Permissions (Part 2)
Description:
In kernel builds, any unprivileged process running on the NuttX
device can open /dev/efuse and attempt to read/write fuse content.
Reading the fuses may provide valuable information to an attacker
controlling the user process. The write operation, in extreme cases
where the fuse blocks are not locked, may brick the device.
DISCLAIMER: I tried to be strict with the settings, better to relax them
later if it's needed.
This is part of https://github.com/apache/nuttx/issues/19410
See https://github.com/apache/nuttx/issues/19410
Compiles ok.
Signed-off-by: Catalin Visinescu <catalin_visinescu@yahoo.com>
Now that time_t is unconditionally 64-bit (signed int64_t) and the
struct timespec fields tv_sec / tv_nsec are wide enough on their own,
the explicit (uint64_t)/(int64_t)/(int) casts that used to guard the
multiplications and subtractions in *_us / *_ms / *_ns helpers are no
longer needed. Drop them to keep the timekeeping math readable and
consistent with the previous sclock_t/time_t cleanup.
In the same spirit, this commit also:
* Normalises the printf-style format specifiers and casts used to
print tv_sec / tv_nsec / tv_usec values across arch/, drivers/,
fs/, sched/ and libs/. The prior code was a mix of
"%d"/"%u"/"%ld"/"%lu"/"%lld"/PRIu32/PRIu64 with matching
(int)/(unsigned long)/(long long)/PRIu* casts; some formats
truncated time_t on 32-bit hosts, others mismatched signedness or
width. Replace all such cases with the portable POSIX-recommended
forms:
- tv_sec (time_t, signed, impl-defined width) -> %jd + (intmax_t)
- tv_nsec (long, signed) -> %ld (no cast)
- tv_usec (suseconds_t / long) -> %ld (no cast)
Add #include <stdint.h> where required.
* Drops a few stale `(FAR const time_t *)&ts.tv_sec` casts and
related `(FAR struct tm *)` / `(const time_t *)` casts in
gmtime_r() / localtime_r() / gmtime() callers; ts.tv_sec is plain
time_t now and the casts only obscured the type.
* Fixes one overflow in fs/procfs/fs_procfscritmon.c where
all_time.tv_sec * 1000000 could overflow on 32-bit time_t before
being multiplied again; cast to uint64_t at the start.
No behavioural change.
Signed-off-by: Xiang Xiao <xiaoxiang@xiaomi.com>
The 32-bit system clock has a limited range (~497 days) and the
configuration knob is no longer worth the complexity given that
practically every modern target already enables it. Make 64-bit
time_t/clock_t/sclock_t/nuttx_time_t the only supported flavor.
Specifically:
- Drop the SYSTEM_TIME64 Kconfig option and its dependent
PERF_OVERFLOW_CORRECTION/HRTIMER guards in sched/Kconfig.
- Remove every #ifdef CONFIG_SYSTEM_TIME64 branch in headers
(include/{sys/types.h,limits.h,inttypes.h,nuttx/clock.h,
nuttx/fs/hostfs.h}) and core code paths
(sched/clock/clock.h, drivers/power/pm/pm_procfs.c,
drivers/rpmsg/rpmsg_ping.c, fs/procfs/fs_procfsuptime.c,
libs/libc/wqueue/work_usrthread.c,
arch/avr/src/avrdx/avrdx_timerisr_tickless_alarm.c).
- Strip CONFIG_SYSTEM_TIME64=y from every board defconfig.
- Update Documentation/guides/rust.rst accordingly.
Signed-off-by: Xiang Xiao <xiaoxiang@xiaomi.com>
Every compiler supported by NuttX provides the "long long" types,
so the CONFIG_HAVE_LONG_LONG indirection is no longer useful.
Remove the option from include/nuttx/compiler.h and treat
"long long" as unconditionally available across the OS.
In addition to deleting the guard itself, this commit unconditionally
enables the long-long flavored helpers that used to be gated behind
it:
- libs/libc/fixedmath: drop the soft-emulated b32/ub32 routines
in lib_fixedmath.c (-261 lines) and trim the matching
prototypes, Make.defs and CMakeLists.txt entries; keep only
the long-long backed implementations.
- include/sys/endian.h, include/strings.h, libs/libc/string
/lib_ffsll.c, lib_flsll.c: always expose the 64-bit byte-swap
and ffsll/flsll variants.
- libs/libm/libm/lib_llround{,f,l}.c: drop the empty stubs.
- libs/libc/stdlib (atoll, llabs, lldiv, strtoll/ull, rand48,
strtold), libs/libc/stream (libvsprintf, libvscanf,
libbsprintf, ultoa_invert), libs/libc/misc (crc64, crc64emac),
libs/libc/inttypes/strtoimax, libs/libc/lzf, libs/libc/libc.csv,
libs/libc/string (memset, vikmemcpy): remove the
#ifdef CONFIG_HAVE_LONG_LONG branches.
- include/{stddef.h,stdlib.h,fixedmath.h,sys/epoll.h,cxx/cstdlib,
nuttx/audio/audio.h,nuttx/crc64.h,nuttx/lib/math.h,
nuttx/lib/math32.h,nuttx/lib/stdbit.h}: same guard cleanup.
- drivers/note/note_driver.c, fs/spiffs/src/spiffs.h,
sched/irq/irq_procfs.c: drop their local guards as well.
- Documentation/applications/netutils/ntpclient/index.rst:
refresh the documentation snippet.
Signed-off-by: Xiang Xiao <xiaoxiang@xiaomi.com>
debug.h is a NuttX-specific, non-POSIX header. Placing it in the
top-level include/ directory creates naming conflicts with external
projects that define their own debug.h.
This commit moves the canonical header to include/nuttx/debug.h,
following the NuttX convention for non-POSIX/non-standard headers,
and updates all in-tree references.
A backward-compatibility shim is left at include/debug.h that
emits a deprecation #warning and re-includes <nuttx/debug.h>,
allowing out-of-tree code to continue building while migrating.
Signed-off-by: Piyush Patle <piyushpatle228@gmail.com>
In file_dup3, the file descriptor is initialized with the O_NONBLOCK flag.
If the inode's ioctl(FIONBIO) call fails with a result other than OK or
ENOTTY, the file may be mistakenly released.
Signed-off-by: zhangyuan29 <zhangyuan29@xiaomi.com>
Add NOTE_DUMP_BINARY to the note_type_e enum and implement its handling
in noteram_dump_one. This enables the recording and dumping of binary
logs in hexadecimal format, improving traceability for binary event data.
Signed-off-by: yukangzhi <yukangzhi@xiaomi.com>
Add handling for the FIONREAD ioctl in noteram_ioctl to return the
number of unread bytes in the circular note buffer (noteram_unread_length()).
Validate the argument pointer and return -EINVAL if it is NULL.
Signed-off-by: yukangzhi <yukangzhi@xiaomi.com>
Add compilation condition for 'nx_vsyslog' syscall.
Export 'sched_note_printf_ip' syscall when CONFIG_SYSLOG_TO_SCHED_NOTE=y
Put the implementation of sched_note_printf_ip in libc/misc/lib_note.c
Signed-off-by: yukangzhi <yukangzhi@xiaomi.com>
Add spinlock protection to sched_note_preemption and nxsched_critmon_preemption.
Ensures thread-safe access to global state in preemption notification and critical
monitoring, preventing race conditions in SMP and interrupt contexts.
Signed-off-by: hujun5 <hujun5@xiaomi.com>
The value returned by sizeof(struct note_start_s) is larger
than the actual memory footprint of struct note_start_s.
This causes the length calculated in sched_note_start to be larger
than the actual memory size,which further leads to out-of-bounds reads in note_common.
Signed-off-by: guohao15 <guohao15@xiaomi.com>
note/note_driver.c:2440:45: error: implicit declaration of function 'note_find_taskname'; did you mean 'note_get_taskname'? [-Werror=implicit-function-declaration]
2440 | FAR struct note_taskname_info_s *ti = note_find_taskname(pid);
| ^~~~~~~~~~~~~~~~~~
| note_get_taskname
note/note_driver.c:2440:45: error: initialization of 'struct note_taskname_info_s *' from 'int' makes pointer from integer without a cast [-Werror=int-conversion]
note/note_driver.c:2444:26: error: invalid use of undefined type 'struct note_taskname_info_s'
2444 | strlcpy(buf, ti->name, len);
| ^~
Signed-off-by: wangzhi16 <wangzhi16@xiaomi.com>
The function sched_note_add should not be in the code
section of #ifdef CONFIG_SCHED_INSTRUMENTATION_SWITCH
Signed-off-by: yukangzhi <yukangzhi@xiaomi.com>
When tcb may has been released in caller, the return pointer to tcb->name is dangling pointer. So add a buffer in caller, even if tcb is released, buffer is still valid.
Signed-off-by: wangzhi16 <wangzhi16@xiaomi.com>
Modify the kernel to use only atomic_xx and atomic64_xx interfaces,
avoiding the use of sizeof or typeof to determine the type of
atomic operations, thereby simplifying the kernel's atomic
interface operations.
Signed-off-by: zhangyuan29 <zhangyuan29@xiaomi.com>
Most tools used for compliance and SBOM generation use SPDX identifiers
This change brings us a step closer to an easy SBOM generation.
Signed-off-by: Alin Jerpelea <alin.jerpelea@sony.com>
note/note_driver.c:639:21: warning: 'strlen' reading 1 or more bytes from a region of size 0 [-Wstringop-overread]
639 | namelen = strlen(tcb->name);
| ^~~~~~~~~~~~~~~~~
Signed-off-by: cuiziwei <cuiziwei@xiaomi.com>
note/note_driver.c:1405:11: runtime error: null pointer passed as argument 2, which is declared to never be null
#0 0x33bf5cc in sched_note_event_ip note/note_driver.c:1405
#1 0x33bfb57 in note_driver_instrument_enter note/note_initialize.c:55
#2 0x347b084 in __cyg_profile_func_enter misc/lib_instrument.c:68
#3 0x34179de in binder_initialize binder/binder.c:669
#4 0x339a936 in drivers_initialize /home/cuiziwei/vela/happy/nuttx/drivers/drivers_initialize.c:242
#5 0x335a179 in nx_start init/nx_start.c:632
#6 0x32f755c in main sim/sim_head.c:180
#7 0xf6821518 (/lib/i386-linux-gnu/libc.so.6+0x21518) (BuildId: 7f64b917aaa97b9680d8e44931bf7611c5a1f036)
#8 0xf68215f2 in __libc_start_main (/lib/i386-linux-gnu/libc.so.6+0x215f2) (BuildId: 7f64b917aaa97b9680d8e44931bf7611c5a1f036)
#9 0x32b401a in _start (/home/cuiziwei/vela/happy/nuttx/nuttx+0x32b401a) (BuildId: 33f8f7b361d44a008de87fea1bc970b22b48b700)
Signed-off-by: cuiziwei <cuiziwei@xiaomi.com>
avoid the instrument doesn't get registered in some case
Signed-off-by: cuiziwei <cuiziwei@xiaomi.com>
Signed-off-by: yinshengkai <yinshengkai@xiaomi.com>
In some cases, we only need to use INSTRUMENTATION_DUMP to record custom data,
and we don't want the thread start and end information
Move this part to INSTRUMENTATION_SWTICH for recording
Signed-off-by: yinshengkai <yinshengkai@xiaomi.com>
