Permissions (Part 2)
Description:
In kernel builds, any unprivileged process running on the NuttX
device can open /dev/efuse and attempt to read/write fuse content.
Reading the fuses may provide valuable information to an attacker
controlling the user process. The write operation, in extreme cases
where the fuse blocks are not locked, may brick the device.
DISCLAIMER: I tried to be strict with the settings, better to relax them
later if it's needed.
This is part of https://github.com/apache/nuttx/issues/19410
See https://github.com/apache/nuttx/issues/19410
Compiles ok.
Signed-off-by: Catalin Visinescu <catalin_visinescu@yahoo.com>
Rename rpmsg_device_destory() to rpmsg_device_destroy() to fix a
spelling error in the function name. The function is declared in the
private header drivers/rpmsg/rpmsg.h and used only within the
drivers/rpmsg/ subsystem (rpmsg.c, rpmsg_virtio.c,
rpmsg_router_edge.c, rpmsg_port.c), so there is no public API or
ABI impact.
Signed-off-by: hanzj <hanzjian@zepp.com>
Replace C11 atomic types and operations with NuttX native atomic
interfaces (atomic_t, atomic_set, atomic_fetch_and_acquire,
atomic_fetch_or_acquire) to avoid build failures on toolchains
that lack full C11 atomics support.
Signed-off-by: chenrun1 <chenrun1@xiaomi.com>
Signed-off-by: Bowen Wang <wangbowen6@xiaomi.com>
Now that time_t is unconditionally 64-bit (signed int64_t) and the
struct timespec fields tv_sec / tv_nsec are wide enough on their own,
the explicit (uint64_t)/(int64_t)/(int) casts that used to guard the
multiplications and subtractions in *_us / *_ms / *_ns helpers are no
longer needed. Drop them to keep the timekeeping math readable and
consistent with the previous sclock_t/time_t cleanup.
In the same spirit, this commit also:
* Normalises the printf-style format specifiers and casts used to
print tv_sec / tv_nsec / tv_usec values across arch/, drivers/,
fs/, sched/ and libs/. The prior code was a mix of
"%d"/"%u"/"%ld"/"%lu"/"%lld"/PRIu32/PRIu64 with matching
(int)/(unsigned long)/(long long)/PRIu* casts; some formats
truncated time_t on 32-bit hosts, others mismatched signedness or
width. Replace all such cases with the portable POSIX-recommended
forms:
- tv_sec (time_t, signed, impl-defined width) -> %jd + (intmax_t)
- tv_nsec (long, signed) -> %ld (no cast)
- tv_usec (suseconds_t / long) -> %ld (no cast)
Add #include <stdint.h> where required.
* Drops a few stale `(FAR const time_t *)&ts.tv_sec` casts and
related `(FAR struct tm *)` / `(const time_t *)` casts in
gmtime_r() / localtime_r() / gmtime() callers; ts.tv_sec is plain
time_t now and the casts only obscured the type.
* Fixes one overflow in fs/procfs/fs_procfscritmon.c where
all_time.tv_sec * 1000000 could overflow on 32-bit time_t before
being multiplied again; cast to uint64_t at the start.
No behavioural change.
Signed-off-by: Xiang Xiao <xiaoxiang@xiaomi.com>
POSIX leaves the signedness of time_t and clock_t unspecified, but
mainstream implementations (Linux glibc/musl, the BSDs, macOS, RTEMS,
Zephyr's POSIX layer, Windows _time64) expose time_t as signed 64-bit.
NuttX has historically used uint64_t only because it was tied to the
CONFIG_SYSTEM_TIME64 knob; with that gone, switch:
time_t : uint64_t -> int64_t
clock_t : uint64_t -> int64_t
CLOCK_MAX: UINT64_MAX -> INT64_MAX
This lets (time_t)-1 sentinels, negative tick deltas, and host-side
headers behave as on every other POSIX system without source churn.
Headers updated:
- include/sys/types.h, include/limits.h, include/nuttx/clock.h
- include/nuttx/fs/hostfs.h (nuttx_time_t alias)
- include/nuttx/{mqueue.h,wdog.h,wqueue.h,timers/clkcnt.h}
Because clock_t is now signed 64-bit, the NuttX-internal sclock_t
alias becomes redundant: every sclock_t/SCLOCK_MAX use is folded
back to clock_t/CLOCK_MAX (notably in sched/wdog, sched/mqueue,
sched/sched, sched/clock, sched/timer, libs/libc/time, fs/vfs and
the drivers/arch consumers below).
Tick/period constants (NSEC_PER_SEC, USEC_PER_SEC, MSEC_PER_SEC,
SEC_PER_MIN, ...) in include/nuttx/clock.h are retyped from "long"
literals to INT64_C(...) so that 64-bit arithmetic no longer
depends on the host's long width.
Strip now-redundant (time_t)/(clock_t)/(unsigned long) casts and
unsigned-only branches across the tree:
- arch RTC / oneshot / tickless lowerhalfs:
arm: cxd56xx, efm32, imxrt, lc823450, max326xx, sam34, sama5,
samd5e5, samv7, stm32, stm32f7, stm32h7, stm32l4, stm32wb,
xmc4
mips: pic32mz sparc: bm3803 x86_64: intel64
risc-v/xtensa: espressif (esp_i2c[_slave], esp_rtc,
esp32c3{_i2c,_rtc,_wifi_adapter}, esp32{,s2,s3}_*),
mpfs_perf
- drivers: audio/tone, input/aw86225, power/pm/{activity,
stability}_governor, rpmsg/rpmsg_ping,
timers/{ds3231,mcp794xx,pcf85263,rx8010},
wireless/ieee80211/bcm43xxx, wireless/spirit/spirit_spi
- core: fs/vfs/{fs_poll,fs_timerfd}, mm/iob/iob_alloc,
libs/libc/{netdb/lib_dnscache,time/{lib_calendar2utc,
lib_time}}, net/icmp/icmp_pmtu, net/icmpv6/icmpv6_pmtu,
net/ipfrag, net/tcp/{tcp.h,tcp_timer},
net/utils/net_snoop, net/mld/mld_query (drop the now-dead
mld_mrc2mrd helper since signed math handles it directly),
sched/clock/{clock,clock_initialize},
sched/sched/{sched_profil,sched_setparam,sched_setscheduler},
sched/pthread/pthread_create,
sched/wdog/{wd_gettime,wd_start,wdog.h},
sched/timer/timer_gettime, sched/mqueue/*
Flip the few in-tree printf format strings that assumed an
unsigned 64-bit tv_sec:
* drivers/rpmsg/rpmsg_ping.c PRIu64 -> PRId64
* arch/xtensa/src/esp32{,s2,s3}/esp32*_oneshot_lowerhalf.c
PRIu32 (already wrong) -> PRId64
Signed-off-by: Xiang Xiao <xiaoxiang@xiaomi.com>
The 32-bit system clock has a limited range (~497 days) and the
configuration knob is no longer worth the complexity given that
practically every modern target already enables it. Make 64-bit
time_t/clock_t/sclock_t/nuttx_time_t the only supported flavor.
Specifically:
- Drop the SYSTEM_TIME64 Kconfig option and its dependent
PERF_OVERFLOW_CORRECTION/HRTIMER guards in sched/Kconfig.
- Remove every #ifdef CONFIG_SYSTEM_TIME64 branch in headers
(include/{sys/types.h,limits.h,inttypes.h,nuttx/clock.h,
nuttx/fs/hostfs.h}) and core code paths
(sched/clock/clock.h, drivers/power/pm/pm_procfs.c,
drivers/rpmsg/rpmsg_ping.c, fs/procfs/fs_procfsuptime.c,
libs/libc/wqueue/work_usrthread.c,
arch/avr/src/avrdx/avrdx_timerisr_tickless_alarm.c).
- Strip CONFIG_SYSTEM_TIME64=y from every board defconfig.
- Update Documentation/guides/rust.rst accordingly.
Signed-off-by: Xiang Xiao <xiaoxiang@xiaomi.com>
debug.h is a NuttX-specific, non-POSIX header. Placing it in the
top-level include/ directory creates naming conflicts with external
projects that define their own debug.h.
This commit moves the canonical header to include/nuttx/debug.h,
following the NuttX convention for non-POSIX/non-standard headers,
and updates all in-tree references.
A backward-compatibility shim is left at include/debug.h that
emits a deprecation #warning and re-includes <nuttx/debug.h>,
allowing out-of-tree code to continue building while migrating.
Signed-off-by: Piyush Patle <piyushpatle228@gmail.com>
support specify the address by h2r_buf_addr and r2h_buf_addr
so is can split shared memory pool
Signed-off-by: yintao <yintao@xiaomi.com>
Signed-off-by: Bowen Wang <wangbowen6@xiaomi.com>
When the VIRTIO_RPMSG_F_CPUNAME feature is not negotiated, the driver
previously would crash due to DEBUGASSERT. This commit adds support
for a fallback mechanism:
1. Add rpmsg_virtio_probe_cpuname() API that accepts an optional cpuname
parameter to be used when VIRTIO_RPMSG_F_CPUNAME is not available.
2. Modify rptun driver to pass the cpuname from rptun device config
to rpmsg_virtio_probe_cpuname().
3. Refactor rptun device register/unregister to prioritize RPMSG device
handling before other virtio device types.
This ensures the system works correctly in scenarios where the remote
side does not support the VIRTIO_RPMSG_F_CPUNAME feature.
Signed-off-by: Bowen Wang <wangbowen6@xiaomi.com>
Add TX/RX timestamp tracking for rpmsg_port to enable latency
measurement and debugging:
- Add rpmsg_port_get_timestamp() to retrieve buffer timestamps
- Add rpmsg_port_update_timestamp() to record timestamps at TX/RX time
- Integrate timestamp recording in rpmsg_port_spi and rpmsg_port_spi_slave
- Reserve space for rpmsg_timestamp_s in buffer size calculations
Signed-off-by: liaoao <liaoao@xiaomi.com>
Add rpmsg_get_timestamp() API to get the TX/RX timestamps of an rpmsg
buffer. This is useful for latency measurement and debugging purposes.
The new rpmsg_timestamp_s structure contains:
- tx_nsec: timestamp when the buffer was transmitted
- rx_nsec: timestamp when the buffer was received
Signed-off-by: liaoao <liaoao@xiaomi.com>
Signed-off-by: Bowen Wang <wangbowen6@xiaomi.com>
1. Use virtio_read_config_bytes() to read the string types in
rpmsg-virtio and virtio-net;
2. Use virtio_read_config_member() to read the elements in
virtio-snd configuration space;
Signed-off-by: Bowen Wang <wangbowen6@xiaomi.com>
Now we can release the rx buffer in ept->cb, ept->cb should copy
the rx buffer it's private buffer and then return
RPMSG_SUCCESS_BUFFER_RETURNED.
Signed-off-by: Bowen Wang <wangbowen6@xiaomi.com>
When recv peer poweroff command, should clear the connected status
first to avoid there is data to send when call the rpmsg_unregister(),
then tx thread hang at the data send process but peer has power
off.
When clear the connected status first, rpmsg_port_uart_tx_ready()
will drop the tx packet to avoid tx thread is waked up to send useless
data.
Signed-off-by: Bowen Wang <wangbowen6@xiaomi.com>
rpmsg_port_unreigster() should be called after rpmsg_port_reigster(),
so add the connected condition when receive poweroff command.
Signed-off-by: Bowen Wang <wangbowen6@xiaomi.com>
To debug the tx buffer get failed issue, the rpmsg port uart/spi
can use this mechanism to dump more debug informations.
Signed-off-by: Bowen Wang <wangbowen6@xiaomi.com>
Fix the case that tx thread want to send data to peer and try to
wakeup peer, but rx thread blocked on the tx buffer got procees and
so rx thread can't process the commands includes the wakeup ack
command, then the tx thread will hang at the wakeup process forever.
Signed-off-by: Bowen Wang <wangbowen6@xiaomi.com>
When no free buffers, notify the lower transport, so the lower
transports can know this thing and do some work, such as continue
to process the rx data to avoid the rx thread is blocked that
even can't process the commands.
Signed-off-by: Bowen Wang <wangbowen6@xiaomi.com>
Signed-off-by: liaoao <liaoao@xiaomi.com>
Orignal issue: the new wakeup process may be waked by the last Ack
command from peer, and lead the data is lost because peer may have
enter into the sleep mode.
W = Wake, A = WakeAck, R = Relax, D = Data
TX: [0]W-[1]R--------[4]W----[6]DDDDDDDDDDDD-------
RX: ------------[3]A----[5]Enter Sleep-------------
In this figure, Ack command [3] wakeup the wakeup process [4] because
[3] may be received with a delay.
Now use the ping-pong wake/ack command to fix this issue because
the different wake/ack command can block the last Ack command
wake the wrong wakeup process.
W1 = Wake1, A1 = WakeAck1, W2 = Wake2, A2 = WakeAck2, R = Relax, D = Data
TX: [0]W1-[1]R-------[4]W2----------[6]DDDDDDDDDDD--
RX: ------------[3]A1---------[5]A2-----------------
With this patch, the Ack comamnd [3] can't wakeup the wakeup process [4]
because [3] is Ack1 but [4] is Wake2, and local will not send data until
peer response a [5]Ack2.
Signed-off-by: Bowen Wang <wangbowen6@xiaomi.com>
Try to dump more error log to catch the uart trasmission issue.
1. dump the received error char when received the non start char
at the wait start state;
2. dump the dbg buffer and received buffer when received the
duplicate end char at the wait start state;
Signed-off-by: Bowen Wang <wangbowen6@xiaomi.com>
Peer will receive the power off command and unregister the rpmsg
connections to avoid the rpmsg services stuck at the rpmsg operations.
Signed-off-by: Bowen Wang <wangbowen6@xiaomi.com>
Support wakeup by peer core (Linux)
1. Add 3 commands: STAYWAKE/RELAXWAKE/STAYWAKEACK
Local will stay the wakeup source when received the STAYWAKE command
and relax the pm wake soucre when received the RELAXWAKE.
And local should response the STAYWAKEACK to peer to notify local has
been waked up.
Local core must send the RELAXWAKE command to peer when there is nothing
to do (send/receive data) otherwise peer can't enter into sleep mode.
So we wakeup the tx thread to send the RELAXWAKE command at the time
that may blocked in the file_read() in rx thread.
NOTE:
Local core should relax the pm wakelock when received POWEROFF
command to allow enter into sleep mode when peer core SHUTDOWN.
2. Change all the flags to event, use event is more convinent
to reprsent all the flags. But the tx sem must be kept because we need
support notify the tx is ready event the tx thread is running to avoid
miss any tx ready event.
Signed-off-by: Bowen Wang <wangbowen6@xiaomi.com>
Use the TIOCVHANGUP to notify the driver to switch the uart io
to gpio mode to avoid the current leak caused by the uart io because
peer core may already poweroff so the io can be in high voltage
state.
Signed-off-by: Bowen Wang <wangbowen6@xiaomi.com>
To maintain compatibility in future update, the data transfer is
still valid even can't process the new added command.
Signed-off-by: Bowen Wang <wangbowen6@xiaomi.com>
1. Dump the error log and continue process the next packet when
received error happened instead direclty panic to allow use adb
to update peer core's firmeware;
2. Add more error log to debug the receive error;
Signed-off-by: Bowen Wang <wangbowen6@xiaomi.com>
Move rpmsg internal APIs from public header include/nuttx/rpmsg/rpmsg.h
to private header drivers/rpmsg/rpmsg.h. These APIs are only used within
the rpmsg driver implementation and should not be exposed to external
modules.
Moved APIs:
- rpmsg_modify_signals()
- rpmsg_ns_bind() / rpmsg_ns_unbind()
- rpmsg_device_created() / rpmsg_device_destory()
- rpmsg_register() / rpmsg_unregister()
Signed-off-by: Yongrong Wang <wangyongrong@xiaomi.com>
Signed-off-by: Bowen Wang <wangbowen6@xiaomi.com>
Add a new getrecvbuf callback to the SPI slave device operations
that allows the slave device to provide a pre-allocated receive
buffer directly to the controller. This enables zero-copy data
transfer by allowing the controller to receive data directly into
the device's buffer instead of copying.
Changes:
- Add SPIS_DEV_GETRECVBUF macro and getrecvbuf callback to
spi_slave_devops_s structure in include/nuttx/spi/slave.h
- Implement getrecvbuf in rpmsg_port_spi_slave driver
- Update getdata to return 0 as it's no longer used for this path
Signed-off-by: liaoao <liaoao@xiaomi.com>
The cmdhdr->len was uninitialized before being used in SPI exchange
operations. This caused incorrect transfer lengths.
Changes:
- Initialize cmdhdr->len to sizeof(struct rpmsg_port_header_s) during
initialization for both SPI master and slave drivers
- Use port.txq.len instead of cmdhdr->len for TX exchange length
- Use port.rxq.len instead of cmdhdr->len for RX getdata length
Signed-off-by: liaoao <liaoao@xiaomi.com>
CC: vfs/fs_unlink.c rpmsg/rpmsg_port_spi.c: In function ‘rpmsg_port_spi_complete_handler’:
rpmsg/rpmsg_port_spi.c:415:11: warning: implicit declaration of function ‘rpmsg_port_spi_drop_packets’; did you mean ‘rpmsg_port_drop_packets’? [-Wimplicit-function-declaration]
415 | rpmsg_port_spi_drop_packets(rpspi, RPMSG_PORT_SPI_DROP_ALL);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~
| rpmsg_port_drop_packets
rpmsg/rpmsg_port_spi.c:415:46: error: ‘RPMSG_PORT_SPI_DROP_ALL’ undeclared (first use in this function); did you mean ‘RPMSG_PORT_DROP_ALL’?
415 | rpmsg_port_spi_drop_packets(rpspi, RPMSG_PORT_SPI_DROP_ALL);
| ^~~~~~~~~~~~~~~~~~~~~~~
| RPMSG_PORT_DROP_ALL
rpmsg/rpmsg_port_spi_slave.c:292:5: warning: implicit declaration of function ‘container_of’; did you mean ‘list_container_of’? [-Wimplicit-function-declaration]
292 | container_of(port, struct rpmsg_port_spi_s, port);
| ^~~~~~~~~~~~
| list_container_of
Signed-off-by: liaoao <liaoao@xiaomi.com>
The default stack size should be large enough to avoid the stack
overflow:
0x18551ad8 1968 1968 100.0%! 24.2% rpmsg-spi
Signed-off-by: liaoao <liaoao@xiaomi.com>
Use pm wakelock is enough to make sure system will not suspend
when there is a transfer in process, and it can actually sleep when
there is buffer to send but peer side not response in 1ms which is
the timeout we set.
Signed-off-by: liaoao <liaoao@xiaomi.com>
Unbind the spictrl to close the spi controller, and bind it again
when peer boots.
This can help to reduce the leak current caused by the spi gpio.
Signed-off-by: liaoao <liaoao@xiaomi.com>
Only call rpmsg_port_spi_pm_action(false) when no more data to
transfer to avoid unnecessary pm unlock/lock operations.
Signed-off-by: Xiang Xiao <xiaoxiang@xiaomi.com>
Now rpmsg_port_spi/slave support send shutdown command to remote
core to notify then local core will reboot, so remote core can
notify all the rpmsg services to do the unregister.
Signed-off-by: liaoao <liaoao@xiaomi.com>
Add low power support for the rpmsg port spi/slave transport, now
the rpmsg port spi/slave transport will not allow enter into the
low power state when there are still tx data to sent or rx data
to processed.
Signed-off-by: liaoao <liaoao@xiaomi.com>
Signed-off-by: Bowen Wang <wangbowen6@xiaomi.com>
This commit fixes a memory alignment issue in the rpmsg subsystem.
The previous implementation used a flexible array member (rdev[0])
in struct rpmsg_s, but due to automatic 8-byte padding, rpmsg->rdev
could differ from the transport layer's rdev address (e.g.,
rpmsg_virtio->rvdev.rdev), causing potential memory corruption.
Changes:
- Remove rdev[0] flexible array member from struct rpmsg_s
- Add rpmsg_get_rdev_by_rpmsg() inline helper to calculate rdev
address as (rpmsg + 1), ensuring correct pointer arithmetic
- Update all rpmsg->rdev references to use the new helper function
- Fix rpmsg_virtio_notify_wait() to use correct container_of macro
Signed-off-by: Yongrong Wang <wangyongrong@xiaomi.com>
Unify all the cpuname/local_cpuname to struct rpmsg_s, so we can
remove the ops->get_cpuname and ops->get_local_cpuname in
struct rpmsg_ops_s.
Signed-off-by: Bowen Wang <wangbowen6@xiaomi.com>
Fix the issue that pm feature not picked before
rename the rpmsg_virtio to rpmsg_virtio_lite
Signed-off-by: buxiasen <buxiasen@xiaomi.com>
Signed-off-by: Bowen Wang <wangbowen6@xiaomi.com>
