Research window: 2026-10-29 08:00 ~ 2026-10-30 08:00 (Beijing time, 24 hours)

Sources: RT-Thread official news API and community article API, GitHub (main repository commits / PR / Issue / releases / tags, RT-Thread/packages, vscode-rt-smart, sdk, pkgs-test, topic:rt-thread ecosystem search), Google News aggregation (five query groups in Chinese and English, via proxy), HN Algolia, Hackster and vendor site verification (see appendix source list for details)

Index of This Issue

  • I. Kernel and Version Updates
    • Two qemu-virt64 BSPs enable RT-Thread Smart; user mode runs fully in QEMU for the first time (10-29)
    • Default configuration reverted seven and a half hours later: #11942 moves Smart back to an overlay and rewrites CI selection logic (10-29)
    • lwp system call implementation split into 20 files by subsystem; lwp_syscall.c loses 11,638 lines in one go (10-29)
    • Terminal compatibility completed: TIOCLINUX returns zero modifier keys, TTY window defaults to 24×80 (10-29)
    • ping statistics fix: the first reply also sets the minimum, so monotonically increasing values no longer report minimum = -1 (10-29)
  • II. Security Follow-up and Pending Merge Queue
    • Block device ioctl writes a 24-byte partition table to a kernel pointer specified by the caller (10-29)
    • Four driver defects in one day: out-of-bounds ADC channels in three vendors, divide-by-zero in DM365 SPI (10-29)
    • Pending review queue: RISC-V Smart page fault handling, RTL8125 2.5G NIC, RK3588 display and audio (10-29)
    • Proposals for K230D support and Smart improvements still in the queue (10-29)
  • III. Official and Community Activities
    • Official news API stuck at June 17 for the fifth consecutive month (10-29)
    • Infineon Edgi Talk desktop companion: a single Chinese sentence assigns the watch task, with AI-assisted development throughout (10-30)
    • Community long-form article uses 4.0.3 source code to explain kernel object arrays and intrusive linked lists (10-29)
  • IV. Ecosystem and Vendor Adaptation
    • Overseas community uses RT-Spark board for offline edge AI, but the firmware runs FreeRTOS (10-28)
  • V. Trends and Summary of This Issue
    • Trend: Smart is reverted from default configuration on the day it lands; the test overlay becomes its new positioning
    • Limitations and deduplication notes
  • Appendix: Source verification table and source list

I. Kernel and Version Dynamics

1.1 Two qemu-virt64 BSPs Enable RT-Thread Smart, Running Full User Mode in QEMU for the First Time (10-29)

Date: 2026-10-29 09:29 (merge time)　Source: Proposal #11896, main repository commit log

Proposal #11896, created on October 18 and sitting in the queue for ten days, was merged this issue: 14 files, 1263 lines added, 1075 lines removed, 14 commits. The rationale is stated plainly: the qemu-virt64 series BSPs never enabled RT-Thread Smart, so user-mode and LWP-related features could not be tested on QEMU at all, and there was no standard root filesystem initialization flow for virtio block devices and pseudo-terminals.

The changes fall into three layers. Configuration layer: enable RT_USING_SMART for qemu-virt64-riscv and qemu-virt64-aarch64, and disable SMP on riscv64 per Smart’s single-core prerequisite. Runtime layer: add applications/mnt.c, which mounts virtio-blk0 as the root directory (trying elm first, then ext on failure, retrying up to 100 times at 10 ms intervals when the device is not ready), then mounts ptyfs at /dev/pts and procfs at /proc. CI layer: add corresponding entries to three workflows — bsp_buildings, membrowse, and utest_auto_run. For builds, riscv64 switches to the RISC-V general musl toolchain and aarch64 to the aarch64 musl toolchain. The prerequisite #11893 (lwIP loopback network interface support) was merged earlier on October 25; this configuration was regenerated after that symbol landed.

1.2 Default Config Reverted Seven and a Half Hours Later: #11942 Pushes Smart Back to an Overlay Layer, CI Selection Logic Rewritten (10-29)

Date: 2026-10-29 16:59 (merge time)　Source: Proposal #11942

At 16:59 the same day, #11942 passed, rolling back the default configuration left by the previous proposal in full: 7 files, 51 lines added, 220 lines removed. The rtconfig.h of both BSPs drops RT_USING_SMART, KERNEL_VADDR_START, ARCH_REMAP_KERNEL, and the entire PAGECACHE configuration block, adds RT_USING_DFS_V2 and RT_USING_DFS_ELMFAT, and bumps RT_VER_NUM from 0x50301 to 0x50400 — meaning the main branch is now in 5.4.0 development state.

The real technical point is in CI. Previously, utest_auto_run.yml overrode the standard kernel test cases for these two BSPs by “git checkout origin/master’s .config and rtconfig.h”, which would also wipe out the SMP configuration section just appended; this change instead appends a single line # CONFIG_RT_USING_SMART is not set directly to .config, disabling only Smart without touching SMP. Meanwhile, ALL_BSP_COMPILE.json puts qemu-virt64-aarch64 back into the aarch64 standard build group and qemu-virt64-riscv back into the riscv64-unknown-elf standard group, removing the previously separate qemu-smart build group; the aarch64 target toolchain in membrowse reverts from aarch64-linux-musleabi to aarch64-none-elf.

The net effect is that Smart goes from “BSP default configuration” to “utest configuration overlay”: the same BSP runs both the standard kernel regression and, via rtsmart.cfg, the appended Smart test cases, with the two paths no longer overriding each other.

1.3 lwp System Call Implementation Split into 20 Files by Subsystem, lwp_syscall.c Loses 11638 Lines in One Go (10-29)

Date: 2026-10-29 14:50 (merge time)　Source: Proposal #11894

Proposal #11894, also created on October 18, was merged this issue: 22 files, 12223 lines added, 11638 lines removed. The core action is splitting the eleven-thousand-plus-line single file components/lwp/lwp_syscall.c wholesale into the syscall/ directory: grouped by memory, file, path, stat, filesystem, socket, netdb, process, message queue, rt_ipc, signal, system, time scheduling, device, and channel into 20 implementation files, plus syscall_internal.h and a shared system call dispatch table, with the new directory registered in lwp’s SConscript.

The proposal itself states “no functional changes”, which is corroborated by the subsequent clang-format commit: formatting touches only the new files, and the comments note that behavior is unchanged. The value of the split is on the review side — system call implementations go from “flipping through one big file by number” to “locating by subsystem”, so subsequent boundary fixes like copyin/copyout (such as the ioctl issue covered in 2.1) no longer require navigating a ten-thousand-line file.

1.4 Terminal Compatibility Fill-ins: TIOCLINUX Returns Zero Modifier Keys, TTY Window Defaults to 24×80 (10-29)

Date: 2026-10-29 14:48 (merge time)　Source: Proposal #11890

2 files, 18 lines added, 4 lines removed. Previously TIOCLINUX returned failure outright, and many terminal programs probe console state at startup, degrading or exiting when the probe fails; this change returns a zero keyboard modifier state so such programs continue down the normal path on RT-Smart. The other fix is window size: when no source reports a size, the TTY is initialized to 24 rows by 80 columns, preventing programs that rely on ioctl for dimensions from reading 0.

A companion commit fixes the length expression in the same batch of code, using sizeof(tty_ctrl_charset) directly for the memcpy length argument, incidentally clearing cppcheck’s sizeofDivisionMemfunc warning.

1.5 ping Statistics Fix: First Reply Also Sets the Minimum, No More minimum = -1 on Monotonic Increases (10-29)

Date: 2026-10-29 09:33 (merge time)　Source: Proposal #11900

Changes only components/net/netdev/src/netdev.c: 5 lines added, 1 line removed, submitted by the author on October 19. The original logic initialized max_time to 0 and min_time to 0xFFFFFFFF, then updated via an if / else-if chain: the first reply’s latency is necessarily greater than 0, so it takes the max branch and the minimum is never assigned. If subsequent reply latencies keep rising, every sample only updates max, min_time stays at 0xFFFFFFFF, and the final %d print becomes minimum = -1. The fix sets both max and min to that packet’s latency when received equals 1, after which the two comparisons each handle one side, aligning the statistics semantics.

II. Security Follow-up and Merge Queue

2.1 Block device ioctl writes a 24-byte partition table to a kernel pointer specified by the caller (10-29)

Date: 2026-10-29 22:00 (report time)　Source: Defect #11952

An unprivileged RT-Smart process can pass a kernel address down as an ioctl argument: sys_ioctl() and blk_fops_ioctl() perform no copy-in / copy-out and forward the raw argument directly, while blk_dev_control() executes rt_memcpy(args, &blk->partition, sizeof(blk->partition)) in the RT_DEVICE_CTRL_BLK_PARTITION branch, effectively writing 24 bytes of partition information into a kernel address chosen by the attacker. The affected scope is stated as master (v5.4.0-dev) and v5.2.0 through v5.3.0, introduced by generic block layer commit c424cb81; verified on QEMU vexpress-a9, ARMv7-A, 32-bit RT-Smart with an SD image environment, triggerable once the kernel creates /dev/sd0.

This is the second consecutive day of the same class of issue: yesterday the terminal subsystem’s ioctl dropped FreeBSD’s copyin precondition (Defect #11937), and today the block device subsystem dropped the same layer. The common cause is that RT-Smart’s ioctl adaptation layer assumes by default that “the argument is already a kernel address,” while the user-space entry point does not perform that conversion. #11941 (introducing copyin / copyout on the terminal side) is still in the queue, and this defect has no corresponding fix proposal yet.

2.2 Four driver defects in one day: out-of-bounds ADC channels in three vendors, divide-by-zero in DM365 SPI (10-29)

Date: 2026-10-29 19:25 ~ 19:27 (report time)　Source: Defect #11948, #11949, #11951, #11950

The same reporter filed four driver-side defects within two minutes, all highly consistent in theme: channel numbers and frequencies passed in by callers are not validated.

Bluetrum AB32’s ADC first maps the channel via ab32_adc_get_channel() and starts the conversion, but then indexes the data register array with the raw channel number; when out of range, the mapping function silently falls back to 0 without reporting an error, ultimately reading outside the array. Bouffalo’s ADC reads raw_data[10 + channel]; the array has 26 words, so channel 22 lands on the 32nd word, and a channel below -10 overruns the front of the array. HPM’s ADC indexes chn_state[16] with the raw signed channel, and rt_adc_enable() performs no validation. DM365’s SPI, meanwhile, uses max_speed_hz as a divisor in davinci_spi_get_prescale(), dividing by zero when it is 0, and the DIV_ROUND_UP clamp is written after the division, effectively providing no protection.

The common thread across all four is that the rt_adc_read() / rt_spi_configure() layer performs no parameter validation, pushing the validation responsibility down to each driver, and most drivers do not do it.

2.3 Review queue: RISC-V Smart page fault handling, RTL8125 2.5G NIC, RK3588 display and audio (10-29)

Date: 2026-10-29 11:02 ~ 19:53 (last update)　Source: Proposal #11892, Proposal #11944, Proposal #11943, Proposal #11947

#11892 from the same batch as 1.1 (Smart’s MMU and user-space page fault handling on the RISC-V side) remains in the queue this period, with 4 files, 105 lines added, and 8 lines deleted, updated on October 29 at 11:26. It includes adding XuanTie architecture selection and the SVPBMT option, converting early page table pointers by kernel physical offset, allowing the MPR range to extend below the link base address, cleaning up early page tables before enabling the MMU, clearing user address entries from each hart’s kernel page table, and terminating only the current LWP rather than bringing down the kernel when an unhandled user page fault occurs. These changes are the other half of the same goal as 1.1: one makes QEMU run, the other keeps user space on real RISC-V hardware from killing the kernel by mistake.

The other three are all large new hardware support items: the RTL8125 Ethernet driver adds 1934 lines, covering RTL8125 / RTL8162 native PCI, descriptor ring DMA, interrupt-driven RX and TX completion, 10/100/1000/2500M auto-negotiation, lwIP software checksum, plus optional PTP clock and PPS; RK3588 and RK3528 display and audio support spans 36 files, with 5483 lines added and 391 lines deleted, including the HDMI controller and HDPTX PHY, VOP2 routing and framebuffer scanning, and SAI and codec audio clocks; the fix for the unbounded loop when the DHCP raw server address pool is exhausted is small (17 lines added, 4 lines deleted), but it comes with 3586 combinations of pool size / occupancy bitmap / starting position comparison tests and ASAN results, the strongest validation in this period’s queue. There is also a proposal pinning clang-format to 22.1.8, touching 75 files with 3852 lines added.

2.4 Proposals for K230D support and Smart improvements remain in the queue (10-29)

Date: 2026-10-29 (review)　Source: Proposal #11897

#11897 from the same batch as Smart (adding K230D support to K230 and improving Smart) is still not merged this period; its predecessor #11359 has been closed. Among the “four 10-18 proposals” recorded in yesterday’s report, three — #11894, #11896, and #11890 — landed this period, while #11892 and #11897 remain in the queue, indicating this work is being advanced in two stages: items that can be independently verified go first, while those involving new hardware wait for board-side confirmation.

III. Official and Community Activities

3.1 Official news feed stalls at June 17 for the fifth consecutive month (10-29)

Date: 2026-10-29 (verification)　Source: RT-Thread official news list

The latest entry returned by the official news feed is still the 2026-06-17 item “RealSi Technologies Invited to Attend the 2026 Abu Dhabi Investment Forum,” with no new additions from June through October—now silent for the fifth consecutive month. The news list homepage on the official site also shows no new posts over the same period. Company-side external updates likewise produced no hits in this issue’s Google News queries in both Chinese and English, and seven-day queries for 睿擎 and 睿擎派 also came back empty. Corporate updates are currently in a stalled state, leaving GitHub and community articles as the only primary sources for the daily report.

3.2 Infineon Edgi Talk desktop companion: one Chinese sentence assigns a watch task, developed end-to-end with AI collaboration (10-30)

Date: 2026-10-30 00:54 (published)　Source: Community article: Little Watcher

“Little Watcher,” a 2026 embedded competition entry by author Oliver, has been published. The hardware is Infineon Edgi Talk (PSoC Edge E84), the system is RT-Thread, and the source code and release package are public. The functional scope is deliberately narrow: specify in one Chinese sentence the appearance or disappearance of a visible target; when a change is detected, alert the user and save the before/after frames—solving the problem that “a one-off need isn’t worth writing a dedicated recognition program.”

On the engineering side, the board’s M55 side is built on the official BSP’s CherryUSB UVC example and the official Wi-Fi example configuration, retaining the original M33 boot firmware. RT-Thread threads handle voice recording and upload, camera capture and upload, and alert playback separately; a mutex protects shared state and the camera-stop process, and a semaphore wakes the alert thread. Peripherals are accessed through the LCD, touch, microphone, and audio device interfaces; data goes through the Wi-Fi management interface and lwIP sockets; and the control bridge uses FinSH/MSH commands. The PC side handles speech recognition, task compilation, and visual judgment; task plans can be cached and reused, so there is no need to retrain a model for each target. The boundary conditions are stated concretely: a single watch session is capped at 300 seconds and 60 image uploads (1 reference frame plus at most 59 comparisons), the web page retains at most the latest 100 events, frames that cannot be determined are marked uncertain, and the system defaults to paused after a restart.

The interesting part here isn’t the algorithm—visual judgment runs on an off-the-shelf model on the PC side—but that it treats the process of “AI participating in development” as a deliverable in itself: requirements decomposition, code integration, troubleshooting, test verification, documentation, and demo each record how AI participated, with separate records kept for failures and passes.

3.3 Community long-read uses 4.0.3 source to explain kernel object arrays and intrusive linked lists (10-29)

Date: 2026-10-29 08:28 (published)　Source: Community article: Kernel object distribution

A long-read aimed at kernel beginners has been published in the community articles channel. The author is CTIE_4063, and the material is drawn from RT-Thread 4.0.3’s src/object.c and include/rtdef.h, with the code declared to come from the actual source rather than the manual. The article’s main thread maps the requirement set—”manage by type, look up by name, support traversal, support counting”—onto three things: one container per object type, rt_object_information (containing the type, list head, and size of that struct); an intrusive rt_list node embedded in each object, so lookup and traversal need only one piece of generic code; and rt_object_get_information to fetch the container from the type, with container_of used to recover the object from the list node. The article ends with a 60-line exercise reimplementing the core of rt_list and a GitHub Pages illustrated version.

IV. Ecosystem and Vendor Adaptation

4.1 Overseas community uses RT-Spark board for offline edge AI, but the firmware runs FreeRTOS (10-28)

Date: 2026-10-28 (published) / 2026-10-29 08:34 (aggregation hit)　Source: Hackster project: Smart Water Bottle Reminder

An offline edge AI project using the RT-Spark board as hardware has appeared on Hackster: a six-axis IMU distinguishes four states—lying down, being carried, drinking, and shaking—and if no drinking is detected for 30 seconds, the LCD shows a red-text prompt and a buzzer sounds, repeating every 10 seconds. A depth-5 decision tree is trained in Python and exported as pure C; single inference on the STM32F407 takes about 154 microseconds, with 95% accuracy on the held-out set, versus a 97.5% threshold-rule baseline on the same data—a gap the author honestly notes. The whole system has 8 tasks, two queues, and two mutexes, runs at 168 MHz, and is fully offline.

What needs to be kept clear: the project uses RT-Thread’s RT-Spark development board, but the firmware runs FreeRTOS, and the acknowledgments list RT-Thread and FreeRTOS side by side. This is ecosystem reuse at the board level and does not constitute a case of RT-Thread kernel adoption; it is treated as an ecosystem reference and not counted as an application deployment. The same author also published an RT-Spark human activity recognition project on October 26, suggesting this line of work treats the board as a general-purpose STM32F407 development board.

5.1 Trend: Smart is reverted to the default configuration the same day it lands, and the test coverage layer becomes its new positioning

This issue marks the concentrated landing of the RT-Thread Smart line after ten days in the queue: at 09:29, #11896 was merged to enable Smart on the two QEMU virt64 BSPs and complete root filesystem initialization; at 14:48 and 14:50, #11890 and #11894 were merged to add terminal compatibility and syscall layering; and by 16:59, #11942 was merged to restore the BSP default configuration entirely to the standard kernel.

This cadence reads like back-and-forth, but it is actually the maintainers defining where Smart sits: the default configuration must remain predictable so that regular regressions without Smart stay stable; Smart runs separately through utest’s configuration overlay layer, with both paths sharing one BSP. This gains user-mode test coverage on QEMU without disrupting the existing BSP build matrix due to default configuration changes. In the same batch of work, #11892 and #11897 are still queued, showing that “merge first what can be verified on QEMU, merge later what depends on real hardware and board-side confirmation” is the de facto rhythm of these proposals.

The second thread is the security boundary. Yesterday it was terminal ioctl; today it is block device ioctl—both with exactly the same root cause: RT-Smart’s ioctl adaptation layer already defaults its parameters to kernel addresses, but the user-mode entry point does not perform copy-in. Add to that four driver-side channel number and divide-by-zero defects in a single day, and it’s clear that current defect reports are shifting from “the feature is wrong” to “the boundary isn’t checked.” A third point worth noting is the lwp split in 1.3—an 11,000-line single file broken into 20 files grouped by subsystem. This kind of structural change fixes no defects itself, but it determines whether the subsequent batch of boundary fixes can be reviewed efficiently.

5.2 Limitations and deduplication notes

The official news feed has stalled at June 17 for the fifth consecutive month, and there were no company-side updates this issue, so the report relies entirely on the two channels of GitHub and community articles. The 4 items returned by HN Algolia in this window (DissPair, StrictLLM, Help My Sanity, Uji) were all false matches on “threads”-type keywords and were removed as a batch; the topic:rt-thread ecosystem search returned zero hits in this window; the only hit on the English side of Google News was the Hackster project in 4.1, while the two Chinese-language pieces related to RTOS and embodied intelligence had no direct connection to RT-Thread and were not included.

Yesterday’s report recorded #11894 and #11896 as “queued, not yet merged”; both have now been merged in this issue, which is normal scheduling progress rather than a correction of the previous issue’s conclusion. The RT-Spark project in 4.1 is listed only as a board-level ecosystem reference because its firmware is FreeRTOS, and is not counted as an application deployment entry.

Appendix: Source Verification Table and Source List

Source Verification Table

Source Verification Result
Official news API (rt_org) No new items in 24 hours; latest entry remains at 2026-06-17
Community article API (article) 1 new item in the window (10-30 00:54, embedded competition entry); another kernel long-form article published at 10-29 08:28
Main repo commits 7 merges in the window, concentrated between 10-29 09:29 and 16:59
Main repo PRs 5 merged (#11890, #11894, #11896, #11900, #11942); 13 proposals under review updated in this window
Main repo releases / tags No new items; latest remains v5.3.0 (2026-09-10)
Main repo Issues 5 new (#11948 to #11952, driver boundaries and block device ioctl security)
RT-Thread/packages No pushes; latest push 2026-10-23
vscode-rt-smart No pushes; latest push 2026-10-26
RT-Thread/sdk No pushes; latest push 2026-10-25
pkgs-test No pushes; latest push 2026-10-23
topic:rt-thread ecosystem search Zero hits in the window
Google News English 1 hit (Hackster RT-Spark project), included as ecosystem reference
Google News Chinese 2 hits, both RTOS retrospectives and embodied intelligence overviews, unrelated to RT-Thread; excluded
HN Algolia 4 false matches on the “threads” keyword; entire batch excluded

Full Source List