Fixes spelling of "Alternatively", adds proper link to kconfig option,
and fixes Sphinx code block markup.
Signed-off-by: Benjamin Cabé <benjamin@zephyrproject.org>
In 7579ccc68e (modules: hal_nordic: nrfs: Fix initialization priority)
used wrong priority as it assumed that NRFS is using IPC service init
priority. Priorities are fixed now and static assert is added to ensure
that NRFS init priority is higher than IPC service.
Signed-off-by: Krzysztof Chruściński <krzysztof.chruscinski@nordicsemi.no>
Fix a scenario where the logging thread can enter an infinite
loop and starve lower-priority threads when encountering an
uncommitted log message.
If a lower-priority thread is preempted before committing a
message, and a higher-priority thread triggers log processing,
the logging thread may repeatedly attempt to claim it. Since the
message is pending but not committed, z_log_msg_claim() returns
NULL while z_log_msg_pending() remains true, resulting in a
livelock.
Update the log processing logic to avoid looping on uncommitted
messages, allowing lower-priority threads to resume and complete
the commit.
Fixes#101401
Signed-off-by: Javier Romera <lromerajdev@gmail.com>
This fixes a subtle race-condition in the k_timer expiration
handler z_timer_expiration_handler(). There was a small window
of opportunity between when sys_clock_announce() unlocked
interrupts and that handler re-locked them that one or more
higher priority interrupts (or threads running on another CPU
if in an SMP environment) could not only abort the ktimer's
timeout, but restart it as well. Both of these situations are
now detectable in the handler (resulting in an immediate return
from the handler).
To make this work, every case where the ktimer internals either
adds or aborts its timeout is now encapsulated by the ktimer lock.
Thus, when the handler tests if the timeout handler has been
canceled with only the ktimer lock being held, we know that no
other thread or ISR can be modifying the ktimer's timeout.
Fixes#106654
Signed-off-by: Peter Mitsis <peter.mitsis@intel.com>
Disable the DeviceMmioCheck compliance check while documentation and
community discussion are ongoing. The check code is kept in place and
can be re-enabled by removing the self.skip() call.
See https://github.com/zephyrproject-rtos/zephyr/issues/106966
Signed-off-by: Carlo Caione <ccaione@baylibre.com>
As of 0.13.0, mcumgr-toolkit now supports all SMP groups.
Also, its CLI tool is now mentioned specifically.
Signed-off-by: Martin Stumpf <finomnis@gmail.com>
Fix up the existing migration guide entries.
Add missing bits.
Remove information about the PSA Crypto API changes; they belong to
upstream Mbed TLS.
Move `Mbed TLS` under `Modules` instead of `Other subsystems`.
Populate the release notes with the same information but in addition
add the new and deprecated Kconfig options.
Signed-off-by: Tomi Fontanilles <tomi.fontanilles@nordicsemi.no>
IDLE exit is programmed to happen shortly before systimer
programmed wake-up event happens. If the interrupt from
the timer happens before, idle_exit() does not run, as
timeout_idle flag is cleared at the ISR. Fix condition for
both systimer (ESP32) and xtensa drivers.
Signed-off-by: Raffael Rostagno <raffael.rostagno@espressif.com>
With new SDK 1.0, --specs=nosys.specs is not needed for minimal libc.
Fixes many build issues with new SDK when building for minimal libc.
Signed-off-by: Anas Nashif <anas.nashif@intel.com>
Fixes zephyrproject-rtos/zephyr#106597
The current driver for the NXP C40 flash controller instantiates two
drivers, one for the controller (which has no real code -- it's just
a device with no API, config, or data), and one for the flash bank.
This breaks the various partition APIs because they expect the flash
driver API to be attached to the "grandparent" of the partitions
object -- but in the current C40 driver, it is attached to the parent.
I was worried this fix was going to be more complicated, but it
appears to have been quite simple. All I needed to do was to
instantiate a single device with the the API, config and data.
The fix requires the "soc-nv-flash" compatibility to be added to
device trees which reference this driver (see previous commit).
This fix addresses the bug report I filed a few days ago:
NXP C40 flash driver incompatibility with partitions macro APIs #106597
Signed-off-by: Rob Newberry <rob@zenomoto.com>
Signed-off-by: rob-zeno <rob@zenomoto.com>
This commit adds the "soc-nv-flash" compatibility to the NXP C40
flash node, allowing mcuboot's automatic layout detection mechanism
(which relies on the erase-block-size and write-block-size
properties which are already there) to work.
It is a partial and required step to fix:
zephyrproject-rtos/zephyr#106597
Signed-off-by: Rob Newberry <rob@zenomoto.com>
Signed-off-by: rob-zeno <rob@zenomoto.com>
When CONFIG_LOG_MODE_IMMEDIATE and CONFIG_LOG_IMMEDIATE_CLEAN_OUTPUT
are enabled, log messages are processed synchronously and serialized
across CPUs using a global spinlock (process_lock).
In this configuration, if a fatal exception (e.g. stack overflow
triggering a PMP fault on RISC-V) occurs while the current context
already holds process_lock, the fatal error handler may attempt to
log diagnostic messages. This leads to a recursive attempt to acquire
the same spinlock from the same CPU, resulting in a self-deadlock.
This issue is not limited to a specific architecture. It can occur on
any platform where logging is invoked from a fatal or exception context
while the lock is already held.
Fix this by introducing a lightweight owner tracking mechanism for
process_lock. The current CPU ID is stored when the lock is acquired,
and if the same CPU attempts to acquire the lock again, the lock
operation is bypassed to avoid self-deadlock.
This preserves strict log ordering across CPUs during normal operation,
while ensuring that logging remains safe and non-blocking in fatal or
exception contexts.
Signed-off-by: Li Jie <lijie.1996@picoheart.com>
nSIM simulates the full address space, so dereferencing a NULL
pointer (writing to address 0) does not generate a fault. This
caused the coredump test to hang and timeout on nsim_arc_v/rmx100.
Add CONFIG_SOC_FAMILY_NSIM_ARC_V to the list of platforms that use
k_panic() instead of a NULL pointer dereference to trigger the
fatal error.
Signed-off-by: Mohamed Moawad <moawad@synopsys.com>
The check was scanning the entire file content, causing CI failures
for PRs that touch any line in an existing non-compliant driver, even
if the change is completely unrelated to the violation.
Fix this by parsing git diff -U0 hunk headers to determine which
lines were actually added in the changeset, and only flag
RAW_REG_ADDR_RE matches on those lines. The MMIO_API_RE suppression
still scans the whole file so that files already using the MMIO API
are correctly excluded.
Signed-off-by: Carlo Caione <ccaione@baylibre.com>
The RAW_REG_ADDR_RE pattern used \w+ for the cast type, which only
matches single-word types like (uint32_t *). This misses the most
common pattern in Zephyr drivers:
.base = (struct foo_regs *)DT_INST_REG_ADDR(n),
Replace \w+ with [^)]* to match any cast expression including struct,
volatile, and multi-word types.
Also extend the pattern to catch DT_[INST_]REG_ADDR_BY_NAME() casts,
which are equally broken on MMU platforms, and scan .h files in
addition to .c files since some drivers define their config structs
in companion headers.
Before: 554 flagged lines across drivers/
After: 694 flagged lines across drivers/ (+140 newly caught)
Signed-off-by: Carlo Caione <ccaione@baylibre.com>
The iar toolchain fails to build after the update to the
1.0.0 Zephyr SDK. The path to the gnu toolchains
was updated to '${ZEPHYR_SDK_INSTALL_DIR}/gnu/'
in order to be compatible with the 1.0.0 SDK.
Signed-off-by: Jason Yu <zejiang.yu@nxp.com>
sys_clock_set_timeout() and sys_clock_elapsed() are now documented
as requiring the system clock lock to be held by the caller. Wrap
the calls in subsys/pm/pm.c, soc/nxp/rw/power.c and the kernel
shell thread list command with sys_clock_lock()/sys_clock_unlock().
Signed-off-by: Nicolas Pitre <npitre@baylibre.com>
Migrate intel_adsp_timer to the unified timer lock API. Replace the
driver-private spinlock with sys_clock_lock()/sys_clock_announce_locked().
Signed-off-by: Nicolas Pitre <npitre@baylibre.com>
Migrate apic_tsc to the unified timer lock API. Replace the
driver-private spinlock with sys_clock_lock()/sys_clock_announce_locked().
Signed-off-by: Nicolas Pitre <npitre@baylibre.com>
Migrate hpet to the unified timer lock API. Replace the driver-private
spinlock with sys_clock_lock()/sys_clock_announce_locked().
Signed-off-by: Nicolas Pitre <npitre@baylibre.com>
Migrate xtensa_sys_timer to the unified timer lock API. Replace the
driver-private spinlock with sys_clock_lock()/sys_clock_announce_locked()
so that the hardware cycle baseline and the kernel tick counter are
always updated under the same lock.
Also migrate sys_clock_idle_exit() which updates driver state and
announces ticks on LPM exit.
Add extern declarations for sys_clock_cycle_get_32/64 in
arch/xtensa/arch.h, consistent with all other architectures, to
avoid a circular include dependency with system_timer.h. Xtensa
was the only architecture missing them.
Signed-off-by: Nicolas Pitre <npitre@baylibre.com>
Migrate riscv_machine_timer to the unified timer lock API. Replace the
driver-private spinlock with sys_clock_lock()/sys_clock_announce_locked()
so that the hardware cycle baseline (last_count) and the kernel tick
counter (curr_tick) are always updated under the same lock.
This eliminates a race on SMP where sys_clock_elapsed() could observe
the updated last_count before sys_clock_announce() had advanced
curr_tick, causing time-dependent kernel operations to see inconsistent
values.
Remove internal locking from sys_clock_set_timeout() and
sys_clock_elapsed() as they are now always called with the timer lock
held.
Signed-off-by: Nicolas Pitre <npitre@baylibre.com>
Migrate arm_arch_timer to the unified timer lock API. Replace the
driver-private spinlock with sys_clock_lock()/sys_clock_announce_locked()
so that the hardware cycle baseline (last_cycle) and the kernel tick
counter (curr_tick) are always updated under the same lock.
This eliminates a race on SMP where sys_clock_elapsed() could observe
the updated last_cycle before sys_clock_announce() had advanced
curr_tick, causing time-dependent kernel operations to see inconsistent
values.
Remove internal locking from sys_clock_set_timeout() and
sys_clock_elapsed() as they are now always called with the timer lock
held.
Signed-off-by: Nicolas Pitre <npitre@baylibre.com>
On SMP systems with tickless kernels, a race condition exists between
timer driver ISRs and the kernel's tick accounting. The driver updates
its hardware cycle baseline under a private lock, then calls
sys_clock_announce() which updates curr_tick under the separate
timeout_lock. In the gap between these two lock releases, any kernel
code calling sys_clock_elapsed() sees the new driver baseline but the
old curr_tick, producing inconsistent time values that can go backwards.
This affects every code path using the internal elapsed() helper:
uptime queries, timeout scheduling, timeout cancellation, remaining
time queries, and next-expiry calculations.
The root cause is two separate locks protecting state that must be
mutually consistent. Fix this by exposing the kernel's timeout_lock
to timer drivers via sys_clock_lock()/sys_clock_unlock(), and
providing sys_clock_announce_locked() which assumes the lock is
already held.
Timer drivers can now acquire the single lock, update their hardware
state, and announce ticks all under the same lock — eliminating the
race window entirely. The key is passed to sys_clock_announce_locked()
which consumes it (releasing the lock when it returns).
The existing sys_clock_announce() becomes a backward-compatible wrapper,
allowing incremental driver migration with no flag day.
Document that sys_clock_set_timeout(), sys_clock_elapsed(), and
sys_clock_idle_exit() are called by the kernel with the timer lock
held. Update the timer driver guide in clocks.rst accordingly.
Signed-off-by: Nicolas Pitre <npitre@baylibre.com>
In case socket is closed during an async TCP handshake, the TCP context
should be closed immediately, otherwise the connection could be
established after the socket was closed, causing TCP context leak.
To avoid race between socket close and resend timer (i.e. socket being
closed at the same time as the retransmission limit is reached), add
extra state checks before attempting to close the TCP context.
Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
Add a test case which verifies that if a client socket is closed during
an async handshake, the TCP context is properly cleaned up on close,
i.e. it no longer tries to establish the connection.
Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
runtime_idle, also called standby in SiWx91x HAL power manager
did not need to check if it can go to sleep, reconfigure wireless
control after standby, or generate a synchronization event with
the NWP (network coprocessor) when the SoC exits runtime_idle.
This fixes a bug where the shell application is not responsive
with PM enabled. Since the system stays in runtime_idle due to
UART activity for the shell, interrupt information from the NWP
can be lost due to reconfiguration when exiting standby.
Signed-off-by: Martin Hoff <martin.hoff@silabs.com>
body_frag_len was computed using a raw buffer offset formula:
body_frag_len = data_len - (body_frag_start - recv_buf)
This is correct for Content-Length responses: the recv buffer contains
only decoded body bytes after the headers, so the offset arithmetic
gives the exact body byte count.
It is broken for Transfer-Encoding: chunked. RFC 7230 §3.3.2 makes
the two mutually exclusive, so chunked TE never comes with a
Content-Length. With chunked TE, the recv buffer contains both the
decoded body bytes and the chunk framing bytes (chunk-size line, CRLF
body-terminator, terminal chunk "0\r\n\r\n") side by side. The
formula counts everything from body_frag_start to the end of the
buffer fill, so it includes the framing bytes that follow the body,
causing body_frag_len to overcount.
http_parser already knows the exact decoded body byte count: it passes
it as the length argument to on_body(). Use that instead.
Add a regression test that sends a single chunked 206 response from a
raw loopback TCP server in one write, so the chunk terminator and
terminal chunk land in the same recv buffer as the body. The test
asserts body_frag_len equals the decoded body size, not body size + 7
framing bytes.
Signed-off-by: Vytautas Virvičius <vytautas@virvicius.dev>
Add migration guide entry for the FlexSPI NOR DTS
restructuring to the soc-nv-flash child node
convention introduced in b1afb494b0.
Signed-off-by: Ofir Shemesh <ofirshemesh777@gmail.com>
arch_secondary_cpu_init() never returns (it ends with fn(arg) into the
scheduler) but its definition lacks FUNC_NORETURN. The compiler
generates a PACIASP/AUTIASP pair and turns the final fn(arg) into a
tail-call: AUTIASP followed by BR. The AUTIASP causes a PAC
authentication failure (FPAC exception) on secondary CPUs.
Fix by marking the definition FUNC_NORETURN with CODE_UNREACHABLE,
matching the extern declaration. The compiler then generates a plain
BLR without the AUTIASP epilogue.
Also fix the function signature to take no arguments, matching the
extern declaration and actual call sites, and move both
arch_secondary_cpu_init() and z_arm64_mm_init() declarations into
boot.h instead of scattering extern declarations across source files.
Also remove the dead arch_cache_init() call in z_arm64_secondary_prep_c()
that was placed after the noreturn call and could never execute. It is
absent from the primary CPU path in z_prep_c() and the implementation
is empty on arm64 anyway.
Signed-off-by: Nicolas Pitre <npitre@baylibre.com>
Fixes an issue whereby the Kconfigs for manually adjusting the
size and offset were set when mapped bindings were used, these
Kconfigs are not used and to not contain valid information in this
configuration so should not be set
Signed-off-by: Jamie McCrae <jamie.mccrae@nordicsemi.no>
This commit adds additional information for contributors
who whish to contribute safety requirements to the project.
Most importantly, the guide explains how to setup
strictdoc to work with the project's safety requirements
repo.
Signed-off-by: Nicole Pappler <nicole@alektometis.com>
Signed-off-by: nicpappler <github@pappler.eu>
This commit adds the project's Safety Requirements Checklist as
agreed on with the project's safety assessor.
The content is augmented with
* examples
* more explanation to help potential contributers and reviewers
Signed-off-by: Nicole Pappler <nicole@alektometis.com>
Change indentation on multi-line test instruction for consistency
and to ease readability. Also replace 2 tabulations with a space char.
Signed-off-by: Etienne Carriere <etienne.carriere@st.com>
