golin <matteo.golin@gmail.com>
2026-05-31 11:06:41 +08:00