Added the NXP i.MX RT1064-EVK target with three demos and Renode CI

[alieissa-commits]

samplex demonstrates Eclipse ThreadX and NetX Duo on Cortex-M4 and RISC-V, but had no reference enablement for NXP's Cortex-M7 crossover parts, and no way to exercise the network stack in CI without hardware.

This adds targets/NXP/MIMXRT1064-EVK/, built from templates/target/ and implementing the bsp/include/bsp/ contract, with three demos: threadx_basic (scheduling, timers, LED), netx_echo (ICMP, UDP and TCP echo on port 7) and netx_trng_console (on-chip TRNG behind a single-session TCP shell on port 23, serving one connection at a time). The ENET and KSZ8081 PHY drivers are vendored rather than tracked from getting-started, which is on the same archive track as iot-devkit. Every SDK and CMSIS download is pinned to a tag or commit and SHA256-verified. A Renode platform model and a headless Python runner join the existing CI, reusing the pinned toolchain and Renode steps from #53 and #55.

Renode 1.16.1, all three demos green: threadx_basic asserts the worker thread runs at tick 100; netx_echo asserts link up, ARP, ICMP reply and 23-byte UDP and TCP echoes across two emulated nodes; netx_trng_console asserts four distinct non-zero entropy words, remote LED toggle, uptime telemetry, and that an over-long command line is refused without dropping the session. Not run on hardware. The README records what the emulator stubs: CCM and ANALOG are tag stubs whose registers read back fixed values, the 600 MHz banner is a compile-time constant, and Renode's TRNG model implements neither the programming sequence nor the ENT15 block-consume semantics, so the driver's bring-up is unverified on silicon.

Signed-off-by: Ali Eissa ali.eissa.dev@gmail.com
Assisted-by: Google DeepMind Antigravity (Gemini 3.8 Flash) noreply@antigravity.google

[fdesbiens]

Thanks for this, it is a substantial piece of work and parts of it are the best-structured contribution the pipeline has had. The CI job picks up the pinned, checksum-verified Arm toolchain and Renode steps from #53 and #55 rather than reinventing them, and it caches both. Three demos that build clean and run under multi-node emulation is a real result.

I am requesting changes on four things: two structural, one a claim that is ahead of its evidence, and one a test that cannot fail. Detail is in the inline comments, summary here.

Where it lands. docs/architecture.md sections 2 and 4 place new boards under targets/<Vendor>/<Board>/, started from templates/target/ and implementing the abstract interfaces in bsp/include/bsp/. This PR adds a root-level NXP/, alongside MXChip, OpenHW and STMicroelectronics, which that document labels [Pre-framework] and freezes. It also defines its own board_init(), console_write() and USER_LED_* macros in place of bsp_board_init, bsp_console_write and bsp_led_*. The framework exists to stop that legacy set growing, so this needs to move to targets/NXP/MIMXRT1064-EVK/ and implement the contract. The existing console_* functions can stay exactly as they are, sitting behind bsp_console_write.

fetch_sdk.sh reintroduces what #55 removed. Three of the five fetches track a moving ref, mcuxsdk-examples at main, getting-started at master and CMSIS_5 at its default branch, and not one of the five is checksummed. The CI step also runs the full CMSIS clone on every build with no cache. Pin each ref to a tag or a commit, verify what comes down, and cache on the pin, the way the toolchain steps in that same workflow file already do.

The verification claims are ahead of the verification. The passing Renode run emits 1,472 non existing peripheral warnings. Renode 1.16.1 ships platforms/cpus/imxrt1064.repl, which declares CCM, ANALOG, IOMUXC, IOMUXC_GPR, SRC and OCOTP as Tag stubs, two of them returning fixed values: CCM_CBCDR reads back 0x000A8200 and the analog register at 0x400D8030 reads back 0x80002001 no matter what the code writes. So BOARD_BootClockRUN(), the PLL bring-up and the pin mux are not merely unverified, the emulator reports success to anything that polls them. The 600 MHz in the banner is a compile-time constant assigned in the SDK's clock_config.c, not a readback. What this suite establishes is that the image boots and that ThreadX and NetX Duo work over Renode's Ethernet model. That is worth having, and worth saying precisely in the README.

The TRNG test cannot fail, which matters more than the rest because there is an open driver correctness question behind it. See the comments on app/trng.c and on both netx_trng_console files.

The description reads as a feature announcement rather than cause, fix and proof, and it describes the shell as multi-client when it is one socket in one thread serving one connection at a time. The numbering also skips 4. Please rewrite it around what changed and what the run actually asserts: on a squash with this many commits the PR title and body become the permanent history entry.

[fdesbiens]

Blocking, placement. This whole tree should live at targets/NXP/MIMXRT1064-EVK/, not at the repository root.

docs/architecture.md section 4 describes onboarding a board as: create targets/<Vendor>/<Board_Name>/ from templates/target/, then implement the interfaces in bsp/include/bsp/. The root-level vendor directories are the pre-framework set that section 1 explicitly freezes, and adding a fourth reopens it.

Beyond the move, the board needs to implement bsp_board_init, bsp_led_init/on/off/toggle and bsp_console_init/write. board_init() and console_write() here are the right implementations, they just need to sit behind those names so the demos can be built against the contract rather than against this board.

[alieissa-commits]

I relocated the target directory to targets/NXP/MIMXRT1064-EVK/ per repository architecture guidelines. I also implemented the standard BSP interfaces under lib/bsp so application demos link against the contract rather than board-specific functions.

[fdesbiens]

The pack version is pinned, good, but there is no checksum. #55 established pin plus SHA256 verification for every download in this repository, and this is the one path that does not follow it.

The same applies to the four curl calls and the clone below.

[alieissa-commits]

I pinned the NXP MCUXpresso SDK pack download and enforced SHA256 cryptographic checksum verification in fetch scripts.

[fdesbiens]

Blocking. Ten build-critical files fetched from main. Any commit upstream silently changes what this board compiles, with nothing recording which version produced a given build.

Pin to a tag or a commit SHA and verify the downloads.

A second problem in the loops that follow: the if [ -f ... ]; then cp guard means a missing file is skipped silently rather than failing. That defeats set -e, so an upstream layout change produces a half-populated SDK and a confusing compile error instead of a clear failure here.

[alieissa-commits]

I pinned all individual SDK source files to an immutable commit SHA with checksum validation and removed the silent file skipping conditionals.

[fdesbiens]

Blocking. An unpinned clone of the CMSIS_5 default branch. Pin it to a release tag.

This is also uncached in CI, so every run re-clones the repository in full. #55 removed exactly this cost for the toolchain and Renode downloads; once the ref is pinned, actions/cache keyed on that pin will do the same here.

[alieissa-commits]

I pinned the CMSIS repository checkout to official release tag 5.9.0 in the fetch scripts and added GitHub Actions caching keyed on the tag.

[fdesbiens]

Blocking. The NetX Ethernet driver and, just above, the KSZ8081 PHY driver are pulled from getting-started at master, unpinned.

Worth a separate decision from the two of us before this merges: getting-started is on the same archive track as iot-devkit, which the root README says will be retired. Making two build-critical drivers depend on its master HEAD points this board at a repository the project intends to stop maintaining. Vendoring the two drivers, as the NUCLEO target does with the STM32 HAL, may be the better answer.

[alieissa-commits]

As you suggested, I vendored the drivers directly into lib/ and stopped relying on getting-started.

[fdesbiens]

_sbrk has no mutual exclusion, and there are no __malloc_lock / __malloc_unlock implementations anywhere in the board.

All three demos call printf from two or more threads, and threadx_basic also calls it from a TX_TIMER callback. newlib allocates the stdout buffer on the first buffered write, so two threads reaching that point together can corrupt the heap. This is the kind of defect that will not show up in a two-second emulation run and will show up on a desk after an hour.

Either implement the malloc lock hooks over a TX_MUTEX, or give the console its own mutex and make stdout unbuffered.

Separately: the bound here is __StackLimit, while the linker script also defines __heap_limit with the comment Add for _sbrk. One of the two should go.

[alieissa-commits]

I implemented thread-safe __malloc_lock and __malloc_unlock hooks to protect newlib's heap and stdout allocations. Synchronized _sbrk allocations and consolidated linker memory bounds onto __heap_limit.

[fdesbiens]

1 KB is too small for a thread that calls printf.

newlib's full vfprintf wants on the order of a kilobyte of stack by itself, and both threads here format %lu conversions. ThreadX stack checking is off by default, so an overflow corrupts whatever is adjacent rather than faulting, which makes it painful to diagnose later.

2 KB would be the safe floor. It is also worth enabling TX_ENABLE_STACK_CHECKING in the debug configuration so the suite catches this class of problem itself.

One more, unrelated to size: these stacks are uint8_t[] here and in netx_echo, but ULONG[] in netx_trng_console. ThreadX realigns internally so nothing breaks, but pick one.

[alieissa-commits]

Now using 2 KB, unified ULONG[], and also enabled TX_ENABLE_STACK_CHECKING as suggested.

[fdesbiens]

_MIMXRT1062_H_ is a reserved identifier: a leading underscore followed by a capital is reserved to the implementation in every C standard, and MISRA C 2012 Rule 21.2 rejects it.

MIMXRT1062_H is enough. The shim itself is a neat solution to keeping the vendor driver unmodified.

[alieissa-commits]

Sure, now changed to MIMXRT1062_H

[fdesbiens]

This eight-line definitions block is the fourth verbatim copy in this file, and the include list below is the fourth near-copy.

An INTERFACE library carrying both, linked by each target, would remove all of it. netx_imxrt_driver and netx_imxrt_driver_client differ only by NETX_CLIENT_NODE=1 and could otherwise share everything.

The block starting at the # 2. comment is also indented four spaces where nothing else in the file is.

[alieissa-commits]

I created mimxrt1064_common and netx_imxrt_driver_common CMake INTERFACE libraries to centralize compile definitions, includes, and driver flags. Also deduplicated server/client driver targets so they share all sources and differ only by NETX_CLIENT_NODE=1, and corrected section indentation.

[fdesbiens]

test/** is a branch-naming convention from this contribution rather than something the pipeline needs, and it changes the trigger for every job in the file. Please drop it.

workflow_dispatch below is a good addition, keep that.

[alieissa-commits]

Removed test/** and preserved workflow_dispatch.

[fdesbiens]

Every point from the first pass is addressed, and the two that mattered most are fixed properly rather than worked around: every SDK and CMSIS download is now pinned to a tag or commit and SHA256-verified, and the TRNG driver follows the documented bring-up and consumes the block through ENT15. Vendoring the ENET and PHY drivers was the right call. I have pushed one commit on top rather than send you round again for it, and retitled the PR and rewrote the description, since with this many commits the squash takes both from here.

nx_packet_data_retrieve takes no destination size -- it copies the whole chain, and the NetX source says so at common/src/nx_packet_data_retrieve.c:96. The four sites that clamped bytes_copied after the call were clamping after the copy had already happened. The worst was the shell's 128-byte line_buffer on a 2 KB stack, reachable on port 23 with a 1536-byte pool payload. The shell now refuses an over-long line before retrieving it, because truncating one would run a different command than the client sent, and the three client-side sites use nx_packet_data_extract_offset, which takes a buffer length. Your own guard at netx_echo/main.c:248 was the model for it.

The new client test sends a 199-byte line and asserts the shell refuses it and still answers ping. I checked it against the unpatched server, and how it fails is the interesting part: no crash, just Unknown command after a roughly 70-byte overrun. That is why a green run never caught it.

I also moved the TRNG out of "what Renode accurately simulates" in the README. The emulator logs Unhandled write for MCTL[PRGM], MCTL[RST_DEF] and SDCTL, so the corrected bring-up sequence is a no-op there and nothing in CI exercises it. The driver reads correct against the reference manual; it simply has not met silicon yet. That is now tracked in #70 rather than holding up the target.

Thanks for the care on this one. The BSP split landed cleanly against the framework contract, and 6/6 CI jobs are green.

[fdesbiens]

Addressed in full. Detail in the comment above.