Both the UART and PTY serial drivers previously assumed all
VT100/ANSI escape sequences were fixed 3-byte CSI sequences, causing
longer CSI and SS3 key sequences (such as Home, End, Delete, and
modified keys) to leak stray characters into the terminal when local
echo was enabled. This patch replaces the fixed-length logic with a
state machine that correctly recognizes and suppresses escape
sequences of any length, while preserving the data delivered to
applications. The change only affects local echo behavior, is fully
backward compatible, and has been validated with both interactive NSH
sessions and automated PTY tests.
Signed-off-by: Alan C. Assis <acassis@gmail.com>
Assisted-by: Claude Code
Summary
Permissions (Part 3)
Description:
In kernel builds, any unprivileged process running on the NuttX device can
open /dev/efuse and attempt to read/write fuse content. Reading the fuses
may provide valuable information to an attacker controlling the user process.
The write operation, in extreme cases where the fuse blocks are not locked,
may brick the device.
DISCLAIMER: I tried to be strict with the settings, better to relax them
later if it's needed.
This is part of https://github.com/apache/nuttx/issues/19410
Impact
See https://github.com/apache/nuttx/issues/19410
Testing
Compiles ok.
Signed-off-by: Catalin Visinescu <catalin_visinescu@yahoo.com>
This commit introduces a rudimentary architecture and board port for the
MIPS Creator CI20, featuring the dual core Ingenic JZ4780 SoC (MIPS32).
Included in this initial implementation:
- Basic architectural initialization and startup code for the JZ4780 Core 0.
- Minimal configuration required to execute from RAM.
- Early UART/serial console support for basic debugging and NSH output.
- Minimal board-specific configuration for the CI20 target.
- Console output is routed via UART0 on the expansion header.
This establishes basic support for running NuttX on the MIPS CI20.
Further peripherals, optimization, and extended documentation are left for
future iterations or community contributions.
Build and Runtime Deployment Info:
----------------------------------
The baseline can be configured, compiled using the MIPS MTI toolchain,
and loaded via U-Boot using the following commands (replace
<tftp_dir> with your local TFTP root directory).
./tools/configure.sh -l ci20/nsh
make CROSSDEV=mips-mti-elf-
mkimage -A mips -O linux -T kernel -C none -a 0x80000180 -e 0x800004ac \
-n "nx" -d nuttx.bin <tftp_dir>/nuttx.umg
Note: U-Boot must be properly configured for networking (e.g., valid ipaddr,
serverip, and ethaddr environment variables) to fetch the image over TFTP.
Run this from U-Boot prompt:
tftp nuttx.umg && bootm $fileaddr
Signed-off-by: Lwazi Dube <lwazeh@gmail.com>
Permissions (Part 2)
Description:
In kernel builds, any unprivileged process running on the NuttX
device can open /dev/efuse and attempt to read/write fuse content.
Reading the fuses may provide valuable information to an attacker
controlling the user process. The write operation, in extreme cases
where the fuse blocks are not locked, may brick the device.
DISCLAIMER: I tried to be strict with the settings, better to relax them
later if it's needed.
This is part of https://github.com/apache/nuttx/issues/19410
See https://github.com/apache/nuttx/issues/19410
Compiles ok.
Signed-off-by: Catalin Visinescu <catalin_visinescu@yahoo.com>
uart_putxmitchar() manipulates dev->xmit.head/buffer directly with
no internal locking - every other caller (uart_write()) takes
dev->xmit.lock first. uart_readv()'s ECHO handling (both the
backspace/delete erase sequence and the normal character echo)
calls uart_putxmitchar() without taking that lock, so a concurrent
uart_write() and a local echo can race on the same circular buffer
state, corrupting it.
Take dev->xmit.lock around each echo's uart_putxmitchar() calls,
matching what uart_write() already does. uart_readv() holds
dev->recv.lock for its own duration, but no other code path ever
acquires recv.lock while holding xmit.lock, so nesting xmit.lock
inside the existing recv.lock scope here doesn't introduce a new
lock-ordering cycle.
Fixes#14845
Signed-off-by: yi chen <94xhn1@gmail.com>
NuttX has no real session/process-group abstraction, so the TTY layer
collapses the foreground process group onto the single dev->pid field
(pgrp == pid, one member per group). Extend the controlling-terminal
support so portable software (e.g. dropbear, socat) that relies on
job-control primitives works without losing the existing NuttX-specific
behaviour.
Driver (serial.c, pty.c):
- TIOCSCTTY now accepts a flag: arg > 0 keeps the historical "target
PID in arg" semantics (NSH registers the foreground command it just
spawned), while arg == 0 selects the calling task via
nxsched_getpid(), matching the POSIX flag convention used by
dropbear/socat/apue. This preserves all existing callers and makes
the previously-dead arg==0 path deliver SIGINT correctly.
- Add TIOCGPGRP/TIOCGSID (return dev->pid) and TIOCSPGRP (set it).
- pty.c gains the same handlers against pd_pid and includes
nuttx/sched.h for nxsched_getpid().
ioctl numbers (tioctl.h): TIOCGPGRP/TIOCSPGRP/TIOCGSID at 0x37-0x39.
libc wrappers:
- termios: tcgetpgrp(), tcsetpgrp(), tcgetsid() over the new ioctls.
- unistd: setsid()/getsid()/setpgid() stubs consistent with the
existing getpgrp()/getpgid() single-session model (sid == pgid ==
pid; setpgid only succeeds for pgid == pid).
Declare the new prototypes in unistd.h (tcgetsid was already in
termios.h) and register all sources in the Make.defs/CMakeLists.
Group-broadcast signalling (kill(-pgrp)) remains unsupported, so
tty signals still target the single dev->pid; a real session/process
group model is left as a follow-up.
Signed-off-by: Xiang Xiao <xiaoxiang@xiaomi.com>
uart_tcdrain() takes a caller-supplied timeout (e.g. 10s from the
TCDRN ioctl path), but the timeout was only applied to the final
TX-FIFO polling loop. The earlier xmit-buffer drain loop called
nxsem_wait(&dev->xmitsem) with no timeout, so any condition that
prevents the lower half from posting xmitsem (e.g. a stuck DMA
completion path, a wedged hardware-flow-control stall) would block
tcdrain() indefinitely, regardless of the timeout the caller asked
for. The pre-existing comment ("NOTE: There is no timeout on the
following loop. ... the caller should call tcflush() first") openly
acknowledged this hang.
Move the start timestamp before both phases and replace the bare
nxsem_wait() with nxsem_tickwait() using the remaining time, so the
total time spent in tcdrain() honors the caller's timeout regardless
of which phase stalls. When the remaining time is already exhausted,
short-circuit to -ETIMEDOUT without calling into the scheduler. The
existing exit path (drop critical section, skip the FIFO polling
loop, unlock the xmit mutex, leave the cancellation point) handles
the new -ETIMEDOUT propagation correctly without further changes.
Also fold the "Set up for the timeout" comment into the kludge
REVISIT comment, since the timestamp is no longer set up at that
point.
Signed-off-by: Lingao Meng <menglingao@xiaomi.com>
uart_tcdrain() registers a cancellation point on entry via
enter_cancellation_point() (when called with cancelable=true), and the
normal exit path calls leave_cancellation_point() before returning.
However the timeout path inside the FIFO drain loop returns -ETIMEDOUT
directly without going through the normal exit path, leaking one
cancellation point reference (tcb->cpcount is left incremented). Over
repeated timeouts this counter will desync and prevent
pthread_cancel() / pthread_setcancelstate() from behaving correctly
for the calling thread.
Fix by calling leave_cancellation_point() before the early return,
matching the existing exit path.
Signed-off-by: Lingao Meng <menglingao@xiaomi.com>
Adjust the generic 16550 driver for the AM62x console path. Preserve
the FIFO programming sequence needed by the TI UART, keep the bootloader
owned early console state when requested, and drain the transmit buffer
correctly when polling mode is enabled.
Signed-off-by: Piyush Patle <piyushpatle228@gmail.com>
debug.h is a NuttX-specific, non-POSIX header. Placing it in the
top-level include/ directory creates naming conflicts with external
projects that define their own debug.h.
This commit moves the canonical header to include/nuttx/debug.h,
following the NuttX convention for non-POSIX/non-standard headers,
and updates all in-tree references.
A backward-compatibility shim is left at include/debug.h that
emits a deprecation #warning and re-includes <nuttx/debug.h>,
allowing out-of-tree code to continue building while migrating.
Signed-off-by: Piyush Patle <piyushpatle228@gmail.com>
Remove the unnecessary CONFIG_RPMSG_UART_CONSOLE preprocessor guard around
the console registration logic in uart_rpmsg_init().
The uart_rpmsg_init() function already accepts a bool isconsole parameter to
dynamically control console registration, which is designed to support flexible
console setup in distributed multi-core SOC systems. Adding the macro check on
top of this runtime parameter is redundant and negates the dynamic registration
capability.
This change fixes a regression introduced by PR #18410, which broke the functionality
of sim/rpproxy and sim/rpserver due to the incorrect macro guard preventing proper
console registration for the rpmsg UART device.
Signed-off-by: chao an <anchao.archer@bytedance.com>
Adds CONFIG_16550_POLLING options to enable polling mode for
transmission. This avoids TX interrupts and reduces interrupt latency
at the cost of blocking during TX.
Implements sendbuf() method for efficient buffer transmission
in polling mode.
Signed-off-by: yinshengkai <yinshengkai@bytedance.com>
Signed-off-by: chao an <anchao.archer@bytedance.com>
Adds CONFIG_UART_XLNXPS_POLLING options to enable polling mode for
transmission. This avoids TX interrupts and reduces interrupt latency
at the cost of blocking during TX.
Implements sendbuf() method for efficient buffer transmission
in polling mode.
Signed-off-by: yinshengkai <yinshengkai@bytedance.com>
Signed-off-by: chao an <anchao.archer@bytedance.com>
This PR adds complete driver support for the Xilinx UART Peripheral System (XUARTPS)
in the NuttX serial driver framework. The implementation includes the core driver code
(uart_xlnx_ps.c), configuration files (Kconfig-xlnxps), header definitions (uart_xlnx_ps.h),
and integration with the existing NuttX build system (CMakeLists.txt, Make.defs, Kconfig).
The driver supports UART0 configuration with customizable parameters (base address,
clock frequency, IRQ number, baud rate, parity, data bits, stop bits), RX/TX buffer sizing,
hardware flow control (RTS/CTS), interrupt-driven data transfer, and console mapping for XUARTPS UART0.
It also provides standard serial driver operations (setup, shutdown, attach/detach, ioctl, send/receive)
and early serial initialization for boot-time console access.
Signed-off-by: chao an <anchao.archer@bytedance.com>
Mainline Linux doesn't use data encapsuation or flow control in its
tty_rpmsg driver. Create a NuttX counterpart which matches this
implementation.
This driver uses the static "rpmsg-tty" name to connect with the
remote service.
Signed-off-by: Maarten Zanders <maarten@zanders.be>
Parameter isconsole in uart_rpmsg_init() has two effects: set uart
terminal flags for typical console use and register the device as
/dev/console. These are separate things. The latter might not be
wanted in all cases.
Use the already existing config option CONFIG_RPMSG_UART_CONSOLE to
conditionally register the uart as console device.
Signed-off-by: Maarten Zanders <maarten@zanders.be>
When the receive buffer is full and the driver only implements recvbuf
operation without receive operation, the code would crash due to calling
a NULL function pointer. This patch fixes the issue by:
1. Check if recvbuf is available before calling it
2. When buffer is full, use a temporary buffer to drain hardware FIFO
to prevent data accumulation in hardware
3. Add proper NULL check for receive operation to avoid crash
4. Initialize pbuf to NULL to prevent uninitialized variable usage
This ensures the serial driver works correctly even when only recvbuf
is implemented and the receive buffer is full.
Signed-off-by: dongjiuzhu1 <dongjiuzhu1@xiaomi.com>
When pressing Ctrl-C, the foreground process did not receive SIGINT
and failed to terminate.
The serial driver called nxsig_tgkill(-1, dev->pid, signo) from
interrupt context. With pid=-1, nxsig_dispatch() was called with
thread=true, which requires stcb->group == this_task()->group.
However, in interrupt context, this_task() returns the IDLE task,
whose group differs from the target process group. This caused
the signal dispatch to fail with -ESRCH.
Solution:
Replace nxsig_tgkill(-1, pid, signo) with nxsig_kill(pid, signo).
nxsig_kill() uses thread=false, which routes through group_signal()
without the same-group check, allowing signals to be delivered
correctly from interrupt context.
Impact:
- Fixes Ctrl-C signal delivery in serial console
- No API changes
- Affects serial driver interrupt handling only
Testing: Verified on QEMU ARM64 simulator with serial console
Signed-off-by: yinshengkai <yinshengkai@bytedance.com>
there is no SERIAL_DMA option, it was removed long time ago in:
0d203fd535
It should be SERIAL_TXDMA and SERIAL_RXDMA
Signed-off-by: raiden00pl <raiden00@railab.me>
Nuttx currently has 2 types of sleep interfaces:
1. Signal-scheduled sleep: nxsig_sleep() / nxsig_usleep() / nxsig_nanosleep()
Weaknesses:
a. Signal-dependent: The signal-scheduled sleep method is bound to the signal framework, while some driver sleep operations do not depend on signals.
b. Timespec conversion: Signal-scheduled sleep involves timespec conversion, which has a significant impact on performance.
2. Busy sleep: up_mdelay() / up_udelay()
Weaknesses:
a. Does not actively trigger scheduling, occupy the CPU loading.
3. New interfaces: Scheduled sleep: nxsched_sleep() / nxsched_usleep() / nxsched_msleep() / nxsched_ticksleep()
Strengths:
a. Does not depend on the signal framework.
b. Tick-based, without additional computational overhead.
Currently, the Nuttx driver framework extensively uses nxsig_* interfaces. However, the driver does not need to rely on signals or timespec conversion.
Therefore, a new set of APIs is added to reduce dependencies on other modules.
(This PR also aims to make signals optional, further reducing the code size of Nuttx.)
Signed-off-by: chao an <anchao.archer@bytedance.com>
Some code paths in drivers/serial/serial.c load head and tail values
of receive and transmit circular buffers with interrupts enabled,
making it possible that the interrupt handler changes the value.
As noted in the code, this is safe as long as the load itself is atomic.
That is not true for 8bit architectures which fetch the 16-bit values
using two load instructions. If interrupt handler runs between those
two instructions and changes the value, the read returns corrupted data.
This patch introduces CONFIG_ARCH_LDST_16BIT_NOT_ATOMIC configuration
option which is automatically selected for AVR architecture. Based
on this option, head and tail values are reduced to 8-bit length
so the read remains atomic.
Patch was tested by building on rv-virt:nsh - disassembly of functions
from serial.c showed no difference which is correct as Risc-V does
not need to protect reads of these values. There should be no impact
for architectures that do not set the new configuration option.
It was also tested by by custom echo application running on AVR128DA28.
Signed-off-by: Kerogit <kr.git@kerogit.eu>
This patch fixes calculation of nbuffered value if
CONFIG_SERIAL_IFLOWCONTROL_WATERMARKS is set. Volatile variable that
can be changed in interrupt handler was used in a condition which
branched the calculation into two paths. Precisely timed interrupt
could make the branch that was taken the incorrect one.
Patch was tested by building on AVR DA/DB chip.
Signed-off-by: Kerogit <kr.git@kerogit.eu>
ax99100 export each serial port as a separate PCI device function
so we have to handle this properly.
Signed-off-by: p-szafonimateusz <p-szafonimateusz@xiaomi.com>
The UART driver (cdcacm...) might have buffered data received, Just continue
processing the RX queue if this happens. If not, then check the file or dev
flags.
Signed-off-by: yangsong8 <yangsong8@xiaomi.com>
Data form serial framework will be written to usb reqbuf directly,
and data form cdcacm will be read form reqbuf directly.
Signed-off-by: yangsong8 <yangsong8@xiaomi.com>
The alloctab can be looped, if the first check the corresponding
bit is set, it will not continue to loop
Signed-off-by: yangsong8 <yangsong8@xiaomi.com>
This commit add support to the serial_icounter_s struct used with
TIOCGICOUNT to report U[S]ART errors such as frame, parity, overrun,
etc.
Signed-off-by: Alan C. Assis <acassis@gmail.com>
UART RAM will have probabilistic bubble time during continuous transmission.
Update the offset after sending to avoid this problem.
Signed-off-by: chao an <anchao.archer@bytedance.com>
This would fix readv/writev issues mentioned in
https://github.com/apache/nuttx/pull/12674.
(only for this specific driver though. with this approach,
we basically have to fix every single drivers and
filesystems.)
Lightly tested on the serial console, using micropython REPL
on toywasm with esp32s3-devkit:toywasm, which used to be
suffered by the readv issue.
0 up_testset (lock=0x404241c0 <g_uart1priv+32>) at /home/hujun5/下载/vela_sim/nuttx/include/arch/spinlock.h:96
1 spin_lock_wo_note (lock=<optimized out>) at /home/hujun5/下载/vela_sim/nuttx/include/nuttx/spinlock.h:207
2 spin_lock_irqsave_wo_note (lock=0x404241c0 <g_uart1priv+32>) at /home/hujun5/下载/vela_sim/nuttx/include/nuttx/spinlock.h:467
3 spin_lock_irqsave (lock=0x404241c0 <g_uart1priv+32>) at /home/hujun5/下载/vela_sim/nuttx/include/nuttx/spinlock.h:521
4 pl011_txint (dev=0x404240b0 <g_uart1port>, enable=false) at serial/uart_pl011.c:746
5 0x00000000402a3f1c in uart_xmitchars (dev=0x404240b0 <g_uart1port>) at serial/serial_io.c:118
6 0x00000000402a10f8 in pl011_txint (dev=<optimized out>, enable=<optimized out>) at serial/uart_pl011.c:756
7 0x00000000402a2ca0 in uart_write (filep=<optimized out>, buffer=<optimized out>, buflen=0) at serial/serial.c:1493
8 0x000000004028c464 in file_writev_compat (filep=0x4046cda0, uio=<optimized out>) at vfs/fs_write.c:81
9 0x000000004028c588 in file_writev (filep=<optimized out>, uio=uio@entry=0x40470dc0) at vfs/fs_write.c:161
10 0x000000004028c5fc in nx_writev (fd=<optimized out>, iov=iov@entry=0x40470e10, iovcnt=iovcnt@entry=1) at vfs/fs_write.c:257
11 0x000000004028c660 in writev (fd=<optimized out>, iov=iov@entry=0x40470e10, iovcnt=iovcnt@entry=1) at vfs/fs_write.c:356
12 0x000000004028c6dc in write (fd=<optimized out>, buf=buf@entry=0x404090b2 <g_nshgreeting>, nbytes=<optimized out>) at vfs/fs_write.c:421
13 0x00000000402adb10 in nsh_session (pstate=pstate@entry=0x40471080, login=login@entry=1, argc=argc@entry=1, argv=argv@entry=0x4046cf40) at nsh_session.c:108
14 0x00000000402ad94c in nsh_consolemain (argc=argc@entry=1, argv=argv@entry=0x4046cf40) at nsh_consolemain.c:75
15 0x00000000402ad894 in nsh_main (argc=argc@entry=1, argv=argv@entry=0x4046cf40) at nsh_main.c:74
16 0x00000000402a5880 in nxtask_startup (entrypt=0x402ad7fc <nsh_main>, argc=1, argv=0x4046cf40) at sched/task_startup.c:72
17 0x000000004029d444 in nxtask_start () at task/task_start.c:116
18 0x0000000000000000 in ?? ()
fix regresion from https://github.com/apache/nuttx/pull/15301
Signed-off-by: hujun5 <hujun5@xiaomi.com>
Modify the kernel to use only atomic_xx and atomic64_xx interfaces,
avoiding the use of sizeof or typeof to determine the type of
atomic operations, thereby simplifying the kernel's atomic
interface operations.
Signed-off-by: zhangyuan29 <zhangyuan29@xiaomi.com>
