syslog_write_foreach() compares an unsigned count against a signed
accumulator:
size_t nwritten = 0;
ssize_t nwritten_max = -EIO;
...
if (nwritten > nwritten_max)
{
nwritten_max = nwritten;
}
return nwritten_max;
The usual arithmetic conversions promote nwritten_max to size_t, so -EIO
becomes 4294967291 on a 32-bit target, and the comparison is never true.
nwritten_max keeps its initial value and the function returns -EIO no
matter how many bytes actually went out. Observed under gdb on a running
target: nwritten == 64, nwritten_max == -5, (nwritten > nwritten_max) == 0.
Most callers discard the result -- syslog() itself returns void -- so this
is normally invisible. It becomes fatal when /dev/console is backed by
syslog_console_write(), because then stdio acts on it.
lib_fflush_unlocked() sees a negative return, sets __FS_FLAG_ERROR and
returns early, before resetting fs_bufpos. The bytes have already been
emitted, but the buffer is never cleared, so every subsequent stdio call
re-flushes the same CONFIG_STDIO_BUFFER_SIZE bytes. The console fills
with one repeated fragment and the system makes no further progress.
Reaching that state needs CONFIG_CONSOLE_SYSLOG=y together with no driver
claiming /dev/console ahead of syslog_console_init(). Three in-tree
defconfigs qualify: x86/qemu-i486:ostest, renesas/skp16c26:ostest and
x86_64/qemu-intel64:earlyfb. The other 56 CONSOLE_SYSLOG configurations
have a serial console that registers /dev/console first, which is why this
has gone unnoticed.
Introduced by 1685e8ff7b ("syslog: avoid an infinite loop if one channel
fails"), which changed nwritten_max from size_t to ssize_t = -EIO so that
an all-channels-failed case could be reported. Give nwritten the same type
so the comparison is signed, which preserves that intent: nwritten_max
stays -EIO only when no channel wrote anything. nwritten is never negative,
so the remaining comparisons against buflen are unaffected.
Signed-off-by: Marco Casaroli <marco.casaroli@gmail.com>
Assisted-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Permissions (Part 2)
Description:
In kernel builds, any unprivileged process running on the NuttX
device can open /dev/efuse and attempt to read/write fuse content.
Reading the fuses may provide valuable information to an attacker
controlling the user process. The write operation, in extreme cases
where the fuse blocks are not locked, may brick the device.
DISCLAIMER: I tried to be strict with the settings, better to relax them
later if it's needed.
This is part of https://github.com/apache/nuttx/issues/19410
See https://github.com/apache/nuttx/issues/19410
Compiles ok.
Signed-off-by: Catalin Visinescu <catalin_visinescu@yahoo.com>
The current implementation exits syslog_write_foreach function
if write to one channel fails, causing other channels not being written
and returning negated errno. libc syslog functions then stay in
an infinite loop, because error is returned and the same bytes
are still passed to syslograwstream_flush and syslog_write_foreach.
The channel write may fail for many reasons - disconnected USB if
CDC ACM syslog is enabled, lost networking if telnet syslog is enabled,
error on NOR flash etc. This shouldn't lead to an ininite loop in the
code though.
The solution ensures all channels in syslog_write_foreach are tried,
therefore the user get the output to the working channels even if
the first one is broken. It also updates syslograwstream_addchar and
syslograwstream_addstring to skip the bytes if all channels fails. This
ensures syslog call won't result in an infinite loop, but the user may
lost the debugging output.
Co-authored-by: Martin Krasula <mkrasula@elektroline.cz>
Signed-off-by: Michal Lenc <michallenc@seznam.cz>
Now that time_t is unconditionally 64-bit (signed int64_t) and the
struct timespec fields tv_sec / tv_nsec are wide enough on their own,
the explicit (uint64_t)/(int64_t)/(int) casts that used to guard the
multiplications and subtractions in *_us / *_ms / *_ns helpers are no
longer needed. Drop them to keep the timekeeping math readable and
consistent with the previous sclock_t/time_t cleanup.
In the same spirit, this commit also:
* Normalises the printf-style format specifiers and casts used to
print tv_sec / tv_nsec / tv_usec values across arch/, drivers/,
fs/, sched/ and libs/. The prior code was a mix of
"%d"/"%u"/"%ld"/"%lu"/"%lld"/PRIu32/PRIu64 with matching
(int)/(unsigned long)/(long long)/PRIu* casts; some formats
truncated time_t on 32-bit hosts, others mismatched signedness or
width. Replace all such cases with the portable POSIX-recommended
forms:
- tv_sec (time_t, signed, impl-defined width) -> %jd + (intmax_t)
- tv_nsec (long, signed) -> %ld (no cast)
- tv_usec (suseconds_t / long) -> %ld (no cast)
Add #include <stdint.h> where required.
* Drops a few stale `(FAR const time_t *)&ts.tv_sec` casts and
related `(FAR struct tm *)` / `(const time_t *)` casts in
gmtime_r() / localtime_r() / gmtime() callers; ts.tv_sec is plain
time_t now and the casts only obscured the type.
* Fixes one overflow in fs/procfs/fs_procfscritmon.c where
all_time.tv_sec * 1000000 could overflow on 32-bit time_t before
being multiplied again; cast to uint64_t at the start.
No behavioural change.
Signed-off-by: Xiang Xiao <xiaoxiang@xiaomi.com>
debug.h is a NuttX-specific, non-POSIX header. Placing it in the
top-level include/ directory creates naming conflicts with external
projects that define their own debug.h.
This commit moves the canonical header to include/nuttx/debug.h,
following the NuttX convention for non-POSIX/non-standard headers,
and updates all in-tree references.
A backward-compatibility shim is left at include/debug.h that
emits a deprecation #warning and re-includes <nuttx/debug.h>,
allowing out-of-tree code to continue building while migrating.
Signed-off-by: Piyush Patle <piyushpatle228@gmail.com>
This commit introduces a new Kconfig option SYSLOG_TIMESTAMP_MS to allowconfiguring
syslog timestamps to use milliseconds (ms) instead of the default microseconds (µs).
Key changes:
1. Add CONFIG_SYSLOG_TIMESTAMP_MS boolean Kconfig option (depends on SYSLOG_TIMESTAMP),
default disabled. This option lets users choose between millisecond and microsecond
precision in syslog timestamps.
2. Modify the timestamp format string in nx_vsyslog():
a. When CONFIG_SYSLOG_TIMESTAMP_MS is enabled: Use [%5ju.%03ld] (3 digits for ms).
b. When disabled (default): Retain original [%5ju.%06ld] (6 digits for µs).
3. Adjust the timestamp value calculation:
a. For ms: Divide nanoseconds by NSEC_PER_MSEC (1,000,000) to get millisecond value.
b. For µs (default): Retain division by NSEC_PER_USEC (1,000) for microsecond value.
This enhancement provides flexibility in syslog timestamp precision:
1. Millisecond precision reduces log line length and is sufficient for many use cases.
2. Maintains backward compatibility (microseconds remain the default).
3. The Kconfig dependency ensures the option is only visible when timestamps are enabled.
The change is fully conditional and has no impact on existing behavior unless the new option is explicitly enabled.
Signed-off-by: liwangzhu <liwangzhu@bytedance.com>
Signed-off-by: chao an <anchao.archer@bytedance.com>
Signals in NuttX serve two primary purposes:
1. Synchronization and wake-up:
Signals can be used to block threads on specific signal sets and later
wake them up by delivering the corresponding signals to those threads.
2. Asynchronous notification:
Signals can also be used to install callback handlers for specific signals, allowing threads to
asynchronously invoke those handlers when the signals are delivered.
This change introduces the ability to partially disable signal functionality: to disable only signal functions for
Asynchronous notification, keeping functions for Synchronization and wake-up.
This enables finer-grained control over signal usage while preserving existing behavior for supported use cases.
Co-authored-by: Guo Shichao guoshichao@xiaomi.com
Signed-off-by: Chengdong Wang wangchengdong@lixiang.com
Add documentation describing the purpose and behavior of early_syslog(),
which provides a minimal logging facility available during early system
initialization or system down.
Signed-off-by: Chengdong Wang wangchengdong@lixiang.com
Introduce early_syslog() to enable basic logging during the very early
boot or system down stages, when the full syslog subsystem is not yet
available.
Signed-off-by: Chengdong Wang wangchengdong@lixiang.com
In current implementation, when doing syslog_write(), there may
be more than one channel, the syslog will iterate each channel,
but only return the bytes writen through the last channel, the
better way should be returning the maximum bytes writen
through one channel.
Signed-off-by: Chengdong Wang <wangchengdong@lixiang.com>
Initial implementation of RFC 5424 support (syslog protocol). Allows
users to force-format the syslog output in a RFC 5424 compatible way,
making NuttX systems 'originators' that are able to interface with
syslog 'collectors' and 'relays' (useful for logging to syslog servers).
In addition to regular formatting options for syslog output, users can
also add structured data (currently only timeQuality is implemented,
assuming no sync and no timezone is no known). Facilities and severities
now also follow RFC 5424. Support for additional features (like
more sdata elements, msgid, etc.) will need to be built into the syslog
implementation if desired.
if rpmsg triggers force flushing when the master core provides lower putc,
characters will be duplicated caused by SYSLOG_DEFAULT also send the char to lower half.
in this PR, we disable force put char to lower putc if CONFIG_SYSLOG_DEFAULT is enabled
Signed-off-by: chao an <anchao.archer@bytedance.com>
Add an option to completely disable syslog() and replace it with an empty functions.
This option can be useful for small systems when we don't have any logging support,
but compiler is not able to remove useless code.
This way the final image also won't contain the strings that are present in
syslog() calls when compiler optimization is enabled (for example from /boards
where syslog is often used instead of debug macros).
Signed-off-by: raiden00pl <raiden00@railab.me>
Replace get current tcb method from nxsched_get_tcb(nxsched_gettid()) to this_task(),
change two function calls with inline function to improve performance:
FAR struct tcb_s *tcb = nxsched_get_tcb(nxsched_gettid());
FAR struct tcb_s *tcb = this_task();
Signed-off-by: chao an <anchao.archer@bytedance.com>
Use the CDCACM as a SYSLOG output device, send message to remote proc.
If there are more than one CDCACM devices, then a device minor number
may also need to be provided. Default: 0
Signed-off-by: yangsong8 <yangsong8@xiaomi.com>
just read the code, still have the deadlock after below change:
| commit 3b6f463ce2
| Author: chenrun1 <chenrun1@xiaomi.com>
| Date: Tue Dec 31 14:31:46 2024 +0800
|
| syslog_inbuffer:Fixed the lock reentry issue in single core + spinlock scenario
|
| Summary:
| When spinlock.h is enabled in a single-core scenario, spinlock reentry and exceptions may occur when spin_lock_irqsave_wo_note is used in syslog_add_intbuffer
|
| Signed-off-by: chenrun1 <chenrun1@xiaomi.com>
Signed-off-by: chao an <anchao.archer@bytedance.com>
Summary:
When spinlock.h is enabled in a single-core scenario, spinlock reentry and exceptions may occur when spin_lock_irqsave_wo_note is used in syslog_add_intbuffer
Signed-off-by: chenrun1 <chenrun1@xiaomi.com>
syslog_putc() have a lot of duplicate logic with syslog_write().
remove syslog_putc() and reuse syslog_write() to simplify syslog printing.
Signed-off-by: chao an <anchao@lixiang.com>
This would avoid the undesirable intertactions with the serial driver
described in https://github.com/apache/nuttx/issues/14662.
Although I'm not entirely happy with this fix because it assumes
the particular implementations of up_putc/up_nputc and its association
to the serial devices, I haven't come up with better ideas for now.
An alternative is to place some serializations inside the target
specific serial (and/or whatever provides up_putc api) implementaitons.
But it isn't too attractive to put potentially complex logic into the
low-level machinaries, especially when we have a lot of similar copies
of it.
Another alternative is to deprecate up_putc. (at least for the purpose
of syslog.) But it seems at least some of users are relying on what
the current implementation provides heavily.
This commit also removes g_lowputs_lock because the critical section
would serve the purpose of the lock as well.
Most tools used for compliance and SBOM generation use SPDX identifiers
This change brings us a step closer to an easy SBOM generation.
Signed-off-by: Alin Jerpelea <alin.jerpelea@sony.com>
Blocking while running a signal handler is not advisable, instead write
the log string character by character.
There is also a potential for a deadlock, as discussed in #6618
Note: querying for rtcb->sigdeliver is not 100% ideal, as it only tells
_if_ a signal handler has been queued, not if it is running. However, it
makes syslog safe / usable which is a debug feature anyhow.
CC: clk/clk_fixed_rate.c clk/clk_divider.c:177:14: warning: taking the absolute value of unsigned type 'unsigned int' has no effect [-Wabsolute-value]
return abs(rate - now) < abs(rate - best);
^
clk/clk_divider.c:177:14: note: remove the call to 'abs' since unsigned values cannot be negative
return abs(rate - now) < abs(rate - best);
^~~
clk/clk_divider.c:177:32: warning: taking the absolute value of unsigned type 'unsigned int' has no effect [-Wabsolute-value]
return abs(rate - now) < abs(rate - best);
^
clk/clk_divider.c:177:32: note: remove the call to 'abs' since unsigned values cannot be negative
return abs(rate - now) < abs(rate - best);
^~~
CC: mm_heap/mm_initialize.c 2 warnings generated.
clk/clk.c:1324:11: warning: variable 'irqflags' is used uninitialized whenever 'if' condition is true [-Wsometimes-uninitialized]
if (clk->parents == NULL)
^~~~~~~~~~~~~~~~~~~~
clk/clk.c:1341:19: note: uninitialized use occurs here
clk_list_unlock(irqflags);
^~~~~~~~
clk/clk.c:1324:7: note: remove the 'if' if its condition is always false
if (clk->parents == NULL)
^~~~~~~~~~~~~~~~~~~~~~~~~
clk/clk.c:1255:22: note: initialize the variable 'irqflags' to silence this warning
irqstate_t irqflags;
^
= 0
CC: clk/clk_mux.c clk/clk_multiplier.c:110:14: warning: taking the absolute value of unsigned type 'unsigned int' has no effect [-Wabsolute-value]
return abs(rate - new) < abs(rate - best);
^
clk/clk_multiplier.c:110:14: note: remove the call to 'abs' since unsigned values cannot be negative
return abs(rate - new) < abs(rate - best);
^~~
clk/clk_multiplier.c:110:32: warning: taking the absolute value of unsigned type 'unsigned int' has no effect [-Wabsolute-value]
return abs(rate - new) < abs(rate - best);
^
clk/clk_multiplier.c:110:32: note: remove the call to 'abs' since unsigned values cannot be negative
return abs(rate - new) < abs(rate - best);
^~~
clk/clk_mux.c:47:14: warning: taking the absolute value of unsigned type 'unsigned int' has no effect [-Wabsolute-value]
return abs(now - rate) < abs(best - rate);
^
clk/clk_mux.c:47:14: note: remove the call to 'abs' since unsigned values cannot be negative
return abs(now - rate) < abs(best - rate);
^~~
clk/clk_mux.c:47:32: warning: taking the absolute value of unsigned type 'unsigned int' has no effect [-Wabsolute-value]
return abs(now - rate) < abs(best - rate);
^
clk/clk_mux.c:47:32: note: remove the call to 'abs' since unsigned values cannot be negative
return abs(now - rate) < abs(best - rate);
^~~
AS: sim/sim_fork_x86.S 2 warnings generated.
1 warning2 warnings generated.
generated.
iperf.c:325:14: warning: format specifies type 'uintmax_t' (aka 'unsigned long long') but the argument has type 'unsigned long' [-Wformat]
now_len -last_len,
^~~~~~~~~~~~~~~~~
iperf.c:340:14: warning: format specifies type 'uintmax_t' (aka 'unsigned long long') but the argument has type 'uintmax_t' (aka 'unsigned long') [-Wformat]
now_len,
^~~~~~~
CC: misc/rpmsgblk_server.c 2 warnings generated.
:28: warning: format specifies type 'uintmax_t' (aka 'unsigned long long') but the argument has type 'uintmax_t' (aka 'unsigned long') [-Wformat]
(uintmax_t)skip);
^~~~~~~~~~~~~~~
nsh_dbgcmds.c:473:20: warning: format specifies type 'uintmax_t' (aka 'unsigned long long') but the argument has type 'uintmax_t' (aka 'unsigned long') [-Wformat]
(uintmax_t)position);
^~~~~~~~~~~~~~~~~~~
CC: nsh_main.c 2 warnings generated.
return INTMAX_MIN;
~~~~~~ ^~~~~~~~~~
CC: nsh_system.c note: expanded from macro 'INTMAX_MIN'
^~~~~~~~~
/Users/vela/work/nuttx/include/stdint.h:65:41: note: expanded from macro 'INT64_MIN'
~~~~~~~~~~~^~~
inttypes/lib_strtoimax.c:103:37: warning: implicit conversion from 'long long' to 'intmax_t' (aka 'long') changes value from -9223372036854775808 to 0 [-Wconstant-conversion]
return (accum == limit) ? INTMAX_MIN : -(intmax_t)accum;
~~~~~~ ^~~~~~~~~~
/Users/vela/work/nuttx/include/stdint.h:136:29: note: expanded from macro 'INTMAX_MIN'
^~~~~~~~~
/Users/vela/work/nuttx/include/stdint.h:65:41: note: expanded from macro 'INT64_MIN'
~~~~~~~~~~~^~~
inttypes/lib_strtoimax.c:106:17: warning: result of comparison of constant 9223372036854775807 with expression of type 'uintmax_t' (aka 'unsigned long') is always false [-Wtautological-constant-out-of-range-compare]
if (accum > INTMAX_MAX)
~~~~~ ^ ~~~~~~~~~~
inttypes/lib_strtoimax.c:109:18: warning: implicit conversion from 'long long' to 'intmax_t' (aka 'long') changes value from 9223372036854775807 to -1 [-Wconstant-conversion]
return INTMAX_MAX;
~~~~~~ ^~~~~~~~~~
/Users/vela/work/nuttx/include/stdint.h:137:29: note: expanded from macro 'INTMAX_MAX'
^~~~~~~~~
/Users/vela/work/nuttx/include/stdint.h:66:29: note: expanded from macro 'INT64_MAX'
^~~~~~~~~~~~~~~~~~~~~~~~~~~~
/Users/vela/work/nuttx/include/arch/inttypes.h:35:23: note: expanded from macro 'INT64_C'
^~~~~~~
<scratch space>:12:1: note: expanded from here
9223372036854775807ll
^~~~~~~~~~~~~~~~~~~~~
syslog/vsyslog.c:212:32: warning: format specifies type 'uintmax_t' (aka 'unsigned long long') but the argument has type 'uintmax_t' (aka 'unsigned long') [-Wformat]
, (uintmax_t)ts.tv_sec
^~~~~~~~~~~~~~~~~~~~
CC: iob/iob_free.c 4 warnings generated.
1 warning generated.
CC: mqueue/mq_msgqalloc.c inttypes/lib_strtoumax.c:91:23: warning: implicit conversion from 'unsigned long long' to 'uintmax_t' (aka 'unsigned long') changes value from 18446744073709551615 to 4294967295 [-Wconstant-conversion]
accum = UINTMAX_MAX;
~ ^~~~~~~~~~~
/Users/vela/work/nuttx/include/stdint.h:140:29: note: expanded from macro 'UINTMAX_MAX'
^~~~~~~~~~
/Users/vela/work/nuttx/include/stdint.h:67:29: note: expanded from macro 'UINT64_MAX'
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
/Users/vela/work/nuttx/include/arch/inttypes.h:36:23: note: expanded from macro 'UINT64_C'
^~~~~~~~
<scratch space>:8:1: note: expanded from here
18446744073709551615ull
^~~~~~~~~~~~~~~~~~~~~~~
CC: icmp/icmp_ioctl.c 1 warning generated.
time/lib_strftime.c:584:52: warning: format specifies type 'uintmax_t' (aka 'unsigned long long') but the argument has type 'uintmax_t' (aka 'unsigned long') [-Wformat]
len = snprintf(dest, chleft, "%ju", (uintmax_t)mktime(&tmp));
~~~ ^~~~~~~~~~~~~~~~~~~~~~~
%ju
Signed-off-by: Bowen Wang <wangbowen6@xiaomi.com>
