Research window: 2026-10-20 08:00 ~ 2026-10-21 08:00 (Beijing time, 24 hours)

Sources: RT-Thread official news API, community forum article API, GitHub (org: RT-Thread main repo commits / PR / Issue / Releases / tags, env tool repo, packages index, rtthread-skills, smart-build, rtthread-specification, RT-Thread Studio SDK index, topic:rt-thread ecosystem search), Google News aggregation (multiple Chinese and English queries, via proxy), HN Algolia, industry media and vendor channel verification (see appendix source list for details)

In This Issue

  • I. Kernel and Version Updates
    • RISC-V ticket spinlock switched to atomic add: livelock path under multi-core contention removed (10-20)
    • Same-priority thread ready-order fix proposal: IPC wakeups and new starts changed to append to tail (10-21)
    • Serial V1 adds receive timeout event: timeout merged into RX_IND callback (10-21)
  • II. Security and Stability Follow-up
    • cromfs directory name length unconstrained: ls/getdents out-of-bounds and kernel PC hijack (10-20)
    • OFW deep pre-check changed to debug-gated: author adds compile switch after maintainer suggestion (10-20)
    • tmpfs truncation defect reproduced on RT-Smart aarch64 and claimed (10-20)
    • Other in-review progress: interrupt acknowledge fix awaiting retest, IAR implicit declaration discussion continues (10-20)
  • III. Official and Community Activities
    • Official news API still has no new items, v5.4.0 still has no tag or release artifacts (10-21)
    • Community forum adds 2 new embedded competition entries (10-20)
    • ReCore 1.8.4 release livestream scheduled for tonight 20:00 (10-21)
  • IV. Ecosystem and Vendor Adaptation
    • K1 BSP support matrix added: default 8 cores, SPI and QSPI status promoted (10-20)
    • scons –attach crashes on Chinese Windows: fix proposal to replace emoji with ASCII (10-20)
    • Allwinner D1s adds QEMU run script, maintainer suggests changing to target-qemu directory (10-20)
    • Other repos in the org silent this period, no new commits in packages and Studio index (10-21)
  • V. Industry Applications
    • Dual-board collaborative smart terminal: M7 display side runs RT-Thread and LVGL, C3 acts as networking bridge (10-20)
    • Edgi-Talk human detection alarm system: M55 plus NPU, detection and alarm closed locally (10-20)
    • Farmland pest voiceprint recognition: AIoT competition award-winning entry featured on Electronic Engineering Album (10-20)
  • VI. Summary and Trend Observations
    • Trends this period
    • Limitations and deduplication notes

I. Kernel and Version Updates

1.1 RISC-V ticket spinlock switched to atomic add: livelock path under multi-core contention removed (10-20)

Date: 2026-10-20 16:04 (created)　Source: PR #11904, cpuport.c

Maintainer GuEe-GUI submitted a rework of the ticket spinlock in the RISC-V common layer (6 files, +33/-37, two commits). The original implementation performed both ticket acquisition and release on the same 32-bit word via a load-reserved/conditional-store loop: the upper 16 bits held the next ticket to issue and the lower 16 bits the currently held ticket; once the unlocking side retried its conditional store on the same word, the acquirer’s reservation was repeatedly invalidated, allowing a livelock under heavy multi-core contention. The new implementation replaces ticket acquisition with a single atomic-add instruction, incrementing the upper half-word to complete acquisition, which cannot contend for the same reservation as the unlock; the unlock is changed so that only the holder writes the lower half-word, completing in a single half-word store with no read-modify-write of the whole word, so it cannot overwrite a new ticket even while acquisition proceeds concurrently. An additional memory barrier after acquiring the lock ensures critical-section accesses are ordered after the observed release. The proposal is marked as a mature version and assigned to the RISC-V kernel review.

1.2 Proposal to fix ready ordering of same-priority threads: IPC wakeups and new starts appended to tail (10-21)

Date: 2026-10-21 00:06 (created)　Source: PR #11907, Issue #8459

Community member Yunlk opened a fix for the ready-queue insertion order (4 files, +255/-22, including a new utest). The original logic inserted any thread without a “yielded” flag at the head of the queue, and that flag is cleared when a thread is switched out, so threads resumed from IPC suspend queues such as semaphores, as well as newly started threads, were all inserted at the head, making the actual execution order of same-priority threads the reverse of their ready order. The proposal saves the original state before overwriting it, retaining head insertion only for the single case of “still running and preempted with time slice not exhausted,” and appending everything else to the tail; the single-core and multi-core insertion branches are modified consistently, and a new test case covers both the semaphore-wakeup and start paths. The author measured on qemu-vexpress-a9: before the fix, semaphore wakeup order was B then A and start order was D then C; after the fix, they are A then B and C then D respectively. The proposal is still under review, with two workflows awaiting maintainer approval.

1.3 Serial V1 adds receive-timeout event: timeout folded into RX_IND callback (10-21)

Date: 2026-10-21 00:15 (created)　Source: PR #11909, Issue #8143

The receive-timeout event (code 0x05) has long been defined in the header, but the V1 framework’s interrupt handling covers only the first four events and has no fallback branch, so when a driver emits this event the framework does nothing and the notification is silently dropped. Two drivers in the repository depend on it to delimit data frames: WCH CH579M and Synwit SWM341 both use the chip’s receive-timeout interrupt to determine that “a frame has been fully received,” and both are on the V1 framework, so frame boundaries are effectively lost and can only fall back to reporting by hardware watermark. The proposal folds the event into the receive-indication callback: drain the hardware FIFO first, then invoke the upper layer with the length already buffered in the software FIFO. The change is a single branch (5 lines including comments) and leaves V2 untouched, since the V2 header does not define this macro at all. The author performed compile-level verification only, lacking hardware with an idle-timeout interrupt, and additionally suggested adding a test case on a pseudo serial device for CI.

II. Security and Stability Follow-up

2.1 cromfs directory name length unconstrained: ls/getdents out-of-bounds and kernel PC hijack (10-20)

Date: 2026-10-20 19:29 (creation time)　Source: Issue #11905

Contributor XueDugu opened a new cromfs defect ticket. When reading directory entries, no upper-bound check is performed on the directory name length; an overlong name copies its content into a fixed-size directory entry buffer, overrunning its tail. The overflow is large enough to overwrite adjacent data, and can be triggered by ls or reading the directory. The author states the kernel program counter can be redirected to a controllable location. The defect was introduced by a cromfs sync commit on 2022-12-14; v4.1.1 is not affected, while everything from v5.0.0 through v5.3.0 and current mainline is affected. The two DFS implementations share the same origin, and both v1 and v2 each contain an unconstrained copy. The author reproduced it on QEMU vexpress-a9; the ticket is currently unclaimed.

2.2 OFW deep pre-check moved behind a debug gate: author adds compile switch after maintainer suggestion (10-20)

Date: 2026-10-20 09:11 ~ 16:03 (comment time)　Source: PR #11901, Issue #11879

The device tree depth pre-check proposal covered in the previous issue went through a round of review in this window. Review first questioned the cost of the pre-traversal and suggested switching to a runtime check that exits and frees memory when the limit is exceeded; the author responded that freeing an incomplete tree requires recursive traversal along pointers, with scattered allocation points prone to missed or double frees, whereas the check function is read-only, does not allocate, and does not parse properties, making its overhead small relative to expansion itself. The maintainer then gave direction: OFW is designed to trust firmware, and 64 levels far exceeds the actual needs of most SoCs, so the check should be enabled only in debug mode. The author accepted, wrapped the depth check in a debug switch, and retested on qemu-virt64-aarch64 with debug mode enabled and a 65-level device tree. The changes have been pushed; the proposal is still under review.

2.3 tmpfs truncation defect reproduced on RT-Smart aarch64 and claimed (10-20)

Date: 2026-10-20 22:53 (reproduction comment)　Source: Issue #11902

The tmpfs truncation defect covered in the previous issue gained device-side evidence in this window. A community member reproduced it on the RT-Smart qemu-virt64-aarch64 board: when a file is truncated to 0 bytes, the buffer is freed but the function still returns success, and subsequent application reads and writes land on freed kernel heap, potentially causing information disclosure and double free. The reproduction environment was QEMU 11.0.0 virt machine with GICv3, cross toolchain 15.2.1, and DFS_V2 configuration. The ticket was claimed on 10-20 by another community member; a fix patch has not yet been submitted.

2.4 Other in-review progress: interrupt acknowledge fix awaiting retest, IAR implicit declaration discussion continues (10-20)

Date: 2026-10-20 (comment time)　Source: PR #11860, PR #11864, Issue #9941, PR #10096

In-window progress on four existing items. For the proposal to remove the redundant pending clear from the aarch64 interrupt controller acknowledge (#11860), the author says another version of the trap handling change will be tested in the next couple of days, and it will not be merged for now. The proposal addressing float printing corruption caused by implicit declaration of the log function under IAR 8.40 (#11864) adds an assembly-level explanation: without a prototype, the compiler infers variadic arguments by fixed parameter passing, so %f picks up the wrong position; review still requires board-level configuration and before/after output records under the same configuration. Two other process verifications: #9941 confirms scons --attach works on mainline, and suggests closing the feature request; #10096 confirms the on-demand build option still has not entered mainline, and the proposal branch is severely outdated, so rebasing first is suggested.

III. Official and Community Activities

3.1 Still no new items on the official news API; v5.4.0 still has no tag or release artifacts (10-21)

Date: 2026-10-21 (verification time)　Source: RT-Thread official news API, releases

The organization category of the official news API returns 25 archived posts, the latest still dated 2026-06-17, with no additions in this window; updates have been stalled for over four months. The official website news list page is dynamically rendered on the frontend, so scraping only yields an empty loading shell; news data is taken from the API. No change on the version side: the latest tag and release artifacts are still v5.3.0 from 09-10, and v5.4.0 exists only as a version macro, with no release notes or binaries in sight. Product and event information continues to be first released via the WeChat official account, community forum, and GitHub.

3.2 Community forum adds 2 embedded competition entries (10-20)

Date: 2026-10-20 08:31 (publish time)　Source: Community forum article API

Among the top 20 items of the community article API, 2 were added in this window, both published at 10-20 08:31 and both 2026 embedded competition entries: one is a dual-board collaborative smart terminal based on the Novosense NS800RT7P65 and Espressif ESP32-C3, and the other is an edge AI human detection alarm system based on the Edgi-Talk development board; technical highlights are covered in 5.1 and 5.2 respectively. The remaining items are editorial updates of earlier works or were published earlier, and are not expanded again in this issue.

3.3 Ruiqing 1.8.4 release livestream scheduled for tonight at 20:00 (10-21)

Date: 2026-10-21 20:00 (livestream time)　Source: EET-China: ROS2 motion control solution based on RC-Pi-3506 and hub motors

A hands-on article on the Ruiqing platform from an industry media outlet ends with a livestream schedule: the Ruiqing 1.8.4 release livestream is set for October 21 at 20:00, and will demonstrate the EG1200 industrial gateway’s virtual network port and network file system, rotary encoder peripheral, MIPI RGB666 adaptation, MIPI power-on timing control, GPIO pull-up/pull-down configuration, and AMP debug commands, all said to be verified on RC-Pi-3506 hardware. The 1.8.4 feature list was reported previously; this item is only a schedule reminder.

IV. Ecosystem and Vendor Adaptation

4.1 K1 BSP Support Matrix Added to the Table: Default 8 Cores, SPI and QSPI Status Promoted (10-20)

Date: 2026-10-20 16:04 (creation time)　Source: PR #11904, K1 BSP README

In the same batch as the spinlock rework, the default core count for SpacemiT K1 was changed from 4 to 8, with the Chinese and English documentation updated in sync. The board support table at the repository root added a section for this vendor; the K1 row is marked as supported in every column: GPIO, UART, ADC, I2C, SPI, watchdog, timer, PWM, RTC, SDIO, PCI, DMA, Ethernet, audio, display, and crypto. SPI and QSPI were changed from “ported, under validation” to “supported,” and the previously open SPI NOR read-ID issue was closed accordingly. These two pending items were left over from when the first version of K1 was merged in the previous issue, and both were closed out in this window.

4.2 scons –attach Crashes on Chinese Windows: Fix Proposal to Replace Emoji with ASCII (10-20)

Date: 2026-10-20 23:42 (issue creation)　Source: Issue #11906, PR #11908

Running scons --attach on Chinese Windows (code page 936) throws an encoding exception outright and aborts the entire command: the prompt message uses two emoji, which GBK cannot encode. All three usages of this command go through the same function, meaning it is completely unusable in a Chinese environment; setting an environment variable to force UTF-8 works around it, but ordinary users would not know to do that. The issue was filed the same day, and a fix proposal was submitted the same day, replacing the 4 symbols with ASCII markers while retaining the original ANSI colors; the author states this is consistent with the colored-output conventions of other scripts in the repository. A separate comment notes that the proposal’s memory report check failure stems from the upstream third-party action itself being broken and is unrelated to this change.

4.3 Allwinner D1s Adds QEMU Run Script; Maintainer Suggests Switching to a target-qemu Directory (10-20)

Date: 2026-10-20 13:45 (creation time)　Source: PR #11903

Board support for Allwinner D1s previously required real hardware. The proposal adds a launch script that invokes a D1s emulated machine from a separate repository (single core, 64 MB RAM, two UARTs, interrupts and timers, two storage controllers), reusing this directory’s boot firmware and device tree, with the UART as console; under the default configuration it completes storage initialization and reaches the command line. The review did not directly accept the script form, but instead suggested creating a unified target-machine subdirectory under the board or chip vendor directory, containing the launch script and an AI-oriented build guide, so that it becomes a reproducible validation environment; the author has not yet replied.

4.4 Other Repositories in the Organization Quiet This Issue; No New Commits to Packages or Studio Index (10-21)

Date: 2026-10-21 (verification time)　Source: RT-Thread organization repositories, packages, Studio sdk-index

Organization-level check by push time: the main repository’s latest push was 10-19, rtthread-skills and smart-build stopped at 10-18, env and the specification repository stopped at 10-17, the package index’s latest commit was 10-14 (an index update for a chip vendor SDK), and Studio’s SDK index stopped at 10-10. The toolchain, packages, and Studio lines all had no new content this issue, consistent with the main repository’s pace of no merges for two consecutive days.

V. Industry Applications

5.1 Dual-board Collaborative Smart Terminal: M7 display side runs RT-Thread and LVGL, C3 acts as networking bridge (10-20)

Date: 2026-10-20 08:31 (publish time)　Source: Community article: Dual-board collaborative smart terminal based on NS800RT7P65 and ESP32-C3

A 2026 embedded competition entry that divides work between two microcontrollers. NOVOSENSE NS800RT7P65 (Cortex-M7, with hardware floating point) runs RT-Thread 5.3.0 and LVGL 9.1.0, implementing a 3×3 desktop and 14 applications; the screen is a 240×320 driver-chip solution, and the author measured an SPI ceiling of 50 MHz, having once tried 70 MHz and gotten a garbled full screen; 16 MB external NOR mounts a small file system, so backlight, color adjustment, game high scores and alarms survive power loss; the knob connects to a quadrature decoder, and buttons are read directly with software debouncing. Espressif ESP32-C3 serves as the networking side, handling wireless connectivity, time synchronization, reporting and local web-based upgrades; the web page can change configuration and upload firmware. The two boards communicate over only one serial port, and based on this the author calculated that serial bandwidth is insufficient to transmit full-screen pixels, so no video playback was implemented.

5.2 Edgi-Talk Human Detection Alarm System: M55 plus NPU, local closed loop for detection and alarm (10-20)

Date: 2026-10-20 08:31 (publish time)　Source: Community article: Edge AI human detection alarm system based on Edgi-Talk

Another competition entry uses Infineon PSoC E84 as the platform: the M55 core runs RT-Thread and handles video, scheduling and business logic, the M33 core manages secure boot, and the NPU performs fixed-point inference. The camera outputs YUYV format 424×240 via USB host, the screen displays 320×240, inference runs every 5 frames with 320×320 eight-bit fixed-point input, up to 8 candidate boxes, a confidence threshold of 0.45 and overlap suppression of 0.45; alarms are confirmed after 3 consecutive hits and cleared after 5 consecutive misses, avoiding single-frame false-detection jitter. Storage writes, network reporting and audio playback each have their own queue and do not occupy the video thread; network loss does not affect local detection and sound/light alarms; the system tick is 1000 Hz, and on exception it degrades to core preview.

Date: 2026-10-20 17:30 (publish time)　Source: EET-China: Offline insect recognition by sound, a practical guide to on-device voiceprint recognition based on Edge Impulse

An industry media outlet published an RT-Thread AIoT competition excellence award-winning work: using the Edgi-Talk onboard microphone to capture field insect sounds, four-class classification (cicada, cricket, noise, unknown) is performed on Edge Impulse, with features taken from mel filter bank energies, a 1-second window, 200 ms step, 16 kHz sampling, about 2 minutes 15 seconds of accumulated samples, split 82 to 18 into training and test, and after 100 training rounds a fixed-point model is exported for on-device inference. If judged a pest, an external sprayer is triggered; if recognized as noise or unknown, no action is taken, all offline with no cloud dependency. The author has released the documentation and code.

VI. Summary and Trend Observations

  • Two low-level kernel paths fixed simultaneously: The scheduler restores first-come-first-served ordering for same-priority ready tasks, and the RISC-V ticket lock changes ticket acquisition to a single-instruction atomic add and release to a halfword store. The former affects the predictability of execution order, while the latter affects liveness under multi-core contention; both are issues long masked by default behavior.
  • Peripheral event semantics begin to be filled in: Serial V1 finally wires “receive timeout equals end of frame” into the framework. Those affected are exactly two domestic board support packages that rely on idle interrupts to delimit frames, showing that historical gaps at the framework layer are still being discovered one by one.
  • Defect discovery continues to be driven by external researchers: This issue’s cromfs out-of-bounds single report traces the impact surface back to v5.0.0 and points out that the two DFS implementations share the same origin. Such reports with version ranges are more valuable than single-point patches, and also highlight the duplication risk brought by parallel maintenance of v1 and v2.
  • Vendor platforms move from bootable to deliverable: K1 enables 8 cores by default, SPI and QSPI status is promoted to supported and enters the support matrix; D1s adds an emulator run path, and review elevates “reproducible environment” to directory conventions and AI-oriented documentation, reflecting a platformization mindset.
  • Localization details of the toolchain come into view: Emoji under Chinese Windows cause build commands to abort. The problem is small but the impact is broad, reflecting that cross-platform usability testing remains a weak spot.
  • Official channels remain silent: The news API has been inactive for over four months, and version releases remain stuck at September. External information relies mainly on GitHub and community works; this pattern has remained unchanged for two consecutive weeks.

6.2 Limitations and Deduplication Notes

  • This issue covers a 24-hour window (10-20 08:00 ~ 10-21 08:00), not a Monday, so no multi-day merge is performed.
  • No merges landed in the main repository within the window; all entries come from proposals, defect tickets, and the community side. Therefore, the three sections under “Kernel and Version Dynamics” are all proposals under review rather than landed changes, and each entry notes its status.
  • Deduplication against the previous issue: The device tree deep pre-check (#11901) and the tmpfs truncation ticket (#11902) were already included in the previous issue; this issue only covers review conclusions and device-side reproductions newly added within the window. Interrupt acknowledgment (#11860), IAR implicit declaration (#11864), on-demand compilation (#10096), and attach configuration (#9941) are earlier entries; this issue only records progress.
  • The main controllers of both competition works are not RISC-V: The NOVOSENSE NS800RT7P65 is a Cortex-M7, and only the networking-side Espressif ESP32-C3 is RISC-V; Edgi-Talk is Cortex-M55 plus M33. They are included because of RT-Thread application cases and toolchain practice, not as RISC-V adaptation analysis.
  • The organization-level full push could not be verified through the API (anonymous quota exhausted), so repository commit feeds and the organization page were cross-verified instead; the Studio SDK index was confirmed via the commit feed to be stuck at 10-10.
  • The forum article API only returns the first 20 entries; the rest were not verified. The official news list page is front-end rendered, so scraping yields only an empty shell; news is based on the API.
  • Google News returned zero hits for the English window; of the 2 Chinese items over three days, 1 was an already-included article and 1 was an old article from 10-18; the RT-Thread query was still drowned out by same-name automotive articles, and none produced additional entries.

Appendix: Source Verification Table

Source Verification Result
RT-Thread official news API (organization category) No new items; the latest of 25 archived posts remains 06-17, stalled for over four months
Official website news list page Client-side dynamic rendering; scraping only yields an empty loading shell
Community forum article API 2 new items in the window (two contest entries at 10-20 08:31), included
GitHub main repo commits 0 merges in the window; latest remains the K1 first release at 10-19 10:49
GitHub main repo PRs 9 updates in the window, of which 5 newly opened (#11903, #11904, #11907, #11908, #11909), no merges
GitHub main repo Issues 2 newly opened (#11905, #11906), plus 4 existing tickets received comments
GitHub main repo releases / tags No new releases; latest remains v5.3.0 from 09-10, v5.4.0 has no tag
GitHub RT-Thread/packages No pushes in the window (most recent 10-14)
GitHub RT-Thread Studio sdk-index No pushes (commit log confirms most recent 10-10)
GitHub other organization repos rtthread-skills and smart-build stalled at 10-18; env and specification repos stalled at 10-17
GitHub topic:rt-thread ecosystem search 5 items in the past week; only 1 in the window is a general graphics library, not topic-specific, not included
Google News aggregation (Chinese, via proxy) 2 items in the three-day window; 1 included, 1 is an old post from 10-18; Ruiching queries mostly noise
Google News aggregation (English) Zero hits in the three-day window
HN Algolia All 5 candidates are false matches on “threads”; no relevant discussion
Industry media and vendor channels Pest voiceprint article included; Ruiching livestream schedule noted as a tip

Complete Source List