Currently, the `read` function of the watchdog device is dummy and
does nothing. Although this is fine, it's not useful at all from a
userspace perspective, where you may want to check the current WDOG
status.
A wrapper around the `ioctl` `WDIOC_GETSTATUS` has been added as
the `read` function for the WDOG.
Signed-off-by: Javier Alonso <javieralonso@geotab.com>
Provide per-instance capture automonitor lookup for watchdog lower halves
that pass callback context, and avoid selecting an unrelated watchdog when
legacy lower halves provide no context. Update STM32 WWDG lower halves to pass
their instance context so multiple watchdog devices remain distinguishable.
Signed-off-by: hanzhijian <hanzhijian@zepp.com>
Assisted-by: OpenAI Codex
Permissions (Part 2)
Description:
In kernel builds, any unprivileged process running on the NuttX
device can open /dev/efuse and attempt to read/write fuse content.
Reading the fuses may provide valuable information to an attacker
controlling the user process. The write operation, in extreme cases
where the fuse blocks are not locked, may brick the device.
DISCLAIMER: I tried to be strict with the settings, better to relax them
later if it's needed.
This is part of https://github.com/apache/nuttx/issues/19410
See https://github.com/apache/nuttx/issues/19410
Compiles ok.
Signed-off-by: Catalin Visinescu <catalin_visinescu@yahoo.com>
fs_getfilep()/fs_putfilep() were renamed to file_get()/file_put().
The PTP clock paths still used the old names, breaking the PTP_CLOCK build.
Signed-off-by: raiden00pl <raiden00@railab.me>
While attempting to create architecture-specific implementation
of up_udelay, it was discovered that the overriding function is not
included in the final binary, the weak implementation was used instead.
Further investigation and experimentation showed that the linker
only overrides the weak implementation with the custom one if
the custom one is present in a .c source file that contains at least
one other function that is called from somewhere. Some additional
testing revealed that at least one other already present up_udelay
override (rv32m1-vega:nsh) is affected by this.
In a short mailing list discussion it was determined that this
is a likely result of using static libraries during the build process
and it was suggested to introduce configuration option that will
exclude weak implementations of the function from the build altogether.
This patch does that.
This patch does not enable this configuration option for any existing
board/chip because doing so would change its behaviour and needs
to be tested by users of the hardware.
Also changed is the static assertion in sched/clock/clock_delay.c
to not prevent building the code when architecture declares that
it does not use BOARD_LOOPSPERMSEC to determine required loop count.
BOARD_LOOPSPERMSEC is made undefined in such case.
Patch was tested by building breadxavr:nsh (identical binary by SHA256),
rv32m1-vega:nsh (identical text section) and rv-virt:nsh (text section
differs because of different ordering of functions in the binary, ostest
passed though.)
Signed-off-by: Kerogit <kr.git@kerogit.eu>
up_timer_gettime() computed tv_sec and tv_nsec from two separate calls
to current_usec(), which returns a free-running microsecond counter.
The counter advances between the two calls, so a read that straddles a
second boundary yields an inconsistent (possibly backwards) timespec.
Read current_usec() once into a local variable and derive both fields
from that single snapshot.
Signed-off-by: yushuailong <yyyusl@qq.com>
On some boards, the PCF85263 RTC does not count between reboots. Due to STOP_ENABLE (register 0x2E), bit=0 = 1, which freezes the RTC counter.
The exact trigger is unknown - not all boards exhibit the issue. The bit is battery-backed and
persists across reboots, so once set (e.g. by a power glitch or undefined hardware state) the
RTC stays frozen until explicitly cleared. The old driver never did this.
Fix: write `0x00` to `STOP_ENABLE` on init, which is the correct reset value per the datasheet.
Fix: set time properly:
Due to datasheet the set_time should be as follow:
1. set stop_enable
2. clear prescaler
3. set time
4. clear stop_enable
Signed-off-by: Marin Doetterer <marin@auterion.com>
BREAKING CHANGE: separate pulse count feature from PWM driver.
Coupling PWM driver with pulse count feature was bad decision from the beginning,
these are two different things:
- PWM is a modulation scheme: it continuously represents a value by varying duty
cycle, usually at a fixed frequency.
- Pulse train generation is a finite waveform transaction: generate N edges/pulses
with selected timing, then complete.
This change introduce a new pulse count driver with new API.
Now user can generate pulse train by providing:
- high pulse length in ns
- low pulse length in ns
- pulse count
All architectures supporting pulse count have been adapted in subsequent commits.
Users must migrate their code to use the new driver with new API.
Signed-off-by: raiden00pl <raiden00@railab.me>
Now that time_t is unconditionally 64-bit (signed int64_t) and the
struct timespec fields tv_sec / tv_nsec are wide enough on their own,
the explicit (uint64_t)/(int64_t)/(int) casts that used to guard the
multiplications and subtractions in *_us / *_ms / *_ns helpers are no
longer needed. Drop them to keep the timekeeping math readable and
consistent with the previous sclock_t/time_t cleanup.
In the same spirit, this commit also:
* Normalises the printf-style format specifiers and casts used to
print tv_sec / tv_nsec / tv_usec values across arch/, drivers/,
fs/, sched/ and libs/. The prior code was a mix of
"%d"/"%u"/"%ld"/"%lu"/"%lld"/PRIu32/PRIu64 with matching
(int)/(unsigned long)/(long long)/PRIu* casts; some formats
truncated time_t on 32-bit hosts, others mismatched signedness or
width. Replace all such cases with the portable POSIX-recommended
forms:
- tv_sec (time_t, signed, impl-defined width) -> %jd + (intmax_t)
- tv_nsec (long, signed) -> %ld (no cast)
- tv_usec (suseconds_t / long) -> %ld (no cast)
Add #include <stdint.h> where required.
* Drops a few stale `(FAR const time_t *)&ts.tv_sec` casts and
related `(FAR struct tm *)` / `(const time_t *)` casts in
gmtime_r() / localtime_r() / gmtime() callers; ts.tv_sec is plain
time_t now and the casts only obscured the type.
* Fixes one overflow in fs/procfs/fs_procfscritmon.c where
all_time.tv_sec * 1000000 could overflow on 32-bit time_t before
being multiplied again; cast to uint64_t at the start.
No behavioural change.
Signed-off-by: Xiang Xiao <xiaoxiang@xiaomi.com>
POSIX leaves the signedness of time_t and clock_t unspecified, but
mainstream implementations (Linux glibc/musl, the BSDs, macOS, RTEMS,
Zephyr's POSIX layer, Windows _time64) expose time_t as signed 64-bit.
NuttX has historically used uint64_t only because it was tied to the
CONFIG_SYSTEM_TIME64 knob; with that gone, switch:
time_t : uint64_t -> int64_t
clock_t : uint64_t -> int64_t
CLOCK_MAX: UINT64_MAX -> INT64_MAX
This lets (time_t)-1 sentinels, negative tick deltas, and host-side
headers behave as on every other POSIX system without source churn.
Headers updated:
- include/sys/types.h, include/limits.h, include/nuttx/clock.h
- include/nuttx/fs/hostfs.h (nuttx_time_t alias)
- include/nuttx/{mqueue.h,wdog.h,wqueue.h,timers/clkcnt.h}
Because clock_t is now signed 64-bit, the NuttX-internal sclock_t
alias becomes redundant: every sclock_t/SCLOCK_MAX use is folded
back to clock_t/CLOCK_MAX (notably in sched/wdog, sched/mqueue,
sched/sched, sched/clock, sched/timer, libs/libc/time, fs/vfs and
the drivers/arch consumers below).
Tick/period constants (NSEC_PER_SEC, USEC_PER_SEC, MSEC_PER_SEC,
SEC_PER_MIN, ...) in include/nuttx/clock.h are retyped from "long"
literals to INT64_C(...) so that 64-bit arithmetic no longer
depends on the host's long width.
Strip now-redundant (time_t)/(clock_t)/(unsigned long) casts and
unsigned-only branches across the tree:
- arch RTC / oneshot / tickless lowerhalfs:
arm: cxd56xx, efm32, imxrt, lc823450, max326xx, sam34, sama5,
samd5e5, samv7, stm32, stm32f7, stm32h7, stm32l4, stm32wb,
xmc4
mips: pic32mz sparc: bm3803 x86_64: intel64
risc-v/xtensa: espressif (esp_i2c[_slave], esp_rtc,
esp32c3{_i2c,_rtc,_wifi_adapter}, esp32{,s2,s3}_*),
mpfs_perf
- drivers: audio/tone, input/aw86225, power/pm/{activity,
stability}_governor, rpmsg/rpmsg_ping,
timers/{ds3231,mcp794xx,pcf85263,rx8010},
wireless/ieee80211/bcm43xxx, wireless/spirit/spirit_spi
- core: fs/vfs/{fs_poll,fs_timerfd}, mm/iob/iob_alloc,
libs/libc/{netdb/lib_dnscache,time/{lib_calendar2utc,
lib_time}}, net/icmp/icmp_pmtu, net/icmpv6/icmpv6_pmtu,
net/ipfrag, net/tcp/{tcp.h,tcp_timer},
net/utils/net_snoop, net/mld/mld_query (drop the now-dead
mld_mrc2mrd helper since signed math handles it directly),
sched/clock/{clock,clock_initialize},
sched/sched/{sched_profil,sched_setparam,sched_setscheduler},
sched/pthread/pthread_create,
sched/wdog/{wd_gettime,wd_start,wdog.h},
sched/timer/timer_gettime, sched/mqueue/*
Flip the few in-tree printf format strings that assumed an
unsigned 64-bit tv_sec:
* drivers/rpmsg/rpmsg_ping.c PRIu64 -> PRId64
* arch/xtensa/src/esp32{,s2,s3}/esp32*_oneshot_lowerhalf.c
PRIu32 (already wrong) -> PRId64
Signed-off-by: Xiang Xiao <xiaoxiang@xiaomi.com>
The 32-bit system clock has a limited range (~497 days) and the
configuration knob is no longer worth the complexity given that
practically every modern target already enables it. Make 64-bit
time_t/clock_t/sclock_t/nuttx_time_t the only supported flavor.
Specifically:
- Drop the SYSTEM_TIME64 Kconfig option and its dependent
PERF_OVERFLOW_CORRECTION/HRTIMER guards in sched/Kconfig.
- Remove every #ifdef CONFIG_SYSTEM_TIME64 branch in headers
(include/{sys/types.h,limits.h,inttypes.h,nuttx/clock.h,
nuttx/fs/hostfs.h}) and core code paths
(sched/clock/clock.h, drivers/power/pm/pm_procfs.c,
drivers/rpmsg/rpmsg_ping.c, fs/procfs/fs_procfsuptime.c,
libs/libc/wqueue/work_usrthread.c,
arch/avr/src/avrdx/avrdx_timerisr_tickless_alarm.c).
- Strip CONFIG_SYSTEM_TIME64=y from every board defconfig.
- Update Documentation/guides/rust.rst accordingly.
Signed-off-by: Xiang Xiao <xiaoxiang@xiaomi.com>
BREAKING CHANGE: remove PWM_MULTICHAN option
PWM_MULTICHAN option is redundant, we can just set CONFIG_PWM_NCHANNELS > 1.
At default CONFIG_PWM_NCHANNELS is set to 1, so the default behavior is preserved.
Access to single channel API is now `info->channels[0].XXX` instead of `info->XXX`
This is the first step to simplify PWM implementation and make it more portable.
Signed-off-by: raiden00pl <raiden00@railab.me>
current_usec() returns a uint64_t, but it used TICK2USEC(timebase)
to convert scheduler ticks to microseconds. On 32-bit clock_t builds,
TICK2USEC() performs the multiplication in 32-bit arithmetic before the
result is widened.
With CONFIG_USEC_PER_TICK=10000, this wraps after about 71.6 minutes:
UINT32_MAX / 1000000 ~= 4294 seconds
After the wrap, up_timer_gettick() can report time near zero again. This
can leave absolute watchdog timeouts, such as those used by usleep() /
clock_nanosleep(), waiting for a tick value that will not be reached until
the 32-bit scheduler counter wraps.
Cast timebase to uint64_t before multiplying by USEC_PER_TICK so
current_usec() remains monotonic across the 32-bit microsecond boundary.
Signed-off-by: Max Kriegleder <max.kriegleder@gmail.com>
DShot is a packet based serial protocol, used for controlling motor controllers
(ESCs), typically for drones.
This adds an upper-half driver for dshot protocol, along with common
configuration options and definitions definitions.
Signed-off-by: Jukka Laitinen <jukka.laitinen@tii.ae>
debug.h is a NuttX-specific, non-POSIX header. Placing it in the
top-level include/ directory creates naming conflicts with external
projects that define their own debug.h.
This commit moves the canonical header to include/nuttx/debug.h,
following the NuttX convention for non-POSIX/non-standard headers,
and updates all in-tree references.
A backward-compatibility shim is left at include/debug.h that
emits a deprecation #warning and re-includes <nuttx/debug.h>,
allowing out-of-tree code to continue building while migrating.
Signed-off-by: Piyush Patle <piyushpatle228@gmail.com>
When all signals are disabled, nxsig_notification is not available and
should not be invoked. Remove the call to avoid build and runtime issues
in no-signal configurations.
Signed-off-by: Chengdong Wang <wangchengdong@lixiang.com>
Changes the default value for CONFIG_BOARD_LOOPSPERMSEC to -1, which is
invalid. All boards that forget to configure this value will encounter a
static assertion at compile time, enforcing that configurations
upstreamed to NuttX have calibrated values for correct delay timings.
Boards which implement ALARM_ARCH or TIMER_ARCH do not rely on the
busy-loop delay implementation and thus only have a run-time check to
ensure proper delay-timings (in the case where delays are used before
the alarm/timer driver is registered).
Some boards already in the NuttX upstream do not have calibrated values,
but there are no users who currently own the board to submit a
calibrated value for the configurations to use. In this scenario, the
value is temporarily set to 0 and a warning is displayed so that users
of these boards are informed of the calibration process.
Signed-off-by: Matteo Golin <matteo.golin@gmail.com>
Implement Linux-compatible TFD_TIMER_CANCEL_ON_SET flag for timerfd to
allow applications to detect discontinuous changes to CLOCK_REALTIME.
Background:
According to Linux timerfd_create(2) man page, when a timerfd is created
with CLOCK_REALTIME and TFD_TIMER_CANCEL_ON_SET flag is specified, the
read() operation should fail with ECANCELED if the real-time clock
undergoes a discontinuous change. This allows applications to detect
and respond to system time changes.
Implementation:
1. Add clock notifier infrastructure (clock_notifier.h/c) to notify
interested parties when system time changes
2. Implement TFD_TIMER_CANCEL_ON_SET flag support in timerfd
3. Register timerfd with clock notifier when flag is set
4. Cancel timer and return ECANCELED when clock change is detected
5. Notify clock changes in:
- clock_settime()
- clock_initialize()
- clock_timekeeping_set_wall_time()
- rpmsg_rtc time synchronization
Changes include:
- New files: include/nuttx/clock_notifier.h, sched/clock/clock_notifier.c
- Modified: fs/vfs/fs_timerfd.c to handle TFD_TIMER_CANCEL_ON_SET
- Modified: clock subsystem to call notifier chain on time changes
- Modified: rpmsg_rtc to notify time changes during sync
Use case example:
Applications using timerfd with absolute time can now detect when
system time is adjusted (e.g., NTP sync, manual time change) and
take appropriate action such as recalculating timeouts or updating
scheduled events.
Reference: https://man7.org/linux/man-pages/man2/timerfd_create.2.html
Signed-off-by: dongjiuzhu1 <dongjiuzhu1@xiaomi.com>
Add null pointer check for ioctl operations in RTC driver.
Return -ENOTTY when ioctl function pointer is NULL to prevent crashes.
Signed-off-by: dongjiuzhu1 <dongjiuzhu1@xiaomi.com>
Fix potential crash when removing client from server list.
Add proper list initialization check before deletion operation.
Signed-off-by: dongjiuzhu1 <dongjiuzhu1@xiaomi.com>
without rpmsg rtc client driver
Avoid sending rpmsg messages to cores that don't have RTC client driver.
Check endpoint availability before attempting to send messages.
Signed-off-by: dongjiuzhu1 <dongjiuzhu1@xiaomi.com>
Export rpmsg endpoint to allow remote CPU to access RTC services.
Simplify the initialization flow and remove unnecessary Kconfig options.
Signed-off-by: dongjiuzhu1 <dongjiuzhu1@xiaomi.com>
This commit fixes a typo in the capture.h header file. This is a
breaking change, but the fix is trivial (replace macro with new one).
Signed-off-by: Côme VINCENT <44554692+comejv@users.noreply.github.com>
rename nxsched_timer_expiration to nxsched_tick_expiration
to align with nxsched_process_tick()
Signed-off-by: Chengdong Wang <wangchengdong@lixiang.com>
Add basic timer operations to the kernel, including registration,
start/stop, and callback handling. This provides a consistent timer
interface for use by kernel components and drivers.
Signed-off-by: zhaohaiyang1 <zhaohaiyang1@xiaomi.com>
The reference count (upper->crefs) is incremented in timer_open()
only after ensuring it will not overflow, timer_close() is only
called after a successful open. Therefore, crefs should never be
zero when timer_close() is called. The check for crefs > 0 before
decrementing is unnecessary and has been removed to simplify the code.
Signed-off-by: fangpeina <fangpeina@xiaomi.com>
This commit introduces a software-based fake capture driver that simulates
a 10Hz square wave with 50% duty cycle, enabling development and testing
of capture-related applications without requiring real hardware.
Background:
The capture driver subsystem requires hardware support (timers with input
capture functionality) to measure external signal frequency and duty cycle.
During development, testing, or on platforms without capture hardware, it's
difficult to develop and test applications that use the capture API.
Problem:
Without a fake/simulator driver:
- Developers cannot test capture applications without specific hardware
- Continuous Integration (CI) systems cannot run capture-related tests
- Applications cannot be developed on platforms lacking capture hardware
- Testing edge notification features requires complex hardware setup
- Difficult to reproduce specific timing scenarios for debugging
Solution:
This commit provides a software-simulated capture driver that generates
predictable capture events using a watchdog timer. The fake driver
produces a square wave signal at 10Hz frequency with 50% duty cycle,
allowing applications to test the full capture API without hardware.
Signed-off-by: dongjiuzhu1 <dongjiuzhu1@xiaomi.com>
This commit adds comprehensive signal notification support to the capture
driver, enabling applications to be asynchronously notified when capture
edge events occur on any channel, rather than having to poll for events.
Background:
The capture driver is used to measure frequency and duty cycle of external
signals by detecting edges (rising/falling). Previously, applications could
only retrieve captured values through periodic polling via CAPIOC_GETDUTY
and CAPIOC_GETFREQ ioctl commands, which is inefficient for event-driven
applications.
Problem:
Without event notification, applications must:
- Continuously poll the capture device to check for new events
- Waste CPU cycles in polling loops
- Experience higher latency in responding to capture events
- Cannot efficiently handle multiple capture channels simultaneously
Solution:
This commit adds a signal-based notification mechanism that allows
applications to register callbacks for specific capture channels and
edge types (rising, falling, or both). When the hardware detects the
configured edge, a signal is sent to the registered task.
Signed-off-by: dongjiuzhu1 <dongjiuzhu1@xiaomi.com>
using Desired frequency offset from nominal frequency in
parts per billion(ppb) to adjust frequency
Signed-off-by: dongjiuzhu1 <dongjiuzhu1@xiaomi.com>
This patch adds a dummy PTP clock driver implementation that provides
a software-based PTP clock for testing and development purposes.
Key changes include:
1. Dummy PTP clock driver implementation:
- Added drivers/timers/ptp_clock_dummy.c
- Provides software-based PTP clock using system monotonic clock
- Implements all required lower-half driver operations
2. Lower-half driver operations:
- adjfine: Frequency adjustment (stores adjustment value)
- adjtime: Time offset adjustment (applies delta to base time)
- gettime: Returns current PTP clock time
- settime: Sets PTP clock time
- getcaps: Reports clock capabilities (1 billion PPB max adjustment)
- getcrosststamp: Provides system/device cross-timestamp
3. Driver initialization:
- Added ptp_clock_dummy_init() in drivers/drivers_initialize.c
- Auto-registration under CONFIG_PTP_CLOCK_DUMMY configuration
- Creates /dev/ptp0 character device node
4. Build system integration:
- Added CONFIG_PTP_CLOCK_DUMMY Kconfig option (depends on PTP_CLOCK)
- Updated CMakeLists.txt and Make.defs
- Added include/nuttx/timers/ptp_clock_dummy.h header
5. Implementation details:
- Uses clock_gettime(CLOCK_MONOTONIC) as time base
- Tracks time offset and frequency adjustment internally
- Suitable for testing PTP clock applications without hardware
This dummy driver enables development and testing of PTP clock applications
on platforms without dedicated PTP hardware support.
Signed-off-by: dongjiuzhu1 <dongjiuzhu1@xiaomi.com>
This patch introduces the foundational PTP (Precision Time Protocol) clock
driver framework for NuttX, enabling precise time synchronization support
based on IEEE 1588 standard.
Key changes include:
1. New PTP clock driver infrastructure:
- Added drivers/timers/ptp_clock.c implementing upper-half driver
- Created include/nuttx/timers/ptp_clock.h with PTP clock interfaces
- Implemented upper/lower half driver architecture for hardware abstraction
2. Core functionality:
- Clock time get/set operations (gettime, settime)
- Frequency adjustment support (adjtime, adjfine)
- Phase adjustment capabilities
- System-device cross-timestamping for precise synchronization
3. IOCTL commands:
- PTP_CLOCK_SETTIME/GETTIME for time manipulation
- PTP_CLOCK_GETRES for resolution queries
- PTP_CLOCK_ADJTIME for time adjustment
- PTP_CLOCK_GETCAPS for capability queries
- PTP_SYS_OFFSET* for system offset measurements
4. Supporting structures:
- struct ptp_lowerhalf_s: lower-half driver interface
- struct ptp_clock_caps: clock capabilities descriptor
- struct ptp_sys_offset: system time offset measurement
- Added timex structures in include/sys/timex.h for ADJ_* operations
5. Build system integration:
- Added CONFIG_PTP_CLOCK Kconfig option
- Updated CMakeLists.txt and Make.defs
- Added PTPCLK debug macros in include/debug.h
This framework provides the base for PTP clock implementations, allowing
hardware-specific drivers to register and provide precise time services
through a standardized interface.
Signed-off-by: dongjiuzhu1 <dongjiuzhu1@xiaomi.com>
This reverts the removal of ndelay_accurate from #14450, since as
mentioned in #17011, this fails to consider the `sim` architecture
where CONFIG_BOARD_LOOPSPERMSEC was set to 0 because of reliance on the
accurate implementations of the up_delay functions. All the commit did
was remove a more accurate implementation in favour of a less accurate
one.
Signed-off-by: Matteo Golin <matteo.golin@gmail.com>
