z_impl_updatehub_probe() checks that the outer metadata object
array has exactly two elements, but then accesses objects[1].objects[0]
without checking that the inner array is non-empty. A server response
whose second object array is empty leaves that element zero-initialized,
so objects[1].objects[0].objects.sha256sum is NULL and the following
strlen() dereferences a NULL pointer, crashing the agent.
Reject metadata whose inner object array is empty before dereferencing
it, for both the 'any boards' and 'some boards' layouts.
Signed-off-by: Gerson Fernando Budke <gerson.budke@ossystems.com.br>
ctx.sock was set to 0 after cleanup, but 0 is a valid file
descriptor (stdin). If cleanup_connection() were called without an
open socket, zsock_close(0) would close stdin.
Guard the close with ctx.sock >= 0 and use -1 as the invalid
socket sentinel.
Signed-off-by: Gerson Fernando Budke <gerson.budke@ossystems.com.br>
coap_packet_init() was hardcoded to COAP_TYPE_CON, ignoring the
msgtype parameter. This meant report() calls passing COAP_TYPE_NON_CON
were silently sent as confirmable messages.
Signed-off-by: Gerson Fernando Budke <gerson.budke@ossystems.com.br>
strncmp with strlen(CONFIG_BOARD) only compares the first N
characters, allowing a supported_hardware entry like
"frdm_k64f_extra" to incorrectly match CONFIG_BOARD="frdm_k64f".
This could cause the device to accept firmware intended for a
different board variant.
Use strcmp for an exact match. Both strings are null-terminated.
Signed-off-by: Gerson Fernando Budke <gerson.budke@ossystems.com.br>
memcpy(metadata_copy, metadata, strlen(metadata)) does not copy the
null terminator. Since metadata_copy comes from k_malloc (unzeroed),
the subsequent strlen(metadata_copy) reads past the copied data into
uninitialized heap memory, and json_obj_parse may process garbage
data or crash.
Zero the buffer before copying to ensure proper null termination.
Signed-off-by: Gerson Fernando Budke <gerson.budke@ossystems.com.br>
strncmp(report.previous_state, "", sizeof("") - 1) always returns 0
because sizeof("") - 1 is 0, and strncmp with length 0 always
returns 0 per the C standard. This means report.error_message was
always set to "" and the server never received actual error details.
Replace with a direct check for a non-empty string. Guard the check
against a NULL previous_state, which state_name() can return for an
out-of-range state (the UPDATEHUB_FLASH_INIT_ERROR case passes a
response code instead of a state), so the new check does not
dereference a NULL pointer.
Signed-off-by: Gerson Fernando Budke <gerson.budke@ossystems.com.br>
When DTLS setsockopt or zsock_connect failed after socket creation,
the error path used ret to decide whether to call cleanup_connection().
However ret was set to -1 after socket creation, so the check
(ret > 0) was false and the socket was never closed.
Additionally, ret was set to 1 before socket creation, so if
zsock_socket itself failed, cleanup_connection() would be called
on an invalid file descriptor.
Replace the ret-based cleanup check with (ctx.sock >= 0) which
directly reflects whether a socket exists that needs closing.
Signed-off-by: Gerson Fernando Budke <gerson.budke@ossystems.com.br>
The UpdateHub subsystem has a race condition between the background
autohandler (system workqueue) and user-triggered operations (shell
commands or direct API calls). Both paths share the global ctx
structure without synchronization, allowing concurrent calls to
prepare_fds() which writes beyond the single-element ctx.fds[1]
array when ctx.nfds is already 1, corrupting adjacent memory
(ctx.sock) and leading to DoS or undefined behavior.
Replace the unused struct k_sem semaphore with a static K_MUTEX_DEFINE
to serialize access to the shared ctx across z_impl_updatehub_probe(),
z_impl_updatehub_update(), and z_impl_updatehub_report_error().
Add a bounds check to prepare_fds() (returning -ENOMEM when ctx.nfds
>= ARRAY_SIZE(ctx.fds)) as defense-in-depth against Out-of-Bounds
writes, and propagate the error through start_coap_client().
Signed-off-by: Gerson Fernando Budke <gerson.budke@ossystems.com.br>
Add support for the Cortex-A32 processor. The Cortex-A32 processor
is built on the ARMv8-A architecture and supports only the AArch32
execution state.
Signed-off-by: Silesh C V <silesh@alifsemi.com>
the buffer doesn't need to be zero initialized.
therefore we don't need to use K_calloc.
It can already be seen, when we need to increase the
buffer we do it with k_realloc, which doesn't set the
additional space to zeros.
Signed-off-by: Fin Maaß <f.maass@vogl-electronic.com>
kernel.h implies kernel_structs.h via kernel_includes.h, making
explicit inclusion of kernel_structs.h unnecessary whenever kernel.h
is already included in the same translation unit.
Remove the redundant includes across arch, boards, drivers, kernel,
lib, samples, subsys, and tests trees.
in include/zephyr/kernel_structs.h:
* 2. kernel.h shall imply kernel_structs.h, such that it shall not be
* necessary to include kernel_structs.h explicitly when kernel.h is
* included.
Signed-off-by: Anas Nashif <anas.nashif@intel.com>
Having an interface library named "mbedTLS" and the real library named
"mbedtls" (as provided by the Mbed TLS module) is misleading.
This commit replaces:
- mbedTLS -> mbedtls_iface for the CMake library. "mbedTLS" is still
available as alias to "mbedtls_iface" for backward
compatibility, but this should be removed in the future.
- mbedTLS -> Mbed TLS in comments and documentation.
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
Introduces K_MEM_SLAB_DEFINE_TYPE() and K_MEM_SLAB_DEFINE_STATIC_TYPE()
helpers to allow the user to declare slabs for types without having to
manually ensure the alignment is correct.
Manual slab alignment was very error-prone and this change fixes several
instances of misalignment that would be trapped by the undefined
behavior sanitizer when running on 64-bit targets.
Signed-off-by: Egill Sigurdur <egill@egill.xyz>
Add a dependency on the NETBUF size if the UART transport and the
img_mgmt group is selected.
Signed-off-by: Tomasz Chyrowicz <tomasz.chyrowicz@nordicsemi.no>
393350fd65 made it so that the `mbedTLS`
library is only created when `CONFIG_MBEDTLS_BUILTIN`.
Before this commit, users of Mbed TLS did the following:
`zephyr_library_link_libraries_ifdef(CONFIG_MBEDTLS mbedTLS)`
If the `mbedTLS` CMake library doesn't exist but is still linked to
(as is the case when `CONFIG_MBEDTLS && !CONFIG_MBEDTLS_BUILTIN`),
the linker command is populated with `-lmbedTLS` which makes the build
fail because there is no `libmbedTLS.a` in the build.
Make it so that users of Mbed TLS only link to the `mbedTLS` CMake
library when the builtin version is used.
Signed-off-by: Tomi Fontanilles <tomi.fontanilles@nordicsemi.no>
The `max_input` variable gets reduced by 3 bytes to make room for the
size header in the first frame; it does not however get reset to its
previous value in the following frame, which permanently reduces
the frame size by three bytes.
Signed-off-by: Martin Stumpf <finomnis@gmail.com>
Fixes an issue whereby a write might have partially been successful
but failed due to insufficient space in the storage device by
re-attempting the write again with the offset, and if it still
fails, return an error
Signed-off-by: Jamie McCrae <jamie.mccrae@nordicsemi.no>
The OpenRISC 1000 architecture can be tested through the qemu_or1k emulated
SoC and board. Because this emulated device has minimal external hardware
by default, this patch enables a minimal suite of tests covering core
kernel features for the CPU architecture.
When running the test suite, OpenRISC was found to require additional stack
space to prevent an overflow. Therefore, a minimal additional amount of
storage: 128-bytes, was added that was found in practice to allow tests to
complete.
Note that Qemu version 9.2.0 or newer is required so as to include the
following commit:
commit 3eb43aeb164f1f83c97ff693c7d464b49755110c
Author: Joel Holdsworth <jholdsworth@nvidia.com>
Date: Fri Jun 7 15:29:33 2024 -0700
hw/openrisc: Fixed undercounting of TTCR in continuous mode
This fixes a bug in the implementation of the emulated OpenRISC Tick Timer
which prevents the Zephyr OpenRISC port from task-scheduling properly.
Signed-off-by: Joel Holdsworth <jholdsworth@nvidia.com>
Replaces usage of these deprecated macros with ones that support
fixed and mapped partition compatibles. Also includes an update to
hal_espressif which also (rightly or wrongly) has zephyr specific
code in it
Signed-off-by: Jamie McCrae <jamie.mccrae@nordicsemi.no>
In
d45cd6716bf27a26f9ec
the mayority of this code was changed to use the new native networking
API naming, but one macro was forgotten.
Let's change it now so this code builds also without
CONFIG_NET_NAMESPACE_COMPAT_MODE
Signed-off-by: Alberto Escolar Piedras <alberto.escolar.piedras@nordicsemi.no>
Fixes macros that broke after changes were merged which started
using the unit address of partition nodes. This also fixes the
test to ensure devices not starting at 0x0 are properly checked
which previously would silently be unknown
Signed-off-by: Jamie McCrae <jamie.mccrae@nordicsemi.no>
Adds support for using MCUmgr over UART (not via shell) in a raw
mode which does not include base64 and other SMP over console
encoding
Signed-off-by: Jamie McCrae <jamie.mccrae@nordicsemi.no>
The return value variable was initialized but immediately
overwritten before.
Remove the redundant initialization and limit the variable scope to
where it is actually used.
No functional change.
Signed-off-by: Gaetan Perrot <gaetan.perrot@spacecubics.com>
Changes CONFIG_MCUMGR_TRANSPORT_UART from selecting
CONFIG_UART_MCUMGR to instead of depending upon it, as it should
never have selected a driver Kconfig and instead always depended
upon it, and is needed for supporting different UART transports
Signed-off-by: Jamie McCrae <jamie.mccrae@nordicsemi.no>
Adds names to these libraries to prevent using auto-generated
names of the paths, which can be longer than the maximum supported
length on the current version of gcc for windows
Signed-off-by: Jamie McCrae <jamie.mccrae@nordicsemi.no>
Fixes various issues in the Kconfigs including not properly having
abbreviations in the correct case, line lengths, duplicating other
Kconfigs, etc.
Signed-off-by: Jamie McCrae <jamie.mccrae@nordicsemi.no>
A new error code FS_MGMT_ERR_FILE_CLOSE_FAILED is returned when
closing a file fails. This is done on write or close operations - read
operations remain unchecked.
Signed-off-by: Samuel Kleiser <s.kleiser@vega.com>
In case of native build, the CONFIG_architecture
cannot currently be resolved with Kconfig, so we
must fall back to resolving it during compilation
using compiler definitions.
Signed-off-by: Jaagup Averin <jaagup.averin@gmail.com>
In d45cd6716b the mayority of the
Zephyr codebased was changed to use the Zephyr native net_ prefixed
types, but some were forgotten.
Without this fix/change the code still builds as we are by now setting
CONFIG_NET_NAMESPACE_COMPAT_MODE. But when this is not set, things
fail to build.
Signed-off-by: Alberto Escolar Piedras <alberto.escolar.piedras@nordicsemi.no>
Remove duplicated #include directives within the same
preprocessor scope across the Zephyr tree.
Duplicates inside different #ifdef branches are preserved
as they may be intentional.
Signed-off-by: Sylvio Alves <sylvio.alves@espressif.com>
The FW loader reports and manages exactly two slots:
- slot 0: this is the slot for the application code to update
- slot 1: this is the slot, in which the FW loader is placed
The slot 1 is reported, so tools can fetch metadata about the
FW loader installed on the device.
Unfortunately, currently SMP-based FW loader allows to issue slot erase
command for the slot 1, effectively erasing the FW loader code that is
being executed.
This change correctly identifies the slot 1 as an active one, marking it
as used and blocking erase operation on that slot.
Signed-off-by: Tomasz Chyrowicz <tomasz.chyrowicz@nordicsemi.no>
According to the docs the millis were in the format `.SSSSSS`. In
reality though, it only accepted exactly `.SSS`, not `.SS` or `.SSSS`
and specifically also not `.SSSSSS`, contrary to the docs. Further, it did
not fail with an error message but simply produced the wrong value.
With this change it accepts everything from `.` to `.SSSSSS` and
produces the correct result. This is compatible with the previous
behavior, with the documentation and with everything in between.
Signed-off-by: Martin Stumpf <finomnis@gmail.com>
- Currently, it is not possible to use mcumgr client with smp server
since there is no way to specify smp server address for requests.
- This patch series adds support for creating smp_client_object
containing information regarding the host server. This design allows
multiple smp_client_object to exist for the same underlying smp_udp
transport, making it much easier to use the same udp socket for multiple
OTAs.
Signed-off-by: Ayush Singh <ayush@beagleboard.org>
