avoid 802.15.4 using a standard BSD function name, enable BSD test after mg_error() fix

Make mg_http_ota_cb public, add /ota endpoints to MCU examples

.github/workflows/claude-full-security-scan.yml

@@ -1,16 +1,42 @@
-name: Claude Full Codebase Security Scan
+name: Claude Codebase Security Scan
 
 on:
   workflow_dispatch:
     inputs:
-      prompt_path:
-        description: "Path to the repo prompt file Claude should read"
-        required: true
-        default: "resources/specs/claude-security-scan.md"
       target_ref:
         description: "Branch, tag, or SHA to scan"
         required: false
         default: ""
+      common_misc:
+        description: "Run common/misc security scan"
+        required: false
+        type: boolean
+        default: true
+      mongoose_core:
+        description: "Run Mongoose core security scan"
+        required: false
+        type: boolean
+        default: true
+      web_http_auth:
+        description: "Run web/HTTP/auth security scan"
+        required: false
+        type: boolean
+        default: true
+      tls:
+        description: "Run TLS security scan"
+        required: false
+        type: boolean
+        default: true
+      net_builtin:
+        description: "Run built-in network security scan"
+        required: false
+        type: boolean
+        default: true
+      protocols:
+        description: "Run protocol security scan"
+        required: false
+        type: boolean
+        default: true
   #schedule:
     # Weekly scan: Sunday 02:00 UTC
   #  - cron: "0 2 * * 0"
@@ -20,73 +46,163 @@ permissions:
   id-token: write
 
 concurrency:
-  group: claude-full-codebase-security-scan-${{ github.ref }}
+  group: claude-security-scans
   cancel-in-progress: false
+  queue: max
 
 jobs:
-  scan:
-    name: Full codebase security scan
+  prepare:
+    name: Prepare selected scan matrix
     runs-on: ubuntu-latest
-    timeout-minutes: 60
 
-    env:
-      DEFAULT_PROMPT_PATH: "resources/specs/claude-security-scan.md"
+    outputs:
+      target_ref: ${{ steps.plan.outputs.target_ref }}
+      matrix: ${{ steps.plan.outputs.matrix }}
+      has_scans: ${{ steps.plan.outputs.has_scans }}
 
     steps:
-      - name: Resolve scan inputs
-        id: vars
+      - name: Resolve scan inputs and build matrix
+        id: plan
         shell: bash
         run: |
+          set -euo pipefail
+
           if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
-            PROMPT_PATH="${{ inputs.prompt_path }}"
             TARGET_REF="${{ inputs.target_ref }}"
+            RUN_COMMON_MISC="${{ inputs.common_misc }}"
+            RUN_MONGOOSE_CORE="${{ inputs.mongoose_core }}"
+            RUN_WEB_HTTP_AUTH="${{ inputs.web_http_auth }}"
+            RUN_TLS="${{ inputs.tls }}"
+            RUN_NET_BUILTIN="${{ inputs.net_builtin }}"
+            RUN_PROTOCOLS="${{ inputs.protocols }}"
           else
-            PROMPT_PATH="${DEFAULT_PROMPT_PATH}"
             TARGET_REF=""
+            RUN_COMMON_MISC="true"
+            RUN_MONGOOSE_CORE="true"
+            RUN_WEB_HTTP_AUTH="true"
+            RUN_TLS="true"
+            RUN_NET_BUILTIN="true"
+            RUN_PROTOCOLS="true"
           fi
 
           if [ -z "$TARGET_REF" ]; then
             TARGET_REF="${{ github.ref }}"
           fi
 
-          echo "prompt_path=$PROMPT_PATH" >> "$GITHUB_OUTPUT"
-          echo "target_ref=$TARGET_REF" >> "$GITHUB_OUTPUT"
+          MATRIX="$(jq -cn \
+            --arg common_misc "$RUN_COMMON_MISC" \
+            --arg mongoose_core "$RUN_MONGOOSE_CORE" \
+            --arg web_http_auth "$RUN_WEB_HTTP_AUTH" \
+            --arg tls "$RUN_TLS" \
+            --arg net_builtin "$RUN_NET_BUILTIN" \
+            --arg protocols "$RUN_PROTOCOLS" \
+            '{
+              include: ([
+                {
+                  enabled: ($common_misc == "true"),
+                  area: "common_misc",
+                  display_name: "Common / Misc",
+                  area_prompt: "resources/specs/areas/common_misc.md"
+                },
+                {
+                  enabled: ($mongoose_core == "true"),
+                  area: "mongoose_core",
+                  display_name: "Mongoose Core",
+                  area_prompt: "resources/specs/areas/mongoose_core.md"
+                },
+                {
+                  enabled: ($web_http_auth == "true"),
+                  area: "web_http_auth",
+                  display_name: "Web / HTTP / Auth",
+                  area_prompt: "resources/specs/areas/web_http_auth.md"
+                },
+                {
+                  enabled: ($tls == "true"),
+                  area: "tls",
+                  display_name: "TLS",
+                  area_prompt: "resources/specs/areas/tls.md"
+                },
+                {
+                  enabled: ($net_builtin == "true"),
+                  area: "net_builtin",
+                  display_name: "Built-In Network",
+                  area_prompt: "resources/specs/areas/net_builtin.md"
+                },
+                {
+                  enabled: ($protocols == "true"),
+                  area: "protocols",
+                  display_name: "Protocols",
+                  area_prompt: "resources/specs/areas/protocols.md"
+                }
+              ] | map(select(.enabled)) | map(del(.enabled)))
+            }'
+          )"
 
+          HAS_SCANS="$(jq -r '.include | length > 0' <<< "$MATRIX")"
+
+          echo "target_ref=$TARGET_REF" >> "$GITHUB_OUTPUT"
+          echo "matrix=$MATRIX" >> "$GITHUB_OUTPUT"
+          echo "has_scans=$HAS_SCANS" >> "$GITHUB_OUTPUT"
+
+  scan:
+    name: ${{ matrix.display_name }} security scan
+    needs: prepare
+    if: needs.prepare.outputs.has_scans == 'true'
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+
+    strategy:
+      fail-fast: false
+      max-parallel: 1
+      matrix: ${{ fromJSON(needs.prepare.outputs.matrix) }}
+
+    env:
+      MASTER_PROMPT_PATH: "resources/specs/claude-security-scan.md"
+      FILTERING_PROMPT_PATH: "resources/specs/claude-false-positive-filtering.md"
+      SCAN_AREA: ${{ matrix.area }}
+      AREA_PROMPT_PATH: ${{ matrix.area_prompt }}
+
+    steps:
       - name: Checkout repository
         uses: actions/checkout@v6
         with:
-          ref: ${{ steps.vars.outputs.target_ref }}
+          ref: ${{ needs.prepare.outputs.target_ref }}
           fetch-depth: 0
 
-      - name: Verify prompt file exists
+      - name: Verify required prompt files exist
         shell: bash
         run: |
-          test -f "${{ steps.vars.outputs.prompt_path }}" || {
-            echo "Prompt file not found: ${{ steps.vars.outputs.prompt_path }}"
-            exit 1
-          }
+          for prompt_file in "$MASTER_PROMPT_PATH" "$AREA_PROMPT_PATH" "$FILTERING_PROMPT_PATH"; do
+            test -f "$prompt_file" || {
+              echo "Required prompt file not found: $prompt_file"
+              exit 1
+            }
+          done
 
-      - name: Run Claude full codebase security scan
+      - name: Run Claude ${{ matrix.display_name }} security scan
         id: claude_scan
         uses: anthropics/claude-code-action@v1
+        timeout-minutes: 30
         with:
           anthropic_api_key: ${{ secrets.CLAUDE_API_KEY }}
 
           prompt: |
             REPO: ${{ github.repository }}
-            REF: ${{ steps.vars.outputs.target_ref }}
-            PROMPT_FILE: ${{ steps.vars.outputs.prompt_path }}
+            REF: ${{ needs.prepare.outputs.target_ref }}
+            MASTER_PROMPT_FILE: ${{ env.MASTER_PROMPT_PATH }}
+            SCAN_AREA: ${{ matrix.area }}
+            AREA_PROMPT_FILE: ${{ matrix.area_prompt }}
+            FILTERING_PROMPT_FILE: ${{ env.FILTERING_PROMPT_PATH }}
 
-            You are running a full-codebase security scan in GitHub Actions.
+            You are running a focused security scan for the assigned area in GitHub Actions.
 
-            First, read the main prompt file at:
-            ${{ steps.vars.outputs.prompt_path }}
+            First, read the master prompt at ${{ env.MASTER_PROMPT_PATH }}.
+            Then read the assigned area prompt at ${{ matrix.area_prompt }}.
+            Read the false-positive filtering prompt at ${{ env.FILTERING_PROMPT_PATH }} as required by the master prompt.
 
-            Treat that file as the authoritative security-review instruction set. You will also
-            read and analyze additional prompt files mentioned in the main prompt file by their absolute paths in the repo, 
-            as per the instructions found in it.
+            Perform the security review for the ${{ matrix.area }} area. Follow relevant supporting code when necessary, but do not independently scan unrelated areas.
+            Return only the JSON required by the master prompt.
 
-            Scan the checked-out repository as a whole codebase.
             Do not modify files.
             Do not create commits.
             Do not open pull requests.
@@ -94,9 +210,8 @@ jobs:
             Do not create GitHub issues.
 
           claude_args: |
-            --max-turns 20
             --allowedTools "Read,Glob,Grep,Bash(git:*),Bash(find:*),Bash(grep:*),Bash(sed:*),Bash(cat:*)"
-            --model claude-opus-4-8
+            --model claude-opus-5
 
       - name: Prepare private security scan outputs
         if: always() && steps.claude_scan.outputs.execution_file != ''
@@ -106,8 +221,8 @@ jobs:
           set -u
           mkdir -p private-scan-results
           TODAY="$(date -u +%Y%m%d)"
-          EXECUTION_OUTPUT_FILE="claude-execution-output_${TODAY}.json"
-          FINDINGS_FILE="security-findings_${TODAY}.json"
+          EXECUTION_OUTPUT_FILE="claude-execution-output_${SCAN_AREA}_${TODAY}.json"
+          FINDINGS_FILE="security-findings_${SCAN_AREA}_${TODAY}.json"
 
           HAS_EXECUTION_OUTPUT="false"
           HAS_JSON_FINDINGS="false"
@@ -177,5 +292,5 @@ jobs:
             exit 0
           fi
 
-          git commit -m "Add security scan results ${{ steps.prepare_outputs.outputs.date_suffix }}"
+          git commit -m "Add ${SCAN_AREA} security scan results ${{ steps.prepare_outputs.outputs.date_suffix }}"
           git push

.github/workflows/claude-pr-security-review.yml

@@ -1,9 +1,6 @@
 name: Claude PR Security Review
 
 on:
-  pull_request:
-    types: [opened]
-
   workflow_dispatch:
     inputs:
       pr_number:
@@ -22,7 +19,7 @@ permissions:
   issues: write
 
 concurrency:
-  group: claude-pr-security-review-${{ github.event.pull_request.number || inputs.pr_number }}
+  group: claude-pr-security-review-${{ inputs.pr_number }}
   cancel-in-progress: false
 
 jobs:
@@ -33,7 +30,7 @@ jobs:
 
     env:
       GH_TOKEN: ${{ github.token }}
-      PR_NUMBER: ${{ github.event.pull_request.number || inputs.pr_number }}
+      PR_NUMBER: ${{ inputs.pr_number }}
 
     steps:
       - name: Resolve workflow variables
@@ -111,4 +108,4 @@ jobs:
 
           claude_args: |
             --allowedTools "Read,Bash(cat:*),Bash(gh pr diff:*),Bash(gh pr view:*),Bash(gh pr comment:*)"
-            --model claude-opus-4-8
+            --model claude-opus-5

.github/workflows/fuzz.yml

@@ -12,13 +12,99 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        target: [fuzz, fuzz_tls]
-    name: ${{ matrix.target }}
+        ipv6: [0, 1] # fuzz code always feeds IPv6, so this fuzzes ignoring while going parallel in sync
+    name: fuzz IPV6=${{ matrix.ipv6 }}
+    env:
+      TFLAGS: -DMG_ENABLE_IPV6=${{ matrix.ipv6 }}
     steps:
     - uses: actions/checkout@v5
       with: { fetch-depth: 2 }
-    - run: make -C test ${{ matrix.target }} ARGS="-max_total_time=14400"
+    - name: Restore Combined Fuzzing Corpus
+      uses: dawidd6/action-download-artifact@v21
+      with:
+        name: combined-fuzz-corpus
+        path: test/corpus_dir
+        branch: ${{ github.base_ref || github.ref_name }}
+        search_artifacts: true
+        if_no_artifact_found: warn
+    - name: Run Matrix Fuzzers
+      run: mkdir -p test/corpus_dir && make -C test fuzz ARGS="corpus_dir -seed=${{ github.run_id }} -max_total_time=14400"
+    # Keep failures split by matrix leg so the offending input is easy to find.
+    - name: Upload Fuzz Failure Artifacts
+      if: failure()
+      uses: actions/upload-artifact@v7
+      with:
+        name: fuzz-failure-ipv6-${{ matrix.ipv6 }}
+        path: |
+          test/corpus_dir
+          test/crash-*
+          test/leak-*
+          test/oom-*
+          test/timeout-*
+        if-no-files-found: ignore
+        retention-days: 14
+    # v4 artifacts are immutable, so each parallel leg uploads its own corpus.
+    - name: Upload Corpus Shard
+      uses: actions/upload-artifact@v7
+      with:
+        name: fuzz-corpus-ipv6-${{ matrix.ipv6 }}
+        path: test/corpus_dir
+        retention-days: 14
 
-# as we're not getting access to test units causing a problem, convert from the log:
+  merge_fuzz_corpus:
+    runs-on: ubuntu-latest
+    needs: fuzz
+    name: merge fuzz corpus
+    steps:
+    # Merge both parallel fuzzing corpuses into the shared seed for next run.
+    - name: Merge Corpus Shards
+      uses: actions/upload-artifact/merge@v7
+      with:
+        name: combined-fuzz-corpus
+        pattern: fuzz-corpus-ipv6-*
+        delete-merged: true
+        retention-days: 14
+  # see NOTE
+
+  fuzz_tls:
+    runs-on: ubuntu-latest
+    name: fuzz_tls
+    env:
+      TFLAGS: -DMG_ENABLE_IPV6=0
+    steps:
+    - uses: actions/checkout@v5
+      with: { fetch-depth: 2 }
+    - name: Restore Fuzzing Corpus
+      uses: actions/cache/restore@v6
+      with:
+        path: test/corpus_dir
+        key: fuzz-corpus-${{ github.head_ref || github.ref_name }}-${{ github.run_id }}
+        restore-keys: |
+          fuzz-corpus-${{ github.head_ref || github.ref_name }}-
+          fuzz-corpus-main-
+          fuzz-corpus-
+    - name: Run Fuzzer
+      run: mkdir -p test/corpus_dir && make -C test fuzz_tls ARGS="corpus_dir -seed=${{ github.run_id }} -max_total_time=14400"
+    - name: Upload Fuzz TLS Failure Artifacts
+      if: failure()
+      uses: actions/upload-artifact@v7
+      with:
+        name: fuzz-tls-failure-artifacts
+        path: |
+          test/corpus_dir
+          test/crash-*
+          test/leak-*
+          test/oom-*
+          test/timeout-*
+        if-no-files-found: ignore
+        retention-days: 14
+    - name: Save Updated Corpus to Cache
+      uses: actions/cache/save@v6
+      with:
+        path: test/corpus_dir
+        key: fuzz-corpus-${{ github.head_ref || github.ref_name }}-${{ github.run_id }}
+
+# NOTE
+# In case we can't get access to test units causing a problem, convert from the log:
 # base64 -d > dataofdeath
 # then paste the base64 data, enter, Ctrl-D; maybe check with hexdump -C dataofdeath

.github/workflows/nightly.yml

@@ -1,7 +1,7 @@
 name: Full build
 on:
   schedule:
-    - cron: '0 22 * * *' # run at 10 PM UTC
+    - cron: '17 22 * * *' # run at 10:17 PM UTC
   # Allow manual runs
   workflow_dispatch:
 env:
@@ -51,6 +51,25 @@ jobs:
         cat log
         test/health.awk < log > json
         scp -o "StrictHostKeyChecking=no" json "root@176.9.217.245:/data/downloads/health/linux_${{ matrix.target }}_${{ matrix.cc }}_${{ matrix.ssl }}_${{ matrix.select }}_$(date +"%Y%m%d").json"
+
+  c89:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        target: [diabish, ppc_diabish]
+        ssl: ["", BUILTIN]
+    name: C89 ${{ matrix.target }} SSL=${{ matrix.ssl }}
+    env:
+      SSL: ${{ matrix.ssl }}
+      TFLAGS: -DMG_ENABLE_POLL=0 -DMG_ENABLE_EPOLL=0 -DMG_ENABLE_CHACHA20=0 -DMQTT_LOCALHOST -DNO_ZU_TEST
+    steps:
+    - uses: actions/checkout@v5
+      with: { fetch-depth: 2 }
+    - run: | # GH runners seem to overflow the 32-bit FS for the QEMU PPC (works for me in RHEL9)
+        if [[ "${{ matrix.target }}" = ppc_* ]]; then export TFLAGS="$TFLAGS -D_FILE_OFFSET_BITS=64"; fi
+        sudo apt -y update ; sudo apt -y install binfmt-support qemu-user-static && ./test/setup_mqtt_server.sh && docker run --rm --privileged multiarch/qemu-user-static --reset -p yes && make -C test ${{ matrix.target }}
+
   mip:
     runs-on: ubuntu-latest
     strategy:
@@ -59,10 +78,6 @@ jobs:
         cc: [gcc, clang, g++, clang++]
         target: [mip_test, mip_tap_test]
         ssl: ["", BUILTIN, MBEDTLS, OPENSSL, WOLFSSL]
-        # #3226: built-in TCP is currently not working with WolfSSL (builds fine)
-        exclude:
-        - ssl: WOLFSSL
-          target: mip_tap_test
     name: ${{ matrix.target }} CC=${{ matrix.cc }} SSL=${{ matrix.ssl }}
     env:
       CC: ${{ matrix.cc }}
@@ -75,6 +90,26 @@ jobs:
     - uses: webfactory/ssh-agent@v0.10.0
       with:
             ssh-private-key: ${{ secrets.HEALTH_TESTS_SSH_KEY }}
+    # WolfSSL version (5.6.6) in current GH runner (Ubuntu 24.04) is broken for EC
+    # https://github.com/wolfSSL/wolfssl/pull/10065
+    - name: Build non-broken WolfSSL version
+      if: matrix.ssl == 'WOLFSSL'
+      run: |
+        sudo apt -y update
+        sudo apt -y install autoconf automake libtool
+        git clone --depth 1 --branch v5.9.1-stable https://github.com/wolfSSL/wolfssl
+        cd wolfssl
+        ./autogen.sh
+        ./configure --prefix="$GITHUB_WORKSPACE/wolfssl-install" --enable-all
+        make -j"$(nproc)"
+        make install
+        echo "WOLFSSL=$GITHUB_WORKSPACE/wolfssl-install" >> "$GITHUB_ENV"
+        echo "LD_LIBRARY_PATH=$GITHUB_WORKSPACE/wolfssl-install/lib${LD_LIBRARY_PATH:+:$LD_LIBRARY_PATH}" >> "$GITHUB_ENV"
+        if [ "${{ matrix.cc }}" = "g++" ] || [ "${{ matrix.cc }}" = "clang++" ]; then
+          echo "TFLAGS=$TFLAGS -DWOLFSSL_USE_OPTIONS_H -Wno-pedantic" >> "$GITHUB_ENV"
+        else
+          echo "TFLAGS=$TFLAGS -DWOLFSSL_USE_OPTIONS_H" >> "$GITHUB_ENV"
+        fi
     - run: if [ "${{ matrix.target }}" == "mip_tap_test" ]; then source ./test/setup_ga_network.sh ; sed -i -e "s/127.0.0.1//" test/mosquitto.conf; cat test/mosquitto.conf; ./test/setup_mqtt_server.sh; fi && sudo apt -y update ; sudo apt -y install libmbedtls-dev libwolfssl-dev && make -C test ${{ matrix.target }} > log
     - if: success() || failure()
       run: |
@@ -82,18 +117,231 @@ jobs:
         test/health.awk < log > json
         scp -o "StrictHostKeyChecking=no" json "root@176.9.217.245:/data/downloads/health/${{ matrix.target }}_${{ matrix.cc }}_${{ matrix.ssl }}_$(date +"%Y%m%d").json"
 
+  miprtx:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        ssl: ["", BUILTIN]
+    name: MIP RTX TAP SSL=${{ matrix.ssl }}
+    env:
+      IPV6: 0
+      RTX: 1
+      SSL: ${{ matrix.ssl }}
+      TFLAGS: -DMQTT_HOST -DIPV6_NOROUTING -DNO_ABORT
+    steps:
+    - uses: actions/checkout@v5
+      with: { fetch-depth: 2 }
+    - run: |
+        source ./test/setup_ga_network.sh ; sed -i -e "s/127.0.0.1//" test/mosquitto.conf ; ./test/setup_mqtt_server.sh
+        make -C test mip_tap_test
+
   mip89:
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
-      max-parallel: 1   # no parallel runs, to minimize MQTT errors
       matrix:
-        target: [mip_vc98]
-    name: mip89 ${{ matrix.target }}
+        target: [mip_vc98, mip_diabish, mip_ppc_diabish]
+        ipv6: [0, 1]
+    name: MIP C89 ${{ matrix.target }} IPV6=${{ matrix.ipv6 }}
     steps:
     - uses: actions/checkout@v5
       with: { fetch-depth: 2 }
-    - run: make -C test ${{ matrix.target }} IPV6=1
+    - run: sudo apt -y update ; sudo apt -y install binfmt-support qemu-user-static && docker run --rm --privileged multiarch/qemu-user-static --reset -p yes && make -C test ${{ matrix.target }} IPV6=${{ matrix.ipv6 }}
+  mipbe:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        target: [mip_s390, mip_port_s390, mip_ppc, mip_port_ppc, mip_mips, mip_port_mips]
+        ipv6: [0, 1]
+        ssl: ["", BUILTIN]
+    name: MIP be ${{ matrix.target }} IPV6=${{ matrix.ipv6 }} SSL=${{ matrix.ssl }}
+    env:
+      TFLAGS: -DMQTT_HOST -DIPV6_NOROUTING
+    steps:
+    - uses: actions/checkout@v5
+      with: { fetch-depth: 2 }
+    - run: |
+        sudo apt -y update ; sudo apt -y install binfmt-support qemu-user-static && docker run --rm --privileged multiarch/qemu-user-static --reset -p yes
+        if [[ "${{ matrix.target }}" == *port* ]]; then source ./test/setup_ga_network.sh ; export ENV="-e Tmp=. -e WINEDEBUG=-all -e HOST_IP -e HOST_IPV6 -e HOST_IFC" ; sed -i -e "s/127.0.0.1//" test/mosquitto.conf; cat test/mosquitto.conf; ./test/setup_mqtt_server.sh ; make -C test port_tap_bridge ; test/port_tap_bridge & sleep 2 ; fi
+        make -C test ${{ matrix.target }} IPV6=${{ matrix.ipv6 }} SSL=${{ matrix.ssl }}
+
+  miprtxbe:
+    runs-on: ubuntu-latest
+    name: MIP RTX be s390 port
+    env:
+      IPV6: 0
+      RTX: 1
+      TFLAGS: -DMQTT_HOST -DIPV6_NOROUTING -DNO_ABORT
+    steps:
+    - uses: actions/checkout@v5
+      with: { fetch-depth: 2 }
+    - run: |
+        sudo apt -y update ; sudo apt -y install binfmt-support qemu-user-static && docker run --rm --privileged multiarch/qemu-user-static --reset -p yes
+        source ./test/setup_ga_network.sh ; export ENV="-e Tmp=. -e WINEDEBUG=-all -e HOST_IP -e HOST_IPV6 -e HOST_IFC -e RTX" ; sed -i -e "s/127.0.0.1//" test/mosquitto.conf ; ./test/setup_mqtt_server.sh ; make -C test port_tap_bridge ; test/port_tap_bridge & sleep 2
+        make -C test mip_port_s390
+
+  l2:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        cc: [gcc, clang, g++, clang++]
+        target: [eth_test, ppp_test]
+        ipv6: [0, 1]
+    name: L2 ${{ matrix.target }} CC=${{ matrix.cc }} IPV6=${{ matrix.ipv6 }}
+    steps:
+    - uses: actions/checkout@v5
+      with: { fetch-depth: 2 }
+    - uses: webfactory/ssh-agent@v0.10.0
+      with:
+            ssh-private-key: ${{ secrets.HEALTH_TESTS_SSH_KEY }}
+    - run: make -C test ${{ matrix.target }} IPV6=${{ matrix.ipv6 }} CC=${{ matrix.cc }} > log
+    - if: success() || failure()
+      run: |
+        cat log
+        test/health.awk < log > json
+        scp -o "StrictHostKeyChecking=no" json "root@176.9.217.245:/data/downloads/health/${{ matrix.target }}_${{ matrix.cc }}_${{ matrix.ipv6 }}_$(date +"%Y%m%d").json"
+  l289:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        target: [eth_vc98, ppp_vc98]
+        ipv6: [0, 1]
+    name: L2 C89 ${{ matrix.target }} IPV6=${{ matrix.ipv6 }}
+    steps:
+    - uses: actions/checkout@v5
+      with: { fetch-depth: 2 }
+    - run: make -C test ${{ matrix.target }} IPV6=${{ matrix.ipv6 }}
+  l2be:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        target: [eth_s390, ppp_s390]
+        ipv6: [0, 1]
+    name: L2 be ${{ matrix.target }} IPV6=${{ matrix.ipv6 }}
+    steps:
+    - uses: actions/checkout@v5
+      with: { fetch-depth: 2 }
+    - run: sudo apt -y update ; sudo apt -y install binfmt-support qemu-user-static && docker run --rm --privileged multiarch/qemu-user-static --reset -p yes && make -C test ${{ matrix.target }} IPV6=${{ matrix.ipv6 }}
+  pppoe_vlan: # run tests, build tests performed by the l2 job may not catch runtime alignment and protocol issues, etc.
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        cc: [gcc, clang, g++, clang++]
+        ipv6: [0, 1]
+    name: PPPoE over VLAN CC=${{ matrix.cc }} IPV6=${{ matrix.ipv6 }}
+    steps:
+    - uses: actions/checkout@v5
+      with: { fetch-depth: 2 }
+    - uses: webfactory/ssh-agent@v0.10.0
+      with:
+            ssh-private-key: ${{ secrets.HEALTH_TESTS_SSH_KEY }}
+    - run: |
+        source ./test/setup_ga_network.sh
+        make -C test pppoe_tap_test CC=${{ matrix.cc }} IPV6=${{ matrix.ipv6 }} > log
+    - if: success() || failure()
+      run: |
+        cat log
+        test/health.awk < log > json
+        scp -o "StrictHostKeyChecking=no" json "root@176.9.217.245:/data/downloads/health/pppoe-vlan_${{ matrix.cc }}_${{ matrix.ipv6 }}_$(date +"%Y%m%d").json"
+
+  atcmd:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        cc: [gcc, clang, g++, clang++]
+    name: ATcmd CC=${{ matrix.cc }}
+    env:
+      IPV6: 0 # makes no sense, shorten code
+    steps:
+    - uses: actions/checkout@v5
+      with: { fetch-depth: 2 }
+    - uses: webfactory/ssh-agent@v0.10.0
+      with:
+            ssh-private-key: ${{ secrets.HEALTH_TESTS_SSH_KEY }}
+    - run: make -C test atcmd_test CC=${{ matrix.cc }} > log
+    - if: success() || failure()
+      run: |
+        cat log
+        test/health.awk < log > json
+        scp -o "StrictHostKeyChecking=no" json "root@176.9.217.245:/data/downloads/health/ATcmd_${{ matrix.cc }}_$(date +"%Y%m%d").json"
+  atcmd89:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        target: [atcmd_vc98]
+    name: ATcmd C89 ${{ matrix.target }}
+    env:
+      IPV6: 0 # makes no sense, shorten code
+    steps:
+    - uses: actions/checkout@v5
+      with: { fetch-depth: 2 }
+    - run: make -C test ${{ matrix.target }}
+  atcmdbe:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        target: [atcmd_s390]
+    name: ATcmd be ${{ matrix.target }}
+    env:
+      IPV6: 0 # makes no sense, shorten code
+    steps:
+    - uses: actions/checkout@v5
+      with: { fetch-depth: 2 }
+    - run: sudo apt -y update ; sudo apt -y install binfmt-support qemu-user-static && docker run --rm --privileged multiarch/qemu-user-static --reset -p yes && make -C test ${{ matrix.target }}
+
+  bsd:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        target: [bsd, bsd_nortos]
+        cc: [gcc, clang, g++, clang++]
+    name: bsd CC=${{ matrix.cc }}
+    steps:
+    - uses: actions/checkout@v5
+      with: { fetch-depth: 2 }
+    - uses: webfactory/ssh-agent@v0.10.0
+      with:
+            ssh-private-key: ${{ secrets.HEALTH_TESTS_SSH_KEY }}
+    - run: |
+        source ./test/setup_ga_network.sh
+        make -C test/bsd shm_tap_bridge
+        test/bsd/shm_tap_bridge &
+        sleep 2
+        make -C test/bsd ${{ matrix.target }} CC=${{ matrix.cc }} > log
+    - if: success() || failure()
+      run: |
+        cat log
+        test/health.awk < log > json
+        scp -o "StrictHostKeyChecking=no" json "root@176.9.217.245:/data/downloads/health/bsd_${{ matrix.cc }}_$(date +"%Y%m%d").json"
+
+  bsdbe:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        target: [bsd_s390]
+    name: bsd be ${{ matrix.target }}
+    steps:
+    - uses: actions/checkout@v5
+      with: { fetch-depth: 2 }
+    - run: |
+        sudo apt -y update ; sudo apt -y install binfmt-support qemu-user-static && docker run --rm --privileged multiarch/qemu-user-static --reset -p yes
+        source ./test/setup_ga_network.sh
+        make -C test port_tap_bridge
+        test/port_tap_bridge &
+        sleep 2
+        make -C test/bsd ${{ matrix.target }}
+
   s390:
     runs-on: ubuntu-latest
     strategy:
@@ -106,7 +354,7 @@ jobs:
     steps:
     - uses: actions/checkout@v5
       with: { fetch-depth: 2 }
-    - run: sudo apt -y update ; sudo apt -y install binfmt-support qemu-user-static && ./test/setup_mqtt_server.sh && docker run --rm --privileged multiarch/qemu-user-static --reset -p yes && make -C test s390 SSL=${{ matrix.ssl }} MULTIREC=NO
+    - run: sudo apt -y update ; sudo apt -y install binfmt-support qemu-user-static && ./test/setup_mqtt_server.sh && docker run --rm --privileged multiarch/qemu-user-static --reset -p yes && make -C test s390 SSL=${{ matrix.ssl }}
   armhf:
     runs-on: ubuntu-latest
     strategy:
@@ -119,7 +367,7 @@ jobs:
     steps:
     - uses: actions/checkout@v5
       with: { fetch-depth: 2 }
-    - run: sudo apt -y update ; sudo apt -y install binfmt-support qemu-user-static && ./test/setup_mqtt_server.sh && docker run --rm --privileged multiarch/qemu-user-static --reset -p yes && make -C test armhf SSL=${{ matrix.ssl }} MULTIREC=NO
+    - run: sudo apt -y update ; sudo apt -y install binfmt-support qemu-user-static && ./test/setup_mqtt_server.sh && docker run --rm --privileged multiarch/qemu-user-static --reset -p yes && make -C test armhf SSL=${{ matrix.ssl }}
   unamalgamated-mg_prefix:
     runs-on: ubuntu-latest
     strategy:
@@ -156,8 +404,6 @@ jobs:
         exclude:
         - ssl: MBEDTLS
           select: -DMG_ENABLE_POLL=0
-        - ssl: MBEDTLS                # see issue#2694
-          select: -DMG_ENABLE_POLL=1
         - ssl: OPENSSL
           select: -DMG_ENABLE_POLL=0
         - ssl: WOLFSSL
@@ -188,7 +434,7 @@ jobs:
       fail-fast: false
       max-parallel: 1   # no parallel runs, to minimize MQTT errors
       matrix:
-        target: [vc98, vc17, vc22, mingw, mingw++]
+        target: [vc98, vc17, vc22, mingw, mingw++] # current mdash/mingw image compiler does not have support for %zu; test disabled below
         ssl: ["", BUILTIN]
         select: [-DMG_ENABLE_POLL=0, -DMG_ENABLE_POLL=1]
         exclude:
@@ -197,14 +443,14 @@ jobs:
     name: windows ${{ matrix.target }} SSL=${{ matrix.ssl }} TFLAGS=${{ matrix.select }}
     env:
       SSL: ${{ matrix.ssl }}
-      TFLAGS: ${{ matrix.select }} -DMQTT_LOCALHOST -DNO_ABORT
+      TFLAGS: ${{ matrix.select }} -DMQTT_LOCALHOST -DNO_ABORT 
     steps:
     - uses: actions/checkout@v5
       with: { fetch-depth: 2 }
     - uses: webfactory/ssh-agent@v0.10.0
       with:
             ssh-private-key: ${{ secrets.HEALTH_TESTS_SSH_KEY }}
-    - run: ./test/setup_mqtt_server.sh && make -C test ${{ matrix.target }} > log
+    - run: if [ "${{ matrix.target }}" == "mingw" ]; then export TFLAGS="$TFLAGS -DNO_ZU_TEST"; fi && ./test/setup_mqtt_server.sh && make -C test ${{ matrix.target }} > log
     - if: success() || failure()
       run: |
         cat log
@@ -318,41 +564,69 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        example:
-          - path: infineon/xmc47_relax-make-baremetal-builtin
-          - path: infineon/xmc_plt2go_4400-make-baremetal-builtin
-          - path: infineon/xmc72_evk-make-baremetal-builtin
-          - path: nxp/frdm-mcxn947-make-baremetal-builtin
-          - path: nxp/frdm-mcxn947-make-freertos-builtin
-          - path: nxp/rt1020-evk-make-baremetal-builtin
-          - path: nxp/rt1060-evk-make-baremetal-builtin
-          - path: nxp/rt1170-evk-make-baremetal-builtin
-          - path: rp/pico-w
-          - path: rp/w5500-evb-pico
-          - path: rp/w55rp20-evb-pico
-          - path: rp/pico-rndis
-          - path: stm32/nucleo-f429zi/minimal
-          - path: stm32/nucleo-f746zg/minimal
-          - path: stm32/nucleo-f746zg/minimal-pppoe
-          - path: stm32/nucleo-f756zg/minimal
-          - path: stm32/nucleo-h563zi/minimal
-          - path: stm32/nucleo-h723zg/minimal
-          - path: stm32/nucleo-h743zi/minimal
-          - path: stm32/nucleo-n657x0-q/minimal
-          - path: stm32/nucleo-u5a5zj-q/minimal
-          - path: stm32/portenta-h7/minimal
-          - path: stm32/stm32h573i-dk/minimal
-          - path: stm32/stm32h747i-disco/minimal
-          - path: ti/ek-tm4c1294xl-make-baremetal-builtin
-          - path: ti/ek-tm4c1294xl-make-freertos-builtin
-    name: ${{ matrix.example.path }}
+        include:
+          - group: infineon-nxp
+            examples: |
+              infineon/xmc47_relax-make-baremetal-builtin
+              infineon/xmc_plt2go_4400-make-baremetal-builtin
+              infineon/xmc72_evk-make-baremetal-builtin
+              nxp/frdm-imxrt1186/minimal
+              nxp/frdm-mcxe247/minimal
+              nxp/frdm-mcxn947/minimal
+              nxp/frdm-rw612/minimal
+              nxp/rt1060-evkb/minimal
+              nxp/rt1170-evkb/minimal
+          - group: rp-ti
+            examples: |
+              rp/pico-w
+              rp/w5500-evb-pico
+              rp/w55rp20-evb-pico
+              rp/pico-rndis
+              ti/ek-tm4c1294xl-make-baremetal-builtin
+              ti/ek-tm4c1294xl-make-freertos-builtin
+          - group: stm32-1
+            examples: |
+              stm32/nucleo-f429zi/minimal
+              stm32/nucleo-f746zg/minimal
+              stm32/nucleo-f746zg/minimal-pppoe
+              stm32/nucleo-f756zg/minimal
+              stm32/nucleo-h723zg/minimal
+              stm32/nucleo-h723zg/minimal-bsd-baremetal
+              stm32/nucleo-h723zg/minimal-bsd-freertos
+          - group: stm32-2
+            examples: |
+              stm32/nucleo-h563zi/minimal
+              stm32/nucleo-h743zi/minimal
+              stm32/nucleo-n657x0-q/minimal
+              stm32/nucleo-u5a5zj-q/minimal
+              stm32/portenta-h7/minimal
+              stm32/stm32h573i-dk/minimal
+              stm32/stm32h747i-disco/minimal
+    name: wizard ARM ${{ matrix.group }}
     env:
       GO: 0
     steps:
       - uses: actions/checkout@v5
         with: { fetch-depth: 2 }
       - run: sudo apt -y update && sudo apt -y install gcc-arm-none-eabi
-      - run: make -C tutorials/${{ matrix.example.path }} build
+      - run: |
+          failed=0
+          sep=
+          examples='${{ matrix.examples }}'
+          for x in $examples; do
+            echo "========== $x =========="
+            if make -C "tutorials/$x" build; then
+              ok=true
+              echo "SUCCESS: $x"
+            else
+              ok=false
+              failed=1
+              echo "FAILURE: $x"
+            fi
+            printf 'HEALTH_DASHBOARD\t%s"%s": %s\n' "$sep" "$x" "$ok"
+            sep=,
+          done
+          exit $failed
 
 
   generic_examples:
@@ -362,8 +636,7 @@ jobs:
       matrix:
         example:
           - path: micropython/esp32
-          - path: http/uart-bridge/esp32
-          - path: http/http-client/esp8266/http-client-server
+          - path: esp32/uart-bridge
     name: ${{ matrix.example.path }}
     env:
       GO: 0
@@ -378,40 +651,41 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        example:
-          - path: mqtt/mqtt-client/microchip/same54-xpro
-          - path: nxp/nxp-frdmk66f-freertos
-          - path: nxp/nxp-lpcxpresso54s018m-freertos
-          - path: nxp/nxp-mimxrt1020-freertos
-          - path: nxp/nxp-evkbimxrt1050-lwip-freertos
-          - path: nxp/nxp-evkmimxrt1020-lwip-freertos
-          - path: nxp/nxp-evkmimxrt1024-lwip-freertos
-          - path: nxp/nxp-evkmimxrt1060-lwip-freertos
-          - path: nxp/nxp-evkmimxrt1064-lwip-freertos
-          - path: nxp/nxp-evkmimxrt1160-cm7-lwip-freertos
-          - path: nxp/nxp-evkmimxrt1170-cm7-lwip-freertos
-          - path: nxp/nxp-frdmk64f-lwip-freertos
-          - path: nxp/nxp-frdmk66f-lwip-freertos
-          - path: nxp/nxp-lpcxpresso54018-lwip-freertos
-          - path: nxp/nxp-lpcxpresso54608-lwip-freertos
-          - path: nxp/nxp-lpcxpresso54618-lwip-freertos
-          - path: nxp/nxp-lpcxpresso54628-lwip-freertos
-          - path: nxp/nxp-twrk65f180m-lwip-freertos
-          - path: nxp/nxp-twrkv58f220m-lwip-freertos
-          - path: rp/pico-rmii
-          - path: stm32/nucleo-f746zg/minimal-rm2
-          - path: stm32/nucleo-f746zg/minimal-rndis
-          - path: stm32/nucleo-f429zi/minimal-rm2
-          - path: stm32/nucleo-f429zi/minimal-rndis
-          - path: stm32/nucleo-g031k8/minimal-w5500
-          - path: ti/ti-ek-tm4c1294xl-http-server
-          - path: ti/ek-tm4c1294xl-make-baremetal-builtin-rndis
-    name: ${{ matrix.example.path }}
+        include:
+          - group: other
+            examples: |
+              microchip/same54-xpro/mqtt-client
+              rp/pico-rmii
+              stm32/nucleo-f746zg/minimal-rm2
+              stm32/nucleo-f746zg/minimal-rndis
+              stm32/nucleo-f429zi/minimal-rm2
+              stm32/nucleo-f429zi/minimal-rndis
+              stm32/nucleo-g031k8/minimal-w5500
+              ti/ti-ek-tm4c1294xl-http-server
+              ti/ek-tm4c1294xl-make-baremetal-builtin-rndis
+    name: generic ARM ${{ matrix.group }}
     steps:
       - uses: actions/checkout@v5
         with: { fetch-depth: 2 }
       - run: sudo apt -y update && sudo apt -y install gcc-arm-none-eabi
-      - run: make -C tutorials/${{ matrix.example.path }} build
+      - run: |
+          failed=0
+          sep=
+          examples='${{ matrix.examples }}'
+          for x in $examples; do
+            echo "========== $x =========="
+            if make -C "tutorials/$x" build; then
+              ok=true
+              echo "SUCCESS: $x"
+            else
+              ok=false
+              failed=1
+              echo "FAILURE: $x"
+            fi
+            printf 'HEALTH_DASHBOARD\t%s"%s": %s\n' "$sep" "$x" "$ok"
+            sep=,
+          done
+          exit $failed
 
   device_dashboard_examples:
     runs-on: ubuntu-latest
@@ -419,13 +693,13 @@ jobs:
       fail-fast: false
       matrix:
         example:
-          - path: esp32
+          - path: esp32/device-dashboard
     name: ${{ matrix.example.path }}
     steps:
       - uses: actions/checkout@v5
         with: { fetch-depth: 2 }
       - run: echo # nothing specific to install or do
-      - run: make -C tutorials/http/device-dashboard/${{ matrix.example.path }} build
+      - run: make -C tutorials/${{ matrix.example.path }} build
 
 
   device_dashboard_examples_arm:
@@ -433,33 +707,54 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        ssl: ["", -DMG_TLS=MG_TLS_BUILTIN]
-        example:
-          - path: http/device-dashboard/microchip/same54-xpro
-          - path: nxp/rt1020-evk-make-freertos-builtin
-          - path: nxp/rt1060-evk-make-freertos-builtin
-          - path: nxp/rt1170-evk-make-freertos-builtin
-          - path: renesas/ek-ra6m4-make-baremetal-builtin
-    name: ${{ matrix.example.path }} ${{ matrix.ssl }}
+        include:
+          - group: none
+            cflags: ""
+            examples: |
+              microchip/same54-xpro/device-dashboard
+              renesas/ek-ra6m4-make-baremetal-builtin
+          - group: builtin
+            cflags: -DMG_TLS=MG_TLS_BUILTIN
+            examples: |
+              microchip/same54-xpro/device-dashboard
+              renesas/ek-ra6m4-make-baremetal-builtin
+    name: device dashboard ARM ${{ matrix.group }}
     steps:
       - uses: actions/checkout@v5
         with: { fetch-depth: 2 }
       - run: sudo apt -y update && sudo apt -y install gcc-arm-none-eabi
-      - run: make -C tutorials/${{ matrix.example.path }} build CFLAGS_EXTRA="${{ matrix.ssl }}"
+      - run: |
+          failed=0
+          sep=
+          examples='${{ matrix.examples }}'
+          for x in $examples; do
+            echo "========== $x =========="
+            if make -C "tutorials/$x" build CFLAGS_EXTRA="${{ matrix.cflags }}"; then
+              ok=true
+              echo "SUCCESS: $x"
+            else
+              ok=false
+              failed=1
+              echo "FAILURE: $x"
+            fi
+            printf 'HEALTH_DASHBOARD\t%s"%s": %s\n' "$sep" "$x" "$ok"
+            sep=,
+          done
+          exit $failed
 
-#  mqtt_dashboard_examples:
-#    runs-on: ubuntu-latest
-#    strategy:
-#      fail-fast: false
-#      matrix:
-#        example:
-#          - path:
-#    name: ${{ matrix.example.path }}
-#    steps:
-#      - uses: actions/checkout@v5
-#        with: { fetch-depth: 2 }
-#      - run: echo # nothing specific to install or do
-#      - run: make -C tutorials/${{ matrix.example.path }} build
+  mqtt_dashboard_examples_arm:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        example:
+          - path: rp/pico-rndis-device
+    name: ${{ matrix.example.path }}
+    steps:
+      - uses: actions/checkout@v5
+        with: { fetch-depth: 2 }
+      - run: sudo apt -y update && sudo apt -y install gcc-arm-none-eabi
+      - run: make -C tutorials/${{ matrix.example.path }} build
 
 
 #  dual_examples:

.github/workflows/nightly_retry.yml

@@ -0,0 +1,23 @@
+name: Retry failed nightly jobs
+on:
+  schedule:
+    - cron: '17 2 * * *'
+  workflow_dispatch:
+permissions:
+  actions: write
+jobs:
+  retry:
+    runs-on: ubuntu-latest
+    steps:
+    - env:
+        GH_TOKEN: ${{ github.token }}
+      run: |
+        min=$(date -u -d '5 hours ago' +%s)
+        max=$(date -u -d '2 hours ago' +%s)
+        gh api --paginate "/repos/$GITHUB_REPOSITORY/actions/workflows/nightly.yml/runs?status=failure&per_page=100" --jq '.workflow_runs[] | select(.run_attempt == 1) | [.id, .created_at] | @tsv' |
+          while IFS=$'\t' read -r id updated; do
+            when=$(date -u -d "$updated" +%s)
+            if [ "$when" -ge "$min" ] && [ "$when" -le "$max" ]; then
+              gh api --method POST "/repos/$GITHUB_REPOSITORY/actions/runs/$id/rerun-failed-jobs"
+            fi
+          done

.github/workflows/nightly_tests.yml

@@ -53,16 +53,6 @@ jobs:
       run: sudo apt -y update && sudo apt -y install gcc-arm-none-eabi
     - run: make -C tutorials/stm32/nucleo-h563zi/minimal test VCON_API_KEY=${{secrets.VCON_API_KEY}}
 
-  test_rt1020:
-    runs-on: ubuntu-latest
-    steps:
-    - uses: actions/checkout@v5
-      with: { fetch-depth: 3 }
-    - name: baremetal
-      run: sudo apt -y update && sudo apt -y install gcc-arm-none-eabi
-    - run: make -C tutorials/nxp/rt1020-evk-make-baremetal-builtin test VCON_API_KEY=${{secrets.VCON_API_KEY}}
-    - run: make -C tutorials/nxp/rt1020-evk-make-freertos-builtin test VCON_API_KEY=${{secrets.VCON_API_KEY}}
-
   test_rt1060:
     runs-on: ubuntu-latest
     steps:
@@ -70,8 +60,7 @@ jobs:
       with: { fetch-depth: 3 }
     - name: baremetal
       run: sudo apt -y update && sudo apt -y install gcc-arm-none-eabi
-    - run: make -C tutorials/nxp/rt1060-evk-make-baremetal-builtin test VCON_API_KEY=${{secrets.VCON_API_KEY}}
-    - run: make -C tutorials/nxp/rt1060-evk-make-freertos-builtin test VCON_API_KEY=${{secrets.VCON_API_KEY}}
+    - run: make -C tutorials/nxp/rt1060-evkb/minimal build
 
   test_rt1170:
     runs-on: ubuntu-latest
@@ -80,8 +69,7 @@ jobs:
       with: { fetch-depth: 3 }
     - name: baremetal
       run: sudo apt -y update && sudo apt -y install gcc-arm-none-eabi
-    - run: make -C tutorials/nxp/rt1170-evk-make-baremetal-builtin test VCON_API_KEY=${{secrets.VCON_API_KEY}}
-    - run: make -C tutorials/nxp/rt1170-evk-make-freertos-builtin test VCON_API_KEY=${{secrets.VCON_API_KEY}}
+    - run: make -C tutorials/nxp/rt1170-evkb/minimal build
 
   test_ra6m4:
     runs-on: ubuntu-latest
@@ -110,8 +98,8 @@ jobs:
       with: { fetch-depth: 2 }
     - name: baremetal
       run: sudo apt -y update && sudo apt -y install gcc-arm-none-eabi
-    - run:  make -C tutorials/http/device-dashboard/microchip/same54-xpro test VCON_API_KEY=${{secrets.VCON_API_KEY}}
-    - run:  make -C tutorials/mqtt/mqtt-client/microchip/same54-xpro test VCON_API_KEY=${{secrets.VCON_API_KEY}}
+    - run:  make -C tutorials/microchip/same54-xpro/device-dashboard test VCON_API_KEY=${{secrets.VCON_API_KEY}}
+    - run:  make -C tutorials/microchip/same54-xpro/mqtt-client test VCON_API_KEY=${{secrets.VCON_API_KEY}}
 
   test_pico_w5500:
     runs-on: ubuntu-latest

.github/workflows/on_demand.yml

@@ -4,35 +4,47 @@ on:
 env:
   IPV6: 0
 jobs:
-  mip:
+  atcmd:
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
       matrix:
-        cc: [gcc]
-        target: [mip_tap_test]
-        ssl: ["", BUILTIN, MBEDTLS, OPENSSL, WOLFSSL]
-        # #3226: built-in TCP is currently not working with WolfSSL (builds fine)
-        exclude:
-        - ssl: WOLFSSL
-          target: mip_tap_test
-    name: ${{ matrix.target }} CC=${{ matrix.cc }} SSL=${{ matrix.ssl }}
-    env:
-      CC: ${{ matrix.cc }}
-      SSL: ${{ matrix.ssl }}
-      TFLAGS: -DMQTT_HOST -DIPV6_NOROUTING -DNO_ABORT  # -DMQTT_HOST_NAME=\"server\"
+        cc: [gcc, clang, g++, clang++]
+    name: ATcmd CC=${{ matrix.cc }}
     steps:
     - uses: actions/checkout@v5
       with: { fetch-depth: 2 }
     - uses: webfactory/ssh-agent@v0.10.0
       with:
             ssh-private-key: ${{ secrets.HEALTH_TESTS_SSH_KEY }}
-    - run: if [ "${{ matrix.target }}" == "mip_tap_test" ]; then source ./test/setup_ga_network.sh ; export IPV6=1; sed -i -e "s/127.0.0.1//" test/mosquitto.conf; cat test/mosquitto.conf; ./test/setup_mqtt_server.sh; else export IPV6=1 ; fi && sudo apt -y update ; sudo apt -y install libmbedtls-dev libwolfssl-dev && make -C test ${{ matrix.target }} > log
+    - run: make -C test atcmd_test CC=${{ matrix.cc }} > log
     - if: success() || failure()
       run: |
         cat log
         test/health.awk < log > json
-        scp -o "StrictHostKeyChecking=no" json "root@176.9.217.245:/data/downloads/health/${{ matrix.target }}_${{ matrix.cc }}_${{ matrix.ssl }}_$(date +"%Y%m%d").json"
+        scp -o "StrictHostKeyChecking=no" json "root@176.9.217.245:/data/downloads/health/atcmd_${{ matrix.cc }}_$(date +"%Y%m%d").json"
+  atcmd89:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        target: [atcmd_vc98]
+    name: ATcmd C89 ${{ matrix.target }}
+    steps:
+    - uses: actions/checkout@v5
+      with: { fetch-depth: 2 }
+    - run: make -C test ${{ matrix.target }}
+  atcmdbe:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        target: [atcmd_s390]
+    name: ATcmd be ${{ matrix.target }}
+    steps:
+    - uses: actions/checkout@v5
+      with: { fetch-depth: 2 }
+    - run: sudo apt -y update ; sudo apt -y install binfmt-support qemu-user-static && docker run --rm --privileged multiarch/qemu-user-static --reset -p yes && make -C test ${{ matrix.target }}
 
 
 #  macos:

.github/workflows/quicktest.yml

@@ -16,8 +16,13 @@ jobs:
       fail-fast: false
       matrix:
         cc: [gcc, clang++]
-        target: [test, mip_test]
+        target: [test, mip_test, eth_test, ppp_test]
         ssl: ["", BUILTIN]
+        exclude:
+        - target: eth_test
+          ssl: BUILTIN
+        - target: ppp_test
+          ssl: BUILTIN
     name: linux ${{ matrix.target }} CC=${{ matrix.cc }} SSL=${{ matrix.ssl }}
     env:
       CC: ${{ matrix.cc }}
@@ -143,15 +148,18 @@ jobs:
           - path: infineon/xmc47_relax-make-baremetal-builtin
           - path: infineon/xmc_plt2go_4400-make-baremetal-builtin
           - path: infineon/xmc72_evk-make-baremetal-builtin
-          - path: nxp/frdm-mcxn947-make-baremetal-builtin
-          - path: nxp/frdm-mcxn947-make-freertos-builtin
-          - path: nxp/rt1020-evk-make-baremetal-builtin
-          - path: nxp/rt1060-evk-make-baremetal-builtin
-          - path: nxp/rt1170-evk-make-baremetal-builtin
+          - path: nxp/frdm-imxrt1186/minimal
+          - path: nxp/frdm-mcxe247/minimal
+          - path: nxp/frdm-mcxn947/minimal
+          - path: nxp/frdm-rw612/minimal
+          - path: nxp/rt1060-evkb/minimal
+          - path: nxp/rt1170-evkb/minimal
           - path: stm32/nucleo-f429zi/minimal
           - path: stm32/nucleo-f746zg/minimal
           - path: stm32/nucleo-h563zi/minimal
           - path: stm32/nucleo-h723zg/minimal
+          - path: stm32/nucleo-h723zg/minimal-bsd-baremetal
+          - path: stm32/nucleo-h723zg/minimal-bsd-freertos
           - path: stm32/nucleo-h743zi/minimal
           - path: stm32/stm32h573i-dk/minimal
           - path: ti/ek-tm4c1294xl-make-baremetal-builtin
@@ -163,7 +171,7 @@ jobs:
       - uses: actions/checkout@v5
         with: { fetch-depth: 2 }
       - run: |
-          if ./test/match_changed_files.sh '^src'; then
+          if ./test/match_changed_files.sh '^src|^tutorials/${{ matrix.example.path }}'; then
             echo GO=1 >> $GITHUB_ENV
             sudo apt -y update && sudo apt -y install gcc-arm-none-eabi
           fi
@@ -177,8 +185,7 @@ jobs:
       fail-fast: false
       matrix:
         example:
-          - path: http/uart-bridge/esp32
-          - path: http/http-client/esp8266/http-client-server
+          - path: esp32/uart-bridge
     name: ${{ matrix.example.path }}
     env:
       GO: 0
@@ -220,7 +227,7 @@ jobs:
       fail-fast: false
       matrix:
         example:
-          - path: esp32
+          - path: esp32/device-dashboard
     name: ${{ matrix.example.path }}
     env:
       GO: 0
@@ -228,12 +235,12 @@ jobs:
       - uses: actions/checkout@v5
         with: { fetch-depth: 2 }
       - run: |
-          if ./test/match_changed_files.sh '^src|tutorials/http/device-dashboard'; then
+          if ./test/match_changed_files.sh '^src|^tutorials/http/device-dashboard|^tutorials/${{ matrix.example.path }}'; then
             echo GO=1 >> $GITHUB_ENV
             # nothing specific to install or do
           fi
       - if: ${{ env.GO == 1 }}
-        run: make -C tutorials/http/device-dashboard/${{ matrix.example.path }} build
+        run: make -C tutorials/${{ matrix.example.path }} build
 
   device_dashboard_examples_arm:
     runs-on: ubuntu-latest
@@ -241,10 +248,7 @@ jobs:
       fail-fast: false
       matrix:
         example:
-          - path: http/device-dashboard/microchip/same54-xpro
-          - path: nxp/rt1020-evk-make-freertos-builtin
-          - path: nxp/rt1060-evk-make-freertos-builtin
-          - path: nxp/rt1170-evk-make-freertos-builtin
+          - path: microchip/same54-xpro/device-dashboard
           - path: renesas/ek-ra6m4-make-baremetal-builtin
           - path: rp/pico-rndis
           - path: rp/pico-w
@@ -263,3 +267,24 @@ jobs:
           fi
       - if: ${{ env.GO == 1 }}
         run: make -C tutorials/${{ matrix.example.path }} build
+
+  mqtt_dashboard_examples_arm:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        example:
+          - path: rp/pico-rndis-device
+    name: ${{ matrix.example.path }}
+    env:
+      GO: 0
+    steps:
+      - uses: actions/checkout@v5
+        with: { fetch-depth: 2 }
+      - run: |
+          if ./test/match_changed_files.sh '^src|^tutorials/mqtt/mqtt-dashboard/device|^tutorials/${{ matrix.example.path }}'; then
+            echo GO=1 >> $GITHUB_ENV
+            sudo apt -y update && sudo apt -y install gcc-arm-none-eabi
+          fi
+      - if: ${{ env.GO == 1 }}
+        run: make -C tutorials/${{ matrix.example.path }} build

.github/workflows/test.yml

@@ -179,7 +179,6 @@ jobs:
         example:
           - path: esp32/uart-bridge
           - path: esp32/micropython
-          - path: esp8266/http-client-server
     name: ${{ matrix.example.path }}
     env:
       GO: 0

AGENTS.md

@@ -1,8 +1,12 @@
-# Mongoose - Embedded Network Library
+# Mongoose: a full-stack embedded networking library
+
+Mongoose is a full-stack embedded networking library for C/C++: a TCP/IP stack
+with drivers, TLS 1.3, an embedded web server (HTTP, WebSocket), MQTT and
+firmware OTA updates in two files, `mongoose.c` and `mongoose.h`. Mongoose runs on
+STM32, NXP and other microcontrollers, on bare metal or with an RTOS, with no
+external dependencies. Use it for cloud connectivity, device web dashboards,
+secure firmware updates and remote control.
 
-Mongoose is an open source, two-file C networking library and embedded web server for
-microcontrollers that combines TCP/IP stack, HTTP, WebSocket, MQTT, TLS 1.3
-stack, built-in firmware OTA updates, and device-dashboard infrastructure.
 License: GPLv2 or commercial.
 Website: https://mongoose.ws/
 GitHub repo: https://github.com/cesanta/mongoose
@@ -26,6 +30,8 @@ GitHub repo: https://github.com/cesanta/mongoose
   functionality such as HTTP, MQTT, Modbus, or device-dashboard logic.
 - Once Mongoose is integrated, desktop examples from `tutorials/http`,
   `tutorials/mqtt`, and similar directories also work on embedded systems.
+- For STM32, NXP IMXRT, RP2040/2350 use Mongoose's built-in TCP/IP stack
+- When building an STM32 project from scratch, use the closest tutorials/stm32/*/cube/*.ioc file as a base
 
 ## API prefix map
 
@@ -49,14 +55,17 @@ function signatures, structs, options, examples, and constraints.
 - `MG_OTA_*`, `mg_ota_*` - firmware OTA support
 
 
-## Integration
+## How to integrate Mongoose into an existing project
 
-Copy `mongoose.h` and `mongoose.c` into a `mongoose/` subdirectory of the
-project and add `mongoose/mongoose.c` to the build. The easiest is to
-copy from GitHub:
+Create `mongoose/` directory in your project.
+Download `mongoose.h` and `mongoose.c` into a `mongoose/` directory.
 
-https://raw.githubusercontent.com/cesanta/mongoose/refs/heads/master/mongoose.c
-https://raw.githubusercontent.com/cesanta/mongoose/refs/heads/master/mongoose.h
+```sh
+curl --fail --silent --create-dirs -o mongoose/mongoose.c https://raw.githubusercontent.com/cesanta/mongoose/refs/heads/master/mongoose.c
+curl --fail --silent --create-dirs -o mongoose/mongoose.h https://raw.githubusercontent.com/cesanta/mongoose/refs/heads/master/mongoose.h
+```
+
+Add `mongoose/mongoose.c` to the build.
 
 **Desktop/server** (Linux, macOS, Windows): two files are sufficient.
 
@@ -89,6 +98,27 @@ Minimal `mongoose_config.h` should set `MG_ARCH`. For example, for STM32:
 #define MG_ARCH MG_ARCH_CUBE
 ```
 
+## How to generate a new STM32 project from scratch
+
+Download and unzip the pre-generated project which is the closest to your MCU:
+
+- https://mongoose.ws/downloads/nucleo-h723zg-dashboard-full.zip
+- https://mongoose.ws/downloads/nucleo-f429zi-dashboard-full.zip
+- https://mongoose.ws/downloads/nucleo-h563zi-dashboard-full.zip
+- https://mongoose.ws/downloads/nucleo-f756zg-dashboard-full.zip
+- https://mongoose.ws/downloads/nucleo-n657x0-q-dashboard-full.zip
+- https://mongoose.ws/downloads/nucleo-u5a5zj-q-dashboard-full.zip
+- https://mongoose.ws/downloads/portenta-h7-dashboard-full.zip
+
+## How to generate a new RP2040 / RP2350 project from scratch
+
+Download and unzip the pre-generated project which is the closest to your MCU:
+
+- https://mongoose.ws/downloads/w5500-evb-pico-dashboard-full.zip
+- https://mongoose.ws/downloads/w55rp20-evb-pico-dashboard-full.zip
+- https://mongoose.ws/downloads/pico-w-dashboard-full.zip
+- https://mongoose.ws/downloads/pico-rndis-dashboard-full.zip
+
 ## Core API
 
 ```c
@@ -204,9 +234,11 @@ device dashboard.
 
 ### Required files
 
+The following files must exist at these exact paths, regardless of the build environment:
+
 ```
 your_project/
-├── main.c               # your code
+├── ...                  # IDE-specific project scaffolding
 └── mongoose/
     ├── mongoose.h       # single header
     ├── mongoose.c       # single source file
@@ -394,6 +426,11 @@ Each fieldset is exported via the get/set JSON-RPC interface, as well via the RE
 
 Do not use the API directly, dashboard.js interfaces with the UI via the data-* attributes.
 
+The dashboard backend must expose these exact functions: mg_dash_init() and mg_dash_poll().
+
+Do not rename, wrap, relocate, or replace these files or functions. Do not introduce alternatives such as app_dashboard_init(), app_dashboard_poll(), web/dashboard.html, or Core/Src/dashboard.c.
+
+Board-specific STM32Cube files may exist outside mongoose/, but the Mongoose dashboard files must retain the structure and API documented above.
 
 ## Filesystem
 
@@ -453,7 +490,7 @@ embedded devices and needs only a few lines added to `mongoose_config.h`:
 
 ```c
 #define MG_OTA_URL "https://mongoose.ws/ota/u/PREFIX/ota.json"  // Copy from instructions panel
-#define MG_OTA_FIRMWARE_VERSION "MY_PRODUCT_1.4.2"  // Change this
+#define MG_FIRMWARE_VERSION "MY_PRODUCT_1.4.2"  // Change this
 ```
 
 No backend programming required. The device registers itself and checks in at

README.md

@@ -1,4 +1,4 @@
-# Mongoose - Embedded Web Server / Embedded Network Library
+# Mongoose: a full-stack embedded networking library
 
 [![License: GPLv2/Commercial](https://img.shields.io/badge/License-GPLv2%20or%20Commercial-green.svg)](https://opensource.org/licenses/gpl-2.0.php)
 [![Build Status]( https://github.com/cesanta/mongoose/actions/workflows/quicktest.yml/badge.svg)](https://github.com/cesanta/mongoose/actions)
@@ -7,11 +7,17 @@
 
 <img src="https://mongoose.ws/images/logo.svg" width="48" height="48"
 align="left" style="float:left;" />
-Two files. Drop `mongoose.c` and `mongoose.h` into any C/C++ project and get a
-full network stack — HTTP, WebSocket, MQTT, TLS, firmware OTA
-updates, device dashboard — on any microcontroller or desktop OS.
+Mongoose is a full-stack embedded networking library for C/C++: a TCP/IP stack
+with drivers, TLS 1.3, an embedded web server (HTTP, WebSocket), MQTT and
+firmware OTA updates in two files, `mongoose.c` and `mongoose.h`. Mongoose runs on
+STM32, NXP and other microcontrollers, on bare metal or with an RTOS, with no
+external dependencies. Use it for cloud connectivity, device web dashboards,
+secure firmware updates and remote control.
 
-On the market since 2004, used by vast number of open source and commercial
+Use it instead of lwIP + mbedTLS + httpd + an MQTT client + OTA glue code, or
+run it on top of lwIP or Zephyr.
+
+On the market since 2004, used by a vast number of open source and commercial
 products - it even runs on the International Space Station! Features include:
 
 - Cross-platform:
@@ -24,7 +30,7 @@ products - it even runs on the International Space Station! Features include:
 - Source code is both ISO C and ISO C++ compliant
 - Very easy to integrate
 - Own TCP/IP stack for bare metal / RTOS, or run on top of any existing one (lwIP, Zephyr, ...)
-- Built-in TLS 1.3 ECC stack. Also can use external TLS libraries - mbedTLS, OpenSSL, or other
+- Built-in TLS 1.3 stack. Also can use external TLS libraries - mbedTLS, OpenSSL, or other
 - Does not depend on any other software to implement networking
 - Built-in firmware updates for STM32 H5, STM32 H7, NXP IMXRT, RP2040/2350, ESP32 and more
 - Commercial support with proactive security updates; [CRA-compliant](https://mongoose.ws/security/cra-compliance/)
@@ -35,8 +41,32 @@ See https://mongoose.ws/ for complete documentation, videos, case studies, etc.
 
 ## Supported platforms
 
-Mongoose can work on top of any TCP/IP stack that supports BSD sockets API.
-Platforms supported by the 3rd party TCP/IP stacks:
+Mongoose has its own built-in TCP/IP stack with drivers, so it needs no
+additional software to implement networking. The built-in stack runs on bare
+metal and under any RTOS. Platforms supported by the Mongoose built-in TCP/IP
+stack:
+
+| MCU | Connectivity | Notes |
+| :-- | :----------- | :---- |
+| **STM32** | Built-in Ethernet | Ethernet-capable STM32F, STM32H5, STM32H7, STM32N6, STM32C5 variants |
+| **NXP i.MX RT** | Built-in Ethernet | RT102x, RT104x, RT105x, RT106x, RT117x, RT118x (NETC) |
+| **NXP MCX** | Built-in Ethernet | MCXN94x, MCXE247 |
+| **NXP RW612** | Eth, WiFi, 802.15.4 | Separate Ethernet and radio drivers |
+| **Microchip ATSAME54** | Built-in Ethernet | GMAC driver |
+| **Renesas RA** | Built-in Ethernet | RA6M, RA8M |
+| **Infineon XMC** | Built-in Ethernet | XMC4, XMC7 |
+| **Texas Instruments** | Built-in Ethernet | TM4C, TMS570 |
+| **RP2040, RP2350, STM32, others** | CYW43xx Wi-Fi chips | SPI or SDIO; Pico W, Pico 2 W, Pico RM2, Arduino Portenta H7 |
+| **STM32, others** | ST67W6 Wi-Fi modules | SPI; for example, STM32U5 with the ST67W611M1 module |
+| **MCUs with an NXP Wi-Fi SDK port** | NXP Wi-Fi | Requires the SDK's Wi-Fi port implementing the driver's network hooks |
+| **NXP MCXW71** | Built-in 802.15.4 radio | IPv4 over IEEE 802.15.4 |
+| **NXP RW612** | Built-in 802.15.4 radio | IPv4 over IEEE 802.15.4; requires NXP radio firmware |
+| **Any MCU with SPI** | W5500 or W5100 Ethernet chips | External Wiznet MAC+PHY |
+| **MCUs connected to a cellular modem** | Cellular | AT commands and PPP; for example, SIM800 |
+| **MCUs with CMSIS Ethernet drivers** | Ethernet via CMSIS-Driver | Requires CMSIS Ethernet MAC and PHY drivers |
+
+Mongoose can also run on top of any TCP/IP stack that supports the BSD
+sockets API. Platforms supported via 3rd party TCP/IP stacks:
 
 | TCP/IP stack    | Notes |
 | :-------------- | :------- |
@@ -45,23 +75,6 @@ Platforms supported by the 3rd party TCP/IP stacks:
 | **Other**       | Any other TCP/IP stack that supports BSD socket API, for example Amazon FreeRTOS-TCP |
 | **Linux, Mac, Windows**   | Workstations, server, single board computers, embedded Linux devices running on MPUs or FPGAs |
 
-Optionally, Mongoose provides its own built-in TCP/IP stack, eliminating the
-need for additional software to implement networking functionality. The
-built-in stack supports operation in both bare-metal and RTOS environments.
-Platforms supported by the Mongoose built-in TCP/IP stack:
-
-| Hardware       | Notes |
-| :------------- | :------- |
-| **STM32**      | All STM32 MCUs with built-in Ethernet: STM32Fxx, STM32H5xx, STM32H7xx |
-| **NXP**        |  All NXP MCUs with built-in Ethernet: IMXRT102x, IMXRT104x, IMXRT105x, IMXRT106x, IMXRT117x, RW612, MCXN94x   |
-| **Microchip**  | ATSAME54 MCUs with built-int Ethernet  |
-| **Renesas**    | RA5M, RA6M, RA8M MCUs with built-in Ethernet    |
-| **Infineon**   | XMC4, XMC7 MCUs with built-in Ethernet    |
-| **Texas Instruments**  |  TM4C, TMS570 MCUs with built-in Ethernet   |
-| **Cypress WiFi**  | Any MCU with CY43xx WiFi chips, like RP2040 Pico-W, RP2350 Pico2-W, Arduino Portenta    |
-| **Wiznet Ethernet**  | Any MCU that use Wiznet W5500 or Wiznet 5100 MAC+PHY chips    |
-| **Cellular**   | NRF9160, SIM800    |
-
 ## Usage Examples
 
 Below are quick snippets that should give an idea how simple the API is and
@@ -158,6 +171,17 @@ int main() {
 }
 ```
 
+## Licensing
+
+Mongoose is dual-licensed:
+- GPLv2: free for open source projects. Many popular open source projects use
+  Mongoose, for example
+  [SWUpdate](https://github.com/sbabic/swupdate/tree/master/mongoose), the
+  embedded Linux update framework
+- Commercial: for closed-source products. Includes support directly from the
+  engineers who wrote the whole stack, and early security fixes.
+  See [licensing](https://mongoose.ws/licensing/)
+
 ## Commercial use
 - Mongoose is used by hundreds of businesses, from Fortune500 giants like
   Siemens, Schneider Electric, Broadcom, Bosch, Google, Samsung, Qualcomm, Caterpillar to the small businesses
@@ -220,6 +244,15 @@ Technical guides and deep dives into embedded web servers, WebUI integration and
 - [STM32 Ethernet and caches](https://mongoose.ws/articles/stm32-ethernet-and-cache/)
 - [NXP RW612 OTA Firmware Update](https://mongoose.ws/articles/rw612-ota-firmware-update/)
 - [lwIP vs Mongoose - TCP/IP Stack Integration Benchmark](https://mongoose.ws/articles/lwip-vs-mongoose-tcpip-stack-integration/)
+- [Embedded TCP/IP Stacks Comparison](https://mongoose.ws/embedded-tcpip-stack-comparison/)
+- [STM32H5 File System on Internal Flash: LittleFS + Mongoose](https://mongoose.ws/articles/stm32h5-file-system-on-internal-flash/)
+- [Firmware OTA and remote control on NXP FRDM-RW612](https://mongoose.ws/articles/rw612-mdash/)
+- [25000 WebSocket messages per second on STM32 Nucleo-H723ZG](https://mongoose.ws/articles/stm32-websocket-benchmark/)
+- [How to connect STM32 to AWS IoT Core](https://mongoose.ws/articles/stm32-aws-iot/)
+- [How to connect STM32 to Azure IoT Hub](https://mongoose.ws/articles/stm32-azure-iot-hub/)
+- [How to connect STM32 to EMQX](https://mongoose.ws/articles/stm32-emqx/)
+- [STM32 Device Management deep dive: Secure OTA, Remote Control, health monitor](https://mongoose.ws/articles/stm32-mdash-deep-dive/)
+- [STM32 TCP/IP footprint: how much flash and RAM does Mongoose take?](https://mongoose.ws/articles/tcp-ip-footprint/)
 
 
 ## Contributions

SECURITY.md

@@ -0,0 +1,41 @@
+# Security Policy
+
+Mongoose is a full-stack embedded networking library by Cesanta Software Ltd,
+<https://mongoose.ws>. This policy covers how to report vulnerabilities
+and how Cesanta handles them.
+
+## Supported versions
+
+Security fixes go to the `master` branch and the latest release.
+
+## Reporting a vulnerability
+
+Do not report security issues in public GitHub issues. Report them
+privately using GitHub Security Advisories:
+<https://github.com/cesanta/mongoose/security/advisories/new>
+
+Include the Mongoose version or commit, steps or a proof of concept to reproduce, and
+the impact. Cesanta usually responds the same business day.
+
+## Disclosure process
+
+1. Cesanta reviews the report and coordinates a fix with the reporter.
+2. Eligible commercial customers receive a notification and a private fix
+   one month before the CVE becomes public.
+3. The fix and the CVE are then published. The reporter is credited in the
+   GitHub Security Advisory.
+
+## Security testing
+
+- CI on every push, unit tests built with ASAN and UBSan
+- CodeQL static analysis on every commit
+- Continuous fuzzing on OSS-Fuzz, plus nightly libFuzzer runs
+- AI-assisted security review on every pull request
+- Regular review by independent security research groups worldwide
+
+## EU Cyber Resilience Act (CRA)
+
+Mongoose supports CRA compliance for connected products: a documented
+vulnerability handling process (this file), TLS 1.3, signed OTA firmware
+updates, and an SBOM (`sbom.cdx.json`). Details:
+<https://mongoose.ws/security/cra-compliance/>

resources/I-CUBE-Mongoose/.config/mongoose_parameters.json

@@ -0,0 +1,32 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema",
+  "version": "0.0.1",
+  "componentid": "::Mongoose:Networking Core",
+  "type": "object",
+  "grammarVersion": "3.8.0",
+  "license": "Copyright (c) Cesanta Software Limited",
+  "properties": {
+    "parameters": {
+      "type": "object",
+      "properties": {
+        "info": {
+          "type": "object",
+          "title": "General information",
+          "properties": {
+            "description": {
+              "title": "Middleware description",
+              "type": "string",
+              "actions": [
+                {
+                  "type": "disable",
+                  "condition": "true"
+                }
+              ],
+              "default": "Mongoose networking library: TCP/IP, TLS, HTTP, WebSocket, MQTT, OTA. Edit mongoose_config.h to configure it."
+            }
+          }
+        }
+      }
+    }
+  }
+}

resources/I-CUBE-Mongoose/Cesanta.I-CUBE-Mongoose.pdsc

@@ -1,13 +1,23 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<package schemaVersion="1.7.40" xmlns:xs="http://www.w3.org/2001/XMLSchema-instance" xs:noNamespaceSchemaLocation="PACK.xsd">
+<package schemaVersion="1.7.56" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:stm32="https://developer.st.com/schemas/stm32cube/1.0.0" xsi:noNamespaceSchemaLocation="PACK.xsd">
   <vendor>Cesanta</vendor>
   <name>I-CUBE-Mongoose</name>
-  <description>Mongoose - a lightweight networking library providing TCP/IP stack, TLS, HTTP (Embedded Web Server), WebSocket, MQTT, and Firmware OTA updates. Build production-ready web device dashboards and MQTT cloud connectivity without stitching multiple components together.
-  </description>
+  <description>Mongoose - a full-stack networking library for microcontrollers: Ethernet and Wi-Fi drivers, TCP/IP stack, TLS 1.3, HTTP, WebSocket, MQTT, Modbus, OTA updates and device management, in a two-file C/C++ library, on any RTOS or bare metal.</description>
   <url>https://mongoose.ws/downloads/stm32pack/</url>
   <license>License.txt</license>
   <supportContact>https://mongoose.ws/contact/</supportContact>
+  <environments>
+    <environment name="STM32Cube">
+      <stm32:pack type="MW" friendlyName="Mongoose" shortDesc="Mongoose full-stack networking library">
+        <relocation-info parent="middleware"/>
+        <no-compatibility-constraint/>
+      </stm32:pack>
+    </environment>
+  </environments>
   <releases>
+    <release date="2026-10-21" version="7.23.3">See https://github.com/cesanta/mongoose/releases/tag/7.23</release>
+    <release date="2026-10-19" version="7.23.2">See https://github.com/cesanta/mongoose/releases/tag/7.23</release>
+    <release date="2026-09-28" version="7.23.1">See https://github.com/cesanta/mongoose/releases/tag/7.23</release>
     <release date="2026-05-11" version="7.21.7">See https://github.com/cesanta/mongoose/releases/tag/7.21</release>
     <release date="2026-05-05" version="7.21.5">See https://github.com/cesanta/mongoose/releases/tag/7.21</release>
     <release date="2026-04-24" version="7.21.4">See https://github.com/cesanta/mongoose/releases/tag/7.21</release>
@@ -19,7 +29,7 @@
       <keyword>IMPLEMENTED_WITH_STM32CUBEMX</keyword>
   </keywords>
   <components>
-    <component Cclass="Mongoose" Cgroup="Networking Core" Cversion="7.21.7" maxInstances="1">
+    <component Cclass="Mongoose" Cgroup="Networking Core" Cversion="7.23.3" maxInstances="1">
       <description>Networking Core</description>
       <files>
         <file category="doc" name="README.md"/>
@@ -27,7 +37,15 @@
         <file category="sourceC" name="mongoose.c" />
         <file category="header" name="mongoose_config.h"/>
         <file category="utility" name="README.md" public="false"/>
+        <file category="genAsset" name=".config/mongoose_parameters.json"/>
       </files>
+      <environments>
+        <environment name="STM32Cube">
+          <stm32:component>
+            <middleware-entry-point id="Mongoose" name="Mongoose" category="TCP/IP"/>
+          </stm32:component>
+        </environment>
+      </environments>
     </component>
   </components>
 </package>

resources/I-CUBE-Mongoose/Makefile

@@ -1,10 +1,16 @@
-VERSION = 7.21.7
+VERSION = 7.23.3
 REPO_ROOT = ../..
 MX ?= /Applications/STMicroelectronics/STM32CubeMX.app/Contents/MacOs/STM32CubeMX
-FILES = Cesanta.I-CUBE-Mongoose.pdsc Release_Notes.html mongoose_config.h README.md
+FILES = Cesanta.I-CUBE-Mongoose.pdsc Release_Notes.html mongoose_config.h README.md .config/mongoose_parameters.json
 GENERATED = License.txt mongoose.h mongoose.c
+MX2 ?= $(HOME)/STMicroelectronics/STM32CubeMX2_1.1.2/.bin/cube
+PACKSDIR ?= $(HOME)/Library/Application Support/stm32cube/packs
+MX2CPN ?= STM32C5A3ZGT6
+MX2PROJ = $(CURDIR)/mx2test/test.ioc2
+
+NAME = Cesanta.I-CUBE-Mongoose.$(VERSION)
+PACK = $(NAME).pack
 
-PACK = Cesanta.I-CUBE-Mongoose.$(VERSION).pack
 all: $(PACK)
 
 Cesanta.I-CUBE-Mongoose.$(VERSION).pack: $(FILES) $(GENERATED)
@@ -44,23 +50,19 @@ mongoose.h: Mongoose
 mongoose.c: Mongoose
 	cp $(REPO_ROOT)/mongoose.c $@
 
-pk: $(PACK)
-	rm -f gen.mx
-	echo swmgr remove Cesanta.I-CUBE-Mongoose.$(VERSION) >> gen.mx
-	echo swmgr install `pwd`/Cesanta.I-CUBE-Mongoose.$(VERSION).pack ask >> gen.mx
-	echo exit >> gen.mx
-	$(MX) -q `pwd`/gen.mx
-
-
-mx: $(PACK)
-	mkdir -p $@
-	cp ../downloads/nucleo_h563zi.ioc $@
-	V=`grep 'Mcu.ThirdParty0' $@/nucleo_h563zi.ioc | sed 's,^.*se.,,'`; sed -i '' "s,$$V,$(VERSION),g" $@/nucleo_h563zi.ioc
-	rm -f gen.mx
-	echo config load `pwd`/$@/nucleo_h563zi.ioc >> gen.mx
-	echo project generate >> gen.mx
-	echo exit >> gen.mx
-	$(MX) -q `pwd`/gen.mx
+test_mx2: $(PACK)
+	-$(MX2) pack remove --cmsis-pack-root "$(PACKSDIR)" $(NAME)
+	rm -f "$(PACKSDIR)/.Download/$(PACK)"
+	$(MX2) pack install --cmsis-pack-root "$(PACKSDIR)" "$(CURDIR)/$(PACK)"
+	export PATH="$(dir $(MX2)):$$PATH"; \
+	PORT=$$(cube lifecycle-mx start-only | sed -n 's/^BACKEND_PORT *//p'); \
+	cube mx project close --port $$PORT -p "$(MX2PROJ)" --discard > /dev/null 2>&1; \
+	rm -rf mx2test && mkdir mx2test && \
+	cube mx project create-from-mcu --port $$PORT --cpn $(MX2CPN) -l "$(CURDIR)/mx2test" -n test --empty-project && \
+	cube mx middleware enable-middleware --port $$PORT -p "$(MX2PROJ)" -n Mongoose | tee mx2test/enable.json && \
+	grep -q '"status": "success"' mx2test/enable.json && \
+	cube mx project save --port $$PORT -p "$(MX2PROJ)" && \
+	cube mx project close --port $$PORT -p "$(MX2PROJ)" --discard
 
 clean:
-	rm -rf *.pack STM32CubeMX/*.$(VERSION)_*.xml $(GENERATED) gen.mx mx
+	rm -rf *.pack STM32CubeMX/*.$(VERSION)_*.xml $(GENERATED) mx2test

resources/downloads/integrate_mongoose_cubemx.sh

@@ -39,8 +39,7 @@ patch_linker_script() {
 HUART=`perl -nle 'print \$1 if /^UART_HandleTypeDef (.+);/' $MAIN_C`
 grep -q mongoose.h $MAIN_C || perl -i -ne 'print; print "#include \"mongoose.h\"\n" if /BEGIN Includes/' $MAIN_C
 grep -q '^static void log_fn' $MAIN_C || perl -i -ne "print; print \"static void log_fn(char ch, void *param) {\n  HAL_UART_Transmit(param, (unsigned char *) &ch, 1, HAL_MAX_DELAY);\n}\n\" if /USER CODE BEGIN 0/" $MAIN_C
-grep -q 'mg_mgr_init' $MAIN_C || perl -i -ne 'print; print "  struct mg_mgr mgr;\n  mg_mgr_init(&mgr);\n  mg_log_set_fn(log_fn, &'"${HUART}"');\n\n" if /USER CODE BEGIN WHILE/' $MAIN_C
-grep -q 'mg_mgr_init' $MAIN_C && grep -q 'mg_log_set_fn' $MAIN_C || perl -i -ne 'print; print "  mg_log_set_fn(log_fn, &'"${HUART}"');\n" if /mg_mgr_init/' $MAIN_C
+grep -q 'mg_mgr_init' $MAIN_C || perl -i -ne 'print; print "  struct mg_mgr mgr;\n  mg_log_set_fn(log_fn, &'"${HUART}"');\n  mg_mgr_init(&mgr);\n  mg_log_set_fn(log_fn, &'"${HUART}"');\n\n" if /USER CODE BEGIN WHILE/' $MAIN_C
 grep -q 'mg_mgr_poll' $MAIN_C || perl -i -ne 'print "    mg_mgr_poll(&mgr, 0);\n" if /USER CODE END WHILE/; print;' $MAIN_C
 patch_linker_script $DIR/STM32H723XG_FLASH.ld
 patch_linker_script $DIR/STM32H743XX_FLASH.ld

resources/specs/areas/common_misc.md

@@ -0,0 +1,38 @@
+# Security Scan Area: common_misc
+
+## Target
+
+Area: common_misc
+
+This area covers common utility code, parsing/string/formatting helpers, URL handling, hash/base64 helpers, filesystem backends, little filesystem integration, and flash support.
+
+Primary files:
+- `src/base64.c`
+- `src/fmt.c`
+- `src/json.c`
+- `src/log.c`
+- `src/md5.c`
+- `src/printf.c`
+- `src/sha1.c`
+- `src/sha256.c`
+- `src/str.c`
+- `src/url.c`
+- `src/util.c`
+- `src/fs*.c`
+- `src/lfs.c`
+- `src/flash.c`
+
+Perform a focused security review centered on these files and this security surface.
+
+Supporting code elsewhere under `src/` may be inspected when necessary to establish reachability, data flow, state, validation, mitigation, or impact, but do not inspect or report code outside `src/` or independently review unrelated areas.
+
+## Area-Specific Security Guidance
+
+**Filesystem Backends:**
+- Review packed filesystem code and filesystem backends for traversal, unauthorized file read/write, overwrite, or truncation.
+- Check path canonicalization across POSIX, Windows, embedded filesystems, packed filesystems, and custom `mg_fs` implementations.
+- Look for trailing slash confusion, NUL byte truncation, and case sensitivity differences in backend path handling.
+
+**URL Parsing:**
+- Review URL parsing for scheme, host, port, IPv6 literal, userinfo, percent-encoding, embedded NUL, empty host, default port, and path/query boundary confusion.
+- Check for SSRF-relevant behavior only when attacker input can control the destination host, protocol, or network boundary. Path-only control is not sufficient.

resources/specs/areas/mongoose_core.md

@@ -0,0 +1,30 @@
+# Security Scan Area: mongoose_core
+
+## Target
+
+Area: mongoose_core
+
+This area covers the core event/network/connection machinery, iobuf handling, queues, socket transport, timers, and BSD abstraction.
+
+Primary files:
+- `src/event.c`
+- `src/iobuf.c`
+- `src/net.c`
+- `src/queue.c`
+- `src/sock.c`
+- `src/timer.c`
+- `src/bsd.c`
+
+Perform a focused security review centered on these files and this security surface.
+
+Supporting code elsewhere under `src/` may be inspected when necessary to establish reachability, data flow, state, validation, mitigation, or impact, but do not inspect or report code outside `src/` or independently review unrelated areas.
+
+## Area-Specific Security Guidance
+
+**Protocol State Machine and Event-Driven Lifecycle Bugs:**
+- Review transitions between listening, accepted, connecting, resolving, TLS handshaking, HTTP, WebSocket, MQTT, draining, closing, and closed states.
+- Check whether malformed input can cause protocol handlers to process data in the wrong state, process stale data after close, or invoke callbacks with invalid event data.
+- Look for use-after-free or stale pointer use when callbacks call `mg_close_conn`, mark a connection closing, mutate iobufs, change protocol handlers, or initiate TLS/WebSocket/MQTT transitions.
+- Verify that partial reads/writes, backpressure, `is_full`, draining, TLS pending states, and send-buffer mutations cannot cause duplicated sends, skipped validation, or parser confusion.
+- Review timer and wakeup handling for stale user data pointers, cross-thread queue misuse, and callbacks firing after associated connections/state have been freed.
+- Only report concurrency or race issues when a concrete event ordering can trigger memory corruption, unauthorized action, or reliable device/process crash.

resources/specs/areas/net_builtin.md

@@ -0,0 +1,26 @@
+# Security Scan Area: net_builtin
+
+## Target
+
+Area: net_builtin
+
+This area covers the built-in TCP/IP stack and its selected L2 implementations.
+
+Primary files:
+- `src/l2_*.c`
+- `src/net_builtin.c`
+
+Perform a focused security review centered on these files and this security surface.
+
+Supporting code elsewhere under `src/` may be inspected when necessary to establish reachability, data flow, state, validation, mitigation, or impact, but do not inspect or report code outside `src/` or independently review unrelated areas.
+
+## Area-Specific Security Guidance
+
+**Built-In TCP/IP Stack, Packet Parsing, and Embedded Network Drivers:**
+- Review Ethernet, ARP, IP, IPv6, ICMP, UDP, TCP, DHCP, SNTP, and driver receive/transmit paths for packet-length validation before reading protocol headers.
+- Check IP/TCP/UDP header length fields, options length, fragmentation/reassembly behavior, checksum handling, and payload offset calculations for underflow, overflow, or out-of-bounds access.
+- Look for malformed packets that can corrupt descriptor rings, RX/TX buffers, queue state, ARP tables, connection state, or timers.
+- Review interrupt handlers and bare-metal driver code for bounded processing loops. Flag IRQ paths where attacker-controlled traffic can cause livelock, starvation, descriptor ownership loss, or repeated processing of the same malformed frame.
+- Check DMA descriptor ownership transitions, memory barriers, cache coherency handling, and buffer length fields for race-like bugs that can cause memory corruption or stale packet reuse.
+- Review platform-specific drivers such as STM32, NXP, TI, Microchip, Renesas, Infineon, Wiznet, Cypress WiFi, cellular, and other built-in stack integrations for inconsistent bounds checks or endian conversions.
+- Treat a remotely reachable malformed Ethernet/IP/TCP/UDP packet that crashes, wedges, or corrupts an embedded target as reportable.

resources/specs/areas/protocols.md

@@ -0,0 +1,38 @@
+# Security Scan Area: protocols
+
+## Target
+
+Area: protocols
+
+This area covers the smaller externally controlled protocol parsers and state machines other than HTTP, WebSocket, and TLS.
+
+Primary files:
+- `src/modbus.c`
+- `src/rpc.c`
+- `src/sntp.c`
+- `src/mqtt.c`
+- `src/dns.c`
+
+Perform a focused security review centered on these files and this security surface.
+
+Supporting code elsewhere under `src/` may be inspected when necessary to establish reachability, data flow, state, validation, mitigation, or impact, but do not inspect or report code outside `src/` or independently review unrelated areas.
+
+## Area-Specific Security Guidance
+
+**MQTT Parser and Broker/Client State Machine Vulnerabilities:**
+- Review MQTT fixed header parsing, remaining-length decoding, variable-length integer loops, packet identifier handling, QoS transitions, topic extraction, property parsing, and MQTT 3.x vs MQTT 5 differences.
+- Look for malformed MQTT packets that can trigger out-of-bounds reads/writes, stack buffer overflow, heap corruption, assertion/crash, or parser desynchronization.
+- Specifically check SUBSCRIBE and UNSUBSCRIBE handling for unbounded numbers of topics, malformed topic length fields, missing QoS bytes, invalid QoS values, and writes to fixed-size response arrays.
+- Verify that PUBLISH handling enforces topic length, packet length, QoS rules, retained flag handling, packet identifier requirements, and message bounds before accessing fields.
+- Check protocol handlers for authorization bypass, cross-topic data exposure, wildcard topic mishandling, `$SYS` or reserved topic confusion, and unintended publish/subscribe access.
+- Review MQTT reconnect/resubscribe logic for stale connection state, packet identifier reuse bugs, and memory lifetime problems after close/reconnect.
+- Treat unauthenticated single-packet broker crash, client crash from malicious broker response, or memory corruption during MQTT parsing as reportable.
+
+**DNS and mDNS Parsing and Name Resolution:**
+- Review DNS and mDNS message parsing for label length validation, compression pointer loops, pointer bounds, recursive expansion limits, integer overflow, malformed resource records, and out-of-bounds reads.
+- Check that DNS answers are matched to outstanding requests by transaction ID, question name/type/class, and source expectations where applicable.
+- Look for cache poisoning, response spoofing, or name confusion if DNS response validation is weak in client or resolver code.
+- Verify that DNS failures, timeouts, and retries cannot leave dangling active request state or corrupt connection state.
+
+**Modbus, RPC, and SNTP:**
+- Review externally controlled lengths, framing, message parsing, and protocol state for malformed peer input that can cause parser desynchronization, state corruption, or a remotely triggerable crash or wedge.

resources/specs/areas/tls.md

@@ -0,0 +1,44 @@
+# Security Scan Area: tls
+
+## Target
+
+Area: tls
+
+This area covers the complete Mongoose TLS implementation represented by the primary files.
+
+Primary files:
+- `src/tls_aes128.c`
+- `src/tls_builtin.c`
+- `src/tls_chacha20.c`
+- `src/tls_dummy.c`
+- `src/tls_mbed.c`
+- `src/tls_openssl.c`
+- `src/tls_p256_cortex.c`
+- `src/tls_p256.c`
+- `src/tls_p384.c`
+- `src/tls_rsa.c`
+
+Perform a focused security review centered on these files and this security surface.
+
+Supporting code elsewhere under `src/` may be inspected when necessary to establish reachability, data flow, state, validation, mitigation, or impact, but do not inspect or report code outside `src/` or independently review unrelated areas.
+
+Connection, core, network, and helper code under `src/` may be inspected when needed to understand the complete TLS execution path.
+
+## Area-Specific Security Guidance
+
+### Mandatory High-Risk Coverage: Built-In TLS
+
+The built-in TLS implementation (`MG_TLS_BUILTIN`) is a mandatory high-risk review target. Perform a substantial security analysis of all security-relevant built-in TLS code, including parsing, cryptographic processing, authentication and certificate validation, length and buffer handling, protocol state, cross-call behavior, and failure paths.
+
+Trace attacker-controlled TLS peer input through normal client and server execution, including traffic received before peer authentication is complete. Report any credible memory-safety, authentication, confidentiality, integrity, state-corruption, or remotely triggerable availability vulnerability.
+
+**TLS, Certificate, Hostname Verification, and Cryptographic Validation:**
+- Review all TLS backends, including built-in TLS, mbedTLS, OpenSSL, WolfSSL, and custom TLS integration, for equivalent security behavior where possible.
+- Flag certificate verification bypasses, accidental `skip_verification` use in security-sensitive defaults, missing hostname verification when `name`/SNI is available, or inconsistent validation across TLS backends.
+- For hostname verification, check wildcard handling carefully. A wildcard certificate identity must not match multiple DNS labels. For example, `*.example.com` must not match `a.b.example.com`.
+- Verify that wildcard matching is applied only to certificate presented identifiers, not to arbitrary reference identifiers or general DNS glob matching.
+- Review `mg_match` or other glob/matching helpers if used for certificate identity checks, authorization checks, filesystem paths, routing, or topic matching. Flag cases where glob semantics are broader than the security policy requires.
+- Check certificate parsing for DER/PEM boundary errors, length overflows, malformed ASN.1, extension parsing mistakes, name constraints, SAN vs CN precedence, embedded NUL, and invalid string type handling.
+- Review TLS record parsing, handshake transcript handling, key schedule, random generation, ECC (P-256, P-384) operations, AES-GCM nonce/tag handling, and error handling for memory safety and authentication failures.
+- Flag any behavior that silently falls back from verified TLS to unverified TLS or plaintext.
+- Check that TLS receive/send error paths cannot corrupt connection state, reuse freed buffers, or continue processing unauthenticated plaintext as encrypted data.

resources/specs/areas/web_http_auth.md

@@ -0,0 +1,61 @@
+# Security Scan Area: web_http_auth
+
+## Target
+
+Area: web_http_auth
+
+This area covers HTTP parsing and framing, HTTP-facing filesystem behavior, SSI, WebSocket, authentication/token/dashboard code, and HTTP-based OTA behavior.
+
+Primary files:
+- `src/http.c`
+- `src/ssi.c`
+- `src/ws.c`
+- `src/jwt.c`
+- `src/dash.c`
+- `src/ota.c`
+
+Perform a focused security review centered on these files and this security surface.
+
+Supporting code elsewhere under `src/` may be inspected when necessary to establish reachability, data flow, state, validation, mitigation, or impact, but do not inspect or report code outside `src/` or independently review unrelated areas.
+
+For OTA behavior, follow operations under `src/` into TLS, flash, filesystem, JSON, URL, or other support code when necessary, while keeping the review centered on the `web_http_auth` surface.
+
+## Area-Specific Security Guidance
+
+**HTTP Parser, Request Smuggling, and Message Framing:**
+- Verify that HTTP requests or responses containing both `Content-Length` and `Transfer-Encoding` are rejected or handled in a way that cannot cause front-end/back-end desynchronization. Treat CL+TE coexistence as security-relevant request smuggling risk.
+- Verify that duplicate `Content-Length`, duplicate `Transfer-Encoding`, conflicting transfer codings, malformed chunk sizes, chunk extensions, premature EOF, and body length mismatches cannot cause inconsistent body parsing.
+- Check whether HTTP/1.0, HTTP/1.1, and malformed protocol versions alter CL/TE handling unsafely. A message with both `Content-Length` and `Transfer-Encoding` should not be accepted merely because of version differences.
+- Look for parsing paths where headers are normalized differently from later lookup paths, including case folding, whitespace around colon, obs-fold/line folding, embedded NUL, duplicate headers, or partial header names.
+- Review URL decoding, query parsing, multipart parsing, upload handling, range handling, and chunked responses for bounds mistakes, truncation, or inconsistent decoded-vs-raw path decisions.
+- Check static file serving and SSI handling for path traversal through percent-encoding, double decoding, backslashes on Windows, mixed separators, dot-dot segments, absolute paths, drive letters, symlinks, embedded NUL, or alias/root_dir confusion.
+- Review HTTP authentication helper paths for parsing ambiguities in Basic auth, header extraction, credential truncation, empty username/password acceptance, or incorrect comparison behavior.
+- Check that HTTP upgrade to WebSocket validates method, headers, key, version, and connection semantics consistently before switching protocol state.
+
+**WebSocket Framing and Upgrade Vulnerabilities:**
+- Review WebSocket frame parsing for extended payload length handling, 16-bit/64-bit length conversion, masking rules, fragmentation, continuation frames, control-frame length limits, close/ping/pong handling, and compression-related assumptions if present.
+- Check that client-to-server frames require masking and that malformed mask/payload boundaries cannot read or write out of bounds.
+- Look for state-machine confusion after HTTP upgrade, especially where partial frames, fragmented messages, or mixed HTTP/WebSocket bytes can cause parser desynchronization.
+- Check whether large or malformed frame lengths can cause integer overflow, memory corruption, uncontrolled allocation, connection lockup, or single-connection/device crash.
+- Verify that WebSocket message APIs preserve attacker-controlled binary data length correctly and do not pass non-null-terminated payloads to C-string functions.
+
+**HTTP-Facing Filesystem Serving, Uploads, and SSI:**
+- Review `mg_http_serve_dir`, `mg_http_serve_file`, upload APIs, and SSI expansion for traversal, unauthorized file read/write, overwrite, truncation, or unexpected executable/include behavior.
+- Look for inconsistent handling of decoded and undecoded paths, double decoding, query string leakage into path, trailing slash confusion, NUL byte truncation, and case sensitivity differences.
+- Review multipart upload parsing for boundary confusion, filename traversal, field length overflow, partial-write behavior, and max-size enforcement.
+- Check SSI include handling for directory escape, recursive include loops, unintended disclosure of local files, and parsing of attacker-controlled SSI directives.
+- Verify that range requests and static response headers cannot cause out-of-bounds reads or disclose memory.
+
+**OTA/Firmware Update and Device Dashboard Security:**
+- Review firmware update endpoints and code paths for missing authentication, authorization bypass, path confusion, arbitrary write, unsafe flash offset/length handling, and failure to verify firmware authenticity where the code claims secure update behavior.
+- Check update chunk parsing for integer overflow, flash boundary crossing, rollback/downgrade exposure, incomplete image bootability, and crash/power-loss unsafe state transitions.
+- Flag any code path where unauthenticated network input can write firmware, configuration, filesystem contents, flash pages, bootloader state, or device identity material.
+- Review device dashboard code for security-sensitive default routes, credentials, upload handlers, debug endpoints, config mutation endpoints, and CORS/header behavior.
+
+**Authentication, Authorization, and Access-Control Patterns in Mongoose Integrations:**
+- Review helper APIs and code paths that implement HTTP auth, cookies, sessions, tokens, device dashboards, REST APIs, upload endpoints, and firmware update endpoints.
+- Flag authentication bypasses caused by prefix route matching, glob matching, decoded-vs-raw URI confusion, case normalization mistakes, missing boundary checks, or default-open sensitive endpoints.
+- Check for authorization decisions made in client-side JavaScript only. Client-side checks are not security boundaries.
+- Review CORS and origin checks only when they protect credentialed sensitive operations and the exploit path is concrete.
+- Look for credential comparison bugs, truncation of usernames/passwords, accepting empty credentials, parsing only part of an Authorization header, or treating malformed credentials as anonymous-but-authorized.
+- Flag sensitive data exposure when secrets, credentials, tokens, private keys, firmware signing material, PII, or device identity values can be read by unauthorized remote clients or logged from attacker-triggered paths.

resources/specs/claude-false-positive-filtering.md

@@ -5,7 +5,7 @@
 3. The exploit depends on NULL, dangling, fake, or corrupted pointers/objects supplied by a local caller, including invalid `mg_connection`, `mg_mgr`, `mg_str`, iobufs, or callback data.
 4. The exploit requires manually mutating internal structs, flags, parser offsets, descriptor indexes, connection state, TLS state, MQTT/WebSocket state, or filesystem state into impossible combinations.
 5. The bug exists only in tests, fuzz harnesses, benchmarks, synthetic unit tests, or debug-only code, with no shared production logic.
-6. The issue is only in a tutorial/demo/example with no realistic production relevance or sensitive operation.
+6. The affected file is outside `src/`.
 7. The attacker must edit source code, build flags, compile-time macros, TLS backend choices, filesystem roots, or local device configuration.
 8. The attacker must directly write hardware registers, MMIO, DMA descriptors, descriptor ownership bits, IRQ state, cache registers, or peripheral configuration.
 9. Generic DoS from high traffic volume, many valid connections, slow clients, missing quotas, missing rate limits, or ordinary resource saturation.
@@ -14,6 +14,8 @@
 12. Generic crypto advice with no concrete impact on authentication, confidentiality, integrity, downgrade resistance, hostname verification, certificate validation, key handling, nonces/tags, or plaintext fallback.
 13. Speculative protocol claims without a specific malformed input shape, reachable parser path, and concrete security impact.
 14. Pure application policy gaps: no default auth, no CSRF, no user access model, no account lockout, no audit logs, or no password policy.
+15. OTA findings based only on allowing plain HTTP, lacking firmware hash/signature verification, or permitting update URLs to change scheme/host when this is documented/configurable behavior and no existing security check is bypassed.
+16. Filter TCP findings that rely primarily on predictability or insufficient entropy in protocol sequence-state generation, including attacks based on guessing or reconstructing connection state without observing the traffic.
 
 # SIGNAL QUALITY CRITERIA
 **For remaining findings, assess:**
@@ -25,7 +27,7 @@
 6. Does the report provide exact files, functions, line numbers, data flow, bounds reasoning, state reasoning, or a minimal malformed input?
 7. Is the malformed input shape clear, such as CL+TE HTTP, oversized MQTT SUBSCRIBE, malformed WebSocket length, DNS compression loop, wildcard TLS certificate, invalid packet header length, or encoded path traversal?
 8. Is the severity justified by reachability and impact?
-9. Is this a library/helper/default/example-pattern vulnerability rather than only arbitrary application misuse?
+9. Is this a library/helper/default vulnerability rather than only arbitrary application misuse?
 10. Is the fix specific enough to act on: reject CL+TE, bound arrays, validate DNS pointers, enforce one-label wildcard matching, check packet lengths, canonicalize paths, or bound RX loops?
 11. Is a DoS finding caused by a concrete implementation flaw rather than volume, slow clients, missing quotas, or capacity limits?
 12. In embedded context, can a small malformed input reliably crash, wedge, corrupt, or permanently disrupt a device/process?
@@ -42,24 +44,26 @@
 8. Keep unsafe `mg_match` or glob use at security boundaries: certificate identity, route authorization, filesystem policy, MQTT topic authorization, or access control.
 9. Keep DNS/mDNS label, compression pointer, pointer loop, RR length, transaction matching, spoofing, OOB, or infinite-loop issues with external reachability.
 10. Keep filesystem traversal through exposed serving/upload/SSI paths, including encoding, double decoding, backslashes, dot-dot, absolute paths, drive letters, symlinks, NULs, alias/root confusion, and upload filename traversal.
-11. Keep OTA/update issues allowing unauthenticated or improperly validated writes to firmware, flash, config, filesystem, boot state, device identity, or update metadata.
-12. Keep embedded packet parser bugs in Ethernet, ARP, IP, IPv6, ICMP, UDP, TCP, DHCP, SNTP, or drivers when malformed traffic causes OOB, overflow, descriptor corruption, queue corruption, state corruption, or crash.
-13. Keep IRQ, polling, RX descriptor, and packet-loop livelock/starvation/wedge bugs caused by received traffic.
-14. Keep event-lifecycle bugs reachable from external input: UAF, stale pointer, double close, callback lifetime error, iobuf mutation after close, protocol transition confusion, timer/wakeup after free.
-15. Keep externally reachable `mg_str` null-termination mistakes causing OOB read, data leak, auth bypass, parser confusion, or crash.
-16. Keep integer conversion bugs where external lengths affect allocation, copying, parsing, or bounds checks.
-17. Filter parser/helper reports based only on a local caller passing invalid pointers, fake lengths, fake structs, or corrupted objects.
-18. Filter reports requiring direct mutation of connection internals such as protocol flags, closing flags, handler pointers, iobuf fields, callback pointers, or user data.
-19. Filter reports requiring attacker control of `MG_ENABLE_*`, TLS backend macros, filesystem backend macros, compiler flags, debug flags, sanitizer settings, or platform defines.
-20. Filter direct hardware-access reports requiring writes to registers, DMA descriptors, MMIO, IRQ state, cache controls, or peripheral configuration.
-21. Filter generic “Mongoose lacks authentication” reports unless a helper, example, route pattern, auth parser, MQTT broker behavior, dashboard, upload handler, or OTA endpoint creates a concrete issue.
-22. Filter generic rate-limit/quota/connection-cap/upload-cap findings unless a specific bug lets a small malformed input trigger crash, corruption, infinite loop, or disproportionate exhaustion.
-23. Filter purely theoretical UB, portability, unaligned-access, or signed-overflow reports with no supported-platform impact and no realistic external trigger.
-24. Filter RFC non-compliance without concrete smuggling, bypass, memory corruption, data exposure, state corruption, or crash.
-25. Keep security-relevant production-like examples: dashboards, upload servers, MQTT brokers, firmware update flows, auth examples, TLS examples, and filesystem-serving examples.
-26. Keep client-side findings caused by malicious servers, brokers, DNS responders, TLS peers, WebSocket peers, or HTTP peers.
-27. Keep callback-related findings only when Mongoose invokes the callback normally and then unsafely continues using freed or mutated state.
-28. Keep availability findings when one malformed packet, request, certificate, DNS response, MQTT message, WebSocket frame, or small sequence can reliably crash, wedge, corrupt, or disrupt a Mongoose target.
-29. Keep custom backend findings only when the issue is in Mongoose’s backend interface, default backend, documented backend contract, or common backend implementation.
-30. When uncertain, keep findings with clear external input, reachable code path, and concrete impact in Mongoose library/protocol/driver code; filter internal-access, impossible-state, local-misuse, generic-hardening, and speculative reports.
-31. For dashboard reports, do not infer unauthenticated access from a route-specific check alone; account for the broader authentication flow. Keep concrete reachable bugs such as path traversal, unsafe decoded paths, or file read/write/delete issues.
+11. Keep embedded packet parser bugs in Ethernet, ARP, IP, IPv6, ICMP, UDP, TCP, DHCP, SNTP, or drivers when malformed traffic causes OOB, overflow, descriptor corruption, queue corruption, state corruption, or crash.
+12. Keep IRQ, polling, RX descriptor, and packet-loop livelock/starvation/wedge bugs caused by received traffic.
+13. Keep event-lifecycle bugs reachable from external input: UAF, stale pointer, double close, callback lifetime error, iobuf mutation after close, protocol transition confusion, timer/wakeup after free.
+14. Keep externally reachable `mg_str` null-termination mistakes causing OOB read, data leak, auth bypass, parser confusion, or crash.
+15. Keep integer conversion bugs where external lengths affect allocation, copying, parsing, or bounds checks.
+16. Filter parser/helper reports based only on a local caller passing invalid pointers, fake lengths, fake structs, or corrupted objects.
+17. Filter reports requiring direct mutation of connection internals such as protocol flags, closing flags, handler pointers, iobuf fields, callback pointers, or user data.
+18. Filter reports requiring attacker control of `MG_ENABLE_*`, TLS backend macros, filesystem backend macros, compiler flags, debug flags, sanitizer settings, or platform defines.
+19. Filter direct hardware-access reports requiring writes to registers, DMA descriptors, MMIO, IRQ state, cache controls, or peripheral configuration.
+20. Filter generic “Mongoose lacks authentication” reports unless a helper, route pattern, auth parser, MQTT broker behavior, dashboard, upload handler, or OTA endpoint creates a concrete issue.
+21. Filter generic rate-limit/quota/connection-cap/upload-cap findings unless a specific bug lets a small malformed input trigger crash, corruption, infinite loop, or disproportionate exhaustion.
+22. Filter purely theoretical UB, portability, unaligned-access, or signed-overflow reports with no supported-platform impact and no realistic external trigger.
+23. Filter RFC non-compliance without concrete smuggling, bypass, memory corruption, data exposure, state corruption, or crash.
+24. Keep security-relevant production library code under `src/` for dashboards, uploads, MQTT, firmware updates, authentication, TLS, and filesystem serving.
+25. Keep client-side findings caused by malicious servers, brokers, DNS responders, TLS peers, WebSocket peers, or HTTP peers.
+26. Keep callback-related findings only when Mongoose invokes the callback normally and then unsafely continues using freed or mutated state.
+27. Keep availability findings when one malformed packet, request, certificate, DNS response, MQTT message, WebSocket frame, or small sequence can reliably crash, wedge, corrupt, or disrupt a Mongoose target.
+28. Keep custom backend findings only when the issue is in Mongoose’s backend interface, default backend, documented backend contract, or common backend implementation.
+29. When uncertain, keep findings with clear external input, reachable code path, and concrete impact in Mongoose library/protocol/driver code; filter internal-access, impossible-state, local-misuse, generic-hardening, and speculative reports.
+30. For dashboard reports, do not infer unauthenticated access from a route-specific check alone; account for the broader authentication flow. Keep concrete reachable bugs such as path traversal, unsafe decoded paths, or file read/write/delete issues.
+31. Filter reports regarding DNS transaction ID predictability or lack of strict question-name matching in DNS response processing, as these are acknowledged design limitations of the current implementation.
+32. Filter reports that unauthenticated SNTP time affects TLS certificate validity when Mongoose only performs the SNTP sync if mg_boot_timestamp_ms has not already been initialized.
+33. Filter TCP ISN predictability, weak sequence-number generation, RFC 6528 non-compliance, blind/off-path handshake spoofing, forged RST, and sequence-number-guessing reports in the built-in TCP/IP stack.

resources/specs/claude-pr-security-review.md

@@ -1,24 +1,35 @@
-Review the complete PR diff. This contains all code changes in the PR.
+Review only changes under `src/` in the complete PR diff. Ignore all other changes in the PR.
 
 # OBJECTIVE
 
 Perform a security-focused code review to identify HIGH-CONFIDENCE security vulnerabilities that could have real exploitation potential.
 
-This is not a general code review - focus ONLY on security implications newly added by this PR. Do not comment on existing security concerns.
+This is not a general code review - focus ONLY on security implications newly added by this PR under `src/`. Do not analyze, count, or report changes outside `src/`. Do not comment on existing security concerns.
 
-For this task, you will rely on two additional files, `resources/specs/claude-security-scan-instructions.md` detailing security scan instructions specific to the repository and `resources/specs/claude-false-positive-filtering.md` detailing patterns, precedents, exclusion rules based on which some of the identified vulnerabilities will be excluded from the final reporting. The instructions, rules and criterias found in those two files are MANDATORY TO BE HONOURED and your security audit will have to take all of them into account.
+For this task, you will rely on the specified shared security-review sections in `resources/specs/claude-security-scan.md`, the specified security-guidance sections in the six `resources/specs/areas/*.md` prompts listed below, and `resources/specs/claude-false-positive-filtering.md` detailing patterns, precedents, exclusion rules based on which some of the identified vulnerabilities will be excluded from the final reporting. The instructions, rules and criterias found in those referenced sections and the filtering file are MANDATORY TO BE HONOURED and your security audit will have to take all of them into account.
 
-YOU MUST READ AND ANALYZE BOTH OF THESE FILES BEFORE COMMENCING THE SECURITY AUDIT. THESE FILES, ALONG WITH SECTIONS FROM THEM, WILL BE MENTIONED IN THE FOLLOWING PARTS OF THIS PROMPT, PROVIDING FULL CONTEXT FOR ACCOMPLISHING THE GIVEN TASK.
+YOU MUST READ AND ANALYZE THE SPECIFIED SECTIONS AND THE FILTERING FILE BEFORE COMMENCING THE SECURITY AUDIT. THESE SOURCES WILL BE MENTIONED IN THE FOLLOWING PARTS OF THIS PROMPT, PROVIDING FULL CONTEXT FOR ACCOMPLISHING THE GIVEN TASK.
 
 # CRITICAL INSTRUCTIONS
 1. MINIMIZE FALSE POSITIVES: Only flag issues where you're >80% confident of actual exploitability
 2. AVOID NOISE: Skip theoretical issues, style concerns, or low-impact findings
-3. UNDERSTANDING CONTEXT AND SCOPE OF REVIEW: In the security scan instructions file `resources/specs/claude-security-scan-instructions.md`, read the `External Attacker Threat Model` and `Mongoose-Specific Security Review Scope` subsections found in the `SECURITY SCAN CONTEXT` main section for a full understanding of the scanning model, code review context and the perspective from which the scanning is going to take place.
+3. UNDERSTANDING CONTEXT AND SCOPE OF REVIEW: In `resources/specs/claude-security-scan.md`, read only the `External Attacker Threat Model` and `Mongoose-Specific Security Review Scope` subsections found in the `SECURITY SCAN CONTEXT` main section for a full understanding of the scanning model, code review context and the perspective from which the scanning is going to take place. Do not apply unrelated full-scan instructions from that file. In particular, do not inherit assigned-area scan scope, full-scan JSON output requirements, full-scan `review_completed` semantics, instructions to scan long-standing code independently of the PR, or area-selection workflow behavior. This PR prompt's scope, methodology, validation, and output rules remain authoritative.
 4. TREAT EXCLUSIONS AS MANDATORY. The exclusions section below is mandatory. If a potential finding falls under an exclusion, do not report it. If a finding partially overlaps an exclusion, only report it if there is a concrete, non-excluded security impact.
 
 # SECURITY CATEGORIES TO EXAMINE 
 
-In the security scan instructions file `resources/specs/claude-security-scan-instructions.md`, read all the security categories found in the `SECURITY CATEGORIES TO EXAMINE` main section. THESE ARE THE SECURITY CATEGORIES WHICH NEED TO BE EXAMINED.
+Read the general/common security categories in the `GENERAL SECURITY CATEGORIES TO EXAMINE` section of `resources/specs/claude-security-scan.md`.
+
+Also read the `Area-Specific Security Guidance` section from every area prompt:
+
+* `resources/specs/areas/common_misc.md`
+* `resources/specs/areas/mongoose_core.md`
+* `resources/specs/areas/web_http_auth.md`
+* `resources/specs/areas/tls.md`
+* `resources/specs/areas/net_builtin.md`
+* `resources/specs/areas/protocols.md`
+
+Use only the security guidance from the area prompts and ignore their full-scan-specific `Target` sections. Consider the complete set of common and area-specific security categories for every file the PR modifies under `src/`. Do not choose one area or make this PR review area-scoped. Ignore all other changed paths and report only security vulnerabilities introduced by the PR under `src/`.
 
 Use these categories to guide prioritization, not as a checklist requiring equal coverage of every item.
 
@@ -37,7 +48,7 @@ Phase 2 - Comparative Analysis:
 - Flag code that introduces new attack surfaces
 
 Phase 3 - Vulnerability Assessment:
-- Examine each modified file for security implications
+- Examine each modified file under `src/` for security implications
 - Trace data flow from user inputs to sensitive operations
 - Look for privilege boundaries being crossed unsafely
 - Identify injection points and unsafe deserialization
@@ -110,6 +121,6 @@ Better to miss some theoretical issues than flood the report with false positive
 
 Read the `HARD EXCLUSIONS` section found in the `resources/specs/claude-false-positive-filtering.md` filtering file, for each possbile vulnerability found, check if it matches any items from the patterns listed in that section and if that is the case, exclude that vulnerability from the report. DO NOT REPORT IT if a match is found. Also, take into account the project-specific filtering and reporting precedents found in the `PRECEDENTS` section of the filtering file.
 
-Begin your analysis now. Use the repository exploration tools to understand the codebase context, then analyze the PR changes for security implications.
+Begin your analysis now. Use the repository exploration tools to understand the `src/` codebase context, then analyze only the PR changes under `src/` for security implications.
 
-Your final action must be posting the PR comment. You should not reply again after posting the PR comment.
+Your final action must be posting the PR comment. You should not reply again after posting the PR comment.

resources/specs/claude-security-scan-instructions.md

@@ -1,121 +0,0 @@
-# SECURITY SCAN CONTEXT
-
-**External Attacker Threat Model:**
-- Analyze vulnerabilities from the perspective of an external attacker, not from the perspective of a developer, local user, debugger, test harness, or code running inside the process.
-- The attacker can provide bytes through real external interfaces exposed by Mongoose or a Mongoose-based application: TCP, UDP, HTTP, WebSocket, MQTT, DNS, mDNS, TLS handshakes/certificates, Ethernet/IP/TCP/UDP packets, uploaded files, request paths, query strings, headers, message bodies, malicious server responses, and other protocol inputs.
-- The attacker cannot directly call internal C functions, pass arbitrary invalid pointers, mutate internal structs, invoke callbacks manually, edit compile-time macros, alter build flags, write to hardware registers, control DMA descriptors directly, attach a debugger, or run code inside the target process.
-- For a finding to be valid, show how attacker-controlled external input reaches the vulnerable code path through normal library/application execution.
-- Do not report findings that require impossible internal states unless the finding also explains how an external input can cause that state.
-- Do not report “API misuse” as a library vulnerability unless the API contract makes the insecure use likely, undocumented, or unavoidable.
-- For embedded networking and driver code, assume the attacker can send malformed network traffic to the device, but cannot directly manipulate hardware registers, memory-mapped I/O, DMA rings, or interrupt state except as a consequence of packets processed by the driver.
-
-**Mongoose-Specific Security Review Scope:**
-- Treat this repository as a security-sensitive embedded C/C++ networking stack. Mongoose processes attacker-controlled bytes from TCP, UDP, HTTP, WebSocket, MQTT, DNS, mDNS, TLS, filesystem upload/download paths, and built-in TCP/IP drivers.
-- In this repository, remotely triggerable denial of service is security-relevant when it is caused by a concrete implementation flaw such as memory corruption, parser abort, assertion failure, stack exhaustion, infinite loop, unbounded recursion, IRQ livelock, connection state corruption, descriptor-ring corruption, or a single unauthenticated packet causing process/device crash.
-- Prioritize HIGH and MEDIUM severity findings. Include LOW only when unusually concrete, externally relevant, and useful. Do not report vague robustness concerns. Every finding must identify the attacker-controlled input, affected parser/state machine/buffer, concrete impact, and the exact code path.
-- Prefer findings with a plausible packet/request/message shape. For network protocol issues, describe the relevant malformed HTTP request, MQTT packet, WebSocket frame, DNS message, TLS handshake/certificate input, Ethernet/IP/TCP/UDP packet, or filesystem request.
-- Because this is C/C++, memory safety vulnerabilities are in scope. Buffer overflows, stack overflows, heap overflows, out-of-bounds reads/writes, use-after-free, double free, integer overflow leading to memory corruption, invalid pointer lifetime, and unsafe length conversions must be reviewed carefully.
-- Do not dismiss issues merely because they are “only DoS” if the issue is remotely triggerable against an embedded server, broker, device dashboard, firmware-update endpoint, or network-facing parser.
-
-# SECURITY CATEGORIES TO EXAMINE
-
-**C Memory Safety and Length-Handling Vulnerabilities:**
-- Look for writes to fixed-size stack or heap buffers where the loop bound is derived from attacker-controlled protocol fields, including topic counts, header counts, chunk counts, multipart parts, DNS labels, WebSocket fragments, TCP/IP options, or filesystem path components.
-- Check all conversions between `size_t`, `int`, `long`, `uint16_t`, `uint32_t`, and signed protocol lengths. Flag integer truncation, wraparound, negative-to-large conversion, or off-by-one behavior that can affect allocation, parsing, copying, or bounds checks.
-- Review any `memcpy`, `memmove`, `memcmp`, `snprintf`, `mg_snprintf`, `mg_xprintf`, iobuf append/delete/resize operation, and manual pointer increment where source length can originate from network input.
-- Treat `struct mg_str` values as non-null-terminated unless the code proves otherwise. Flag use of `strlen`, `%s`, `strcmp`, `strstr`, or C-string APIs on attacker-controlled `mg_str.buf` unless length and termination are guaranteed.
-- Check for parser code that advances pointers without proving that enough bytes remain. Flag any read of fixed-size fields, variable-length integers, DNS labels, TLS vectors, MQTT remaining length, WebSocket extended lengths, or HTTP chunks before bounds are validated.
-- Look for inconsistent ownership and lifetime of buffers referenced by `mg_str`, connection receive/send iobufs, TLS buffers, filesystem buffers, and event callback data.
-- Check for reentrancy hazards in event callbacks where user handlers may close a connection, mutate iobufs, start TLS, change protocol handlers, or free state while protocol code continues using stale pointers.
-
-**HTTP Parser, Request Smuggling, and Message Framing:**
-- Verify that HTTP requests or responses containing both `Content-Length` and `Transfer-Encoding` are rejected or handled in a way that cannot cause front-end/back-end desynchronization. Treat CL+TE coexistence as security-relevant request smuggling risk.
-- Verify that duplicate `Content-Length`, duplicate `Transfer-Encoding`, conflicting transfer codings, malformed chunk sizes, chunk extensions, premature EOF, and body length mismatches cannot cause inconsistent body parsing.
-- Check whether HTTP/1.0, HTTP/1.1, and malformed protocol versions alter CL/TE handling unsafely. A message with both `Content-Length` and `Transfer-Encoding` should not be accepted merely because of version differences.
-- Look for parsing paths where headers are normalized differently from later lookup paths, including case folding, whitespace around colon, obs-fold/line folding, embedded NUL, duplicate headers, or partial header names.
-- Review URL decoding, query parsing, multipart parsing, upload handling, range handling, and chunked responses for bounds mistakes, truncation, or inconsistent decoded-vs-raw path decisions.
-- Check static file serving and SSI handling for path traversal through percent-encoding, double decoding, backslashes on Windows, mixed separators, dot-dot segments, absolute paths, drive letters, symlinks, embedded NUL, or alias/root_dir confusion.
-- Review HTTP authentication helper paths for parsing ambiguities in Basic auth, header extraction, credential truncation, empty username/password acceptance, or incorrect comparison behavior.
-- Check that HTTP upgrade to WebSocket validates method, headers, key, version, and connection semantics consistently before switching protocol state.
-
-**MQTT Parser and Broker/Client State Machine Vulnerabilities:**
-- Review MQTT fixed header parsing, remaining-length decoding, variable-length integer loops, packet identifier handling, QoS transitions, topic extraction, property parsing, and MQTT 3.x vs MQTT 5 differences.
-- Look for malformed MQTT packets that can trigger out-of-bounds reads/writes, stack buffer overflow, heap corruption, assertion/crash, or parser desynchronization.
-- Specifically check SUBSCRIBE and UNSUBSCRIBE handling for unbounded numbers of topics, malformed topic length fields, missing QoS bytes, invalid QoS values, and writes to fixed-size response arrays.
-- Verify that PUBLISH handling enforces topic length, packet length, QoS rules, retained flag handling, packet identifier requirements, and message bounds before accessing fields.
-- Check broker examples and protocol handlers for authorization bypass, cross-topic data exposure, wildcard topic mishandling, `$SYS` or reserved topic confusion, and unintended publish/subscribe access.
-- Review MQTT reconnect/resubscribe logic for stale connection state, packet identifier reuse bugs, and memory lifetime problems after close/reconnect.
-- Treat unauthenticated single-packet broker crash, client crash from malicious broker response, or memory corruption during MQTT parsing as reportable.
-
-**WebSocket Framing and Upgrade Vulnerabilities:**
-- Review WebSocket frame parsing for extended payload length handling, 16-bit/64-bit length conversion, masking rules, fragmentation, continuation frames, control-frame length limits, close/ping/pong handling, and compression-related assumptions if present.
-- Check that client-to-server frames require masking and that malformed mask/payload boundaries cannot read or write out of bounds.
-- Look for state-machine confusion after HTTP upgrade, especially where partial frames, fragmented messages, or mixed HTTP/WebSocket bytes can cause parser desynchronization.
-- Check whether large or malformed frame lengths can cause integer overflow, memory corruption, uncontrolled allocation, connection lockup, or single-connection/device crash.
-- Verify that WebSocket message APIs preserve attacker-controlled binary data length correctly and do not pass non-null-terminated payloads to C-string functions.
-
-**TLS, Certificate, Hostname Verification, and Cryptographic Validation:**
-- Review all TLS backends, including built-in TLS, mbedTLS, OpenSSL, WolfSSL, and custom TLS integration, for equivalent security behavior where possible.
-- Flag certificate verification bypasses, accidental `skip_verification` use in security-sensitive examples or defaults, missing hostname verification when `name`/SNI is available, or inconsistent validation across TLS backends.
-- For hostname verification, check wildcard handling carefully. A wildcard certificate identity must not match multiple DNS labels. For example, `*.example.com` must not match `a.b.example.com`.
-- Verify that wildcard matching is applied only to certificate presented identifiers, not to arbitrary reference identifiers or general DNS glob matching.
-- Review `mg_match` or other glob/matching helpers if used for certificate identity checks, authorization checks, filesystem paths, routing, or topic matching. Flag cases where glob semantics are broader than the security policy requires.
-- Check certificate parsing for DER/PEM boundary errors, length overflows, malformed ASN.1, extension parsing mistakes, name constraints, SAN vs CN precedence, embedded NUL, and invalid string type handling.
-- Review TLS record parsing, handshake transcript handling, key schedule, random generation, ECC/X25519 operations, AES-GCM nonce/tag handling, and error handling for memory safety and authentication failures.
-- Flag any behavior that silently falls back from verified TLS to unverified TLS or plaintext.
-- Check that TLS receive/send error paths cannot corrupt connection state, reuse freed buffers, or continue processing unauthenticated plaintext as encrypted data.
-
-**DNS, mDNS, URL Parsing, and Name Resolution:**
-- Review DNS and mDNS message parsing for label length validation, compression pointer loops, pointer bounds, recursive expansion limits, integer overflow, malformed resource records, and out-of-bounds reads.
-- Check that DNS answers are matched to outstanding requests by transaction ID, question name/type/class, and source expectations where applicable.
-- Look for cache poisoning, response spoofing, or name confusion if DNS response validation is weak in client or resolver code.
-- Review URL parsing for scheme, host, port, IPv6 literal, userinfo, percent-encoding, embedded NUL, empty host, default port, and path/query boundary confusion.
-- Check for SSRF-relevant behavior only when attacker input can control the destination host, protocol, or network boundary. Path-only control is not sufficient.
-- Verify that DNS failures, timeouts, and retries cannot leave dangling active request state or corrupt connection state.
-
-**Built-In TCP/IP Stack, Packet Parsing, and Embedded Network Drivers:**
-- Review Ethernet, ARP, IP, IPv6, ICMP, UDP, TCP, DHCP, SNTP, and driver receive/transmit paths for packet-length validation before reading protocol headers.
-- Check IP/TCP/UDP header length fields, options length, fragmentation/reassembly behavior, checksum handling, and payload offset calculations for underflow, overflow, or out-of-bounds access.
-- Look for malformed packets that can corrupt descriptor rings, RX/TX buffers, queue state, ARP tables, connection state, or timers.
-- Review interrupt handlers and bare-metal driver code for bounded processing loops. Flag IRQ paths where attacker-controlled traffic can cause livelock, starvation, descriptor ownership loss, or repeated processing of the same malformed frame.
-- Check DMA descriptor ownership transitions, memory barriers, cache coherency handling, and buffer length fields for race-like bugs that can cause memory corruption or stale packet reuse.
-- Review platform-specific drivers such as STM32, NXP, TI, Microchip, Renesas, Infineon, Wiznet, Cypress WiFi, cellular, and other built-in stack integrations for inconsistent bounds checks or endian conversions.
-- Treat a remotely reachable malformed Ethernet/IP/TCP/UDP packet that crashes, wedges, or corrupts an embedded target as reportable.
-
-**Filesystem Serving, Uploads, Packed Filesystems, and SSI:**
-- Review `mg_http_serve_dir`, `mg_http_serve_file`, upload APIs, packed filesystem code, and SSI expansion for traversal, unauthorized file read/write, overwrite, truncation, or unexpected executable/include behavior.
-- Check path canonicalization across POSIX, Windows, embedded filesystems, packed filesystems, and custom `mg_fs` implementations.
-- Look for inconsistent handling of decoded and undecoded paths, double decoding, query string leakage into path, trailing slash confusion, NUL byte truncation, and case sensitivity differences.
-- Review multipart upload parsing for boundary confusion, filename traversal, field length overflow, partial-write behavior, and max-size enforcement.
-- Check SSI include handling for directory escape, recursive include loops, unintended disclosure of local files, and parsing of attacker-controlled SSI directives.
-- Verify that range requests and static response headers cannot cause out-of-bounds reads or disclose memory.
-
-**OTA/Firmware Update and Device Dashboard Security:**
-- Review firmware update endpoints and examples for missing authentication, authorization bypass, path confusion, arbitrary write, unsafe flash offset/length handling, and failure to verify firmware authenticity where the code claims secure update behavior.
-- Check update chunk parsing for integer overflow, flash boundary crossing, rollback/downgrade exposure, incomplete image bootability, and crash/power-loss unsafe state transitions.
-- Flag any code path where unauthenticated network input can write firmware, configuration, filesystem contents, flash pages, bootloader state, or device identity material.
-- Review device dashboard examples for security-sensitive default routes, credentials, upload handlers, debug endpoints, config mutation endpoints, and CORS/header behavior when they are likely to be copied into production.
-- Do not report ordinary insecure demo behavior unless it creates a realistic copy-paste production vulnerability or affects library code.
-
-**Protocol State Machine and Event-Driven Lifecycle Bugs:**
-- Review transitions between listening, accepted, connecting, resolving, TLS handshaking, HTTP, WebSocket, MQTT, draining, closing, and closed states.
-- Check whether malformed input can cause protocol handlers to process data in the wrong state, process stale data after close, or invoke callbacks with invalid event data.
-- Look for use-after-free or stale pointer use when callbacks call `mg_close_conn`, mark a connection closing, mutate iobufs, change protocol handlers, or initiate TLS/WebSocket/MQTT transitions.
-- Verify that partial reads/writes, backpressure, `is_full`, draining, TLS pending states, and send-buffer mutations cannot cause duplicated sends, skipped validation, or parser confusion.
-- Review timer and wakeup handling for stale user data pointers, cross-thread queue misuse, and callbacks firing after associated connections/state have been freed.
-- Only report concurrency or race issues when a concrete event ordering can trigger memory corruption, unauthorized action, or reliable device/process crash.
-
-**Cross-Platform C Portability With Security Impact:**
-- Review code paths whose security depends on struct packing, alignment, endianness, pointer size, signedness of `char`, integer width, or platform-specific filesystem/network behavior.
-- Check for unaligned memory access on embedded targets when parsing attacker-controlled network packets.
-- Verify endian conversions for Ethernet/IP/TCP/UDP/DNS/MQTT/TLS fields before bounds checks and allocations.
-- Look for platform branches where one backend performs validation and another does not, especially across UNIX, Windows, lwIP, Zephyr, FreeRTOS-like systems, bare-metal, and built-in TCP/IP stack modes.
-- Flag portability bugs only when they create a realistic vulnerability on a supported platform, not merely theoretical undefined behavior.
-
-**Authentication, Authorization, and Access-Control Patterns in Mongoose Integrations:**
-- Review examples and helper APIs that implement HTTP auth, cookies, sessions, tokens, device dashboards, REST APIs, MQTT topic access, upload endpoints, and firmware update endpoints.
-- Flag authentication bypasses caused by prefix route matching, glob matching, decoded-vs-raw URI confusion, case normalization mistakes, missing boundary checks, or default-open sensitive endpoints.
-- Check for authorization decisions made in client-side JavaScript only. Client-side checks are not security boundaries.
-- Review CORS and origin checks only when they protect credentialed sensitive operations and the exploit path is concrete.
-- Look for credential comparison bugs, truncation of usernames/passwords, accepting empty credentials, parsing only part of an Authorization header, or treating malformed credentials as anonymous-but-authorized.
-- Flag sensitive data exposure when secrets, credentials, tokens, private keys, firmware signing material, PII, or device identity values can be read by unauthorized remote clients or logged from attacker-triggered paths.

resources/specs/claude-security-scan.md

@@ -1,24 +1,34 @@
-# Full Codebase Security Scan Prompt
+# Security Scan Master Prompt
 
-You are an expert security reviewer performing a full-codebase security audit of the checked-out repository.
+You are an expert security reviewer performing a focused security audit centered on one assigned scan area in the checked-out repository.
 
-You must analyze the repository as a whole and identify credible, externally reachable security vulnerabilities in the current implementation.
+You must analyze the assigned target and security surface and identify credible, externally reachable security vulnerabilities in the current implementation.
 
-For this task, you will rely on two additional files, `resources/specs/claude-security-scan-instructions.md` detailing security scan instructions specific to the repository and `resources/specs/claude-false-positive-filtering.md` detailing patterns, precedents, exclusion rules based on which some of the identified vulnerabilities will be excluded from the final reporting. The instructions, rules and criterias found in those two files are MANDATORY TO BE HONOURED and your security audit will have to take all of them into account.
+Every full security scan uses:
 
-YOU MUST READ AND ANALYZE BOTH OF THESE FILES BEFORE COMMENCING THE SECURITY AUDIT. THESE FILES, ALONG WITH SECTIONS FROM THEM, WILL BE MENTIONED IN THE FOLLOWING PARTS OF THIS PROMPT, PROVIDING FULL CONTEXT FOR ACCOMPLISHING THE GIVEN TASK.
+1. the shared master prompt: `resources/specs/claude-security-scan.md`;
+2. one area prompt selected by the workflow: `resources/specs/areas/<area>.md`;
+3. the common filtering prompt: `resources/specs/claude-false-positive-filtering.md`.
+
+The area prompt defines what is being scanned. This master prompt defines how security analysis and reporting are performed. The filtering prompt defines what must not be reported and which historical precedents must be honored.
+
+YOU MUST READ AND ANALYZE THE ASSIGNED AREA PROMPT AND THE COMMON FILTERING PROMPT BEFORE COMMENCING THE SECURITY AUDIT. THE INSTRUCTIONS, RULES, AND CRITERIA IN ALL THREE PROMPTS ARE MANDATORY TO BE HONORED.
 
 ## OBJECTIVE
 
-You are reviewing a full source repository for security vulnerabilities.
+You are reviewing one assigned security area in a source repository for security vulnerabilities.
 
-The repository may contain application code, protocol parsers, networking code, embedded code, library code, examples, tests, build scripts, documentation, generated files, and third-party/vendor code.
+The `src/` directory contains the protocol parsers, networking code, embedded code, library code, generated code, and platform-specific code in scope for this review.
 
-Your task is to determine which parts of the repository are security-relevant, identify externally reachable attack surfaces, and report only findings with a concrete vulnerability pattern, credible attacker influence, and meaningful security impact.
+The area-specific prompt defines the primary files and security surface for this invocation. Your task is to identify externally reachable attack surfaces within that assigned area and report only findings with a concrete vulnerability pattern, credible attacker influence, and meaningful security impact.
+
+The security review target is limited to code under `src/`. Do not analyze, count, or report code outside `src/` as part of the security review.
+
+You may inspect code outside the listed target files only when it is also under `src/` and is necessary to understand data flow, reachability, call chains, state transitions, memory ownership, mitigations, authentication or authorization, protocol interaction, exploitability, or impact. Inspecting supporting code must not turn into an independent security review of unrelated areas. Findings must remain tied to the assigned target and security surface and must identify an affected file under `src/`.
 
 DO NOT modify files, create commits, open PRs, create issues or post comments! You must only produce the final JSON report requested below.
 
-Identify high-confidence security vulnerabilities in the full codebase. For this prompt, high-confidence means confidence >= 0.7 under the scoring rules below. Focus on vulnerabilities that are reachable through normal execution paths and attacker-controlled inputs. Report only findings that have a concrete security impact.
+Identify high-confidence security vulnerabilities in the assigned scan area. For this prompt, high-confidence means confidence >= 0.7 under the scoring rules below. Focus on vulnerabilities that are reachable through normal execution paths and attacker-controlled inputs. Report only findings that have a concrete security impact.
 
 Do not report vague best-practice concerns, speculative hardening suggestions, style issues, maintainability concerns, generic bug risks, or findings without a clear attacker-controlled path.
 
@@ -26,9 +36,26 @@ Existing vulnerabilities in the current codebase are in scope.
 
 Previously introduced vulnerabilities are in scope.
 
-Any security-relevant issue present in the checked-out repository is in scope unless explicitly excluded below.
+Any security-relevant issue tied to the assigned target or security surface is in scope unless explicitly excluded below.
 
-In the security scan instructions file `resources/specs/claude-security-scan-instructions.md`, read the `External Attacker Threat Model` and `Mongoose-Specific Security Review Scope` subsections found in the `SECURITY SCAN CONTEXT` main section for a full understanding of the scanning model and the code review context.
+## SECURITY SCAN CONTEXT
+
+**External Attacker Threat Model:**
+- Analyze vulnerabilities from the perspective of an external attacker, not from the perspective of a developer, local user, debugger, test harness, or code running inside the process.
+- The attacker can provide bytes through real external interfaces exposed by Mongoose or a Mongoose-based application: TCP, UDP, HTTP, WebSocket, MQTT, DNS, mDNS, TLS handshakes/certificates, Ethernet/IP/TCP/UDP packets, uploaded files, request paths, query strings, headers, message bodies, malicious server responses, and other protocol inputs.
+- The attacker cannot directly call internal C functions, pass arbitrary invalid pointers, mutate internal structs, invoke callbacks manually, edit compile-time macros, alter build flags, write to hardware registers, control DMA descriptors directly, attach a debugger, or run code inside the target process.
+- For a finding to be valid, show how attacker-controlled external input reaches the vulnerable code path through normal library/application execution.
+- Do not report findings that require impossible internal states unless the finding also explains how an external input can cause that state.
+- Do not report “API misuse” as a library vulnerability unless the API contract makes the insecure use likely, undocumented, or unavoidable.
+- For embedded networking and driver code, assume the attacker can send malformed network traffic to the device, but cannot directly manipulate hardware registers, memory-mapped I/O, DMA rings, or interrupt state except as a consequence of packets processed by the driver.
+
+**Mongoose-Specific Security Review Scope:**
+- Treat this repository as a security-sensitive embedded C/C++ networking stack. Mongoose processes attacker-controlled bytes from TCP, UDP, HTTP, WebSocket, MQTT, DNS, mDNS, TLS, filesystem upload/download paths, and built-in TCP/IP drivers.
+- In this repository, remotely triggerable denial of service is security-relevant when it is caused by a concrete implementation flaw such as memory corruption, parser abort, assertion failure, stack exhaustion, infinite loop, unbounded recursion, IRQ livelock, connection state corruption, descriptor-ring corruption, or a single unauthenticated packet causing process/device crash.
+- Prioritize HIGH and MEDIUM severity findings. Include LOW only when unusually concrete, externally relevant, and useful. Do not report vague robustness concerns. Every finding must identify the attacker-controlled input, affected parser/state machine/buffer, concrete impact, and the exact code path.
+- Prefer findings with a plausible packet/request/message shape. For network protocol issues, describe the relevant malformed HTTP request, MQTT packet, WebSocket frame, DNS message, TLS handshake/certificate input, Ethernet/IP/TCP/UDP packet, or filesystem request.
+- Because this is C/C++, memory safety vulnerabilities are in scope. Buffer overflows, stack overflows, heap overflows, out-of-bounds reads/writes, use-after-free, double free, integer overflow leading to memory corruption, invalid pointer lifetime, and unsafe length conversions must be reviewed carefully.
+- Do not dismiss issues merely because they are “only DoS” if the issue is remotely triggerable against an embedded server, broker, device dashboard, firmware-update endpoint, or network-facing parser.
 
 ## CRITICAL INSTRUCTIONS
 
@@ -56,12 +83,14 @@ Do not report:
 * Purely defensive hardening suggestions.
 * Issues that only matter under unrealistic assumptions.
 
-### 3. Analyze the repository as a whole
+### 3. Analyze the assigned scan area
 
-This is a full-codebase scan. You should inspect the repository structure, identify major components, and prioritize security-sensitive code paths.
+This is a targeted scan centered on the primary files and security surface defined by the assigned area prompt. Follow relevant supporting code under `src/` when necessary to establish reachability, data flow, state, validation, mitigation, exploitability, or impact, but do not inspect code outside `src/` as part of the security review or independently review unrelated areas.
 
 Do not restrict analysis to a diff. Do not assume only changed files matter. Do not assume an issue is irrelevant because it appears in old or long-standing code.
 
+Findings must remain tied to the assigned target and security surface.
+
 ### 4. Prioritize externally reachable attack surfaces
 
 Prioritize code reachable from attacker-controlled or peer-controlled inputs. Relevant inputs may include, but are not limited to:
@@ -94,25 +123,40 @@ The exclusions section below is mandatory. If a potential finding falls under an
 
 If a finding partially overlaps an exclusion, only report it if there is a concrete, non-excluded security impact.
 
-## SECURITY CATEGORIES TO EXAMINE
+## GENERAL SECURITY CATEGORIES TO EXAMINE
 
-In the security scan instructions file `resources/specs/claude-security-scan-instructions.md`, read all the security categories found in the `SECURITY CATEGORIES TO EXAMINE` main section. THESE ARE THE SECURITY CATEGORIES WHICH NEED TO BE EXAMINED.
+The following common security categories apply to every assigned scan area. The assigned area prompt provides additional area-specific security guidance.
 
 Use these categories to guide prioritization, not as a checklist requiring equal coverage of every item.
 
+**C Memory Safety and Length-Handling Vulnerabilities:**
+- Look for writes to fixed-size stack or heap buffers where the loop bound is derived from attacker-controlled protocol fields, including topic counts, header counts, chunk counts, multipart parts, DNS labels, WebSocket fragments, TCP/IP options, or filesystem path components.
+- Check all conversions between `size_t`, `int`, `long`, `uint16_t`, `uint32_t`, and signed protocol lengths. Flag integer truncation, wraparound, negative-to-large conversion, or off-by-one behavior that can affect allocation, parsing, copying, or bounds checks.
+- Review any `memcpy`, `memmove`, `memcmp`, `snprintf`, `mg_snprintf`, `mg_xprintf`, iobuf append/delete/resize operation, and manual pointer increment where source length can originate from network input.
+- Treat `struct mg_str` values as non-null-terminated unless the code proves otherwise. Flag use of `strlen`, `%s`, `strcmp`, `strstr`, or C-string APIs on attacker-controlled `mg_str.buf` unless length and termination are guaranteed.
+- Check for parser code that advances pointers without proving that enough bytes remain. Flag any read of fixed-size fields, variable-length integers, DNS labels, TLS vectors, MQTT remaining length, WebSocket extended lengths, or HTTP chunks before bounds are validated.
+- Look for inconsistent ownership and lifetime of buffers referenced by `mg_str`, connection receive/send iobufs, TLS buffers, filesystem buffers, and event callback data.
+- Check for reentrancy hazards in event callbacks where user handlers may close a connection, mutate iobufs, start TLS, change protocol handlers, or free state while protocol code continues using stale pointers.
+
+**Cross-Platform C Portability With Security Impact:**
+- Review code paths whose security depends on struct packing, alignment, endianness, pointer size, signedness of `char`, integer width, or platform-specific filesystem/network behavior.
+- Check for unaligned memory access on embedded targets when parsing attacker-controlled network packets.
+- Verify endian conversions for Ethernet/IP/TCP/UDP/DNS/MQTT/TLS fields before bounds checks and allocations.
+- Look for platform branches where one backend performs validation and another does not, especially across UNIX, Windows, lwIP, Zephyr, FreeRTOS-like systems, bare-metal, and built-in TCP/IP stack modes.
+- Flag portability bugs only when they create a realistic vulnerability on a supported platform, not merely theoretical undefined behavior.
+
 ## ANALYSIS METHODOLOGY
 
 Follow this methodology before producing the final JSON.
 
 ### Phase 1: Repository context research
 
-First, understand the repository.
+First, understand the assigned area within `src/`.
 
 Identify:
 
-* Main source directories.
-* Build systems.
-* Public APIs.
+* Relevant directories under `src/`.
+* Public APIs declared under `src/`.
 * Protocol implementations.
 * Network-facing components.
 * File parsing components.
@@ -120,14 +164,13 @@ Identify:
 * TLS, crypto, or certificate validation logic.
 * Memory management patterns.
 * Platform-specific code.
-* Example, test, fuzz, generated, and vendor directories.
-* Components most likely to process attacker-controlled input.
+* Components in the assigned area most likely to process attacker-controlled input.
 
-Use repository files to infer the actual architecture instead of assuming a generic web application model.
+Use files under `src/` to infer the actual architecture instead of assuming a generic web application model.
 
 ### Phase 2: Attack surface mapping
 
-Map the externally reachable attack surfaces.
+Map the externally reachable attack surfaces within the assigned area.
 
 For each important surface, determine:
 
@@ -166,6 +209,7 @@ Before including any finding in the final output, confirm:
 * The severity matches the impact.
 * The finding is not a duplicate of another finding.
 * The finding is not excluded.
+* The finding is tied to the assigned target or security surface.
 
 If you cannot provide this level of specificity, do not report the finding.
 
@@ -218,6 +262,8 @@ The value of `files_reviewed` should reflect the number of files substantially i
 
 Do not inflate this number by counting files that were only listed or briefly skimmed.
 
+The value `review_completed: true` means the assigned scan area was meaningfully reviewed, not that the entire repository was reviewed.
+
 ## SEVERITY GUIDELINES
 
 Use these severity definitions.
@@ -313,10 +359,9 @@ Take into account the project-specific filtering and reporting precedents found
 
 ## DIRECTORY AND FILE EXCLUSIONS
 
-Do not analyze or report findings from the following paths unless they are directly used by production/library code:
-- .github/
-- resources/
-- test/
+Only analyze and report findings from files under `src/`.
+
+Do not analyze or count code outside `src/` as part of the security review.
 
 ## OUTPUT REQUIREMENTS
 
@@ -336,4 +381,4 @@ Do not include commentary.
 
 Do not reply again after outputting the JSON.
 
-Begin the full-codebase security analysis now.
+Begin the assigned-area security analysis now.

sbom.cdx.json

@@ -3,22 +3,22 @@
   "bomFormat": "CycloneDX",
   "specVersion": "1.6",
   "serialNumber": "urn:uuid:d3f8b1e2-4a7c-4d9e-bf2a-1c3e5f7a9b0d",
-  "version": 1,
+  "version": 2,
   "metadata": {
-    "timestamp": "2026-06-01T00:00:00Z",
+    "timestamp": "2026-10-13T00:00:00Z",
     "component": {
       "type": "library",
       "bom-ref": "mongoose",
       "supplier": { "name": "Cesanta Software Limited", "url": ["https://cesanta.com"] },
       "author": "Cesanta Software Limited",
       "name": "mongoose",
-      "version": "7.21",
+      "version": "7.23",
       "description": "Two-file C/C++ embedded networking library. HTTP, WebSocket, MQTT, TLS 1.3, OTA firmware updates, device dashboard. Runs on microcontrollers and desktop OS.",
       "licenses": [
         { "expression": "GPL-2.0-only" },
         { "license": { "name": "Cesanta Commercial License", "url": "https://mongoose.ws/licensing/" } }
       ],
-      "purl": "pkg:github/cesanta/mongoose@7.21",
+      "purl": "pkg:github/cesanta/mongoose@7.23",
       "externalReferences": [
         { "type": "website",          "url": "https://mongoose.ws" },
         { "type": "vcs",              "url": "https://github.com/cesanta/mongoose" },
@@ -27,21 +27,38 @@
         { "type": "distribution",     "url": "https://raw.githubusercontent.com/cesanta/mongoose/master/mongoose.c" }
       ],
       "properties": [
-        { "name": "cpe", "value": "cpe:2.3:a:cesanta:mongoose:7.21:*:*:*:*:*:*:*" }
+        { "name": "cpe", "value": "cpe:2.3:a:cesanta:mongoose:7.23:*:*:*:*:*:*:*" }
       ]
     }
   },
   "components": [
     {
       "type": "library",
-      "bom-ref": "micro-ecc",
-      "author": "Kenneth MacKay",
-      "name": "micro-ecc",
-      "description": "ECC point operations on GF(p) curves (secp256r1). Used by Mongoose built-in TLS 1.3 for ECDH key exchange and ECDSA signatures. Source: src/tls_uecc.c, src/tls_uecc.h.",
-      "licenses": [ { "expression": "BSD-2-Clause" } ],
-      "purl": "pkg:github/kmackay/micro-ecc",
+      "bom-ref": "bearssl-ec",
+      "author": "Thomas Pornin",
+      "name": "BearSSL EC (P-256, P-384, ECDSA)",
+      "description": "P-256 (ec_p256_m31) and P-384 (ec_prime_i31) elliptic curve arithmetic, ECDSA sign and verify, and the i31 bignum code they use, derived from BearSSL. Used by Mongoose built-in TLS 1.3 for ECDHE key exchange and ECDSA signatures, by JWT ES256 and by OTA firmware signature verification. Source: src/tls_p256.c, src/tls_p256.h, src/tls_p384.c, src/tls_p384.h.",
+      "licenses": [ { "expression": "MIT" } ],
       "externalReferences": [
-        { "type": "vcs", "url": "https://github.com/kmackay/micro-ecc" }
+        { "type": "website", "url": "https://bearssl.org" }
+      ],
+      "properties": [
+        { "name": "upstream-commit", "value": "7bea48e5e850ab4cafbe68d3765cdaba13a86d6f" }
+      ]
+    },
+    {
+      "type": "library",
+      "bom-ref": "p256-cortex-m4",
+      "author": "Emil Lenngren, Shortcut Labs AB",
+      "name": "P256-Cortex-M4",
+      "description": "P-256 ECDH and ECDSA in Cortex-M assembly. Used by Mongoose built-in TLS 1.3 instead of the BearSSL P-256 code on Cortex-M cores with the DSP extension (M4, M7, M33, M55, M85). Source: src/tls_p256_cortex.c.",
+      "licenses": [ { "expression": "MIT" } ],
+      "purl": "pkg:github/Emill/P256-Cortex-M4@ecd3ec2222fc9e18b6b44c86bb7183971a2041fc",
+      "externalReferences": [
+        { "type": "vcs", "url": "https://github.com/Emill/P256-Cortex-M4" }
+      ],
+      "properties": [
+        { "name": "upstream-commit", "value": "ecd3ec2222fc9e18b6b44c86bb7183971a2041fc" }
       ]
     },
     {
@@ -55,17 +72,6 @@
         { "type": "website", "url": "https://bearssl.org" }
       ]
     },
-    {
-      "type": "library",
-      "bom-ref": "strobe-x25519",
-      "author": "Cryptography Research, Inc. / Mike Hamburg",
-      "name": "STROBE x25519 (adapted)",
-      "description": "X25519 Diffie-Hellman function adapted from the STROBE project. Used by Mongoose built-in TLS 1.3 for ECDH key exchange. Source: src/tls_x25519.c.",
-      "licenses": [ { "expression": "MIT" } ],
-      "externalReferences": [
-        { "type": "website", "url": "https://strobe.sourceforge.io/" }
-      ]
-    },
     {
       "type": "library",
       "bom-ref": "sha1-reid",

src/arch.h

@@ -4,7 +4,6 @@
 #define MG_ARCH_UNIX 1          // Linux, BSD, Mac, ...
 #define MG_ARCH_WIN32 2         // Windows
 #define MG_ARCH_ESP32 3         // ESP32
-#define MG_ARCH_ESP8266 4       // ESP8266
 
 #define MG_ARCH_FREERTOS 5      // FreeRTOS <-- DEPRECATED !!!
 
@@ -19,6 +18,7 @@
 #define MG_ARCH_RTTHREAD 14     // RT-Thread RTOS
 #define MG_ARCH_ARMCGT 15       // Texas Semi ARM-CGT
 #define MG_ARCH_CUBE 16	        // STM32Cube environment
+#define MG_ARCH_MCUXPRESSO 17   // MCUXpresso environment
 
 #define MG_ARCH_NEWLIB MG_ARCH_ARMGCC  // Alias, deprecate in 2025
 
@@ -49,7 +49,6 @@
 #include "arch_armgcc.h"
 #include "arch_cube.h"
 #include "arch_esp32.h"
-#include "arch_esp8266.h"
 #include "arch_rtx.h"
 #include "arch_threadx.h"
 #include "arch_unix.h"

src/arch_armcgt.h

@@ -12,7 +12,8 @@
 #include <sys/types.h>
 #include <time.h>
 
+#ifndef MG_PATH_MAX
 #define MG_PATH_MAX 100
-#define MG_ENABLE_DIRLIST 0
+#endif
 
 #endif

src/arch_armgcc.h

@@ -18,7 +18,8 @@
 #include <time.h>
 #include <unistd.h>
 
+#ifndef MG_PATH_MAX
 #define MG_PATH_MAX 100
-#define MG_ENABLE_DIRLIST 0
+#endif
 
 #endif

src/arch_cube.h

@@ -25,10 +25,6 @@
 #define MG_PATH_MAX 100
 #endif
 
-#ifndef MG_ENABLE_DIRLIST
-#define MG_ENABLE_DIRLIST 0
-#endif
-
 
 #ifndef MG_ENABLE_TCPIP
 #define MG_ENABLE_TCPIP 1  // Enable built-in TCP/IP stack
@@ -36,6 +32,7 @@
 
 #if MG_ENABLE_TCPIP && !defined(MG_ENABLE_DRIVER_STM32F) && \
     !defined(MG_ENABLE_DRIVER_STM32H) && !defined(MG_ENABLE_DRIVER_STM32N) && \
+    !defined(MG_ENABLE_DRIVER_STM32C) && \
     !defined(MG_ENABLE_DRIVER_CYW) && !defined(MG_ENABLE_DRIVER_CYW_SDIO) && \
     !defined(MG_ENABLE_DRIVER_ST67W6)
 #if defined(STM32F1) || defined(STM32F2) || defined(STM32F4) || defined(STM32F7)
@@ -44,6 +41,8 @@
 #define MG_ENABLE_DRIVER_STM32H 1
 #elif defined(STM32N6)
 #define MG_ENABLE_DRIVER_STM32N 1
+#elif defined(STM32C5)
+#define MG_ENABLE_DRIVER_STM32C 1
 #else
 #error Select a driver in mongoose_config.h
 #endif
@@ -60,70 +59,8 @@
 #define MG_OTA MG_OTA_STM32H5
 #elif !defined(MG_OTA) && defined(STM32H7)
 #define MG_OTA MG_OTA_STM32H7
-#endif
-
-// OTA rollback timer via IWDG. Fixed 10 s hang-detection window (prescaler
-// /1024, LSI ~32 kHz: reload = 10 * 32000 / 1024 = 312). mg_ota_poll() feeds
-// the watchdog every 500 ms while in MG_OTA_TESTING state; if the event loop
-// hangs for 10 s, the IWDG fires and the device rolls back.
-// STM32H7 names the peripheral IWDG1; all others use IWDG.
-// The total evaluation period is set by MG_OTA_ROLLBACK_TIMEOUT_SECONDS.
-// STM32H7 names the watchdog peripheral IWDG1; all other families use IWDG.
-#if defined(IWDG1) && !defined(IWDG)
-#define MG_IWDG IWDG1
-#else
-#define MG_IWDG IWDG
-#endif
-// PR=6 → /256 prescaler, RLR=1250 → ~10 s at LSI 32 kHz.
-// Works on F4/F7/H5/H7; uses direct register writes so it is safe before HAL_Init().
-#ifndef MG_OTA_ROLLBACK_TIMER_START
-#define MG_OTA_ROLLBACK_TIMER_START()                                          \
-  do {                                                                         \
-    MG_IWDG->KR = 0xCCCCU;                              /* start + LSI  */    \
-    MG_IWDG->KR = 0x5555U;                              /* unlock PR/RLR */   \
-    MG_IWDG->PR = 6U;                                   /* /256         */    \
-    MG_IWDG->RLR = 1250U;                               /* 10 s         */    \
-    while (MG_IWDG->SR & (IWDG_SR_PVU | IWDG_SR_RVU)) (void) 0;              \
-    MG_IWDG->KR = 0xAAAAU;                              /* reload       */    \
-  } while (0)
-#endif
-
-// Feed (reload) the IWDG. Called from mg_ota_poll() every 500 ms.
-#ifndef MG_OTA_ROLLBACK_TIMER_FEED
-#define MG_OTA_ROLLBACK_TIMER_FEED() (MG_IWDG->KR = 0xAAAAU)
-#endif
-
-// OTA state in a backup register that survives warm resets but clears on POR.
-// STATE_GET reads work without any setup. STATE_SET enables the RTC APB clock
-// and unlocks backup domain write access via direct register writes, so it is
-// safe to call from any context (before or after HAL_Init).
-// H5 (TAMP->BKP0R), H7 (RTC->BKP0R), F4/F7 (RTC->BKP0R).
-#ifndef MG_OTA_STATE_GET
-#if defined(PWR_DBPCR_DBP)
-#define MG_OTA_DBP_ENABLE() (PWR->DBPCR |= PWR_DBPCR_DBP)
-#elif defined(PWR_CR1_DBP)
-#define MG_OTA_DBP_ENABLE() (PWR->CR1 |= PWR_CR1_DBP)
-#else
-#define MG_OTA_DBP_ENABLE() (PWR->CR |= PWR_CR_DBP)
-#endif
-
-#if defined(TAMP)
-#define MG_OTA_STATE_GET()                                           \
-  (RCC->APB3ENR |= RCC_APB3ENR_RTCAPBEN, TAMP->BKP0R)
-#define MG_OTA_STATE_SET(v)                                           \
-  (RCC->APB3ENR |= RCC_APB3ENR_RTCAPBEN, MG_OTA_DBP_ENABLE(),        \
-   (TAMP->BKP0R = (uint32_t) (v)), TAMP->BKP0R)
-#elif defined(RCC_APB4ENR_RTCAPBEN)
-#define MG_OTA_STATE_GET() (RTC->BKP0R)
-#define MG_OTA_STATE_SET(v)                                           \
-  (RCC->APB4ENR |= RCC_APB4ENR_RTCAPBEN, MG_OTA_DBP_ENABLE(),        \
-   (RTC->BKP0R = (uint32_t) (v)))
-#else
-#define MG_OTA_STATE_GET() (RTC->BKP0R)
-#define MG_OTA_STATE_SET(v)                                           \
-  (RCC->APB1ENR |= RCC_APB1ENR_PWREN, MG_OTA_DBP_ENABLE(),           \
-   (RTC->BKP0R = (uint32_t) (v)))
-#endif
+#elif !defined(MG_OTA) && defined(STM32C5)
+#define MG_OTA MG_OTA_STM32C5
 #endif
 
 // use HAL-defined execute-in-ram section

src/arch_esp32.h

@@ -21,6 +21,9 @@
 #include <esp_timer.h>     // amalgamation ditching them
 #include <esp_system.h>
 #include <esp_mac.h>
+#include <esp_idf_version.h>
+// #include <esp_memory_utils.h>  // For health record coredumps
+// #include <esp_core_dump.h>     // For health record coredumps
 
 #define MG_PATH_MAX 128
 
@@ -28,8 +31,8 @@
 #define MG_ENABLE_POSIX_FS 1
 #endif
 
-#ifndef MG_ENABLE_DIRLIST
-#define MG_ENABLE_DIRLIST 1
+#ifndef MG_HEALTH_DATA_SIZE
+#define MG_HEALTH_DATA_SIZE 20
 #endif
 
 #endif

src/arch_esp8266.h

@@ -1,26 +0,0 @@
-#pragma once
-
-#if MG_ARCH == MG_ARCH_ESP8266
-
-#include <ctype.h>
-#include <dirent.h>
-#include <errno.h>
-#include <fcntl.h>
-#include <limits.h>
-#include <netdb.h>
-#include <stdarg.h>
-#include <stdbool.h>
-#include <stddef.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-#include <sys/stat.h>
-#include <sys/time.h>
-#include <sys/types.h>
-#include <time.h>
-
-#include <esp_system.h>
-
-#define MG_PATH_MAX 128
-
-#endif

src/arch_mcuxpresso.h

@@ -0,0 +1,229 @@
+#pragma once
+
+#if MG_ARCH == MG_ARCH_MCUXPRESSO
+#define _POSIX_TIMERS
+
+#include <ctype.h>
+#if !defined(MG_ENABLE_LWIP) || !MG_ENABLE_LWIP
+#include <errno.h>
+#endif
+#include <stdarg.h>
+#include <stdbool.h>
+#include <stdint.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/stat.h>
+#include <sys/time.h>
+#include <sys/types.h>
+#include <time.h>
+#include <unistd.h>
+
+// MCUXpresso-generated header, includes the SoC peripheral definitions.
+// NOTE: use angle brackets to prevent amalgamator ditching it
+#include <fsl_device_registers.h>
+
+#ifndef MG_PATH_MAX
+#define MG_PATH_MAX 100
+#endif
+
+#ifndef MG_ENABLE_TCPIP
+#define MG_ENABLE_TCPIP 1  // Enable built-in TCP/IP stack
+#endif
+
+#if MG_ENABLE_TCPIP && !defined(MG_ENABLE_DRIVER_IMXRT10) && \
+    !defined(MG_ENABLE_DRIVER_IMXRT11) && !defined(MG_ENABLE_DRIVER_NETC)
+#if defined(CPU_MIMXRT1021DAG5A) || defined(CPU_MIMXRT1024DAG5A) ||         \
+    defined(CPU_MIMXRT1042XJM5B) || defined(CPU_MIMXRT1052DVL6B) ||         \
+    defined(CPU_MIMXRT1062DVL6B) || defined(CPU_MIMXRT1064DVL6B) ||         \
+    defined(CPU_MIMXRT1062DVL6A) || defined(CPU_MIMXRT1064DVL6A) ||         \
+    defined(CPU_MIMXRT1062DVMAA_cm7) || defined(CPU_MIMXRT1062DVL6A_cm7) || \
+    defined(CPU_MIMXRT1062DVL6B_cm7) || defined(_MIMXRT1021_H_) ||          \
+    defined(_MIMXRT1024_H_) || defined(_MIMXRT1042_H_) ||                   \
+    defined(_MIMXRT1052_H_) || defined(_MIMXRT1062_H_) ||                   \
+    defined(_MIMXRT1064_H_)
+#define MG_ENABLE_DRIVER_IMXRT10 1
+#elif defined(CPU_MIMXRT1176DVMAA_cm7) || defined(CPU_MIMXRT1176DVMAA_cm4) || \
+    defined(_MIMXRT1176_cm7_H_) || defined(_MIMXRT1176_cm4_H_) ||             \
+    defined(_MIMXRT1176_H_)
+#define MG_ENABLE_DRIVER_IMXRT11 1
+#elif defined(CPU_MIMXRT1186CVJ8C_cm33) || defined(MIMXRT1186_cm33_H_)
+#define MG_ENABLE_DRIVER_NETC 1
+#else
+#error Select an Ethernet driver in mongoose_config.h
+#endif
+#endif
+
+#ifndef MG_TLS
+#define MG_TLS MG_TLS_BUILTIN
+#endif
+
+#if !defined(MG_OTA) &&                                              \
+    (defined(CPU_MIMXRT1021DAG5A) || defined(CPU_MIMXRT1024DAG5A) || \
+     defined(_MIMXRT1021_H_) || defined(_MIMXRT1024_H_))
+#define MG_OTA MG_OTA_RT1020
+#elif !defined(MG_OTA) && \
+    (defined(CPU_MIMXRT1052DVL6B) || defined(_MIMXRT1052_H_))
+#define MG_OTA MG_OTA_RT1050
+#elif !defined(MG_OTA) &&                                                    \
+    (defined(CPU_MIMXRT1062DVL6B) || defined(CPU_MIMXRT1062DVL6A) ||         \
+     defined(CPU_MIMXRT1042XJM5B) || defined(_MIMXRT1042_H_) ||              \
+     defined(CPU_MIMXRT1062DVMAA_cm7) || defined(CPU_MIMXRT1062DVL6A_cm7) || \
+     defined(CPU_MIMXRT1062DVL6B_cm7) || defined(_MIMXRT1062_H_))
+#define MG_OTA MG_OTA_RT1060
+#elif !defined(MG_OTA) &&                                            \
+    (defined(CPU_MIMXRT1064DVL6B) || defined(CPU_MIMXRT1064DVL6A) || \
+     defined(_MIMXRT1064_H_))
+#define MG_OTA MG_OTA_RT1064
+#elif !defined(MG_OTA) &&                                                    \
+    (defined(CPU_MIMXRT1176DVMAA_cm7) || defined(CPU_MIMXRT1176DVMAA_cm4) || \
+     defined(_MIMXRT1176_cm7_H_) || defined(_MIMXRT1176_cm4_H_) ||           \
+     defined(_MIMXRT1176_H_))
+#define MG_OTA MG_OTA_RT1170
+#elif !defined(MG_OTA) && \
+    (defined(CPU_MIMXRT1186CVJ8C_cm33) || defined(MIMXRT1186_cm33_H_))
+#define MG_OTA MG_OTA_RT1180
+#endif
+
+#ifndef MG_IRAM
+#if defined(CPU_MIMXRT1186CVJ8C_cm33) || defined(MIMXRT1186_cm33_H_)
+#define MG_IRAM \
+  __attribute__((noinline, section(".ramfunc.$SRAM_ITC_cm33")))
+#else
+#define MG_IRAM __attribute__((noinline, section(".data_RAM2")))
+#endif
+#endif
+
+#ifndef MG_ETH_RAM
+#if defined(CPU_MIMXRT1186CVJ8C_cm33) || defined(MIMXRT1186_cm33_H_)
+#define MG_ETH_RAM __attribute__((section(".bss.$ETH_RAM")))
+#endif
+#endif
+
+#ifndef MG_SET_MAC_ADDRESS
+#if defined(MG_ENABLE_DRIVER_NETC) && MG_ENABLE_DRIVER_NETC
+// No OCOTP_FUSES present on RT1186 to generate the UUID
+#define MG_SET_MAC_ADDRESS(mac) (void) (mac)
+#else
+#if defined(MG_ENABLE_DRIVER_IMXRT11) && MG_ENABLE_DRIVER_IMXRT11
+#define MG_OCOTP_FUSES ((volatile uint32_t *) 0x40cac900)
+#else
+#define MG_OCOTP_FUSES ((volatile uint32_t *) 0x401f4410)
+#endif
+#define MG_SET_MAC_ADDRESS(mac)                                             \
+  do {                                                                      \
+    mac[0] = 2;                                                             \
+    mac[1] = (MG_OCOTP_FUSES[0] >> 0) & 255;                                \
+    mac[2] = (MG_OCOTP_FUSES[0] >> 10) & 255;                               \
+    mac[3] = ((MG_OCOTP_FUSES[0] >> 19) ^ (MG_OCOTP_FUSES[4] >> 19)) & 255; \
+    mac[4] = (MG_OCOTP_FUSES[4] >> 10) & 255;                               \
+    mac[5] = (MG_OCOTP_FUSES[4] >> 0) & 255;                                \
+  } while (0)
+#endif
+#endif
+
+#ifndef MG_IMXRT_WDOG1_TIMEOUT_MS
+#define MG_IMXRT_WDOG1_TIMEOUT_MS 10000U
+#endif
+
+#if defined(CPU_MIMXRT1186CVJ8C_cm33) || defined(MIMXRT1186_cm33_H_)
+
+#define MG_IMXRT_RTWDOG1_UNLOCK()                                \
+  do {                                                           \
+    if ((RTWDOG1->CS & RTWDOG_CS_CMD32EN_MASK) != 0U) {          \
+      RTWDOG1->CNT = RTWDOG_UPDATE_KEY;                          \
+    } else {                                                     \
+      RTWDOG1->CNT = RTWDOG_UPDATE_KEY & 0xffffU;                \
+      RTWDOG1->CNT = RTWDOG_UPDATE_KEY >> 16;                    \
+    }                                                            \
+    while ((RTWDOG1->CS & RTWDOG_CS_ULK_MASK) == 0U) (void) 0;  \
+  } while (0)
+
+#define MG_IMXRT_RTWDOG1_FEED()                                  \
+  do {                                                           \
+    uint32_t primask_ = __get_PRIMASK();                         \
+    __disable_irq();                                             \
+    if ((RTWDOG1->CS & RTWDOG_CS_CMD32EN_MASK) != 0U) {          \
+      RTWDOG1->CNT = RTWDOG_REFRESH_KEY;                         \
+    } else {                                                     \
+      RTWDOG1->CNT = RTWDOG_REFRESH_KEY & 0xffffU;               \
+      RTWDOG1->CNT = RTWDOG_REFRESH_KEY >> 16;                   \
+    }                                                            \
+    if (primask_ == 0U) __enable_irq();                          \
+  } while (0)
+
+#ifndef MG_OTA_ROLLBACK_TIMER_START
+#define MG_OTA_ROLLBACK_TIMER_START()                                      \
+  do {                                                                     \
+    uint32_t primask_ = __get_PRIMASK();                                   \
+    SRC_GENERAL_REG->SRMASK &= ~SRC_GENERAL_SRMASK_WDOG1_MASK_MASK;        \
+    __disable_irq();                                                       \
+    MG_IMXRT_RTWDOG1_UNLOCK();                                             \
+    RTWDOG1->WIN = 0U;                                                     \
+    RTWDOG1->TOVAL = (MG_IMXRT_WDOG1_TIMEOUT_MS + 7U) / 8U;                \
+    RTWDOG1->CS = RTWDOG_CS_EN_MASK | RTWDOG_CS_UPDATE_MASK |              \
+                  RTWDOG_CS_CLK(1U) | RTWDOG_CS_PRES_MASK |                \
+                  RTWDOG_CS_CMD32EN_MASK;                                  \
+    while ((RTWDOG1->CS & RTWDOG_CS_RCS_MASK) == 0U) (void) 0;             \
+    if (primask_ == 0U) __enable_irq();                                    \
+  } while (0)
+#endif
+
+#ifndef MG_OTA_ROLLBACK_TIMER_FEED
+#define MG_OTA_ROLLBACK_TIMER_FEED() MG_IMXRT_RTWDOG1_FEED()
+#endif
+
+// GPR5 survives RTWDOG global resets and is not reserved by the boot ROM.
+#ifndef MG_OTA_STATE_GET
+#define MG_OTA_STATE_GET() SRC_GENERAL_REG->GPR[5]
+#endif
+
+#ifndef MG_OTA_STATE_SET
+#define MG_OTA_STATE_SET(v) (SRC_GENERAL_REG->GPR[5] = (uint32_t) (v))
+#endif
+
+#else
+
+#define MG_IMXRT_WDOG1_FEED() \
+  do {                        \
+    WDOG1->WSR = 0x5555;      \
+    WDOG1->WSR = 0xaaaa;      \
+  } while (0)
+
+#ifndef MG_OTA_ROLLBACK_TIMER_START
+#define MG_OTA_ROLLBACK_TIMER_START()                                     \
+  do {                                                                    \
+    uint16_t wt_ = (uint16_t) ((MG_IMXRT_WDOG1_TIMEOUT_MS / 500) - 1);    \
+    if ((WDOG1->WCR & WDOG_WCR_WDE_MASK) == 0) {                          \
+      WDOG1->WMCR = 0;                                                    \
+      WDOG1->WCR = (uint16_t) (WDOG_WCR_WDZST_MASK | WDOG_WCR_WDBG_MASK | \
+                               WDOG_WCR_WDE_MASK | WDOG_WCR_WDT_MASK |    \
+                               WDOG_WCR_SRS_MASK | WDOG_WCR_WDW_MASK |    \
+                               WDOG_WCR_WT(wt_));                         \
+    }                                                                     \
+    MG_IMXRT_WDOG1_FEED();                                                \
+  } while (0)
+#endif
+
+#ifndef MG_OTA_ROLLBACK_TIMER_FEED
+#define MG_OTA_ROLLBACK_TIMER_FEED() MG_IMXRT_WDOG1_FEED()
+#endif
+
+#ifndef MG_OTA_STATE_GET
+#define MG_OTA_STATE_GET() SNVS->LPGPR[0]
+#endif
+
+#ifndef MG_OTA_STATE_SET
+#define MG_OTA_STATE_SET(v)          \
+  do {                               \
+    if (SNVS->LPSR & (1u << 3)) {    \
+      SNVS->LPLVDR = 0x41736166u;    \
+      SNVS->LPSR = 1u << 3;          \
+    }                                \
+    SNVS->LPGPR[0] = (uint32_t) (v); \
+  } while (0)
+#endif
+
+#endif
+
+#endif

src/arch_unix.h

@@ -50,10 +50,6 @@
 #include <time.h>
 #include <unistd.h>
 
-#ifndef MG_ENABLE_DIRLIST
-#define MG_ENABLE_DIRLIST 1
-#endif
-
 #ifndef MG_PATH_MAX
 #define MG_PATH_MAX FILENAME_MAX
 #endif

src/arch_win32.h

@@ -159,16 +159,13 @@ typedef int socklen_t;
 #define realpath(a, b) _fullpath((b), (a), MG_PATH_MAX)
 #define sleep(x) Sleep((x) *1000)
 #define mkdir(a, b) _mkdir(a)
+#define rmdir(a) _rmdir(a)
 #define timegm(x) _mkgmtime(x)
 
 #ifndef S_ISDIR
 #define S_ISDIR(x) (((x) &_S_IFMT) == _S_IFDIR)
 #endif
 
-#ifndef MG_ENABLE_DIRLIST
-#define MG_ENABLE_DIRLIST 1
-#endif
-
 #ifndef SIGPIPE
 #define SIGPIPE 0
 #endif

src/base64.c

@@ -12,16 +12,16 @@ static int mg_base64_encode_single(int c) {
   }
 }
 
-static int mg_base64_decode_single(int c) {
+static int base64_decode_single(int c, char plus, char slash) {
   if (c >= 'A' && c <= 'Z') {
     return c - 'A';
   } else if (c >= 'a' && c <= 'z') {
     return c + 26 - 'a';
   } else if (c >= '0' && c <= '9') {
     return c + 52 - '0';
-  } else if (c == '+') {
+  } else if (c == plus) {
     return 62;
-  } else if (c == '/') {
+  } else if (c == slash) {
     return 63;
   } else if (c == '=') {
     return 64;
@@ -30,6 +30,14 @@ static int mg_base64_decode_single(int c) {
   }
 }
 
+static int mg_base64_decode_single(int c) {
+  return base64_decode_single(c, '+', '/');
+}
+
+static int mg_base64url_decode_single(int c) {
+  return base64_decode_single(c, '-', '_');
+}
+
 size_t mg_base64_update(unsigned char ch, char *to, size_t n) {
   unsigned long rem = (n & 3) % 3;
   if (rem == 0) {
@@ -91,3 +99,41 @@ fail:
   if (dl > 0) dst[0] = '\0';
   return 0;
 }
+
+size_t mg_base64url_encode(const unsigned char *p, size_t n, char *to,
+                           size_t dl) {
+  size_t i, len = mg_base64_encode(p, n, to, dl);
+  if (len == 0) return 0;
+  for (i = 0; i < len; i++) {
+    if (to[i] == '+') {
+      to[i] = '-';
+    } else if (to[i] == '/') {
+      to[i] = '_';
+    }
+  }
+  while (len > 0 && to[len - 1] == '=') to[--len] = '\0';
+  return len;
+}
+
+size_t mg_base64url_decode(const char *src, size_t n, char *dst, size_t dl) {
+  size_t i, len = 0;
+  unsigned int bits = 0, v = 0;
+  if (dl == 0 || (n & 3) == 1) goto fail;
+  for (i = 0; src != NULL && i < n; i++) {
+    int c = mg_base64url_decode_single(src[i]);
+    if (c == 64) break;
+    if (c < 0) goto fail;
+    v = (v << 6) | (unsigned int) c;
+    bits += 6;
+    if (bits >= 8) {
+      bits -= 8;
+      if (len + 1 >= dl) goto fail;
+      dst[len++] = (char) ((v >> bits) & 255U);
+    }
+  }
+  dst[len] = '\0';
+  return len;
+fail:
+  if (dl > 0) dst[0] = '\0';
+  return 0;
+}

src/base64.h

@@ -4,3 +4,6 @@ size_t mg_base64_update(unsigned char input_byte, char *buf, size_t len);
 size_t mg_base64_final(char *buf, size_t len);
 size_t mg_base64_encode(const unsigned char *p, size_t n, char *buf, size_t);
 size_t mg_base64_decode(const char *src, size_t n, char *dst, size_t);
+size_t mg_base64url_encode(const unsigned char *p, size_t n, char *buf,
+                           size_t);
+size_t mg_base64url_decode(const char *src, size_t n, char *dst, size_t);

src/bsd.h

@@ -4,22 +4,64 @@
 #include "net_builtin.h"
 
 #if MG_ENABLE_BSD_SOCKETS
+void mg_bsd_init(struct mg_mgr *);
+void mg_bsd_poll(struct mg_mgr *);
 
-#ifndef MG_ENABLE_BSD_PROTOTYPES
-#include <arpa/inet.h>
 #include <errno.h>
 #include <fcntl.h>
-#include <netdb.h>
-#include <netinet/in.h>
-#include <netinet/tcp.h>
-#include <poll.h>
-#include <sys/select.h>
-#include <sys/socket.h>
-#include <sys/time.h>
-#include <sys/un.h>
-#else
-#include <errno.h>
+
+#ifndef EAGAIN
+#define EAGAIN 11
+#endif
+#ifndef EWOULDBLOCK
+#define EWOULDBLOCK EAGAIN
+#endif
+#ifndef EINPROGRESS
+#define EINPROGRESS 36
+#endif
+#ifndef ENOTCONN
+#define ENOTCONN 107
+#endif
+#ifndef ECONNREFUSED
+#define ECONNREFUSED 111
+#endif
+#ifndef ECONNRESET
+#define ECONNRESET 104
+#endif
+#ifndef EADDRINUSE
+#define EADDRINUSE 98
+#endif
+#ifndef ETIMEDOUT
+#define ETIMEDOUT 110
+#endif
+#ifndef EBADF
+#define EBADF 9
+#endif
+#ifndef EMFILE
+#define EMFILE 24
+#endif
+#ifndef ENOMEM
+#define ENOMEM 12
+#endif
+#ifndef EIO
+#define EIO 5
+#endif
+#ifndef EINVAL
+#define EINVAL 22
+#endif
+#ifndef EPERM
+#define EPERM 1
+#endif
+#ifndef EPIPE
+#define EPIPE 32
+#endif
+#ifndef EPROTONOSUPPORT
+#define EPROTONOSUPPORT 93
+#endif
+
+#if MG_ENABLE_BSD_PROTOTYPES
 typedef unsigned int socklen_t;
+typedef unsigned long nfds_t;
 typedef uint32_t in_addr_t;
 struct in_addr { in_addr_t s_addr; };
 struct in6_addr { uint8_t s6_addr[16]; };
@@ -45,7 +87,6 @@ struct hostent {
   int h_length;
   char **h_addr_list;
 };
-#define h_addr h_addr_list[0]
 struct addrinfo {
   int ai_flags;
   int ai_family;
@@ -57,6 +98,32 @@ struct addrinfo {
   struct addrinfo *ai_next;
 };
 struct pollfd { int fd; short events; short revents; };
+
+#if !defined(FD_SET) && !defined(FD_ZERO) && !defined(FD_ISSET)
+#define MG_BSD_SELECT_H
+typedef unsigned long __fd_mask;
+#ifndef FD_SETSIZE
+#define FD_SETSIZE 64
+#endif
+#define _NFDBITS ((int) sizeof(__fd_mask) * 8)
+#define _howmany(x, y) (((x) + ((y) - 1)) / (y))
+typedef struct fd_set {
+  __fd_mask __fds_bits[_howmany(FD_SETSIZE, _NFDBITS)];
+} fd_set;
+#define __fdset_mask(n) ((__fd_mask) 1 << ((n) % _NFDBITS))
+#define FD_CLR(n, p) ((p)->__fds_bits[(n) / _NFDBITS] &= ~__fdset_mask(n))
+#define FD_ISSET(n, p) \
+  (((p)->__fds_bits[(n) / _NFDBITS] & __fdset_mask(n)) != 0)
+#define FD_SET(n, p) ((p)->__fds_bits[(n) / _NFDBITS] |= __fdset_mask(n))
+#define FD_ZERO(p)                                                     \
+  do {                                                                 \
+    fd_set *_p = (p);                                                  \
+    size_t _n = _howmany(FD_SETSIZE, _NFDBITS);                        \
+    while (_n > 0) _p->__fds_bits[--_n] = 0;                           \
+  } while (0)
+#endif
+
+#define h_addr h_addr_list[0]
 #define AF_INET 2
 #define AF_INET6 10
 #define AF_UNSPEC 0
@@ -69,6 +136,7 @@ struct pollfd { int fd; short events; short revents; };
 #define IPPROTO_UDP 17
 #define INADDR_ANY 0
 #define INADDR_LOOPBACK 0x7f000001
+#define INET_ADDRSTRLEN 16
 #define SOL_SOCKET 0xffff
 #define SO_REUSEADDR 2
 #define SO_REUSEPORT 15
@@ -77,79 +145,37 @@ struct pollfd { int fd; short events; short revents; };
 #define SO_BROADCAST 6
 #define SO_RCVBUF 8
 #define SO_SNDBUF 7
+#define SO_NOSIGPIPE 0x1022
 #define TCP_NODELAY 1
 #define MSG_DONTWAIT 0x40
 #define MSG_NOSIGNAL 0x4000
 #define MSG_PEEK 0x02
+#ifndef F_GETFL
 #define F_GETFL 3
+#endif
+#ifndef F_SETFL
 #define F_SETFL 4
-#define O_NONBLOCK 0x0004
+#endif
+#ifndef O_NONBLOCK
+#define O_NONBLOCK 0x4000
+#endif
 #define SHUT_RD 0
 #define SHUT_WR 1
 #define SHUT_RDWR 2
 #define AI_PASSIVE 0x0001
 #define NI_MAXHOST 1025
 #define NI_MAXSERV 32
-#ifndef EAGAIN
-#define EAGAIN 11
-#endif
-#ifndef EWOULDBLOCK
-#define EWOULDBLOCK EAGAIN
-#endif
-#ifndef EINPROGRESS
-#define EINPROGRESS 36
-#endif
-#ifndef ENOTCONN
-#define ENOTCONN 107
-#endif
-#ifndef ECONNREFUSED
-#define ECONNREFUSED 111
-#endif
-#ifndef ECONNRESET
-#define ECONNRESET 104
-#endif
-#ifndef EADDRINUSE
-#define EADDRINUSE 98
-#endif
-#ifndef ETIMEDOUT
-#define ETIMEDOUT 110
-#endif
 #define POLLIN 0x001
 #define POLLOUT 0x004
 #define POLLERR 0x008
 #define POLLHUP 0x010
 #define POLLNVAL 0x020
-uint16_t htons(uint16_t);
-uint16_t ntohs(uint16_t);
-uint32_t htonl(uint32_t);
-uint32_t ntohl(uint32_t);
-#endif  // MG_ENABLE_BSD_PROTOTYPES
 
-#define closesocket(a) close(a)
+#define htons(x) mg_ntohs(x)
+#define ntohs(x) mg_ntohs(x)
+#define htonl(x) mg_ntohl(x)
+#define ntohl(x) mg_ntohl(x)
 
-#ifndef MG_BSD_BACKLOG
-#define MG_BSD_BACKLOG 5
-#endif
-
-#ifndef MG_BSD_CONNECT_TIMEOUT_MS
-#define MG_BSD_CONNECT_TIMEOUT_MS 10000
-#endif
-
-// Mongoose-specific API
-void mg_bsd_init(void);  // must be called before socket()
-void mg_bsd_poll(struct mg_mgr *);  // process pending BSD commands
-
-// Transport backend: implement these OR define MG_ENABLE_FREERTOS for the built-in backend
-void *mg_bsd_transport_new(int domain, int type, int proto);
-void  mg_bsd_transport_free(void *t);
-int   mg_bsd_transport_listen(void *t, const struct sockaddr_in *addr);
-void *mg_bsd_transport_accept(void *t, struct sockaddr_in *peer, bool nonblock);
-ssize_t mg_bsd_transport_recv(void *t, void *buf, size_t len, bool nonblock);
-ssize_t mg_bsd_transport_send(void *t, const void *buf, size_t len, bool nonblock);
-int   mg_bsd_transport_connect(void *t, const struct sockaddr_in *addr, bool nonblock);
-void  mg_bsd_transport_close(void *t);
-
-// Standard BSD socket API
 int socket(int, int, int);
 int bind(int, const struct sockaddr *, socklen_t);
 int listen(int, int);
@@ -157,23 +183,40 @@ int accept(int, struct sockaddr *, socklen_t *);
 int connect(int, const struct sockaddr *, socklen_t);
 ssize_t send(int, const void *, size_t, int);
 ssize_t recv(int, void *, size_t, int);
-ssize_t sendto(int, const void *, size_t, int, const struct sockaddr *, socklen_t);
+ssize_t sendto(int, const void *, size_t, int, const struct sockaddr *,
+               socklen_t);
 ssize_t recvfrom(int, void *, size_t, int, struct sockaddr *, socklen_t *);
 int close(int);
 int shutdown(int, int);
-int fcntl(int, int, int);
 int setsockopt(int, int, int, const void *, socklen_t);
 int getsockopt(int, int, int, void *, socklen_t *);
 int getsockname(int, struct sockaddr *, socklen_t *);
 int getpeername(int, struct sockaddr *, socklen_t *);
 int select(int, fd_set *, fd_set *, fd_set *, struct timeval *);
-int poll(struct pollfd *, unsigned int, int);
+int poll(struct pollfd *, nfds_t, int);
 struct hostent *gethostbyname(const char *);
-int getaddrinfo(const char *, const char *, const struct addrinfo *, struct addrinfo **);
+int getaddrinfo(const char *, const char *, const struct addrinfo *,
+                struct addrinfo **);
 void freeaddrinfo(struct addrinfo *);
 int inet_pton(int, const char *, void *);
 const char *inet_ntop(int, const void *, char *, socklen_t);
 in_addr_t inet_addr(const char *);
 char *inet_ntoa(struct in_addr);
+#else
+#include <arpa/inet.h>
+#include <netdb.h>
+#include <netinet/in.h>
+#include <netinet/tcp.h>
+#include <poll.h>
+#include <sys/select.h>
+#include <sys/socket.h>
+#include <sys/un.h>
+#include <unistd.h>
+#endif  // MG_ENABLE_BSD_PROTOTYPES
 
+#include <sys/time.h>
+
+#else
+#define mg_bsd_init(mgr)
+#define mg_bsd_poll(mgr)
 #endif  // MG_ENABLE_BSD_SOCKETS

src/config.h

@@ -82,10 +82,6 @@
 #define MG_ENABLE_WINSOCK 1
 #endif
 
-#ifndef MG_ENABLE_DIRLIST
-#define MG_ENABLE_DIRLIST 0
-#endif
-
 #ifndef MG_ENABLE_CUSTOM_RANDOM
 #define MG_ENABLE_CUSTOM_RANDOM 0
 #endif
@@ -135,7 +131,7 @@
 #endif
 
 #ifndef MG_ENABLE_POSIX_FS
-#define MG_ENABLE_POSIX_FS 0
+#define MG_ENABLE_POSIX_FS MG_ENABLE_LFS
 #endif
 
 #ifndef MG_INVALID_SOCKET
@@ -175,6 +171,14 @@
 #define MG_ENABLE_TCPIP_DRIVER_INIT 1  // enabled built-in driver for
 #endif                                 // Mongoose built-in network stack
 
+#ifndef MG_ENABLE_TCPIP_TCPRTX
+#define MG_ENABLE_TCPIP_TCPRTX 0  // TCP retransmission queue
+#endif
+
+#ifndef MG_TCPIP_DHCPNAME_SIZE
+#define MG_TCPIP_DHCPNAME_SIZE 18  // struct mg_tcpip_if :: dhcp_name size
+#endif
+
 #ifndef MG_TCPIP_IP                      // e.g. MG_IPV4(192, 168, 0, 223)
 #define MG_TCPIP_IP MG_IPV4(0, 0, 0, 0)  // Default is 0.0.0.0 (DHCP)
 #endif
@@ -211,10 +215,6 @@
 #define MG_SET_MAC_ADDRESS(mac)
 #endif
 
-#ifndef MG_TCPIP_DHCPNAME_SIZE
-#define MG_TCPIP_DHCPNAME_SIZE 18  // struct mg_tcpip_if :: dhcp_name size
-#endif
-
 #ifndef MG_SET_WIFI_CONFIG
 #define MG_SET_WIFI_CONFIG(ifp, driver_data)
 #endif
@@ -223,6 +223,28 @@
 #define MG_ENABLE_TCPIP_PRINT_DEBUG_STATS 0
 #endif
 
+#ifndef MG_TLS_RECORD_SIZE
+#define MG_TLS_RECORD_SIZE 16384  // Max plaintext per sent TLS record, builtin
+#endif
+
 #ifndef MG_ENABLE_CHACHA20
 #define MG_ENABLE_CHACHA20 1  // When set to 0, GCM is used. For MG_TLS_BUILTIN
 #endif
+
+// P-256 implementation, for MG_TLS_BUILTIN
+#define MG_P256_LENNGREN 1  // Cortex-M4/M7/M33 asm, see tls_p256_cortex.c
+#define MG_P256_BEAR 3      // Portable C, BearSSL, see tls_p256.c
+
+#ifndef MG_P256
+#if defined(__GNUC__) && defined(__ARM_ARCH_PROFILE) && \
+    __ARM_ARCH_PROFILE == 'M' && defined(__ARM_FEATURE_DSP) && \
+    !defined(__ARM_BIG_ENDIAN)
+#define MG_P256 MG_P256_LENNGREN  // Cortex-M with DSP: M4, M7, M33, M55, M85
+#else
+#define MG_P256 MG_P256_BEAR
+#endif
+#endif
+
+#ifndef MG_ENABLE_HEALTH
+#define MG_ENABLE_HEALTH 0
+#endif

src/dash.c

@@ -1,5 +1,6 @@
 #include "dash.h"
 #include "http.h"
+#include "ota.h"
 #include "util.h"
 
 #define MG_NO_CACHE_HEADERS "Cache-Control: no-cache\r\n"
@@ -77,12 +78,7 @@ static int mg_dash_array_size(struct mg_field_set *set,
                               struct mg_dash_user *u) {
   int saved = *set->index, sz = -1;
   *set->index = -1;
-  if (set->fn) {
-    if (set->fn(MG_DASH_READ, u)) sz = *set->index;
-  } else if (set->get_dir) {
-    mg_dash_dir_read(set, u);
-    sz = *set->index;
-  }
+  if (set->fn && set->fn(MG_DASH_READ, u)) sz = *set->index;
   *set->index = saved;
   return sz;
 }
@@ -100,10 +96,7 @@ static size_t mg_dash_print_array(mg_pfn_t fn, void *arg, va_list *ap) {
   for (;;) {
     bool done = to >= 0 && *set->index > to;
     if (!done) {
-      if (set->fn)
-        set->fn(MG_DASH_READ, u);
-      else if (set->get_dir)
-        mg_dash_dir_read(set, u);
+      if (set->fn) set->fn(MG_DASH_READ, u);
       done = *set->index < 0;
     }
     if (done) break;
@@ -167,9 +160,16 @@ static size_t mg_dash_print_endpoint(mg_pfn_t fn, void *arg, va_list *ap) {
 void mg_dash_send_change(struct mg_mgr *mgr, struct mg_field_set *set) {
   struct mg_connection *c;
   for (c = mgr->conns; c != NULL; c = c->next) {
-    struct mg_dash_cdata *d = (struct mg_dash_cdata *) c->data;
-    struct mg_dash_user *u = d->u;
+    struct mg_dash_cdata *d;
+    struct mg_dash_user *u;
     if (!c->is_websocket) continue;
+    if (c->send.len > MG_DASH_MAX_SEND_BUF_SIZE) {  // Skip slow consumers
+      MG_ERROR(("skipping, send buf %lu > %d", (unsigned long) c->send.len,
+                MG_DASH_MAX_SEND_BUF_SIZE));
+      continue;
+    }
+    d = (struct mg_dash_cdata *) c->data;
+    u = d->u;
     if (u == NULL) continue;
     if (set->index != NULL && *set->index < 0) {
       int sz = mg_dash_array_size(set, u);
@@ -178,8 +178,7 @@ void mg_dash_send_change(struct mg_mgr *mgr, struct mg_field_set *set) {
                    MG_ESC("change"), MG_ESC("params"), MG_ESC(set->name), sz);
     } else {
       int saved_idx = set->index != NULL ? *set->index : 0;
-      bool ok = set->fn ? set->fn(MG_DASH_READ, u)
-                        : (set->get_dir ? mg_dash_dir_read(set, u) : true);
+      bool ok = set->fn ? set->fn(MG_DASH_READ, u) : true;
       if (!ok) {
         if (set->index != NULL) *set->index = saved_idx;
         continue;
@@ -226,8 +225,7 @@ static int mg_dash_parse_field(struct mg_str json, struct mg_field *f) {
          mg_json_get_num(json, json_path, (double *) f->value);
   } else if (f->type == MG_VAL_STR && f->value_size > 0) {
     struct mg_str tok = mg_json_get_tok(json, json_path);
-    ok = tok.len >= 2 && tok.buf[0] == '"' &&
-         tok.buf[tok.len - 1] == '"';
+    ok = tok.len >= 2 && tok.buf[0] == '"' && tok.buf[tok.len - 1] == '"';
     if (ok) mg_json_unescape(json, json_path, (char *) f->value, f->value_size);
   } else if (f->type == MG_VAL_RAW && f->value_size > 0) {
     ok = mg_snprintf((char *) f->value, f->value_size, "%.*s", json.len,
@@ -264,68 +262,6 @@ static int mg_dash_apply(struct mg_connection *c, struct mg_dash *dash,
   return total_count;
 }
 
-bool mg_dash_dir_read(struct mg_field_set *set, struct mg_dash_user *u) {
-  char dir[256], fname[128] = "";
-  struct mg_fs *fs = u->dash->upload_fs ? u->dash->upload_fs : &mg_fs_posix;
-  struct mg_field *name_field = NULL, *size_field = NULL;
-  size_t i;
-
-  if (!set->get_dir(u, dir, sizeof(dir))) return false;
-
-  for (i = 0; set->fields[i].name != NULL; i++) {
-    if (name_field == NULL && set->fields[i].type == MG_VAL_STR &&
-        strcmp(set->fields[i].name, "name") == 0)
-      name_field = &set->fields[i];
-    if (size_field == NULL && strcmp(set->fields[i].name, "size") == 0)
-      size_field = &set->fields[i];
-  }
-  if (name_field == NULL) return false;
-
-  if (*set->index == -1) {  // Size query: count all files
-    int count = 0;
-    while (mg_fs_ls(fs, dir, fname, sizeof(fname))) count++;
-    *set->index = count;
-    return true;
-  }
-
-  {  // Regular read: scan to *set->index
-    int target = *set->index, cur = 0;
-    while (mg_fs_ls(fs, dir, fname, sizeof(fname))) {
-      if (cur++ == target) {
-        mg_snprintf((char *) name_field->value, name_field->value_size, "%s",
-                    fname);
-        if (size_field != NULL) {
-          char path[512];
-          size_t sz = 0;
-          mg_snprintf(path, sizeof(path), "%s/%s", dir, fname);
-          fs->st(path, &sz, NULL);
-          if (size_field->type == MG_VAL_UINT64)
-            *(uint64_t *) size_field->value = (uint64_t) sz;
-          else if (size_field->type == MG_VAL_INT)
-            *(int *) size_field->value = (int) sz;
-        }
-        return true;
-      }
-    }
-    *set->index = -1;  // No more entries
-    return true;
-  }
-}
-
-static bool mg_dash_set_file_name(struct mg_field_set *set,
-                                  struct mg_str name) {
-  size_t i;
-  for (i = 0; set->fields[i].name != NULL; i++) {
-    struct mg_field *f = &set->fields[i];
-    if (f->type == MG_VAL_STR && strcmp(f->name, "name") == 0) {
-      mg_snprintf((char *) f->value, f->value_size, "%.*s", (int) name.len,
-                  name.buf);
-      return true;
-    }
-  }
-  return false;
-}
-
 static inline void mg_log_http_req(struct mg_connection *c,
                                    struct mg_http_message *hm) {
   int len = 0;
@@ -358,33 +294,6 @@ static inline void mg_log_http_req(struct mg_connection *c,
             c->send.buf + n));
 }
 
-static void mg_dash_ota_cb(struct mg_connection *c, const char *errmsg) {
-  mg_http_reply(c, errmsg ? 500 : 200, NULL, errmsg ? errmsg : "ok\n");
-  c->is_draining = 1;
-}
-
-static void mg_dash_upload_cb(struct mg_connection *c, const char *errmsg) {
-  if (errmsg) {
-    mg_http_reply(c, 500, NULL, "%s\n", errmsg);
-  } else {
-    // mg_http_start_upload() repurposes c->data for its own bookkeeping,
-    // so the field set can't be cached there. Re-derive the dashboard from
-    // c->fn_data instead, and notify every file-backed array: the upload
-    // could belong to any of them, and re-querying get_dir() per recipient
-    // is what mg_dash_send_change() does anyway (directories can be
-    // user-specific)
-    struct mg_dash *dash = (struct mg_dash *) c->fn_data;
-    struct mg_field_set *fs;
-    mg_http_reply(c, 200, NULL, "ok\n");
-    for (fs = dash->sets; fs != NULL; fs = fs->next) {
-      if (fs->get_dir == NULL) continue;
-      *fs->index = -1;  // Signal mg_dash_send_change() to broadcast new size
-      mg_dash_send_change(c->mgr, fs);
-    }
-  }
-  c->is_draining = 1;
-}
-
 static uint64_t mg_dash_make_expiration_time(struct mg_dash *dash) {
   unsigned t = (unsigned) dash->session_auto_expiration_seconds;
   if (t == 0) t = 3600;  // Default expiration time in seconds
@@ -624,6 +533,25 @@ static void mg_dash_handle_add(struct mg_connection *c, struct mg_dash *dash,
   }
 }
 
+static void mg_serve_fs(struct mg_connection *c, struct mg_http_message *hm,
+                        struct mg_dash_user *u, bool stream) {
+  struct mg_dash *dash = (struct mg_dash *) c->fn_data;
+  char root[128] = "/fs/=";
+  if (u == NULL) {
+    mg_http_reply(c, 403, MG_JSON_HEADERS, "Not Authorised\n");
+  } else if (dash->files_dir(u, root + 5, sizeof(root) - 5) == false) {
+    mg_http_reply(c, 500, MG_JSON_HEADERS, "Upload dir error\n");
+  } else {
+    struct mg_http_serve_opts o;
+    memset(&o, 0, sizeof(o));
+    o.root_dir = root;
+    o.fs = dash->upload_fs ? dash->upload_fs : &mg_fs_posix;
+    o.enable_delete = o.enable_upload = o.enable_dir_listing = true;
+    if (stream) mg_http_serve_upload(c, hm, &o);
+    else mg_http_serve_dir(c, hm, &o);
+  }
+}
+
 void mg_dash_ev_handler(struct mg_connection *c, int ev, void *ev_data) {
   struct mg_dash *dash = (struct mg_dash *) c->fn_data;
   struct mg_dash_cdata *d = (struct mg_dash_cdata *) c->data;
@@ -637,9 +565,6 @@ void mg_dash_ev_handler(struct mg_connection *c, int ev, void *ev_data) {
     // Received headers - check authentication and possibly start uploads/ota
     struct mg_http_message *hm = (struct mg_http_message *) ev_data;
     struct mg_dash_user *u = mg_dash_authenticate(c, hm, dash);
-    struct mg_str parts[3];
-    memset(parts, 0, sizeof(parts));
-
     if (mg_match(hm->uri, mg_str("/api/hi"), NULL) ||
         mg_match(hm->uri, mg_str("/api/logout"), NULL)) {
       // Do nothing, handle them MG_EV_HTTP_MSG. We bypass auth for those
@@ -649,49 +574,21 @@ void mg_dash_ev_handler(struct mg_connection *c, int ev, void *ev_data) {
     } else if (mg_match(hm->uri, mg_str("/api/login"), NULL) && u != NULL) {
       mg_handle_login(c, u);
       d->marker = CONN_HANDLED;
+    } else if (u != NULL && dash->files_dir != NULL &&
+               mg_match(hm->uri, mg_str("/fs/#"), NULL)) {
+      mg_serve_fs(c, hm, u, true);
+      return;  // Important - the serve_fs() call can invalidate hm
     } else if (mg_match(hm->uri, mg_str("/api/ota"), NULL)) {
-      mg_http_start_ota(c, hm, mg_dash_ota_cb);
-    } else if (mg_match(hm->uri, mg_str("/fs/*/*"), parts) &&
-               (mg_strcasecmp(hm->method, mg_str("POST")) == 0 ||
-                mg_strcasecmp(hm->method, mg_str("PUT")) == 0)) {
-      struct mg_field_set *set = mg_dash_find_field_set(dash, parts[0]);
-      struct mg_str name = parts[1];
-      int len =
-          mg_url_decode(name.buf, name.len, (char *) name.buf, name.len + 1, 0);
-      if (len > 0 && (size_t) len <= name.len) name.len = (size_t) len;
-      if (set == NULL || set->get_dir == NULL) {
-        mg_http_reply(c, 404, MG_JSON_HEADERS, "Not Found\n");
-        d->marker = CONN_HANDLED;
-      } else if (u == NULL) {
-        mg_http_reply(c, 403, MG_JSON_HEADERS, "Not Authorised\n");
-        d->marker = CONN_HANDLED;
-      } else if (!mg_path_is_sane(name)) {
-        mg_http_reply(c, 400, MG_JSON_HEADERS, "Bad file name\n");
-        d->marker = CONN_HANDLED;
-      } else {
-        mg_dash_set_file_name(set, name);
-        if (set->fn != NULL && !set->fn(MG_DASH_WRITE, u)) {
-          mg_http_reply(c, 403, MG_JSON_HEADERS, "Not Authorised\n");
-          d->marker = CONN_HANDLED;
-        } else {
-          char dir[256];
-          struct mg_fs *fs = dash->upload_fs ? dash->upload_fs : &mg_fs_posix;
-          if (!set->get_dir(u, dir, sizeof(dir))) {
-            mg_http_reply(c, 500, MG_JSON_HEADERS, "Upload dir error\n");
-            d->marker = CONN_HANDLED;
-          } else {
-            mg_http_start_upload(c, hm, name, mg_str(dir), fs,
-                                 mg_dash_upload_cb);
-          }
-        }
-      }
+      // Authenticated above. Streaming owns the connection and c->data.
+      mg_http_stream_body(c, hm, mg_http_ota_cb, NULL);
+      return;
     }
     if (d->marker != '\0') mg_log_http_req(c, hm);
   } else if (ev == MG_EV_HTTP_MSG && d->marker != '\0') {
     // The response has been send in EV_HDRS path, so we're not reponding
     // anything but clearing the marker for the next request.
     d->marker = 0;
-    c->is_resp = 0;
+    c->pfn_data = NULL;  // Response done
   } else if (ev == MG_EV_HTTP_MSG && d->marker == '\0') {
     struct mg_http_message *hm = (struct mg_http_message *) ev_data;
     struct mg_dash_user *u = mg_dash_authenticate(c, hm, dash);
@@ -707,42 +604,9 @@ void mg_dash_ev_handler(struct mg_connection *c, int ev, void *ev_data) {
     } else if (mg_match(hm->uri, mg_str("/api/websocket"), NULL)) {
       d->u = u;
       mg_ws_upgrade(c, hm, NULL);
-    } else if (mg_match(hm->uri, mg_str("/fs/*/*"), parts)) {
-      struct mg_field_set *set = mg_dash_find_field_set(dash, parts[0]);
-      if (set == NULL || set->get_dir == NULL) {
-        mg_http_reply(c, 404, MG_JSON_HEADERS, "Not Found");
-      } else if (u == NULL) {
-        mg_http_reply(c, 403, MG_JSON_HEADERS, "Not Authorised\n");
-      } else {
-        char dir[256], path[512];
-        struct mg_fs *fs = dash->upload_fs ? dash->upload_fs : &mg_fs_posix;
-        struct mg_str name = parts[1];
-        int len = mg_url_decode(name.buf, name.len, (char *) name.buf,
-                                name.len + 1, 0);
-        if (len > 0 && (size_t) len <= name.len) name.len = (size_t) len;
-        if (!mg_path_is_sane(name)) {
-          mg_http_reply(c, 400, MG_JSON_HEADERS, "Bad file name\n");
-          return;
-        }
-        if (!set->get_dir(u, dir, sizeof(dir))) {
-          mg_http_reply(c, 500, MG_JSON_HEADERS, "Upload dir error\n");
-          return;
-        }
-        mg_snprintf(path, sizeof(path), "%s/%.*s", dir, name.len, name.buf);
-        if (mg_strcasecmp(hm->method, mg_str("DELETE")) == 0) {
-          mg_dash_set_file_name(set, name);
-          if (set->fn != NULL && !set->fn(MG_DASH_DELETE, u)) {
-            mg_http_reply(c, 403, MG_JSON_HEADERS, "Not Authorised\n");
-          } else {
-            fs->rm(path);
-            *set->index = -1;  // Signal mg_dash_send_change() to send new size
-            mg_dash_send_change(c->mgr, set);
-            mg_http_reply(c, 200, NULL, "true");
-          }
-        } else {
-          mg_http_serve_file(c, hm, path, NULL);
-        }
-      }
+    } else if (dash->files_dir != NULL &&
+               mg_match(hm->uri, mg_str("/fs/#"), NULL)) {
+      mg_serve_fs(c, hm, u, false);
     } else if (mg_match(hm->uri, mg_str("/api/del/*/*/*"), parts) ||
                mg_match(hm->uri, mg_str("/api/del/*/*"), parts)) {
       mg_dash_handle_del(c, dash, u, parts);
@@ -773,7 +637,7 @@ void mg_dash_ev_handler(struct mg_connection *c, int ev, void *ev_data) {
           break;
         }
       }
-      if (ch == NULL) mg_http_reply(c, 404, MG_JSON_HEADERS, "Not Found");
+      if (ch == NULL) mg_http_reply(c, 404, MG_JSON_HEADERS, "Not Found\n");
       mg_log_http_req(c, hm);
     }
   }

src/dash.h

@@ -73,9 +73,7 @@ struct mg_field_set {
                // fn sets *index = -1 to signal end of iteration.
                // Size query: framework sets *index = -1 before fn(READ); fn
                // sets *index = total size
-  bool (*get_dir)(const struct mg_dash_user *u, char *buf,
-                  size_t len);  // Non-NULL: file array
-  struct mg_field_set *next;    // Next set in the list
+  struct mg_field_set *next;  // Next set in the list
 };
 
 // Custom URI handler, registered with MG_DASH_REGISTER_CUSTOM_HANDLER()
@@ -96,6 +94,9 @@ struct mg_dash {
   int session_auto_expiration_seconds;  // Session lifetime, 0: 1 hour default
   struct mg_dash_user *guest;           // Used when authenticate == NULL
   struct mg_fs *upload_fs;  // FS for uploads/listing, default &mg_fs_posix
+  // Resolves the built-in file manager's root dir for user u, e.g. per-user
+  // upload directories. NULL: file manager disabled
+  bool (*files_dir)(const struct mg_dash_user *u, char *buf, size_t len);
 };
 
 #define MG_DASH_ADD_FIELD_SET(dash_, set_) \
@@ -121,43 +122,6 @@ void mg_dash_ev_handler(struct mg_connection *c, int ev, void *ev_data);
 // array size if *set->index < 0, or a single element update otherwise
 void mg_dash_send_change(struct mg_mgr *mgr, struct mg_field_set *);
 
-// Default reader for file-backed array sets (set->get_dir != NULL)
-// Usage example - this is a complete implemenation of the file manager:
-// ```c
-// static struct file {
-//   int index;
-//   char name[64];
-//   size_t size;
-//   uint64_t checksum;
-// } s_file;
-// static struct mg_field_set set_files;
-//
-// static bool get_dir(const struct mg_dash_user *u, char *buf, size_t len) {
-//   (void) u;
-//   mkdir("/tmp/dashboard", 0755);
-//   mg_snprintf(buf, len, "%s", "/tmp/dashboard");
-//   return true;
-// }
-//
-// static struct mg_field fields_files[] = {
-//     {"name", MG_VAL_STR, s_file.name, sizeof(s_file.name)},
-//     {"size", MG_VAL_UINT64, &s_file.size, 0},
-//     {"checksum", MG_VAL_UINT64, &s_file.checksum, sizeof(s_file.checksum)},
-//     {NULL, MG_VAL_INT, NULL, 0},
-// };
-//
-// static bool files_fn(enum mg_dash_op op, struct mg_dash_user *u) {
-//   if (op == MG_DASH_WRITE) return s_uploads_enabled && u->level >= 7;
-//   if (op != MG_DASH_READ) return false;
-//   if (!mg_dash_dir_read(&set_files, u)) return false;
-//   s_file.checksum = 0;  // Mock to show how to set custom fields
-//   return true;
-// }
-//
-// static struct mg_field_set set_files = {"files", fields_files, files_fn, &s_file.index, get_dir, NULL};
-// ```
-bool mg_dash_dir_read(struct mg_field_set *set, struct mg_dash_user *u);
-
 // Helper forward declarations for Mongoose CMSIS pack modules
 extern struct mg_mgr g_mgr;
 extern void mg_dash_init(struct mg_mgr *);

src/dns.c

@@ -228,16 +228,16 @@ static void dns_cb(struct mg_connection *c, int ev, void *ev_data) {
   }
 }
 
-static bool mg_dns_send(struct mg_connection *c, const struct mg_str *name,
-                        uint16_t txnid, bool ipv6) {
-  struct {
+static bool dns_send(struct mg_connection *c, const struct mg_str *name,
+                     unsigned int rtype, uint16_t txnid, uint16_t flags) {
+  struct { // RFC-1035 4.1.2
     struct mg_dns_header header;
     uint8_t data[256];
   } pkt;
   size_t i, n;
   memset(&pkt, 0, sizeof(pkt));
   pkt.header.txnid = mg_htons(txnid);
-  pkt.header.flags = mg_htons(0x100);
+  pkt.header.flags = mg_htons(flags);
   pkt.header.num_questions = mg_htons(1);
   for (i = n = 0; i < sizeof(pkt.data) - 5; i++) {
     if (name->buf[i] == '.' || i >= name->len) {
@@ -247,25 +247,30 @@ static bool mg_dns_send(struct mg_connection *c, const struct mg_str *name,
     }
     if (i >= name->len) break;
   }
-  memcpy(&pkt.data[n], "\x00\x00\x01\x00\x01", 5);  // A query
+  memset(&pkt.data[n], 0, 5);         // nul, QTYPE, QCLASS
+  pkt.data[n + 2] = (uint8_t) rtype;  // QTYPE = rtype, only 0-255 supported
+  pkt.data[n + 4] = 1;                // QCLASS = IN
   n += 5;
-  if (ipv6) pkt.data[n - 3] = 0x1c;  // AAAA query
-  // memcpy(&pkt.data[n], "\xc0\x0c\x00\x1c\x00\x01", 6);  // AAAA query
-  // n += 6;
   return mg_send(c, &pkt, sizeof(pkt.header) + n);
 }
 
+static bool mg_dns_send(struct mg_connection *c, const struct mg_str *name,
+                        uint16_t txnid, bool ipv6) {
+  return dns_send(c, name, ipv6 ? MG_DNS_RTYPE_AAAA : MG_DNS_RTYPE_A, txnid,
+                  0x100); // RD
+}
+
 bool mg_dnsc_init(struct mg_mgr *mgr, struct mg_dns *dnsc);
 bool mg_dnsc_init(struct mg_mgr *mgr, struct mg_dns *dnsc) {
   if (dnsc->url == NULL) {
-    mg_error(0, "DNS server URL is NULL. Call mg_mgr_init()");
+    MG_ERROR(("DNS server URL is NULL. Call mg_mgr_init()"));
     return false;
   }
   if (dnsc->c == NULL) {
     dnsc->c = mg_connect(mgr, dnsc->url, NULL, NULL);
     if (dnsc->c == NULL) return false;
-    dnsc->c->pfn = dns_cb;
   }
+  dnsc->c->pfn = dns_cb; // do it always, DHCP-assigned DNS bootstrap needs it
   return true;
 }
 
@@ -458,7 +463,6 @@ static void handle_mdns_query(struct mg_connection *c) {
     MG_VERBOSE(("RR %u %u %s", (unsigned int) rr.atype,
                 (unsigned int) rr.aclass, name));
     if (rr.atype == MG_DNS_RTYPE_A) {
-      // TODO(): ensure c->fn_data ends in \0
       // if we have a name to match, go; otherwise users will match and fill
       // req.r.name and set req.is_resp
       if (c->fn_data != NULL && mg_casecmp((char *) c->fn_data, name) != 0)
@@ -574,43 +578,149 @@ static void handle_mdns_query(struct mg_connection *c) {
   }
 }
 
+
+static size_t srvtoname(char *svc) {
+  char *dot = strchr(svc, '.');
+  if (dot == NULL) return 0;
+  *dot = '\0';
+  return (size_t) (dot - svc);
+}
+
+#define MG_MAX_MDNS_RECORDS 8
+// Condense one useful mDNS/DNS-SD chain from a response datagram into a single
+// MG_EV_MDNS_RESP event. A/AAAA as the first supported record are terminal
+// address answers (AAAA currently ignored). For PTR/SRV/TXT, subsequent
+// records are attached only when their label matches the service instance, or
+// the SRV target for address records.
+// Some devices send SRV/TXT as extra Answer RRs instead of Additional RRs, so
+// both sections are parsed as one chain.
 static void handle_mdns_response(struct mg_connection *c) {
   struct mg_dns_header *rh = (struct mg_dns_header *) c->recv.buf;
-  struct mg_dns_rr rr;
-  size_t n;
-  // Parse first response, offset 12 is header size
-  n = mg_dns_parse_rr(c->recv.buf, c->recv.len, 12, false, &rr);
-  MG_VERBOSE(("mDNS response parsed, result=%d", (int) n));
-  if (n > 0) {
-    // RFC-6762 Appendix C, RFC2181 11: m(n + 1-63), max 255 + 0x0
-    char name[256];
-    uint8_t name_len;
-    struct mg_mdns_resp resp;
-    memset(&resp, 0, sizeof(resp));
-    if (rh->num_answers > mg_htons(1)) MG_DEBUG(("ignoring > 1 answers"));
-    mg_dns_parse_name(c->recv.buf, c->recv.len, 12, name, sizeof(name));
-    name_len = (uint8_t) strlen(name);
-    MG_VERBOSE(("RR %u %u %s", (unsigned int) rr.atype,
-                (unsigned int) rr.aclass, name));
-    if (rr.alen == 4 && rr.atype == MG_DNS_RTYPE_A &&
-        (rr.aclass & 0x7FFF) == 1) {
-      resp.addr.is_ip6 = false;
-      memcpy(resp.addr.addr.ip, (char *) (rh + 1) + n - 4, 4);
-      MG_DEBUG(("A response from %.*s = %M", name_len, name, mg_print_ip,
-                &resp.addr));
-      //    } else if (rr.alen == 16 && rr.atype == MG_DNS_RTYPE_AAAA &&
-      //    (rr.aclass & 0x7FFF) == 1) {
-      //      resp.addr.is_ip6 = true;
-      //      memcpy(resp.addr.addr.ip, (char *)(rh + 1) + n - 16], 16);
-      //      MG_DEBUG(("AAAA response from %.*s = %M", name_len, name,
-      //      mg_print_ip, &resp.addr));
-    } else {
-      return;
-    }
-    resp.name = mg_str_n(name, name_len);
-    resp.rr = &rr;
-    mg_call(c, MG_EV_MDNS_RESP, &resp);
+  struct mg_dns_rr rr, rr_[5]; // A, PTR, SRV, TXT, AAAA, in that order
+  struct mg_mdns_resp resp;
+  size_t n, i, num, answers, roff_[5], roff = 12;  // offset 12 is header size
+  // RFC-6762 Appendix C, RFC2181 11: m(n + 1-63), max 255 + 0x0
+  char name[256], srvcproto[256], instance[256], host[256];
+  uint16_t atype = 0;
+  answers = mg_ntohs(rh->num_answers);
+  num = answers + mg_ntohs(rh->num_other_prs);
+  if (answers == 0) return;
+  MG_VERBOSE(("mDNS response: %u answer, %u additional", (unsigned) answers,
+              (unsigned) (num - answers)));
+  if (num > MG_MAX_MDNS_RECORDS) {
+    num = MG_MAX_MDNS_RECORDS;
+    MG_DEBUG(("ignoring > %u records", MG_MAX_MDNS_RECORDS));
   }
+  memset(roff_, 0, sizeof(roff_));
+  memset(&rr_, 0, sizeof(rr_));
+  memset(&resp, 0, sizeof(resp));
+  instance[0] = host[0] = '\0';
+  for (i = 0; i < num; i++) { // First Answer RR is primary; the rest must match it
+    n = mg_dns_parse_rr(c->recv.buf, c->recv.len, roff, false, &rr);
+    MG_VERBOSE(("mDNS record parsed, result=%u", n));
+    if (n == 0) return;
+    if (mg_dns_parse_name(c->recv.buf, c->recv.len, roff, name, sizeof(name)) == 0) return;
+    MG_VERBOSE(("RR %u %u %s", (unsigned int) rr.atype, (unsigned int) rr.aclass, name));
+    if (rr.alen == 4 && rr.atype == MG_DNS_RTYPE_A && (rr.aclass & 0x7FFF) == 1 &&
+        (i == 0 || (host[0] != '\0' && strcmp(name, host) == 0) ||
+         (host[0] == '\0' && instance[0] != '\0' && strcmp(name, instance) == 0))) {
+      if (rr_[0].atype != 0) break;
+      if (i == 0) atype = rr.atype;
+      resp.name = mg_str(name);
+      resp.addr.is_ip6 = false;
+      memcpy(resp.addr.addr.ip, c->recv.buf + roff + n - 4, 4);
+      MG_VERBOSE(("A record"));
+      roff_[0] = roff, rr_[0] = rr;
+      if (atype == MG_DNS_RTYPE_A) break;
+    } else if (rr.alen == 16 && rr.atype == MG_DNS_RTYPE_AAAA && (rr.aclass & 0x7FFF) == 1 &&
+               (i == 0 || (host[0] != '\0' && strcmp(name, host) == 0) ||
+                (host[0] == '\0' && instance[0] != '\0' && strcmp(name, instance) == 0))) {
+# if 0
+      if (rr_[4].atype != 0) break;
+      resp.addr.is_ip6 = true;
+      if (i == 0) atype = rr.atype;
+      resp.name = mg_str(name);
+      memcpy(resp.addr.addr.ip, c->recv.buf + roff + n - 16, 16);
+      MG_VERBOSE(("AAAA record"));
+      roff_[4] = roff, rr_[4] = rr;
+      if (atype == MG_DNS_RTYPE_AAAA) break;
+#else
+      MG_VERBOSE(("ignored AAAA record"));
+#endif
+    } else if (rr.atype == MG_DNS_RTYPE_PTR && (rr.aclass & 0x7FFF) == 1 && i == 0) {
+      if (rr_[1].atype != 0) break;
+      atype = rr.atype;
+      if (mg_dns_parse_name(c->recv.buf, c->recv.len, roff + rr.nlen + 10,
+                            instance, sizeof(instance)) == 0) return;
+      MG_VERBOSE(("PTR record"));
+      roff_[1] = roff, rr_[1] = rr;
+    } else if (rr.atype == MG_DNS_RTYPE_SRV && rr.alen >= 6 && (rr.aclass & 0x7FFF) == 1 &&
+               (i == 0 || (instance[0] != '\0' && strcmp(name, instance) == 0))) {
+      if (rr_[2].atype != 0) break;
+      if (i == 0) atype = rr.atype;
+      resp.sd.port = MG_LOAD_BE16(c->recv.buf + roff + rr.nlen + 14);
+      resp.addr.port = mg_htons(resp.sd.port);
+      if (instance[0] == '\0') mg_snprintf(instance, sizeof(instance), "%s", name);
+      if (mg_dns_parse_name(c->recv.buf, c->recv.len, roff + rr.nlen + 16,
+                            host, sizeof(host)) == 0) return;
+      MG_VERBOSE(("SRV record"));
+      roff_[2] = roff, rr_[2] = rr;
+    } else if (rr.atype == MG_DNS_RTYPE_TXT && (rr.aclass & 0x7FFF) == 1 &&
+               (i == 0 || (instance[0] != '\0' && strcmp(name, instance) == 0))) {
+      if (rr_[3].atype != 0) break;
+      if (i == 0) atype = rr.atype;
+      if (instance[0] == '\0') mg_snprintf(instance, sizeof(instance), "%s", name);
+      resp.sd.txt = mg_str_n((char *) c->recv.buf + roff + rr.nlen + 10, rr.alen);
+      MG_VERBOSE(("TXT record"));
+      roff_[3] = roff, rr_[3] = rr;
+    }
+    roff += n;
+    if (i == 0 && atype == 0) return;
+  }
+  if (atype == MG_DNS_RTYPE_A) {
+    resp.rr = &rr_[0];
+    MG_DEBUG(("A response from %s = %M", name, mg_print_ip, &resp.addr));
+#if 0
+  } else if (atype == MG_DNS_RTYPE_AAAA) {
+    resp.rr = &rr_[4];
+    MG_DEBUG(("AAAA response from %s = %M", name, mg_print_ip6, resp.addr.addr.ip));
+#endif
+  } else if (atype == MG_DNS_RTYPE_PTR) {
+    size_t len;
+    resp.rr = &rr_[1];
+    if (mg_dns_parse_name(c->recv.buf, c->recv.len, roff_[1], srvcproto,
+                          sizeof(srvcproto)) == 0) return;
+    len = strlen(srvcproto);
+    if (len <= 6) return;
+    resp.sd.srvcproto = mg_str_n(srvcproto, len - 6);  // remove .local
+    if (host[0] != '\0') {
+      resp.name = mg_str(host);
+    } else if (rr_[0].atype == 0) {
+      mg_snprintf(name, sizeof(name), "%s", instance);
+      resp.name = mg_str_n(name, srvtoname(name));
+    } else {
+      if (mg_dns_parse_name(c->recv.buf, c->recv.len, roff_[0], name,
+                            sizeof(name)) == 0) return;
+      resp.name = mg_str(name);
+    }
+    MG_DEBUG(("PTR response for %s from %s", srvcproto, name));
+  } else if (atype == MG_DNS_RTYPE_SRV || atype == MG_DNS_RTYPE_TXT) {
+    size_t len, name_len;
+    resp.rr = atype == MG_DNS_RTYPE_SRV ? &rr_[2] : &rr_[3];
+    if (mg_dns_parse_name(c->recv.buf, c->recv.len,
+                          atype == MG_DNS_RTYPE_SRV ? roff_[2] : roff_[3],
+                          srvcproto, sizeof(srvcproto)) == 0)
+      return;
+    len = strlen(srvcproto);
+    name_len = srvtoname(srvcproto);
+    if (name_len == 0 || len <= name_len + 7) return;  // remove .local
+    resp.sd.srvcproto = mg_str_n(srvcproto + name_len + 1, len - name_len - 7);
+    resp.name = mg_str_n(srvcproto, name_len);
+    MG_DEBUG(("%s response for %s from %s", atype == MG_DNS_RTYPE_SRV ? "SRV" : "TXT", srvcproto, name));
+  } else {
+    return;
+  }
+  mg_call(c, MG_EV_MDNS_RESP, &resp);
 }
 
 static void handle_mdns_record(struct mg_connection *c) {
@@ -684,8 +794,7 @@ struct mg_connection *mg_mdns_listen(struct mg_mgr *mgr, mg_event_handler_t fn,
 static bool mdns_query(struct mg_connection *c, struct mg_str *name,
                        unsigned int rtype) {
   mg_multicast_restore(c, (uint8_t *) &c->loc);
-  (void) rtype;
-  return mg_dns_send(c, name, 0, false);
+  return dns_send(c, name, rtype, 0, 0);  // RFC-6762 18.1 id = 0, 18.6 RD = 0
 }
 
 bool mg_mdns_query(struct mg_connection *c, const char *name,

src/dns.h

@@ -60,11 +60,12 @@ struct mg_mdns_req {
   bool is_unicast;  // True if the client requested a unicast (QU) response
 };
 
-// ev_data for MG_EV_MDNS_RESP, carrying the resolved address from an mDNS response.
+// ev_data for MG_EV_MDNS_RESP, carrying address/data from a mDNS response
 struct mg_mdns_resp {
-  struct mg_dns_rr *rr;  // Resource record from the response
+  struct mg_dns_rr *rr;  // Resource record from the response (1st in chain)
   struct mg_str name;    // Resolved hostname, without the .local suffix
   struct mg_addr addr;   // Resolved IP address
+  struct mg_dnssd_record sd; // Service Discovery data
 };
 
 // Parses a DNS query or response from buf/len into dm. Returns true on success.
@@ -81,6 +82,7 @@ size_t mg_dns_parse_rr(const uint8_t *buf, size_t len, size_t ofs,
 // Creates an mDNS listener on UDP multicast 224.0.0.251:5353. Registers it as
 // the manager's mDNS resolver (mgr->mdns). Fires MG_EV_MDNS_REQ for incoming
 // queries and MG_EV_MDNS_RESP for incoming responses. Returns NULL on error.
+// fn_data is a NUL-terminated server name, or NULL to pass all requests to fn.
 struct mg_connection *mg_mdns_listen(struct mg_mgr *mgr, mg_event_handler_t fn,
                                      void *fn_data);
 

src/drivers/at_cmd.c

@@ -9,7 +9,9 @@
 
 static size_t print_atcmd(void (*out)(char, void *), void *arg, va_list *ap) {
   struct mg_str s = va_arg(*ap, struct mg_str);
-  for (size_t i = 0; i < s.len; i++) out(s.buf[i] < 0x20 ? '.' : s.buf[i], arg);
+  size_t i;
+  for (i = 0; i < s.len; i++)
+    out((char) (s.buf[i] < 0x20 ? '.' : s.buf[i]), arg);
   return s.len;
 }
 
@@ -27,7 +29,7 @@ static bool mg_atcmd_handle(struct mg_tcpip_if *ifp) {
     if (dd->script_index % 2 == 0) {  // send AT command
       const char *cmd = dd->script[dd->script_index];
       MG_DEBUG(("send AT[%d]: %M", dd->script_index, print_atcmd, mg_str(cmd)));
-      while (*cmd) dd->tx(dd->usart, *cmd++);
+      while (*cmd != '\0') dd->tx(dd->usart, (uint8_t) *cmd++);
       dd->script_index++;
       ifp->recv_queue.head = 0;
     } else {  // check AT command response
@@ -43,7 +45,7 @@ static bool mg_atcmd_handle(struct mg_tcpip_if *ifp) {
           return false;  // FAIL
         }
         if ((c = dd->rx(dd->usart)) < 0) return false;  // no data
-        q->buf[q->head++] = c;
+        q->buf[q->head++] = (char) c;
         if (mg_match(mg_str_n(q->buf, q->head), mg_str(expect), NULL)) {
           MG_DEBUG(("recv AT[%d]: %M", dd->script_index, print_atcmd,
                     mg_str_n(q->buf, q->head)));
@@ -84,7 +86,7 @@ static size_t mg_atcmd_rx(void *buf, size_t len, struct mg_tcpip_if *ifp) {
       }
     }
     if (!dd->no_byte_stuff && !byte_unstuff(dd, &b)) continue;
-    q->buf[q->head++] = b;
+    q->buf[q->head++] = (char) b;
   }
   len = (q->head <= len) ? q->head : 0;
   memmove(buf, q->buf, len);
@@ -130,7 +132,7 @@ struct mg_tcpip_driver mg_tcpip_driver_atcmd = {mg_atcmd_init, mg_atcmd_tx, mg_a
 static void byte_stuff(struct mg_tcpip_driver_atcmd_data *dd, uint8_t b) {
   if ((b < 0x20) || (b == MG_HDLC_ESC) || (b == MG_HDLC_FLAG)) {
     dd->tx(dd->usart, MG_HDLC_ESC);
-    dd->tx(dd->usart, b ^ 0x20);
+    dd->tx(dd->usart, (uint8_t) (b ^ 0x20));
   } else {
     dd->tx(dd->usart, b);
   }

src/drivers/mcxw71.c

@@ -0,0 +1,142 @@
+#include "net_builtin.h"
+
+#if MG_ENABLE_TCPIP && defined(MG_ENABLE_DRIVER_MCXW71) && \
+    MG_ENABLE_DRIVER_MCXW71
+
+// ZLL, 802.15.4 link layer. See MCXW71 reference manual and NXP
+// ieee_802_15_4 PHY sources: PhyPacketProcessor.c, PhyPlmeData.c, PhyISR.c
+struct mg_zll {
+  volatile uint32_t IRQSTS, PHY_CTRL, EVENT_TMR, TIMESTAMP, T1CMP, T2CMP,
+      T2PRIMECMP, T3CMP, T4CMP, PA_PWR, CHANNEL_NUM0, LQI_AND_RSSI,
+      MACSHORTADDRS0, MACLONGADDRS0_LSB, MACLONGADDRS0_MSB, RX_FRAME_FILTER,
+      CCA_LQI_CTRL, CCA2_CTRL, RESERVED_0, DSM_CTRL, RESERVED_1,
+      MACSHORTADDRS1, MACLONGADDRS1_LSB, MACLONGADDRS1_MSB, DUAL_PAN_CTRL,
+      CHANNEL_NUM1, SAM_CTRL, SAM_TABLE, SAM_MATCH, SAM_FREE_IDX,
+      SEQ_CTRL_STS, ACKDELAY, FILTERFAIL_CODE, RX_WTR_MARK, RESERVED_2,
+      SLOT_PRELOAD, SEQ_STATE, TMR_PRESCALE, LENIENCY_LSB, LENIENCY_MSB,
+      PART_ID, COEX_CTRL, COEX_PRIORITY, ENHACK_CTRL0;
+};
+
+// TrustZone: code built for the secure state (-mcmse) uses the secure alias
+// of the radio registers, 0x5xxxxxxx. Otherwise, the non-secure alias
+#if defined(__ARM_FEATURE_CMSE) && (__ARM_FEATURE_CMSE & 2)
+#define MGI_ZLL ((struct mg_zll *) 0x58A01000)
+#define MGI_PKT_RAM ((volatile uint8_t *) 0x58A08000)
+#else
+#define MGI_ZLL ((struct mg_zll *) 0x48A01000)
+#define MGI_PKT_RAM ((volatile uint8_t *) 0x48A08000)
+#endif
+
+#define MGI_TX_PB MGI_PKT_RAM           // Length byte (incl. FCS), then frame
+#define MGI_RX_PB (MGI_PKT_RAM + 0x80)  // Received frame, no length byte
+
+#define MGI_IRQSTS_SEQIRQ MG_BIT(0)
+#define MGI_IRQSTS_RXIRQ MG_BIT(2)
+#define MGI_IRQSTS_RX_LEN(x) (((x) >> 24) & 0x7f)  // Frame length incl. FCS
+#define MGI_PHY_CTRL_XCVSEQ 7U
+#define MGI_PHY_CTRL_ALL_IRQ_MASKS 0x8007ff00U  // Bits 8..18, 31: mask all IRQs
+#define MGI_SEQ_STATE_MASK 0x1fU
+#define MGI_SEQ_STATE_RX_WU 0x10U         // RX warm up
+#define MGI_SEQ_CTRL_NO_RX_RECYCLE MG_BIT(5)
+#define MGI_FRAME_FILTER 0x70bU  // Beacon, data, command; versions 0..2
+
+enum { MGI_SEQ_IDLE = 0, MGI_SEQ_RX = 1, MGI_SEQ_TX = 2 };  // PHY_CTRL[XCVSEQ]
+#define MGI_TX_TIMEOUT 400U  // Symbols, 16 us: 127 bytes
+
+// Symbol timer, 16 us, 24 bits
+static uint32_t mg_mcxw71_symbols(void) {
+  return MGI_ZLL->EVENT_TMR >> 8;
+}
+
+// Wait for the sequence to end, up to MGI_TX_TIMEOUT symbols
+static bool mg_mcxw71_wait(void) {
+  uint32_t start = mg_mcxw71_symbols();
+  while (((mg_mcxw71_symbols() - start) & 0xffffffU) < MGI_TX_TIMEOUT) {
+    if (MGI_ZLL->IRQSTS & MGI_IRQSTS_SEQIRQ) return true;
+  }
+  return false;
+}
+
+// Stop the current sequence, wait for the sequencer to go idle. See PhyAbort()
+static void mg_mcxw71_idle(void) {
+  if (MGI_ZLL->PHY_CTRL & MGI_PHY_CTRL_XCVSEQ) {
+    while ((MGI_ZLL->SEQ_STATE & MGI_SEQ_STATE_MASK) == MGI_SEQ_STATE_RX_WU)
+      (void) 0;
+    MGI_ZLL->PHY_CTRL &= ~MGI_PHY_CTRL_XCVSEQ;
+    while (MGI_ZLL->SEQ_STATE & MGI_SEQ_STATE_MASK) (void) 0;
+  }
+  MGI_ZLL->IRQSTS = MGI_ZLL->IRQSTS;  // Clear all flags, write 1 to clear
+}
+
+// Start a new sequence: MGI_SEQ_RX or MGI_SEQ_TX
+static void mg_mcxw71_start(uint32_t seq) {
+  MGI_ZLL->IRQSTS = MGI_ZLL->IRQSTS;
+  MGI_ZLL->PHY_CTRL |= seq;
+}
+
+static bool mg_mcxw71_init(struct mg_tcpip_if *ifp) {
+  struct mg_l2_802154_data *d =
+      (struct mg_l2_802154_data *) ifp->driver_data;
+  if (d == NULL || d->channel < 11 || d->channel > 26) {
+    MG_ERROR(("Set driver_data, channel 11..26"));
+    return false;
+  }
+  MGI_ZLL->SEQ_CTRL_STS |= MGI_SEQ_CTRL_NO_RX_RECYCLE;
+  MGI_ZLL->PHY_CTRL = MGI_PHY_CTRL_ALL_IRQ_MASKS;  // Mask all IRQs, we poll
+  MGI_ZLL->IRQSTS = MGI_ZLL->IRQSTS;
+  MGI_ZLL->SAM_CTRL = 0;
+  MGI_ZLL->RX_FRAME_FILTER = MGI_FRAME_FILTER;
+  MGI_ZLL->TMR_PRESCALE = 5;  // 16 us timebase, one symbol
+  MGI_ZLL->CHANNEL_NUM0 = d->channel;
+  MGI_ZLL->MACSHORTADDRS0 = (0xfffeU << 16) | d->pan_id;  // Filter by PAN ID
+  MGI_ZLL->PA_PWR = 0x3f;  // PA slices, max output power
+  mg_mcxw71_start(MGI_SEQ_RX);
+  return true;
+}
+
+// Send one radio frame: MAC header and payload, no FCS
+static size_t mg_mcxw71_send(const uint8_t *p, size_t len,
+                             struct mg_tcpip_if *ifp) {
+  size_t i;
+  bool ok;
+  mg_mcxw71_idle();
+  MGI_TX_PB[0] = (uint8_t) (len + 2);  // FCS is added by hardware
+  for (i = 0; i < len; i++) MGI_TX_PB[i + 1] = p[i];  // 8-bit access only
+  mg_mcxw71_start(MGI_SEQ_TX);
+  ok = mg_mcxw71_wait();
+  mg_mcxw71_idle();
+  mg_mcxw71_start(MGI_SEQ_RX);
+  (void) ifp;
+  return ok ? len : 0;
+}
+
+static size_t mg_mcxw71_tx(const void *buf, size_t len,
+                           struct mg_tcpip_if *ifp) {
+  return mg_l2_802154_tx(ifp, buf, len, mg_mcxw71_send);
+}
+
+static size_t mg_mcxw71_rx(void *buf, size_t len, struct mg_tcpip_if *ifp) {
+  uint32_t irqsts = MGI_ZLL->IRQSTS;
+  uint8_t f[125];
+  size_t i, n = 0;
+  if ((irqsts & MGI_IRQSTS_SEQIRQ) == 0) return 0;  // Still receiving
+  if (irqsts & MGI_IRQSTS_RXIRQ) {
+    n = MGI_IRQSTS_RX_LEN(irqsts);
+    n = n >= 2 ? n - 2 : 0;  // Strip FCS
+    if (n > sizeof(f)) n = sizeof(f);
+    for (i = 0; i < n; i++) f[i] = MGI_RX_PB[i];
+  }
+  mg_mcxw71_idle();
+  mg_mcxw71_start(MGI_SEQ_RX);
+  return mg_l2_802154_rx(ifp, f, n, buf, len);
+}
+
+static bool mg_mcxw71_poll(struct mg_tcpip_if *ifp, bool s1) {
+  (void) ifp, (void) s1;
+  return true;  // Radio link is always up
+}
+
+struct mg_tcpip_driver mg_tcpip_driver_mcxw71 = {mg_mcxw71_init, mg_mcxw71_tx,
+                                                 mg_mcxw71_rx, mg_mcxw71_poll};
+
+#endif

src/drivers/mcxw71.h

@@ -0,0 +1,25 @@
+#pragma once
+
+#if MG_ENABLE_TCPIP && defined(MG_ENABLE_DRIVER_MCXW71) && \
+    MG_ENABLE_DRIVER_MCXW71
+
+// NXP MCXW71 IEEE 802.15.4 radio, ZLL link layer, as an Ethernet interface:
+// Ethernet frames are split into radio frames, see mg_l2_802154_tx().
+// The transceiver (XCVR) must be set up for 802.15.4 before mg_tcpip_init(),
+// see hal_radio_init() in the FRDM-MCXW71 tutorial.
+// driver_data: struct mg_l2_802154_data, channel and PAN ID set
+
+#define MG_TCPIP_DRIVER_INIT(mgr)                                    \
+  do {                                                               \
+    static struct mg_l2_802154_data driver_data_;                  \
+    static struct mg_tcpip_if mif_;                                  \
+    driver_data_.channel = MG_L2_802154_CHANNEL;                   \
+    driver_data_.pan_id = MG_L2_802154_PAN_ID;                     \
+    mif_.driver = &mg_tcpip_driver_mcxw71;                           \
+    mif_.driver_data = &driver_data_;                                \
+    MG_SET_MAC_ADDRESS(mif_.mac);                                    \
+    mg_tcpip_init(mgr, &mif_);                                       \
+    MG_INFO(("Driver: mcxw71, channel %d", MG_L2_802154_CHANNEL)); \
+  } while (0)
+
+#endif

src/drivers/netc.c

@@ -0,0 +1,468 @@
+#include "net_builtin.h"
+
+#if defined(MG_ENABLE_TCPIP) && MG_ENABLE_TCPIP && \
+    defined(MG_ENABLE_DRIVER_NETC) && MG_ENABLE_DRIVER_NETC
+
+// IMXRT1180 RM - Chapter 53 - Ethernet Controller (NETC)
+
+#define ETH_DESC_CNT 8 // Descriptor count must be multiple of 8 (53.4.6.11.97)
+#define ETH_PKT_SIZE 1536
+
+struct netc_pci_function { // 53.4.6.1.1
+  volatile uint32_t DID_VID;
+  volatile uint16_t CMD, STAT;
+  volatile uint8_t reserved0[0x40];
+  volatile uint16_t DEV_CTL, DEV_STAT;
+  volatile uint8_t reserved1[0x34];
+  volatile uint16_t MSIX_CAP_LIST, MSIX_MSG_CTL;
+};
+
+struct netc_emdio { // 53.4.6.12
+  volatile uint32_t EMDIO_CFG, EMDIO_CTL, EMDIO_DATA, EMDIO_ADDR, EMDIO_STAT;
+};
+
+struct netc_enetc { // 53.4.6.6 
+  volatile uint32_t ECAPR0, ECAPR1, ECAPR2, reserved0, PMR;
+  volatile uint8_t reserved1[0x1ec];
+  volatile uint32_t PSIPMMR, PSIPVMR;
+  volatile uint8_t reserved2[0x5f8];
+  volatile uint32_t SMCAPR;
+  volatile uint8_t reserved3[0x17fc];
+  struct {
+    volatile uint32_t PSIPMAR0, PSIPMAR1, PSIVLANR, reserved0, PSICFGR0,
+      PSICFGR1, PSICFGR2;
+    volatile uint8_t reserved1[0x3c];
+    volatile uint32_t PSIMMHFR0, PSIMMHFR1;
+    volatile uint8_t reserved2[0x20];
+  } PSI[1];
+};
+
+struct netc_port { // 53.4.6.8
+  volatile uint32_t PCAPR, PMCAPR, PIOCAPR, reserved0, PCR;
+  volatile uint8_t reserved1[0x0c];
+  volatile uint32_t PMAR0, PMAR1;
+  volatile uint8_t reserved2[0xd8];
+  volatile uint32_t POR, PSR;
+  volatile uint8_t reserved3[0x30];
+  volatile uint32_t PDGSR;
+  volatile uint8_t reserved4[0xc4];
+  struct {
+    volatile uint32_t PTGSTCSR, reserved0, PTCTMSDUR, reserved1, PTCCBSR0,
+      PTCCBSR1;
+    volatile uint8_t reserved2[8];
+  } TCT[8];
+  volatile uint8_t reserved5[0x220];
+  volatile uint32_t BPSTGSR;
+};
+
+struct netc_port_mac { // 53.4.6.9
+  volatile uint8_t reserved0[8];
+  volatile uint32_t COMMAND_CONFIG, MAC_ADDR_0, MAC_ADDR_1, MAXFRM, MINFRM;
+  volatile uint8_t reserved1[0x24];
+  volatile uint32_t IEVENT;
+  volatile uint8_t reserved2[0x1dc];
+  volatile uint64_t TFRMN;
+  volatile uint8_t reserved3[0xd8];
+  volatile uint32_t IF_MODE;
+  volatile uint8_t reserved4[0xfc];
+};
+
+struct netc_eth_link {
+  struct netc_port_mac PM[2];
+};
+
+struct netc_pseudo_link {
+  volatile uint32_t PPMSR;
+  volatile uint8_t reserved0[0x0c];
+  volatile uint32_t PPMCR;
+};
+
+struct netc_switch { // 53.4.6.5
+  volatile uint8_t reserved0[0x400];
+  volatile uint32_t MPCR;
+  volatile uint8_t reserved1[0x1c0c];
+  volatile uint32_t VFHTDECR0, VFHTDECR1, VFHTDECR2;
+};
+
+struct netc_bdr {
+  volatile uint32_t TBMR, TBSR;
+  volatile uint8_t reserved0[8];
+  volatile uint32_t TBBAR0, TBBAR1, TBPIR, TBCIR, TBLENR;
+  volatile uint8_t reserved1[0x7c];
+  volatile uint32_t TBIER, TBIDR, TBICR0, TBICR1;
+  volatile uint8_t reserved2[0x50];
+  volatile uint32_t RBMR, RBSR, RBBSR, RBCIR, RBBAR0, RBBAR1, RBPIR,
+    reserved3, RBLENR;
+  volatile uint8_t reserved4[0x5c];
+  volatile uint32_t RBDCR;
+  volatile uint8_t reserved5[0x1c];
+  volatile uint32_t RBIER, RBIDR, RBICR0, RBICR1;
+  volatile uint8_t reserved6[0x50];
+};
+
+struct netc_si { // 53.4.6.11
+  volatile uint32_t SIMR, SISR;
+  volatile uint8_t reserved0[0x30];
+  volatile uint32_t SIRBGCR;
+  volatile uint8_t reserved1[0x2ec];
+  volatile uint32_t SITFRM0;
+  volatile uint8_t reserved2[0x6fc];
+  volatile uint32_t SIRXIDR0;
+  volatile uint8_t reserved3[0x154];
+  volatile uint32_t SIMSIRRVR[1];
+  volatile uint8_t reserved4[0x747c];
+  struct netc_bdr BDR[1];
+};
+
+struct netc_msix_entry { // 53.4.2.11
+  volatile uint32_t MSG_ADDR, MSG_UPPER_ADDR, MSG_DATA, VECTOR_CTRL;
+};
+
+struct netc_msgintr { // 54.4
+  struct {
+    volatile uint32_t MSIIR, MSIR;
+  } MSI[3];
+};
+
+#define NETC_EMDIO_PCI \
+  ((struct netc_pci_function *) (uintptr_t) 0x60001000U)
+#define NETC_SWITCH_PCI \
+  ((struct netc_pci_function *) (uintptr_t) 0x60002000U)
+#define NETC_ENETC1_PCI \
+  ((struct netc_pci_function *) (uintptr_t) 0x60004000U)
+#define NETC_EMDIO ((struct netc_emdio *) (uintptr_t) 0x60ba1c00U)
+
+#define NETC_ENETC1 ((struct netc_enetc *) (uintptr_t) 0x60b50000U)
+#define NETC_ENETC1_PORT ((struct netc_port *) (uintptr_t) 0x60b54000U)
+#define NETC_ENETC1_PSEUDO_LINK \
+  ((struct netc_pseudo_link *) (uintptr_t) 0x60b55000U)
+#define NETC_ENETC1_SI0 ((struct netc_si *) (uintptr_t) 0x60b40000U)
+#define NETC_ENETC1_MSIX \
+  ((struct netc_msix_entry *) (uintptr_t) 0x60c00000U)
+
+#define NETC_SWITCH ((struct netc_switch *) (uintptr_t) 0x60a00000U)
+#define NETC_SW0_PORT(link)                                   \
+  ((struct netc_port *) (uintptr_t) (0x60a04000U +            \
+                                     (uint32_t) (link) * 0x4000U))
+#define NETC_SW0_ETH(link)                                    \
+  ((struct netc_eth_link *) (uintptr_t) (0x60a05000U +        \
+                                         (uint32_t) (link) * 0x4000U))
+#define NETC_SW0_PORT4 ((struct netc_port *) (uintptr_t) 0x60a14000U)
+#define NETC_MSGINTR1 \
+  ((struct netc_msgintr *) (uintptr_t) 0x428a0000U)
+
+enum {
+  NETC_RX_MSIX_ENTRY = 0,
+  NETC_RX_MSG_INDEX = 2,
+};
+
+struct netc_tx_bd {
+  uint64_t buffer_address;
+  uint16_t buffer_length, frame_length;
+  uint32_t control;
+};
+
+struct netc_rx_descriptor {
+  uint64_t buffer_address, reserved;
+};
+
+struct netc_rx_writeback {
+  uint16_t internet_checksum, parser_summary;
+  uint32_t rss_hash;
+  uint16_t buffer_length, vlan;
+  uint32_t status;
+};
+
+union netc_rx_bd {
+  struct netc_rx_descriptor descriptor;
+  struct netc_rx_writeback writeback;
+};
+
+static volatile struct netc_tx_bd s_txdesc[ETH_DESC_CNT] MG_ETH_RAM
+    __attribute__((aligned(128)));
+static volatile union netc_rx_bd s_rxdesc[ETH_DESC_CNT] MG_ETH_RAM
+    __attribute__((aligned(128)));
+static uint8_t s_txbuf[ETH_DESC_CNT][ETH_PKT_SIZE] MG_ETH_RAM
+    __attribute__((aligned(64)));
+static uint8_t s_rxbuf[ETH_DESC_CNT][ETH_PKT_SIZE] MG_ETH_RAM
+    __attribute__((aligned(64)));
+
+static uint16_t s_tx_prod;
+static uint16_t s_tx_clean;
+static uint16_t s_rx_cons;
+static struct mg_tcpip_if *s_ifp;
+
+static uint16_t enet_read_phy(uint8_t addr, uint8_t reg) {
+  NETC_EMDIO->EMDIO_CFG &= ~MG_BIT(6);  // ENC45: use Clause 22
+  NETC_EMDIO->EMDIO_CTL = MG_BIT(15) | ((uint32_t) (addr & 0x1fU) << 5) |
+                           (reg & 0x1fU);  // READ, PORT_ADDR, DEV_ADDR
+  while (NETC_EMDIO->EMDIO_CFG & MG_BIT(31)) (void) 0;  // BSY1
+  return (uint16_t) (NETC_EMDIO->EMDIO_DATA & 0xffffU);
+}
+
+static void enet_write_phy(uint8_t addr, uint8_t reg, uint16_t value) {
+  NETC_EMDIO->EMDIO_CFG &= ~MG_BIT(6);  // ENC45: use Clause 22
+  NETC_EMDIO->EMDIO_CTL = ((uint32_t) (addr & 0x1fU) << 5) |
+                           (reg & 0x1fU);  // PORT_ADDR, DEV_ADDR
+  NETC_EMDIO->EMDIO_DATA = value;
+  while (NETC_EMDIO->EMDIO_CFG & MG_BIT(31)) (void) 0;  // BSY1
+}
+
+static bool mg_tcpip_driver_netc_init(struct mg_tcpip_if *ifp) {
+  struct mg_tcpip_driver_netc_data *d =
+      (struct mg_tcpip_driver_netc_data *) ifp->driver_data;
+  struct mg_phy phy = {enet_read_phy, enet_write_phy};
+  struct netc_port *switch_port;
+  struct netc_eth_link *eth_link;
+  uint64_t tx_base = (uint64_t) (uintptr_t) s_txdesc;
+  uint64_t rx_base = (uint64_t) (uintptr_t) s_rxdesc;
+  uint32_t mac0 = (uint32_t) ifp->mac[0] |
+                  ((uint32_t) ifp->mac[1] << 8) |
+                  ((uint32_t) ifp->mac[2] << 16) |
+                  ((uint32_t) ifp->mac[3] << 24);
+  uint32_t mac1 = (uint32_t) ifp->mac[4] |
+                  ((uint32_t) ifp->mac[5] << 8);
+  uint32_t mdc_cr =
+      (uint32_t) (d->mdc_cr < 0 ? MG_DRIVER_MDC_CR : d->mdc_cr);
+
+  switch_port = NETC_SW0_PORT(d->link);
+  eth_link = NETC_SW0_ETH(d->link);
+  s_ifp = ifp;
+  for (int i = 0; i < ETH_DESC_CNT; i++) {
+    s_txdesc[i].buffer_address = (uint64_t) (uintptr_t) s_txbuf[i];
+    s_rxdesc[i].descriptor.buffer_address =
+        (uint64_t) (uintptr_t) s_rxbuf[i];
+  }
+
+  NETC_EMDIO_PCI->DEV_CTL |= MG_BIT(15);  // INIT_FLR
+  while (NETC_EMDIO_PCI->DEV_CTL & MG_BIT(15)) (void) 0;
+  NETC_EMDIO_PCI->CMD |= MG_BIT(2) | MG_BIT(1);  // BUS_MASTER_EN, MEM_ACCESS
+  NETC_EMDIO->EMDIO_CFG =
+      ((mdc_cr & 0x1ffU) << 7) | MG_BIT(2);  // MDIO_CLK_DIV, MDIO_HOLD
+  mg_phy_init(&phy, d->phy_addr, 0);
+
+  // Initialize ENETC1 PSI0 and port
+  NETC_ENETC1_PCI->CMD |= MG_BIT(2) | MG_BIT(1);  // BUS_MASTER_EN, MEM_ACCESS
+  NETC_ENETC1_PCI->MSIX_MSG_CTL = MG_BIT(14);  // FUNC_MASK
+  NETC_ENETC1_PORT->POR |= MG_BIT(1) | MG_BIT(0);  // RXDIS, TXDIS
+  NETC_ENETC1_PCI->DEV_CTL |= MG_BIT(15);  // INIT_FLR
+  while (NETC_ENETC1_PCI->DEV_CTL & MG_BIT(15)) (void) 0;
+  NETC_ENETC1_PCI->CMD |= MG_BIT(2) | MG_BIT(1);  // BUS_MASTER_EN, MEM_ACCESS
+  NETC_ENETC1_PCI->MSIX_MSG_CTL = MG_BIT(14);  // FUNC_MASK
+  NETC_ENETC1_PORT->PCR = 99U << 16;  // PSPEED: 1 Gbps
+  NETC_ENETC1_PORT->PMAR0 = mac0;
+  NETC_ENETC1_PORT->PMAR1 = mac1;
+  NETC_ENETC1_PSEUDO_LINK->PPMCR = MG_BIT(16);  // TXPAD
+  NETC_ENETC1->PSIPMMR &= ~(MG_BIT(16) | MG_BIT(0));
+  NETC_ENETC1_SI0->SIMR &=
+      ~(MG_BIT(31) | MG_BIT(3) | MG_BIT(2) | MG_BIT(1));
+  NETC_ENETC1_SI0->SIRBGCR = 0;
+  NETC_ENETC1->PSI[0].PSICFGR0 =
+      MG_BIT(16) | MG_BIT(0);  // one Rx BDR, one Tx BDR
+
+  NETC_ENETC1->PSI[0].PSICFGR2 = 0;  // NUM_MSIX: one entry
+  NETC_ENETC1_MSIX[NETC_RX_MSIX_ENTRY].VECTOR_CTRL = MG_BIT(0);  // MASK
+  NETC_ENETC1_MSIX[NETC_RX_MSIX_ENTRY].MSG_ADDR =
+      (uint32_t) (uintptr_t) &NETC_MSGINTR1->MSI[0].MSIIR;
+  NETC_ENETC1_MSIX[NETC_RX_MSIX_ENTRY].MSG_UPPER_ADDR = 0;
+  NETC_ENETC1_MSIX[NETC_RX_MSIX_ENTRY].MSG_DATA = NETC_RX_MSG_INDEX;
+  NETC_ENETC1_SI0->SIMSIRRVR[0] = NETC_RX_MSIX_ENTRY;  // Rx ring 0 -> entry 0
+
+  // Initialize switch function 2 to drive the selected physical port
+  NETC_SWITCH_PCI->CMD |= MG_BIT(2) | MG_BIT(1);
+  NETC_SWITCH_PCI->MSIX_MSG_CTL = MG_BIT(14);  // FUNC_MASK
+  switch_port->POR |= MG_BIT(1) | MG_BIT(0);
+  eth_link->PM[0].COMMAND_CONFIG |= MG_BIT(26);  // SWR
+  while (eth_link->PM[0].COMMAND_CONFIG & MG_BIT(26)) (void) 0;
+  eth_link->PM[1].COMMAND_CONFIG |= MG_BIT(26);  // SWR
+  while (eth_link->PM[1].COMMAND_CONFIG & MG_BIT(26)) (void) 0;
+  NETC_SWITCH_PCI->DEV_CTL |= MG_BIT(15);  // INIT_FLR
+  while (NETC_SWITCH_PCI->DEV_CTL & MG_BIT(15)) (void) 0;
+  NETC_SWITCH_PCI->CMD |= MG_BIT(2) | MG_BIT(1);
+  NETC_SWITCH_PCI->MSIX_MSG_CTL = MG_BIT(14);  // FUNC_MASK
+
+  // Configure switch physical port and ethernet link (ETH_X)
+  switch_port->PCR = 99U << 16;  // PSPEED: 1 Gbps
+  switch_port->PMAR0 = mac0;
+  switch_port->PMAR1 = mac1;
+  switch_port->TCT[0].PTCTMSDUR = MG_BIT(24) | MG_BIT(16) | ETH_PKT_SIZE;
+  eth_link->PM[0].MAXFRM = ETH_PKT_SIZE;
+  eth_link->PM[0].MINFRM = 64;
+  eth_link->PM[0].IF_MODE = MG_BIT(14) | 4U;  // 1G RGMII
+  eth_link->PM[0].COMMAND_CONFIG =
+      MG_BIT(15) | MG_BIT(1) | MG_BIT(0);  // TXP, RX_EN, TX_EN
+  eth_link->PM[1].MAXFRM = ETH_PKT_SIZE;
+  eth_link->PM[1].MINFRM = 64;
+  eth_link->PM[1].IF_MODE = MG_BIT(14) | 4U;
+  eth_link->PM[1].COMMAND_CONFIG =
+      MG_BIT(15) | MG_BIT(1) | MG_BIT(0);
+
+  // Bridge the selected physical port with management port 4 (54.4.1.1)
+  NETC_SWITCH->VFHTDECR0 = MG_BIT(4) | MG_BIT(d->link);
+  NETC_SWITCH->VFHTDECR2 = (1UL << 27) | (1UL << 24);  // MFO=1, MLO=1
+  switch_port->BPSTGSR = 2U;  // STG0: forwarding
+  NETC_SW0_PORT4->BPSTGSR = 2U;  // STG0: forwarding
+  switch_port->POR &= ~(MG_BIT(1) | MG_BIT(0));
+  NETC_SW0_PORT4->POR &= ~(MG_BIT(1) | MG_BIT(0));
+
+  // Initialize Tx BD ring 0 (direct switch enqueue)
+  NETC_ENETC1_SI0->BDR[0].TBBAR0 = (uint32_t) tx_base;
+  NETC_ENETC1_SI0->BDR[0].TBBAR1 = (uint32_t) (tx_base >> 32);
+  NETC_ENETC1_SI0->BDR[0].TBLENR = ETH_DESC_CNT;
+
+  // Initialize Rx BD ring 0
+  NETC_ENETC1_SI0->BDR[0].RBICR0 =
+      MG_BIT(31) | MG_BIT(0);  // ICEN, interrupt after one frame
+  NETC_ENETC1_SI0->BDR[0].RBBAR0 = (uint32_t) rx_base;
+  NETC_ENETC1_SI0->BDR[0].RBBAR1 = (uint32_t) (rx_base >> 32);
+  NETC_ENETC1_SI0->BDR[0].RBBSR = ETH_PKT_SIZE;
+  NETC_ENETC1_SI0->BDR[0].RBLENR = ETH_DESC_CNT;
+
+  // Clear stale device and MSGINTR state before the ring becomes active
+  NETC_ENETC1_SI0->SIRXIDR0 = MG_BIT(0);  // RX0, W1C
+  (void) NETC_MSGINTR1->MSI[0].MSIR;  // clear pending messages
+  NETC_ENETC1_SI0->BDR[0].RBIER = MG_BIT(0);  // RXTIE
+  NETC_ENETC1_SI0->BDR[0].TBMR = MG_BIT(31);
+  NETC_ENETC1_SI0->BDR[0].RBMR = MG_BIT(31);  // EN, CRC=0: strip FCS
+  NETC_ENETC1_PORT->POR &= ~(MG_BIT(1) | MG_BIT(0));
+  NETC_ENETC1->PMR |= MG_BIT(16); // SI0EN
+  NETC_ENETC1_SI0->SIMR |= MG_BIT(31);  // EN
+  MG_DSB();
+  if ((NETC_ENETC1->SMCAPR & MG_BIT(0)) == 0U ||
+      (NETC_SWITCH->MPCR & 0x1fU) != 4U) {
+    MG_ERROR(("NETC fixed management path unavailable: SMCAPR=%08lx MPCR=%08lx",
+              (unsigned long) NETC_ENETC1->SMCAPR,
+              (unsigned long) NETC_SWITCH->MPCR));
+    return false;
+  }
+
+  NETC_ENETC1_PCI->MSIX_MSG_CTL =
+    MG_BIT(15);  // Enable RX interrupt, MSIX_EN=1, FUNC_MASK=0
+  MG_DSB();
+  NETC_ENETC1_MSIX[NETC_RX_MSIX_ENTRY].VECTOR_CTRL = 0;  // MASK=0, last
+  MG_DSB();
+  return true;
+}
+
+static size_t mg_tcpip_driver_netc_tx(const void *buf, size_t len,
+                                      struct mg_tcpip_if *ifp) {
+  struct mg_tcpip_driver_netc_data *d =
+      (struct mg_tcpip_driver_netc_data *) ifp->driver_data;
+  uint16_t next;
+  s_tx_clean =
+      (uint16_t) (NETC_ENETC1_SI0->BDR[0].TBCIR & 0xffffU);  // BDR_INDEX
+  next = (uint16_t) (s_tx_prod + 1U);
+  if (next >= ETH_DESC_CNT) next = 0;
+  if (len > sizeof(s_txbuf[0])) {
+    MG_ERROR(("Frame too big, %ld", (long) len));
+    len = (size_t) -1;  // fail
+  } else if (next == s_tx_clean) {
+    ifp->nerr++;
+    MG_ERROR(("No descriptors available"));
+    len = 0;  // retry later
+  } else {
+    memcpy(s_txbuf[s_tx_prod], buf, len);  // Copy data
+    s_txdesc[s_tx_prod].buffer_address =
+        (uint64_t) (uintptr_t) s_txbuf[s_tx_prod];
+    s_txdesc[s_tx_prod].buffer_length = (uint16_t) len;  // BUFF_LEN
+    s_txdesc[s_tx_prod].frame_length = (uint16_t) len;   // FRAME_LEN
+    s_txdesc[s_tx_prod].control =
+        MG_BIT(31) | (2UL << 24) | MG_BIT(23) | ((uint32_t) d->link << 16);
+    // F=1, FLQ=2, SMSO=1, EGR_PORT=link, IPV=0, DR=0
+    MG_DSB();
+    if (++s_tx_prod >= ETH_DESC_CNT) s_tx_prod = 0;
+    NETC_ENETC1_SI0->BDR[0].TBPIR = s_tx_prod;  // BDR_INDEX
+  }
+  return len;
+}
+
+static void mg_tcpip_driver_netc_update_hash_table(struct mg_tcpip_if *ifp) {
+  // mcast address has NETC XOR hash index 56 (RM 53.4.2.3.1.3.8.4.1)
+  NETC_ENETC1->PSI[0].PSIMMHFR0 = 0;
+  NETC_ENETC1->PSI[0].PSIMMHFR1 = MG_BIT(24);
+  (void) ifp;
+}
+
+static bool mg_tcpip_driver_netc_poll(struct mg_tcpip_if *ifp, bool s1) {
+  if (ifp->update_mac_hash_table) {
+    mg_tcpip_driver_netc_update_hash_table(ifp);
+    ifp->update_mac_hash_table = false;
+  }
+  if (!s1) return false;
+  struct mg_tcpip_driver_netc_data *d =
+      (struct mg_tcpip_driver_netc_data *) ifp->driver_data;
+  struct netc_port *switch_port = NETC_SW0_PORT(d->link);
+  struct netc_eth_link *eth_link = NETC_SW0_ETH(d->link);
+  uint8_t speed = MG_PHY_SPEED_10M;
+  bool up, full_duplex = false;
+  struct mg_phy phy = {enet_read_phy, enet_write_phy};
+
+  up = mg_phy_up(&phy, d->phy_addr, &full_duplex, &speed);
+  if ((ifp->state == MG_TCPIP_STATE_DOWN) && up) {
+    uint16_t port_speed = speed == MG_PHY_SPEED_1000M ? 99U
+                          : speed == MG_PHY_SPEED_100M ? 9U
+                                                       : 0U;
+    uint32_t config = switch_port->PCR;
+    uint32_t mode = eth_link->PM[0].IF_MODE;
+    config &= ~(0x3fffU << 16);  // PCR[29:16] PSPEED
+    config |= (uint32_t) port_speed << 16;
+    mode &= ~(MG_BIT(14) | MG_BIT(13) | MG_BIT(6));  // SSP, HD
+    if (speed == MG_PHY_SPEED_1000M) {
+      mode |= MG_BIT(14);  // SSP: 1 Gbps, full duplex
+    } else {
+      if (speed == MG_PHY_SPEED_10M) mode |= MG_BIT(13);  // SSP
+      if (!full_duplex) mode |= MG_BIT(6);                // HD
+    }
+    switch_port->PCR = config;
+    eth_link->PM[0].IF_MODE = mode;
+    eth_link->PM[1].IF_MODE = mode;
+
+    // TX_CSD, RX_CSD, and SPD_DUP are latched while the PHY is reset/down.
+    eth_link->PM[0].IEVENT = MG_BIT(23) | MG_BIT(22) | MG_BIT(21);
+    MG_DSB();
+    MG_DEBUG(("Link is %uM %s-duplex",
+              speed == MG_PHY_SPEED_1000M ? 1000U
+              : speed == MG_PHY_SPEED_100M ? 100U
+                                           : 10U,
+              full_duplex ? "full" : "half"));
+  }
+  return up;
+}
+
+void MSGINTR1_IRQHandler(void);
+void MSGINTR1_IRQHandler(void) {
+  if (NETC_MSGINTR1->MSI[0].MSIR & MG_BIT(NETC_RX_MSG_INDEX)) {
+    NETC_ENETC1_SI0->SIRXIDR0 = MG_BIT(0);  // RX0, W1C
+    MG_DSB();
+    for (int i = 0; i < 10; i++) {  // Read as they arrive but not forever
+      uint32_t status;
+      size_t len;
+      if (s_rx_cons ==
+          (uint16_t) (NETC_ENETC1_SI0->BDR[0].RBPIR & 0xffffU))
+        break;
+      status = s_rxdesc[s_rx_cons].writeback.status;
+      if (!(status & MG_BIT(30))) break;  // R: writeback is ready
+      len = s_rxdesc[s_rx_cons].writeback.buffer_length;
+      if ((status & (MG_BIT(31) | MG_BIT(30))) ==
+              (MG_BIT(31) | MG_BIT(30)) &&  // F, R
+          !(status & (0xffU << 16)) &&       // ERROR
+          !(status & (0xfU << 2)) &&         // HR=0: regular frame
+          len > 0 && len <= sizeof(s_rxbuf[0])) {
+        mg_tcpip_qwrite(s_rxbuf[s_rx_cons], len, s_ifp);  // FCS stripped
+      }
+      s_rxdesc[s_rx_cons].descriptor.buffer_address =
+          (uint64_t) (uintptr_t) s_rxbuf[s_rx_cons];
+      s_rxdesc[s_rx_cons].descriptor.reserved = 0;
+      MG_DSB();
+      if (++s_rx_cons >= ETH_DESC_CNT) s_rx_cons = 0;
+      NETC_ENETC1_SI0->BDR[0].RBCIR = s_rx_cons;
+    }
+  }
+  MG_DSB();
+}
+
+struct mg_tcpip_driver mg_tcpip_driver_netc = {mg_tcpip_driver_netc_init,
+                                               mg_tcpip_driver_netc_tx, NULL,
+                                               mg_tcpip_driver_netc_poll};
+
+#endif

src/drivers/netc.h

@@ -0,0 +1,49 @@
+#pragma once
+
+#if defined(MG_ENABLE_TCPIP) && MG_ENABLE_TCPIP && \
+    defined(MG_ENABLE_DRIVER_NETC) && MG_ENABLE_DRIVER_NETC
+
+struct mg_tcpip_driver_netc_data {
+  int mdc_cr;
+  uint8_t phy_addr;
+
+  // Selects the physical Ethernet link (ETH0 through ETH3)
+  // Its switch port is bridged to pseudo-port 4,
+  // which connects internally to ENETC1
+  // IMXRT1180 RM 53.4.1.1 NETC Block diagram
+  uint8_t link;
+};
+
+#ifndef MG_TCPIP_PHY_ADDR
+#define MG_TCPIP_PHY_ADDR 5
+#endif
+
+#ifndef MG_DRIVER_MDC_CR
+#define MG_DRIVER_MDC_CR 48
+#endif
+
+#ifndef MG_TCPIP_NETC_LINK
+#define MG_TCPIP_NETC_LINK 0
+#endif
+
+struct mg_tcpip_driver;
+extern struct mg_tcpip_driver mg_tcpip_driver_netc;
+
+#define MG_TCPIP_DRIVER_INIT(mgr)                              \
+  do {                                                         \
+    static struct mg_tcpip_driver_netc_data driver_data_;      \
+    static struct mg_tcpip_if mif_;                            \
+    driver_data_.mdc_cr = MG_DRIVER_MDC_CR;                    \
+    driver_data_.phy_addr = MG_TCPIP_PHY_ADDR;                 \
+    driver_data_.link = MG_TCPIP_NETC_LINK;                    \
+    mif_.ip = MG_TCPIP_IP;                                     \
+    mif_.mask = MG_TCPIP_MASK;                                 \
+    mif_.gw = MG_TCPIP_GW;                                     \
+    mif_.driver = &mg_tcpip_driver_netc;                       \
+    mif_.driver_data = &driver_data_;                          \
+    MG_SET_MAC_ADDRESS(mif_.mac);                              \
+    mg_tcpip_init(mgr, &mif_);                                 \
+    MG_INFO(("Driver: netc, MAC: %M", mg_print_mac, mif_.mac)); \
+  } while (0)
+
+#endif

src/drivers/phy.c

@@ -11,7 +11,9 @@ enum {                  // ID1  ID2
   MG_PHY_RTL8201 = 0xc816,  // 001c c816 - RTL8201F
   MG_PHY_RTL8211 = 0xc916,  // 001c c916 - RTL8211F
   MG_PHY_ICS1894x = 0x15,
-  MG_PHY_ICS189432 = 0xf450  // 0015 f450 - ICS1894
+  MG_PHY_ICS189432 = 0xf450,  // 0015 f450 - ICS1894
+  MG_PHY_YT85x = 0x4f51,
+  MG_PHY_YT8531 = 0xe91a  // 4f51 e91a - Motorcomm YT8531
 };
 
 enum {
@@ -29,7 +31,10 @@ enum {
   MG_PHY_RTL82x_REG_PAGESEL = 31,
   MG_PHY_RTL8201_REG_RMSR = 16,   // in page 7
   MG_PHY_RTL8211_REG_PHYSR = 26,  // in page a43
-  MG_PHY_ICS189432_REG_POLL = 17
+  MG_PHY_ICS189432_REG_POLL = 17,
+  MG_PHY_YT8531_REG_PHYSTS = 17,
+  MG_PHY_YT8531_REG_EXT_ADDR = 30,
+  MG_PHY_YT8531_REG_EXT_DATA = 31
 };
 
 static const char *mg_phy_id_to_str(uint16_t id1, uint16_t id2) {
@@ -60,6 +65,8 @@ static const char *mg_phy_id_to_str(uint16_t id1, uint16_t id2) {
       }
     case MG_PHY_ICS1894x:
       return "ICS1894x";
+    case MG_PHY_YT85x:
+      return id2 == MG_PHY_YT8531 ? "YT8531" : "YT85x";
     default:
       return "unknown";
   }
@@ -75,6 +82,18 @@ void mg_phy_init(struct mg_phy *phy, uint8_t phy_addr, uint8_t config) {
   id2 = phy->read_reg(phy_addr, MG_PHY_REG_ID2);
   MG_INFO(("PHY ID: %#04x %#04x (%s)", id1, id2, mg_phy_id_to_str(id1, id2)));
 
+  if (id1 == MG_PHY_YT85x && id2 == MG_PHY_YT8531) {
+    uint16_t value;
+    // TODO (robertc2000): Autonegotiation remains disabled after PHY is reset
+    // We temporarily force enabling autoneg, until a workaround is found.
+    phy->write_reg(phy_addr, MG_PHY_REG_BCR, MG_BIT(12));
+    phy->write_reg(phy_addr, MG_PHY_YT8531_REG_EXT_ADDR, 0xa003);
+    value = phy->read_reg(phy_addr, MG_PHY_YT8531_REG_EXT_DATA);
+    value &= (uint16_t) ~(MG_BIT(3) | MG_BIT(2) | MG_BIT(1) | MG_BIT(0));
+    phy->write_reg(phy_addr, MG_PHY_YT8531_REG_EXT_DATA,
+                   (uint16_t) (value | MG_BIT(1)));  // TXDLY: 2 * 150 ps
+  }
+
   if (id1 == MG_PHY_DP83x && id2 == MG_PHY_DP83867) {
     phy->write_reg(phy_addr, 0x0d, 0x1f);  // write 0x10d to IO_MUX_CFG (0x0170)
     phy->write_reg(phy_addr, 0x0e, 0x170);
@@ -168,6 +187,15 @@ bool mg_phy_up(struct mg_phy *phy, uint8_t phy_addr, bool *full_duplex,
       uint16_t poll_reg = phy->read_reg(phy_addr, MG_PHY_ICS189432_REG_POLL);
       *full_duplex = poll_reg & MG_BIT(14);
       *speed = (poll_reg & MG_BIT(15)) ? MG_PHY_SPEED_100M : MG_PHY_SPEED_10M;
+    } else if (id1 == MG_PHY_YT85x) {
+      uint16_t id2 = phy->read_reg(phy_addr, MG_PHY_REG_ID2);
+      if (id2 == MG_PHY_YT8531) {
+        uint16_t physts = phy->read_reg(phy_addr, MG_PHY_YT8531_REG_PHYSTS);
+        *full_duplex = physts & MG_BIT(13);
+        *speed = (physts & MG_BIT(15))   ? MG_PHY_SPEED_1000M
+                 : (physts & MG_BIT(14)) ? MG_PHY_SPEED_100M
+                                         : MG_PHY_SPEED_10M;
+      }
     }
   }
   return up;

src/drivers/rw612_154.c

@@ -0,0 +1,450 @@
+#include "net_builtin.h"
+
+#if MG_ENABLE_TCPIP && defined(MG_ENABLE_DRIVER_RW612_154) && \
+    MG_ENABLE_DRIVER_RW612_154
+
+// The 802.15.4 radio runs NXP combo firmware on CPU2, an OpenThread RCP. We
+// are CPU3. Messages go through the IMU mailbox: IMU messages carry IMUMC
+// messages, IMUMC messages carry HDLC framed Spinel. See NXP sources:
+// mcuxsdk-core drivers/imu/fsl_imu.c, mcux-component
+// imu_adapter/fsl_adapter_imu.c, connectivity framework
+// platform/rw61x/fwk_platform_hdlc.c; OpenThread src/lib/spinel/spinel.h
+
+// IMU message FIFO registers, one block per direction. See fsl_imu.h
+struct mg_rw612_imu {
+  volatile uint32_t WR_MSG, RD_MSG, STATUS, CNTL, RD_MSG_DBG;
+};
+#define MGI_IMU ((struct mg_rw612_imu *) 0x443ff804)       // CPU3 -> CPU2
+#define MGI_IMU_PEER ((struct mg_rw612_imu *) 0x443ff818)  // CPU2 -> CPU3
+#define MGI_IMU_LOCKED MG_BIT(0)          // STATUS: FIFO locked
+#define MGI_IMU_ALMOST_FULL MG_BIT(1)     // STATUS: FIFO almost full
+#define MGI_IMU_EMPTY MG_BIT(3)           // STATUS: FIFO empty
+#define MGI_IMU_WR_PTR(s) (((s) >> 16) & 15U)
+#define MGI_IMU_INT_CLR MG_BIT(0)         // CNTL: clear message ready IRQ
+#define MGI_IMU_FLUSH MG_BIT(16)          // CNTL: flush send FIFO
+#define MGI_IMU_WAIT_FOR_ACK MG_BIT(17)   // CNTL: lock send FIFO
+#define MGI_IMU_WATERMARK(x) ((uint32_t) (x) << 20)
+#define MGI_IMU_WATERMARK_MASK (15U << 20)
+
+// IMU message: header, then payload words. See IMU_Msg_t
+struct mg_rw612_msg {
+  uint8_t type, subtype, seq, len;  // len: number of payload words
+  uint32_t payload[8];
+};
+
+// Mailbox in SMU2 shared memory, at the address CPU2 firmware expects
+struct mg_rw612_mbox {
+  uint32_t magic[2];             // Sync pattern: [0] CPU2, [1] us
+  struct mg_rw612_msg q[2][16];  // Message slots: [0] CPU2 -> us, [1] ours
+};
+#define MGI_MBOX ((volatile struct mg_rw612_mbox *) 0x443c0000)
+#define MGI_TXBUF 0x443c1508U  // Our IMUMC buffers: 16 x 264 bytes
+#define MGI_TXBUF_CNT 16
+#define MGI_TXBUF_LEN 264U
+#define MGI_SLEEP_FLAG (*(volatile uint32_t *) 0x443c2588)
+#define MGI_SYNC_MAGIC 0xabcdef89U
+
+// IMUMC message, carried in IMU payload words. See imumc_std_msg
+struct mg_rw612_imumc {
+  uint32_t src, dst;  // Endpoint addresses
+  uint16_t rfu, idx;  // Reserved
+  uint16_t len;       // Payload length, bytes
+  uint16_t flags;     // Message flags
+  uint32_t data;      // Payload buffer address
+};
+#define MGI_EPT_LOCAL 10   // Our 802.15.4 endpoint
+#define MGI_EPT_REMOTE 20  // Firmware 802.15.4 endpoint
+
+enum { MGI_MSG_CONTROL = 0, MGI_MSG_IMUMC = 8 };  // IMU message types
+enum {                                            // Control message subtypes
+  MGI_CTL_SYNC = 1,
+  MGI_CTL_SYNC_ACK = 2,
+  MGI_CTL_ACK_FOR_UNLOCK = 3,
+  MGI_CTL_CMD_BUF_ADDR = 6,
+  MGI_CTL_EPT_QUERY = 11,
+  MGI_CTL_EPT_QUERY_RSP = 12,
+  MGI_CTL_BUF_FREE = 13
+};
+
+// Spinel commands, properties and statuses we use
+enum { MGI_CMD_RESET = 1, MGI_CMD_GET = 2, MGI_CMD_SET = 3, MGI_CMD_IS = 6 };
+enum {
+  MGI_PROP_LAST_STATUS = 0,
+  MGI_PROP_NCP_VERSION = 2,
+  MGI_PROP_PHY_ENABLED = 0x20,
+  MGI_PROP_PHY_CHAN = 0x21,
+  MGI_PROP_PANID = 0x36,
+  MGI_PROP_RAW_STREAM = 0x37,
+  MGI_PROP_STREAM_RAW = 0x71
+};
+#define MGI_RESET_STACK 2         // RESET argument: reset the RCP stack only
+#define MGI_STATUS_RESET_MIN 112  // LAST_STATUS: RCP has reset
+#define MGI_STATUS_RESET_MAX 127
+#define MGI_TX_TIMEOUT_MS 200  // Wait for transmit done, incl. retries
+#define MGI_RSP_TIMEOUT_MS 500
+#define MGI_RXQ_CNT 16  // A whole Ethernet frame, 15 radio frames
+
+// Driver state, one radio
+struct mg_rw612 {
+  bool up;                  // IMU link synchronised
+  bool ept_ready;           // IMUMC endpoints connected
+  bool reset;               // RCP reported a reset
+  uint8_t seq;              // IMU message sequence number
+  uint16_t free_bufs;       // Free IMUMC buffers, bit per buffer
+  uint8_t hdlc[300];        // HDLC frame being received, unescaped
+  size_t hlen;              // Bytes in hdlc
+  bool esc;                 // Previous byte was an escape
+  uint8_t tid;              // Spinel transaction ID of the pending request
+  bool rsp;                 // Response to the pending request received
+  uint32_t rsp_status;      // Its status, if LAST_STATUS, else 0
+  char version[64];         // RCP version string
+  uint8_t rxq[MGI_RXQ_CNT][127];  // Received frames, no FCS
+  uint8_t rxlen[MGI_RXQ_CNT];     // Their lengths
+  uint8_t rxhead, rxtail;         // Queue indexes
+};
+static struct mg_rw612 s_rw612;
+
+static void mg_rw612_imu_send(uint8_t type, uint8_t subtype,
+                              const uint32_t *payload, uint8_t len) {
+  volatile struct mg_rw612_msg *m;
+  uint64_t expire = mg_millis() + 100;
+  uint8_t i;
+  while ((MGI_IMU->STATUS & (MGI_IMU_ALMOST_FULL | MGI_IMU_LOCKED)) &&
+         mg_millis() < expire) {
+    (void) 0;
+  }
+  m = &MGI_MBOX->q[1][MGI_IMU_WR_PTR(MGI_IMU->STATUS)];
+  m->type = type, m->subtype = subtype, m->seq = s_rw612.seq++, m->len = len;
+  for (i = 0; i < len; i++) m->payload[i] = payload[i];
+  MGI_IMU->WR_MSG = (uint32_t) (uintptr_t) m;
+}
+
+static void mg_rw612_control(uint8_t subtype, uint32_t a, uint32_t b,
+                             uint8_t len) {
+  uint32_t payload[2] = {a, b};
+  mg_rw612_imu_send(MGI_MSG_CONTROL, subtype, payload, len);
+}
+
+static void mg_rw612_queue_rx(const uint8_t *frame, size_t len) {
+  struct mg_rw612 *s = &s_rw612;
+  uint8_t next = (uint8_t) ((s->rxhead + 1) % MGI_RXQ_CNT);
+  if (next == s->rxtail || len > sizeof(s->rxq[0])) return;  // Full: drop
+  memcpy(s->rxq[s->rxhead], frame, len);
+  s->rxlen[s->rxhead] = (uint8_t) len;
+  s->rxhead = next;
+}
+
+// Spinel packed unsigned integer: 7 bits per byte, LSB first
+static size_t mg_rw612_unpack(const uint8_t *p, size_t len, uint32_t *v) {
+  size_t i;
+  *v = 0;
+  for (i = 0; i < len && i < 4; i++) {
+    *v |= (uint32_t) (p[i] & 0x7f) << (7 * i);
+    if ((p[i] & 0x80) == 0) return i + 1;
+  }
+  return 0;
+}
+
+// Handle a received Spinel frame: header, command, property, value
+static void mg_rw612_spinel(const uint8_t *f, size_t len) {
+  struct mg_rw612 *s = &s_rw612;
+  uint32_t cmd, prop, status = 0;
+  size_t n, ofs = 1;
+  uint8_t tid = f[0] & 15;
+  if (len < 3 || (n = mg_rw612_unpack(f + ofs, len - ofs, &cmd)) == 0) return;
+  ofs += n;
+  if ((n = mg_rw612_unpack(f + ofs, len - ofs, &prop)) == 0) return;
+  ofs += n;
+  if (cmd != MGI_CMD_IS) return;
+  if (prop == MGI_PROP_STREAM_RAW && tid == 0 && len - ofs >= 2) {
+    size_t flen = (size_t) (f[ofs] | (f[ofs + 1] << 8));  // Incl. FCS
+    if (flen >= 2 && ofs + 2 + flen <= len) {
+      mg_rw612_queue_rx(f + ofs + 2, flen - 2);
+    }
+  } else if (prop == MGI_PROP_LAST_STATUS) {
+    mg_rw612_unpack(f + ofs, len - ofs, &status);
+    if (tid == 0 && status >= MGI_STATUS_RESET_MIN &&
+        status <= MGI_STATUS_RESET_MAX) {
+      s->reset = true;
+    }
+  } else if (prop == MGI_PROP_NCP_VERSION) {
+    n = len - ofs < sizeof(s->version) - 1 ? len - ofs : sizeof(s->version) - 1;
+    memcpy(s->version, f + ofs, n);
+    s->version[n] = '\0';
+  }
+  if (tid != 0 && tid == s->tid) s->rsp = true, s->rsp_status = status;
+}
+
+// HDLC-lite: 0x7e delimits frames, 0x7d escapes, FCS-16 at the end
+static uint16_t mg_rw612_fcs(uint16_t fcs, uint8_t c) {
+  int i;
+  fcs ^= c;
+  for (i = 0; i < 8; i++) fcs = (fcs & 1) ? (fcs >> 1) ^ 0x8408 : fcs >> 1;
+  return fcs;
+}
+
+static void mg_rw612_hdlc_rx(const uint8_t *p, size_t len) {
+  struct mg_rw612 *s = &s_rw612;
+  size_t i, j;
+  for (i = 0; i < len; i++) {
+    uint8_t c = p[i];
+    if (c == 0x7e) {
+      if (s->hlen >= 3) {
+        uint16_t fcs = 0xffff;
+        for (j = 0; j < s->hlen; j++) fcs = mg_rw612_fcs(fcs, s->hdlc[j]);
+        if (fcs == 0xf0b8) mg_rw612_spinel(s->hdlc, s->hlen - 2);
+      }
+      s->hlen = 0, s->esc = false;
+    } else if (c == 0x7d) {
+      s->esc = true;
+    } else if (s->hlen < sizeof(s->hdlc)) {
+      s->hdlc[s->hlen++] = s->esc ? c ^ 0x20 : c;
+      s->esc = false;
+    }
+  }
+}
+
+static void mg_rw612_control_rx(volatile struct mg_rw612_msg *m) {
+  struct mg_rw612 *s = &s_rw612;
+  switch (m->subtype) {
+    case MGI_CTL_ACK_FOR_UNLOCK:
+      MGI_IMU->CNTL &= ~MGI_IMU_WAIT_FOR_ACK;
+      break;
+    case MGI_CTL_SYNC:  // As HAL_ImuCtrlHandler(): acknowledge twice
+      mg_rw612_control(MGI_CTL_SYNC_ACK, 0, 0, 0);
+      mg_rw612_control(MGI_CTL_SYNC_ACK, 0, 0, 0);
+      s->up = true;
+      break;
+    case MGI_CTL_SYNC_ACK:
+    case MGI_CTL_CMD_BUF_ADDR:
+      s->up = true;
+      break;
+    case MGI_CTL_EPT_QUERY: {  // Firmware asks if our endpoint exists
+      bool ours = m->payload[0] == MGI_EPT_LOCAL;
+      mg_rw612_control(MGI_CTL_EPT_QUERY_RSP, m->payload[0], ours, 2);
+      if (ours) s->ept_ready = true;
+      break;
+    }
+    case MGI_CTL_EPT_QUERY_RSP:
+      if (m->payload[0] == MGI_EPT_REMOTE && m->payload[1] != 0) {
+        s->ept_ready = true;
+      }
+      break;
+    case MGI_CTL_BUF_FREE: {  // Firmware is done with one of our buffers
+      uint32_t i = (m->payload[0] - MGI_TXBUF) / MGI_TXBUF_LEN;
+      if (i < MGI_TXBUF_CNT) s->free_bufs |= (uint16_t) MG_BIT(i);
+      break;
+    }
+    default:
+      break;
+  }
+}
+
+// Process all received IMU messages. See HAL_ImuReceive()
+static void mg_rw612_poll_imu(void) {
+  bool unlock = false;
+  while ((MGI_IMU_PEER->STATUS & MGI_IMU_EMPTY) == 0) {
+    struct mg_rw612_msg m;
+    volatile struct mg_rw612_msg *p;
+    uint8_t i;
+    MGI_SLEEP_FLAG &= ~1U;
+    p = (volatile struct mg_rw612_msg *) (uintptr_t) MGI_IMU->RD_MSG;
+    if (MGI_IMU_PEER->STATUS & MGI_IMU_LOCKED) unlock = true;
+    if (p == NULL) continue;
+    m.type = p->type, m.subtype = p->subtype, m.len = p->len;
+    for (i = 0; i < 8; i++) m.payload[i] = p->payload[i];
+    if (m.type == MGI_MSG_CONTROL) {
+      mg_rw612_control_rx(&m);
+    } else if (m.type == MGI_MSG_IMUMC) {
+      struct mg_rw612_imumc im;
+      memcpy(&im, m.payload, sizeof(im));
+      if (im.dst == MGI_EPT_LOCAL) {
+        mg_rw612_hdlc_rx((const uint8_t *) (uintptr_t) im.data, im.len);
+      }
+      mg_rw612_control(MGI_CTL_BUF_FREE, im.data, 0, 1);
+    }
+  }
+  MGI_IMU->CNTL |= MGI_IMU_INT_CLR;
+  MGI_SLEEP_FLAG |= 1U;
+  if (unlock) mg_rw612_control(MGI_CTL_ACK_FOR_UNLOCK, 0, 0, 0);
+}
+
+// Send bytes to the firmware endpoint, in IMUMC buffer sized chunks
+static bool mg_rw612_imumc_send(const uint8_t *p, size_t len) {
+  struct mg_rw612 *s = &s_rw612;
+  while (len > 0) {
+    size_t n = len < MGI_TXBUF_LEN ? len : MGI_TXBUF_LEN;
+    uint64_t expire = mg_millis() + 100;
+    struct mg_rw612_imumc im;
+    uint32_t i;
+    while (s->free_bufs == 0) {
+      mg_rw612_poll_imu();
+      if (mg_millis() > expire) return false;
+    }
+    for (i = 0; (s->free_bufs & MG_BIT(i)) == 0; i++) (void) 0;
+    s->free_bufs &= (uint16_t) ~MG_BIT(i);
+    memset(&im, 0, sizeof(im));
+    im.src = MGI_EPT_LOCAL, im.dst = MGI_EPT_REMOTE, im.len = (uint16_t) n;
+    im.data = MGI_TXBUF + i * MGI_TXBUF_LEN;
+    memcpy((void *) (uintptr_t) im.data, p, n);
+    mg_rw612_imu_send(MGI_MSG_IMUMC, 0, (uint32_t *) &im, sizeof(im) / 4);
+    p += n, len -= n;
+  }
+  return true;
+}
+
+// Send a Spinel frame, HDLC encoded, and wait for the response with the
+// same transaction ID. Return false on timeout
+static bool mg_rw612_request(uint8_t *f, size_t len, uint32_t timeout_ms) {
+  struct mg_rw612 *s = &s_rw612;
+  uint8_t buf[2 * 160 + 6];
+  uint16_t fcs = 0xffff;
+  size_t i, n = 0;
+  uint64_t expire = mg_millis() + timeout_ms;
+  s->tid = (uint8_t) (s->tid % 15 + 1);
+  f[0] = (uint8_t) (0x80 | s->tid);  // Header: flag, interface 0, TID
+  s->rsp = false;
+  buf[n++] = 0x7e;
+  for (i = 0; i < len + 2 && n + 3 < sizeof(buf); i++) {
+    uint8_t c;
+    if (i < len) {
+      c = f[i], fcs = mg_rw612_fcs(fcs, c);
+    } else {
+      c = (uint8_t) (i == len ? ~fcs & 0xff : ~fcs >> 8);
+    }
+    if (c == 0x7e || c == 0x7d || c == 0x11 || c == 0x13 || c == 0xf8) {
+      buf[n++] = 0x7d, c ^= 0x20;
+    }
+    buf[n++] = c;
+  }
+  buf[n++] = 0x7e;
+  if (!mg_rw612_imumc_send(buf, n)) return false;
+  while (!s->rsp && mg_millis() < expire) mg_rw612_poll_imu();
+  return s->rsp;
+}
+
+static bool mg_rw612_set(uint32_t prop, const uint8_t *val, size_t len) {
+  uint8_t f[16];
+  if (len > sizeof(f) - 3) return false;
+  f[1] = MGI_CMD_SET, f[2] = (uint8_t) prop;  // Properties used are < 0x80
+  memcpy(f + 3, val, len);
+  return mg_rw612_request(f, len + 3, MGI_RSP_TIMEOUT_MS) &&
+         s_rw612.rsp_status == 0;
+}
+
+// Log an init error, return false
+static bool mg_rw612_fail(const char *msg) {
+  MG_ERROR(("%s", msg));
+  return false;
+}
+
+static bool mg_rw612_154_init(struct mg_tcpip_if *ifp) {
+  struct mg_rw612 *s = &s_rw612;
+  struct mg_l2_802154_data *d =
+      (struct mg_l2_802154_data *) ifp->driver_data;
+  uint8_t f[8], one = 1, pan[2];
+  uint64_t expire;
+  if (d == NULL || d->channel < 11 || d->channel > 26) {
+    MG_ERROR(("Set driver_data, channel 11..26"));
+    return false;
+  }
+  if (MGI_MBOX->magic[0] != MGI_SYNC_MAGIC) {
+    MG_ERROR(("Radio firmware is not running on CPU2"));
+    return false;
+  }
+  memset(s, 0, sizeof(*s));
+  s->free_bufs = 0xffff;
+  // Reset our send FIFO, drop stale messages. See IMU_Init()
+  MGI_IMU->CNTL |= MGI_IMU_FLUSH;
+  MGI_IMU->CNTL &= ~(MGI_IMU_FLUSH | MGI_IMU_WAIT_FOR_ACK);
+  MGI_IMU->CNTL = (MGI_IMU->CNTL & ~MGI_IMU_WATERMARK_MASK) |
+                  MGI_IMU_WATERMARK(15);
+  while ((MGI_IMU_PEER->STATUS & MGI_IMU_EMPTY) == 0) (void) MGI_IMU->RD_MSG;
+  // Synchronise the IMU link, then connect the IMUMC endpoints
+  MGI_MBOX->magic[1] = MGI_SYNC_MAGIC;
+  mg_rw612_control(MGI_CTL_SYNC, 0, 0, 0);
+  expire = mg_millis() + 1000;
+  while (!s->up && mg_millis() < expire) mg_rw612_poll_imu();
+  if (!s->up) return mg_rw612_fail("IMU sync timeout");
+  expire = mg_millis() + 2000;
+  while (!s->ept_ready && mg_millis() < expire) {
+    uint64_t retry = mg_millis() + 100;
+    mg_rw612_control(MGI_CTL_EPT_QUERY, MGI_EPT_REMOTE, 0, 1);
+    while (!s->ept_ready && mg_millis() < retry) mg_rw612_poll_imu();
+  }
+  if (!s->ept_ready) return mg_rw612_fail("IMUMC endpoint timeout");
+  // Reset the RCP stack, wait for its reset status, read its version
+  f[1] = MGI_CMD_RESET, f[2] = MGI_RESET_STACK;
+  mg_rw612_request(f, 3, MGI_RSP_TIMEOUT_MS);
+  expire = mg_millis() + 1000;
+  while (!s->reset && mg_millis() < expire) mg_rw612_poll_imu();
+  if (!s->reset) return mg_rw612_fail("RCP reset timeout");
+  f[1] = MGI_CMD_GET, f[2] = MGI_PROP_NCP_VERSION;
+  mg_rw612_request(f, 3, MGI_RSP_TIMEOUT_MS);
+  MG_INFO(("RCP: %s", s->version));
+  if (!mg_rw612_set(MGI_PROP_PHY_ENABLED, &one, 1)) {
+    return mg_rw612_fail("PHY enable failed");
+  }
+  pan[0] = (uint8_t) d->pan_id, pan[1] = (uint8_t) (d->pan_id >> 8);
+  if (!mg_rw612_set(MGI_PROP_PHY_CHAN, &d->channel, 1) ||
+      !mg_rw612_set(MGI_PROP_PANID, pan, 2)) {
+    return mg_rw612_fail("Channel or PAN ID set failed");
+  }
+  if (!mg_rw612_set(MGI_PROP_RAW_STREAM, &one, 1)) {
+    return mg_rw612_fail("Raw stream enable failed");
+  }
+  return true;
+}
+
+// Send one radio frame: MAC header and payload, no FCS
+static size_t mg_rw612_send(const uint8_t *p, size_t len,
+                            struct mg_tcpip_if *ifp) {
+  struct mg_l2_802154_data *d =
+      (struct mg_l2_802154_data *) ifp->driver_data;
+  uint8_t f[3 + 2 + 127 + 4];
+  size_t n = 3;
+  f[1] = MGI_CMD_SET, f[2] = MGI_PROP_STREAM_RAW;
+  f[n++] = (uint8_t) (len + 2), f[n++] = 0;  // PSDU length, incl. FCS
+  memcpy(f + n, p, len), n += len;
+  f[n++] = 0, f[n++] = 0;  // FCS, filled in by the radio
+  f[n++] = d->channel;
+  f[n++] = 4;  // Max CSMA backoffs
+  f[n++] = 0;  // Max frame retries: broadcast frames are not acknowledged
+  f[n++] = 1;  // CSMA-CA enabled
+  if (!mg_rw612_request(f, n, MGI_TX_TIMEOUT_MS)) {
+    MG_ERROR(("TX timeout"));
+    return 0;
+  }
+  if (s_rw612.rsp_status != 0) {
+    MG_VERBOSE(("TX failed, status %lu", (unsigned long) s_rw612.rsp_status));
+    return 0;
+  }
+  return len;
+}
+
+static size_t mg_rw612_154_tx(const void *buf, size_t len,
+                              struct mg_tcpip_if *ifp) {
+  return mg_l2_802154_tx(ifp, buf, len, mg_rw612_send);
+}
+
+static size_t mg_rw612_154_rx(void *buf, size_t len, struct mg_tcpip_if *ifp) {
+  struct mg_rw612 *s = &s_rw612;
+  size_t res = 0;
+  mg_rw612_poll_imu();
+  while (s->rxtail != s->rxhead && res == 0) {
+    res = mg_l2_802154_rx(ifp, s->rxq[s->rxtail], s->rxlen[s->rxtail], buf,
+                          len);
+    s->rxtail = (uint8_t) ((s->rxtail + 1) % MGI_RXQ_CNT);
+  }
+  return res;
+}
+
+static bool mg_rw612_154_poll(struct mg_tcpip_if *ifp, bool s1) {
+  (void) ifp, (void) s1;
+  return s_rw612.up;
+}
+
+struct mg_tcpip_driver mg_tcpip_driver_rw612_154 = {
+    mg_rw612_154_init, mg_rw612_154_tx, mg_rw612_154_rx, mg_rw612_154_poll};
+
+#endif

src/drivers/rw612_154.h

@@ -0,0 +1,29 @@
+#pragma once
+
+#if MG_ENABLE_TCPIP && defined(MG_ENABLE_DRIVER_RW612_154) && \
+    MG_ENABLE_DRIVER_RW612_154
+
+// NXP RW612 IEEE 802.15.4 radio, as an Ethernet interface: Ethernet frames
+// are split into radio frames, see mg_l2_802154_tx(). The radio runs on
+// CPU2: NXP BLE/802.15.4 combo firmware, an OpenThread radio co-processor
+// (RCP). The firmware must be loaded and running before mg_tcpip_init(), see
+// the FRDM-RW612 eth_radio_bridge tutorial. The driver talks to it over the
+// CPU2 <-> CPU3 IMU mailbox: IMUMC messages carrying HDLC framed Spinel.
+// driver_data: struct mg_l2_802154_data, channel and PAN ID set
+
+#ifndef MG_TCPIP_DRIVER_INIT
+#define MG_TCPIP_DRIVER_INIT(mgr)                                       \
+  do {                                                                  \
+    static struct mg_l2_802154_data driver_data_;                     \
+    static struct mg_tcpip_if mif_;                                     \
+    driver_data_.channel = MG_L2_802154_CHANNEL;                      \
+    driver_data_.pan_id = MG_L2_802154_PAN_ID;                        \
+    mif_.driver = &mg_tcpip_driver_rw612_154;                           \
+    mif_.driver_data = &driver_data_;                                   \
+    MG_SET_MAC_ADDRESS(mif_.mac);                                       \
+    mg_tcpip_init(mgr, &mif_);                                          \
+    MG_INFO(("Driver: rw612_154, channel %d", MG_L2_802154_CHANNEL)); \
+  } while (0)
+#endif
+
+#endif

src/drivers/st67w6.c

@@ -365,7 +365,7 @@ static bool st67w6_init(uint8_t *mac) {
   }
   // set clock, who cares ???
   if (!st67w6_at_cmd("AT+GET_CLOCK\r\n", 14)) return false;
-  MG_DEBUG(("%.*s", s_at_resp_len, at_resp));  // TODO(scaprile): --> VERBOSE
+  MG_VERBOSE(("%.*s", s_at_resp_len, at_resp));
   // BT-ENABLED DEPENDENCY
 
   // MODULE DEPENDENCY

src/drivers/stm32h.c

@@ -2,6 +2,7 @@
 
 #if MG_ENABLE_TCPIP && (MG_ENABLE_DRIVER_STM32H || MG_ENABLE_DRIVER_MCXN || \
                         MG_ENABLE_DRIVER_STM32N)
+// STM32C: vendor modded single-queue Synopsys v5.4, same settings as STM32H
 // STM32H: vendor modded single-queue Synopsys v4.2
 // STM32N: dual-queue GbE Synopsys v5.2 with no hash table option, 64-bit AXI
 // MCXNx4x: dual-queue Synopsys v5.2 with no hash table option
@@ -310,7 +311,7 @@ static uint32_t s_rxno;
 #if MG_ENABLE_DRIVER_MCXN
 void ETHERNET_IRQHandler(void);
 void ETHERNET_IRQHandler(void) {
-#elif MG_ENABLE_DRIVER_STM32H
+#elif MG_ENABLE_DRIVER_STM32H && !MG_ENABLE_DRIVER_STM32C
 void ETH_IRQHandler(void);
 void ETH_IRQHandler(void) {
 #else
@@ -339,8 +340,10 @@ void ETH1_IRQHandler(void) {
   }
   ETH->DMACSR =
       MG_BIT(7) | MG_BIT(8);  // Clear possible RBU RPS while processing
-  ETH->DMACRDTPR =
-      (uint32_t) (uintptr_t) &s_rxdesc[ETH_DESC_CNT - 1];  // and resume RX
+  // Resume RX: tail is the last descriptor given back to DMA. It must differ
+  // from the DMA current descriptor, or some DMAs, e.g. STM32C5, stay suspended
+  ETH->DMACRDTPR = (uint32_t) (uintptr_t) &s_rxdesc[(s_rxno + ETH_DESC_CNT - 1) %
+                                                    ETH_DESC_CNT];
 }
 
 struct mg_tcpip_driver mg_tcpip_driver_stm32h = {

src/drivers/stm32h.h

@@ -4,6 +4,13 @@
 #if !defined(MG_ENABLE_DRIVER_STM32H)
 #define MG_ENABLE_DRIVER_STM32H 0
 #endif
+#if !defined(MG_ENABLE_DRIVER_STM32C)
+#define MG_ENABLE_DRIVER_STM32C 0
+#endif
+#if MG_ENABLE_DRIVER_STM32C  // STM32C5: STM32H5 MAC, the IRQ is ETH1
+#undef MG_ENABLE_DRIVER_STM32H
+#define MG_ENABLE_DRIVER_STM32H 1
+#endif
 #if !defined(MG_ENABLE_DRIVER_MCXN)
 #define MG_ENABLE_DRIVER_MCXN 0
 #endif
@@ -43,9 +50,11 @@ struct mg_tcpip_driver_stm32h_data {
 #define MG_DRIVER_MDC_CR 4
 #endif
 
-#if MG_ENABLE_DRIVER_STM32H && MG_ARCH == MG_ARCH_CUBE && !defined(MG_ENABLE_ETH_IRQ)
+#if MG_ENABLE_DRIVER_STM32H && !MG_ENABLE_DRIVER_STM32C && \
+    MG_ARCH == MG_ARCH_CUBE && !defined(MG_ENABLE_ETH_IRQ)
 #define MG_ENABLE_ETH_IRQ() NVIC_EnableIRQ(ETH_IRQn)
-#elif MG_ENABLE_DRIVER_STM32N && MG_ARCH == MG_ARCH_CUBE && !defined(MG_ENABLE_ETH_IRQ)
+#elif (MG_ENABLE_DRIVER_STM32N || MG_ENABLE_DRIVER_STM32C) && \
+    MG_ARCH == MG_ARCH_CUBE && !defined(MG_ENABLE_ETH_IRQ)
 #define MG_ENABLE_ETH_IRQ() NVIC_EnableIRQ(ETH1_IRQn)
 #elif !defined(MG_ENABLE_ETH_IRQ)
 #define MG_ENABLE_ETH_IRQ()

src/flash.c

@@ -4,7 +4,7 @@
 #include "ota.h"
 #ifdef MG_OTA_PUBLIC_KEY
 #include "sha256.h"
-#include "tls_uecc.h"
+#include "tls_p256.h"
 #endif
 
 #if MG_OTA != MG_OTA_NONE && MG_OTA != MG_OTA_CUSTOM
@@ -37,6 +37,9 @@ bool mg_ota_flash_write(const void *buf, size_t len, struct mg_flash *flash) {
   bool ok = false;
   if (s_size == 0) {
     MG_ERROR(("OTA is not started, call mg_ota_begin()"));
+  } else if (s_addr + MG_ROUND_UP(len, flash->align) >
+             (char *) flash->start + flash->size) {
+    MG_ERROR(("Flash overflow: attempting to write past the flash boundary"));
   } else {
     size_t len_aligned_down = MG_ROUND_DOWN(len, flash->align);
     if (len_aligned_down) ok = flash->write_fn(s_addr, buf, len_aligned_down);
@@ -73,9 +76,8 @@ bool mg_ota_flash_end(struct mg_flash *flash) {
         uint8_t hash[32];
         size_t fw_size = s_size - 68;  // strip 64-byte sig + 4-byte magic
         mg_sha256(hash, (uint8_t *) base, fw_size);
-        ok = mg_uecc_verify(s_pubkey, hash, sizeof(hash),
-                            (uint8_t *) base + fw_size,
-                            mg_uecc_secp256r1()) == 1;
+        ok = mg_p256_verify(s_pubkey, hash, sizeof(hash),
+                            (uint8_t *) base + fw_size) == 1;
         MG_INFO(("Signature: %s", ok ? "ok" : "fail"));
       } else {
         ok = false;

src/fmt.c

@@ -173,6 +173,7 @@ size_t mg_vxprintf(void (*out)(char, void *), void *param, const char *fmt,
         is_long++, c = fmt[++i];
         if (c == 'l') is_long++, c = fmt[++i];
       }
+      if (c == 'z') is_long = 1, c = fmt[++i];
       if (c == 'p') x = 1, is_long = 1;
       if (c == 'd' || c == 'u' || c == 'x' || c == 'X' || c == 'p' ||
           c == 'g' || c == 'f') {

src/fmt.h

@@ -34,8 +34,8 @@ typedef size_t (*mg_pm_t)(mg_pfn_t fn, void *arg, va_list *);
 //   - mg_print_base64 - prints a buffer as a base64-encoded string
 //   - mg_print_esc - prints a JSON-escaped string
 //   - mg_print_hex - prints a buffer as a hex string
-//   - mg_print_ip - prints an IP address in a struct mg_str
-//   - mg_print_ip_port - prints IP address and port in a struct mg_str
+//   - mg_print_ip - prints an IP address in a struct mg_addr
+//   - mg_print_ip_port - prints IP address and port in a struct mg_addr
 //   - mg_print_ip4 - prints an IPv4 address
 //   - mg_print_ip6 - prints an IPv6 address
 //   - mg_print_mac - prints a MAC address

src/fs.c

@@ -1,4 +1,5 @@
 #include "fs.h"
+#include "log.h"
 #include "printf.h"
 #include "str.h"
 #include "util.h"
@@ -47,6 +48,7 @@ bool mg_file_write(struct mg_fs *fs, const char *path, const void *buf,
   char tmp[MG_PATH_MAX], rnd[10];
   size_t path_len = mg_snprintf(tmp, sizeof(tmp), "%s..%s", path,
                                 mg_random_str(rnd, sizeof(rnd)));
+  fs->rm(tmp);
   if (path_len < sizeof(tmp) &&
       (fd = mg_fs_open(fs, tmp, MG_FS_WRITE | MG_FS_EXCL)) != NULL) {
     result = fs->wr(fd->fd, buf, len) == len;
@@ -54,8 +56,11 @@ bool mg_file_write(struct mg_fs *fs, const char *path, const void *buf,
     if (result) {
       fs->rm(path);
       result = fs->mv(tmp, path);
+      MG_DEBUG(("mv %s -> %s result=%d", tmp, path, result));
     }
     fs->rm(tmp);
+  } else {
+    MG_ERROR(("mg_fs_open(%s) failed, path_len=%zu", tmp, path_len));
   }
   return result;
 }
@@ -67,8 +72,10 @@ bool mg_file_printf(struct mg_fs *fs, const char *path, const char *fmt, ...) {
   va_start(ap, fmt);
   data = mg_vmprintf(fmt, &ap);
   va_end(ap);
-  result = mg_file_write(fs, path, data, strlen(data));
-  mg_free(data);
+  if (data != NULL) {
+    result = mg_file_write(fs, path, data, strlen(data));
+    mg_free(data);
+  }
   return result;
 }
 

src/fs.h

@@ -2,6 +2,7 @@
 
 #include "arch.h"
 #include "config.h"
+#include "lfs.h"
 
 // Flags returned by mg_fs.st() and passed to mg_fs.open().
 enum { MG_FS_READ = 1, MG_FS_WRITE = 2, MG_FS_DIR = 4, MG_FS_EXCL = 8 };
@@ -40,6 +41,7 @@ void mg_fs_close(struct mg_fd *fd);
 
 // Sequential directory iterator. Call repeatedly with the same buf/len;
 // each call fills buf with the next entry name. Returns false when done.
+// Note: make sure buf[0] == 0 before the first call
 bool mg_fs_ls(struct mg_fs *fs, const char *path, char *buf, size_t len);
 
 // Reads the entire file into a heap-allocated buffer. The returned mg_str is

src/fs_fat.c

@@ -1,44 +1,19 @@
 #include "arch.h"
 #include "event.h"
 #include "fs.h"
+#include "util.h"
 
 #if MG_ENABLE_FATFS
 #include <ff.h>
 
-static int mg_days_from_epoch(int y, int m, int d) {
-  y -= m <= 2;
-  int era = y / 400;
-  int yoe = y - era * 400;
-  int doy = (153 * (m + (m > 2 ? -3 : 9)) + 2) / 5 + d - 1;
-  int doe = yoe * 365 + yoe / 4 - yoe / 100 + doy;
-  return era * 146097 + doe - 719468;
-}
-
-static time_t mg_timegm(const struct tm *t) {
-  int year = t->tm_year + 1900;
-  int month = t->tm_mon;  // 0-11
-  if (month > 11) {
-    year += month / 12;
-    month %= 12;
-  } else if (month < 0) {
-    int years_diff = (11 - month) / 12;
-    year -= years_diff;
-    month += 12 * years_diff;
-  }
-  int x = mg_days_from_epoch(year, month + 1, t->tm_mday);
-  return 60 * (60 * (24L * x + t->tm_hour) + t->tm_min) + t->tm_sec;
-}
-
 static time_t ff_time_to_epoch(uint16_t fdate, uint16_t ftime) {
-  struct tm tm;
-  memset(&tm, 0, sizeof(struct tm));
-  tm.tm_sec = (ftime << 1) & 0x3e;
-  tm.tm_min = ((ftime >> 5) & 0x3f);
-  tm.tm_hour = ((ftime >> 11) & 0x1f);
-  tm.tm_mday = (fdate & 0x1f);
-  tm.tm_mon = ((fdate >> 5) & 0x0f) - 1;
-  tm.tm_year = ((fdate >> 9) & 0x7f) + 80;
-  return mg_timegm(&tm);
+  unsigned int sec = (ftime << 1) & 0x3e;
+  unsigned int min = (ftime >> 5) & 0x3f;
+  unsigned int hour = (ftime >> 11) & 0x1f;
+  unsigned int day = fdate & 0x1f;
+  unsigned int month = (fdate >> 5) & 0x0f;
+  unsigned int year = ((fdate >> 9) & 0x7f) + 1980;
+  return (time_t) mg_timegm(year, month, day, hour, min, sec);
 }
 
 static int ff_stat(const char *path, size_t *size, time_t *mtime) {
@@ -75,9 +50,9 @@ static void *ff_open(const char *path, int flags) {
   if (flags & MG_FS_WRITE) {
     mode |= FA_WRITE;
     if (flags & MG_FS_EXCL) {
-      mode |= FA_OPEN_ALWAYS | FA_OPEN_APPEND;
-    } else {
       mode |= FA_CREATE_NEW;
+    } else {
+      mode |= FA_OPEN_ALWAYS | FA_OPEN_APPEND;
     }
   }
   if ((fp = mg_calloc(1, sizeof(*fp))) != NULL &&

src/fs_posix.c

@@ -10,6 +10,10 @@
 #define MG_STAT_FUNC stat
 #endif
 
+#if MG_ENABLE_LFS
+#include <dirent.h>
+#endif
+
 static int p_stat(const char *path, size_t *size, time_t *mtime) {
 #if !defined(S_ISDIR)
   MG_ERROR(("stat() API is not supported. %p %p %p", path, size, mtime));
@@ -161,7 +165,6 @@ struct dirent *readdir(DIR *d) {
 
 static void p_list(const char *dir, void (*fn)(const char *, void *),
                    void *userdata) {
-#if MG_ENABLE_DIRLIST
   struct dirent *dp;
   DIR *dirp;
   if ((dirp = (opendir(dir))) == NULL) return;
@@ -170,9 +173,6 @@ static void p_list(const char *dir, void (*fn)(const char *, void *),
     fn(dp->d_name, userdata);
   }
   closedir(dirp);
-#else
-  (void) dir, (void) fn, (void) userdata;
-#endif
 }
 
 static void *p_open(const char *path, int flags) {

src/health.c

@@ -0,0 +1,121 @@
+#include "config.h"
+#include "health.h"
+
+// The one health record. Lives in RAM that survives a warm reset, see
+// MG_HEALTH_RAM and the .mg_health region in the linker script
+struct mg_health mg_health_record MG_HEALTH_RAM;
+
+// STM32 H723 support. Needs the _estack symbol from the linker script
+#if MG_ENABLE_HEALTH && (defined(STM32H7_DEV_ID) || defined(STM32H5) || defined(STM32C5))
+// Fault handler body. Runs in exception context: no printf, no malloc, no
+// blocking calls. Copies the unwind registers and raw stack into the health
+// record, then resets.
+// "used" keeps the linker from garbage-collecting this section: the only
+// reference is the "b fault_c" branch in the naked handler below
+__attribute__((used, noinline)) static void fault_c(uint32_t *frame,
+                                                    uint32_t exc_return) {
+  extern uint32_t _estack;
+  uint32_t *stack = frame + 8 + ((exc_return & (1U << 4)) ? 0 : 18);
+  uint32_t *r = mg_health_record.data;
+
+  if (frame[7] & (1U << 9)) stack++;    // Eight-byte stack alignment padding
+  r[0] = (uint32_t) (uintptr_t) stack;  // SP
+  r[1] = frame[5];                      // LR
+  r[2] = frame[6];                      // PC
+  for (size_t i = 0; i < MG_HEALTH_DATA_SIZE - 3; i++) {  // Raw stack
+    r[3 + i] = stack + i < &_estack ? stack[i] : 0;
+  }
+  mg_health_record.cpuid = SCB->CPUID;
+  mg_health_record.reset_reason = MG_HEALTH_RESET_FAULT;
+  NVIC_SystemReset();
+}
+
+// Common fault entry. EXC_RETURN bit 2 tells which stack was in use:
+// 0 = MSP, 1 = PSP. Load the faulting SP into r0 and hand it to fault_c()
+__attribute__((naked)) void HardFault_Handler(void) {
+  __asm volatile(
+      "mov r1, lr\n\t"
+      "tst lr, #4\n\t"
+      "ite eq\n\t"
+      "mrseq r0, msp\n\t"
+      "mrsne r0, psp\n\t"
+      "b fault_c\n\t");
+}
+
+// Route the other fault types through the same entry point
+void MemManage_Handler(void) __attribute__((alias("HardFault_Handler")));
+void BusFault_Handler(void) __attribute__((alias("HardFault_Handler")));
+void UsageFault_Handler(void) __attribute__((alias("HardFault_Handler")));
+#endif
+
+// Start a new boot: validate the record, count the boot, store the reset
+// reason. The current boot moves to prev_* slots first, so the previous
+// boot's uptime and reason stay readable. Called by MG_HEALTH_INIT()
+void mg_health_init(void) {
+  char magic[] = MG_HEALTH_MAGIC;
+  // struct mg_health *h = mg_health_get();
+  if (!mg_health_valid()) {  // First boot, or RAM lost its contents
+    memset(&mg_health_record, 0, sizeof(mg_health_record));
+    memcpy(mg_health_record.magic, magic, sizeof(mg_health_record.magic));
+  }
+
+#if 0 && MG_ARCH == MG_ARCH_ESP32 && CONFIG_ESP_COREDUMP_ENABLE_TO_FLASH
+  {
+    // After a crash, copy the backtrace from the core dump in flash: the same
+    // addresses the panic handler prints as "Backtrace: PC:SP PC:SP ...".
+    // The core dump stays in flash, so check the reset reason, otherwise an
+    // old crash is reported on every boot
+    static esp_core_dump_summary_t s;  // Big on RISC-V, keep it off the stack
+    esp_reset_reason_t rr = esp_reset_reason();
+    uint32_t *out = mg_health_record.data;
+    size_t n = 0, max = MG_HEALTH_DATA_SIZE;
+    if (rr != ESP_RST_PANIC && rr != ESP_RST_INT_WDT && rr != ESP_RST_TASK_WDT)
+      return;  // Not a crash that went through the panic handler
+    if (max == 0 || esp_core_dump_get_summary(&s) != ESP_OK) return;
+
+    mg_health_record.cpuid = 42;  // ESP32
+    mg_health_record.reset_reason = MG_HEALTH_RESET_FAULT;
+
+    memset(out, 0, sizeof(mg_health_record.data));
+    out[n++] = s.exc_pc;
+#if CONFIG_IDF_TARGET_ARCH_XTENSA
+    for (uint32_t i = 0; i < s.exc_bt_info.depth && n < max; i++) {
+      if (s.exc_bt_info.bt[i] != s.exc_pc) out[n++] = s.exc_bt_info.bt[i];
+    }
+#elif CONFIG_IDF_TARGET_ARCH_RISCV
+    // No unwinder: take the return address, then words on the stack that
+    // point into executable memory (a heuristic, may include stale values)
+    if (n < max) out[n++] = s.ex_info.ra;
+    for (uint32_t i = 0; i + 4 <= s.exc_bt_info.dump_size && n < max; i += 4) {
+      uint32_t w;
+      memcpy(&w, &s.exc_bt_info.stackdump[i], sizeof(w));  // Byte array
+      if (esp_ptr_executable((void *) (uintptr_t) w)) out[n++] = w;
+    }
+#endif
+  }
+#endif
+}
+
+static size_t print_uint32(void (*fn)(char, void *), void *arg, va_list *ap) {
+  size_t n = va_arg(*ap, size_t);
+  uint32_t *p = va_arg(*ap, uint32_t *);
+  size_t len = 0;
+  while (n--) len += mg_xprintf(fn, arg, "%s%lu", len == 0 ? "" : ",", *p++);
+  return len;
+}
+
+size_t mg_print_crash_record(void (*fn)(char, void *), void *arg, va_list *ap) {
+  size_t len = 0;
+  if (mg_health_valid() &&
+      mg_health_record.reset_reason == MG_HEALTH_RESET_FAULT) {
+    size_t n = sizeof(mg_health_record.data) / sizeof(mg_health_record.data[0]);
+    len += mg_xprintf(fn, arg, "{%m:%hhu,%m:%u,%m:[%M]}",            //
+                      MG_ESC("version"), mg_health_record.magic[3],  //
+                      MG_ESC("cpuid"), mg_health_record.cpuid,       //
+                      MG_ESC("data"), print_uint32, n, mg_health_record.data);
+  } else {
+    len += mg_xprintf(fn, arg, "{}");
+  }
+  (void) ap;
+  return len;
+}

src/health.h

@@ -0,0 +1,81 @@
+// Device health monitoring
+
+#pragma once
+
+#include "arch.h"
+#include "printf.h"
+
+#ifndef MG_HEALTH_MAGIC
+#define MG_HEALTH_MAGIC {'M', 'G', 'H', '3'}  // '3' is the layout version
+#endif
+
+#if !defined(MG_HEALTH_RAM) && (defined(STM32H7_DEV_ID) || defined(STM32H5) || defined(STM32C5))
+#define MG_HEALTH_RAM __attribute__((section(".mg_health")))
+#endif
+
+#if !defined(MG_HEALTH_DATA_SIZE) && (defined(STM32H7_DEV_ID) || defined(STM32H5) || defined(STM32C5))
+#define MG_HEALTH_DATA_SIZE 250
+#endif
+
+#ifndef MG_HEALTH_DATA_SIZE
+#define MG_HEALTH_DATA_SIZE 10
+#endif
+
+// Places the record in RAM that survives a reset. Define in mongoose_config.h
+// to match the linker script, e.g. __attribute__((section(".mg_health")))
+#ifndef MG_HEALTH_RAM
+#define MG_HEALTH_RAM
+#endif
+
+// Why the device restarted. Hardware usually reports several flags at once,
+// so these are ordered by how much they tell you: the most specific cause a
+// device reports wins
+enum mg_health_reason {
+  MG_HEALTH_RESET_UNKNOWN = 0,  // Nothing reported, or no masks configured
+  MG_HEALTH_RESET_POWER,        // Power-on reset, RAM contents are lost
+  MG_HEALTH_RESET_BROWNOUT,     // Supply dipped below the brown-out level
+  MG_HEALTH_RESET_PIN,          // External reset pin, e.g. the reset button
+  MG_HEALTH_RESET_SOFTWARE,     // Firmware asked for it, e.g. NVIC_SystemReset
+  MG_HEALTH_RESET_LOWPOWER,     // Illegal or failed low-power transition
+  MG_HEALTH_RESET_WATCHDOG,     // Watchdog fired: the application stopped
+  MG_HEALTH_RESET_FAULT         // Fault handler ran, see regs[] and saved_stack
+};
+
+struct mg_health {
+  char magic[4];          // MG_HEALTH_MAGIC when the record holds valid data
+  uint32_t reset_reason;  // enum mg_health_reason that started this boot
+  uint32_t cpuid;         // ARM CPU ID
+  uint32_t data[MG_HEALTH_DATA_SIZE];
+};
+
+extern struct mg_health mg_health_record;  // Defined in health.c
+
+// Return true if the record holds valid data, i.e. it survived the reset and
+// was written by this firmware layout
+static inline bool mg_health_valid(void) {
+  static const char magic[] = MG_HEALTH_MAGIC;
+  return memcmp(mg_health_record.magic, magic,
+                sizeof(mg_health_record.magic)) == 0;
+}
+
+static inline int mg_health_reason(void) {
+  return mg_health_valid() ? (int) mg_health_record.reset_reason
+                           : MG_HEALTH_RESET_UNKNOWN;
+}
+
+static inline const char *mg_health_reason_str(int reason) {
+  switch (reason) {
+    case MG_HEALTH_RESET_POWER: return "power";
+    case MG_HEALTH_RESET_BROWNOUT: return "brownout";
+    case MG_HEALTH_RESET_PIN: return "pin";
+    case MG_HEALTH_RESET_SOFTWARE: return "software";
+    case MG_HEALTH_RESET_LOWPOWER: return "lowpower";
+    case MG_HEALTH_RESET_WATCHDOG: return "watchdog";
+    case MG_HEALTH_RESET_FAULT: return "fault";
+    default: return "unknown";
+  }
+}
+
+#define MG_HEALTH_INIT() mg_health_init()
+extern size_t mg_print_crash_record(mg_pfn_t, void *, va_list *);
+extern void mg_health_init(void);

src/http.c

@@ -3,7 +3,6 @@
 #include "fmt.h"
 #include "log.h"
 #include "net.h"
-#include "ota.h"
 #include "printf.h"
 #include "ssi.h"
 #include "util.h"
@@ -170,6 +169,7 @@ int mg_url_decode(const char *src, size_t src_len, char *dst, size_t dst_len,
         mg_str_to_num(mg_str_n(src + i + 1, 2), 16, &dst[j], sizeof(uint8_t));
         i += 2;
       } else {
+        dst[0] = '\0';
         return -1;
       }
     } else if (is_form_url_encoded && src[i] == '+') {
@@ -358,7 +358,7 @@ static void mg_http_vprintf_chunk(struct mg_connection *c, const char *fmt,
   if (c->send.len >= len + 10) {
     mg_snprintf((char *) c->send.buf + len, 9, "%08lx", c->send.len - len - 10);
     c->send.buf[len + 8] = '\r';
-    if (c->send.len == len + 10) c->is_resp = 0;  // Last chunk, reset marker
+    if (c->send.len == len + 10) c->pfn_data = NULL;  // Last chunk, done
   }
   if (!mg_send(c, "\r\n", 2)) mg_error(c, "OOM");
 }
@@ -373,7 +373,7 @@ void mg_http_printf_chunk(struct mg_connection *c, const char *fmt, ...) {
 void mg_http_write_chunk(struct mg_connection *c, const char *buf, size_t len) {
   mg_printf(c, "%lx\r\n", (unsigned long) len);
   if (!mg_send(c, buf, len) || !mg_send(c, "\r\n", 2)) mg_error(c, "OOM");
-  if (len == 0) c->is_resp = 0;
+  if (len == 0) c->pfn_data = NULL;  // Last chunk, response done
 }
 
 // clang-format off
@@ -462,15 +462,14 @@ void mg_http_reply(struct mg_connection *c, int code, const char *headers,
                            (unsigned long) (c->send.len - len));
     c->send.buf[len - 15 + n] = ' ';  // Change ending 0 to space
   }
-  c->is_resp = 0;
+  c->pfn_data = NULL;  // Response done
 }
 
 static void http_cb(struct mg_connection *, int, void *);
 static void restore_http_cb(struct mg_connection *c) {
   mg_fs_close((struct mg_fd *) c->pfn_data);
-  c->pfn_data = NULL;
+  c->pfn_data = NULL;  // Response done
   c->pfn = http_cb;
-  c->is_resp = 0;
 }
 
 char *mg_http_etag(char *buf, size_t len, size_t size, time_t mtime);
@@ -658,7 +657,7 @@ void mg_http_serve_file(struct mg_connection *c, struct mg_http_message *hm,
               etag, (uint64_t) cl, gzip ? "Content-Encoding: gzip\r\n" : "",
               range, hdrs);
     if (mg_strcasecmp(hm->method, mg_str("HEAD")) == 0 || c->is_closing) {
-      c->is_resp = 0;
+      c->pfn_data = NULL;  // Response done
       mg_fs_close(fd);
     } else {  // start serving static content only if not closing, see #3354
       // Track to-be-sent content length at the end of c->data, aligned
@@ -676,159 +675,97 @@ struct printdirentrydata {
   struct mg_http_message *hm;
   const struct mg_http_serve_opts *opts;
   const char *dir;
+  size_t count;
 };
 
-#if MG_ENABLE_DIRLIST
-// Print file name, escaping HTML chars
-static size_t html_esc(void (*fn)(char, void *), void *arg, va_list *ap) {
-  const char *s = va_arg(*ap, const char *);
-  size_t i, len = 0;
-  for (i = 0; s[i] != '\0'; i++) {
-    if (s[i] == '<') {
-      len += mg_xprintf(fn, arg, "%s", "&lt;");
-    } else if (s[i] == '>') {
-      len += mg_xprintf(fn, arg, "%s", "&gt;");
-    } else if (s[i] == '&') {
-      len += mg_xprintf(fn, arg, "%s", "&amp;");
-    } else {
-      len += mg_xprintf(fn, arg, "%c", s[i]);
-    }
-  }
-  return len;
-}
-
 static void printdirentry(const char *name, void *userdata) {
   struct printdirentrydata *d = (struct printdirentrydata *) userdata;
   struct mg_fs *fs = d->opts->fs == NULL ? &mg_fs_posix : d->opts->fs;
   size_t size = 0;
   time_t t = 0;
-  char path[MG_PATH_MAX], sz[40], mod[40];
-  int flags, n = 0;
+  char path[MG_PATH_MAX];
+  int flags;
 
-  // MG_DEBUG(("[%s] [%s]", d->dir, name));
-  if (mg_snprintf(path, sizeof(path), "%s%c%s", d->dir, '/', name) >
+  if (mg_snprintf(path, sizeof(path), "%s%c%s", d->dir, '/', name) >=
       sizeof(path)) {
     MG_ERROR(("%s truncated", name));
   } else if ((flags = fs->st(path, &size, &t)) == 0) {
     MG_ERROR(("%lu stat(%s)", d->c->id, path));
   } else {
-    const char *slash = flags & MG_FS_DIR ? "/" : "";
     if (flags & MG_FS_DIR) {
-      mg_snprintf(sz, sizeof(sz), "%s", "[DIR]");
+      mg_printf(d->c, "%s\n  {%m: %m, %m: true}", //
+                d->count == 0 ? "" : ",", //
+                MG_ESC("name"), MG_ESC(name), MG_ESC("dir"));
     } else {
-      mg_snprintf(sz, sizeof(sz), "%lld", (uint64_t) size);
+      mg_printf(d->c, "%s\n  {%m: %m, %m: %zu, %m: %llu, %m: false}", //
+                d->count == 0 ? "" : ",", //
+                MG_ESC("name"), MG_ESC(name), //
+                MG_ESC("size"), size, //
+                MG_ESC("modified"), (uint64_t) t, MG_ESC("dir"));
     }
-#if defined(MG_HTTP_DIRLIST_TIME_FMT)
-    {
-      char time_str[40];
-      struct tm *time_info = localtime(&t);
-      strftime(time_str, sizeof time_str, "%Y/%m/%d %H:%M:%S", time_info);
-      mg_snprintf(mod, sizeof(mod), "%s", time_str);
-    }
-#else
-    mg_snprintf(mod, sizeof(mod), "%lu", (unsigned long) t);
-#endif
-    n = (int) mg_url_encode(name, strlen(name), path, sizeof(path));
-    mg_printf(d->c,
-              "  <tr><td><a href=\"%.*s%s\">%M%s</a></td>"
-              "<td name=%lu>%s</td><td name=%lld>%s</td></tr>\n",
-              n, path, slash, html_esc, name, slash, (unsigned long) t, mod,
-              flags & MG_FS_DIR ? (int64_t) -1 : (int64_t) size, sz);
+    d->count++;
   }
 }
 
 static void listdir(struct mg_connection *c, struct mg_http_message *hm,
                     const struct mg_http_serve_opts *opts, char *dir) {
-  const char *sort_js_code =
-      "<script>function srt(tb, sc, so, d) {"
-      "var tr = Array.prototype.slice.call(tb.rows, 0),"
-      "tr = tr.sort(function (a, b) { var c1 = a.cells[sc], c2 = b.cells[sc],"
-      "n1 = c1.getAttribute('name'), n2 = c2.getAttribute('name'), "
-      "t1 = a.cells[2].getAttribute('name'), "
-      "t2 = b.cells[2].getAttribute('name'); "
-      "return so * (t1 < 0 && t2 >= 0 ? -1 : t2 < 0 && t1 >= 0 ? 1 : "
-      "n1 ? parseInt(n2) - parseInt(n1) : "
-      "c1.textContent.trim().localeCompare(c2.textContent.trim())); });";
-  const char *sort_js_code2 =
-      "for (var i = 0; i < tr.length; i++) tb.appendChild(tr[i]); "
-      "if (!d) window.location.hash = ('sc=' + sc + '&so=' + so); "
-      "};"
-      "window.onload = function() {"
-      "var tb = document.getElementById('tb');"
-      "var m = /sc=([012]).so=(1|-1)/.exec(window.location.hash) || [0, 2, 1];"
-      "var sc = m[1], so = m[2]; document.onclick = function(ev) { "
-      "var c = ev.target.rel; if (c) {if (c == sc) so *= -1; srt(tb, c, so); "
-      "sc = c; ev.preventDefault();}};"
-      "srt(tb, sc, so, true);"
-      "}"
-      "</script>";
   struct mg_fs *fs = opts->fs == NULL ? &mg_fs_posix : opts->fs;
-  struct printdirentrydata d = {c, hm, opts, dir};
-  char tmp[10], buf[MG_PATH_MAX];
+  struct printdirentrydata d = {c, hm, opts, dir, 0};
+  char tmp[10];
   size_t off, n;
-  int len = mg_url_decode(hm->uri.buf, hm->uri.len, buf, sizeof(buf), 0);
-  struct mg_str uri = len > 0 ? mg_str_n(buf, (size_t) len) : hm->uri;
-
   mg_printf(c,
-            "HTTP/1.1 200 OK\r\n"
-            "Content-Type: text/html; charset=utf-8\r\n"
-            "%s"
-            "Content-Length:         \r\n\r\n",
-            opts->extra_headers == NULL ? "" : opts->extra_headers);
+      "HTTP/1.1 200 OK\r\n"
+      "Content-Type: application/json; charset=utf-8\r\n"
+      "%s"
+      "Content-Length:         \r\n\r\n",
+      opts->extra_headers == NULL ? "" : opts->extra_headers);
   off = c->send.len;  // Start of body
-  mg_printf(c,
-            "<!DOCTYPE html><html><head><title>Index of %M</title>%s%s"
-            "<style>th,td {text-align: left; padding-right: 1em; "
-            "font-family: monospace; }</style></head>"
-            "<body><h1>Index of %M</h1><table cellpadding=\"0\"><thead>"
-            "<tr><th><a href=\"#\" rel=\"0\">Name</a></th><th>"
-            "<a href=\"#\" rel=\"1\">Modified</a></th>"
-            "<th><a href=\"#\" rel=\"2\">Size</a></th></tr>"
-            "<tr><td colspan=\"3\"><hr></td></tr>"
-            "</thead>"
-            "<tbody id=\"tb\">\n",
-            mg_print_html_esc, (int) uri.len, uri.buf, sort_js_code, sort_js_code2,
-            mg_print_html_esc, (int) uri.len, uri.buf);
-  mg_printf(c, "%s",
-            "  <tr><td><a href=\"..\">..</a></td>"
-            "<td name=-1></td><td name=-1>[DIR]</td></tr>\n");
+  mg_printf(c, "[");
   fs->ls(dir, printdirentry, &d);
-  mg_printf(c,
-            "</tbody><tfoot><tr><td colspan=\"3\"><hr></td></tr></tfoot>"
-            "</table><address>Mongoose v.%s</address></body></html>\n",
-            MG_VERSION);
+  mg_printf(c, "\n]\n");
   n = mg_snprintf(tmp, sizeof(tmp), "%lu", (unsigned long) (c->send.len - off));
   if (n > sizeof(tmp)) n = 0;
   memcpy(c->send.buf + off - 12, tmp, n);  // Set content length
-  c->is_resp = 0;                          // Mark response end
+  c->pfn_data = NULL;                      // Response done
+}
+
+// Map requested URI to the file path (buf,len). Use root directory r.
+// r could be a path optionally followed by map: PATH,/PREFIX1=PATH1,...
+static bool uri2path(const char *r, struct mg_str uri, char *buf, size_t len) {
+  struct mg_str k, v, part, s = mg_str(r), u = {NULL, 0}, d = u;
+  size_t n;
+  while (mg_span(s, &part, &s, ',')) {
+    if (!mg_span(part, &k, &v, '=')) k = part, v = mg_str_n(NULL, 0);
+    if (v.len == 0) v = k, k = mg_str("/"), u = k, d = v;
+    if (uri.len < k.len) continue;
+    if (mg_strcmp(k, mg_str_n(uri.buf, k.len)) != 0) continue;
+    u = k, d = v;
+  }
+  n = mg_snprintf(buf, len, "%.*s", (int) d.len, d.buf);
+  if (len == 0 || n + 2 >= len) return false;  // Path overflow
+  if (n > 0 && buf[n - 1] != '/') buf[n++] = '/', buf[n] = '\0';  // Add slash
+  if (mg_url_decode(uri.buf + u.len, uri.len - u.len, buf + n, len - n, 0) < 0) {
+    return false;
+  }
+  buf[len - 1] = '\0';  // Double-check
+  n = strlen(buf);
+  if (!mg_path_is_sane(mg_str_n(buf, n))) return false;
+  while (n > 1 && buf[n - 1] == '/') buf[--n] = 0;  // Trim trailing slashes
+  return true;
 }
-#endif
 
 // Resolve requested file into `path` and return its fs->st() result
-static int uri_to_path2(struct mg_connection *c, struct mg_http_message *hm,
-                        struct mg_fs *fs, struct mg_str url, struct mg_str dir,
-                        char *path, size_t path_size) {
+static int uri_to_file_status(struct mg_connection *c,
+                              struct mg_http_message *hm,
+                              struct mg_fs *fs, const char *root_dir,
+                              char *path, size_t path_size) {
   int flags, tmp;
-  // Append URI to the root_dir, and sanitize it
-  size_t n = mg_snprintf(path, path_size, "%.*s", (int) dir.len, dir.buf);
-  if (n + 2 >= path_size) {
-    mg_http_reply(c, 400, "", "Exceeded path size");
-    return -1;
-  }
-  path[path_size - 1] = '\0';
-  // Terminate root dir with slash
-  if (n > 0 && path[n - 1] != '/') path[n++] = '/', path[n] = '\0';
-  if (url.len < hm->uri.len) {
-    mg_url_decode(hm->uri.buf + url.len, hm->uri.len - url.len, path + n,
-                  path_size - n, 0);
-  }
-  path[path_size - 1] = '\0';  // Double-check
-  n = strlen(path);
-  if (!mg_path_is_sane(mg_str_n(path, n))) {
+  size_t n;
+  if (!uri2path(root_dir, hm->uri, path, path_size)) {
     mg_http_reply(c, 400, "", "Invalid path");
     return -1;
   }
-  while (n > 1 && path[n - 1] == '/') path[--n] = 0;  // Trim trailing slashes
+  n = strlen(path);
   flags = mg_strcmp(hm->uri, mg_str("/")) == 0 ? MG_FS_DIR
                                                : fs->st(path, NULL, NULL);
   MG_VERBOSE(("%lu %.*s -> %s %d", c->id, (int) hm->uri.len, hm->uri.buf, path,
@@ -843,7 +780,7 @@ static int uri_to_path2(struct mg_connection *c, struct mg_http_message *hm,
               "Content-Length: 0\r\n"
               "\r\n",
               (int) hm->uri.len, hm->uri.buf);
-    c->is_resp = 0;
+    c->pfn_data = NULL;  // Response done
     flags = -1;
   } else if (flags & MG_FS_DIR) {
     if (((mg_snprintf(path + n, path_size - n, "/" MG_HTTP_INDEX) > 0 &&
@@ -865,34 +802,36 @@ static int uri_to_path2(struct mg_connection *c, struct mg_http_message *hm,
   return flags;
 }
 
-static int uri_to_path(struct mg_connection *c, struct mg_http_message *hm,
-                       const struct mg_http_serve_opts *opts, char *path,
-                       size_t path_size) {
-  struct mg_fs *fs = opts->fs == NULL ? &mg_fs_posix : opts->fs;
-  struct mg_str k, v, part, s = mg_str(opts->root_dir), u = {NULL, 0}, p = u;
-  while (mg_span(s, &part, &s, ',')) {
-    if (!mg_span(part, &k, &v, '=')) k = part, v = mg_str_n(NULL, 0);
-    if (v.len == 0) v = k, k = mg_str("/"), u = k, p = v;
-    if (hm->uri.len < k.len) continue;
-    if (mg_strcmp(k, mg_str_n(hm->uri.buf, k.len)) != 0) continue;
-    u = k, p = v;
-  }
-  return uri_to_path2(c, hm, fs, u, p, path, path_size);
-}
-
 void mg_http_serve_dir(struct mg_connection *c, struct mg_http_message *hm,
                        const struct mg_http_serve_opts *opts) {
   char path[MG_PATH_MAX];
+  struct mg_fs *fs = opts->fs == NULL ? &mg_fs_posix : opts->fs;
   const char *sp = opts->ssi_pattern;
-  int flags = uri_to_path(c, hm, opts, path, sizeof(path));
+  int flags = uri_to_file_status(c, hm, fs, opts->root_dir, path, sizeof(path));
   if (flags < 0) {
-    // Do nothing: the response has already been sent by uri_to_path()
+    // Do nothing: the response has already been sent by uri_to_file_status()
   } else if (flags & MG_FS_DIR) {
-#if MG_ENABLE_DIRLIST
-    listdir(c, hm, opts, path);
-#else
-    mg_http_reply(c, 403, "", "Forbidden\n");
-#endif
+    if (opts->enable_dir_listing) {
+      listdir(c, hm, opts, path);
+    } else {
+      mg_http_reply(c, 403, "", "Forbidden\n");
+    }
+  } else if (opts->enable_delete &&
+            mg_strcasecmp(hm->method, mg_str("DELETE")) == 0) {
+    mg_http_reply(c, flags && fs->rm(path) ? 200 : 404, "", "");
+  } else if (opts->enable_upload &&
+            (mg_strcasecmp(hm->method, mg_str("POST")) == 0 ||
+             mg_strcasecmp(hm->method, mg_str("PUT")) == 0)) {
+    // Small or already fully buffered body. mg_http_serve_upload() handles
+    // the same thing without buffering, for big uploads, from MG_EV_HTTP_HDRS
+    void *fd;
+    bool ok = false;
+    fs->rm(path);  // MG_FS_WRITE appends, not truncates: drop any old file
+    if ((fd = fs->op(path, MG_FS_WRITE)) != NULL) {
+      ok = fs->wr(fd, hm->body.buf, hm->body.len) == hm->body.len;
+      fs->cl(fd);
+    }
+    mg_http_reply(c, ok ? 200 : 500, "", "");
   } else if (flags && sp != NULL && mg_match(mg_str(path), mg_str(sp), NULL)) {
     mg_http_serve_ssi(c, opts->root_dir, path);
   } else {
@@ -900,6 +839,52 @@ void mg_http_serve_dir(struct mg_connection *c, struct mg_http_message *hm,
   }
 }
 
+// mg_http_stream_body() callback for mg_http_serve_upload(). The file is
+// opened by the caller before streaming starts, so this only writes and closes
+static bool serve_upload_cb(struct mg_http_message *hm, struct mg_str *data,
+                            void **p) {
+  struct mg_fd *fd = (struct mg_fd *) *p;
+  if (hm != NULL) return fd != NULL;  // Start
+  if (data != NULL) {                 // Next chunk
+    return fd != NULL && fd->fs->wr(fd->fd, data->buf, data->len) == data->len;
+  }
+  if (fd != NULL) mg_fs_close(fd);  // End
+  *p = NULL;
+  return true;
+}
+
+// Starts a streaming upload for a big POST/PUT body, so it never sits fully
+// buffered in memory. Companion to mg_http_serve_dir(): call this from
+// MG_EV_HTTP_HDRS, and keep calling mg_http_serve_dir() from MG_EV_HTTP_MSG
+// as before - it handles uploads too, for bodies this function skips.
+// Does nothing unless opts->enable_upload is set, the method is POST or PUT,
+// and Content-Length is known and >= 2 * MG_IO_SIZE.
+void mg_http_serve_upload(struct mg_connection *c, struct mg_http_message *hm,
+                          const struct mg_http_serve_opts *opts) {
+  char path[MG_PATH_MAX];
+  struct mg_fs *fs = opts->fs == NULL ? &mg_fs_posix : opts->fs;
+  if (!opts->enable_upload) {
+    // Not enabled, nothing to do
+  } else if (mg_strcasecmp(hm->method, mg_str("POST")) != 0 &&
+            mg_strcasecmp(hm->method, mg_str("PUT")) != 0) {
+    // Not an upload request, nothing to do
+  } else if (hm->body.len == (size_t) ~0 || hm->body.len < 2 * MG_IO_SIZE) {
+    // Unknown length, or small enough for mg_http_serve_dir() to buffer it
+  } else if (!uri2path(opts->root_dir, hm->uri, path, sizeof(path))) {
+    MG_ERROR(("Invalid upload path: %.*s", (int) hm->uri.len, hm->uri.buf));
+  } else if (fs->st(path, NULL, NULL) & MG_FS_DIR) {
+    // Target is a directory, let mg_http_serve_dir() list it
+  } else {
+    struct mg_fd *fd;
+    fs->rm(path);  // MG_FS_WRITE appends, not truncates: drop any old file
+    if ((fd = mg_fs_open(fs, path, MG_FS_WRITE)) == NULL) {
+      MG_ERROR(("Cannot open %s for upload", path));
+    } else {
+      mg_http_stream_body(c, hm, serve_upload_cb, fd);
+    }
+  }
+}
+
 static bool mg_is_url_safe(int c) {
   return (c >= '0' && c <= '9') || (c >= 'a' && c <= 'z') ||
          (c >= 'A' && c <= 'Z') || c == '.' || c == '_' || c == '-' || c == '~';
@@ -972,8 +957,14 @@ long mg_http_upload(struct mg_connection *c, struct mg_http_message *hm,
                     struct mg_fs *fs, const char *dir, size_t max_size) {
   char buf[20] = "0", file[MG_PATH_MAX], path[MG_PATH_MAX];
   long res = 0, offset;
-  mg_http_get_var(&hm->query, "offset", buf, sizeof(buf));
-  mg_http_get_var(&hm->query, "file", file, sizeof(file));
+  if (mg_http_get_var(&hm->query, "offset", buf, sizeof(buf)) == -3) {
+    mg_http_reply(c, 400, "", "invalid offset");
+    return -3;
+  }
+  if (mg_http_get_var(&hm->query, "file", file, sizeof(file)) == -3) {
+    mg_http_reply(c, 400, "", "invalid file");
+    return -2;
+  }
   offset = strtol(buf, NULL, 0);
   mg_snprintf(path, sizeof(path), "%s%c%s", dir, MG_DIRSEP, file);
   if (hm->body.len == 0) {
@@ -1016,96 +1007,106 @@ int mg_http_status(const struct mg_http_message *hm) {
   return atoi(hm->uri.buf);
 }
 
-struct mg_upload_priv {
-  size_t expected;
-  size_t received;
-  struct mg_fd *fd;  // non-NULL: file upload; NULL: OTA
-  void (*fn)(struct mg_connection *, const char *);
+// State of a streamed request or response body, kept in c->data. The callback
+// is kept in c->fn_data, which is free because we own the connection
+struct mg_upload_state {
+  size_t expected;  // Number of body bytes to receive
+  size_t received;  // Number of body bytes received so far
+  void *user_data;  // Passed to cb, free for cb to use
+  bool failed;      // Set when cb returned false
+  bool finished;    // End callback has been called
 };
 
-static void mg_upload_handler(struct mg_connection *c, int ev, void *ev_data) {
-  struct mg_upload_priv *p = (struct mg_upload_priv *) c->data;
-  if (p->fn == NULL) return;
-  if (ev == MG_EV_READ && c->recv.len > 0) {
-    size_t alignment = 512;
-    size_t left = p->expected > p->received ? p->expected - p->received : 0;
-    size_t aligned = c->recv.len < left ? MG_ROUND_DOWN(c->recv.len, alignment)
-                                        : c->recv.len;
-    bool ok = true;
-    if (aligned > 0) {
-      if (p->fd != NULL) {
-        ok = p->fd->fs->wr(p->fd->fd, c->recv.buf, aligned) == aligned;
-      } else {
-        ok = mg_ota_write(c->recv.buf, aligned);
-      }
-    }
-    p->received += aligned;
-    mg_iobuf_del(&c->recv, 0, aligned);
-    if (!ok) {
-      if (p->fd != NULL) { mg_fs_close(p->fd); p->fd = NULL; }
-      else mg_ota_end();
-      p->fn(c, "write error");
-      mg_free(c->pfn_data); c->pfn_data = NULL; p->fn = NULL;
-    } else if (p->received >= p->expected) {
-      const char *errmsg = NULL;
-      if (p->fd != NULL) { mg_fs_close(p->fd); p->fd = NULL; }
-      else if (!mg_ota_end()) errmsg = "OTA finalize failed";
-      p->fn(c, errmsg);
-      mg_free(c->pfn_data); c->pfn_data = NULL; p->fn = NULL;
-    }
-  } else if (ev == MG_EV_ERROR || ev == MG_EV_CLOSE) {
-    if (p->fd != NULL) { mg_fs_close(p->fd); p->fd = NULL; }
-    else mg_ota_end();
-    p->fn(c, ev == MG_EV_ERROR ? (const char *) ev_data : "connection closed");
-    mg_free(c->pfn_data); c->pfn_data = NULL; p->fn = NULL;
-  }
+// Event handler installed by mg_http_stream_body(). Feeds the body to the
+// callback, then replies (servers only). It does not restore the previous
+// handler: the connection is closed after the reply.
+static void mg_stream_handler(struct mg_connection *c, int ev, void *ev_data) {
+  struct mg_upload_state *us = (struct mg_upload_state *) c->data;
+  bool (*fn)(struct mg_http_message *, struct mg_str *, void **) =
+      (bool (*)(struct mg_http_message *, struct mg_str *, void **))
+      (ptrdiff_t) c->fn_data;
   (void) ev_data;
+  if (ev == MG_EV_CLOSE || ev == MG_EV_ERROR) {
+    if (!us->finished) {
+      // Connection dropped mid-upload. Let cb clean up, e.g. call mg_ota_end()
+      us->finished = true;  // MG_EV_ERROR is followed by MG_EV_CLOSE
+      fn(NULL, NULL, &us->user_data);
+    }
+  } else if (ev == MG_EV_READ && !c->is_draining && !us->finished) {
+    if (!us->failed && c->recv.len > 0 && us->received < us->expected) {
+      // Got some uploaded data. Feed by 512-byte aligned chunks, for OTA
+      size_t left = us->expected - us->received, r = c->recv.len;
+      size_t aligned = r < left ? MG_ROUND_DOWN(r, 512) : left;
+      struct mg_str data = mg_str_n((char *) c->recv.buf, aligned);
+      if (data.len > 0 && !us->failed) {
+        us->failed = !fn(NULL, &data, &us->user_data);
+      }
+      us->received += aligned;
+      mg_iobuf_del(&c->recv, 0, aligned);  // Shift the unprocessed tail
+    }
+    if (!us->finished && (us->failed || us->received >= us->expected)) {
+      // Finished upload. Always call cb, even after error, so it can clean up
+      us->finished = true;
+      us->failed |= !fn(NULL, NULL, &us->user_data);
+      if (c->is_client && us->failed) {
+        mg_error(c, "Body streaming failed");
+      } else if (!c->is_client) {
+        mg_http_reply(c, us->failed ? 500 : 200, NULL, "%zu %s\n",
+                      us->received, us->failed ? "fail" : "ok");
+      }
+      c->is_draining = 1;
+    }
+  }
 }
 
-static void mg_upload_default_cb(struct mg_connection *c, const char *status) {
-  MG_INFO(("%lu %s", c->id, status ? status : "ok"));
-  mg_http_reply(c, status ? 500 : 200, "", "%s\n", status ? status : "ok");
-}
+void mg_http_stream_body(struct mg_connection *c, struct mg_http_message *hm,
+                         bool (*cb)(struct mg_http_message *, struct mg_str *,
+                                    void **),
+                         void *user_data) {
+  struct mg_upload_state *us = (struct mg_upload_state *) c->data;
+  int code = 0;
+  size_t head_len = hm->head.len;
 
-void mg_http_start_upload(struct mg_connection *c, struct mg_http_message *hm,
-                          struct mg_str name, struct mg_str dir,
-                          struct mg_fs *fs,
-                          void (*fn)(struct mg_connection *, const char *)) {
-  struct mg_upload_priv *p = (struct mg_upload_priv *) c->data;
-  char path[MG_PATH_MAX];
-  struct mg_fd *fd;
-  if (fn == NULL) fn = mg_upload_default_cb;
-  if (sizeof(*p) > sizeof(c->data)) { fn(c, "data too small"); return; }
-  if (!mg_path_is_sane(name)) { fn(c, "bad name"); return; }
-  mg_snprintf(path, sizeof(path), "%.*s%c%.*s", (int) dir.len, dir.buf,
-              MG_DIRSEP, (int) name.len, name.buf);
-  fd = mg_fs_open(fs, path, MG_FS_WRITE);
-  if (fd == NULL) { fn(c, "open failed"); return; }
-  p->expected = hm->body.len;
-  p->received = 0;
-  p->fd = fd;
-  p->fn = fn;
-  c->fn = mg_upload_handler;
-  c->pfn_data = strdup(path);
-  c->pfn = NULL;
-  mg_iobuf_del(&c->recv, 0, hm->head.len);
-  mg_call(c, MG_EV_READ, &c->recv.len);
-}
-
-void mg_http_start_ota(struct mg_connection *c, struct mg_http_message *hm,
-                       void (*fn)(struct mg_connection *, const char *)) {
-  struct mg_upload_priv *p = (struct mg_upload_priv *) c->data;
-  if (fn == NULL) fn = mg_upload_default_cb;
-  if (sizeof(*p) > sizeof(c->data)) { fn(c, "data too small"); return; }
-  if (!mg_ota_begin(hm->body.len)) { fn(c, "ota begin failed"); return; }
-  p->expected = hm->body.len;
-  p->received = 0;
-  p->fd = NULL;
-  p->fn = fn;
-  c->fn = mg_upload_handler;
-  c->pfn = NULL;
-  mg_iobuf_del(&c->recv, 0, hm->head.len);
-  mg_call(c, MG_EV_READ, &c->recv.len);
+  // Catch upload requests early, without buffering whole body. Called on the
+  // MG_EV_HTTP_HDRS event: we've received all HTTP headers but not necessarily
+  // the full HTTP body
+  if (!c->is_client && mg_strcmp(hm->method, mg_str("POST")) != 0 &&
+      mg_strcmp(hm->method, mg_str("PUT")) != 0) {
+    code = 405;
+  } else if (mg_http_get_header(hm, "Transfer-Encoding") != NULL) {
+    code = 400;
+  } else if (hm->body.len == (size_t) ~0 ||
+             (!c->is_client && mg_http_get_header(hm, "Content-Length") == NULL)) {
+    code = 411;
+  } else if (sizeof(*us) > sizeof(c->data)) {
+    code = 500;
+  }
+  c->pfn = NULL;  // Take ownership even when validation fails
+  if (code != 0) {
+    c->fn = NULL;
+    c->fn_data = NULL;
+    mg_iobuf_del(&c->recv, 0, c->recv.len);
+    cb(NULL, NULL, &user_data);  // Release resources even if start was skipped
+    if (c->is_client) {
+      mg_error(c, "%s", mg_http_status_code_str(code));
+    } else {
+      mg_http_reply(c, code, code == 405 ? "Allow: POST, PUT\r\n" : NULL, "");
+    }
+    c->is_draining = 1;
+  } else {
+    memset(us, 0, sizeof(*us));
+    us->expected = hm->body.len;  // Store number of bytes we expect
+    us->user_data = user_data;
+    c->fn = mg_stream_handler;
+    c->fn_data = (void *) (ptrdiff_t) cb;
+    us->failed = !cb(hm, NULL, &us->user_data);  // Call before deleting headers
+    if (!c->is_client && !us->failed && !us->finished &&
+        mg_http_get_header(hm, "Expect") != NULL) {
+      mg_http_reply(c, 100, NULL, "");  // If curl expects, we continue
+    }
+    mg_iobuf_del(&c->recv, 0, head_len);  // Delete HTTP headers
+    mg_call(c, MG_EV_READ, &c->recv.len);  // Process the body bytes we have
+  }
 }
 
 static bool is_hex_digit(int c) {
@@ -1114,15 +1115,14 @@ static bool is_hex_digit(int c) {
 }
 
 static int skip_chunk(const char *buf, int len, int *pl, int *dl) {
-  int i = 0, n = 0;
+  int i = 0, n = 0;  // pass int to mg_str_to_num, treats as unsigned
   if (len < 3) return 0;
   while (i < len && is_hex_digit(buf[i])) i++;
-  if (i == 0) return -1;                     // Error, no length specified
-  if (i > (int) sizeof(int) * 2) return -1;  // Chunk length is too big
+  if (i == 0) return -1;  // Error, no length specified
   if (len < i + 2 || buf[i] != '\r' || buf[i + 1] != '\n') return -1;  // Error
-  if (mg_str_to_num(mg_str_n(buf, (size_t) i), 16, &n, sizeof(int)) == false)
+  if (mg_str_to_num(mg_str_n(buf, (size_t) i), 16, &n, sizeof(n)) == false)
     return -1;                    // Decode chunk length, overflow
-  if (n < 0) return -1;           // Error. TODO(): some checks now redundant
+  if (n < 0) return -1;           // Chunk length is too big <0 = >0x80000000
   if (n > len - i - 4) return 0;  // Chunk not yet fully buffered
   if (buf[i + n + 2] != '\r' || buf[i + n + 3] != '\n') return -1;  // Error
   *pl = i + 2, *dl = n;
@@ -1135,7 +1135,9 @@ static void http_cb(struct mg_connection *c, int ev, void *ev_data) {
        c->recv.len > 0)) {  // see #2796
     struct mg_http_message hm;
     size_t ofs = 0;  // Parsing offset
-    while (c->is_resp == 0 && ofs < c->recv.len) {
+    // c->pfn_data is the "response generation in progress" marker. While it
+    // is set, don't parse the next pipelined request, to keep responses in order
+    while (c->pfn_data == NULL && ofs < c->recv.len) {
       const char *buf = (char *) c->recv.buf + ofs;
       int n = mg_http_parse(buf, c->recv.len - ofs, &hm);
       struct mg_str *te;  // Transfer - encoding header
@@ -1184,8 +1186,9 @@ static void http_cb(struct mg_connection *c, int ev, void *ev_data) {
           // contain a Content-length header (unless the body length is 0, in
           // which case it can be omitted). Other requests can also contain a
           // body, but their content has no defined semantics (RFC 7231)
+          // It is a non-chunked request, so the offset (ofs) is updated after
+          // exiting this branch.
           if (hm.body.len != 0) require_content_len = true;
-          ofs += (size_t) n;  // this request has been processed
         } else if (is_response) {
           // HTTP spec 7.2 Entity body: All other responses must include a body
           // or Content-Length header field defined with a value of 0.
@@ -1227,9 +1230,9 @@ static void http_cb(struct mg_connection *c, int ev, void *ev_data) {
         ofs += (size_t) n + hm.body.len;
       }
 
-      if (c->is_accepted) c->is_resp = 1;  // Start generating response
-      mg_call(c, MG_EV_HTTP_MSG, &hm);     // User handler can clear is_resp
-      if (c->is_accepted && !c->is_resp) {
+      if (c->is_accepted) c->pfn_data = c;  // Response started
+      mg_call(c, MG_EV_HTTP_MSG, &hm);  // Handler sets pfn_data NULL when done
+      if (c->is_accepted && c->pfn_data == NULL) {
         struct mg_str *cc = mg_http_get_header(&hm, "Connection");
         if (cc != NULL && mg_strcasecmp(*cc, mg_str("close")) == 0) {
           c->is_draining = 1;  // honor "Connection: close"

src/http.h

@@ -32,6 +32,9 @@ struct mg_http_serve_opts {
   const char *mime_types;     // Additional MIME types: "ext1=type1,ext2=type2". NULL for defaults only
   const char *page404;        // Path to a custom 404 page, e.g. "/404.html". NULL for built-in
   struct mg_fs *fs;           // Filesystem to use. NULL defaults to POSIX
+  bool enable_delete;         // Allow to DELETE files
+  bool enable_upload;         // Allow to POST/PUT files
+  bool enable_dir_listing;    // Enable directory listing
 };
 
 // A single part of a multipart/form-data body, filled by mg_http_next_multipart().
@@ -105,8 +108,11 @@ struct mg_connection *mg_http_connect(struct mg_mgr *, const char *url,
 //   mg_http_listen(), mg_http_serve_file(), mg_http_reply(), mg_match()
 // Notes:
 //   Call from an MG_EV_HTTP_MSG handler. The uri in hm is mapped under
-//   opts->root_dir. Directory listing depends on MG_ENABLE_DIRLIST; SSI uses
-//   opts->ssi_pattern when configured.
+//   opts->root_dir. opts->enable_dir_listing enables directory listing; SSI
+//   uses opts->ssi_pattern when configured. opts->enable_delete enables
+//   DELETE; opts->enable_upload enables POST/PUT, writing the whole body to
+//   a file - see mg_http_serve_upload() to also stream big uploads without
+//   buffering.
 void mg_http_serve_dir(struct mg_connection *, struct mg_http_message *hm,
                        const struct mg_http_serve_opts *);
 
@@ -114,6 +120,15 @@ void mg_http_serve_dir(struct mg_connection *, struct mg_http_message *hm,
 void mg_http_serve_file(struct mg_connection *, struct mg_http_message *hm,
                         const char *path, const struct mg_http_serve_opts *);
 
+// Streams a big POST/PUT upload straight to a file, instead of buffering the
+// whole body. Optional companion to mg_http_serve_dir(): call this from
+// MG_EV_HTTP_HDRS with the same opts, and keep calling mg_http_serve_dir()
+// from MG_EV_HTTP_MSG as usual - it still handles uploads this function skips.
+// Does nothing unless opts->enable_upload is set, the method is POST or PUT,
+// and Content-Length is known and big enough.
+void mg_http_serve_upload(struct mg_connection *, struct mg_http_message *hm,
+                          const struct mg_http_serve_opts *);
+
 // Sends a complete HTTP response with Content-Length.
 //
 // Example:
@@ -160,20 +175,6 @@ void mg_http_creds(struct mg_http_message *, char *, size_t, char *, size_t);
 long mg_http_upload(struct mg_connection *c, struct mg_http_message *hm,
                     struct mg_fs *fs, const char *dir, size_t max_size);
 
-// Streams the raw request body into dir/name via fs. Non-blocking: installs an
-// internal handler and returns immediately. fn is called with NULL on success
-// or an error string on failure.
-void mg_http_start_upload(struct mg_connection *c, struct mg_http_message *hm,
-                          struct mg_str name, struct mg_str dir,
-                          struct mg_fs *fs,
-                          void (*fn)(struct mg_connection *, const char *));
-
-// Starts an OTA firmware update from an HTTP POST upload.
-// Calls mg_ota_begin/write/end internally; fn is called with NULL on success,
-// or an error string on failure.
-void mg_http_start_ota(struct mg_connection *c, struct mg_http_message *hm,
-                       void (*fn)(struct mg_connection *, const char *));
-
 // Sends a 401 Unauthorized response with a Basic Auth WWW-Authenticate challenge.
 void mg_http_bauth(struct mg_connection *, const char *user, const char *pass);
 
@@ -192,7 +193,7 @@ struct mg_str mg_http_get_header_var(struct mg_str s, struct mg_str v);
 // Full examples:
 //   tutorials/http/file-upload-html-form, tutorials/http/http-server
 // Related APIs:
-//   mg_http_listen(), mg_http_start_upload()
+//   mg_http_listen(), mg_http_stream_body()
 // Notes:
 //   Call from an MG_EV_HTTP_MSG handler after the full request body is
 //   received. part.name, part.filename, and part.body are zero-copy slices into
@@ -201,3 +202,35 @@ size_t mg_http_next_multipart(struct mg_str, size_t, struct mg_http_part *);
 
 // Returns the HTTP status code from a parsed response message (e.g. 200, 404).
 int mg_http_status(const struct mg_http_message *hm);
+
+// Streams a POST/PUT body to a callback as it arrives, without buffering it.
+// Call it from an MG_EV_HTTP_HDRS handler, after matching the request, e.g.
+// with mg_match(). Always takes over the connection. Invalid requests receive
+// an HTTP error; client-side failures call mg_error(). Replies and connection
+// draining are handled internally, including callback failures.
+//
+// Callback upload_fn(hm, data, user_data) is called:
+//   - at start: hm is set. Open the file, set *user_data.
+//   - per chunk: data is set, 512 byte aligned except the last. Not called
+//     again after a failure.
+//   - at end: both NULL. Always called exactly once, including validation
+//     failures before start and connections that drop early. Release resources
+//     here. A truncated body looks like a complete one: validate before
+//     committing.
+// The callback returns true on success, false on error. A failure stops
+// streaming immediately and calls the end callback before closing.
+// Example:
+//   if (ev == MG_EV_HTTP_HDRS && mg_match(hm->uri, mg_str("/fs/*"), NULL)) {
+//     mg_http_stream_body(c, hm, upload, NULL);
+//   }
+// Full example:
+//   tutorials/http/file-upload-single-post
+// Related APIs:
+//   mg_http_listen(), mg_http_next_multipart()
+// Notes:
+//   The existing event handler is no longer called. hm is invalid after this
+//   call; c->data and c->fn_data are reserved for streaming state.
+void mg_http_stream_body(struct mg_connection *c, struct mg_http_message *hm,
+                         bool (*upload_fn)(struct mg_http_message *,
+                                           struct mg_str *, void **user_data),
+                         void *user_data);

src/json.c

@@ -363,15 +363,18 @@ char *mg_json_get_b64(struct mg_str json, const char *path, int *slen) {
 char *mg_json_get_hex(struct mg_str json, const char *path, int *slen) {
   char *result = NULL;
   int len = 0, off = mg_json_get(json, path, &len);
-  if (off >= 0 && json.buf[off] == '"' && len > 1 &&
+  if (off >= 0 && json.buf[off] == '"' && len > 1 && (len - 2) % 2 == 0 &&
       (result = (char *) mg_calloc(1, (size_t) len / 2)) != NULL) {
     int i;
     for (i = 0; i < len - 2; i += 2) {
-      mg_str_to_num(mg_str_n(json.buf + off + 1 + i, 2), 16, &result[i >> 1],
-                    sizeof(uint8_t));
+      if (!mg_str_to_num(mg_str_n(json.buf + off + 1 + i, 2), 16,
+                         &result[i >> 1], sizeof(uint8_t))) break;
+    }
+    if (i < len - 2) mg_free(result), result = NULL;
+    if (result != NULL) {
+      result[len / 2 - 1] = '\0';
+      if (slen != NULL) *slen = len / 2 - 1;
     }
-    result[len / 2 - 1] = '\0';
-    if (slen != NULL) *slen = len / 2 - 1;
   }
   return result;
 }

src/json.h

@@ -57,7 +57,7 @@ char *mg_json_get_str(struct mg_str json, const char *path);
 
 // Decodes a hex-encoded JSON string at path into a heap-allocated byte array.
 // Sets *len to the decoded byte count. Caller must mg_free() the result.
-// Returns NULL if not found or not a string.
+// Returns NULL if not found, not a string, or not valid hexadecimal.
 char *mg_json_get_hex(struct mg_str json, const char *path, int *len);
 
 // Decodes a base64-encoded JSON string at path into a heap-allocated byte

src/jwt.c

@@ -0,0 +1,138 @@
+#include "jwt.h"
+#include "base64.h"
+#include "json.h"
+#include "log.h"
+#include "printf.h"
+#include "sha256.h"
+#include "util.h"
+
+#if MG_TLS == MG_TLS_BUILTIN
+#include "tls_p256.h"
+#endif
+
+static size_t jwt_split(struct mg_str jwt, struct mg_str *h, struct mg_str *p,
+                        struct mg_str *s) {
+  size_t i, a = jwt.len, b = jwt.len;
+  for (i = 0; i < jwt.len; i++) {
+    if (jwt.buf[i] == '.') {
+      if (a == jwt.len) a = i;
+      if (a != i) b = i;
+      if (b != jwt.len) break;
+    }
+  }
+  if (a == jwt.len || b == jwt.len || b + 1 >= jwt.len) return 0;
+  *h = mg_str_n(jwt.buf, a);
+  *p = mg_str_n(jwt.buf + a + 1, b - a - 1);
+  *s = mg_str_n(jwt.buf + b + 1, jwt.len - b - 1);
+  return b;
+}
+
+static bool jwt_alg(struct mg_str h, const char *alg) {
+  char got[16];
+  size_t len = h.len * 3 / 4 + 2;
+  char *buf = (char *) mg_calloc(1, len);
+  bool ok;
+  if (buf == NULL) return false;
+  ok = mg_base64url_decode(h.buf, h.len, buf, len) > 0 &&
+       mg_json_unescape(mg_str(buf), "$.alg", got, sizeof(got)) > 0 &&
+       strcmp(got, alg) == 0;
+  mg_free(buf);
+  return ok;
+}
+
+static size_t jwt_header_payload(const char *alg, const struct mg_jwt_opts *opts,
+                                 char *buf, size_t len) {
+  char *header, *kid = NULL;
+  size_t n, m;
+  if (opts->kid.len > 0) {
+    kid = mg_mprintf(",%m:%m", MG_ESC("kid"), mg_print_esc,
+                     (int) opts->kid.len, opts->kid.buf);
+    if (kid == NULL) return 0;
+  }
+  header = mg_mprintf("{%m:%m,%m:%m%.*s%.*s%.*s}", MG_ESC("alg"),
+                      MG_ESC(alg), MG_ESC("typ"), MG_ESC("JWT"),
+                      kid == NULL ? 0 : (int) strlen(kid),
+                      kid == NULL ? "" : kid,
+                      opts->header.len > 0 ? 1 : 0, ",",
+                      (int) opts->header.len, opts->header.buf);
+  mg_free(kid);
+  if (header == NULL) return 0;
+  n = mg_base64url_encode((uint8_t *) header, strlen(header), buf, len);
+  mg_free(header);
+  if (n == 0 || n + 1 >= len) return 0;
+  buf[n++] = '.';
+  m = mg_base64url_encode((uint8_t *) opts->claims.buf, opts->claims.len,
+                          buf + n, len - n);
+  return m == 0 ? 0 : n + m;
+}
+
+size_t mg_jwt_sign_hs256(const struct mg_jwt_opts *opts, char *buf,
+                         size_t len) {
+  uint8_t sig[32];
+  size_t n = jwt_header_payload("HS256", opts, buf, len);
+  size_t m;
+  if (n == 0 || n + 1 >= len) return 0;
+  mg_hmac_sha256(sig, (uint8_t *) opts->secret.buf, opts->secret.len,
+                 (uint8_t *) buf, n);
+  buf[n++] = '.';
+  m = mg_base64url_encode(sig, sizeof(sig), buf + n, len - n);
+  return m == 0 ? 0 : n + m;
+}
+
+size_t mg_jwt_verify_hs256(struct mg_str jwt, const struct mg_jwt_opts *opts,
+                           char *buf, size_t len) {
+  struct mg_str h, p, s;
+  uint8_t sig[33], digest[32];
+  size_t n = jwt_split(jwt, &h, &p, &s);
+  if (n == 0 || !jwt_alg(h, "HS256")) return 0;
+  if (mg_base64url_decode(s.buf, s.len, (char *) sig, sizeof(sig)) !=
+      sizeof(digest))
+    return 0;
+  mg_hmac_sha256(digest, (uint8_t *) opts->secret.buf, opts->secret.len,
+                 (uint8_t *) jwt.buf, n);
+  if (!mg_memeq(sig, digest, sizeof(digest))) return 0;
+  return mg_base64url_decode(p.buf, p.len, buf, len);
+}
+
+#if MG_TLS == MG_TLS_BUILTIN
+size_t mg_jwt_sign_es256(const struct mg_jwt_opts *opts, char *buf,
+                         size_t len) {
+  uint8_t hash[32], sig[64];
+  size_t n = jwt_header_payload("ES256", opts, buf, len);
+  size_t m;
+  if (n == 0 || n + 1 >= len) return 0;
+  mg_sha256(hash, (uint8_t *) buf, n);
+  if (mg_p256_sign(opts->private_key, hash, sizeof(hash), sig) != 1)
+    return 0;
+  buf[n++] = '.';
+  m = mg_base64url_encode(sig, sizeof(sig), buf + n, len - n);
+  return m == 0 ? 0 : n + m;
+}
+
+size_t mg_jwt_verify_es256(struct mg_str jwt, const struct mg_jwt_opts *opts,
+                           char *buf, size_t len) {
+  struct mg_str h, p, s;
+  uint8_t sig[65], hash[32];
+  size_t n = jwt_split(jwt, &h, &p, &s);
+  if (n == 0 || !jwt_alg(h, "ES256")) return 0;
+  if (mg_base64url_decode(s.buf, s.len, (char *) sig, sizeof(sig)) != 64)
+    return 0;
+  mg_sha256(hash, (uint8_t *) jwt.buf, n);
+  if (mg_p256_verify(opts->public_key, hash, sizeof(hash), sig) != 1)
+    return 0;
+  return mg_base64url_decode(p.buf, p.len, buf, len);
+}
+#else
+size_t mg_jwt_sign_es256(const struct mg_jwt_opts *opts, char *buf,
+                         size_t len) {
+  (void) opts, (void) buf, (void) len;
+  MG_ERROR(("JWT ES256 requires built-in TLS"));
+  return 0;
+}
+
+size_t mg_jwt_verify_es256(struct mg_str jwt, const struct mg_jwt_opts *opts,
+                           char *buf, size_t len) {
+  (void) jwt, (void) opts, (void) buf, (void) len;
+  return mg_jwt_sign_es256(NULL, NULL, 0);
+}
+#endif

src/jwt.h

@@ -0,0 +1,27 @@
+#pragma once
+
+#include "arch.h"
+#include "str.h"
+#include "tls.h"
+
+struct mg_jwt_opts {
+  struct mg_str claims;  // JSON payload
+  struct mg_str header;  // Extra header members, no braces; alg/typ are set
+  struct mg_str kid;     // Key ID protected header
+  struct mg_str secret;  // HS256 secret
+  const uint8_t *private_key;  // ES256 private key (MG_TLS_BUILTIN only)
+  const uint8_t *public_key;   // ES256 public key (MG_TLS_BUILTIN only)
+};
+
+// Signs JSON claims as a compact JWT. Returns JWT length, or 0 on error.
+size_t mg_jwt_sign_hs256(const struct mg_jwt_opts *opts, char *buf,
+                         size_t len);
+
+// Verifies JWT and decodes JSON claims into buf. Returns claims length, or 0.
+size_t mg_jwt_verify_hs256(struct mg_str jwt, const struct mg_jwt_opts *opts,
+                           char *buf, size_t len);
+
+size_t mg_jwt_sign_es256(const struct mg_jwt_opts *opts, char *buf,
+                         size_t len);
+size_t mg_jwt_verify_es256(struct mg_str jwt, const struct mg_jwt_opts *opts,
+                           char *buf, size_t len);

src/l2.h

@@ -6,7 +6,7 @@
 #if MG_ENABLE_TCPIP
 
 // no config defaults to 0 => Ethernet
-enum mg_l2type { MG_TCPIP_L2_ETH = 0, MG_TCPIP_L2_PPP, MG_TCPIP_L2_PPPoE };
+enum mg_l2type { MG_TCPIP_L2_ETH = 0, MG_TCPIP_L2_PPP, MG_TCPIP_L2_PPPoE, MG_TCPIP_L2_USER };
 
 #if defined(__DCC__)
 #pragma pack(1)

src/l2_802154.c

@@ -0,0 +1,60 @@
+#include "l2.h"
+#include "net_builtin.h"
+
+#if MG_ENABLE_TCPIP
+
+// Radio frame: 802.15.4 MAC header, 15 bytes: data frame, PAN ID compression,
+// broadcast destination, our EUI-64 made from MAC as source. Then 2 bytes:
+// tag, fragment index << 4 | last fragment index. Then data. 125 bytes max,
+// 127 minus FCS
+#define MGI_802154_HDR 17
+#define MGI_802154_DATA (125 - MGI_802154_HDR)
+
+size_t mg_l2_802154_tx(struct mg_tcpip_if *ifp, const void *buf, size_t len,
+                       size_t (*send_fn)(const uint8_t *, size_t,
+                                      struct mg_tcpip_if *)) {
+  struct mg_l2_802154_data *d =
+      (struct mg_l2_802154_data *) ifp->driver_data;
+  const uint8_t *p = (const uint8_t *) buf, *m = ifp->mac;
+  uint8_t f[MGI_802154_HDR + MGI_802154_DATA];
+  size_t i, n, last = (len - 1) / MGI_802154_DATA;
+  if (len == 0 || last > 15) return 0;
+  d->tag++;
+  for (i = 0; i <= last; i++) {
+    n = i == last ? len - i * MGI_802154_DATA : MGI_802154_DATA;
+    f[0] = 0x41, f[1] = 0xd8, f[2] = d->seq++;  // 2006 frame, see above
+    f[3] = (uint8_t) d->pan_id, f[4] = (uint8_t) (d->pan_id >> 8);
+    f[5] = f[6] = 0xff;
+    f[7] = m[5], f[8] = m[4], f[9] = m[3], f[10] = 0xfe, f[11] = 0xff;
+    f[12] = m[2], f[13] = m[1], f[14] = m[0];  // Little endian EUI-64
+    f[15] = d->tag, f[16] = (uint8_t) ((i << 4) | last);
+    memcpy(f + MGI_802154_HDR, p + i * MGI_802154_DATA, n);
+    if (send_fn(f, MGI_802154_HDR + n, ifp) == 0) return 0;
+  }
+  return len;
+}
+
+size_t mg_l2_802154_rx(struct mg_tcpip_if *ifp, const uint8_t *f, size_t n,
+                       void *buf, size_t len) {
+  struct mg_l2_802154_data *d =
+      (struct mg_l2_802154_data *) ifp->driver_data;
+  size_t idx, last;
+  if (n <= MGI_802154_HDR || f[0] != 0x41 || f[1] != 0xd8 ||
+      f[3] != (uint8_t) d->pan_id || f[4] != (uint8_t) (d->pan_id >> 8))
+    return 0;  // Not ours
+  idx = f[16] >> 4, last = f[16] & 15;
+  if (idx == 0) d->rxtag = f[15], d->rxnext = 0, d->rxlen = 0;
+  if (idx == 0) memcpy(d->rxsrc, f + 7, sizeof(d->rxsrc));
+  n -= MGI_802154_HDR;
+  if (idx != d->rxnext || idx > last || f[15] != d->rxtag ||
+      memcmp(d->rxsrc, f + 7, sizeof(d->rxsrc)) != 0 ||
+      d->rxlen + n > sizeof(d->rxbuf))
+    return 0;  // Missed a fragment, or from another sender
+  memcpy(d->rxbuf + d->rxlen, f + MGI_802154_HDR, n);
+  d->rxlen = (uint16_t) (d->rxlen + n), d->rxnext++;
+  if (idx < last || d->rxlen > len) return 0;
+  memcpy(buf, d->rxbuf, d->rxlen);
+  return d->rxlen;
+}
+
+#endif

src/l2_eth.c

@@ -94,6 +94,13 @@ size_t mg_l2_eth_trailer(struct mg_tcpip_if *ifp, size_t len, uint8_t *cur) {
 struct mg_l2addr *mg_l2_eth_mapip(enum mg_l2addrtype addrtype,
                                   struct mg_addr *addr);
 
+// Read an unaligned little-endian value from byte pointer p into a native integer.
+// Safe on architectures that forbid unaligned access (e.g. Cortex-M0).
+#define MG_LOAD_LE32(p)                           \
+  ((uint32_t) (((uint32_t) MG_U8P(p)[3] << 24U) | \
+               ((uint32_t) MG_U8P(p)[2] << 16U) | \
+               ((uint32_t) MG_U8P(p)[1] << 8U) | MG_U8P(p)[0]))
+
 bool mg_l2_eth_rx(struct mg_tcpip_if *ifp, enum mg_l2proto *proto,
                   struct mg_str *pay, struct mg_str *raw) {
   struct eth *eth = (struct eth *) raw->buf;
@@ -109,7 +116,7 @@ bool mg_l2_eth_rx(struct mg_tcpip_if *ifp, enum mg_l2proto *proto,
   } else {  // We do, check 802.1Q tag
     struct qtag *qtag = (struct qtag *) &eth->type;
     if (qtag->tpid != mg_htons(0x8100)) return false;  // Untagged frame
-    if (mg_ntohs(VLAN_ID(qtag->tci)) != VLAN_ID(d->vlan_id))
+    if (VLAN_ID(mg_ntohs(qtag->tci)) != VLAN_ID(d->vlan_id))
       return false;  // Not our VLAN
     type = MG_LOAD_BE16(qtag + 1);
   }
@@ -119,18 +126,20 @@ bool mg_l2_eth_rx(struct mg_tcpip_if *ifp, enum mg_l2proto *proto,
              sizeof(eth->dst)) != 0)
     return false;  // TODO(): add multicast addresses
   if (ifp->enable_fcs_check && len > hdrlen + 4) {
-    uint32_t crc;
-    len -= 4;  // TODO(scaprile): check on bigendian
+    uint32_t crc, crc_rx;
+    len -= 4;
     crc = mg_crc32(0, (const char *) raw->buf, len);
-    if (memcmp((void *) ((size_t) raw->buf + len), &crc, sizeof(crc)))
+    crc_rx = MG_LOAD_LE32(raw->buf + len);
+    if (crc_rx != crc)
       return false;
   }
   pay->buf = ((char *) eth) + hdrlen;
   pay->len = len - hdrlen;
+  if (len > ifp->framesize) return false;  // Oversized
   for (i = 0; i < sizeof(eth_types) / sizeof(uint16_t); i++) {
     if (type == eth_types[i]) break;
   }
-  if (i == sizeof(eth_types)) {
+  if (i == sizeof(eth_types) / sizeof(eth_types[0])) {
     MG_DEBUG(("Unknown eth type %x", type));
     if (mg_log_level >= MG_LL_VERBOSE)
       mg_hexdump(raw->buf, raw->len >= 32 ? 32 : raw->len);

src/l2_ppp.c

@@ -101,7 +101,7 @@ static uint16_t s_id;
 
 void mg_l2_ppp_init(struct mg_tcpip_if *ifp) {
   ifp->l2mtu = 1500;
-  ifp->framesize = 1500 + sizeof(struct ppp) + sizeof(struct hdlc_);
+  ifp->framesize = ifp->l2mtu + sizeof(struct ppp) + sizeof(struct hdlc_) + 2;
 }
 
 extern void mg_l2_eth_init(struct mg_tcpip_if *);
@@ -169,30 +169,14 @@ uint8_t *mg_l2_pppoe_header(struct mg_tcpip_if *ifp, enum mg_l2proto proto,
                                            s_id, src, dst, frame));
 }
 
-// Calculate FCS/CRC for PPP frames. Could be implemented faster using lookup
-// tables.
-static uint16_t fcs_do(uint8_t *frame, size_t len) {
-  uint32_t fcs = 0xffff;
-  unsigned int j;
-  for (j = 0; j < len; j++) {
-    unsigned int i;
-    uint8_t x = frame[j];
-    for (i = 0; i < 8; i++) {
-      fcs = ((fcs ^ x) & 1) ? (fcs >> 1) ^ 0x8408 : fcs >> 1;
-      x >>= 1;
-    }
-  }
-  return (uint16_t) (fcs & 0xffff);
-}
-
 size_t mg_l2_ppp_trailer(struct mg_tcpip_if *ifp, size_t len, uint8_t *cur) {
   uint16_t crc;
   uint8_t *frame;
   len += sizeof(struct ppp) + sizeof(struct hdlc_);
   frame = cur - len;
-  crc = fcs_do(frame, len);
-  *cur++ = (uint8_t) ~crc;  // add CRC, note the byte order
-  *cur++ = (uint8_t) (~crc >> 8);
+  crc = mg_crc16(0, (const char *) frame, len);
+  *cur++ = (uint8_t) crc;  // add CRC, note the byte order
+  *cur++ = (uint8_t) (crc >> 8);
   // there is no len field in PPP
   (void) ifp;
   return len + 2;
@@ -243,6 +227,7 @@ static void ppp_handle_lcp(struct mg_tcpip_if *ifp, uint8_t *lcpp,
   if (lcpsz < sizeof(*lcp)) return;
   id = lcp->id;
   len = mg_ntohs(lcp->len);
+  if (len < sizeof(*lcp) || len > lcpsz) return;
   switch (lcp->code) {
     case MG_PPP_LCP_CFG_REQ: {
       if (len == sizeof(*lcp)) {
@@ -299,7 +284,7 @@ static void ppp_handle_ipcp(struct mg_tcpip_if *ifp, uint8_t *ipcpp,
   if (ipcpsz < sizeof(*ipcp)) return;
   id = ipcp->id;
   len = mg_ntohs(ipcp->len);
-  if (len > ipcpsz) return;
+  if (len < sizeof(*ipcp) || len > ipcpsz) return;
   switch (ipcp->code) {
     case MG_PPP_IPCP_CFG_REQ:
       MG_VERBOSE(("got IPCP config request, acknowledging..."));
@@ -359,6 +344,7 @@ static void ppp_handle_ipv6cp(struct mg_tcpip_if *ifp, uint8_t *ipv6cpp,
   if (ipv6cpsz < sizeof(*ipv6cp)) return;
   id = ipv6cp->id;
   len = mg_ntohs(ipv6cp->len);
+  if (len < sizeof(*ipv6cp) || len > ipv6cpsz) return;
   switch (ipv6cp->code) {
     case MG_PPP_IPV6CP_CFG_REQ:
       MG_VERBOSE(("got IPV6CP config request..."));
@@ -366,10 +352,10 @@ static void ppp_handle_ipv6cp(struct mg_tcpip_if *ifp, uint8_t *ipv6cpp,
           find_opt(
               MG_PPP_IPV6CP_OPT_IFCID, 10, (const uint8_t *) (ipv6cp + 1),
               len - sizeof(*ipv6cp),
-              (uint8_t *) &((struct mg_l2addr *) (ifp->gwmac))->addr.ieee64)) {
-        if (((struct mg_l2addr *) (ifp->gwmac))->addr.ieee64 != 0) {
+              (uint8_t *) &((struct mg_l2addr *) (ifp->gw6mac))->addr.ieee64)) {
+        if (((struct mg_l2addr *) (ifp->gw6mac))->addr.ieee64 != 0) {
           MG_DEBUG(("IPV6CP cfg, GW IFCID: %M", mg_print_ieee64,
-                    &((struct mg_l2addr *) (ifp->gwmac))->addr.ieee64));
+                    &((struct mg_l2addr *) (ifp->gw6mac))->addr.ieee64));
           ipv6cp->code = MG_PPP_IPV6CP_CFG_ACK;
           ppp_tx_frame(ifp, MG_PPP_PROTO_IPV6CP, ipv6cpp, len);
           req[1] = id;
@@ -393,22 +379,21 @@ static void ppp_handle_ipv6cp(struct mg_tcpip_if *ifp, uint8_t *ipv6cpp,
       // Our peer accepted our ifc id
       MG_VERBOSE(("got IPV6CP config ack"));
       break;
-    case MG_PPP_IPV6CP_CFG_NACK:
+    case MG_PPP_IPV6CP_CFG_NACK: {
+      struct mg_l2addr l2;
       MG_VERBOSE(("got IPV6CP config nack"));
       // NACK contains our "suggested" IFC id, use it
       if (len >= 10 &&
-          find_opt(
-              MG_PPP_IPV6CP_OPT_IFCID, 10, (const uint8_t *) (ipv6cp + 1),
-              len - sizeof(*ipv6cp),
-              (uint8_t *) &((struct mg_l2addr *) (ifp->mac))->addr.ieee64)) {
-        MG_DEBUG(("IPV6CP cfg, IFCID: %M", mg_print_ieee64,
-                  &((struct mg_l2addr *) (ifp->mac))->addr.ieee64));
+          find_opt(MG_PPP_IPV6CP_OPT_IFCID, 10, (const uint8_t *) (ipv6cp + 1),
+                   len - sizeof(*ipv6cp), (uint8_t *) &l2.addr.ieee64)) {
+        MG_DEBUG(("IPV6CP cfg, IFCID: %M", mg_print_ieee64, &l2.addr.ieee64));
+        ifp->ip6ll[1] = l2.addr.ieee64;  // RFC-5072 5, signal L3 we're ready
         ipv6cp->code = MG_PPP_IPV6CP_CFG_REQ;
         ppp_tx_frame(ifp, MG_PPP_PROTO_IPV6CP, ipv6cpp, len);
       } else {
         MG_ERROR(("Peer is not able to offer an interface id"));
       }
-      break;
+    } break;
     case MG_PPP_IPV6CP_CFG_REJECT:
       MG_ERROR(("Peer rejected our interface id"));
       break;
@@ -481,6 +466,7 @@ bool mg_l2_ppp_rx(struct mg_tcpip_if *ifp, enum mg_l2proto *proto,
     pay->buf = (char *) raw->buf;
     pay->len = raw->len - 2;
   }
+  if (pay->len > ifp->l2mtu + sizeof(struct ppp)) return false;  // Oversized
   return ppp_rx(ifp, proto, pay, raw);
 }
 
@@ -563,6 +549,8 @@ bool mg_l2_pppoe_rx(struct mg_tcpip_if *ifp, enum mg_l2proto *proto,
   if (!mg_l2_eth_rx(ifp, &eth_proto, pay, raw)) return false;
   pppoe = (struct pppoe *) pay->buf;            // here we handle pay, not raw
   if (pay->len < sizeof(*pppoe)) return false;  // Truncated
+  if (pay->len - sizeof(*pppoe) > ifp->l2mtu + sizeof(struct ppp))
+    return false;  // Oversized
   if (eth_proto == MG_TCPIP_L2PROTO_PPPoE_DISC) {
     MG_VERBOSE(("PPPoE_DISC"));
     if (s_state == MG_PPPoE_ST_DISC && pppoe->code == MG_PPPoE_PADO &&
@@ -573,10 +561,10 @@ bool mg_l2_pppoe_rx(struct mg_tcpip_if *ifp, enum mg_l2proto *proto,
       uint8_t *p = (uint8_t *) (pppoe + 1);
       uint16_t taglen;
       while (len >= 4) {  // parse tags for a possible AC-Cookie
-        uint16_t curtag = *((uint16_t *) p);
-        taglen = mg_ntohs(*(((uint16_t *) p) + 1));
+        uint16_t curtag = MG_LOAD_BE16(p);
+        taglen = MG_LOAD_BE16(p + 2);
         if (taglen > len - 4) return false;  // truncated / malformed
-        if (curtag == mg_htons(0x0104)) {
+        if (curtag == 0x0104) {
           has_cookie = true;
           break;
         }

src/lfs.c

@@ -3,19 +3,18 @@
 
 #include "flash.h"
 #include "util.h"
+#include "lfs.h"
 
 #if MG_ENABLE_LFS
 
-#include <fcntl.h>
-#include <littlefs/lfs.h>
-#include <string.h>
-#include <sys/stat.h>
-#include <sys/types.h>
-
 #ifndef LFS_USE_RAM
 #define LFS_USE_RAM 0  // If 1, use RAM FS. If 0, use flash
 #endif
 
+#ifndef MG_LFS_SIZE
+#define MG_LFS_SIZE (64 * 1024)
+#endif
+
 #ifndef MG_LFS_BUF_SIZE
 #define MG_LFS_BUF_SIZE 64  // Buffer size used for reads, writes, and cache
 #endif
@@ -28,19 +27,6 @@
 #define MG_LFS_BLOCK_SIZE 8192
 #endif
 
-#ifndef DT_DIR
-#define DT_DIR 4
-#endif
-#ifndef DT_REG
-#define DT_REG 8
-#endif
-
-typedef struct mg_lfs_fd DIR;
-struct dirent {
-  char d_name[LFS_NAME_MAX + 1];
-  unsigned char d_type;
-};
-
 struct mg_lfs_fd {
   struct mg_lfs_fd *next;
   bool isopen;
@@ -52,7 +38,6 @@ struct mg_lfs_fd {
 static lfs_t s_lfs;
 static struct mg_lfs_fd *s_fds;
 static uint8_t *s_fs;
-static int s_next_fd = MG_LFS_FD_BASE;
 static bool s_lfs_ready;
 #if LFS_USE_RAM
 static uint8_t *s_ram_fs;
@@ -110,29 +95,50 @@ static int lfs_driver_sync(const struct lfs_config *cfg) {
 }
 
 bool mg_lfs_init(size_t size) {
-  int result = 0;
+  //bool ok = false;
+  MG_DEBUG(("size: %zu", size));
   if (s_lfs_ready) return true;
-  if (size == 0) return false;
+  if (size == 0) {
+    MG_ERROR(("invalidsize = 0"));
+  } else {
 #if LFS_USE_RAM
-  s_cfg.block_size = MG_LFS_BLOCK_SIZE;
-  if (s_ram_fs == NULL) s_ram_fs = (uint8_t *) mg_calloc(1, size);
-  s_fs = s_ram_fs;
+    s_cfg.block_size = MG_LFS_BLOCK_SIZE;
+    if (s_ram_fs == NULL) s_ram_fs = (uint8_t *) mg_calloc(1, size);
+    s_fs = s_ram_fs;
 #else
-  if (mg_flash == NULL || mg_flash->secsz == 0 || mg_flash->size < size) return false;
-  if (mg_flash->write_fn == NULL) return false;
-  s_cfg.block_size = mg_flash->secsz;
-  s_fs = (uint8_t *) mg_flash->start + mg_flash->size - size;
+    {
+      // Some flash attributes may be initialised on ota_begin
+      int lev = mg_log_level;
+      mg_log_level = MG_LL_NONE;
+      mg_ota_begin(1);
+      mg_ota_end();
+      mg_log_set(lev);
+    }
+    if (mg_flash == NULL || mg_flash->secsz == 0 || mg_flash->size < size) {
+      MG_ERROR(("mg_flash %p secsz %zu flash_size %zu < size %zu", mg_flash, mg_flash->secsz, mg_flash->size, size));
+    } else if (mg_flash->write_fn == NULL) {
+      MG_ERROR(("flash write_fn == NULL"));
+    } else {
+      s_cfg.block_size = mg_flash->secsz;
+      s_fs = (uint8_t *) mg_flash->start + mg_flash->size - size;
+    }
 #endif
-  if (s_fs == NULL || s_cfg.block_size == 0 || size % s_cfg.block_size != 0) {
-    return false;
+    if (s_fs == NULL || s_cfg.block_size == 0 || size % s_cfg.block_size != 0) {
+      MG_ERROR(("s_fs %p blk_size %zu size %zu", s_fs, s_cfg.block_size));
+    } else {
+      s_cfg.block_count = (lfs_size_t) (size / s_cfg.block_size);
+      if (s_cfg.block_count == 0) {
+        MG_ERROR(("blk_count == 0"));
+      } else {
+        if (lfs_mount(&s_lfs, &s_cfg) != 0) lfs_format(&s_lfs, &s_cfg);
+        if (lfs_mount(&s_lfs, &s_cfg) != 0) {
+          MG_ERROR(("lfs_mount"));
+        } else {
+          s_lfs_ready = true;
+        }
+      }
+    }
   }
-  s_cfg.block_count = (lfs_size_t) (size / s_cfg.block_size);
-  if (s_cfg.block_count == 0) return false;
-  if (lfs_mount(&s_lfs, &s_cfg) != 0) {
-    lfs_format(&s_lfs, &s_cfg);
-    if (lfs_mount(&s_lfs, &s_cfg) != 0) result = -1;
-  }
-  s_lfs_ready = result == 0;
   return s_lfs_ready;
 }
 
@@ -145,16 +151,12 @@ static struct mg_lfs_fd *find_fd(int fd) {
 }
 
 static struct mg_lfs_fd *open_fd(void) {
-  struct mg_lfs_fd *f = NULL;
-  if (s_lfs_ready) {
-    f = (struct mg_lfs_fd *) mg_calloc(1, sizeof(*f));
-    if (f != NULL) {
-      f->isopen = true;
-      f->fd = s_next_fd++;
-      f->next = s_fds;
-      s_fds = f;
-      if (s_next_fd < MG_LFS_FD_BASE) s_next_fd = MG_LFS_FD_BASE;
-    }
+  struct mg_lfs_fd *f = NULL, *p = s_fds;
+  if (s_lfs_ready == false) mg_lfs_init(MG_LFS_SIZE);
+  if (s_lfs_ready && (f = (struct mg_lfs_fd *) mg_calloc(1, sizeof(*f)))) {
+    f->isopen = true, f->fd = MG_LFS_FD_BASE, f->next = s_fds;
+    while (p != NULL) p = p->fd == f->fd ? (f->fd++, s_fds) : p->next;
+    s_fds = f;
   }
   return f;
 }
@@ -173,6 +175,7 @@ int _open(const char *path, int flags, mode_t mode) {
   int err, lfs_flags = 0, fd = -1;
   struct mg_lfs_fd *f = open_fd();
   (void) mode;
+  MG_DEBUG(("%s -> %p, lfs_ready %d", path, f, s_lfs_ready));
   if (f == NULL) return -1;
   fd = f->fd;
   if ((flags & 3) == O_RDONLY) lfs_flags |= LFS_O_RDONLY;
@@ -214,11 +217,21 @@ int _lseek(int fd, int offset, int whence) {
 }
 
 int _rename(const char *oldname, const char *newname) {
+  if (s_lfs_ready == false) mg_lfs_init(MG_LFS_SIZE);
   return s_lfs_ready ? lfs_rename(&s_lfs, oldname, newname) : -1;
 }
 
-int _unlink_r(void *r, const char *a) {
-  (void) r;
+// Some libc rename() implementations have no atomic rename syscall and emulate
+// it as link() + unlink() instead of calling _rename() directly. LittleFS has
+// no real hard links, but forwarding to _rename() gives the same end result
+// (oldname becomes newname), which is all mg_file_write()'s atomic-write
+// pattern (write to a temp file, then rename it into place) needs
+int _link(const char *oldname, const char *newname) {
+  return _rename(oldname, newname);
+}
+
+int _unlink(const char *a) {
+  if (s_lfs_ready == false) mg_lfs_init(MG_LFS_SIZE);
   return s_lfs_ready ? lfs_remove(&s_lfs, a) : -1;
 }
 
@@ -227,7 +240,7 @@ DIR *opendir(const char *name) {
   if (f == NULL) return NULL;
   if (lfs_dir_open(&s_lfs, &f->dir, name) != 0) {
     close_fd(f);
-    return NULL;
+    f = NULL;
   }
   return (DIR *) f;
 }
@@ -254,7 +267,9 @@ struct dirent *readdir(DIR *dir) {
 
 int _stat(const char *path, struct stat *st) {
   struct lfs_info info;
+  if (s_lfs_ready == false) mg_lfs_init(MG_LFS_SIZE);
   if (!s_lfs_ready || lfs_stat(&s_lfs, path, &info) != 0) return -1;
+  memset(st, 0, sizeof(*st));
   st->st_mode = info.type == LFS_TYPE_DIR ? S_IFDIR : S_IFREG;
   st->st_size = info.size;
   return 0;
@@ -268,7 +283,7 @@ int _fstat(int fd, struct stat *st) {
 
 int mkdir(const char *path, mode_t mode) {
   (void) mode;
+  if (s_lfs_ready == false) mg_lfs_init(MG_LFS_SIZE);
   return s_lfs_ready ? lfs_mkdir(&s_lfs, path) : -1;
 }
-
 #endif

src/lfs.h

@@ -0,0 +1,20 @@
+#pragma once
+
+#if MG_ENABLE_LFS
+#include <fcntl.h>
+#include <lfs.h>
+
+#ifndef DT_DIR
+#define DT_DIR 4
+#endif
+#ifndef DT_REG
+#define DT_REG 8
+#endif
+
+struct dirent {
+  char d_name[LFS_NAME_MAX + 1];
+  unsigned char d_type;
+};
+
+typedef struct mg_lfs_fd DIR;
+#endif

src/mdash.c

@@ -0,0 +1,190 @@
+#include "mdash.h"
+
+#if MG_ENABLE_MDASH
+
+#include "base64.h"
+#include "health.h"
+#include "log.h"
+#include "ota.h"
+#include "printf.h"
+#include "rpc.h"
+#include "sntp.h"
+#include "tls.h"
+#include "url.h"
+#include "ws.h"
+
+static const char *mg_mdash_ca_pem =
+    "-----BEGIN CERTIFICATE-----\n"
+    "MIIFazCCA1OgAwIBAgIRAIIQz7DSQONZRGPgu2OCiwAwDQYJKoZIhvcNAQELBQAw\n"
+    "TzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2Vh\n"
+    "cmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwHhcNMTUwNjA0MTEwNDM4\n"
+    "WhcNMzUwNjA0MTEwNDM4WjBPMQswCQYDVQQGEwJVUzEpMCcGA1UEChMgSW50ZXJu\n"
+    "ZXQgU2VjdXJpdHkgUmVzZWFyY2ggR3JvdXAxFTATBgNVBAMTDElTUkcgUm9vdCBY\n"
+    "MTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAK3oJHP0FDfzm54rVygc\n"
+    "h77ct984kIxuPOZXoHj3dcKi/vVqbvYATyjb3miGbESTtrFj/RQSa78f0uoxmyF+\n"
+    "0TM8ukj13Xnfs7j/EvEhmkvBioZxaUpmZmyPfjxwv60pIgbz5MDmgK7iS4+3mX6U\n"
+    "A5/TR5d8mUgjU+g4rk8Kb4Mu0UlXjIB0ttov0DiNewNwIRt18jA8+o+u3dpjq+sW\n"
+    "T8KOEUt+zwvo/7V3LvSye0rgTBIlDHCNAymg4VMk7BPZ7hm/ELNKjD+Jo2FR3qyH\n"
+    "B5T0Y3HsLuJvW5iB4YlcNHlsdu87kGJ55tukmi8mxdAQ4Q7e2RCOFvu396j3x+UC\n"
+    "B5iPNgiV5+I3lg02dZ77DnKxHZu8A/lJBdiB3QW0KtZB6awBdpUKD9jf1b0SHzUv\n"
+    "KBds0pjBqAlkd25HN7rOrFleaJ1/ctaJxQZBKT5ZPt0m9STJEadao0xAH0ahmbWn\n"
+    "OlFuhjuefXKnEgV4We0+UXgVCwOPjdAvBbI+e0ocS3MFEvzG6uBQE3xDk3SzynTn\n"
+    "jh8BCNAw1FtxNrQHusEwMFxIt4I7mKZ9YIqioymCzLq9gwQbooMDQaHWBfEbwrbw\n"
+    "qHyGO0aoSCqI3Haadr8faqU9GY/rOPNk3sgrDQoo//fb4hVC1CLQJ13hef4Y53CI\n"
+    "rU7m2Ys6xt0nUW7/vGT1M0NPAgMBAAGjQjBAMA4GA1UdDwEB/wQEAwIBBjAPBgNV\n"
+    "HRMBAf8EBTADAQH/MB0GA1UdDgQWBBR5tFnme7bl5AFzgAiIyBpY9umbbjANBgkq\n"
+    "hkiG9w0BAQsFAAOCAgEAVR9YqbyyqFDQDLHYGmkgJykIrGF1XIpu+ILlaS/V9lZL\n"
+    "ubhzEFnTIZd+50xx+7LSYK05qAvqFyFWhfFQDlnrzuBZ6brJFe+GnY+EgPbk6ZGQ\n"
+    "3BebYhtF8GaV0nxvwuo77x/Py9auJ/GpsMiu/X1+mvoiBOv/2X/qkSsisRcOj/KK\n"
+    "NFtY2PwByVS5uCbMiogziUwthDyC3+6WVwW6LLv3xLfHTjuCvjHIInNzktHCgKQ5\n"
+    "ORAzI4JMPJ+GslWYHb4phowim57iaztXOoJwTdwJx4nLCgdNbOhdjsnvzqvHu7Ur\n"
+    "TkXWStAmzOVyyghqpZXjFaH3pO3JLF+l+/+sKAIuvtd7u+Nxe5AW0wdeRlN8NwdC\n"
+    "jNPElpzVmbUq4JUagEiuTDkHzsxHpFKVK7q4+63SM1N95R1NbdWhscdCb+ZAJzVc\n"
+    "oyi3B43njTOQ5yOf+1CceWxG1bQVs5ZufpsMljq4Ui0/1lvh+wjChP4kqKOJ2qxq\n"
+    "4RgqsahDYVvTH9w7jXbyLeiNdd8XM2w9U/t7y0Ff/9yi0GE44Za4rF2LN9d11TPA\n"
+    "mRGunUHBcnWEvgJBQl9nJEiU0Zsnvgc/ubhPgXRR4Xq37Z0j4r7g1SgEEzwxA57d\n"
+    "emyPxgcYxn/eR44/KJ4EBs+lVDR3veyJm+kXQ99b21/+jh5Xos1AnX5iItreGCc=\n"
+    "-----END CERTIFICATE-----\n";
+
+static struct mg_connection *mg_mdash_conn = NULL;
+// static struct mg_str mg_mdash_key;
+// static void mg_connection *mg_mdash_conn = NULL;
+
+static void mg_mdash_fn(struct mg_connection *c, int ev, void *ev_data) {
+  if (ev == MG_EV_CONNECT) {
+    // c->is_hexdumping = true;
+    if (mg_url_is_ssl(MG_MDASH_URL)) {
+      struct mg_str host = mg_url_host(MG_MDASH_URL);
+      struct mg_tls_opts opts;
+      memset(&opts, 0, sizeof(struct mg_tls_opts));
+      opts.ca = mg_str(mg_mdash_ca_pem);
+      opts.name = host;
+      mg_tls_init(c, &opts);
+    }
+  }
+  if (ev == MG_EV_WS_OPEN) {
+    MG_INFO(("Connected to %s", MG_MDASH_URL));
+    // s_mDashState = MDASH_STATE_CLOUD_CONNECTED;
+    // mDashTriggerEvent(s_mDashState, NULL);
+  } else if (ev == MG_EV_WS_MSG) {
+    struct mg_iobuf io = {0, 0, 0, 512};
+    struct mg_ws_message *wm = (struct mg_ws_message *) ev_data;
+    struct mg_str s = wm->data;
+    struct mg_rpc_req r;
+    while (s.len > 0 && isspace((uint8_t) s.buf[s.len - 1])) s.len--;
+    MG_INFO(("RPC: %.*s", (int) s.len, s.buf));
+    memset(&r, 0, sizeof(struct mg_rpc_req));
+    r.head = &c->mgr->rpcs;
+    r.rpc = NULL;
+    r.pfn = mg_pfn_iobuf;
+    r.pfn_data = &io;
+    r.req_data = NULL;
+    r.frame = s;
+    mg_rpc_process(&r);
+    if (io.buf != NULL) {
+      MG_INFO(("     %s", io.buf));
+      mg_ws_send(c, (const char *) io.buf, io.len, WEBSOCKET_OP_TEXT);
+    } else {
+      MG_DEBUG(("%s", "RPC unhandled"));
+    }
+    mg_iobuf_free(&io);
+  } else if (ev == MG_EV_CLOSE) {
+    mg_mdash_conn = NULL;
+    MG_INFO(("disconnected, ram %lu", 0));
+  }
+  (void) c;
+}
+
+static void mg_mdash_rpc_get_info(struct mg_rpc_req *r) {
+  const char *reset_reason = mg_health_reason_str(mg_health_reason());
+  mg_rpc_ok(r, "{%m:%m,%m:%llu,%m:%m,%m:\"mws.%d\",%m:%M}",     //
+            MG_ESC("fw_version"), MG_ESC(MG_FIRMWARE_VERSION),  //
+            MG_ESC("uptime"), (uint64_t) (mg_millis() / 1000),  //
+            MG_ESC("reboot_reason"), MG_ESC(reset_reason),      //
+            MG_ESC("arch"), MG_ARCH,                            //
+            MG_ESC("crash"), mg_print_crash_record);
+}
+
+static void mg_mdash_rpc_ota_begin(struct mg_rpc_req *r) {
+  size_t total = (size_t) mg_json_get_long(r->frame, "$.params.size", -1);
+  if (mg_ota_begin(total)) {
+    mg_rpc_ok(r, "true");
+  } else {
+    mg_rpc_err(r, 500, "%m", MG_ESC("failed"));
+  }
+}
+
+static void mg_mdash_rpc_ota_write(struct mg_rpc_req *r) {
+  int len = 0, ofs = 0;
+  if ((ofs = mg_json_get(r->frame, "$.params.data", &len)) <= 0 ||
+      r->frame.buf[ofs] != '"') {
+    mg_rpc_err(r, 500, "%m", MG_ESC("data required"));
+  } else {
+    struct mg_str s = mg_str_n(&r->frame.buf[ofs] + 1, (size_t) (len - 2));
+    size_t n = mg_base64_decode(s.buf, s.len, s.buf, s.len);  // Decode in-place
+    if (n == 0) {
+      mg_rpc_ok(r, "%m", MG_ESC("finished"));
+      mg_ota_end();
+    } else if (mg_ota_write(s.buf, n)) {
+      mg_rpc_ok(r, "{%m:%d}", MG_ESC("queued"), n);
+    } else {
+      mg_rpc_err(r, 500, "%m", MG_ESC("write failed"));
+      mg_ota_end();
+    }
+    // mDashNotify("State.Set", "{%m:{%m:%d}}", MG_ESC("ota"),
+    // MG_ESC("percent"), (int) (s_ota_written * 100 / s_ota_size));
+  }
+}
+
+static void mg_mdash_rpc_ota_end(struct mg_rpc_req *r) {
+  if (mg_ota_end()) {
+    mg_rpc_ok(r, "true");
+  } else {
+    mg_rpc_err(r, 500, "%m", MG_ESC("failed"));
+  }
+  // mDashNotify("State.Set", "{%m:{%m:null}}", MG_ESC("ota"),
+  // MG_ESC("percent"));
+}
+
+void mg_mdash_init(struct mg_mgr *mgr) {
+  MG_INFO(("Initialising mdash agent, key [%s]", MG_MDASH_KEY));
+  mg_rpc_add(&mgr->rpcs, mg_str("RPC.List"), mg_rpc_list, NULL);
+  mg_rpc_add(&mgr->rpcs, mg_str("Sys.GetInfo"), mg_mdash_rpc_get_info, NULL);
+  mg_rpc_add(&mgr->rpcs, mg_str("OTA.Begin"), mg_mdash_rpc_ota_begin, NULL);
+  mg_rpc_add(&mgr->rpcs, mg_str("OTA.Write"), mg_mdash_rpc_ota_write, NULL);
+  mg_rpc_add(&mgr->rpcs, mg_str("OTA.End"), mg_mdash_rpc_ota_end, NULL);
+}
+
+void mg_mdash_poll(struct mg_mgr *mgr) {
+#if MG_TLS == MG_TLS_NONE
+  (void) mgr, (void) mg_mdash_fn;  // mdash needs wss://, nothing to do
+#else
+  static uint64_t timer = 0;
+  // No RPC handlers means mdash was never set up, or mg_mdash_free() ran.
+  // No key means mdash would reject us, so do not connect at all
+  if (mg_mdash_conn == NULL && mgr->rpcs != NULL && MG_MDASH_KEY[0] != '\0' &&
+      mg_timer_expired(&timer, 1000, mg_millis())) {
+    MG_INFO(("Connecting to %s", MG_MDASH_URL));
+    mg_mdash_conn = mg_ws_connect(mgr, MG_MDASH_URL, mg_mdash_fn, NULL,
+                                  "Origin: %s\r\n"
+                                  "Authorization: Bearer %s\r\n",
+                                  MG_MDASH_URL, MG_MDASH_KEY);
+  }
+#endif
+}
+
+void mg_mdash_free(struct mg_mgr *mgr) {
+  mg_rpc_del(&mgr->rpcs, NULL);
+}
+
+#else
+void mg_mdash_init(struct mg_mgr *mgr) {
+  (void) mgr;
+}
+void mg_mdash_poll(struct mg_mgr *mgr) {
+  (void) mgr;
+}
+void mg_mdash_free(struct mg_mgr *mgr) {
+  (void) mgr;
+}
+#endif

src/mdash.h

@@ -0,0 +1,21 @@
+// Cloud connector API to https://mdash.net - device management cloud
+
+#pragma once
+
+#include "net.h"
+
+#ifndef MG_MDASH_URL
+#define MG_MDASH_URL "wss://mdash.net/api/v2/rpc"
+#endif
+
+#ifndef MG_MDASH_KEY
+#define MG_MDASH_KEY ""
+#endif
+
+#ifndef MG_ENABLE_MDASH
+#define MG_ENABLE_MDASH 0
+#endif
+
+void mg_mdash_init(struct mg_mgr *);
+void mg_mdash_poll(struct mg_mgr *);
+void mg_mdash_free(struct mg_mgr *);

src/mqtt.c

@@ -438,6 +438,16 @@ int mg_mqtt_parse(const uint8_t *buf, size_t len, uint8_t version,
     case MQTT_CMD_CONNACK:
       if (end - p < 2) return MQTT_MALFORMED;
       m->ack = p[1];
+      p += 2;
+      if (version == 5) {
+        if (p >= end) return MQTT_MALFORMED;
+        len_len = (uint32_t) decode_varint(p, (size_t) (end - p), &tmp);
+        if (!len_len) return MQTT_MALFORMED;
+        m->props_size = (size_t) tmp;
+        m->props_start = (size_t) (p + len_len - buf);
+        p += len_len + m->props_size;
+        if (p > end) return MQTT_MALFORMED;
+      }
       break;
     case MQTT_CMD_PUBACK:
     case MQTT_CMD_PUBREC:

src/net.c

@@ -1,8 +1,8 @@
-#include "net.h"
 #include "dns.h"
 #include "fmt.h"
 #include "log.h"
-#include "ota.h"
+#include "mdash.h"
+#include "net.h"
 #include "printf.h"
 #include "profile.h"
 #include "timer.h"
@@ -29,6 +29,28 @@ size_t mg_printf(struct mg_connection *c, const char *fmt, ...) {
   return len;
 }
 
+bool mg_dscp(struct mg_connection *c, uint8_t dscp) {
+#if MG_ENABLE_SOCKET
+#if MG_ENABLE_FREERTOS_TCP || MG_ARCH == MG_ARCH_THREADX || \
+    MG_ARCH == MG_ARCH_TIRTOS || MG_ARCH == MG_ARCH_WIN32
+  (void) c;
+  (void) dscp;
+#else
+  int tos = dscp << 2, level = IPPROTO_IP, optname = IP_TOS;
+  c->dscp = (unsigned) (dscp & 63);
+#if MG_ENABLE_IPV6 && !MG_ENABLE_LWIP
+  if (c->loc.is_ip6) level = IPPROTO_IPV6, optname = IPV6_TCLASS;
+#endif
+  return setsockopt((MG_SOCKET_TYPE) (size_t) c->fd, level, optname,
+                    (char *) &tos, sizeof(tos)) == 0;
+#endif
+#elif MG_ENABLE_TCPIP
+  c->dscp = (unsigned) (dscp & 63);
+  return true;
+#endif
+  return false;
+}
+
 static bool mg_atonl(struct mg_str str, struct mg_addr *addr) {
   uint32_t localhost = mg_htonl(0x7f000001);
   if (mg_strcasecmp(str, mg_str("localhost")) != 0) return false;
@@ -85,22 +107,31 @@ static bool mg_v4mapped(struct mg_str str, struct mg_addr *addr) {
 
 static bool mg_aton6(struct mg_str str, struct mg_addr *addr) {
   size_t i, j = 0, n = 0, dc = 42;
+  uint16_t val = 0;
+  bool have = false;
   addr->scope_id = 0;
   if (str.len > 2 && str.buf[0] == '[') str.buf++, str.len -= 2;
   if (mg_v4mapped(str, addr)) return true;  // sets addr->is_ip6
   for (i = 0; i < str.len; i++) {
-    if ((str.buf[i] >= '0' && str.buf[i] <= '9') ||
-        (str.buf[i] >= 'a' && str.buf[i] <= 'f') ||
-        (str.buf[i] >= 'A' && str.buf[i] <= 'F')) {
-      unsigned long val = 0;  // TODO(): This loops on chars, refactor
+    int x = str.buf[i] >= '0' && str.buf[i] <= '9'   ? str.buf[i] - '0'
+            : str.buf[i] >= 'a' && str.buf[i] <= 'f' ? str.buf[i] - 'a' + 10
+            : str.buf[i] >= 'A' && str.buf[i] <= 'F' ? str.buf[i] - 'A' + 10
+                                                     : -1;
+    if (x >= 0) {
       if (i > j + 3) return false;
-      // MG_DEBUG(("%lu %lu [%.*s]", i, j, (int) (i - j + 1), &str.buf[j]));
-      mg_str_to_num(mg_str_n(&str.buf[j], i - j + 1), 16, &val, sizeof(val));
-      addr->addr.ip[n] = (uint8_t) ((val >> 8) & 255);
-      addr->addr.ip[n + 1] = (uint8_t) (val & 255);
-    } else if (str.buf[i] == ':') {
+      val = (uint16_t) ((val << 4) | (uint16_t) x);
+      have = true;
+      continue;
+    }
+    if (have) {
+      addr->addr.ip[n] = (uint8_t) (val >> 8),
+      addr->addr.ip[n + 1] = (uint8_t) val;
+      val = 0, have = false;
+    }
+    if (str.buf[i] == ':') {
       j = i + 1;
       if (i > 0 && str.buf[i - 1] == ':') {
+        if (dc != 42) return false;
         dc = n;  // Double colon
         if (i > 1 && str.buf[i - 2] == ':') return false;
       } else if (i > 0) {
@@ -120,20 +151,25 @@ static bool mg_aton6(struct mg_str str, struct mg_addr *addr) {
       return false;
     }
   }
+  if (have)
+    addr->addr.ip[n] = (uint8_t) (val >> 8),
+    addr->addr.ip[n + 1] = (uint8_t) val;
   if (n < 14 && dc == 42) return false;
   if (n < 14) {
     memmove(&addr->addr.ip[dc + (14 - n)], &addr->addr.ip[dc], n - dc + 2);
     memset(&addr->addr.ip[dc], 0, 14 - n);
   }
-
   addr->is_ip6 = true;
   return true;
 }
 
+bool mg_aton_(struct mg_str str, struct mg_addr *addr);
+bool mg_aton_(struct mg_str str, struct mg_addr *addr) {
+  return mg_aton4(str, addr) || mg_aton6(str, addr);
+}
+
 bool mg_aton(struct mg_str str, struct mg_addr *addr) {
-  // MG_INFO(("[%.*s]", (int) str.len, str.buf));
-  return mg_atone(str, addr) || mg_atonl(str, addr) || mg_aton4(str, addr) ||
-         mg_aton6(str, addr);
+  return mg_atone(str, addr) || mg_atonl(str, addr) || mg_aton_(str, addr);
 }
 
 struct mg_connection *mg_alloc_conn(struct mg_mgr *mgr) {
@@ -263,6 +299,9 @@ void mg_mgr_free(struct mg_mgr *mgr) {
   while (t != NULL) tmp = t->next, mg_free(t), t = tmp;
   mgr->timers = NULL;  // Important. Next call to poll won't touch timers
   for (c = mgr->conns; c != NULL; c = c->next) c->is_closing = 1;
+#if MG_ENABLE_MDASH
+  mg_mdash_free(mgr);  // Before the final poll, so mdash does not reconnect
+#endif
   mg_mgr_poll(mgr, 0);
 #if MG_ENABLE_FREERTOS_TCP
   FreeRTOS_DeleteSocketSet(mgr->ss);
@@ -307,13 +346,18 @@ void mg_mgr_init(struct mg_mgr *mgr) {
   mgr->dns4.url = "udp://8.8.8.8:53";
   mgr->dns6.url = "udp://[2001:4860:4860::8888]:53";
   mg_tls_ctx_init(mgr);
-  MG_DEBUG(("MG_IO_SIZE: %lu, TLS: %s", MG_IO_SIZE,
+  MG_DEBUG(("MG_IO_SIZE: %lu, TLS: %s, conn size: %zu, mgr size: %zu",
+            MG_IO_SIZE,
             MG_TLS == MG_TLS_NONE      ? "none"
             : MG_TLS == MG_TLS_MBED    ? "MbedTLS"
             : MG_TLS == MG_TLS_OPENSSL ? "OpenSSL"
             : MG_TLS == MG_TLS_BUILTIN ? "builtin"
             : MG_TLS == MG_TLS_WOLFSSL ? "WolfSSL"
-                                       : "custom"));
+                                       : "custom",
+            sizeof(struct mg_connection), sizeof(struct mg_mgr)));
+#if MG_ENABLE_MDASH
+  mg_mdash_init(mgr);
+#endif
 }
 
 #if MG_ENABLE_TCPIP

src/net.h

@@ -50,6 +50,7 @@ struct mg_mgr {
   struct mg_tcpip_if *ifp;      // Builtin TCP/IP stack: network interface pointer
   size_t extraconnsize;         // Builtin TCP/IP stack: extra bytes allocated per connection
   union mg_pipe pipe;           // Socketpair write-end / queue, used by mg_wakeup()
+  struct mg_rpc *rpcs;          // Linked list of registered RPC handlers
 #if MG_ENABLE_FREERTOS_TCP
   SocketSet_t ss;               // FreeRTOS-TCP socket set
 #endif
@@ -74,6 +75,10 @@ struct mg_connection {
   void *pfn_data;                 // Protocol-level handler argument
   char data[MG_DATA_SIZE];        // Scratch space for protocol state; freely readable
   void *tls;                      // TLS state (internal)
+  unsigned dscp : 6;              // Differentiated Services Code Point
+#define MG_DSCP_CS(class_) ((class_) << 3)
+#define MG_DSCP_AF(class_, drop_) (((class_) << 3) | ((drop_) << 1))
+#define MG_DSCP_EF 46
   unsigned is_listening : 1;      // Listening connection; accepts inbound connections
   unsigned is_client : 1;         // Outbound connection created by mg_connect()
   unsigned is_accepted : 1;       // Inbound connection accepted from a listener
@@ -87,12 +92,12 @@ struct mg_connection {
   unsigned is_mqtt5 : 1;          // MQTT5 connection (set by mg_mqtt_login)
   unsigned is_hexdumping : 1;     // Log hex dump of all in/out traffic
   unsigned is_draining : 1;       // Flush send buffer, then close
-  unsigned is_closing : 1;        // Close and free immediately on next poll
+  unsigned is_closing : 1;        // Request Close and free on next poll
   unsigned is_full : 1;           // Pause incoming reads until cleared
   unsigned is_tls_throttled : 1;  // TLS write was throttled; retry pending
-  unsigned is_resp : 1;           // HTTP: response is still being generated
   unsigned is_readable : 1;       // Socket is ready to read (epoll/select)
   unsigned is_writable : 1;       // Socket is ready to write (epoll/select)
+  unsigned is_bsd : 1;            // Built-in TCP/IP stack BSD socket
 };
 
 // Runs one iteration of the event loop.
@@ -154,6 +159,11 @@ struct mg_connection *mg_connect(struct mg_mgr *, const char *url,
 struct mg_connection *mg_wrapfd(struct mg_mgr *mgr, int fd,
                                 mg_event_handler_t fn, void *fn_data);
 
+// Sets the 6-bit Differentiated Services Code Point for outgoing datagrams.
+// Call on MG_EV_OPEN for UDP listeners, MG_EV_CONNECT for clients, or
+// MG_EV_ACCEPT for TCP servers, before sending application data.
+bool mg_dscp(struct mg_connection *, uint8_t dscp);
+
 // Called internally after DNS resolution completes to create the OS socket
 // and initiate the TCP/IP connect. Normally not called by user code.
 void mg_connect_resolved(struct mg_connection *);

src/net_builtin.h

@@ -59,6 +59,7 @@ struct mg_tcpip_if {
   bool enable_req_sntp;                   // DHCP client requests an SNTP server address
   bool enable_fcs_check;                  // Verify and strip FCS from received frames
   bool enable_mac_check;                  // Drop frames not addressed to this MAC
+  bool enable_tcp_retransmit;             // Enable optional TCP retransmission queue
   bool update_mac_hash_table;             // Signal driver to refresh MAC multicast hash table
   bool is_ip_changed;                     // Set by stack when IP changes; triggers connection restart
   struct mg_tcpip_driver *driver;         // Hardware driver; must be set before mg_tcpip_init()
@@ -152,6 +153,42 @@ extern struct mg_tcpip_driver mg_tcpip_driver_cyw;
 extern struct mg_tcpip_driver mg_tcpip_driver_nxp_wifi;
 extern struct mg_tcpip_driver mg_tcpip_driver_st67w6;
 extern struct mg_tcpip_driver mg_tcpip_driver_atcmd;
+extern struct mg_tcpip_driver mg_tcpip_driver_netc;
+extern struct mg_tcpip_driver mg_tcpip_driver_mcxw71;
+extern struct mg_tcpip_driver mg_tcpip_driver_rw612_154;
+
+// IEEE 802.15.4 radio channel and PAN ID. Settable in mongoose_config.h
+#ifndef MG_L2_802154_CHANNEL
+#define MG_L2_802154_CHANNEL 15  // 11..26
+#endif
+#ifndef MG_L2_802154_PAN_ID
+#define MG_L2_802154_PAN_ID 0xabcd
+#endif
+
+// driver_data for IEEE 802.15.4 radio drivers. The interface is Ethernet:
+// each Ethernet frame is split into broadcast radio frames, and reassembled
+// on the other side, see mg_l2_802154_tx() and mg_l2_802154_rx()
+struct mg_l2_802154_data {
+  uint8_t channel;        // User-set channel, 11..26
+  uint16_t pan_id;        // User-set PAN ID
+  uint8_t seq, tag;       // MAC sequence number, tag of the last sent frame
+  uint8_t rxtag, rxnext;  // Frame being reassembled: tag, next fragment
+  uint8_t rxsrc[8];       // Its sender
+  uint16_t rxlen;         // Its bytes received so far
+  uint8_t rxbuf[1514];    // Reassembly buffer, one Ethernet frame
+};
+
+// Splits an Ethernet frame into radio frames, sends each by calling send().
+// Called by radio drivers' tx(). Return len, or 0 on error
+size_t mg_l2_802154_tx(struct mg_tcpip_if *ifp, const void *buf, size_t len,
+                       size_t (*send)(const uint8_t *, size_t,
+                                      struct mg_tcpip_if *));
+
+// Adds a received radio frame f of n bytes to the frame being reassembled.
+// Called by radio drivers' rx(). Return the Ethernet frame length, copied to
+// buf, when it is complete, otherwise 0
+size_t mg_l2_802154_rx(struct mg_tcpip_if *ifp, const uint8_t *f, size_t n,
+                       void *buf, size_t len);
 
 // SPI bus abstraction for SPI-attached network chips (e.g. W5500).
 // Populate and assign to the driver's driver_data field.

src/net_ft.h

@@ -29,7 +29,8 @@
   ((errcode) == -pdFREERTOS_ERRNO_EWOULDBLOCK || \
    (errcode) == -pdFREERTOS_ERRNO_EISCONN ||     \
    (errcode) == -pdFREERTOS_ERRNO_EINPROGRESS || \
-   (errcode) == -pdFREERTOS_ERRNO_EAGAIN)
+   (errcode) == -pdFREERTOS_ERRNO_EAGAIN ||      \
+   (errcode) == -pdFREERTOS_ERRNO_ENOSPC)
 
 #define MG_SOCK_RESET(errcode) ((errcode) == -pdFREERTOS_ERRNO_ENOTCONN)
 

src/ota.c

@@ -3,6 +3,7 @@
 #include "json.h"
 #include "log.h"
 #include "printf.h"
+#include "tls.h"
 #include "url.h"
 #include "util.h"
 
@@ -12,7 +13,7 @@
 
 // Scannable version tag embedded in every firmware binary, for server-side
 // version extraction. The version string starts after the "MG_VERSION:" prefix.
-static const char s_fw_version[] = "MG_VERSION:" MG_OTA_FIRMWARE_VERSION;
+static const char s_fw_version[] = "MG_VERSION:" MG_FIRMWARE_VERSION;
 
 static bool s_autocommit_ok;  // True after OTA server confirms "same version"
 
@@ -22,10 +23,26 @@ static struct mg_ota_state {
   size_t size;
   uint8_t sha256[32];
   void (*fn)(const char *error_message);
+  size_t received;  // Firmware bytes written so far
+  bool open;        // mg_ota_begin() succeeded, mg_ota_end() is pending
+  const char *err;  // First error during download, NULL if none
 } *s_ota;
 
 static void s_firmware_fn(struct mg_connection *c, int ev, void *ev_data);
 
+static bool s_tls_init(struct mg_connection *c, const char *url) {
+  struct mg_tls_opts opts;
+  memset(&opts, 0, sizeof(opts));
+  opts.ca = mg_str(MG_OTA_TLS_CA);
+  opts.name = mg_url_host(url);
+  if (opts.ca.len == 0) {
+    mg_error(c, "MG_OTA_TLS_CA is not configured");
+  } else {
+    mg_tls_init(c, &opts);
+  }
+  return c->is_tls_hs != 0 && !c->is_closing;
+}
+
 #if MG_ENABLE_CUSTOM_DEVICE_ID
 #else
 void mg_ota_device_id(char *buf, size_t len) {
@@ -58,6 +75,11 @@ void mg_ota_device_id(char *buf, size_t len) {
 
 static void s_version_fn(struct mg_connection *c, int ev, void *ev_data) {
   uint64_t expiration = *(uint64_t *) c->data;
+  if (s_ota == NULL) {
+    c->fn = NULL;
+    c->is_closing = 1;
+    return;
+  }
   if (ev == MG_EV_POLL) {
     if (mg_millis() > expiration) mg_error(c, "Metadata timeout");
   } else if (ev == MG_EV_CONNECT) {
@@ -65,6 +87,9 @@ static void s_version_fn(struct mg_connection *c, int ev, void *ev_data) {
     struct mg_str host = mg_url_host(s_ota->json_url);
     const char *uri = mg_url_uri(s_ota->json_url);
     const char *sep = strchr(uri, '?') == NULL ? "?" : "&";
+    if (mg_url_is_ssl(s_ota->json_url)) {
+      if (!s_tls_init(c, s_ota->json_url)) return;
+    }
     mg_ota_device_id(id, sizeof(id));
     id[sizeof(id) - 1] = '\0';
     mg_printf(
@@ -121,19 +146,54 @@ static void status_fn(const char *errmsg) {
   if (errmsg) MG_ERROR(("OTA failed: %s", errmsg));
 }
 
-static void status_fn_2(struct mg_connection *c, const char *errmsg) {
-  if (s_ota) s_ota->fn(errmsg);
+// Firmware download callback for mg_http_stream_body(). Writes chunks to the
+// OTA target and reports the result via s_ota->fn(). The end call also happens
+// when the connection drops before the whole body arrived.
+static bool s_firmware_cb(struct mg_http_message *hm, struct mg_str *data,
+                          void **p) {
+  bool finalized = false, ok;
+  (void) p;
+  if (s_ota == NULL) return false;
+  if (hm != NULL) {  // Start
+    s_ota->received = 0;
+    s_ota->open = mg_ota_begin(hm->body.len);
+    if (!s_ota->open) s_ota->err = "OTA begin failed";
+    return s_ota->open;
+  } else if (data != NULL) {  // Next chunk
+    if (!mg_ota_write(data->buf, data->len)) {
+      s_ota->err = "OTA write failed";
+      return false;
+    }
+    s_ota->received += data->len;
+    return true;
+  }
+  // End
+  if (s_ota->open) finalized = mg_ota_end();
+  if (s_ota->err == NULL && s_ota->received != s_ota->size) {
+    s_ota->err = "Connection closed";
+  }
+  if (s_ota->err == NULL && !finalized) s_ota->err = "OTA finalize failed";
+  ok = s_ota->err == NULL;
+  s_ota->fn(s_ota->err);
   mg_free(s_ota);
   s_ota = NULL;
-  mg_http_reply(c, errmsg ? 500 : 200, "", "%s\n", errmsg ? errmsg : "ok");
+  return ok;
 }
 
 static void s_firmware_fn(struct mg_connection *c, int ev, void *ev_data) {
   uint64_t expiration = *(uint64_t *) c->data;
+  if (s_ota == NULL) {
+    c->fn = NULL;
+    c->is_closing = 1;
+    return;
+  }
   if (ev == MG_EV_POLL) {
     if (mg_millis() > expiration) mg_error(c, "OTA timeout");
   } else if (ev == MG_EV_CONNECT) {
     struct mg_str host = mg_url_host(s_ota->url);
+    if (mg_url_is_ssl(s_ota->url)) {
+      if (!s_tls_init(c, s_ota->url)) return;
+    }
     mg_printf(c,
               "GET %s HTTP/1.1\r\n"
               "Host: %.*s\r\n"
@@ -148,7 +208,7 @@ static void s_firmware_fn(struct mg_connection *c, int ev, void *ev_data) {
                (unsigned long) hm->body.len, (unsigned long) s_ota->size);
     } else {
       MG_DEBUG(("Beginning OTA (%lu bytes)", (unsigned long) s_ota->size));
-      mg_http_start_ota(c, hm, status_fn_2);
+      mg_http_stream_body(c, hm, s_firmware_cb, NULL);
     }
   } else if (ev == MG_EV_ERROR) {
     s_ota->fn((char *) ev_data);
@@ -181,11 +241,26 @@ void mg_ota_url_check(struct mg_mgr *mgr, const char *json_url,
   }
 }
 
+// Uses *p as a flag: non-NULL means an OTA session is open and must be
+// closed by mg_ota_end()
+bool mg_http_ota_cb(struct mg_http_message *hm, struct mg_str *data, void **p) {
+  if (hm != NULL) {  // Start
+    if (!mg_ota_begin(hm->body.len)) return false;
+    *p = (void *) (ptrdiff_t) 1;
+    return true;
+  } else if (data != NULL) {  // Next chunk
+    return mg_ota_write(data->buf, data->len);
+  }
+  if (*p == NULL) return false;  // End. Begin failed, nothing to finish
+  *p = NULL;
+  return mg_ota_end();
+}
+
 void mg_ota_poll(struct mg_mgr *mgr) {
   static uint64_t t = 5000;  // Fire first time 5 sec after boot
 
   static uint64_t feed_timer;  // Advances 500ms per tick; tracks elapsed time
-  if (MG_OTA_STATE_GET() == MG_OTA_TESTING &&
+  if (MG_OTA_STATE_GET() == MG_OTA_FAILED &&
       mg_timer_expired(&feed_timer, 500, mg_millis())) {
     if (feed_timer < (uint64_t) MG_OTA_ROLLBACK_TIMEOUT_SECONDS * 1000) {
       MG_OTA_ROLLBACK_TIMER_FEED();  // Feed watchdog every 500ms

src/ota.h

@@ -2,8 +2,8 @@
 //
 // This is a low-level OTA API, not intended to be called directly by users.
 // Users are provided with a higher-level API:
-// - defining MG_OTA_URL enables HTTP pull-based updates
-// - mg_http_start_ota() enables push-based updates
+// - defining MG_OTA_URL enables HTTP or HTTPS pull-based updates
+// - mg_http_stream_body() enables push-based updates
 //
 // However, it is possible to use the mg_ota_* API directly. Below is the
 // example code of a function that is called repeatedly. It expects the
@@ -26,6 +26,7 @@
 #pragma once
 
 #include "arch.h"
+#include "http.h"
 #include "net.h"
 
 // Supported OTA targets
@@ -34,6 +35,7 @@
 #define MG_OTA_STM32H7 2            // STM32 H7
 #define MG_OTA_STM32H7_DUAL_CORE 3  // STM32 H7 dual core
 #define MG_OTA_STM32F 4             // STM32 F7/F4/F2
+#define MG_OTA_STM32C5 5            // STM32 C5, same flash controller as H5
 #define MG_OTA_CH32V307 100         // WCH CH32V307
 #define MG_OTA_U2A 200              // Renesas U2A16, U2A8, U2A6
 #define MG_OTA_RT1020 300           // IMXRT1020
@@ -41,7 +43,9 @@
 #define MG_OTA_RT1060 302           // IMXRT1060
 #define MG_OTA_RT1064 303           // IMXRT1064
 #define MG_OTA_RT1170 304           // IMXRT1170
+#define MG_OTA_RT1180 305           // IMXRT1180
 #define MG_OTA_MCXN 310             // MCXN947
+#define MG_OTA_MCXW71 311           // MCXW71
 #define MG_OTA_RW612 320            // FRDM-RW612
 #define MG_OTA_FLASH 900            // OTA via internal flash
 #define MG_OTA_ESP32 910            // ESP32 OTA implementation
@@ -71,6 +75,18 @@ bool mg_ota_write(const void *buf, size_t len);
 // Ends the OTA process and commits the written firmware.
 bool mg_ota_end(void);
 
+// Push-based OTA: mg_http_stream_body() callback that flashes the request
+//
+// ```c
+// if (ev == MG_EV_HTTP_HDRS) {
+//   struct mg_http_message *hm = (struct mg_http_message *) ev_data;
+//   if (mg_match(hm->uri, mg_str("/ota"), NULL)) {
+//     mg_http_stream_body(c, hm, mg_http_ota_cb, NULL);
+//   }
+// }
+// ```
+bool mg_http_ota_cb(struct mg_http_message *hm, struct mg_str *data, void **p);
+
 // MG_OTA_ROLLBACK: swap firmware banks and reset. On flash-based OTA, the
 // default calls swap_fn() (no-op on single-bank) then resets. Override in
 // mongoose_config.h for platforms without mg_flash (ESP32, PicoSDK, etc.).
@@ -149,9 +165,11 @@ enum {
     }                                                              \
   } while (0)
 
-// Pull-based OTA over HTTP. Fetches metadata_url, which must return a JSON
-// object like: { "version": "1.2.3", "url": "FIRMWARE_URL", "size": 324645 }
-// If the server version differs from MG_OTA_FIRMWARE_VERSION, downloads
+// Pull-based OTA over HTTP or HTTPS. If it's HTTPS, MG_OTA_TLS_CA
+// needs to be defined. Fetches metadata_url, which must
+// return a JSON object like:
+// { "version": "1.2.3", "url": "FIRMWARE_URL", "size": 324645 }
+// If the server version differs from MG_FIRMWARE_VERSION, downloads
 // FIRMWARE_URL and performs the OTA update. fn is called on every outcome:
 // NULL on successful flash, "Same version" when already up to date, or an
 // error string on failure. Pass NULL to use the default handler which logs
@@ -160,20 +178,26 @@ void mg_ota_url_check(struct mg_mgr *mgr, const char *metadata_url,
                       void (*fn)(const char *error_message));
 
 // Firmware info URL for mg_ota_poll() which calls mg_ota_url_check().
-// Example:  "http://mongoose.ws/ota/u/0/ota.json". See http://mongoose.ws/ota/
+// Example: "http://mongoose.ws/ota/u/0/ota.json". See http://mongoose.ws/ota/
 // Settable in mongoose_config.h
 #ifndef MG_OTA_URL
 #define MG_OTA_URL NULL
 #endif
 
+// PEM or DER CA certificate used to authenticate an HTTPS OTA server. Set to
+// NULL to use HTTP. Set in mongoose_config.h.
+#ifndef MG_OTA_TLS_CA
+#define MG_OTA_TLS_CA NULL
+#endif
+
 // OTA status callback function for mg_ota_poll()
 #ifndef MG_OTA_STATUS_FN
 #define MG_OTA_STATUS_FN NULL
 #endif
 
 // Firmware version for mg_ota_poll(). Settable in mongoose_config.h
-#ifndef MG_OTA_FIRMWARE_VERSION
-#define MG_OTA_FIRMWARE_VERSION "1.0.0"
+#ifndef MG_FIRMWARE_VERSION
+#define MG_FIRMWARE_VERSION "1.0.0"
 #endif
 
 // Maximum version string length
@@ -195,6 +219,7 @@ void mg_ota_url_check(struct mg_mgr *mgr, const char *metadata_url,
 // E.g. on STM32, uses the 96-bit MCU UID converted to a hex string.
 void mg_ota_device_id(char *buf, size_t len);
 
-// Checks for a firmware update over HTTP. Called automatically by mg_mgr_poll()
-// when MG_OTA_URL is set in mongoose_config.h. Do not call directly.
+// Checks for a firmware update over HTTP or HTTPS. Called automatically by
+// mg_mgr_poll() when MG_OTA_URL is set in mongoose_config.h. Do not call
+// directly.
 void mg_ota_poll(struct mg_mgr *);

src/ota_esp32.c

@@ -46,6 +46,10 @@ bool mg_ota_end(void) {
   }
   MG_DEBUG(("Finished ESP32 OTA, success: %d", s_ota_success));
   s_ota_update_partition = NULL;
+  if (s_ota_success) {
+    MG_OTA_STATE_SET(MG_OTA_TESTING);
+    esp_restart();
+  }
   return s_ota_success;
 }
 

src/ota_imxrt.c

@@ -2,7 +2,7 @@
 #include "log.h"
 #include "ota.h"
 
-#if MG_OTA >= MG_OTA_RT1020 && MG_OTA <= MG_OTA_RT1170
+#if MG_OTA >= MG_OTA_RT1020 && MG_OTA <= MG_OTA_RT1180
 
 static bool mg_imxrt_write(void *, const void *, size_t);
 static bool mg_imxrt_swap(void);
@@ -13,9 +13,12 @@ static bool mg_imxrt_swap(void);
 #elif MG_OTA == MG_OTA_RT1064
 #define MG_IMXRT_FLASH_START 0x70000000
 #define FLEXSPI_NOR_INSTANCE 1
-#else  // RT1170
+#elif MG_OTA == MG_OTA_RT1170
 #define MG_IMXRT_FLASH_START 0x30000000
 #define FLEXSPI_NOR_INSTANCE 1
+#else  // RT1180 FlexSPI2
+#define MG_IMXRT_FLASH_START 0x04000000
+#define FLEXSPI_NOR_INSTANCE 2
 #endif
 
 #if MG_OTA == MG_OTA_RT1050
@@ -324,7 +327,7 @@ struct mg_flexspi_nor_driver_interface {
                     uint32_t *option);
 };
 #else
-// RT117x support ROM API version 1.7
+// RT117x and RT118x
 struct mg_flexspi_nor_driver_interface {
   uint32_t version;
   int (*init)(uint32_t instance, struct mg_flexspi_nor_config *config);
@@ -359,11 +362,16 @@ struct mg_flexspi_nor_driver_interface {
 #define flexspi_nor                                                          \
   (*((struct mg_flexspi_nor_driver_interface **) (*(uint32_t *) 0x0020001c + \
                                                   16)))
-#else
+#elif MG_OTA == MG_OTA_RT1170
 #define MG_FLEXSPI_BASE 0x400CC000
 #define flexspi_nor                                                          \
   (*((struct mg_flexspi_nor_driver_interface **) (*(uint32_t *) 0x0021001c + \
                                                   12)))
+#else
+#define MG_FLEXSPI_BASE 0x445E0000
+#define flexspi_nor                                                          \
+  (*((struct mg_flexspi_nor_driver_interface **) (*(uint32_t *) 0x1000001c + \
+                                                  12)))
 #endif
 
 static bool s_flash_irq_disabled;
@@ -408,6 +416,13 @@ static struct mg_flexspi_nor_config default_config = {
 #else
 // Note: this QSPI configuration works for RTs supporting QSPI
 // Configuration for QSPI memory
+#if MG_OTA == MG_OTA_RT1180
+#define MG_FLEXSPI_QSPI_SERIAL_CLK_FREQ 5  // 100MHz
+#define MG_FLEXSPI_QSPI_FLASH_SIZE (16 * 1024 * 1024)
+#else
+#define MG_FLEXSPI_QSPI_SERIAL_CLK_FREQ 7  // 133MHz
+#define MG_FLEXSPI_QSPI_FLASH_SIZE (8 * 1024 * 1024)
+#endif
 static struct mg_flexspi_nor_config default_config = {
     .memConfig = {.tag = MG_FLEXSPI_CFG_BLK_TAG,
                   .version = MG_FLEXSPI_CFG_BLK_VERSION,
@@ -417,8 +432,8 @@ static struct mg_flexspi_nor_config default_config = {
                   .controllerMiscOption = MG_BIT(4),
                   .deviceType = 1,  // serial NOR
                   .sflashPadType = 4,
-                  .serialClkFreq = 7,  // 133MHz
-                  .sflashA1Size = 8 * 1024 * 1024,
+                  .serialClkFreq = MG_FLEXSPI_QSPI_SERIAL_CLK_FREQ,
+                  .sflashA1Size = MG_FLEXSPI_QSPI_FLASH_SIZE,
                   .lookupTable = MG_FLEXSPI_QSPI_LUT},
     .pageSize = 256,
     .sectorSize = 4 * 1024,
@@ -453,6 +468,7 @@ MG_IRAM static int flexspi_nor_get_config(
 }
 #endif
 
+#if MG_OTA == MG_OTA_RT1020 || MG_OTA == MG_OTA_RT1050
 MG_IRAM static void mg_spin(volatile uint32_t count) {
   while (count--) (void) 0;
 }
@@ -461,6 +477,7 @@ MG_IRAM static void flash_wait(void) {
   while ((*((volatile uint32_t *) (MG_FLEXSPI_BASE + 0xE0)) & MG_BIT(1)) == 0)
     mg_spin(1);
 }
+#endif
 
 MG_IRAM static bool flash_erase(struct mg_flexspi_nor_config *config,
                                 void *addr) {
@@ -491,10 +508,6 @@ MG_IRAM static bool mg_imxrt_erase(void *addr) {
 }
 #endif
 
-MG_IRAM bool mg_imxrt_swap(void) {
-  return true;
-}
-
 MG_IRAM static bool mg_imxrt_write(void *addr, const void *buf, size_t len) {
   struct mg_flexspi_nor_config config, *config_ptr = &config;
   bool ok = false;
@@ -513,6 +526,8 @@ MG_IRAM static bool mg_imxrt_write(void *addr, const void *buf, size_t len) {
   uint32_t *dst = (uint32_t *) addr;
   uint32_t *src = (uint32_t *) buf;
   uint32_t *end = (uint32_t *) ((char *) buf + len);
+  char *flash_start = (char *) s_mg_flash_imxrt.start;
+  char *flash_end = flash_start + s_mg_flash_imxrt.size;
   ok = true;
 
   while (ok && src < end) {
@@ -520,20 +535,32 @@ MG_IRAM static bool mg_imxrt_write(void *addr, const void *buf, size_t len) {
       ok = false;
       break;
     }
-    uint32_t status;
+    uint32_t status = 0;
     uint32_t dst_ofs = (uint32_t) dst - (uint32_t) s_mg_flash_imxrt.start;
-    if ((char *) buf >= (char *) s_mg_flash_imxrt.start) {
+    if ((char *) buf >= flash_start && (char *) buf < flash_end) {
       // If we copy from FLASH to FLASH, then we first need to copy the source
       // to RAM
       size_t tmp_buf_size = s_mg_flash_imxrt.align / sizeof(uint32_t);
       uint32_t tmp[tmp_buf_size];
 
+#if MG_OTA == MG_OTA_RT1020 || MG_OTA == MG_OTA_RT1050
+      // ROM API 1.4 does not provide flexspi_nor_flash_read().
+      // Manually copy byte by byte into the RAM buffer.
       for (size_t i = 0; i < tmp_buf_size; i++) {
         flash_wait();
         tmp[i] = src[i];
       }
-      status = flexspi_nor->program(FLEXSPI_NOR_INSTANCE, config_ptr,
-                                    (uint32_t) dst_ofs, tmp);
+#else
+      // When supported, prefer the read API call.
+      uint32_t src_ofs =
+          (uint32_t) src - (uint32_t) s_mg_flash_imxrt.start;
+      status = flexspi_nor->read(FLEXSPI_NOR_INSTANCE, config_ptr, tmp,
+                                 src_ofs, s_mg_flash_imxrt.align);
+#endif
+      if (status == 0) {
+        status = flexspi_nor->program(FLEXSPI_NOR_INSTANCE, config_ptr,
+                                      dst_ofs, tmp);
+      }
     } else {
       status = flexspi_nor->program(FLEXSPI_NOR_INSTANCE, config_ptr,
                                     (uint32_t) dst_ofs, src);
@@ -550,16 +577,40 @@ fwxit:
   return ok;
 }
 
-// just overwrite instead of swap
 MG_IRAM static void single_bank_swap(char *p1, char *p2, size_t s, size_t ss) {
-  // no stdlib calls here
+  char *scratch = p2 + s;
   for (size_t ofs = 0; ofs < s; ofs += ss) {
+    MG_OTA_ROLLBACK_TIMER_FEED();
+    mg_imxrt_write(scratch, p1 + ofs, ss);
+    MG_OTA_ROLLBACK_TIMER_FEED();
     mg_imxrt_write(p1 + ofs, p2 + ofs, ss);
+    MG_OTA_ROLLBACK_TIMER_FEED();
+    mg_imxrt_write(p2 + ofs, scratch, ss);
   }
   *(volatile unsigned long *) 0xe000ed0c = 0x5fa0004;
 }
 
+MG_IRAM static bool mg_imxrt_swap(void) {
+  size_t ss = s_mg_flash_imxrt.secsz;
+  char *p1 = (char *) s_mg_flash_imxrt.start;
+  char *p2 = p1 + s_mg_flash_imxrt.size / 2;
+  size_t s = s_mg_flash_imxrt.size / 2 - ss;
+  MG_INFO(("Swapping partitions, %u bytes", s));
+  MG_INFO(("Do NOT power off..."));
+  MG_OTA_ROLLBACK_TIMER_FEED();
+  mg_log_level = MG_LL_NONE;
+  s_flash_irq_disabled = true;
+  single_bank_swap(p1, p2, s, ss);
+  return true;  // unreachable
+}
+
 bool mg_ota_begin(size_t new_firmware_size) {
+  size_t max = s_mg_flash_imxrt.size / 2 - s_mg_flash_imxrt.secsz;
+  if (new_firmware_size > max) {
+    MG_ERROR(("Firmware %lu too big for single-bank OTA, max %lu",
+              new_firmware_size, max));
+    return false;
+  }
   return mg_ota_flash_begin(new_firmware_size, &s_mg_flash_imxrt);
 }
 
@@ -568,25 +619,7 @@ bool mg_ota_write(const void *buf, size_t len) {
 }
 
 bool mg_ota_end(void) {
-  if (mg_ota_flash_end(&s_mg_flash_imxrt)) {
-    if (0) {  // is_dualbank()
-      // TODO(): no devices so far
-      *(volatile unsigned long *) 0xe000ed0c = 0x5fa0004;
-    } else {
-      // Swap partitions. Pray power does not go away
-      MG_INFO(("Swapping partitions, size %u (%u sectors)",
-               s_mg_flash_imxrt.size,
-               s_mg_flash_imxrt.size / s_mg_flash_imxrt.secsz));
-      MG_INFO(("Do NOT power off..."));
-      mg_log_level = MG_LL_NONE;
-      s_flash_irq_disabled = true;
-      // Runs in RAM, will reset when finished
-      single_bank_swap(
-          (char *) s_mg_flash_imxrt.start,
-          (char *) s_mg_flash_imxrt.start + s_mg_flash_imxrt.size / 2,
-          s_mg_flash_imxrt.size / 2, s_mg_flash_imxrt.secsz);
-    }
-  }
+  mg_ota_flash_end(&s_mg_flash_imxrt);
   return false;
 }
 struct mg_flash *mg_flash = &s_mg_flash_imxrt;

src/ota_mcxw71.c

@@ -0,0 +1,181 @@
+#include "flash.h"
+#include "log.h"
+#include "ota.h"
+
+#if MG_OTA == MG_OTA_MCXW71
+
+// MCXW71SRM, section 11.2: ROM flash API, 8 KB sectors, 16-byte phrases,
+// 128-byte pages. Only the CM33 application flash is used; RF flash and IFR
+// (including the write-once ROM configuration) are left alone.
+struct mg_mcxw71_flash_config {
+  struct {
+    uint32_t base, size, blocks;
+    uint32_t ifr_base, ifr_size;
+  } mem[2];
+};
+
+struct mg_mcxw71_flash_api {
+  uint32_t (*init)(struct mg_mcxw71_flash_config *);
+  uint32_t (*erase)(struct mg_mcxw71_flash_config *, void *, uint32_t, uint32_t,
+                    uint32_t);
+  uint32_t (*phrase)(struct mg_mcxw71_flash_config *, void *, uint32_t,
+                     uint32_t *, uint32_t);
+  uint32_t (*page)(struct mg_mcxw71_flash_config *, void *, uint32_t,
+                   uint32_t *, uint32_t);
+};
+
+// The flash API pointer is the second entry in the ROM API table.
+#define MG_MCXW71_FLASH_API \
+  (*(const struct mg_mcxw71_flash_api *const *) 0x14816fe4U)
+#define MG_MCXW71_ERASE_KEY 0x6b65666cU  // FOUR_CHAR_CODE('l', 'f', 'e', 'k')
+
+static struct mg_mcxw71_flash_config s_mcxw71_config;
+static size_t s_mcxw71_size, s_mcxw71_received, s_mcxw71_pending;
+static uint32_t s_mcxw71_buf[4];
+static bool s_mcxw71_failed;
+
+static bool mg_mcxw71_write(void *, const void *, size_t);
+static bool mg_mcxw71_swap(void);
+static struct mg_flash s_mg_flash_mcxw71 = {
+    (void *) 0, 0x100000, 8192, 16, mg_mcxw71_write, mg_mcxw71_swap};
+struct mg_flash *mg_flash = &s_mg_flash_mcxw71;
+
+// Everything called while flash is busy, or after the application has been
+// erased, must execute from RAM or ROM. Do not log or call libc here.
+MG_IRAM static bool mg_mcxw71_write(void *addr, const void *buf, size_t len) {
+  uintptr_t dst = (uintptr_t) addr;
+  const volatile uint8_t *src = (const volatile uint8_t *) buf;
+  uint32_t irq, status = 0;
+  if (dst >= s_mg_flash_mcxw71.size || len > s_mg_flash_mcxw71.size - dst ||
+      (dst % 16) != 0 || (len % 16) != 0)
+    return false;
+
+  irq = __get_PRIMASK();
+  __disable_irq();
+  while (len > 0 && status == 0) {
+    uint32_t words[32];  // ROM needs a word-aligned source in RAM
+    volatile uint8_t *p = (volatile uint8_t *) words;
+    size_t i, n = (dst % 128) == 0 && len >= 128 ? 128 : 16;
+    for (i = 0; i < n; i++) p[i] = src[i];
+
+    // Match the MCUXpresso ROM wrappers' cache maintenance. Interrupts stay
+    // masked until the flash command completes and stale cache data is gone.
+    MCM->CPCR2 |= MCM_CPCR2_CCBC_MASK;
+    __DSB();
+    __ISB();
+    if ((dst % 8192) == 0) {
+      status = MG_MCXW71_FLASH_API->erase(
+          &s_mcxw71_config, FMU0, (uint32_t) dst, 8192, MG_MCXW71_ERASE_KEY);
+    }
+    if (status == 0) {
+      if (n == 128) {
+        status = MG_MCXW71_FLASH_API->page(&s_mcxw71_config, FMU0,
+                                           (uint32_t) dst, words, 128);
+      } else {
+        status = MG_MCXW71_FLASH_API->phrase(&s_mcxw71_config, FMU0,
+                                             (uint32_t) dst, words, 16);
+      }
+    }
+    MCM->CPCR2 |= MCM_CPCR2_CCBC_MASK;
+    __DSB();
+    __ISB();
+    dst += n, src += n, len -= n;
+  }
+  __set_PRIMASK(irq);
+  return status == 0;
+}
+
+static bool mg_mcxw71_swap(void) {
+  // The common helper verifies the staged image before the RAM copy below.
+  // A failed write must never commit, even if all expected bytes arrived.
+  return !s_mcxw71_failed;
+}
+
+MG_IRAM static void mg_mcxw71_apply(size_t size) {
+  size_t ofs, half = s_mg_flash_mcxw71.size / 2;
+  __disable_irq();
+  SysTick->CTRL = 0;
+  for (ofs = 0; ofs < size; ofs += 8192) {
+    if (!mg_mcxw71_write((void *) (uintptr_t) ofs,
+                         (const void *) (uintptr_t) (half + ofs), 8192)) {
+      // The application may already be erased. Stay in RAM for debugger
+      // recovery rather than return to partially overwritten flash.
+      for (;;) __NOP();
+    }
+  }
+  __DSB();
+  SCB->AIRCR = 0x05fa0004U;
+  __DSB();
+  for (;;) __NOP();
+}
+
+bool mg_ota_begin(size_t new_firmware_size) {
+  uint32_t status;
+  if (s_mcxw71_size != 0 || new_firmware_size == 0) return false;
+  status = MG_MCXW71_FLASH_API->init(&s_mcxw71_config);
+  if (status != 0 || s_mcxw71_config.mem[0].base != 0 ||
+      s_mcxw71_config.mem[0].size < 16384 ||
+      (s_mcxw71_config.mem[0].size % 16384) != 0) {
+    MG_ERROR(("Flash init failed: %lu", (unsigned long) status));
+    return false;
+  }
+  s_mg_flash_mcxw71.size = s_mcxw71_config.mem[0].size;
+  if (!mg_ota_flash_begin(new_firmware_size, &s_mg_flash_mcxw71)) return false;
+  s_mcxw71_size = new_firmware_size;
+  s_mcxw71_received = s_mcxw71_pending = 0;
+  s_mcxw71_failed = false;
+  return true;
+}
+
+bool mg_ota_write(const void *buf, size_t len) {
+  const uint8_t *p = (const uint8_t *) buf;
+  uint8_t *pending = (uint8_t *) s_mcxw71_buf;
+  if (s_mcxw71_size == 0 || s_mcxw71_failed) return false;
+  if (len > s_mcxw71_size - s_mcxw71_received || (len > 0 && buf == NULL)) {
+    s_mcxw71_failed = true;
+    return false;
+  }
+  s_mcxw71_received += len;
+  if (s_mcxw71_pending > 0) {
+    size_t n = 16 - s_mcxw71_pending;
+    if (n > len) n = len;
+    if (n > 0) memcpy(pending + s_mcxw71_pending, p, n);
+    s_mcxw71_pending += n;
+    if (n > 0) p += n;
+    len -= n;
+    if (s_mcxw71_pending == 16) {
+      s_mcxw71_failed = !mg_ota_flash_write(pending, 16, &s_mg_flash_mcxw71);
+      s_mcxw71_pending = 0;
+    }
+  }
+  if (!s_mcxw71_failed && len >= 16) {
+    size_t n = MG_ROUND_DOWN(len, 16);
+    s_mcxw71_failed = !mg_ota_flash_write(p, n, &s_mg_flash_mcxw71);
+    p += n, len -= n;
+  }
+  if (!s_mcxw71_failed && len > 0) {
+    memcpy(pending + s_mcxw71_pending, p, len);
+    s_mcxw71_pending += len;
+  }
+  return !s_mcxw71_failed;
+}
+
+bool mg_ota_end(void) {
+  bool ok;
+  size_t size = s_mcxw71_size;
+  if (size == 0) return false;
+  if (s_mcxw71_received != size) s_mcxw71_failed = true;
+  if (!s_mcxw71_failed && s_mcxw71_pending > 0) {
+    s_mcxw71_failed =
+        !mg_ota_flash_write(s_mcxw71_buf, s_mcxw71_pending, &s_mg_flash_mcxw71);
+  }
+  ok = mg_ota_flash_end(&s_mg_flash_mcxw71);
+  s_mcxw71_size = s_mcxw71_pending = 0;
+  if (ok) {
+    MG_INFO(("Applying %lu bytes from staging flash", (unsigned long) size));
+    mg_mcxw71_apply(size);
+  }
+  return false;
+}
+
+#endif

src/ota_rw612.c

@@ -291,24 +291,22 @@ MG_IRAM static bool mg_frdm_write(void *addr, const void *buf, size_t len) {
     }
     uint32_t status;
     uint32_t dst_ofs = (uint32_t) dst - (uint32_t) s_mg_flash_frdm.start;
+    size_t tmp_buf_size = s_mg_flash_frdm.align / sizeof(uint32_t);
+    uint32_t tmp[tmp_buf_size];
     if ((char *) buf >= (char *) s_mg_flash_frdm.start &&
         (char *) buf <
             (char *) (s_mg_flash_frdm.start + s_mg_flash_frdm.size)) {
       // If we copy from FLASH to FLASH, then we first need to copy the source
       // to RAM
-      size_t tmp_buf_size = s_mg_flash_frdm.align / sizeof(uint32_t);
-      uint32_t tmp[tmp_buf_size];
-
       for (size_t i = 0; i < tmp_buf_size; i++) {
         flash_wait();
         tmp[i] = src[i];
       }
-      status = flexspi_nor->page_program(MG_FLEXSPI_NOR_INSTANCE, &config,
-                                         (uint32_t) dst_ofs, tmp, false);
     } else {
-      status = flexspi_nor->page_program(MG_FLEXSPI_NOR_INSTANCE, &config,
-                                         (uint32_t) dst_ofs, src, false);
+      memcpy(tmp, src, sizeof(tmp));
     }
+    status = flexspi_nor->page_program(MG_FLEXSPI_NOR_INSTANCE, &config,
+                                       (uint32_t) dst_ofs, tmp, false);
     src = (uint32_t *) ((char *) src + s_mg_flash_frdm.align);
     dst = (uint32_t *) ((char *) dst + s_mg_flash_frdm.align);
     if (status != 0) {

src/ota_stm32f.c

@@ -45,11 +45,9 @@ MG_IRAM static int is_dualbank(void) {
 }
 
 MG_IRAM static void flash_unlock(void) {
-  static bool unlocked = false;
-  if (unlocked == false) {
+  if (MG_REG(MG_FLASH_BASE + MG_FLASH_CR) & MG_BIT(31)) {
     MG_REG(MG_FLASH_BASE + MG_FLASH_KEYR) = 0x45670123;
     MG_REG(MG_FLASH_BASE + MG_FLASH_KEYR) = 0xcdef89ab;
-    unlocked = true;
   }
 }
 

src/ota_stm32h5.c

@@ -2,7 +2,7 @@
 #include "log.h"
 #include "ota.h"
 
-#if MG_OTA == MG_OTA_STM32H5
+#if MG_OTA == MG_OTA_STM32H5 || MG_OTA == MG_OTA_STM32C5
 
 static bool mg_stm32h5_write(void *, const void *, size_t);
 static bool mg_stm32h5_swap(void);
@@ -39,13 +39,14 @@ static uint32_t sectors_per_bank(void) {
 }
 
 static void flash_unlock(void) {
-  static bool unlocked = false;
-  if (unlocked == false) {
+  if (MG_REG(FLASH_NSCR) & MG_BIT(0)) {
     MG_REG(FLASH_KEYR) = 0x45670123;
-    MG_REG(FLASH_KEYR) = 0Xcdef89ab;
+    MG_REG(FLASH_KEYR) = 0xcdef89ab;
+  }
+
+  if (MG_REG(FLASH_OPTCR) & MG_BIT(0)) {
     MG_REG(FLASH_OPTKEYR) = 0x08192a3b;
     MG_REG(FLASH_OPTKEYR) = 0x4c5d6e7f;
-    unlocked = true;
   }
 }
 

src/ota_stm32h7.c

@@ -53,24 +53,24 @@ MG_IRAM static bool is_dualbank(void) {
 }
 
 MG_IRAM static void flash_unlock(void) {
-  static bool unlocked = false;
-  if (unlocked == false) {
-    MG_REG(FLASH_BASE1 + FLASH_KEYR) = 0x45670123;
-    MG_REG(FLASH_BASE1 + FLASH_KEYR) = 0xcdef89ab;
-    if (is_dualbank()) {
-      MG_REG(FLASH_BASE2 + FLASH_KEYR) = 0x45670123;
-      MG_REG(FLASH_BASE2 + FLASH_KEYR) = 0xcdef89ab;
-    }
-    MG_REG(FLASH_BASE1 + FLASH_OPTKEYR) = 0x08192a3b;  // opt reg is "shared"
-    MG_REG(FLASH_BASE1 + FLASH_OPTKEYR) = 0x4c5d6e7f;  // thus unlock once
-    unlocked = true;
+  if (MG_REG(FLASH_BASE1 + FLASH_CR) & MG_BIT(0)) {
+	  MG_REG(FLASH_BASE1 + FLASH_KEYR) = 0x45670123;
+	  MG_REG(FLASH_BASE1 + FLASH_KEYR) = 0xcdef89ab;
+  }
+  if (is_dualbank() && MG_REG(FLASH_BASE2 + FLASH_CR) & MG_BIT(0)) {
+	  MG_REG(FLASH_BASE2 + FLASH_KEYR) = 0x45670123;
+	  MG_REG(FLASH_BASE2 + FLASH_KEYR) = 0xcdef89ab;
+  }
+  if (MG_REG(FLASH_BASE1 + FLASH_OPTCR) & MG_BIT(0)) {
+	  MG_REG(FLASH_BASE1 + FLASH_OPTKEYR) = 0x08192a3b;  // opt reg is "shared"
+	  MG_REG(FLASH_BASE1 + FLASH_OPTKEYR) = 0x4c5d6e7f;  // thus unlock once
   }
 }
 
-MG_IRAM static bool flash_page_start(volatile uint32_t *dst) {
+MG_IRAM static bool flash_page_start(uint32_t *dst) {
   char *base = (char *) s_mg_flash_stm32h7.start,
        *end = base + s_mg_flash_stm32h7.size;
-  volatile char *p = (char *) dst;
+  char *p = (char *) dst;
   return p >= base && p < end && ((p - base) % s_mg_flash_stm32h7.secsz) == 0;
 }
 
@@ -101,7 +101,7 @@ MG_IRAM static uint32_t flash_bank(void *addr) {
 // read-while-write, no need to disable IRQs for standalone usage
 MG_IRAM static bool mg_stm32h7_erase(void *addr) {
   bool ok = false;
-  if (flash_page_start(addr) == false) {
+  if (flash_page_start((uint32_t *) addr) == false) {
     MG_ERROR(("%p is not on a sector boundary", addr));
   } else {
     uintptr_t diff = (char *) addr - (char *) s_mg_flash_stm32h7.start;

src/printf.c

@@ -71,8 +71,10 @@ char *mg_mprintf(const char *fmt, ...) {
 }
 
 void mg_pfn_stdout(char c, void *param) {
+#if MG_ENABLE_POSIX_FS
   putchar(c);
-  (void) param;
+#endif
+  (void) param, (void) c;
 }
 
 static size_t print_ip4(void (*out)(char, void *), void *arg, uint8_t *p) {

src/printf.h

@@ -34,15 +34,15 @@ char *mg_mprintf(const char *fmt, ...);
 size_t mg_queue_printf(struct mg_queue *, const char *fmt, ...);
 
 // Built-in %M/%m printer functions. Each reads its argument(s) from ap.
-size_t mg_print_base64(mg_pfn_t, void *arg, va_list *ap);   // expects: const void *buf, size_t len
+size_t mg_print_base64(mg_pfn_t, void *arg, va_list *ap);   // expects: int len, uint8_t *buf
 size_t mg_print_esc(mg_pfn_t, void *arg, va_list *ap);      // expects: int len, const char *str -- use MG_ESC()
-size_t mg_print_hex(mg_pfn_t, void *arg, va_list *ap);      // expects: const void *buf, size_t len
+size_t mg_print_hex(mg_pfn_t, void *arg, va_list *ap);      // expects: int len, uint8_t *buf
 size_t mg_print_ip(mg_pfn_t, void *arg, va_list *ap);       // expects: const struct mg_addr *
 size_t mg_print_ip_port(mg_pfn_t, void *arg, va_list *ap);  // expects: const struct mg_addr *
 size_t mg_print_ip4(mg_pfn_t, void *arg, va_list *ap);      // expects: uint32_t *ipv4
 size_t mg_print_ip6(mg_pfn_t, void *arg, va_list *ap);      // expects: uint8_t[16] ipv6
 size_t mg_print_mac(mg_pfn_t, void *arg, va_list *ap);      // expects: uint8_t[6] mac
-size_t mg_print_ieee64(mg_pfn_t, void *arg, va_list *ap);   // expects: uint64_t
+size_t mg_print_ieee64(mg_pfn_t, void *arg, va_list *ap);   // expects: uint8_t[8] ieee64
 size_t mg_print_l2addr(mg_pfn_t, void *arg, va_list *ap);   // expects: uint8_t l2, uint8_t[n] n-byte l2-dependent address
 size_t mg_print_html_esc(mg_pfn_t, void *arg, va_list *ap); // expects: int len, const char *str -- use MG_ESC()
 

src/sntp.h

@@ -29,7 +29,6 @@ uint64_t mg_now(void);
 //     MG_INFO(("every second"));
 //   }
 // Full examples:
-//   tutorials/http/http-server/arduino/teensy41-http,
 //   tutorials/mqtt/mqtt-client
 // Related APIs:
 //   mg_millis(), mg_now()

src/sock.c

@@ -1,6 +1,6 @@
-#include "dns.h"
 #include "event.h"
 #include "log.h"
+#include "mdash.h"
 #include "net.h"
 #include "printf.h"
 #include "str.h"
@@ -449,6 +449,7 @@ void mg_connect_resolved(struct mg_connection *c) {
     if (rc == 0) {                       // Success
       setlocaddr(FD(c), &c->loc);
       mg_call(c, MG_EV_CONNECT, NULL);   // Send MG_EV_CONNECT to the user
+      if (c->is_tls_hs) mg_tls_handshake(c);
       if (!c->is_tls_hs) c->is_tls = 0;  // user did not call mg_tls_init()
     } else if (MG_SOCK_PENDING(rc)) {    // Need to wait for TCP handshake
       MG_DEBUG(("%lu %ld -> %M pend", c->id, c->fd, mg_print_ip_port, &c->rem));
@@ -465,6 +466,14 @@ static MG_SOCKET_TYPE raccept(MG_SOCKET_TYPE sock, union usa *usa,
   do {
     memset(usa, 0, sizeof(*usa));
     fd = accept(sock, &usa->sa, len);
+#if MG_ENABLE_FREERTOS_TCP
+    // FreeRTOS_accept() returns NULL to mean "no pending connection",
+    // therefore we avoid retrying it forever on non-blocking listeners
+    if (fd == NULL) {
+      fd = MG_INVALID_SOCKET;
+      break;
+    }
+#endif
   } while (MG_SOCK_INTR(fd));
   return fd;
 }
@@ -759,15 +768,12 @@ void mg_mgr_poll(struct mg_mgr *mgr, int ms) {
   now = mg_millis();
   mg_timer_poll(&mgr->timers, now);
   mg_ota_poll(mgr);
+  mg_mdash_poll(mgr);
 
   for (c = mgr->conns; c != NULL; c = tmp) {
-    bool is_resp = c->is_resp;
+    long flush = 0;
     tmp = c->next;
     mg_call(c, MG_EV_POLL, &now);
-    if (is_resp && !c->is_resp) {
-      long n = 0;
-      mg_call(c, MG_EV_READ, &n);
-    }
     MG_VERBOSE(("%lu %c%c %c%c%c%c%c %lu %lu", c->id,
                 c->is_readable ? 'r' : '-', c->is_writable ? 'w' : '-',
                 c->is_tls ? 'T' : 't', c->is_connecting ? 'C' : 'c',
@@ -782,10 +788,12 @@ void mg_mgr_poll(struct mg_mgr *mgr, int ms) {
     } else {
       if (c->is_readable) read_conn(c);
       if (c->is_writable) write_conn(c);
-      if (c->is_tls && !c->is_tls_hs && c->send.len == 0) mg_tls_flush(c);
+      if (c->is_tls && !c->is_tls_hs && c->send.len == 0)
+        flush = mg_tls_flush(c);
     }
 
-    if (c->is_draining && c->send.len == 0) c->is_closing = 1;
+    if (flush == MG_IO_ERR) mg_error(c, "tx err");
+    if (c->is_draining && c->send.len == 0 && flush == 0) c->is_closing = 1;
     if (c->is_closing) close_conn(c);
   }
 }