Both the UART and PTY serial drivers previously assumed all
VT100/ANSI escape sequences were fixed 3-byte CSI sequences, causing
longer CSI and SS3 key sequences (such as Home, End, Delete, and
modified keys) to leak stray characters into the terminal when local
echo was enabled. This patch replaces the fixed-length logic with a
state machine that correctly recognizes and suppresses escape
sequences of any length, while preserving the data delivered to
applications. The change only affects local echo behavior, is fully
backward compatible, and has been validated with both interactive NSH
sessions and automated PTY tests.
Signed-off-by: Alan C. Assis <acassis@gmail.com>
Assisted-by: Claude Code
Permissions (Part 2)
Description:
In kernel builds, any unprivileged process running on the NuttX
device can open /dev/efuse and attempt to read/write fuse content.
Reading the fuses may provide valuable information to an attacker
controlling the user process. The write operation, in extreme cases
where the fuse blocks are not locked, may brick the device.
DISCLAIMER: I tried to be strict with the settings, better to relax them
later if it's needed.
This is part of https://github.com/apache/nuttx/issues/19410
See https://github.com/apache/nuttx/issues/19410
Compiles ok.
Signed-off-by: Catalin Visinescu <catalin_visinescu@yahoo.com>
uart_putxmitchar() manipulates dev->xmit.head/buffer directly with
no internal locking - every other caller (uart_write()) takes
dev->xmit.lock first. uart_readv()'s ECHO handling (both the
backspace/delete erase sequence and the normal character echo)
calls uart_putxmitchar() without taking that lock, so a concurrent
uart_write() and a local echo can race on the same circular buffer
state, corrupting it.
Take dev->xmit.lock around each echo's uart_putxmitchar() calls,
matching what uart_write() already does. uart_readv() holds
dev->recv.lock for its own duration, but no other code path ever
acquires recv.lock while holding xmit.lock, so nesting xmit.lock
inside the existing recv.lock scope here doesn't introduce a new
lock-ordering cycle.
Fixes#14845
Signed-off-by: yi chen <94xhn1@gmail.com>
NuttX has no real session/process-group abstraction, so the TTY layer
collapses the foreground process group onto the single dev->pid field
(pgrp == pid, one member per group). Extend the controlling-terminal
support so portable software (e.g. dropbear, socat) that relies on
job-control primitives works without losing the existing NuttX-specific
behaviour.
Driver (serial.c, pty.c):
- TIOCSCTTY now accepts a flag: arg > 0 keeps the historical "target
PID in arg" semantics (NSH registers the foreground command it just
spawned), while arg == 0 selects the calling task via
nxsched_getpid(), matching the POSIX flag convention used by
dropbear/socat/apue. This preserves all existing callers and makes
the previously-dead arg==0 path deliver SIGINT correctly.
- Add TIOCGPGRP/TIOCGSID (return dev->pid) and TIOCSPGRP (set it).
- pty.c gains the same handlers against pd_pid and includes
nuttx/sched.h for nxsched_getpid().
ioctl numbers (tioctl.h): TIOCGPGRP/TIOCSPGRP/TIOCGSID at 0x37-0x39.
libc wrappers:
- termios: tcgetpgrp(), tcsetpgrp(), tcgetsid() over the new ioctls.
- unistd: setsid()/getsid()/setpgid() stubs consistent with the
existing getpgrp()/getpgid() single-session model (sid == pgid ==
pid; setpgid only succeeds for pgid == pid).
Declare the new prototypes in unistd.h (tcgetsid was already in
termios.h) and register all sources in the Make.defs/CMakeLists.
Group-broadcast signalling (kill(-pgrp)) remains unsupported, so
tty signals still target the single dev->pid; a real session/process
group model is left as a follow-up.
Signed-off-by: Xiang Xiao <xiaoxiang@xiaomi.com>
uart_tcdrain() takes a caller-supplied timeout (e.g. 10s from the
TCDRN ioctl path), but the timeout was only applied to the final
TX-FIFO polling loop. The earlier xmit-buffer drain loop called
nxsem_wait(&dev->xmitsem) with no timeout, so any condition that
prevents the lower half from posting xmitsem (e.g. a stuck DMA
completion path, a wedged hardware-flow-control stall) would block
tcdrain() indefinitely, regardless of the timeout the caller asked
for. The pre-existing comment ("NOTE: There is no timeout on the
following loop. ... the caller should call tcflush() first") openly
acknowledged this hang.
Move the start timestamp before both phases and replace the bare
nxsem_wait() with nxsem_tickwait() using the remaining time, so the
total time spent in tcdrain() honors the caller's timeout regardless
of which phase stalls. When the remaining time is already exhausted,
short-circuit to -ETIMEDOUT without calling into the scheduler. The
existing exit path (drop critical section, skip the FIFO polling
loop, unlock the xmit mutex, leave the cancellation point) handles
the new -ETIMEDOUT propagation correctly without further changes.
Also fold the "Set up for the timeout" comment into the kludge
REVISIT comment, since the timestamp is no longer set up at that
point.
Signed-off-by: Lingao Meng <menglingao@xiaomi.com>
uart_tcdrain() registers a cancellation point on entry via
enter_cancellation_point() (when called with cancelable=true), and the
normal exit path calls leave_cancellation_point() before returning.
However the timeout path inside the FIFO drain loop returns -ETIMEDOUT
directly without going through the normal exit path, leaking one
cancellation point reference (tcb->cpcount is left incremented). Over
repeated timeouts this counter will desync and prevent
pthread_cancel() / pthread_setcancelstate() from behaving correctly
for the calling thread.
Fix by calling leave_cancellation_point() before the early return,
matching the existing exit path.
Signed-off-by: Lingao Meng <menglingao@xiaomi.com>
debug.h is a NuttX-specific, non-POSIX header. Placing it in the
top-level include/ directory creates naming conflicts with external
projects that define their own debug.h.
This commit moves the canonical header to include/nuttx/debug.h,
following the NuttX convention for non-POSIX/non-standard headers,
and updates all in-tree references.
A backward-compatibility shim is left at include/debug.h that
emits a deprecation #warning and re-includes <nuttx/debug.h>,
allowing out-of-tree code to continue building while migrating.
Signed-off-by: Piyush Patle <piyushpatle228@gmail.com>
Nuttx currently has 2 types of sleep interfaces:
1. Signal-scheduled sleep: nxsig_sleep() / nxsig_usleep() / nxsig_nanosleep()
Weaknesses:
a. Signal-dependent: The signal-scheduled sleep method is bound to the signal framework, while some driver sleep operations do not depend on signals.
b. Timespec conversion: Signal-scheduled sleep involves timespec conversion, which has a significant impact on performance.
2. Busy sleep: up_mdelay() / up_udelay()
Weaknesses:
a. Does not actively trigger scheduling, occupy the CPU loading.
3. New interfaces: Scheduled sleep: nxsched_sleep() / nxsched_usleep() / nxsched_msleep() / nxsched_ticksleep()
Strengths:
a. Does not depend on the signal framework.
b. Tick-based, without additional computational overhead.
Currently, the Nuttx driver framework extensively uses nxsig_* interfaces. However, the driver does not need to rely on signals or timespec conversion.
Therefore, a new set of APIs is added to reduce dependencies on other modules.
(This PR also aims to make signals optional, further reducing the code size of Nuttx.)
Signed-off-by: chao an <anchao.archer@bytedance.com>
Some code paths in drivers/serial/serial.c load head and tail values
of receive and transmit circular buffers with interrupts enabled,
making it possible that the interrupt handler changes the value.
As noted in the code, this is safe as long as the load itself is atomic.
That is not true for 8bit architectures which fetch the 16-bit values
using two load instructions. If interrupt handler runs between those
two instructions and changes the value, the read returns corrupted data.
This patch introduces CONFIG_ARCH_LDST_16BIT_NOT_ATOMIC configuration
option which is automatically selected for AVR architecture. Based
on this option, head and tail values are reduced to 8-bit length
so the read remains atomic.
Patch was tested by building on rv-virt:nsh - disassembly of functions
from serial.c showed no difference which is correct as Risc-V does
not need to protect reads of these values. There should be no impact
for architectures that do not set the new configuration option.
It was also tested by by custom echo application running on AVR128DA28.
Signed-off-by: Kerogit <kr.git@kerogit.eu>
This patch fixes calculation of nbuffered value if
CONFIG_SERIAL_IFLOWCONTROL_WATERMARKS is set. Volatile variable that
can be changed in interrupt handler was used in a condition which
branched the calculation into two paths. Precisely timed interrupt
could make the branch that was taken the incorrect one.
Patch was tested by building on AVR DA/DB chip.
Signed-off-by: Kerogit <kr.git@kerogit.eu>
The UART driver (cdcacm...) might have buffered data received, Just continue
processing the RX queue if this happens. If not, then check the file or dev
flags.
Signed-off-by: yangsong8 <yangsong8@xiaomi.com>
Data form serial framework will be written to usb reqbuf directly,
and data form cdcacm will be read form reqbuf directly.
Signed-off-by: yangsong8 <yangsong8@xiaomi.com>
This would fix readv/writev issues mentioned in
https://github.com/apache/nuttx/pull/12674.
(only for this specific driver though. with this approach,
we basically have to fix every single drivers and
filesystems.)
Lightly tested on the serial console, using micropython REPL
on toywasm with esp32s3-devkit:toywasm, which used to be
suffered by the readv issue.
This would avoid the undesirable intertactions with the serial driver
described in https://github.com/apache/nuttx/issues/14662.
Although I'm not entirely happy with this fix because it assumes
the particular implementations of up_putc/up_nputc and its association
to the serial devices, I haven't come up with better ideas for now.
An alternative is to place some serializations inside the target
specific serial (and/or whatever provides up_putc api) implementaitons.
But it isn't too attractive to put potentially complex logic into the
low-level machinaries, especially when we have a lot of similar copies
of it.
Another alternative is to deprecate up_putc. (at least for the purpose
of syslog.) But it seems at least some of users are relying on what
the current implementation provides heavily.
This commit also removes g_lowputs_lock because the critical section
would serve the purpose of the lock as well.
Most tools used for compliance and SBOM generation use SPDX identifiers
This change brings us a step closer to an easy SBOM generation.
Signed-off-by: Alin Jerpelea <alin.jerpelea@sony.com>
currently, nuttx implements readv/writev on the top of read/write.
while it might work for the simplest cases, it's broken by design.
for example, it's impossible to make it work correctly for files
which need to preserve data boundaries without allocating a single
contiguous buffer. (udp socket, some character devices, etc)
this change is a start of the migration to a better design.
that is, implement read/write on the top of readv/writev.
to avoid a single huge change, following things will NOT be done in
this commit:
* fix actual bugs caused by the original readv-based-on-read design.
(cf. https://github.com/apache/nuttx/pull/12674)
* adapt filesystems/drivers to actually benefit from the new interface.
(except a few trivial examples)
* eventually retire the old interface.
* retire read/write syscalls. implement them in libc instead.
* pread/pwrite/preadv/pwritev (except the introduction of struct uio,
which is a preparation to back these variations with the new
interface.)
1. Use critical_section to protect the fds array;
2. Use critical_section and sched lock to protect the poll notify, because
poll notify may cause context switch, delay the context swtich to
sched_unlock();
Signed-off-by: Bowen Wang <wangbowen6@xiaomi.com>
we can use uart to debug nuttx,like debugger:
1. read/write memory
2. Use watchpoint,breakpoint,single step.
use up_debugpoint api
3. Ctrl+c to stop, continue, or single step.
hold uart send and receive
4. register a panic event, when crash or assert/panic, we use uart to
debug.
Signed-off-by: anjiahao <anjiahao@xiaomi.com>
if multiple threads are doing serial read/write at the same time,
the driver will only wake up one of the thread, which will cause
other threads fail to be woken up in time and cause blocking
Signed-off-by: chao an <anchao@xiaomi.com>
The spawn proxy thread is a special existence in NuttX, usually some developers
spend a lot of time on stack overflow of spawn proxy thread:
https://github.com/apache/nuttx/issues/9046https://github.com/apache/nuttx/pull/9081
In order to avoid similar issues, this PR will remove spawn proxy thread to simplify
the process of task/posix_spawn().
1. Postpone the related processing of spawn file actions until after task_init()
2. Delete the temporary thread of spawn proxy and related global variables
Signed-off-by: chao an <anchao@xiaomi.com>
CONFIG_SERIAL_TERMIOS only decide whether to support c_cflag field since
many terminal application need the first three fields to work correctly.
For more information please reference:
https://www.mail-archive.com/dev@nuttx.apache.org/msg09321.html
before this change(olimexino-stm32:tiny):
text data bss dec hex filename
34884 328 1768 36980 9074 nuttx
after this change:
text data bss dec hex filename
35052 340 1768 37160 9128 nuttx
delta
text data bss dec hex filename
168 12 0 180 b4 nuttx
Signed-off-by: Xiang Xiao <xiaoxiang@xiaomi.com>
There is a rookie mistake introduced by https://github.com/apache/nuttx/pull/8691,
ECHO flag is a part of Local Mode (c_lflags) instead of c_iflags.
nuttx-apps should do the same change in nsh_login and termcurse_vt100.
Signed-off-by: Huang Qi <huangqi3@xiaomi.com>
Echoing console's input is now performed by the serial driver
(https://github.com/apache/nuttx/pull/8691). In order to keep old
behavior of CR being echoed by the device, it's needed to detected
whenever NL is being echoed and send CR before sending it.
