Synchronize changes with Mbed upstream: September 2023 edition (#185)

* Fix null pointer dereferencing

Add null check for return values of functions that are mostly (but not
always) checked for null.
E.g., since 98% of calls to protocol_stack_interface_info_get_by_id
check for null, it is likely that the function can return null values in
some cases, and omitting the check could crash the program.

* Update MAX32660 peripheral drivers with final ones that use by SDK

* Apply MAX32660 delta
Update mbed hal function as per of SDK update

Signed-off-by: Sadik.Ozer <[email protected]>

* M2354: Fix debug failure in Mbed Studio

In Mbed Studio, debugging, based on pyOCD, requires Mbed OS application code starting on the sector boundary.

Modification list:
1.  Update TF-M import assets with MCUboot header padding to sector aligned
2.  Following above, change header size argument (-H) in wrapper.py command line
3.  Following below, fix min-write-size (--align) to 4 (per flash_area_align()) in wrapper.py command line
    https://docs.mcuboot.com/design.html#image-trailer

Related issue:
ARMmbed#15417

* Do not clear interrupt flag during initialization
This causes issue for repeaded initialization while using BufferedSerial mode

Signed-off-by: Sadik.Ozer <[email protected]>

* MAX32660, MAX32670 UART performance improvement

Signed-off-by: Sadik.Ozer <[email protected]>

* Handle negative values passed to close()

Calling close() with negative numbers causes out-of-bounds indexing of the filehandles array. For example, this can happen if open() returns an error and the value is later passed to close().

* Moved a { to the same line as if

Moved a { to the same line as if

* add nullpointer check in LWIP::socket_close

* Fix crash when using FDCAN3 RX IRQ on STM32G473 (and others)

* connectivity: drivers: Update Nuvoton M467 EMAC DMA_IE ctl

In IRQ Handler, to disable some interrupt type of DMA error.
It could avoid unexpected repeated interrupt.The masked bit of
DMA_IE could be recovered in next EMAC IRQ event.

Signed-off-by: cyliang tw <[email protected]>

* Add workaround for G474 hardfault

* update drivers STM32WL CUBE V1.3.0

* Changed static to weak

* Fix: Do not disable SPI for manual drive mode during transaction setup
It has been reported that disabling SPI module causes glitch for manual SS drive mode

Signed-off-by: Sadik.Ozer <[email protected]>

* make cellular event queue size configurable

update unit tests

---------

Signed-off-by: Sadik.Ozer <[email protected]>
Signed-off-by: cyliang tw <[email protected]>
Co-authored-by: Mingjie Shen <[email protected]>
Co-authored-by: Ahmet Polat <[email protected]>
Co-authored-by: Sadik.Ozer <[email protected]>
Co-authored-by: Chun-Chieh Li <[email protected]>
Co-authored-by: alrvid <[email protected]>
Co-authored-by: Jost, Chris <[email protected]>
Co-authored-by: Joseph Duchesne <[email protected]>
Co-authored-by: cyliang tw <[email protected]>
Co-authored-by: Maxim Markin <[email protected]>
Co-authored-by: Charles <[email protected]>
Co-authored-by: Lukas Karel <[email protected]>

connectivity/FEATURE_BLE/libraries/cordio_stack/ble-host/sources/stack/att/att_eatt.c

@@ -267,7 +267,7 @@ static uint8_t eattL2cCocAcceptCback(dmConnId_t connId, uint8_t numChans)
 {
   eattConnCb_t *pCcb = eattGetConnCb(connId);
 
-  if ((pCcb->state == EATT_CONN_STATE_INITIATING) || (pCcb->state == EATT_CONN_STATE_RECONFIG))
+  if (!pCcb || (pCcb->state == EATT_CONN_STATE_INITIATING) || (pCcb->state == EATT_CONN_STATE_RECONFIG))
   {
     // Reject all requests while busy connecting and configuring channels
     return 0;
@@ -348,6 +348,10 @@ static void eattReqNextChannels(dmConnId_t connId)
   eattConnCb_t  *pConnCb = eattGetConnCb(connId);
   uint8_t       numChans = pEattCfg->numChans - EattGetNumChannelsInUse(connId);
 
+  if (!pConnCb) {
+    return;
+  }
+
   numChans = (numChans > L2C_MAX_EN_CHAN) ? L2C_MAX_EN_CHAN : numChans;
 
   EATT_TRACE_INFO1("eattReqNextChannels: numChans: %d", numChans);
@@ -783,7 +787,7 @@ static void eattDmCback(dmEvt_t *pDmEvt)
  *  \param  connId  DM channel ID.
  *  \param  slot    EATT slot.
  *
- *  \return None
+ *  \return L2CAP channel identifier.
  */
 /*************************************************************************************************/
 uint16_t eattGetCid(dmConnId_t connId, uint8_t slot)
@@ -795,6 +799,7 @@ uint16_t eattGetCid(dmConnId_t connId, uint8_t slot)
   else
   {
     eattConnCb_t *pCcb = eattGetConnCb(connId);
+    WSF_ASSERT(pCcb);
     return pCcb->pChanCb[slot-1].cid;
   }
 }

connectivity/FEATURE_BLE/source/generic/SecurityDb.cpp

@@ -63,10 +63,18 @@ void SecurityDb::get_entry_local_keys(
 
         /* set flags connected */
         SecurityDistributionFlags_t* flags = get_distribution_flags(correct_handle);
+        if (!flags) {
+            cb(*db_handle, NULL);
+            return;
+        }
         flags->connected = true;
 
         /* update peer address */
         SecurityDistributionFlags_t* old_flags = get_distribution_flags(*db_handle);
+        if (!old_flags) {
+            cb(*db_handle, NULL);
+            return;
+        }
         flags->peer_address = old_flags->peer_address;
         flags->peer_address_is_public = old_flags->peer_address_is_public;
 

connectivity/FEATURE_BLE/source/generic/SecurityManagerImpl.cpp

@@ -1661,6 +1661,9 @@ void SecurityManager::on_connected(
     cb->db_entry = _db->open_entry(peer_address_type, peer_address);
 
     SecurityDistributionFlags_t* flags = _db->get_distribution_flags(cb->db_entry);
+    if (!flags) {
+        return;
+    }
 
     flags->peer_address = peer_address;
     flags->peer_address_is_public =

connectivity/cellular/mbed_lib.json

@@ -48,6 +48,10 @@
         "at-handler-buffer-size" : {
             "help": "Size of the AT handler buffer",
             "value": 32
+        },
+        "event-queue-size": {
+            "help": "The amount of events the default EventQueue should store",
+            "value": 10
         }
     }
 }

connectivity/cellular/source/framework/device/CellularDevice.cpp

@@ -39,7 +39,7 @@ CellularDevice::CellularDevice() :
 #if MBED_CONF_CELLULAR_USE_SMS
     _sms_ref_count(0),
 #endif //MBED_CONF_CELLULAR_USE_SMS
-    _info_ref_count(0), _queue(10 * EVENTS_EVENT_SIZE), _state_machine(0),
+    _info_ref_count(0), _queue(MBED_CONF_CELLULAR_EVENT_QUEUE_SIZE * EVENTS_EVENT_SIZE), _state_machine(0),
     _status_cb(), _nw(0)
 #ifdef MBED_CONF_RTOS_PRESENT
     , _queue_thread(osPriorityNormal, 2048, NULL, "cellular_queue")

connectivity/cellular/tests/UNITTESTS/framework/device/athandler/CMakeLists.txt

@@ -15,6 +15,7 @@ target_compile_definitions(${TEST_NAME}
         DEVICE_INTERRUPTIN=1
         MBED_CONF_PLATFORM_DEFAULT_SERIAL_BAUD_RATE=115200
         MBED_CONF_CELLULAR_AT_HANDLER_BUFFER_SIZE=32
+        MBED_CONF_CELLULAR_EVENT_QUEUE_SIZE=10
         MBED_CONF_RTOS_PRESENT=1
 )
 

connectivity/cellular/tests/UNITTESTS/framework/device/cellularcontext/CMakeLists.txt

@@ -21,6 +21,7 @@ target_compile_definitions(${TEST_NAME}
         DEVICE_INTERRUPTIN=1
         MBED_CONF_PLATFORM_DEFAULT_SERIAL_BAUD_RATE=115200
         MBED_CONF_CELLULAR_AT_HANDLER_BUFFER_SIZE=32
+        MBED_CONF_CELLULAR_EVENT_QUEUE_SIZE=10
 )
 
 target_sources(${TEST_NAME}

connectivity/cellular/tests/UNITTESTS/framework/device/cellulardevice/CMakeLists.txt

@@ -19,6 +19,7 @@ target_compile_definitions(${TEST_NAME}
         DEVICE_INTERRUPTIN=1
         MBED_CONF_PLATFORM_DEFAULT_SERIAL_BAUD_RATE=115200
         MBED_CONF_CELLULAR_AT_HANDLER_BUFFER_SIZE=32
+        MBED_CONF_CELLULAR_EVENT_QUEUE_SIZE=10
 )
 
 target_sources(${TEST_NAME}

connectivity/cellular/tests/UNITTESTS/framework/device/cellularstatemachine/CMakeLists.txt

@@ -20,6 +20,7 @@ target_compile_definitions(${TEST_NAME}
         DEVICE_INTERRUPTIN=1
         MBED_CONF_PLATFORM_DEFAULT_SERIAL_BAUD_RATE=115200
         MBED_CONF_CELLULAR_AT_HANDLER_BUFFER_SIZE=32
+        MBED_CONF_CELLULAR_EVENT_QUEUE_SIZE=10
 )
 
 target_sources(${TEST_NAME}

connectivity/drivers/emac/TARGET_NUVOTON_EMAC/TARGET_M460/m460_eth.c

@@ -325,6 +325,7 @@ void EMAC0_IRQHandler(void)
     uint32_t interrupt,dma_status_reg, mac_status_reg;
     int status;
     uint32_t dma_addr;
+    uint32_t dma_ie = DmaIntEnable;
 
     // Check GMAC interrupt
     mac_status_reg = synopGMACReadReg((u32 *)gmacdev->MacBase, GmacInterruptStatus);
@@ -401,6 +402,7 @@ void EMAC0_IRQHandler(void)
     if(interrupt & synopGMACDmaRxNormal) {
     	//NU_RAW_Debug(("rx\n"));
         NU_RAW_Debug(("%s:: Rx Normal \r\n", __FUNCTION__));
+	dma_ie &= ~DmaIntRxNormMask;  // disable RX interrupt
         // to handle received data
         if (nu_eth_txrx_cb != NULL) {
             nu_eth_txrx_cb('R', nu_userData);
@@ -409,16 +411,17 @@ void EMAC0_IRQHandler(void)
 
     if(interrupt & synopGMACDmaRxAbnormal) {
         mbed_error_printf("%s::Abnormal Rx Interrupt Seen \r\n",__FUNCTION__);
-    	gmacdev->synopGMACNetStats.rx_over_errors++;
-        if(gmacdev->GMAC_Power_down == 0) {	// If Mac is not in powerdown
-            synopGMAC_resume_dma_rx(gmacdev);//To handle GBPS with 12 descriptors
+        if(gmacdev->GMAC_Power_down == 0) {    // If Mac is not in powerdown
+            gmacdev->synopGMACNetStats.rx_over_errors++;
+            dma_ie &= ~DmaIntRxAbnMask;
+            synopGMAC_resume_dma_rx(gmacdev);  //To handle GBPS with 12 descriptors
         }
     }
 
     if(interrupt & synopGMACDmaRxStopped) {
         mbed_error_printf("%s::Receiver stopped seeing Rx interrupts \r\n",__FUNCTION__); //Receiver gone in to stopped state
         if(gmacdev->GMAC_Power_down == 0) {	// If Mac is not in powerdown
-        	gmacdev->synopGMACNetStats.rx_over_errors++;
+            gmacdev->synopGMACNetStats.rx_over_errors++;
             synopGMAC_enable_dma_rx(gmacdev);
         }
     }
@@ -450,13 +453,13 @@ void EMAC0_IRQHandler(void)
             synopGMAC_take_desc_ownership_tx(gmacdev);
 
             synopGMAC_enable_dma_tx(gmacdev);
-            mbed_error_printf("%s::Transmission Resumed\n",__FUNCTION__);
+            mbed_error_printf("%s::Transmission Resumed\n", __FUNCTION__);
         }
     }
 
     /* Enable the interrupt before returning from ISR*/
 //    if( !(interrupt & synopGMACDmaRxNormal)) {  /* RxNormal will enable INT in numaker_eth_trigger_rx */
-        synopGMAC_enable_interrupt(gmacdev,DmaIntEnable);
+        synopGMAC_enable_interrupt(gmacdev, dma_ie);
 //    }
     return;
 }
@@ -515,7 +518,10 @@ int numaker_eth_get_rx_buf(uint16_t *len, uint8_t **buf)
 //    synopGMAC_disable_dma_rx(gmacdev);    // it will encounter DMA interrupt status as "Receiver stopped seeing Rx interrupts"
     *len = synop_handle_received_data(NU_M460_INTF, buf);
     dump_desc(gmacdev->RxBusyDesc);
-    if( *len <= 0 ) return -1; /* No available RX frame */
+    if( *len <= 0 ) {
+        synopGMAC_enable_interrupt(gmacdev, DmaIntEnable);
+        return -1; /* No available RX frame */
+    }
 
     // length of payload should be <= 1514
     if (*len > (NU_ETH_MAX_FLEN - 4)) {

connectivity/lwipstack/source/LWIPStack.cpp

@@ -287,8 +287,9 @@ nsapi_error_t LWIP::socket_close(nsapi_socket_t handle)
     /* Check if TCP FSM is in ESTABLISHED state.
      * Then give extra time for connection close handshaking  until TIME_WAIT state.
      * The purpose is to prevent eth/wifi driver stop and  FIN ACK corrupt.
-     * This may happend if network interface disconnect follows immediately after socket_close.*/
-    if (NETCONNTYPE_GROUP(s->conn->type) == NETCONN_TCP && s->conn->pcb.tcp->state == ESTABLISHED) {
+     * This may happend if network interface disconnect follows immediately after socket_close.
+     * In case of a TCP RESET flag, the pcb structure is already deleted, therefore check for nullpointer.*/
+    if (NETCONNTYPE_GROUP(s->conn->type) == NETCONN_TCP && (nullptr == s->conn->pcb.tcp || s->conn->pcb.tcp->state == ESTABLISHED)) {
         _event_flag.clear(TCP_CLOSED_FLAG);
         netconn_shutdown(s->conn, false, true);
         _event_flag.wait_any(TCP_CLOSED_FLAG, TCP_CLOSE_TIMEOUT);

connectivity/nanostack/coap-service/source/coap_connection_handler.c

@@ -480,7 +480,7 @@ static int secure_session_recvfrom(int8_t socket_id, unsigned char *buf, size_t
 {
     (void)len;
     internal_socket_t *sock = int_socket_find_by_socket_id(socket_id);
-    if (sock->data && sock->data_len > 0) {
+    if (sock && sock->data && sock->data_len > 0) {
         memcpy(buf, sock->data, sock->data_len);
         int l = sock->data_len;
         ns_dyn_mem_free(sock->data);

connectivity/nanostack/mbed-mesh-api/source/thread_tasklet.c

@@ -238,6 +238,9 @@ void thread_tasklet_poll_network_status(void *param)
         } else {
             memcpy(thread_tasklet_data_ptr->ip, temp_ipv6, 16);
             link_configuration_s *link_cfg = thread_management_configuration_get(thread_tasklet_data_ptr->nwk_if_id);
+            if (!link_cfg) {
+                return;
+            }
             if (memcmp(thread_tasklet_data_ptr->ip, link_cfg->mesh_local_ula_prefix, 8) == 0) {
                 thread_tasklet_network_state_changed(MESH_CONNECTED_LOCAL);
             } else {

connectivity/nanostack/sal-stack-nanostack/source/6LoWPAN/Thread/thread_bbr_api.c

@@ -682,6 +682,9 @@ static void thread_bbr_status_check(thread_bbr_t *this, uint32_t seconds)
     }
     // Check if network data as border router is possible or modified
     protocol_interface_info_entry_t *cur = protocol_stack_interface_info_get_by_id(this->interface_id);
+    if (!cur) {
+        return;
+    }
     this->br_hosted = thread_bbr_i_host_prefix(cur, bbr_prefix_ptr, &this->br_count, &br_lowest_host);
 
     if (!this->br_info_published && bbr_prefix_ptr && this->br_count == 0) {

connectivity/nanostack/sal-stack-nanostack/source/6LoWPAN/Thread/thread_bbr_commercial.c

@@ -545,6 +545,9 @@ static int thread_pbbr_bb_qry_cb(int8_t service_id, uint8_t source_address[16],
     // Test code for b/ba response override
     if (ba_response_status_count) {
         device_configuration_s *device_config = thread_joiner_application_get_device_config(this->interface_id);
+        if (!device_config) {
+            return -1;
+        }
         ml_eid_ptr = device_config->eui64;
         last_transaction_time = protocol_core_monotonic_time;
         ba_response_status_count--;
@@ -617,7 +620,7 @@ static int thread_pbbr_dua_duplicate_address_detection(int8_t service_id, uint8_
     protocol_interface_info_entry_t *cur = protocol_stack_interface_info_get_by_id(this->interface_id);
     duplicate_dua_tr_t *tr_ptr = thread_border_router_dup_tr_find(this->interface_id, addr_data_ptr);
 
-    if (!tr_ptr) {
+    if (!cur || !tr_ptr) {
         return -1;
     }
 

connectivity/nanostack/sal-stack-nanostack/source/6LoWPAN/Thread/thread_ccm.c

@@ -756,6 +756,11 @@ static int thread_ccm_reenroll_registrar_addr_resp_cb(int8_t service_id, uint8_t
         return -1;
     }
 
+    if (!cur) {
+        tr_debug("Protocol stack interface info get failed");
+        return -1;
+    }
+
     if (!thread_meshcop_tlv_find(response_ptr->payload_ptr, response_ptr->payload_len, MESHCOP_TLV_REGISTRAR_IPV6_ADDRESS, &addr_ptr)) {
         tr_debug("Registrar addr get failed");
         return -1;

connectivity/nanostack/sal-stack-nanostack/source/6LoWPAN/Thread/thread_common.c

@@ -751,8 +751,10 @@ void thread_child_id_request_info_init(thread_pending_child_id_req_t *child_info
 thread_pending_child_id_req_t *thread_child_id_request_allocate(void)
 {
     thread_pending_child_id_req_t *req = ns_dyn_mem_alloc(sizeof(thread_pending_child_id_req_t));
-    memset(req->eiid, 0, 8);
-    thread_child_id_request_info_init(req);
+    if (req) {
+        memset(req->eiid, 0, 8);
+        thread_child_id_request_info_init(req);
+    }
     return req;
 }
 

connectivity/nanostack/sal-stack-nanostack/source/6LoWPAN/Thread/thread_joiner_application.c

@@ -719,8 +719,9 @@ static void configuration_set_copy_mandatory(configuration_set_t *destination_pt
 static void configuration_set_generate(int8_t interface_id, configuration_set_t *destination_ptr, link_configuration_s *configuration_ptr)
 {
     uint8_t *response_ptr;
+    protocol_interface_info_entry_t *cur = protocol_stack_interface_info_get_by_id(interface_id);
 
-    if (!destination_ptr || !configuration_ptr) {
+    if (!destination_ptr || !configuration_ptr || !cur) {
         return;
     }
     response_ptr = destination_ptr->data;
@@ -739,7 +740,6 @@ static void configuration_set_generate(int8_t interface_id, configuration_set_t
     response_ptr = thread_tmfcop_tlv_data_write(response_ptr, MESHCOP_TLV_PSKC, 16, configuration_ptr->PSKc);
     response_ptr = thread_tmfcop_tlv_data_write(response_ptr, MESHCOP_TLV_NETWORK_NAME, stringlen((char *)&configuration_ptr->name, 16), configuration_ptr->name);
     *response_ptr++ = MESHCOP_TLV_SECURITY_POLICY; // type
-    protocol_interface_info_entry_t *cur = protocol_stack_interface_info_get_by_id(interface_id);
     if (thread_info(cur)->version >= THREAD_VERSION_1_2) {
         *response_ptr++ = 4; // length
         response_ptr = common_write_16_bit(configuration_ptr->key_rotation, response_ptr);

connectivity/nanostack/sal-stack-nanostack/source/6LoWPAN/ws/ws_pae_auth.c

@@ -1057,6 +1057,9 @@ static int8_t ws_pae_auth_timer_if_stop(kmp_service_t *service, kmp_api_t *kmp)
     (void) service;
 
     supp_entry_t *supp_entry = kmp_api_data_get(kmp);
+    if (!supp_entry) {
+        return -1;
+    }
 
     kmp_entry_t *entry = ws_pae_lib_kmp_list_entry_get(&supp_entry->kmp_list, kmp);
     if (!entry) {

platform/source/mbed_retarget.cpp

@@ -678,6 +678,10 @@ extern "C" int PREFIX(_close)(FILEHANDLE fh)
 #if !MBED_CONF_PLATFORM_STDIO_MINIMAL_CONSOLE_ONLY
 extern "C" int close(int fildes)
 {
+    if (fildes < 0) {
+        errno = EBADF;
+        return -1;
+    }
     FileHandle *fhc = mbed_file_handle(fildes);
     filehandles[fildes] = NULL;
     if (fhc == NULL) {