fix: bump lib/nrfx and lib/tinyusb together, fix the fallout (#19)

* fix: bump lib/nrfx and lib/tinyusb together, fix the fallout

Renovate's PR #11 (nrfx digest) and #12 (tinyusb digest) each failed CI on
every board. Investigated both:

- nrfx alone (bumped to Renovate's target, nrfx 4.5.0/1b7bedb) breaks the
  build immediately: nrfx 4.0 restructured its whole layout (mdk/ ->
  bsp/stable/mdk/, etc.), so this repo's Makefile IPATHs can't find nrf.h at
  all. That's a real rework, not a digest bump - pinned to v3.14.0 instead,
  the last tag before the 4.0 restructure.
- tinyusb alone (Renovate's target, 5c0e31c) fails to compile against the
  old 2019 nrfx pin: its nrf5x USB port calls nrfx's chip-errata functions
  (nrf52_errata_199()) that don't exist yet at that nrfx version. The two
  submodules move together.

With nrfx at v3.14.0 and tinyusb at 5c0e31c, three more issues surfaced,
all fixed here:
- tinyusb merged device/usbd_control.c into usbd.c; the Makefile's hardcoded
  tinyusb C_SRC list still named the now-gone file.
- nrfx renamed nrf_wdt_started()/nrf_wdt_request_status() in the WDT HAL
  (see lib/nrfx/CHANGELOG.md) - the one in-repo call site needed updating.
- nrfx's gcc_startup_<mcu>.S (since nrfx 3.x) copies .data via
  __data_start/__data_end (no trailing underscore) instead of this repo's
  __data_start__/__data_end__, plus three new RAM-loaded regions
  (.sdata/.tdata/.fast) nothing here uses. Added alias symbols and
  zero-length filler for the unused regions to linker/nrf_common.ld -
  deliberately not swapping in nrfx's own updated linker script, which also
  redefines .bss/.noinit placement and would fight this repo's board .ld
  files' fixed-address NOINIT region (BLE bond exchange across a DFU
  reset).

Verified: all 14 boards build and link clean via tools/build_all.py.

Not done here: real hardware testing. This is still the multi-year
boot-critical submodule bump AGENTS.md already flagged as needing it
before merge - a clean build is necessary, not sufficient.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* docs: record the CURRENT.UF2 restore gotcha found during hardware testing

Real RAK4631 hardware testing for this branch (see PR #19) hit this:
restoring an app via ghostfat's live CURRENT.UF2 dump left the device
hung on boot even though the bytes matched what was there before. A
normal release UF2 or OTA-DFU flash both worked fine immediately after.
Recording it so it doesn't get mistaken for a regression from this PR's
actual change (nrfx/tinyusb) next time someone hits it.

* docs: update the CURRENT.UF2 gotcha now that it's fixed, not untriaged

#20 root-caused and fixed what this note previously flagged as an open
mystery hit during this PR's hardware testing.

---------

Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>

Author: jamesarich

AGENTS.md

@@ -84,12 +84,26 @@ the vendored `lib/tinyusb`. `cmsis/` is ARM CMSIS headers.
 
 `lib/nrfx`, `lib/tinyusb`, `lib/uf2` are git submodules, **not** vendored
 copies — `git submodule update --init --recursive` is required before any
-build. They are also **years out of date** (checked 2026-08-18: nrfx pinned
-2019, tinyusb 2021, uf2 2020, all several years behind upstream HEAD).
-`renovate.json` now surfaces bump PRs on a daily schedule instead of leaving
-that invisible, but nothing bumps them automatically — these are
-boot-critical, and a multi-year jump needs real hardware testing before
-merge, not a bot auto-merge.
+build. `renovate.json` surfaces bump PRs on a daily schedule, but nothing
+bumps them automatically — these are boot-critical, and a version jump needs
+real hardware testing before merge, not a bot auto-merge.
+
+`lib/nrfx` is deliberately pinned to **v3.14.0**, not the latest commit
+Renovate will keep proposing. nrfx 4.0 restructured the entire repo layout
+(`mdk/` → `bsp/stable/mdk/`, among others) — a jump to it would need this
+repo's Makefile `IPATH`s and every board's linker script reworked, not just
+a digest bump. v3.14.0 is the last tag on the pre-4.0 layout, so it's the
+practical ceiling for a same-day bump; going past it is a real project, not
+a Renovate merge. If a future Renovate PR targets nrfx ≥4.0, that's this
+gotcha firing — don't merge it without doing that rework.
+
+`lib/tinyusb`'s `nrf5x` USB port (`dcd_nrf5x.c`) calls nrfx's chip-specific
+errata functions (e.g. `nrf52_errata_199()`) — bumping tinyusb alone,
+without nrfx at a version new enough to define them, fails to compile. The
+two submodules move together, not independently, which is why Renovate's
+separate per-submodule PRs (#11, #12 as originally filed) each failed CI on
+their own; see the `linker/nrf_common.ld` gotcha below for the other half of
+what that joint bump needed.
 
 `lib/softdevice/` vendors Nordic's SoftDevice binaries directly (not a
 submodule) — `SD_NAME`/`SD_VERSION` in `Makefile` select which one.
@@ -128,8 +142,31 @@ itself; a human has to edit it too.
   PlatformIO target names, never by this repo's directory names. Renaming a
   board directory here for "consistency" achieves nothing functionally and
   risks breaking `UF2_BOARD_ID`/build-artifact filenames for no benefit.
+- **`linker/nrf_common.ld` needs `__data_start`/`__sdata_*`/`__tdata_*`/`__fast_*`
+  symbols since nrfx 3.x.** `lib/nrfx/mdk/gcc_startup_<mcu>.S`'s data-copy loop
+  changed from this repo's `__data_start__`-style (double underscore) names to
+  plain `__data_start`, plus three new RAM-loaded regions (`.sdata`/`.tdata`/
+  `.fast`) nothing in this codebase actually uses. **Do not** pull in nrfx's own
+  updated `mdk/nrf_common.ld` to get these — it also redefines `.bss`/`.noinit`
+  placement, which would silently fight this repo's board `.ld` files (e.g.
+  `linker/nrf52840.ld`'s fixed-address `NOINIT` region used for BLE bond
+  exchange across a DFU reset). The fix already applied is a handful of alias
+  assignments plus zero-length filler for the three unused regions — extend
+  that pattern, don't replace the file.
 - **Board gaps are tracked as issues, not guessed at.** `Meshtastic-Android`
   flags `NANO_G2_ULTRA` and `NOMADSTAR_METEOR_PRO` as needing bootloader
   upgrade support with no board here yet (issues #4, #5) — bringing up a
   new board needs real hardware to get `UF2_BOARD_ID`/VID-PID/pin defs
   right; don't fabricate a `board.h` without one.
+- **`CURRENT.UF2` dump-and-restore used to hang the device — fixed in #20,
+  don't reintroduce it.** Root cause: `CURRENT.UF2` was sized off the max
+  possible app region (`TRUE_USER_FLASH_SIZE`) instead of the real
+  installed app, AND `msc_uf2.c`'s UF2-app-flash completion path never
+  recorded the real app size into `bootloader_settings.bank_0_size` (stayed
+  0 from a `memset`, only the DFU-serial protocol populated it). Together
+  that meant restoring a `CURRENT.UF2` dump byte-for-byte could still hang
+  the device on boot. Both fixed together in #20 (`ghostfat.c`'s
+  `current_flash_size()` + `msc_uf2.c`'s `update_status.app_size`) —
+  verified on real RAK4631 hardware, the same dump-and-restore sequence
+  that hung now completes in ~2 seconds. If you change either of those two
+  files, check this still holds.

Makefile

@@ -194,7 +194,6 @@ C_SRC += \
 	$(TUSB_PATH)/portable/nordic/nrf5x/dcd_nrf5x.c \
 	$(TUSB_PATH)/common/tusb_fifo.c \
 	$(TUSB_PATH)/device/usbd.c \
-	$(TUSB_PATH)/device/usbd_control.c \
 	$(TUSB_PATH)/class/cdc/cdc_device.c \
 	$(TUSB_PATH)/class/msc/msc_device.c \
 	$(TUSB_PATH)/tusb.c

lib/nrfx

@@ -117,7 +117,7 @@ static void wait_for_events(void)
 
     // Feed all Watchdog just in case application enable it
     // WDT cannot be disabled once started. It even last through NVIC soft reset
-    if ( nrf_wdt_started(NRF_WDT) )
+    if ( nrf_wdt_started_check(NRF_WDT) )
     {
       for (uint8_t i=0; i<8; i++) nrf_wdt_reload_request_set(NRF_WDT, i);
     }

lib/sdk11/components/libraries/bootloader_dfu/bootloader.c

@@ -123,6 +123,19 @@ SECTIONS
 
     } > RAM
 
+    /* nrfx's gcc_startup_*.S (since nrfx 3.x) copies .data via these
+     * non-double-underscore names, plus three more RAM-loaded regions
+     * (.sdata/.tdata/.fast) this board never places anything into.
+     * Aliased/zero-length here rather than pulled from nrfx's own
+     * nrf_common.ld, which also redefines .noinit/.bss placement that
+     * this bootloader deliberately overrides per-board (see linker/nrf52840.ld). */
+    __data_start   = __data_start__;
+    __data_end     = __data_end__;
+    __data_load_start = __etext;
+    __sdata_start = .; __sdata_end = .; __sdata_load_start = .;
+    __tdata_start = .; __tdata_end = .; __tdata_load_start = .;
+    __fast_start  = .; __fast_end  = .; __fast_load_start  = .;
+
     .bss :
     {
         . = ALIGN(4);