Research window: 2026-10-28 08:00 ~ 2026-10-29 08:00 (Beijing time, 24 hours)

Sources: RT-Thread official news API and community article API, GitHub (main repository commits / PR / Issue / releases / tags, RT-Thread/packages, vscode-rt-smart, sdk, pkgs-test, topic:rt-thread ecosystem search), Google News aggregation (six queries in Chinese and English, via proxy), HN Algolia, industry media and community project repository verification (see appendix source list for details)

Issue Index

  • I. Kernel and Version Updates
    • utest proposal submitted three months ago merges four commits at once (10-28)
    • utest summary misjudgment: a later passing unit erases the testcase failure count (10-28)
    • netdev test cases cut public network dependency, CI no longer accesses 8.8.8.8 or Baidu (10-28)
    • Signal test cases under musl start from 1, signal 0 no longer involved (10-28)
    • DHCP raw server option parsing boundary fix, out-of-bounds read defect closed (10-28)
  • II. Security Follow-up and Pending Merge Queue
    • RT-Smart terminal ioctl hands user pointer to kernel for dereference, allowing arbitrary kernel memory read/write (10-28)
    • libc timer 64-bit truncation: 10-second timer armed as 21 hours (10-28)
    • musl pthread_exit thread list use-after-free, SMP concurrent exit crashes (10-28)
    • Smart batch of 10-18 proposals continues to refresh in the queue (10-29)
  • III. Official and Community Activities
    • Official news API still at June 17, fourth consecutive month with no additions (10-28)
    • Community article channel publishes three embedded competition works within 80 minutes (10-28)
    • FAL maintainer steps down, one entry removed from MAINTAINERS (10-28)
  • IV. Ecosystem and Vendor Adaptation
    • Renesas RA6W1-EK adds 24 Wi-Fi interrupt vectors, CryptoCell and MAC TX/RX completed (10-28)
    • Industrial CAN distributed mobile robot on NOVOSENSE NS800RT7P65 (10-28)
    • DAMO XuanTie D121 master with Loongson LS2K0300 slave for multi-device monitoring and anomaly tracing (10-28)
    • Lightweight neural network enhanced FOC on NXP MCXA346, steady-state error reduced by 4.26% (10-28)
  • V. Trend Observations and Summary
    • This issue’s trend: test infrastructure and security boundaries both catching up
    • Limitations and deduplication notes
  • Appendix: Source verification table and source list

I. Kernel and Version Dynamics

1.1 utest Proposal Submitted Three Months Ago Merged in Four Commits at Once (10-28)

Date: 2026-10-28 14:44 (merge time)　Source: Main repository commit log, Proposal #11601

The only grouped landing on the mainline this period came from an old proposal. Proposal #11601 was created on July 9 and merged on October 28 at 14:44, bringing in four commits across three files, with 125 lines added and 103 removed: a utest summary statistics fix, netdev test case stabilization, skipping signal 0 under musl, and two clang-format cleanups. All four landed at the same timestamp, indicating a whole-proposal merge rather than cherry-picking. From submission in July to mainline entry in late October, it sat for over three months; such pure test-and-format proposals routinely rank low in the review queue, but once merged they immediately change CI verdicts.

1.2 utest Summary Misjudgment: Later Passing Units Erase a Testcase’s Failure Count (10-28)

Date: 2026-10-28 14:44 (merge time)　Source: Proposal #11601

When a testcase contains multiple UTEST_UNIT_RUN calls, a failing unit followed by a passing unit caused utest_unit_run() to reset local_utest.failed_num, so the testcase and the overall summary still reported success. In other words, the test genuinely failed but the report said otherwise. The fix: clear the statistics before the testcase starts, keep each unit counted independently, and after each unit completes, accumulate that unit’s pass and fail counts back into the testcase totals. This preserves unit-level isolation without letting later successes overwrite earlier failures. The change lands in utest.c, adding 29 lines and removing 6.

1.3 netdev Test Cases Cut Public-Network Dependency; CI No Longer Reaches 8.8.8.8 or Baidu (10-28)

Date: 2026-10-28 14:44 (merge time)　Source: Proposal #11601

The original netdev ping test cases treated 8.8.8.8 and www.baidu.com as mandatory reachable targets, and also relied on invalid IP strings like “192.256.0.321” being rejected by the parsing layer. There were two problems: without external network access in CI, the former cases necessarily fail—a false red; and rejection behavior for invalid strings varies across parser implementations—a pseudo-assertion. This change wraps the external-network cases entirely in #ifndef RT_USING_CI_ACTION, switches the invalid-address case to passing an empty hostname (rejected before the DNS query), and changes the DNS case to verify only that configuration writes take effect. The change lands in tc_netdev.c, adding 34 lines and removing 43.

1.4 Signal Test Cases Under musl Start at 1; signal 0 No Longer Participates (10-28)

Date: 2026-10-28 14:44 (merge time)　Source: Proposal #11601

Four signal test cases previously installed handlers starting from signo equal to 0. Signal 0 in POSIX is only used for existence checks and has no installable-handler semantics; calling it this way under musl fails, so the whole group broke on musl configurations. This change introduces UTEST_SIGNAL_MIN: 1 under musl, still 0 for other libcs, with all four loops switched to the macro. The change lands in signal_tc.c, adding 10 lines and removing 4. This is a typical way to strip “libc implementation differences” out of test verdicts—cleaner than loosening conditions in assertions.

1.5 DHCP raw Server Option Parsing Gains Boundary Checks; Out-of-Bounds Read Defect Closed (10-28)

Date: 2026-10-28 19:04 (merge time)　Source: Proposal #11940, Defect #11913

When iterating over client options, the raw API DHCP server could read a missing length byte or return a truncated option; the MESSAGE_TYPE and REQUESTED_IP call sites then read values without validating length, constituting an out-of-bounds read. Parsing also proceeded over a preallocated 1500-byte buffer, beyond the range of data actually received. The merged fix validates layer by layer: confirm the option header is complete before reading the length byte; confirm declared content falls within the packet before returning or advancing the pointer; require at least 4 bytes for REQUESTED_IP and at least 1 byte for MESSAGE_TYPE; reject packets shorter than DHCP_OPTIONS_OFS; and compute the option region from the actual packet length. Only dhcp_server_raw.c changes, adding 23 lines and removing 5, with the author validating via 12 host-side regression cases (ASAN).

II. Security Follow-up and Merge Queue

2.1 RT-Smart terminal ioctl passes user pointers to the kernel for dereference, allowing arbitrary kernel memory read/write (10-28)

Date: 2026-10-28 13:14 (report) / 20:35 (fix proposal)　Source: Issue #11937, PR #11941

The report notes that RT-Smart’s terminal subsystem was ported from the FreeBSD tty framework, but the port dropped FreeBSD’s premise of first copyin-ing user arguments into a kernel stack buffer inside sys_ioctl(). RT-Smart’s sys_ioctl() forwards the raw user pointer directly for non-flock commands, and the ported adapter functions and the TIOCGWINSZ branch in tty.c still write directly to kernel addresses via *(struct winsize *)data. The consequence: an unprivileged process can read and write arbitrary kernel memory using only the two official interfaces, open plus ioctl, and passing a null pointer can crash the kernel outright. Affects all versions from v5.1.0 onward (introduced by PR #8672 on 2024-03-28); v5.0.x is unaffected. Verified on qemu-vexpress-a9, and the defect is architecture-independent — AArch64 RT-Smart is equally affected. At 20:35 the same day, the community submitted PR #11941: it introduces kernel stack staging and copy_from_user/copy_to_user in the ioctl adapter layer, and adds lwp_in_user_space() bounds checks to the common ptm and tty paths — 6 files, 577 insertions, 52 deletions.

2.2 libc timer 64-bit truncation: a 10-second timer is armed as 21 hours (10-28)

Date: 2026-10-28 (creation time)　Source: PR #11938, Issue #11924

Issue #11924 reports that timer_gettime() stores total remaining nanoseconds in a 32-bit integer before splitting into seconds. The proposer dug further and found an even more serious truncation of the same kind upstream: timer_settime() performs its conversion with unsigned long res = rt_clock_time_get_res_scaled(), and that function returns values on the order of 1e13 for a 100 Hz clock source; storing that in 32 bits keeps only the low bits, so the computed reload is completely wrong. Per the arithmetic in the proposal, a 10-second timer works out to a reload corresponding to roughly 21 hours — in other words, the timer is wrong from the moment it is armed, and fixing only timer_gettime() will not make the result correct. The proposal fixes both the set and query sides — 4 files, 142 insertions, 5 deletions — and remains in the queue.

2.3 musl pthread_exit thread-list use-after-free, SMP concurrent exit crashes (10-28)

Date: 2026-10-26 (report) / 2026-10-28 (update)　Source: Issue #11932

Under RT-Thread Smart 5.2.2, SMP, aarch64, and musl 1.2.5, concurrent pthread_create and pthread_exit crash inside musl_pthread_exit: when unlinking from the thread list, the code writes to an already-freed or already-unmapped thread descriptor (Data Abort), or the thread return address is overwritten with 0 (Instruction Abort). The report includes a reproducer and detailed analysis; a workload of 1000 rounds with 8 threads reproduces within a few hundred rounds. The issue was updated in this window but has no corresponding fix proposal yet, making it a Smart-side problem to watch in the next batch — it belongs to a different subsystem than 2.1, but both sit on the same “user-mode/kernel-mode boundary” line.

2.4 The batch of Smart PRs from 10-18 keeps refreshing in the queue (10-29)

Date: 2026-10-28 20:37 ~ 2026-10-29 00:17 (last update)　Source: PR #11896, PR #11894

The PR enabling RT-Thread Smart on qemu-virt64 was still being updated at 00:17 on October 29, and the PR splitting lwp syscall implementations by subsystem refreshed at 20:37 on October 28; both were created on October 18 and remain unmerged. The same batch also includes several lwp, signal, and serial-related PRs that refreshed in a cluster on the afternoon of October 28. This group remains the most active segment of the queue in this window, but none of the four merges that day belonged to Smart, indicating that maintainers cleared older testing and networking backlog first this round.

III. Official and Community Activity

3.1 Official news API still at June 17, fourth consecutive month with no additions (10-28)

Date: 2026-10-28 (verification time)　Source: Official news API

A page-by-page check of the official news API shows the latest entries are still the two published on 2026-06-17, covering the Abu Dhabi Investment Forum and the 4th Software Innovation and Development Conference respectively; there were no additions in either the 24-hour or 7-day window. Compared with the community article channel publishing three pieces in one day, the contrast is stark: official external communications have been low-frequency for four consecutive months, and the daily report’s routine content is effectively carried by GitHub and the community side. This state is itself informative for judging community activity — a slower corporate communications cadence does not mean the engineering side has stalled.

3.2 Community article channel publishes three embedded competition entries within 80 minutes (10-28)

Date: 2026-10-28 13:03 ~ 14:12 (publish time)　Source: Community article API

The community article API gained three new entries between 13:03 and 14:12, all 2026 Embedded Competition entries: an industrial CAN distributed mobile robot based on the NOVOSENSE NS800RT7P65, a multi-slave monitoring and anomaly tracing system with a XuanTie D121 as master, and a lightweight neural-network-enhanced brushless motor controller based on NXP MCXA346. All three include open-source repositories or complete reproduction records, spanning industrial control, industrial connectivity, and motor control. The clustered posting indicates the competition has entered its submission and showcase peak, and that this cohort of authors is accustomed to publishing engineering details alongside code rather than submitting only a report. Detailed technical breakdowns of each are in Chapter IV.

3.3 FAL maintainer steps down, one entry removed from MAINTAINERS (10-28)

Date: 2026-10-28 18:48 (merge time)　Source: PR #11939

A merge that only touches MAINTAINERS removes the components_fal entry; the original author states in the description that they no longer have the time or energy to continue participating in community work. FAL (Flash abstraction layer) has long been maintained by a single person; this is a voluntary handover by the maintainer and does not reflect a code quality problem. With the entry removed, the component currently has no registered maintainer, and whether someone steps in is worth watching — by past patterns, once such foundational components go unclaimed, problems only surface when vendors submit BSPs.

IV. Ecosystem and Vendor Adaptation

4.1 Renesas RA6W1-EK Adds 24 Wi-Fi Interrupt Vectors, Completes CryptoCell and MAC TX/RX Support (10-28)

Date: 2026-10-28 18:52 (merge time)　Source: PR #11934

The rafw_gen vector table for the RA6W1-EK previously covered only general-purpose peripherals, leaving an entire group of Wi-Fi-side interrupts without entry points: KDMA, TDES CBC, PSK SHA1, SYSPLL and FPLL lock, the full set of RTC interfaces (external wakeup, power-down, brownout, pulse counting, bus clock, access, mirror, load complete), MRM and D-cache MRM, CryptoCell-312, HSU, MAC timer/receive/transmit/protocol/general/beacon, and the radio controller — 24 in total. All are now declared as weak handlers and wired into the vector table, and two crypto entry points in the ROM symbol table were renamed with a __rom_ prefix to avoid collisions with same-named symbols on the RAM side. The changes land in vector_data.c (49 lines added) and rom_code_gcc.symbols (6 lines changed).

4.2 Industrial CAN Distributed Mobile Robot on NOVOSENSE NS800RT7P65 (10-28)

Date: 2026-10-28 14:12 (publish time)　Source: Community article: small autonomous mobile robot, open-source repo

An industrial control track entry in the 2026 embedded competition, with code released under GPL-3.0. The main controller is a NOVOSENSE NS800RT7P65 (Cortex-M7, 600 MHz) running RT-Thread 4.x, with a single chip handling the FOC 2-axis gimbal, CAN master control, and 40 MSH online diagnostic commands; the chassis uses a five-node CAN architecture (main controller, gimbal FOC, sensor acquisition, chassis drive, vision AI), with each slave running its own local closed loop — consistent with layered industrial AMR design. On the sensing side, a rotating ultrasonic scanner generates a 2D point cloud, an IMU and odometry provide pose estimation, and a camera supplies images while a companion board runs object detection, separating vision compute from control compute. Monitoring runs over a LAN MQTT platform, with a Web page displaying pose, point cloud, detected targets, and trajectory in real time, and supporting multi-step task sequences issued over the intranet — the entire chain does not depend on the public internet.

4.3 DAMO XuanTie D121 Master with Loongson LS2K0300 Slave for Multi-Device Monitoring and Anomaly Tracing (10-28)

Date: 2026-10-28 13:03 (publish time)　Source: Community article: multi-slave device monitoring and anomaly tracing system

An industrial connectivity solution from the same batch of competition entries. The master is a DAMO XuanTie D121 running RT-Thread with an LVGL touchscreen, polling two slaves over RS485 and Modbus RTU: a Spark STM32F407 collecting temperature, humidity, and six-axis data, and a Loongson LS2K0300 reporting system metrics such as CPU, memory, and uptime. Collected data is written to a TF card with local playback support; key events such as communication interruption, recovery, and vibration limit violations enter a persistent queue and are uploaded to the cloud via ESP8266 for remote viewing through a WeChat mini-program, with data stored locally during network outages and back-filled on recovery. A key design point is that other devices keep logging when a single device goes offline. Putting ARM and LoongArch slaves on the same Modbus bus offers direct reference value for heterogeneous device onboarding scenarios.

4.4 Lightweight Neural Network-Enhanced FOC on NXP MCXA346 Cuts Steady-State Error by 4.26% (10-28)

Date: 2026-10-28 14:12 (publish time)　Source: Community article: lightweight neural network-enhanced intelligent brushless motor controller, open-source repo

The third competition entry, built on NXP FRDM-MCXA346 with a 2804 motor, AS5600 magnetic encoder, and SimpleFOC Mini driver. On the control side, feedforward plus PI speed and position loops run first, then a dynamic compensation network with 3 inputs, 8 hidden units, and 1 output is superimposed on the control output; the weights are exported as C code and computed directly on the MCU, with no inference framework in the firmware. Compensation can be toggled independently for same-parameter comparison. In 90 on-board test runs (10 switching types within ±15 RPM, three rounds each): steady-state tail-segment RMSE over a 100 ms window dropped from 2.187 to 2.094 RPM, about 4.26%; full-segment RMSE dropped from 3.327 to 3.291, about 1.07%. In addition, adding 25 ms smoothing to the P-term target reduced the mean full-segment speed error by about 5.83% across 60 test runs. On the RT-Thread side, the control thread runs on a 2 ms period, the serial thread separately handles commands and telemetry, and threads synchronize state via mutex.

V. Trend Observations and Summary

5.1 This Issue’s Trend: Test Infrastructure and Security Boundaries Both Get Remedial Work

Date: 2026-10-29 (this issue)　Source: main repo commit log, bug #11937

Four of this issue’s seven merges are test-related: three change test-case logic and one is formatting only, all aimed at making CI verdicts trustworthy — no longer depending on the public internet, no longer being overwritten by later units, and no longer assuming signal 0 can be installed under musl. Security is the other thread: the DHCP out-of-bounds read was closed, the RT-Smart terminal ioctl issue of user pointers reaching the kernel directly was reported and a fix filed the same day, and the libc timer truncation fix advanced from “query only” to “set as well.” Neither category produces new features, but both point to the same thing: re-establishing the two premises that “tests pass” and “parameters are trustworthy.” By contrast, Smart-side proposals are still being refreshed in the queue without merging that day, indicating this maintenance round is clearing old debts on the test and network sides first.

5.2 Limitations and Deduplication Notes

Date: 2026-10-29 (this issue)　Source: official news API, community article API

  • The official news API has had no new entries for the fourth consecutive month; this issue’s news-side content comes from the community article API and GitHub. The media search window yielded only one long RTOS retrospective article (10-28 11:48); scraping of the original site was restricted, so whether the body mentions RT-Thread could not be verified, and it was not included.
  • The clang-format 22.1.8 full-formatting proposal #11936 recorded in yesterday’s daily report continued to refresh this issue (10-28 18:50) with no substantive change, so it is not re-included.
  • In the topic:rt-thread ecosystem search window, only zlgopen/awtk had a push (10-28 12:56), a routine improvement to a general-purpose GUI toolkit with no direct relation to RT-Thread, so it was excluded.
  • Both HN Algolia hits this issue were string false matches on threads and ThreadShelf and were dropped as a batch; the Google News English side had no relevant items in the window.
  • Three competition entries were published the same day on similar themes and are included separately by track rather than merged into one, to avoid losing technical detail.

Appendix: Source Verification Table and Source List

Source Verification Table

Source Verification Result
Official news API (rt_org) No new items in 24 hours; latest entry remains at 2026-06-17
Community article API (article) 3 new items in the window, all 2026 embedded competition entries (10-28 13:03 to 14:12)
Main repo commits 7 merges in the window, concentrated at 10-28 14:44 and 18:48 to 19:04
Main repo PRs 4 merged (#11601, #11934, #11939, #11940), 2 newly opened (#11938, #11941), 17 proposals under review updated in this window
Main repo releases / tags No new items; latest remains v5.3.0 (2026-09-10)
Main repo Issues 1 newly opened (#11937, RT-Smart terminal ioctl security), 2 others updated in this window
RT-Thread/packages No pushes; latest push 2026-10-23
vscode-rt-smart No pushes; latest push 2026-10-26
RT-Thread/sdk No pushes; latest push 2026-10-26
pkgs-test No pushes; latest push 2026-10-23
topic:rt-thread ecosystem search Only zlgopen/awtk pushed in the window, not directly related to RT-Thread; excluded
Google News Chinese 1 RTOS retrospective long-form article in the window; original site fetch restricted, not included
Google News English No relevant hits in the window
HN Algolia 2 threads and ThreadShelf false matches; entire batch excluded

Full Source List