When ptpd runs over IEEE 802.3 (-2) with hardware timestamping and
ETHTOOL_GET_TS_INFO does not report SOF_TIMESTAMPING_TX_HARDWARE,
SOF_TIMESTAMPING_RX_HARDWARE and SOF_TIMESTAMPING_RAW_HARDWARE for the
interface, refuse to start instead of logging a warning and running in
software - the same way linuxptp/ptp4l refuses to start when hardware
timestamping is configured but not reported as supported by ethtool,
rather than silently degrading. The error message names the missing
capability and points to -S, and the usage text documents the
requirement.
Hardware RX timestamps are required as well: without them the receive
timestamps come from the system clock while the transmit ones come from
the MAC, and the two cannot be combined into a meaningful delay.
The check is limited to the 802.3 transport, the only one on which ptpd
retrieves hardware TX timestamps. -H is the default with
CONFIG_NET_TIMESTAMP, so applying it to the UDP transports would make a
plain "ptpd" refuse to start on any interface whose driver does not
report hardware timestamping, although it never needs that capability.
Assisted-by: Claude:claude-sonnet-5
Signed-off-by: Daniel P. Carvalho <danieloak@gmail.com>
Query interface hardware timestamping capabilities with the SIOCETHTOOL
ETHTOOL_GET_TS_INFO ioctl during initialization, the same way
linuxptp/ptp4l does on Linux, instead of detecting support through
runtime trial and error. If the query itself fails, refuse to start.
Remove the consecutive failure counter (hwts_tx_failures,
PTP_HWTS_TX_MAX_FAILURES, hwts_tx_disabled). When hardware TX
timestamping is supported and requested, report genuine runtime timeouts
as errors (ptperr) instead of silently downgrading to software
timestamping. Invalidate clock_source_valid in ptpd status while a
hardware TX timestamp failure persists.
Assisted-by: Gemini:gemini-3.8-pro
Assisted-by: Claude:claude-sonnet-5
Signed-off-by: Daniel P. Carvalho <danieloak@gmail.com>
The frame leaves the MAC later than the moment its hardware transmit
timestamp is latched, because of the clock domain crossing and the PHY.
This fixed delay is the egressLatency port parameter of IEEE 1588.
Add the configured latency to every hardware transmit timestamp
obtained through MSG_ERRQUEUE, the counterpart of the ingress
compensation.
- Add CONFIG_NETUTILS_PTPD_EGRESS_LATENCY_NS (default 0, which applies
no compensation).
- Add the -O option to override it at run time.
- Add egress_latency_ns to struct ptpd_config_s.
Software timestamps are not affected.
Assisted-by: Claude:claude-sonnet-5
Signed-off-by: Daniel P. Carvalho <danieloak@gmail.com>
Timestamp transmitted event messages with the hardware clock instead of
reading the clock after sendmsg() returns.
When hardware timestamping is selected on an AF_PACKET socket, request
SOF_TIMESTAMPING_TX_HARDWARE for each event message, wait for the
looped-back packet on the error queue with MSG_ERRQUEUE, and take the
timestamp from its SO_TIMESTAMPING control message, as on Linux. Sync,
Delay_Req and Pdelay_Req get their real departure time.
- Use a transmit socket of its own, separate from the event socket, so
the error queue is not shared with received packets.
- Handle POLLERR separately from POLLIN in the main loop and drain all
pending packets on each wakeup.
- If the timestamp does not arrive, fall back to a software timestamp
taken before the frame is sent. After three consecutive failures the
driver is assumed not to provide hardware transmit timestamps, a
warning is printed once and only software timestamps are used, so a
driver without support does not stall the daemon.
- Take the software timestamp before sending in every mode. It used to
be taken after sendmsg() returned, so a fast peer's reply could appear
to arrive before the request had left and give a negative delay.
- Accept a measured path delay down to -100 microseconds and clamp it to
zero, since hardware timestamps on both ends can make a short link
measure slightly negative.
Assisted-by: Claude:claude-sonnet-5
Signed-off-by: Daniel P. Carvalho <danieloak@gmail.com>
A single Sync sample whose receive timestamp was taken late, for
example because the task was scheduled late with software
timestamping, was fed straight into the phase correction and the
drift estimate, and could pull the clock away from the master.
- Add CONFIG_NETUTILS_PTPD_OUTLIER_THRESHOLD_NS (default 0, which
disables the check). A phase error that differs by more than this
many nanoseconds from the median of the last five accepted samples
is discarded, with a warning.
- Accept the sample after eight consecutive rejections and restart
the history from it, so that a real step of the master is still
followed while a short burst of disturbed samples is ridden out.
- Restart the history whenever the clock is stepped, since the old
samples no longer describe the new time base.
- With the default of 0 the behaviour is unchanged.
Signed-off-by: Daniel P. Carvalho <danieloak@gmail.com>
Assisted-by: Claude:claude-sonnet-5
PR #3789 replaced the in-memory sigqueue + shared memory IPC in ptpd_status()
with file-based IPC to support Protected and Kernel modes across address
spaces. However, on microcontrollers running CONFIG_BUILD_FLAT, a filesystem
or /tmp (TMPFS) is rarely mounted or available, causing ptpd_status() to fail
with -ETIMEDOUT (errno 110) because the status file cannot be created.
Retain the file-based IPC for !CONFIG_BUILD_FLAT (Protected and Kernel modes)
while restoring the zero-overhead in-memory sigqueue + semaphore IPC for
CONFIG_BUILD_FLAT. Both modes share the status serialization logic via
ptp_populate_status() and support all fields including P2P.
Assisted-by: Gemini:gemini-3.8-flash-medium
Signed-off-by: Daniel P. Carvalho <danieloak@gmail.com>
The MAC latches a hardware receive timestamp later than the frame
reaches the wire, because of the PHY and the clock domain crossing.
This fixed delay is the ingressLatency port parameter of IEEE 1588 and
shows up as a constant phase error between the local and the master
clock.
Subtract the configured latency from every hardware receive timestamp
in ptp_getrxtime(), the single place where they enter the daemon, so
Sync, Delay_Resp and the peer delay messages are all corrected.
- Add CONFIG_NETUTILS_PTPD_INGRESS_LATENCY_NS (default 0, which applies
no compensation).
- Add the -I option to override it at run time.
- Add ingress_latency_ns to struct ptpd_config_s.
Software timestamps are not affected.
Assisted-by: Claude:claude-sonnet-5
Signed-off-by: Daniel P. Carvalho <danieloak@gmail.com>
When state->clockid is configured to a hardware PTP clock device
(e.g., /dev/ptp0) instead of CLOCK_REALTIME, ptp_adjtime() previously
passed only the measured frequency drift (-ppb) to clock_adjtime(),
ignoring the residual phase offset (delta_ns / adjustment_ns).
As a result, while the hardware counter tracked frequency, its phase
was never pulled into alignment with the master clock.
Convert delta_ns (which combines frequency drift and current phase error
clamped to max_adjust_ns) to ppb over CONFIG_CLOCK_ADJTIME_PERIOD_MS,
acting as a proportional-integral (PI) phase servo. This drives the
hardware clock to phase lock with the master via POSIX clock_adjtime()
using ADJ_FREQUENCY without requiring proprietary ioctl calls.
Assisted-by: Claude:claude-sonnet-5
Assisted-by: Gemini:gemini-3.8-flash-medium
Signed-off-by: Daniel P. Carvalho <danieloak@gmail.com>
A single drift-rate sample computed between two consecutive sync
updates was clamped against CLOCK_ADJTIME_SLEWLIMIT_PPM - the
hardware's slew-rate safety limit, not a bound on how large a real
crystal-oscillator drift measurement can plausibly be. An abnormally
short or long measurement interval (e.g. right after a clock
source outage/reconnect, or a burst of closely spaced sync packets
following packet loss) could therefore produce a wildly implausible
sample that still passed the check and corrupted the long-term
drift_ppb average.
Add CONFIG_NETUTILS_PTPD_MAX_DRIFT_PPB (default 500000, well above
any real crystal's few-hundred-ppm drift) as a dedicated plausibility
bound, intentionally much tighter than CLOCK_ADJTIME_SLEWLIMIT_PPM.
A sample outside this bound is discarded and the previous averaged
drift_ppb is kept unchanged instead of being corrupted.
Assisted-by: Claude:claude-sonnet-5
Signed-off-by: Daniel P. Carvalho <danieloak@gmail.com>
Implements the Peer-to-Peer (P2P) transparent clock delay measurement
mechanism (IEEE 1588-2008 §11.4 / IEEE 802.1AS / IEC/IEEE 61850-9-3)
in apps/netutils/ptpd:
- Add PTP_MSGTYPE_PDELAY_REQ, PTP_MSGTYPE_PDELAY_RESP, and
PTP_MSGTYPE_PDELAY_RESP_FOLLOW_UP definitions and structs in ptpv2.h.
- Define IEEE 1588-2008 Annex F peer delay multicast MAC address
01:80:c2:00:00:0e and Annex D peer delay IP address 224.0.0.107.
- Replace bool delay_e2e with enum ptp_delay_mechanism_e (PTP_DELAY_NONE,
PTP_DELAY_E2E, PTP_DELAY_P2P) in include/netutils/ptpd.h.
- Add -P CLI option in system/ptpd/ptpd_main.c with mutual exclusion
check against -E, and display last_transmitted_pdelayreq in status.
- Implement responder logic in ptp_process_pdelay_req() sending
Pdelay_Resp (t2) and Pdelay_Resp_Follow_Up (t3) regardless of master
or slave state.
- Implement requester logic in ptp_send_pdelay_req() gated on the
physical link without requiring prior BMCA master selection.
- Implement ptp_process_pdelay_resp() and
ptp_process_pdelay_resp_followup() using canonical mean path delay
formula ((t4 - t1) - (t3 - t2)) / 2.
- Refactor path delay bounds checking and moving average filter into
ptp_record_path_delay() shared across E2E and P2P mechanisms.
- Set PTP version 2.0 and controlField 0x05 in Pdelay_Req, Pdelay_Resp
and Pdelay_Resp_Follow_Up, and in the own-identity header, so that
peers such as linuxptp accept the messages.
- Clear pdelay_waiting_followup when a new Pdelay_Req is sent, so an
orphaned Pdelay_Resp_Follow_Up from an abandoned cycle is not paired
with stale timestamps.
- Warn at startup when P2P is selected without CONFIG_SCHED_TICKLESS,
since a tick-driven clock cannot resolve the peer delay.
- Skip IP multicast join/leave handling for AF_PACKET.
Assisted-by: Claude:claude-sonnet-5
Assisted-by: Gemini:gemini-3.8-flash-medium
Signed-off-by: Daniel P. Carvalho <danieloak@gmail.com>
ptp_sendmsg() called a blocking recvmsg(state->tx_socket, ...) right
after sending a Delay_Req whenever hardware_ts was set, assuming a
Linux-style MSG_ERRQUEUE/loopback semantics NuttX does not have.
Since tx_socket and event_socket share the same underlying
connection, this call instead blocked on and consumed whatever PTP
packet arrived next on the wire — almost always the Delay_Resp,
which typically arrives within milliseconds of the request. Its
payload was read into a local buffer that went out of scope on
return, so the packet never reached ptp_process_rx_packet() and
path_delay_ns stayed at 0 in -H mode. t3 is now captured locally
via ptp_gettime(), the same way -S mode already did, until
hardware TX timestamping is supported.
Also replaces the path delay heuristic in ptp_process_delay_resp()
(which derived an approximation of (t2-t1) from path_delay_ns and
last_delta_ns, only valid once the clock had already converged) with
the canonical IEEE 1588-2008 §11.3 formula: store (t2-t1) directly
from Sync/Follow_Up as sync_diff_ns, then average it with (t4-t3)
from the Delay_Req/Delay_Resp exchange. Relaxes the path delay
ceiling to 10ms unconditionally, since Delay_Req's t3 is software-
timestamped in both modes until hardware TX timestamping is supported.
Assisted-by: Claude:claude-sonnet-5
Assisted-by: Gemini:gemini-3.8-flash-medium
Signed-off-by: Daniel P. Carvalho <danieloak@gmail.com>
Replace the sigqueue + shared-memory IPC mechanism in ptpd_status()
with a file-based approach:
- Daemon side: on SIGUSR1, write a binary ptpd_status_s struct to
a temp file and atomically rename it to the status path.
- Client side: send kill(SIGUSR1), poll for the file to appear,
then read the struct back.
This removes the CONFIG_BUILD_FLAT restriction (the old code returned
-ENOTSUP for Protected and Kernel builds) and avoids passing pointers
across address spaces via sigqueue. The status file path is
configurable via NETUTILS_PTPD_STATUSFILE (default /tmp/ptpd.status).
The atomic temp + rename pattern ensures readers never see a partial
write.
Signed-off-by: wenquan1 <wenquan1@xiaomi.com>
The IGMP multicast join (ipmsfilter) was previously called before
the interface address (interface_addr) was populated via SIOCGIFADDR.
This meant the IGMP join had to locate the network device without
a valid local address, which could fail or join on the wrong interface.
Move the multicast group subscription to after the interface address
is queried, and guard it with an AF_INET check since IGMP only applies
to IPv4. This ensures the IGMP join can always locate the correct
network device.
Signed-off-by: wenquan1 <wenquan1@xiaomi.com>
Add ptpinfo()/ptpwarn() calls, gated by the existing
CONFIG_DEBUG_PTP_INFO/_WARN symbols (zero cost when disabled), at
points that previously failed silently: an unrecognized L2 protocol,
a domain mismatch, and a Delay_Resp rejected by the source/requester
identity check. These were essential to diagnosing the drift and
Delay_Req bugs fixed in the two preceding commits on real hardware,
and are kept for future maintainers debugging this path.
Assisted-by: Claude:claude-sonnet-5
Assisted-by: Gemini:gemini-3.8-flash-medium
Signed-off-by: Daniel P. Carvalho <danieloak@gmail.com>
1. On AF_PACKET SOCK_RAW sockets in NuttX, msg_name must be NULL because
the destination MAC address is already contained in the Ethernet header.
Previously, passing sockaddr_in caused sendmsg() to fail immediately
with -EAFNOSUPPORT, completely blocking transmission of Delay_Req.
2. Correct PTP primary multicast MAC address to 01:1b:19:00:00:00
(IEEE 1588 Annex F) and ensure ether_type is in network byte order.
3. Initialize delayreq_interval to 1 second default and guard against 0.
4. Set logmessageinterval to 0x7f (IEEE 1588-2008 Table 23 sentinel for
Delay_Req) instead of inheriting 0 from the announce header template.
5. Update PTP version to 0x12 (2.1, minorVersionPTP=1) to match the
value used by mature implementations such as linuxptp.
Assisted-by: Claude:claude-sonnet-5
Assisted-by: Gemini:gemini-3.8-flash-medium
Signed-off-by: Daniel P. Carvalho <danieloak@gmail.com>
1. Post-jump drift bootstrap: on the first Sync packet following a step
jump, do not compute frequency drift against a synthesized zero delta,
which previously caused the entire residual phase offset (~ms) to be
mistaken for frequency drift (~million ppb) and immediately absorbed.
2. Drift rate formula: normalize the adjustment contribution by the actual
measurement interval instead of the adjtime slew period, and compute
natural delta rate as (delta - last_delta + last_adjtime) / interval.
3. Remove broken last_delta > delta comparison that prevented offsets from
converging and applied inverted corrections on negative overshoots.
4. Correct ptp_adjtime() invocation to always pass adjustment_ns for
CLOCK_REALTIME slewing rather than dropping drift compensation when
delta exceeds threshold. Clamp adjustment_ns to the hardware slew limit
so last_adjtime_ns accurately mirrors the true slew applied.
5. Enable Delay_Req in E2E mode once clock is tracking (not jumping) and
allow software timestamping latency in ptp_process_delay_resp().
6. Propagate initialization return code from ptpd_start() and avoid
unconditional failure print in do_ptpd_start().
Assisted-by: Claude:claude-sonnet-5
Assisted-by: Gemini:gemini-3.8-flash-medium
Signed-off-by: Daniel P. Carvalho <danieloak@gmail.com>
The uLUt and libshvc declare headers intended for make export
by EXPORTED_INCLUDES mechanism implemented during 2026
Micowindows GSoC. The shv-libs4c has been updated as well
to support newer pyshv versions and that way firmware updates
when shv-nxboot-updater is used through pyshv based shvflasher.py
and related GUI.
For pyshv see https://github.com/silicon-heaven/pyshv
New commits from shv-libs4c project
https://github.com/silicon-heaven/shv-libs4c
- shv_com_common: shv_unpack_discard and shv_unpack_skip
required to skip additional parameters and query requests
introduced introduced by newer silicon-heaven protocol
and pyshv. Incorrect skipping was a bug even against
previous protocol version but did not present itself because
older pyshv did not send additional requests which need
to be ignored.
- shv_file_node: small, but crucial unpack change
Ignore any other messages than PARAM in file node's write unpack
function. Other different states should be handled, too.
- shv_file_node: fix the CRC unpack method too
Any other messages than PARAM are ignored.
- shv_com: add a method to close a connection only
- shv_dotdevice_node.c: close the conn with the other side when resetted
- shv_com.h: use array designators for error strings
- libshvtree: move shv_con_errno_strs to the C file to not waste space
by copies
- shvtree/shv_clayer_posix: provide alternative socketpair notification
support
This allows to use shv-libs4c and related pysimCoder support
on RTEMS system which does not provide functional pipe
directive/system call but BSD networking supported local/UNIX
socket pair is fully supported.
Signed-off-by: Pavel Pisa <ppisa@pikron.com>
Expose the upstream HIGH_PERFORMANCE mode through
CONFIG_LIB_MQTT5_HIGH_PERFORMANCE and enable it by default. This keeps
normal embedded builds lightweight while allowing developers to restore
Paho heap and call-stack diagnostics when investigating library issues.
Signed-off-by: raiden00pl <raiden00@railab.me>
Assisted-by: OpenAI Codex:gpt-5
Add CONFIG_LIB_MQTT5_THREAD_STACKSIZE for threads created
internally by Paho and use it in Thread.c.
Keep CONFIG_UTILS_MQTT5_STACKSIZE scoped to the two utility
application tasks.
This permits S2OPC to enable MQTT through LIB_MQTT5 without
also building unrelated command-line utilities.
Signed-off-by: raiden00pl <raiden00@railab.me>
Assisted-by: OpenAI Codex:gpt-5
The bundled patch still contains an MQTTPacket.h hunk for a bool
typedef that no longer exists in Paho 1.3.15. Make and CMake both
hide the resulting rejection, allowing a partially patched source
tree to be compiled. Remove the stale hunk and make patch failures
fatal.
The Make context target also allows VersionInfo.h generation to
race source extraction under parallel builds. Make the generated
header depend on the extraction target so the input template is
present first.
The publisher and subscriber samples live below src/samples but
include public headers from src. Add the Paho source include directory
to the Make flags, matching the CMake targets, so CONFIG_UTILS_MQTT5
builds both utilities.
Finally, define distclean independently of whether the downloaded
tree exists when Make parses the file. Remove package-owned archives
and sources while preserving a developer Git checkout, and ignore
those downloaded paths.
Signed-off-by: raiden00pl <raiden00@railab.me>
Assisted-by: OpenAI Codex:gpt-5
ostest's "vfork" test was never testing vfork(). It has the child write a
global and the parent observe the write -- the defining property of *sharing*,
not of vfork(), whose defining property is that the parent is suspended and
whose contract forbids the child to write anything at all. It passed because
NuttX implemented fork() and vfork() as the same sharing primitive, which
apache/nuttx#19562 separates.
vfork.c is rewritten to test what vfork() promises. The child does only what
POSIX permits -- it calls _exit(42) and nothing else, not even exit(), which
would run atexit handlers and flush stdio in the parent's address space. Since
the child may not write memory and the parent cannot run while the child lives,
the observable is the child's exit status: had the parent not been suspended,
it would have reached waitpid() while the child was still alive. Where child
status is not retained -- ostest_main() sets SA_NOCLDWAIT for the whole run,
deliberately -- ECHILD is accepted as equally good evidence, since it says the
child was already gone when the parent asked.
fork.c is new and tests POSIX fork(): the child's writes to .data, .bss and
the heap are invisible to the parent and vice versa, a pointer to a stack local
taken before the fork names the same object in both, and the child does
everything a vfork() child may not -- calls malloc() and printf(), and returns
from the function that called fork().
Both run at the top of user_main(). They exercise the lowest-level machinery
in the suite -- address environments, stack setup, the architecture's register
context -- so a fault in one takes the process down instead of reporting a
failure. Learning that in seconds rather than after everything else has passed
matters when a port is being brought up.
Each test gates on the one primitive it tests, ARCH_HAVE_VFORK and
ARCH_HAVE_FORK respectively. There is no compatibility layer and no mapping
between symbols. vfork.c no longer requires SCHED_WAITPID: the suspension is
in the kernel primitive now, so the test's core assertion holds without it and
only the status check is conditional.
The simulator is the one exception. It selects ARCH_HAVE_VFORK, but ostest
takes the sim down as soon as the test runs there, so the call keeps the
!ARCH_SIM guard that apps ee7642793 put on the old test in 2024. The old gate
hid this: ARCH_HAVE_FORK is not set on the sim, so the test was not built
there at all.
The other in-tree callers are audited for which primitive they actually meant:
* interpreters/python's _posixsubprocess and netutils/libwebsockets'
LWS_HAVE_WORKING_VFORK want the fork-then-exec path -- ARCH_HAVE_VFORK.
* python's os.fork() and libwebsockets' LWS_HAVE_FORK mean real fork() and stay
on ARCH_HAVE_FORK, so they become *absent* rather than silently wrong.
* testing/fs/fdsantest's vfork case follows ARCH_HAVE_VFORK.
interpreters/bas is deliberately left alone. Its SHELL and EDIT statements
reach for vfork() under an ARCH_HAVE_FORK guard and want the same treatment,
but checkpatch.sh checks the whole of any file a patch touches and
bas_statement.c produces 1681 pre-existing findings against master, so a
one-line change there fails CI on its own. The consequence is small:
EXAMPLES_BAS_SHELL is EXPERIMENTAL and already depends on ARCH_HAVE_FORK, so it
becomes unselectable rather than misbehaving.
Assisted-by: Claude Code:claude-opus-5
Signed-off-by: Marco Casaroli <marco.casaroli@gmail.com>
This companion change updates the nuttx-apps CMake build to use
NuttX’s NUTTX_DIR and NUTTX_BINARY_DIR instead of CMAKE_SOURCE_DIR
and CMAKE_BINARY_DIR, which incorrectly refer to the outermost project
when NuttX is embedded via add_subdirectory(). Since apps/ is itself
included from NuttX’s top-level CMakeLists.txt, these variables were
effectively being used as references to NuttX’s root and inherited
the same bug fixed in the matching NuttX change for #19697. All
self-referencing uses are replaced while intentionally preserving
standalone projects and unrelated custom variables or hardcoded paths.
The change affects only the CMake build system, preserves normal
standalone behavior, and was tested with sim:nsh both standalone and
embedded, with apps such as hello and ostest successfully built and
available in NSH.
Fixes#19697.
Assisted-by: Claude:claude-sonnet-5
Signed-off-by: Alan Carvalho de Assis <acassis@gmail.com>
Neither of these wants fork() semantics. Both reach for fork() only to put
work in the background, and each has a NuttX-native way to do that, so
neither needs a fork primitive at all -- which matters once apache/nuttx#19562
makes ARCH_HAVE_FORK conditional on the architecture implementing POSIX
fork().
netutils/dropbear: the port already routes every fork-then-exec through
vfork(), because sysoptions.h selects DROPBEAR_VFORK when HAVE_FORK is
undefined and the port leaves it undefined. spawn_command() in dbutil.c and
both call sites in scp.c follow that switch. The one exception is the
daemon() fallback that compat.c compiles under #ifndef HAVE_DAEMON, which
calls fork() directly and bypasses it. NuttX provides daemon() in
libs/libc/unistd/lib_daemon.c and declares it in unistd.h, so the fallback is
redundant; define HAVE_DAEMON alongside the HAVE_STRLCAT and HAVE_STRLCPY
entries that are there for exactly the same reason. The code was unreachable
in any case -- the port hands svr_getopts() an argv containing -F, so
svr_opts.forkbg is always zero and dropbear never calls daemon() at all.
testing/drivers/nand_sim: forked so that the parent could return to the shell
while the child registered the MTD device and slept forever. Nothing from
before the fork is used after it, so the child is a self-contained entry
point, and task_create() expresses that directly. The emulator body moves
into nand_sim_daemon() unchanged. TESTING_NAND_SIM therefore needs no fork
dependency, and the two sim configurations that enable it keep working
whatever ARCH_HAVE_FORK is set to.
Assisted-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Signed-off-by: Marco Casaroli <marco.casaroli@gmail.com>
CONFIG_NETUTILS_MDNS_STACKSIZE defaulted to DEFAULT_TASK_STACKSIZE,
which resolves to as little as 2KiB on some targets. The bundled
mjansson responder uses a deeper stack than that (DNS record parsing
with name decompression, plus the send/receive buffers) and overflows
on startup, taking the board down with a hardfault before it answers a
single query.
Default to 8KiB, the value that reliably runs the responder, and
correct the help text, which previously claimed a 4KiB default that did
not match DEFAULT_TASK_STACKSIZE.
Assisted-by: Claude (Anthropic Claude Code)
Signed-off-by: Ricard Rosson <ricard@groundbits.com>
Replace the bundled libtomcrypt chacha20-poly1305 implementation with an
adapter that drives the NuttX crypto device: the SSH construction maps onto
CRYPTO_CHACHA20_DJB (the original 64-bit counter/nonce ChaCha20
parameterization used by chacha20-poly1305@openssh.com) for the packet
length and payload streams, and onto CRYPTO_POLY1305 for the authentication
tag (plain MACs are driven in two steps through /dev/crypto: COP_FLAG_UPDATE
feeds the data, a final call retrieves the tag).
Signed-off-by: Felipe Moura <moura.fmo@gmail.com>
Replace the bundled libtomcrypt HMAC modules with an adapter that computes the hmac-sha2-256 packet MAC through the NuttX crypto device using CRYPTO_SHA2_256_HMAC sessions.
Require CRYPTO, CRYPTO_RANDOM_POOL, CRYPTO_CRYPTODEV and CRYPTO_CRYPTODEV_SOFTWARE_CRYPTO explicitly instead of selecting crypto support.
Signed-off-by: Felipe Moura <moura.fmo@gmail.com>
The Makefile build already forwards both values via PRIORITY /
STACKSIZE. Align the CMake build with the Makefile so that
CONFIG_NETUTILS_REXECD_PRIORITY and CONFIG_NETUTILS_REXECD_STACKSIZE
take effect under CMake as well.
Assisted-by: GitHubCopilot:claude-4.8-opus
Signed-off-by: wangjianyu3 <wangjianyu3@xiaomi.com>
Migrate passwd encrypt/verify to PBKDF2 modular crypt format using
kernel cryptodev (CRYPTO_PBKDF2_HMAC_SHA256 via /dev/crypto). Add
passwd_pbkdf2 wrapper, base64url helpers, complexity validation, and
pbkdf2_test for RFC 6070 vector coverage. FSUTILS_PASSWD selects
CRYPTO, ALLOW_BSD_COMPONENTS, and CRYPTO_CRYPTODEV so existing sim
defconfigs keep building. Change NSH_LOGIN_USERNAME default to root and
remove fixed-login password defaults.
BREAKING CHANGE: TEA-encoded /etc/passwd entries no longer verify.
Regenerate each entry after upgrading. Pair with the nuttx host mkpasswd
changes in apache/nuttx#19209. Boards must enable the appropriate
software or hardware crypto backend for PBKDF2 at runtime. When
CONFIG_NSH_LOGIN_FIXED=y, set CONFIG_NSH_LOGIN_PASSWORD in the board
defconfig or menuconfig; there is no default password.
Signed-off-by: Abhishek Mishra <mishra.abhishek2808@gmail.com>
Rename base64_encode, base64_decode, and ecc_make_key in bundled
libtomcrypt to avoid duplicate symbol link errors when dropbear is built
alongside netutils/codecs and NuttX crypto (e.g. sim:dropbear).
Signed-off-by: Abhishek Mishra <mishra.abhishek2808@gmail.com>
The per-session NSH task is reaped with waitpid() in
dropbear_nshsession.c. Without CONFIG_SCHED_CHILD_STATUS the kernel does
not retain the child exit status, so waitpid() returns ECHILD right after
authentication and the interactive session never starts
("NSH session wait failed: Unknown error 10").
Depend on SCHED_HAVE_PARENT and SCHED_CHILD_STATUS (following the project's
depends-on-over-select convention) so the requirement is explicit; boards
enabling Dropbear must set these in their defconfig.
Signed-off-by: Felipe Moura <moura.fmo@gmail.com>
Dropbear gathers its entropy from /dev/urandom (libtomcrypt's
rng_get_bytes tries /dev/urandom before /dev/random), so requiring
ARCH_HAVE_RNG and DEV_RANDOM shuts the port out of targets without a
hardware TRNG -- including the simulator, where a dropbear
configuration silently loses NETUTILS_DROPBEAR at configure time.
Keep only the DEV_URANDOM requirement.
Signed-off-by: Felipe Moura <moura.fmo@gmail.com>
recv() returns zero when the peer closes the TCP connection cleanly. The SMTP response path only treated negative returns as errors, so EOF could leave stale or empty response data to be checked as if a server reply had arrived.
Return ERROR on zero-length receives at each SMTP response point and keep the SPDX copyright header within the project line length limit.
Signed-off-by: Old-Ding <ai.neo.ae86@gmail.com>
The current distclean implementation has two issues:
1. Application.mk does not remove .kconfig on distclean, so stale
config fragments from earlier builds can pollute subsequent ones.
2. Several external-library Makefiles (lame, libshvc, libulut) run
"make -C <subdir> distclean" without checking whether the
subdirectory exists. When the library was never downloaded (common
in CI partial-build environments), distclean fails with "No such
file or directory".
Fix:
- Application.mk: add $(call DELFILE, .kconfig) to the distclean
target so that .kconfig is cleaned along with .built, .depend, etc.
- audioutils/lame/Makefile: guard the distclean recipe with
"if [ -d $(DST_PATH) ]; then ...; fi" and use $(MAKE) instead
of bare make.
- netutils/libshvc/Makefile, netutils/libulut/Makefile: same
directory-existence guard for their distclean recipes.
- crypto/wolfssl/Makefile: change "distclean:" to "distclean::"
(double-colon) so it does not override the distclean:: rule
inherited from Application.mk.
Signed-off-by: hanzhijian <hanzhijian@zepp.com>
By default rexecd spawns a detached worker thread per accepted connection
to allow concurrent sessions. Add a "-t" runtime option to instead handle
each connection inline in the main task, avoiding the per-connection
worker stack (CONFIG_NETUTILS_REXECD_STACKSIZE) allocation from the heap.
This matters on low-memory targets with limited free heap.
With "-t", connections are served strictly one at a time: a long-running
or interactive command blocks the accept loop until it finishes. Without
it, the existing thread-per-connection behaviour is unchanged.
Assisted-by: GitHubCopilot:claude-4.8-opus
Signed-off-by: wangjianyu3 <wangjianyu3@xiaomi.com>
popen() now returns a fopencookie-backed FILE* whose fileno() yields the
cookie pointer rather than a real descriptor, so poll() silently ignores
the negative fd and the relay loop blocks forever waiting for command
completion. See https://github.com/apache/nuttx-apps/pull/3511
Use dpopen()/dpclose() to obtain the raw bidirectional socket descriptor
directly, restoring the EOF/POLLHUP command-completion signal.
Assisted-by: GitHubCopilot:claude-4.8-opus
Signed-off-by: wangjianyu3 <wangjianyu3@xiaomi.com>
When the relay loop exits early without entering any branch, ret would be
returned uninitialized, tripping -Werror=maybe-uninitialized. Initialize
it to 0.
Assisted-by: GitHubCopilot:claude-4.8-opus
Signed-off-by: wangjianyu3 <wangjianyu3@xiaomi.com>
Integrated SSH daemon authenticating against FSUTILS_PASSWD, with an
ECDSA P-256 host key and an NSH session over a PTY per connection. Built
from the upstream Dropbear tarball (pinned commit) and patched for
NuttX, using Dropbear's bundled libtomcrypt for all crypto. setsid()
(apache/nuttx#19184) and link() now come from NuttX, not local stubs.
Signed-off-by: Felipe Moura <moura.fmo@gmail.com>
Prior to this change, if an empty folder existed instead of the
actual libwebsockets source, the build would fail. This commit
checks for an actual file instead, avoid such kind of errors.
Signed-off-by: Tiago Medicci <tiago.medicci@espressif.com>
libwebsockets can be built without TLS support. To allow this, it
was necessary to create a specific Kconfig option that enables TLS
support if OPENSSL_MBEDTLS_WRAPPER is enabled. Otherwise, TLS is
not supported (but libwebsockets can still be used with plain ws://
connections).
Signed-off-by: Tiago Medicci <tiago.medicci@espressif.com>
Extend the allocation-failure check to httpd_strdup(), the thttpd-local wrapper that has the same failure contract as strdup().
This is logically separable from the direct strdup()/asprintf() fixes: it prevents using hs->hostname before checking whether the wrapped string allocation succeeded, and releases the partially allocated server state on failure.
The scope intentionally does not extend to malloc(), calloc(), or other raw allocators because #1727 specifically calls out strdup()/asprintf(), and covering all allocation APIs would make this PR much broader.
Signed-off-by: Nightt <87569709+nightt5879@users.noreply.github.com>
Add missing failure handling for direct strdup() and asprintf() calls where the allocated result is consumed locally before any NULL/error check.
This keeps the scope to the functions named in #1727 and avoids changing pass-through return sites where callers already receive NULL on allocation failure.
Signed-off-by: Nightt <87569709+nightt5879@users.noreply.github.com>
Now that time_t is unconditionally 64-bit (signed int64_t) and the
struct timespec fields tv_sec / tv_nsec are wide enough on their own,
the explicit (uint64_t)/(int64_t)/(int) casts that used to guard the
multiplications and subtractions in *_us / *_ms / *_ns helpers are no
longer needed. Drop them to keep the timekeeping math readable.
In the same spirit, this commit also normalises the printf-style format
specifiers and casts used to print tv_sec / tv_nsec / tv_usec values.
The prior code was a mix of "%d"/"%u"/"%ld"/"%lu"/"%lld" with matching
(int)/(unsigned long)/(long long) casts; some formats truncated time_t
on 32-bit hosts, others mismatched signedness or width. Replace all
such cases with the portable POSIX-recommended forms:
- tv_sec (time_t, signed, impl-defined width) -> %jd + (intmax_t)
- tv_nsec (long, signed) -> %ld (no cast)
- tv_usec (suseconds_t / long) -> %ld (no cast)
Also drop two stale `(FAR const time_t *)&ts.tv_sec` casts that are
unnecessary now that ts.tv_sec is plain time_t.
Arithmetic-cleanup files (existing scope):
- benchmarks/cyclictest/cyclictest.c: timediff_us()
- benchmarks/sd_bench/sd_bench_main.c: get_time_delta_us()
- examples/oneshot/oneshot_main.c: maxus computation
- examples/watchdog/watchdog_main.c: current_time_ms (x2)
- industry/nxmodbus/nxmb_internal.h: nxmb_util_clock_ms()
- netutils/ntpclient/ntpclient.c: timespec2ntp()
- netutils/ptpd/ptpd.c: ptp_adjtime()
- system/dd/dd_main.c: elapsed accounting
- testing/drivers/drivertest/drivertest_posix_timer.c:
get_timestamp()
- testing/drivers/sd_stress/sd_stress_main.c:get_time_delta()
- testing/sched/getprime/getprime_main.c: elapsed accounting
- testing/sched/pthread_mutex_perf/pthread_mutex_perf.c:
timespec_avg()
Printf-format-fix files (new in this revision):
- examples/adjtime/adjtime_main.c
- examples/charger/charger_main.c
- examples/netpkt/netpkt_ethercat.c
- fsutils/mkfatfs/mkfatfs.c
- graphics/tiff/tiff_initialize.c
- netutils/ptpd/ptpd.c
- nshlib/nsh_timcmds.c
- system/coredump/coredump.c
- system/ptpd/ptpd_main.c
- testing/drivers/drivertest/drivertest_oneshot.c
- testing/mm/kasantest/kasantest.c
- testing/ostest/semtimed.c
- testing/sched/pthread_mutex_perf/pthread_mutex_perf.c
- testing/sched/timerjitter/timerjitter.c
- testing/testsuites/kernel/time/cases/clock_test_clock01.c
- testing/testsuites/kernel/time/cases/clock_test_smoke.c
No behavioural change.
Signed-off-by: Xiang Xiao <xiaoxiang@xiaomi.com>
Refactor netlib_check_ipconnectivity() to use gateway/router ping instead
of DNS server ping for network connectivity checks. Add IPv6 support.
Signed-off-by: zhanghongyu <zhanghongyu@xiaomi.com>
