3738 Commits
Author SHA1 Message Date
Justin Hammond 69386aa6c0 drivers/power: Describe the regulators through procfs.
The regulator framework has no way out to userspace: consumers reach a
rail by name from inside the kernel, which is the right interface for
controlling one, but it leaves a board with regulators offering no way
to see what they are doing, and a newly written regulator driver cannot
be looked at without writing a consumer for it first.

Adds /proc/regulator, behind REGULATOR_PROCFS, listing every registered
regulator: its present voltage, the range it will accept, whether it is
enabled, how many consumers hold and enable it, its supply, and whether
it is always on or expected on at boot.  Lines carry the same key:value
tokens in the same order, so the file is machine parseable.  The last
two are worth reading beside the consumer count, since a rail enabled
with no consumers is expected rather than suspect when either is set.

A part usually measures more than the framework has fields for, so
struct regulator_ops_s gains an optional describe method: it writes
key:value text and the renderer appends it to that rail's line.  This is
how a driver reports what only it knows, an input voltage, an output
current, a temperature or a fault word, without the framework growing a
field per part or the driver growing procfs code of its own.  It is
called with the list mutex held and never from interrupt context, so
reading the part over a bus is allowed.

The voltage and the enabled state are read back from the hardware rather
than recalled, so a rail the boot loader set and nothing has touched
since reads as it actually is.  Both calls can fail, and a failure
reports - rather than an errno formatted as a voltage or a rail that
looks switched on.

Reading the hardware is also why this takes the list mutex directly
rather than calling regulator_list_lock(), which additionally disables
interrupts so that callers in interrupt or idle context are safe.
Asking a regulator on a bus what it is doing means a transfer, and a
transfer waits; a task reading a file can afford to wait and an
interrupt handler cannot.

procfs_register() appends without checking for duplicates, so the entry
is claimed once for the lifetime of the system rather than whenever the
list is empty.  It also needs FS_PROCFS_REGISTER, which the option now
depends on rather than only FS_PROCFS.

Documents the framework, which had no page at all: the consumer
interface and what counted enables mean, what a driver supplies, and the
new entry.

The entry is read only.  What voltage a rail may be is knowledge its
consumers hold, and arranging the order between them is what the
framework is for, so moving one from a shell would step around the part
that matters.

Assisted-by: Claude:claude-opus-5
Signed-off-by: Justin Hammond <justin@dynam.ac>
2026-08-18 17:28:02 +08:00
Abhishek Mishra e29db6724c sched,fs,docs: support setuid sudo helper
Supports the UNIX setuid-on-exec sudo helper. Documents the model,
generates an extra ROMFS user and /etc/sudoers for a non-root test,
reports BINFS modes from the builtin table so ls -l matches execute
bits, and skips NULL environment entries when sanitizing a setuid exec.

Signed-off-by: Abhishek Mishra <mishra.abhishek2808@gmail.com>
2026-08-18 15:57:52 +08:00
Justin Hammond 56070e94df drivers/mmcsd: Switch SD cards into high speed.
The SD path never performs the CMD6 switch its eMMC counterpart has
performed for years, so an SD card is left in default speed and every
host clocked accordingly, at 25MHz rather than the 50MHz the card
supports.  A TODO in this file has asked for it since 2010; this removes
it.

A host asks for the switch by reporting SDIO_CAPS_SD_HS_MODE, which
mirrors the eMMC capability beside it.  The switch is attempted once the
bus is at the default transfer rate and the wide bus is selected, and
the card's own answer decides the outcome: the 64 byte status block
reports the function actually selected, and a card that cannot do what
was asked says so there rather than failing the command.  Cards below
version 1.10 of the physical layer specification are not asked, since
CMD6 postdates them.

Only a confirmed switch reaches the host, as the new
CLOCK_SD_TRANSFER_4BIT_HS rate.  That is a rate rather than a flag on an
existing one because the host is clocked twice during initialization,
once before the switch can have happened, and a host that cannot tell
the two apart would run a card in default speed past its rated 25MHz.
The enumerator is added last, so no existing driver's switch statement
changes meaning, and the rate reaches only a host that reported the new
capability, which none in tree does.

Every failure path is survivable: a card that declines, a card too old
to ask, and a host that never asks all stay at the default rate.

Documents the two capabilities and the clock rates a lower half has to
handle.

The MMC/SD documentation was three sentences and a pointer to the SDIO
page, so it said nothing about how a card is registered, how the bus width
and clock are negotiated, or what any of the configuration options do.  It
now covers those, the ioctl interface and /proc/mmcsd, and the high speed
switch this commit adds is described where somebody looking for it would
look rather than only in the SDIO lower half page.

Assisted-by: Claude:claude-opus-5
Signed-off-by: Justin Hammond <justin@dynam.ac>
2026-08-18 09:38:45 +08:00
raiden00pl 20f15ba2e3 arch/arm/stm32f7: use common Kconfig symbols
CONFIG_STM32F7_LCD_BACKLIGHT is not defined by any Kconfig, so the LTDC
backlight control is dead code.  CONFIG_STM32F7_PLLSAI and
CONFIG_STM32F7_PLLI2S are defined by the board.h files, and the common
SPI test helper names its mode macros CONFIG_STM32F7_SPIx_TEST_MODE.
Use the common CONFIG_STM32_* names everywhere.

Also drop the misspelled CONFIG_STM32F7_STM33F75XX from the DMA chip
check, which already tests CONFIG_STM32_STM32F75XX.

The CAN section of the STM32F7 documentation names the options
CONFIG_STM32F7F7_CANx, which has a duplicated family prefix and never
existed.  Use the common names there too.

Signed-off-by: raiden00pl <raiden00@railab.me>
Assisted-by: Claude Code
2026-08-18 09:34:58 +08:00
dechao_gong eaaba5e0a1 arch/arm/rtl8721f: add PWM master driver support
Wire the shared Ameba PWM driver (arch/arm/src/common/ameba/ameba_pwm.c)
to RTL8721F (amebagreen2).  The chip spreads PWM across four four-channel
timers (TIM4..TIM7); this port drives TIM4 as the single time base with
four compare channels, matching the shared driver's model.  A new
ameba_pwm_chip.h supplies the RTL8721F specifics taken from the SDK
fwlib headers: TIM4 at the non-secure base 0x41000000, 40 MHz input
clock, IRQ 11 (TIMER4_IRQ), crossbar pad-mux codes 111..114
(PINMUX_FUNCTION_TIM4_PWM0..3) and the distinct function/clock enable
bits (APBPeriph_PWM0 / APBPeriph_PWM0_CLOCK).

The board registers one timer at /dev/pwm0 with channel 1 on PB18 and
channel 2 on PB19 for the pwm example; edit the table to match a board's
wiring.  The common driver is not touched.

Signed-off-by: dechao_gong <dechao_gong@realsil.com.cn>
Assisted-by: Claude <noreply@anthropic.com>
2026-08-17 09:34:22 -03:00
dechao_gong 2546802911 arch/arm/rtl8720f: add PWM master driver support
Wire the shared Ameba PWM driver (arch/arm/src/common/ameba/ameba_pwm.c)
to RTL8720F.  The chip spreads PWM across several four-channel timers
(TIM4/TIM5); this port drives TIM4 as the single time base with four
compare channels, matching the shared driver's model.  A new
ameba_pwm_chip.h supplies the RTL8720F specifics taken from the SDK
fwlib headers: TIM4 at the non-secure base 0x401c7000, 40 MHz input
clock, IRQ 9 (TIMER4_IRQ), crossbar pad-mux codes 45..48
(PINMUX_FUNCTION_TIM4_PWM0..3) and the distinct function/clock enable
bits (APBPeriph_PWM0 / APBPeriph_PWM0_CLOCK).

The board registers one timer at /dev/pwm0 with channel 1 on PB18 and
channel 2 on PB19 for the pwm example; edit the table to match a board's
wiring.  The common driver is not touched.

Signed-off-by: dechao_gong <dechao_gong@realsil.com.cn>
Assisted-by: Claude <noreply@anthropic.com>
2026-08-17 09:34:22 -03:00
dechao_gong 6f2e17c113 arch/arm/rtl8721dx: add shared Ameba PWM driver
Add a shared NuttX PWM lower-half for the Realtek Ameba PWM timer in
arch/arm/src/common/ameba, driven through the SDK fwlib.  TIM8 provides a
single time base feeding eight compare channels (CCR0..CCR7) that share one
frequency while each carries its own duty, so a single /dev/pwm0 exposes the
multichannel output via CONFIG_PWM_NCHANNELS.  The fwlib PWM routines are
split ROM/RAM: the time-base calls resolve from on-chip ROM, while the
capture/compare calls live in fwlib ram_common/ameba_tim.c, which the build
pulls into AMEBA_FWLIB_SRCS when CONFIG_AMEBA_PWM is set.

Per-chip wiring (timer index, channel count, register base, input clock,
IRQ, clock masks and the crossbar pad-mux code table) lives in
arch/arm/src/rtl8721dx/ameba_pwm_chip.h so a port to another Ameba chip only
supplies a same-named header; the pad-mux codes are a per-channel table
(AMEBA_PWM_PINMUX_FIDS) rather than a computed base, so chips with a single
shared code or codes grouped per timer are expressed by the header alone.

The timer registers as /dev/pwm0 from pke8721daf bring-up through the stock
PWM character driver; a dedicated `pwm` defconfig drives examples/pwm for
validation.

Signed-off-by: dechao_gong <dechao_gong@realsil.com.cn>
Assisted-by: Claude <noreply@anthropic.com>
2026-08-17 09:34:22 -03:00
wangjianyu3 f40e948594 Documentation/nxinit: document property triggers and fix CONFIG names
The Triggers section previously stated that action (property) triggers
were not yet implemented; they are supported now, so describe the
fnmatch value matching and the edge-triggered semantics of on <event>.
The Examples section used the stale CONFIG_SYSTEM_INIT_* prefix and now
uses CONFIG_SYSTEM_NXINIT_* together with a property trigger example.

This documents the behavior added in
https://github.com/apache/nuttx-apps/pull/3726.

Assisted-by: GitHubCopilot:claude-opus-4.8
Signed-off-by: wangjianyu3 <wangjianyu3@xiaomi.com>
2026-08-17 17:04:04 +08:00
Liam Howatt bf9a9d43a5 Documentation/stm32h5: EXTI is supported.
EXTI is one of the supported peripherals and nucleo-h563zi has a
defconfig for the user button which demonstrates the interrupt
capability.

Signed-off-by: Liam Howatt <liamhowatt@geotab.com>
2026-08-17 10:45:14 +02:00
raiden00pl 6955aeb64b ci: do not trigger Build on PR description edits
The Depends-On feature (commit e73f7f7d0e) made the Build workflow
trigger on PR description edits. A gate job checks whether the edit
changed any Depends-On declaration: if yes, the build jobs run again
with the new dependencies; on any other edit the gate skips all build
jobs.

The gate has a side effect that breaks PR check results. Skipped jobs
still register check results on the PR, and the PR checks view shows
the newest check run of each name. So after any description edit the
PR shows "skipped" for every build check instead of the pass/fail
from the real run. Re-running that newest run only repeats the skip,
so the real results never come back. This can also hide a red X from
a failed build.

Fix by not triggering Build on description edits at all: remove the
"edited" event type and the gate job.

Depends-On keeps working: dependencies are read from the description
at the start of every run against master, as before. Fetch-Source now
re-reads the description through the API instead of using the copy
stored in the event payload, so every run uses the current Depends-On
state no matter how it was triggered.

After editing a Depends-On line, retrigger CI by any of:
- pushing new or rebased commits to the PR branch
- closing and reopening the PR
- pressing "Re-run all jobs" on the existing Build run

A description edit alone no longer triggers anything, which is
exactly the behavior that corrupted the PR check results.

Update Documentation/testing/nuttx-ci.rst accordingly.

Same change as in nuttx-apps; both repos received the gate from the
same Depends-On feature.

Signed-off-by: raiden00pl <raiden00@railab.me>
Assisted-by: Claude Code
2026-08-16 19:08:58 -04:00
dechao_gong 36a971567a arch/arm/rtl8721f: add SPI master driver support
Wire the shared Ameba SPI (DesignWare SSI) driver
(arch/arm/src/common/ameba/ameba_spi.c) into the RTL8721F (amebagreen2)
build and expose the SPI0/SPI1 masters at /dev/spiN.

Add the per-chip ameba_spi_chip.h with the amebagreen2 controller bases
(0x40121000 / 0x40122000, non-secure aliases), the group-0 SPI clock masks
(bit14/bit15), and the per-signal crossbar pad-mux codes (SPI0 75/76/77/78,
SPI1 79/80/81/82).  The SSI ip_clk is the PERI_HCLK-domain clock, which the
amebagreen2 fwlib exposes directly through HPERI_ClkGet(), so AMEBA_SPI_IPCLK()
is a single ROM call rather than the register poking the other ICs need.

Compile the common driver and the SDK fwlib SSI RAM source under
CONFIG_AMEBA_SPI, register the bus in the board bring-up, and add an "spi"
board configuration exercising the system/spi spitool.

Assisted-by: Claude <noreply@anthropic.com>
Signed-off-by: dechao_gong <dechao_gong@realsil.com.cn>
2026-08-14 11:36:37 -03:00
dechao_gong 214d02f417 arch/arm/rtl8720f: add SPI master driver support
Wire the shared Ameba SPI (DesignWare SSI) driver
(arch/arm/src/common/ameba/ameba_spi.c) into the RTL8720F build and expose
the SPI0/SPI1 masters at /dev/spiN.

Add the per-chip ameba_spi_chip.h with the RTL8720F controller bases
(0x401C1000 / 0x401C2000, non-secure aliases), the group-0 SPI clock masks,
the per-signal crossbar pad-mux codes (RTL8720F has no generic
PINMUX_FUNCTION_SPI), and the SYS_PLL-based ip_clk computation
(REG_LSYS_CKD_SYS_PLL_GRP0 HPERI divider).  The chip header declares the
SYS_PLL_ClkGet() query its AMEBA_SPI_IPCLK() uses, since RTL8720F has no
PLL_ClkGet().

Compile the common driver and the SDK fwlib SSI RAM source under
CONFIG_AMEBA_SPI, register the bus in the board bring-up, and add an "spi"
board configuration exercising the system/spi spitool.

Assisted-by: Claude <noreply@anthropic.com>
Signed-off-by: dechao_gong <dechao_gong@realsil.com.cn>
2026-08-14 11:36:37 -03:00
dechao_gong 7dbf782e5b arch/arm/rtl8721dx: add shared Ameba SPI driver
Add a shared NuttX SPI master lower-half for the Realtek Ameba SPI
controllers (SPI0/SPI1) in arch/arm/src/common/ameba, driven through the
SDK fwlib in polling mode with full-duplex exchange and a software chip
select.  Per-chip wiring (controller count, register bases, clock masks,
crossbar pad-mux codes and the fwlib SSI_InitTypeDef layout) lives in
arch/arm/src/rtl8721dx/ameba_spi_chip.h so a port to the other Ameba
chips only supplies a same-named header.

Each controller registers as /dev/spiN from pke8721daf bring-up through
the stock SPI character driver; a dedicated `spi` defconfig drives the
spitool for validation.

Assisted-by: Claude <noreply@anthropic.com>
Signed-off-by: dechao_gong <dechao_gong@realsil.com.cn>
2026-08-14 11:36:37 -03:00
fangpeina fbfb1b95f7 Documentation/applications/system: Add stty command documentation
Add documentation for the stty terminal configuration utility,
describing usage, available settings, examples, and configuration
options.

Signed-off-by: fangpeina <fangpeina@xiaomi.com>
2026-08-14 13:47:04 +02:00
Alan Carvalho de Assis fdcd0ec317 Documentation: add apps/system/toybox entry
Basic usage/configuration reference for the toybox application, plus
known limitations: ps lists no processes (it expects Linux's
/proc/<pid>/stat, which NuttX's procfs doesn't provide), and grep -r
is unreliable against procfs.

Signed-off-by: Alan C. Assis <acassis@gmail.com>
Assisted-by: Claude Sonnet 5 <noreply@anthropic.com>
2026-08-14 10:20:52 +08:00
Alin Jerpelea 850ac5ca63 Documentation/hpm6360evk: improve readability
separate code sections for better readability

Signed-off-by: Alin Jerpelea <alin.jerpelea@sony.com>
2026-08-13 08:55:56 -03:00
Abhishek Mishra 3bc0b17908 Documentation: document supplementary groups and setresuid/setresgid
Document CONFIG_SCHED_NGROUPS, setgroups/getgroups/initgroups, and
setresuid/setresgid in the user identity guide.

Signed-off-by: Abhishek Mishra <mishra.abhishek2808@gmail.com>
2026-08-12 16:06:03 -03:00
Alan Carvalho de Assis 42ac826a4c doc/sim: Add Documentation about SIM Input
This commit adds basic information about SIM Input support.

Signed-off-by: Alan C. Assis <acassis@gmail.com>
2026-08-12 14:08:34 -03:00
Alin Jerpelea e2ab02d368 Documentation\hpm6360evk: update guide to match the user experience
updated the cross-compiler download, added verification steps and rearanged the
guide

Signed-off-by: Alin Jerpelea <alin.jerpelea@sony.com>
2026-08-12 17:14:11 +02:00
Alin Jerpelea 4977c28a3f Documentation: add NuttX 13.0.1 release notes
add release notes for NuttX 13.0.1 release

Signed-off-by: Alin Jerpelea <alin.jerpelea@sony.com>
2026-08-12 21:53:28 +08:00
dechao_gong 0be19937ba Documentation/rtl8721dx,rtl8721f: document the I2C driver
The I2C master driver support for the RTL8721Dx (pke8721daf) and RTL8721F
(rtl8721f_evb) boards was merged without the matching board documentation.
Add the missing I2C entry to each board's Features list and an "i2c"
configuration section describing the /dev/i2cN devices, the board pin
table, and the i2ctool usage, mirroring the existing gpio/uart sections.

Signed-off-by: dechao_gong <dechao_gong@realsil.com.cn>
Assisted-by: Claude <noreply@anthropic.com>
2026-08-12 08:46:16 -03:00
dechao_gong af49db4483 arch/arm/rtl8720f: add I2C master driver support
Wire the RTL8720F to the shared Ameba I2C master driver
(arch/arm/src/common/ameba/ameba_i2c.c), reusing it unchanged.

Add the per-chip header arch/arm/src/rtl8720f/ameba_i2c_chip.h supplying
the chip's I2C wiring: two controllers (I2C0/I2C1) on their non-secure
register aliases (0x401c8000 / 0x401c9000), the APBPeriph function/clock
masks, the crossbar SCL/SDA pad-mux codes (59/60 and 61/62), and
AMEBA_I2C_HAS_DMA_FIELDS=1 (the chip's I2C_InitTypeDef carries the DMA
request-level fields).

Add the board glue: rtl8720f_i2c.c registers I2C0 at /dev/i2c0
(PA22/PA23) and I2C1 at /dev/i2c1 (PA24/PA25), plus the build wiring
(Make.defs / CMakeLists.txt / ameba_board.mk pull in the common driver
and the fwlib ram_common/ameba_i2c.c data-table source), the bringup
registration hook and the board header declaration.

Add the i2c defconfig (minimal NSH with the i2ctool) and document the
config in the board index.

Signed-off-by: dechao_gong <dechao_gong@realsil.com.cn>
Assisted-by: Claude <noreply@anthropic.com>
2026-08-12 08:46:16 -03:00
dechao_gong 18d2ae253c arch/arm/rtl8720f: add UART master driver support
Wire the shared common UART driver
(arch/arm/src/common/ameba/ameba_uart.c) into RTL8720F.  Add an
ameba_uart_chip.h supplying the per-chip UART parameters: two
general-purpose controllers (UART0/UART1), their non-secure register
bases (0x401C3000 / 0x401C4000 -- the fwlib UART_DEV_TABLE points at
the non-secure alias), NVIC vectors, APBPeriph function/clock masks
and the crossbar TX/RX pad-mux function codes.

The fwlib ROM UART routines index data tables (UART_DEV_TABLE,
APBPeriph_UARTx) that live in fwlib ram_common/ameba_uart.c, so that
source is compiled in when CONFIG_AMEBA_UART is set.  Wire
CONFIG_AMEBA_UART into Make.defs/CMakeLists/ameba_board.mk, add the
board port table (UART0 at /dev/ttyS1, PA22 TX / PA23 RX, 115200 8N1)
with bringup registration, a uart config and board documentation.

Hardware-verified on rtl8720f_evb: serialrx/serialblaster over a
PA22-to-PA23 TX/RX loopback transferred all 2600 bytes intact.

Assisted-by: Claude <noreply@anthropic.com>
Signed-off-by: dechao_gong <dechao_gong@realsil.com.cn>
2026-08-12 08:46:16 -03:00
dechao_gong 3197472ad4 arch/arm/rtl8720f: add single-port GPIO support
RTL8720F drives all GPIO through a single 32-pin port A controller
served by one NVIC vector, unlike RTL8721Dx (ports A/B) or RTL8721F
(ports A/B/C).  Add an ameba_gpio_chip.h that configures the shared
common GPIO driver (arch/arm/src/common/ameba/ameba_gpio.c) for a
single port: AMEBA_GPIO_NPORTS=1, AMEBA_GPIO_PORT_IRQS={GPIOA} and
the APBPeriph_GPIO gate bits.

GPIO_INTStatusGet/ClearEdge live in the RTL8720F ROM symbol table, so
no fwlib ram_common object needs compiling in.  Wire CONFIG_AMEBA_GPIO
into Make.defs/CMakeLists/Kconfig, add the board pin table (PA22 out,
PA23 in, PA24 interrupt) with bringup registration and a gpio config.

Hardware-verified on rtl8720f_evb: output, input and (falling-edge)
interrupt all confirmed via a PA22-to-PA24 loopback.

Signed-off-by: dechao_gong <dechao_gong@realsil.com.cn>
Assisted-by: Claude <noreply@anthropic.com>
2026-08-12 08:46:16 -03:00
Marco Casaroli 7f6a0a30da boards/arm/stm32l4/b-l475e-iot01a: Add a QEMU nsh configuration.
QEMU's b-l475e-iot01a machine models the STM32L4x5 core peripherals, but
not the QUADSPI controller or the on-board MX25R6435F flash.  The nsh
configuration therefore panics during board bring-up, inside
stm32_qspi_initialize() -> mx25rxx_initialize() -> qspi_command(), before
the console has produced any output.

Add a qemu configuration that is nsh without CONFIG_B_L475E_IOT01A_MTD_FLASH
and the QSPI/MTD/SMARTFS chain that symbol selects.  It boots to an NSH
prompt on USART1 under:

  qemu-system-arm -M b-l475e-iot01a -nographic -kernel nuttx

Document the new configuration, including the fact that QEMU's STM32L4x5
USART model never calls qemu_chr_fe_accept_input() after the guest reads
RDR.  Console input consequently stalls after the first byte or two when a
line is pasted or piped in, although typing at human speed works.

Assisted-by: Claude Code:claude-opus-5
Signed-off-by: Marco Casaroli <marco.casaroli@gmail.com>
2026-08-10 22:46:31 +08:00
dechao_gong 9e33dc077a Documentation/rtl8721f: add rtl8721f_evb board photo
Add the board photo and replace the placeholder todo in the RTL8721F EVB
documentation index with a figure directive so the board page renders the
hardware image, matching the other Realtek board pages.

Signed-off-by: dechao_gong <dechao_gong@realsil.com.cn>
Assisted-by: Claude <noreply@anthropic.com>
2026-08-10 09:51:02 -03:00
dechao_gong b5ec07b19b arch/arm/rtl8721f: add UART character driver support
Expose the RTL8721F general-purpose UARTs through the shared Ameba serial
driver in arch/arm/src/common/ameba.  Only the chip-specific glue is added:
a new ameba_uart_chip.h supplying the green2 register bases, IRQs, clock
masks and UART TX/RX pin-mux function codes, plus the build wiring and a
board port table registering UART0 at /dev/ttyS1.  The common serial layer
is reused unchanged.

A new "uart" board config enables the driver with the serialrx and
serialblaster examples and runtime TERMIOS support.

Verified on RTL8721F EVB hardware with a PA24/PA25 loopback: single-message
echo, 2600-byte serialrx/serialblaster throughput with no loss, and TERMIOS
reconfiguration (CS7 data-bit truncation, parity and stop-bit ioctl
round-trip, and 9600 baud reprogramming) all pass.

Signed-off-by: dechao_gong <dechao_gong@realsil.com.cn>
Assisted-by: Claude <noreply@anthropic.com>
2026-08-10 09:51:02 -03:00
Marco Casaroli 067e30e14f arch/x86_64: Build fork() children from the caller's syscall frame.
In a kernel build vfork() is reached through a system call, so the return
address and stack pointer the architecture's entry point can see for itself
are the kernel's, not the caller's.  A child built from those resumes at a
kernel address, which is why x86_64 selected the fork family only for the
flat build.

x86_64_syscall() now publishes the caller's frame in xcp.sregs for the
duration of the stub call, and x86_64_fork() builds the child from it:

  x86_64_fork_syscall()  when xcp.sregs is non-NULL, so that the child
                         returns from the very same `syscall' instruction as
                         the parent, in user mode, on its own stack;
  x86_64_fork_direct()   otherwise, which is the flat build and any kernel
                         thread that calls the entry point as a plain
                         function.

The discriminator is xcp.sregs rather than TCB_FLAG_SYSCALL, which arm64 and
RISC-V use:  that flag also defers signal actions, x86_64 has never raised it,
and its kernel-build signal path does not survive being made to -- a
pre-existing problem that does not belong to this work.

Two properties of SYSCALL/SYSRET shape the child's frame.  The instruction
leaves the caller's RIP and RFLAGS in RCX and R11 rather than on a stack, so
they are moved into the RIP and RFLAGS slots of the interrupt frame the child
is resumed from; and the hardware never records the caller's CS and SS at all,
SYSRETQ reconstructing them from IA32_STAR, so the child's are filled in with
the user code and data selectors at RPL 3.  The frame is therefore not copied
wholesale:  the extended state and the general registers are inherited, while
the segment registers and the thread pointer stay as up_initial_state() left
them, the child's stack being a fresh allocation the parent's FS base does not
describe.

x86_64_fork_relocfp() is new and is not optional here.  A function returns
with `leave', which feeds the frame pointer into the stack pointer, so
relocating only the RBP the child resumes with gets it exactly one frame:
the next return loads a saved RBP still pointing into the parent's stack.

With that in place ARCH_X86_64 can select ARCH_HAVE_VFORK unconditionally.

Build-verified on qemu-intel64:knsh_romfs and qemu-intel64:ostest.  NuttX on
qemu-intel64 requires tsc-deadline and pcid, which TCG does not implement, so
it cannot be run on this host.

Assisted-by: Claude Code:claude-opus-5
Signed-off-by: Marco Casaroli <marco.casaroli@gmail.com>
2026-08-10 08:57:30 -03:00
Marco Casaroli 3557791ae2 arch/arm64: Build fork() children from the caller's syscall frame.
In a kernel or protected build vfork() is reached through a system call, so
the return address and stack pointer that the entry point in
arm64_fork_func.S can snapshot for itself belong to the kernel-side stub, not
to the caller.  A child built from that snapshot resumes at a kernel address
on a kernel stack.  This is why arm64 selected the fork family only for the
flat build.

Record what the caller was actually doing instead.  arm64_sync_exc passes the
exception frame to dispatch_syscall() in x7 -- x0-x6 carry the call number and
its six parameters, so x7 is free -- and dispatch_syscall() stores it in
xcp.sregs, mirroring what riscv_swint.c does.

arm64_fork() then chooses where the caller's registers live:

  arm64_fork_syscall()  when TCB_FLAG_SYSCALL is set, rebuilding the child
                        from xcp.sregs so that it returns from the very same
                        SVC as the parent;
  arm64_fork_direct()   otherwise, which is the flat build and any kernel
                        thread that calls the entry point as a plain function.

The stack copy and the relocation of pointers into it are shared by both
paths in arm64_fork_stack() and arm64_fork_reloc().

With that in place ARCH_ARM64 can select ARCH_HAVE_VFORK unconditionally.

Verified on qemu-armv8a:knsh (BUILD_KERNEL), qemu-armv8a:nsh (BUILD_FLAT) and
qemu-armv8a:citest_smp under qemu-system-aarch64:  ostest's vfork_test passes
on all three, and it was absent from knsh before the change.  The protected
configurations are build-verified only (fvp-armv8r:pnsh), there being no
emulator for them here.

Assisted-by: Claude Code:claude-opus-5
Signed-off-by: Marco Casaroli <marco.casaroli@gmail.com>
2026-08-10 08:57:30 -03:00
Marco Casaroli 608d1e269a arch/arm: Build fork() children from the caller's syscall frame on armv7-a.
In a kernel build the cloning primitives are reached through a system call,
and armv7-a dispatches one by re-pointing the caller's own exception frame at
dispatch_syscall() and switching to the task's kernel stack.  The snapshot the
entry point in fork.S takes for itself therefore describes the kernel-side
stub, and the frames below it are on a stack the child gets no copy of:  a
child built from that snapshot resumes at a kernel address with a stack
pointer into its own user stack.  It faulted with a prefetch abort at PC 0 on
qemu-armv7a:knsh, which is why the fork family had never been run there.

Record what the caller was actually doing instead.  arm_syscall() stores the
exception frame of the outermost system call in xcp.sregs, mirroring
riscv_swint.c, and arm_fork() chooses where the caller's registers live:

  arm_fork_syscall()  when a user stack pointer is saved, rebuilding the child
                      from xcp.sregs so that it returns from the very same SVC
                      as the parent, in the same mode, on its own stack and
                      with no inherited system call nesting;
  arm_fork_direct()   otherwise -- the flat build, a kernel thread in any
                      build, and a build without a kernel stack, where the
                      call is dispatched on the caller's own stack so the
                      caller's frames are copied along with the kernel-side
                      ones.

Note that the discriminator is xcp.ustkptr rather than TCB_FLAG_SYSCALL.  On
armv7-a the caller is the task that runs the kernel side of its own system
call, so being in a system call is not by itself a reason to distrust the
snapshot; the switch to the kernel stack is.  Because arm_syscall() has
already re-pointed the frame by the time arm_fork() runs, the caller's PC,
CPSR and SP come from where arm_syscall() put them -- syscall[0].sysreturn,
syscall[0].cpsr and ustkptr -- and the rest from the frame itself.

Nothing selects the primitives on an ARM kernel build yet, so this commit
changes no configuration; it is what the next one needs to be correct.

Assisted-by: Claude Code:claude-opus-5
Signed-off-by: Marco Casaroli <marco.casaroli@gmail.com>
2026-08-10 08:57:30 -03:00
Marco Casaroli aae62ceaae !Documentation: Describe the fork()/vfork() split.
Documentation/guides/fork_vfork_migration.rst is new.  It says what changed
and why, gives the two primitives as a table, states plainly what breaks, and
answers "which replacement do I want?" from the reader's own reason for having
called fork() -- posix_spawn() or vfork() to run a program, pthread_create()
for a second flow of control that shares memory, fork() itself for an
independent copy.  It also documents the two configuration symbols, what an
architecture has to implement to gain real fork(), and the one visible
consequence of moving the vfork() suspension into the kernel: a waitpid()
after a child that _exit()s can only report status where
CONFIG_SCHED_CHILD_STATUS is enabled.

reference/user/01_task_control.rst gains an entry for fork() and rewrites the
one for vfork(), which described NuttX's limitations rather than the
interface's contract.  standards/posix.rst moves fork() from "No" to "Cond."
and vfork() from "Yes" to "Cond.", both being conditional on the configuration
now.  implementation/memory_configurations.rst no longer lists fork() as
unimplementable in the presence of address environments, which was the whole
point of that section's wish list.  Three long-standing typos in that file are
corrected while touching it, since codespell checks the whole of any file a
patch modifies.

BREAKING CHANGE: this commit carries no code; it is the migration guide for
the fork() withdrawal in the commit before it, and is marked so that every
commit in the series carries the marker CONTRIBUTING.md 1.13 requires.  The
quick fixes are in Documentation/guides/fork_vfork_migration.rst.

Assisted-by: Claude Code:claude-opus-5
Signed-off-by: Marco Casaroli <marco.casaroli@gmail.com>
2026-08-10 08:57:30 -03:00
guanyi3 e7ef45d39a Documentation: add devfreq framework documentation
Document the device frequency scaling framework: the QoS/governor arbitration model, the lower-half driver interface, built-in governors, in-kernel QoS requests, change notifications, procfs, and suspend/resume.

Signed-off-by: guanyi3 <guanyi3@xiaomi.com>
2026-08-08 15:23:54 -03:00
raiden00pl 80a04ea953 drivers/analog: add digital potentiometer driver support
Add a common upper-half character driver for digital potentiometers
with a generic set of ioctl commands (wiper set/get, terminal control,
device properties) that can be shared by chip-specific lower halves.

Signed-off-by: raiden00pl <raiden00@railab.me>
Assisted-by: Claude Code
2026-08-08 18:37:08 +08:00
Filipe Cavalcanti ef06fc9e80 Documentation: update esp32p4-tab5 with LCD and touch info
Adds documentation entries to the tab5 board, mentioning the new
defconfigs and updates support features.

Signed-off-by: Filipe Cavalcanti <filipe.cavalcanti@espressif.com>
2026-08-07 19:13:42 -04:00
Lwazi Dube 72796cdcd7 docs/boards/ci20: Remove redundant mkimage command
Remove the manual mkimage step because CONFIG_UBOOT_UIMAGE=y already
generates a valid uImage. This brings the documentation up to date
with the uImage usage that was already standard in practice.
2026-08-07 11:17:55 +08:00
Felipe Moura f9a25a4fef boards/esp32c3-devkit: add Dropbear SSH server support
Restore the esp32c3-devkit:dropbear defconfig and its documentation, now that
the AES symbol collision between the Wi-Fi stack and crypto/aes.c is fixed in
the ESP HAL.  netutils/dropbear depends on CRYPTO_CRYPTODEV_SOFTWARE_CRYPTO,
so the defconfig enables the cryptodev software backend and base64 codecs.

Signed-off-by: Felipe Moura <moura.fmo@gmail.com>
2026-08-06 16:15:12 -03:00
Jorge Guzman c191bcb76d boards/arm/stm32l0/b-l072z-lrwan1: fix radio clock and add LoRa configurations
The 32 MHz TCXO that clocks the SX1276 is powered from PA12 and was never
driven, so the radio had no clock at all.  The user button was copied from
the Nucleo L073RZ and left on PC13, which carries DIO3 of the radio on this
board; it is PB2.

Adds lorawan_tx and lorawan_beacon, with the radio defaults of a public
LoRaWAN network in the 915 MHz band, and fills in the board page.

Assisted-by: Claude Code 4.8
Signed-off-by: Jorge Guzman <jorge.gzm@gmail.com>
2026-08-06 13:01:39 -03:00
Jorge Guzman 7bda3b7c8b wireless/lpwan/sx127x: fix the frequency step, the band and the LoRa only build
- The frequency step was truncated to 61 Hz, while it is FXOSC/(2**19),
  about 61.035 Hz.  The error puts a 915 MHz channel more than 500 kHz away
  from the requested frequency, outside its own bandwidth.

- The low or high frequency front end was left at its reset value, so a board
  wired for 868 or 915 MHz neither transmitted nor received.

- sx127x_rx_watchdog() is only used by the FSK and OOK path but was compiled
  whenever receive support was on, so a LoRa only configuration failed to
  build with -Werror.  nrf52840-dk:sx127x is such a configuration.

Adds the sync word, the default bandwidth and the default spreading factor as
configuration options, all defaulting to the previous behaviour, and a page
for the driver under components/drivers.

Assisted-by: Claude Code 4.8
Signed-off-by: Jorge Guzman <jorge.gzm@gmail.com>
2026-08-06 13:01:39 -03:00
Jorge Guzman f37bc4546e wireless/lpwan: add SX1301 LoRa concentrator driver
Character driver for the Semtech SX1301, the baseband processor of a LoRaWAN
gateway, and the two SX125x radios it drives.  Received packets come from
read(), downlinks go to write(), and the channel plan, the start and the stop
are ioctls.

The interface is device independent, in nuttx/wireless/lpwan/lora_gw.h with
the commands in the common WLIOC_GW_* space, so another concentrator driver
can implement it and the same application drive it.

Adds a lorawan_gw configuration for the Nucleo F746ZG with a shield of the
LRWAN_GS_HF1 family.  Off by default (LPWAN_SX1301).

Assisted-by: Claude Code 4.8
Signed-off-by: Jorge Guzman <jorge.gzm@gmail.com>
2026-08-06 13:01:39 -03:00
Alan Carvalho de Assis 2d0733cf41 doc/i2ctool: Add missing -z paramenter
As requested at https://github.com/apache/nuttx/pull/19712

Signed-off-by: Alan C. Assis <acassis@gmail.com>
2026-08-06 09:28:08 -04:00
Filipe Cavalcanti 015020223c Documentation: add ST7123 to input docs
Adds documentation to input and touchscreen controller files, regarding
support for ST7123 IC.

Signed-off-by: Filipe Cavalcanti <filipe.cavalcanti@espressif.com>
2026-08-06 12:42:15 +02:00
raiden00pl 877cd6d129 Documentation: describe CMake build for qemu-intel64 knsh_romfs
The CMake build does not need the manual export/import/mkromfsimg
steps: applications and the ROMFS image are generated by the normal
build. Document the CMake invocation and how to run the image.

Signed-off-by: raiden00pl <raiden00@railab.me>
Assisted-by: Claude Code
2026-08-06 02:39:03 +08:00
Marco Casaroli 21133a90c4 Documentation/nxflat: Document the in-tree mknxflat and the ABI marker.
mknxflat is built from tools/nxflat by the NuttX build itself, so the
toolchain section no longer sends the reader to buildroot for it; only
ldnxflat still comes from there.  Bring the mknxflat usage text in line
with the tool, note that MKNXFLAT and LDNXFLAT are supplied by the ARM
Toolchain.defs, and correct the r10 references left in the PIC
descriptions.

Describe the module ABI marker, so that a user whose prebuilt module
starts failing exec() with ENOEXEC finds out that the loader refuses a
module whose import table does not name __nxflat_abi_v2, and that
rebuilding the module is the fix.

Assisted-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Signed-off-by: Marco Casaroli <marco.casaroli@gmail.com>
2026-08-06 01:38:23 +08:00
Marco Casaroli abbe0df26d !arch/arm: Use r9 as the PIC base register.
ARM PIC has used r10 as the base register, but the tree has never been
consistent about it.  Toolchain.defs gives CONFIG_BUILD_PIC
-mpic-register=r9 and CONFIG_PIC -mpic-register=r10, twenty-five lines
apart, and arm_initialstate.c sets REG_R9 from inline assembly under one
and REG_PIC under the other, with a comment reading "Set the PIC base
register (probably R10)".  This settles it on r9 for all of PIC: NXFLAT,
ELF PIC and CONFIG_BUILD_PIC alike.

r9 is the right choice rather than an arbitrary one.  It is the AAPCS
platform register, the "static base", and it is what GCC itself picks
for -msingle-pic-base on an EABI target; r10 is the non-EABI default.

It also removes a combination that cannot build today.  Stack checking
adds -ffixed-r10 in armv7-m/Toolchain.defs and armv8-m/Toolchain.defs,
while CONFIG_PIC adds -mpic-register=r10, and GCC rejects the pair with
"unable to use 'r10' for PIC register".  The comment above REG_PIC has
always said the register "can be R9 if stack checking is enabled", but
the definition was unconditionally REG_R10, so it would have named the
wrong register even had the build succeeded.

The thunk generator moves with the firmware.  NXFLAT import stubs had
the register baked in as "add ip,ip,sl", so a module built for r9 would
load and then branch to a wild address on its first call out.  The stubs
now come from NXFLAT_PIC_REG in the in-tree tool, which is built only
when CONFIG_NXFLAT is set, following the
CONFIG_BOARD_ETC_ROMFS_PASSWD_ENABLE precedent in tools/Unix.mk.

That leaves modules built before this change, and they are the reason
for the ABI marker.  The NXFLAT header cannot carry a version: h_magic
is written by ldnxflat, which is GPL, derived from elf2flt, and stays
out of this repository, so it can never be changed in step with the
loader.  The import table can, because both of its ends are in-tree --
mknxflat emits it and nxflat_bindimports() reads it -- and ldnxflat
passes it through untouched.  So every module now imports
__nxflat_abi_v2, the base firmware defines it, and a module that does
not import it is refused.

Making the marker a real exported symbol rather than a name the loader
special-cases is what keeps it out of the build system's way: a board's
symbol table picks it up exactly as it picks up printf, so mksymtab.sh
and its equivalents need no change.  It also gives the reverse direction
a diagnosis for free -- a module built against a newer ABI than its
firmware fails with "Exported symbol __nxflat_abi_v2 not found".

Most of the remaining churn is boards restating a default.  ARCHPICFLAGS
is a "?=" default so that a board only speaks up when it differs, and
twenty-six were assigning the value the default already had.  MKNXFLAT
gets the same treatment: thirteen boards named the same tool, and the
only thing that varies is ARM versus Thumb-2, which falls out of
CONFIG_ARM_THUMB.  LDNXFLAT gains a default too -- it stays an
out-of-tree PATH lookup, but naming it centrally fixes boards that never
assigned it, where it expanded to nothing and handed make a recipe
beginning "-e", whose leading dash make ate as "ignore errors".

The non-ARM boards carrying -mpic-register=r10 lose it: it is an
ARM-only option, reachable only through CPICFLAGS, which is only used to
build NXFLAT modules, and no non-ARM board enables NXFLAT.

Boards keep nothing about PIC flags any more.  ARCHPICFLAGS was set by
sixty-three of them and only ever fed CPICFLAGS, which is only used to
build NXFLAT modules; no board outside arch/arm enables NXFLAT, so every
non-ARM copy was setting a variable nothing read.  Those are removed
rather than moved somewhere more central, which would only make dead
text look load-bearing.  LDNXFLAT goes the same way as MKNXFLAT, for the
same reason: thirteen boards named the same tool that Toolchain.defs now
names once.

One of them was not merely redundant.  am67/t3-gem-o1 asked for
"-mpic-register=r10 -ffixed-r10", which GCC refuses outright with
"unable to use 'r10' for PIC register" -- the very combination the
filter-out machinery in Toolchain.defs exists to prevent.  It has
survived because that board does not build NXFLAT modules, so the flags
are never handed to a compiler.  Renaming the register would have
carried the fault forward unchanged, so the line goes.

Tested on lm3s6965-ek:qemu-nxflat under QEMU, configured and built with
no overrides.  The nxflat example runs the errno, hello and struct
modules with output identical to the same config built from master.
Built with the old out-of-tree thunk generator instead, the same
firmware refuses all three with ENOEXEC rather than locking up in a
HardFault, which is what this change is for.  mps3-an547:picostest,
which is CONFIG_PIC without CONFIG_NXFLAT, builds clean and does not
build the thunk generator.

The .def files pick up two cosmetic changes here alongside the register:
a "Dyanamic" typo that codespell rejects, and a reworded comment in each
thunk_*.c.  Neither appears in the emitted thunk -- both are in C
comments -- so the generated text is still what the upstream tool
produces, modulo the register itself.

BREAKING CHANGE: ARM PIC moves from r10 to r9.  An NXFLAT module built
before this change has r10 baked into its import stubs and will not run
against a firmware carrying it; the two cannot be mixed.  The module is
refused with ENOEXEC rather than branching to a wild address, by way of the
__nxflat_abi_v2 marker described below.

Quick fix: rebuild the module against this tree.  Its source needs no
change.  A board that reserved r10 by hand, or that assigned ARCHPICFLAGS
or MKNXFLAT to restate a default, should drop those assignments; nothing
else is affected, and CONFIG_PIC without CONFIG_NXFLAT needs no action.

Assisted-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Signed-off-by: Marco Casaroli <marco.casaroli@gmail.com>
2026-08-06 01:38:23 +08:00
fangyibo ecacc7bc7c Documentation/audio: document the audio upper half interface
The audio subsystem page listed the source files and the configuration
options, but nothing about the interface the upper half presents to
applications.  PR #18348 added a device state machine, a second buffer
allocation mode, poll and mmap support and several new ioctls, none of
which were described anywhere, so the only way to learn the expected
call sequence was to read audio/audio.c.

Document what the upper half now guarantees:

  - the device state machine, and the fact that AUDIOIOC_START is
    rejected until AUDIOIOC_CONFIGURE has moved the device out of
    AUDIO_STATE_OPEN;
  - the normal open/configure/allocate/enqueue/start sequence;
  - the two AUDIOIOC_ALLOCBUFFER modes selected by u.pbuffer, who owns
    the buffers in each, and that a shared ring request may return zero
    when the ring is already populated;
  - that AUDIOIOC_GETBUFFERINFO also establishes the shared ring depth,
    so a lower half which does not implement it disables that mode;
  - the poll event semantics and how mmap() selects between a ring
    buffer and the device status by requested length;
  - all ioctls handled by the upper half, grouped by purpose;
  - how per-open state is aggregated into the device state when several
    applications share one device.

No functional change.

Signed-off-by: fangyibo <fangyibo@xiaomi.com>
2026-08-05 07:58:53 +02:00
Felipe Moura 184ba318cd Documentation/mpu6050: document the data ready interrupt mode
The registration example showed the three argument form, which no longer
compiles, and fetch() as the only way samples are taken. Update it, add
a section on the two acquisition modes and the attach() a board provides
for the interrupt one, and state the 100 Hz sample rate.

Signed-off-by: Felipe Moura <moura.fmo@gmail.com>
2026-08-04 17:40:28 -03:00
Marco Casaroli 58e227a8a5 Documentation: Document dlopen() reference counting.
Describe the shared library open semantics in the FLAT and PROTECTED
builds: dlopen() of a library that is already loaded returns a handle
to it and takes an additional reference, and the library is unloaded
only when the last handle is closed.  Note the consequences that follow
from having a single instance: libraries are matched by basename, data
is shared by all users, and constructors and destructors run once.

Contrast this with insmod(), which still rejects a duplicate module
name, and note that dlopen() is not implemented in the KERNEL build.

Assisted-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Signed-off-by: Marco Casaroli <marco.casaroli@gmail.com>
2026-08-04 11:12:49 -03:00
Jorge Guzman 121182e599 Documentation/applications/games/nxdoom: document the display options
The options that let a board trade memory for drawing speed were only
described in their Kconfig help, where someone bringing the game up on a
new board is unlikely to find them.  Describe what each one does and
when it is worth enabling.

Signed-off-by: Jorge Guzman <jorge.gzm@gmail.com>
2026-08-04 10:30:04 +08:00
Jorge Guzman 7426e092c7 boards/arm/stm32h7/linum-stm32h753bi: add an nxdoom configuration
Runs NXDoom on the board's LCD, played with a USB HID keyboard and
reading the game data from the microSD card, so it exercises the LTDC
framebuffer, the OTG FS host and the SDMMC peripheral at once.

Three settings are needed that are not obvious:

  CONFIG_FAT_FORCE_INDIRECT, because the FAT layer otherwise reads whole
  sectors straight into the caller's buffer and the SDMMC IDMA cannot
  reach the caller's buffer when it lives in external SDRAM.  The
  failure appears part way through startup, once the internal RAM has
  filled and allocations start coming from SDRAM.

  CONFIG_HIDKBD_NOGETREPORT, because the keyboard answers GET_REPORT on
  the control pipe with an empty report and only delivers key data on
  its interrupt endpoint.  Without it the keyboard enumerates, reports
  no error, and no key is ever seen.

  CONFIG_STM32_LTDC_L1_L8 with the frame buffer colour map, because DOOM
  is natively palettised:  letting the display convert the palette while
  it scans out removes the conversion from the blit and halves the
  amount of data written per frame.

Signed-off-by: Jorge Guzman <jorge.gzm@gmail.com>
2026-08-04 10:30:04 +08:00
Abhishek Mishra 4002e6af5f Documentation: describe FS permission interface and mount-crossing
Document inode_checkperm / inode_checkpathperm, mountpoint traverse vs open
semantics, and the optional mountpt_operations.permission hook in
file_permission.rst.

Signed-off-by: Abhishek Mishra <mishra.abhishek2808@gmail.com>
2026-08-02 18:48:40 -03:00