Perform pseudo-filesystem permission checks inside inode_reserve() and
inode_remove() while the inode tree lock is held, and hold that lock across
pseudorename mutations so symlink swaps cannot bypass directory checks.
Hold a read lock around pseudo-fs open permission checks.
On setuid/setgid exec, update saved set-IDs, mark the task group secure,
sanitize dangerous environment variables, clear debug/dumpable flags, and
add issetugid(), secure_getenv(), and PR_SET/GET_DUMPABLE support.
Signed-off-by: Abhishek Mishra <mishra.abhishek2808@gmail.com>
Use inode_checkopenperm() for message queues, named semaphores, and
shm, and reallocate mqueue state when reopening after the last close.
Signed-off-by: Abhishek Mishra <mishra.abhishek2808@gmail.com>
Set i_owner and i_group from the caller's effective credentials in
inode_reserve(), covering IPC objects, FIFOs, and pseudo-files.
Signed-off-by: Abhishek Mishra <mishra.abhishek2808@gmail.com>
A file system that answers statfs with a magic nothing maps to shows up as
"Unrecognized" in df. Give xipfs its constant alongside the others in
sys/statfs.h and the case in fs_gettype that turns it into a name.
Assisted-by: Claude Code:claude-opus-5
Signed-off-by: Marco Casaroli <marco.casaroli@gmail.com>
ROMFS is the usual way to carry executables on a NOMMU target with memory
mapped NOR flash: it can hand out a real flash pointer from mmap(), so the
NXFLAT loader maps a module's text in place instead of copying it into RAM.
But a ROMFS image is built on the host and is read only, so a module cannot
be downloaded onto the board at run time.
xipfs is a writable file system with the same in-place property. Each file
is stored as one physically contiguous, erase-block aligned extent, so an
mmap() of it resolves to flash_base + extent_offset and a loader can execute
the file where it already lies. This needs the underlying MTD driver to
answer BIOC_XIPBASE; on the RP2350 rp23xx_flash_mtd.c does.
Files are write once. A file is created, its size is declared, it is
written sequentially, closed, and is thereafter immutable until it is
deleted. That is the whole life cycle of a downloaded module, and it is
what licenses the design: the exact extent is reserved at create time, so
no file ever grows, moves, or fragments internally. Random writes, appends
and truncation of a written file are not supported and are refused.
The only source of fragmentation is therefore free space holes left by
deletes. Allocation fails with -ENOSPC when no single contiguous run is
large enough, and never defragments on its own; the caller decides whether
to compact and retry, through XIPFSIOC_DEFRAG. Defragmentation is manual,
best effort and interruptible: it is a loop of atomic single-extent
relocations, each one copy, commit, erase, so every stop point -- a time
budget, a pinned extent, an erase error -- leaves a consistent layout that
is simply less compact. It reports the largest contiguous run it achieved,
which is what tells the caller whether the retry will fit.
Metadata is committed power safely. Two metadata block sets are used in
ping-pong, each generation carrying a sequence number and a CRC, and every
state change is ordered as write the new data, flip the metadata reference,
then erase what the old one referenced. Mount scans both sets and selects
the last fully valid generation, so a torn write costs the interrupted
operation and nothing else.
A mapping takes a pin on the extent, and the pin lives on the extent rather
than on the file descriptor, so three running instances of one module hold
three pins and the extent becomes movable only when the last one goes.
Defragmentation skips pinned extents, which is what stops it relocating
code that is executing. The pin is released by munmap() or by the task
teardown walk, so a task that dies without unmapping does not leak it.
Directories are records in that same generation, carrying their own identity
and the identity of the directory holding them; the root is implicit and owns
identity zero. They are deliberately NOT objects in the data region, which
is what keeps the commit story in one piece: mkdir and rmdir add or remove a
record and commit one generation, exactly as create and unlink do, so there
is never a multi-object update to journal or an orphan to collect at mount.
An empty directory therefore exists, survives a remount, and costs one entry
out of the volume's fixed supply and no flash blocks at all.
A name is one path component; depth comes from the parent, so XIPFS_NAME_MAX
bounds a component, which is what statfs reports it as. Mount rebuilds the
tree and checks that it is one: identities unique, names unique within a
directory, every parent a live directory, and following parents reaching the
root -- a cycle on the medium would otherwise hang a path walk rather than
merely answering wrongly. '.' and '..' are refused as components, since an
entry stored under either could never be reached again.
The commands that act on the volume rather than on one file --
XIPFSIOC_DEFRAG and XIPFSIOC_LISTPINNED -- are reached through the ioctldir
method, on a descriptor for the mountpoint directory. They are accepted on
a descriptor for a file inside the volume too, but that route holds the file
open for the duration and an open extent cannot be relocated, so a pass
asked for that way is obstructed by the act of asking.
mmap() falls back to the generic RAM copy for ordinary readers when the
media cannot be addressed directly. A module loader must not silently get
a RAM copy, so MAP_XIP_STRICT is added: with it the mapping either resolves
in place or fails with -ENXIO, which the caller can turn into defragment
and retry.
Assisted-by: Claude Code:claude-opus-5
Signed-off-by: Marco Casaroli <marco.casaroli@gmail.com>
During the Toybox port to NuttX, Claude noticed that changes in the
menuconfig weren't taking affect. This issue exists for a long time on
NuttX, in fact BayLibre's presentation from 2017 make jokes about our
building system not been reliable:
https://www.youtube.com/watch?v=XUJK2htXxKw&t=320s
Stale archive members from $(AR)'s additive-only behavior can linger
after Kconfig toggles change which files provide a symbol, causing dead
weight or "multiple definition" link errors on incremental builds.
Fixed by splitting ARCHIVE into two macros: ARCHIVE keeps the original
additive behavior for apps/libapps.a, which many independent
subdirectories contribute to across a build, while the new
ARCHIVE_REBUILD deletes then archives for the far more common case
of a single Makefile building its own self-contained $(OBJS)
- all 39 such call sites now use it.
Assisted-By: Claude Sonnet 5
Signed-off-by: Alan C. Assis <acassis@gmail.com>
FIOC_REFORMAT, FIOC_OPTIMIZE, FIOC_INTEGRITY and FIOC_DUMP act on a volume,
not on any one file, but the only route into a file system has been the
per-file ioctl method. A caller therefore has to open an unrelated file
just to name the volume it means.
For nxffs that is not merely awkward, it is a dead end. nxffs_ioctl()
refuses FIOC_REFORMAT while any file on the volume is open:
if (volume->ofiles)
{
ferr("ERROR: Open files\n");
ret = -EBUSY;
and every open file is on that list (nxffs_open.c). The descriptor used to
issue the command is itself such a file, so the check can never pass and
FIOC_REFORMAT is unreachable through the only interface that exposes it.
Add an optional ioctldir method to struct mountpt_operations, reached by
issuing the ioctl on a descriptor for the mountpoint directory:
fd = open("/mnt/nxffs", O_RDONLY | O_DIRECTORY);
ioctl(fd, FIOC_REFORMAT, 0);
It takes the same (mountpt, dir) pair as opendir/readdir/rewinddir, so it
reads as a member of the directory-operations family; the file system
recovers the volume from the mountpoint inode and may ignore dir. The
member is placed at the end of the structure rather than beside the other
directory operations on purpose: every file system initialises
mountpt_operations positionally, so a member inserted mid-structure would
force all of them to add a slot for a method they do not implement.
Appending keeps the change to one file system.
dir_ioctl() gives that method the first chance at every command when the
directory belongs to a mounted volume and the file system provides one, and
falls back to its own handling of FIOC_FILEPATH and BIOC_FLUSH when the file
system answers -ENOTTY. Trying the file system first is what lets a file
system override a command the VFS would otherwise answer generically; the
-ENOTTY fallback is what keeps the generic answers available to everyone
else. A file system that leaves the method NULL is unaffected: the VFS
answers exactly as before.
The existing per-file method could not simply be reused for this. It takes
a struct file, and every implementation that has an ioctl -- fat, romfs,
tmpfs, spiffs among them -- asserts on filep->f_priv and dereferences it,
so handing it a directory descriptor with no open file behind it would
fault. Making the entry point separate keeps that contract intact and
makes support explicit rather than assumed.
nxffs implements it, which is what makes its FIOC_REFORMAT reachable. The
per-file path is left in place and both share one implementation, so
nothing that works today stops working. spiffs, which has the same shape
of volume commands, can follow.
Measured on sim:nxffs, with one file written to the volume and then the
same sequence of ioctls issued on a file descriptor, on a descriptor for the
mountpoint directory, and on a descriptor for a pseudo file system directory.
Before:
FIOC_REFORMAT via file fd: ret=-1 errno=16 (EBUSY, as expected)
FIOC_REFORMAT via dir fd: ret=-1 errno=25
FIOC_FILEPATH via dir fd: ret=0 "/mnt/nxffs//"
BIOC_FLUSH via dir fd: ret=0
bogus cmd via dir fd: ret=-1 errno=25
FIOC_FILEPATH via /dev fd: ret=0 "/dev//"
bogus cmd via /dev fd: ret=-1 errno=25
name still in the raw MTD image afterwards: yes
After:
FIOC_REFORMAT via file fd: ret=-1 errno=16 (EBUSY, as expected)
FIOC_REFORMAT via dir fd: ret=0
FIOC_FILEPATH via dir fd: ret=0 "/mnt/nxffs//"
BIOC_FLUSH via dir fd: ret=0
bogus cmd via dir fd: ret=-1 errno=25
FIOC_FILEPATH via /dev fd: ret=0 "/dev//"
bogus cmd via /dev fd: ret=-1 errno=25
name still in the raw MTD image afterwards: no
Only the FIOC_REFORMAT line on the directory descriptor changes, and the raw
MTD image confirms the volume really was erased. FIOC_FILEPATH and
BIOC_FLUSH on a directory still answer even though nxffs is now consulted
ahead of them, an unrecognised command is still refused rather than
forwarded blindly, and a directory in the pseudo file system, which has no
ioctldir at all, is untouched.
Assisted-by: Claude Code:claude-opus-4-8
Assisted-by: Claude Code:claude-fable-5
Assisted-by: Claude Code:claude-opus-5
Signed-off-by: Marco Casaroli <marco.casaroli@gmail.com>
hostfs keeps its own HOSTFS_MAX_PATH wrapper for internal buffers, but
it should not hard-code a path length separate from the system path
configuration.
Define HOSTFS_MAX_PATH from PATH_MAX instead. PATH_MAX is backed by
CONFIG_PATH_MAX, whose default remains 256, so the default hostfs
behavior does not change while configurations that choose a larger path
limit are honored consistently.
Assisted-by: Claude:Claude-Fable-5
Signed-off-by: Lingao Meng <menglingao@xiaomi.com>
hostfs_mkpath() appends a relative path to the configured host root
with strlcat(). The third argument to strlcat() is the total
destination buffer size, not the remaining free space.
Passing pathlen - strlen(path) makes the effective limit shrink after
a long host root has already been copied. With a sufficiently long
root, a valid relative path can be dropped or truncated, so operations
under the mount point may resolve to the host root instead of the
requested child path.
Pass the full destination buffer size and let strlcat() account for the
current string length internally.
The companion examples/hostfs_longpath app validates this regression by
mounting hostfs with a long host root, writing a probe file below the
mount point, and reading it back. The old size argument drops the
relative component in that scenario; this fix preserves it.
Assisted-by: Claude:Claude-Fable-5
Signed-off-by: Lingao Meng <menglingao@xiaomi.com>
fcntl(F_GETLK/F_SETLK/F_SETLKW) is handled by VFS and reaches file
systems as private FIOC_* ioctl commands. hostfs previously forwarded
those private ioctl command numbers to the host ioctl backend, which is
not the POSIX file-locking interface and cannot be interpreted by the
host OS.
Keep hostfs on the generic host_ioctl() path and define the FIOC_* lock
command values in the hostfs host ABI. The POSIX sim backend recognizes
those commands in host_ioctl() and translates struct flock fields to the
host ABI before calling host fcntl(). Other hostfs backends keep their
existing unsupported-host-ioctl behavior.
F_SETLKW is implemented in the POSIX sim backend by retrying
non-blocking host F_SETLK with a short sleep. This preserves the
blocking NuttX API without forwarding host F_SETLKW directly.
Testing:
- Host: Ubuntu 22.04 x86_64.
- Board/config: sim:nsh with CONFIG_FS_HOSTFS=y,
CONFIG_SIM_HOSTFS=y and CONFIG_EXAMPLES_SIM_POSIX=y.
- make -j16.
- Ran examples/sim_posix from nuttx-apps. The test mounted a long
/tmp hostfs path, opened a host-backed file, and verified
fcntl(F_SETLK), fcntl(F_GETLK), fcntl(F_SETLKW), and unlocking with
F_UNLCK. The app printed "sim_posix: hostfs locks ok" and
"sim_posix: PASS".
Assisted-by: Claude:Claude-Fable-5
Signed-off-by: Lingao Meng <menglingao@xiaomi.com>
If user passes NULL as buffer, the driver may crash. This is problematic
for NuttX protected and kernel builds.
Details in the issue: https://github.com/apache/nuttx/issues/19473
While this fixes the issue with a typical NULL pointer, fundamentally this
will be addressed with the implementation of access_ok().
https://man7.org/linux/man-pages/man2/access.2.html
Signed-off-by: Catalin Visinescu <catalin_visinescu@yahoo.com>
blksize_t is currently defined as int16_t, which overflows when a
filesystem reports a block size larger than 32767 bytes. This causes
st_blksize to become zero, leading to an integer divide-by-zero when
st_blocks is calculated in stat().
Widen blksize_t to int32_t to support larger filesystem block sizes.
Update nuttx_blksize_t in include/nuttx/fs/hostfs.h to keep it
consistent with include/sys/types.h.
struct geometry.geo_sectorsize (include/nuttx/fs/ioctl.h) is also
typed blksize_t, so every debug print of that field using a 16-bit
format specifier is updated to PRId32 to match the new width:
drivers/misc/ramdisk.c, drivers/mmcsd/mmcsd_spi.c, drivers/mtd/ftl.c,
fs/driver/fs_blockmerge.c, drivers/mtd/smart.c,
drivers/usbhost/usbhost_storage.c, drivers/mmcsd/mmcsd_sdio.c,
arch/arm/src/s32k1xx/s32k1xx_eeeprom.c,
arch/arm/src/lc823450/lc823450_mmcl.c.
Signed-off-by: Ansh Rai <anshrai331@gmail.com>
Signed-off-by: root <root@LAPTOP-9C7LKDC5.localdomain>
Permissions (Part 2)
Description:
In kernel builds, any unprivileged process running on the NuttX
device can open /dev/efuse and attempt to read/write fuse content.
Reading the fuses may provide valuable information to an attacker
controlling the user process. The write operation, in extreme cases
where the fuse blocks are not locked, may brick the device.
DISCLAIMER: I tried to be strict with the settings, better to relax them
later if it's needed.
This is part of https://github.com/apache/nuttx/issues/19410
See https://github.com/apache/nuttx/issues/19410
Compiles ok.
Signed-off-by: Catalin Visinescu <catalin_visinescu@yahoo.com>
Reading /proc/<pid>/group/env for another task dereferenced tg_envp
under the caller's own address environment instead of the target
task's, since tg_envp lives in the target's user heap. Switch to the
target's address environment around the traversal, and to the
caller's own environment only around the copy into the caller's
buffer.
Signed-off-by: liang.huang <liang.huang@houmo.ai>
Limit the parsed TXTABLE name field to NAME_MAX and reject entries that do not provide all three required fields. This avoids writing past struct partition_s.name when a text partition table contains an overlong name.
Signed-off-by: Old-Ding <35417409+Old-Ding@users.noreply.github.com>
Align the NuttX open(2) flag constants with the Linux asm-generic
values so that the FUSE wire protocol and other cross-platform
interfaces work without conversion.
All code that used '(flags & O_RDONLY)' as a bitmask check (always 0
now that O_RDONLY=0) has been updated to use '(flags & O_ACCMODE)'
comparisons.
The NUTTX_O_* constants in include/nuttx/fs/hostfs.h are updated to
match, and the sim hostfs open flag mapping is fixed.
Signed-off-by: Xiang Xiao <xiaoxiang@xiaomi.com>
O_RDOK and O_WROK are non-standard aliases for O_RDONLY and O_WRONLY
respectively. Having two names for the same flag creates confusion,
especially when aligning the flag values with Linux. Remove the
aliases and replace all uses with the standard O_RDONLY/O_WRONLY.
No functional change — O_RDOK was defined as O_RDONLY and O_WROK as
O_WRONLY, so the replacement is a pure text substitution.
Signed-off-by: Xiang Xiao <xiaoxiang@xiaomi.com>
Add the POSIX d_ino (file serial number) member to struct dirent and
populate it on every readdir() path, so portable callers (e.g. scp in
dropbear) that read dp->d_ino observe a meaningful, non-zero inode
number:
- include/dirent.h: declare d_ino in struct dirent and drop the
outdated comment claiming the field is unimplemented.
- include/nuttx/fs/hostfs.h: add d_ino to struct nuttx_dirent_s so
the hostfs ABI can carry the inode number across the VFS boundary.
- arch/sim/src/sim/posix/sim_hostfs.c: forward the host's
ent->d_ino into entry->d_ino.
- fs/vfs/fs_dir.c (read_pseudodir): copy the in-memory inode's
i_ino into entry->d_ino for the pseudo filesystem.
- fs/yaffs/yaffs_vfs.c: forward yaffs's dirent->d_ino into
entry->d_ino.
- fs/rpmsgfs: extend struct rpmsgfs_readdir_s with an 'ino' field
and propagate it across the RPC in both rpmsgfs_server (fills it
from the underlying entry) and rpmsgfs_client (writes it back to
the caller's nuttx_dirent_s).
Signed-off-by: Xiang Xiao <xiaoxiang@xiaomi.com>
A 16-bit ino_t can only address 65536 distinct file serial numbers,
which is not enough for filesystems with large directory trees and
breaks portable software (e.g. dropbear's scp) that expects a wider
inode number space. Widen ino_t (and nuttx_ino_t in the hostfs ABI)
to uint32_t to match common POSIX practice.
Update fs/rpmsgfs/rpmsgfs.h accordingly: promote the 'ino' field in
struct rpmsgfs_stat_priv_s from uint16_t to uint32_t and move 'nlink'
into the trailing 16-bit slot previously occupied by the reserved
field, keeping the overall packed-struct layout/size unchanged.
Signed-off-by: Xiang Xiao <xiaoxiang@xiaomi.com>
Build fs_link.c unconditionally so link() remains available even when
CONFIG_PSEUDOFS_SOFTLINKS is disabled. Return ENOSYS in that
configuration instead of leaving applications with an undefined symbol.
Signed-off-by: Felipe Moura <moura.fmo@gmail.com>
Check open access against file mode and owner via fs_checkmode(), verify
parent directory permissions on create, and assign creator uid/gid to
newly created files.
Signed-off-by: Abhishek Mishra <mishra.abhishek2808@gmail.com>
Store uid/gid/mode on tmpfs objects, support chstat, enforce open and
path permissions via fs_checkmode()/fs_checkopenperm(), and inherit
creator identity on file creation.
Signed-off-by: Abhishek Mishra <mishra.abhishek2808@gmail.com>
Add fs_checkmode() and fs_checkopenperm() for reuse across filesystems.
Enforce pseudoFS mode bits in inode_checkperm() and allow world-readable
open of passwd/group entries so getpwnam() works after seteuid().
Signed-off-by: Abhishek Mishra <mishra.abhishek2808@gmail.com>
When a board switches storage technology but wants to mount a littlefs
filesystem onto this storage it is desired to still use the same firmware.
This almost works out of the box in NuttX with the exception of setting the
correct block size, which may be different depending on the used storage.
An incorrect block size may lead to suboptimal performance or worse.
To avoid writing a firmware variant that only differs by
CONFIG_FS_LITTLEFS_BLOCK_SIZE_FACTOR this adds the option to pass the
intended block size at the mount call. To still enable the usage of the existing
options this adds a parser for comma-separated mount options, allowing multiple
options to be passed simultaneously.
Example: "autoformat,block_size_factor=4",
"autoformat,block_size_factor=1"
This is backwards compatible: single options passed without commas continue to
work as before.
Signed-off-by: alexcekay <alexander@auterion.com>
Initialize i_owner and i_group from the creating task's
effective uid/gid when a pseudo-file is created via O_CREAT.
This aligns pseudo-file ownership with the creator's
effective credentials instead of leaving new files
root-owned by default.
Signed-off-by: Abhishek Mishra <mishra.abhishek2808@gmail.com>
We can apply file lock on SHM inode as well. Ensure file_lock_get_path
function passes and doesn't return EBADF errno.
Signed-off-by: Michal Lenc <michallenc@seznam.cz>
We need to use gettid instead of getpid, otherwise flocks applied
from different threads are considered as single thread lock and are
ignored (or updated).
Also fix the behavior if process opens the file multiple times
Linux/BSD manual states multiple file descriptors opened by a single
process shall be treated independently. Therefore we also need to
compare struct file pointer to determine whether the lock applies
to the same descriptor or not.
Signed-off-by: Michal Lenc <michallenc@seznam.cz>
Add pseudoFS permission enforcement for unlink(), mkdir(), and rename() VFS mutation operations.
This change validates parent-directory permissions before modifying pseudoFS inode topology and returns -EACCES for unauthorized operations.
The implementation preserves mountpoint filesystem behavior and fixes multiple inode lifetime/search-state issues in the rename path.
Signed-off-by: Abhishek Mishra <mishra.abhishek2808@gmail.com>
Add pseudoFS caller validation for chmod and chown operations
using the caller's effective uid. Align behavior with POSIX
semantics by allowing owner/root chmod and root-only chown.
Signed-off-by: Abhishek Mishra <mishra.abhishek2808@gmail.com>
Now that time_t is unconditionally 64-bit (signed int64_t) and the
struct timespec fields tv_sec / tv_nsec are wide enough on their own,
the explicit (uint64_t)/(int64_t)/(int) casts that used to guard the
multiplications and subtractions in *_us / *_ms / *_ns helpers are no
longer needed. Drop them to keep the timekeeping math readable and
consistent with the previous sclock_t/time_t cleanup.
In the same spirit, this commit also:
* Normalises the printf-style format specifiers and casts used to
print tv_sec / tv_nsec / tv_usec values across arch/, drivers/,
fs/, sched/ and libs/. The prior code was a mix of
"%d"/"%u"/"%ld"/"%lu"/"%lld"/PRIu32/PRIu64 with matching
(int)/(unsigned long)/(long long)/PRIu* casts; some formats
truncated time_t on 32-bit hosts, others mismatched signedness or
width. Replace all such cases with the portable POSIX-recommended
forms:
- tv_sec (time_t, signed, impl-defined width) -> %jd + (intmax_t)
- tv_nsec (long, signed) -> %ld (no cast)
- tv_usec (suseconds_t / long) -> %ld (no cast)
Add #include <stdint.h> where required.
* Drops a few stale `(FAR const time_t *)&ts.tv_sec` casts and
related `(FAR struct tm *)` / `(const time_t *)` casts in
gmtime_r() / localtime_r() / gmtime() callers; ts.tv_sec is plain
time_t now and the casts only obscured the type.
* Fixes one overflow in fs/procfs/fs_procfscritmon.c where
all_time.tv_sec * 1000000 could overflow on 32-bit time_t before
being multiplied again; cast to uint64_t at the start.
No behavioural change.
Signed-off-by: Xiang Xiao <xiaoxiang@xiaomi.com>
POSIX leaves the signedness of time_t and clock_t unspecified, but
mainstream implementations (Linux glibc/musl, the BSDs, macOS, RTEMS,
Zephyr's POSIX layer, Windows _time64) expose time_t as signed 64-bit.
NuttX has historically used uint64_t only because it was tied to the
CONFIG_SYSTEM_TIME64 knob; with that gone, switch:
time_t : uint64_t -> int64_t
clock_t : uint64_t -> int64_t
CLOCK_MAX: UINT64_MAX -> INT64_MAX
This lets (time_t)-1 sentinels, negative tick deltas, and host-side
headers behave as on every other POSIX system without source churn.
Headers updated:
- include/sys/types.h, include/limits.h, include/nuttx/clock.h
- include/nuttx/fs/hostfs.h (nuttx_time_t alias)
- include/nuttx/{mqueue.h,wdog.h,wqueue.h,timers/clkcnt.h}
Because clock_t is now signed 64-bit, the NuttX-internal sclock_t
alias becomes redundant: every sclock_t/SCLOCK_MAX use is folded
back to clock_t/CLOCK_MAX (notably in sched/wdog, sched/mqueue,
sched/sched, sched/clock, sched/timer, libs/libc/time, fs/vfs and
the drivers/arch consumers below).
Tick/period constants (NSEC_PER_SEC, USEC_PER_SEC, MSEC_PER_SEC,
SEC_PER_MIN, ...) in include/nuttx/clock.h are retyped from "long"
literals to INT64_C(...) so that 64-bit arithmetic no longer
depends on the host's long width.
Strip now-redundant (time_t)/(clock_t)/(unsigned long) casts and
unsigned-only branches across the tree:
- arch RTC / oneshot / tickless lowerhalfs:
arm: cxd56xx, efm32, imxrt, lc823450, max326xx, sam34, sama5,
samd5e5, samv7, stm32, stm32f7, stm32h7, stm32l4, stm32wb,
xmc4
mips: pic32mz sparc: bm3803 x86_64: intel64
risc-v/xtensa: espressif (esp_i2c[_slave], esp_rtc,
esp32c3{_i2c,_rtc,_wifi_adapter}, esp32{,s2,s3}_*),
mpfs_perf
- drivers: audio/tone, input/aw86225, power/pm/{activity,
stability}_governor, rpmsg/rpmsg_ping,
timers/{ds3231,mcp794xx,pcf85263,rx8010},
wireless/ieee80211/bcm43xxx, wireless/spirit/spirit_spi
- core: fs/vfs/{fs_poll,fs_timerfd}, mm/iob/iob_alloc,
libs/libc/{netdb/lib_dnscache,time/{lib_calendar2utc,
lib_time}}, net/icmp/icmp_pmtu, net/icmpv6/icmpv6_pmtu,
net/ipfrag, net/tcp/{tcp.h,tcp_timer},
net/utils/net_snoop, net/mld/mld_query (drop the now-dead
mld_mrc2mrd helper since signed math handles it directly),
sched/clock/{clock,clock_initialize},
sched/sched/{sched_profil,sched_setparam,sched_setscheduler},
sched/pthread/pthread_create,
sched/wdog/{wd_gettime,wd_start,wdog.h},
sched/timer/timer_gettime, sched/mqueue/*
Flip the few in-tree printf format strings that assumed an
unsigned 64-bit tv_sec:
* drivers/rpmsg/rpmsg_ping.c PRIu64 -> PRId64
* arch/xtensa/src/esp32{,s2,s3}/esp32*_oneshot_lowerhalf.c
PRIu32 (already wrong) -> PRId64
Signed-off-by: Xiang Xiao <xiaoxiang@xiaomi.com>
The 32-bit system clock has a limited range (~497 days) and the
configuration knob is no longer worth the complexity given that
practically every modern target already enables it. Make 64-bit
time_t/clock_t/sclock_t/nuttx_time_t the only supported flavor.
Specifically:
- Drop the SYSTEM_TIME64 Kconfig option and its dependent
PERF_OVERFLOW_CORRECTION/HRTIMER guards in sched/Kconfig.
- Remove every #ifdef CONFIG_SYSTEM_TIME64 branch in headers
(include/{sys/types.h,limits.h,inttypes.h,nuttx/clock.h,
nuttx/fs/hostfs.h}) and core code paths
(sched/clock/clock.h, drivers/power/pm/pm_procfs.c,
drivers/rpmsg/rpmsg_ping.c, fs/procfs/fs_procfsuptime.c,
libs/libc/wqueue/work_usrthread.c,
arch/avr/src/avrdx/avrdx_timerisr_tickless_alarm.c).
- Strip CONFIG_SYSTEM_TIME64=y from every board defconfig.
- Update Documentation/guides/rust.rst accordingly.
Signed-off-by: Xiang Xiao <xiaoxiang@xiaomi.com>
Every compiler supported by NuttX provides the "long long" types,
so the CONFIG_HAVE_LONG_LONG indirection is no longer useful.
Remove the option from include/nuttx/compiler.h and treat
"long long" as unconditionally available across the OS.
In addition to deleting the guard itself, this commit unconditionally
enables the long-long flavored helpers that used to be gated behind
it:
- libs/libc/fixedmath: drop the soft-emulated b32/ub32 routines
in lib_fixedmath.c (-261 lines) and trim the matching
prototypes, Make.defs and CMakeLists.txt entries; keep only
the long-long backed implementations.
- include/sys/endian.h, include/strings.h, libs/libc/string
/lib_ffsll.c, lib_flsll.c: always expose the 64-bit byte-swap
and ffsll/flsll variants.
- libs/libm/libm/lib_llround{,f,l}.c: drop the empty stubs.
- libs/libc/stdlib (atoll, llabs, lldiv, strtoll/ull, rand48,
strtold), libs/libc/stream (libvsprintf, libvscanf,
libbsprintf, ultoa_invert), libs/libc/misc (crc64, crc64emac),
libs/libc/inttypes/strtoimax, libs/libc/lzf, libs/libc/libc.csv,
libs/libc/string (memset, vikmemcpy): remove the
#ifdef CONFIG_HAVE_LONG_LONG branches.
- include/{stddef.h,stdlib.h,fixedmath.h,sys/epoll.h,cxx/cstdlib,
nuttx/audio/audio.h,nuttx/crc64.h,nuttx/lib/math.h,
nuttx/lib/math32.h,nuttx/lib/stdbit.h}: same guard cleanup.
- drivers/note/note_driver.c, fs/spiffs/src/spiffs.h,
sched/irq/irq_procfs.c: drop their local guards as well.
- Documentation/applications/netutils/ntpclient/index.rst:
refresh the documentation snippet.
Signed-off-by: Xiang Xiao <xiaoxiang@xiaomi.com>
Split mnemofs into allocation, directory, file, CTZ, and read/write
modules, and update direntry traversal and file handling. Add superblock
format version 1 support, reject newer on-flash versions, and preserve
the mounted version when rewriting metadata.
Update the NAND simulator drivers for the new mnemofs behavior by fixing
spare writes, exposing the erase state, allowing raw reads, and documenting
the background-task startup flow.
Signed-off-by: Saurav Pal <resyfer.dev@gmail.com>
Add inode_checkperm() and integrate it into file_vopen()
to enforce UNIX-style read/write permission checks for
pseudoFS inodes using effective uid/gid credentials.
Skip permission enforcement for mountpoint inodes and
allow kernel threads to bypass checks.
Signed-off-by: Abhishek Mishra <mishra.abhishek2808@gmail.com>
Add a CONFIG_FS_PERMISSION Kconfig option for future
filesystem permission support infrastructure.
The option depends on CONFIG_SCHED_USER_IDENTITY and
CONFIG_PSEUDOFS_ATTRIBUTES to ensure task credential
tracking and pseudo-filesystem inode ownership/mode
metadata are available before enabling the feature.
The symbol defaults to n to preserve existing behavior
for current configurations.
No runtime permission enforcement is introduced by
this commit.
Signed-off-by: Abhishek Mishra <mishra.abhishek2808@gmail.com>
Preserve only the existing file type bits (S_IFMT) and
replace permission bits from inode->i_mode instead of
merging them with |= semantics.
This fixes pseudoFS stat()/ls mode reporting after
chmod() updates.
Signed-off-by: Abhishek Mishra <mishra.abhishek2808@gmail.com>
This commit fixes a regression introduced by
89df084b0e. That commit
added a check to ensure iov_base is not NULL, assuming NULL
always represents an inaccessible address.
However, in CONFIG_BUILD_KERNEL mode where CONFIG_ARCH_TEXT_VBASE
is set to 0, address zero is a valid virtual address for the
user-space text segment. The previous check caused libelf to
fail with -EFAULT when attempting to load ELF program headers
into the base of the user address space.
This patch wraps the safety check in a conditional to ensure it is
only executed when address zero is not considered a valid
executable base.
Signed-off-by: Lwazi Dube <lwazeh@gmail.com>
When CONFIG_FS_BACKTRACE is enabled, collecting a stack trace for every
new file descriptor adds overhead to fast path operations like open(),
dup(), and socket().
This patch adds a new configuration option CONFIG_FS_BACKTRACE_DEFAULT.
When enabled (default behavior), the GROUP_FLAG_FD_BACKTRACE flag is
automatically set during group allocation, causing backtrace to be
captured for all tasks globally, preserving the original diagnostic
capability.
When disabled, backtrace capture is zero-cost by default and must be
explicitly enabled per task group using GROUP_FLAG_FD_BACKTRACE.
Signed-off-by: zhanxiaoqi <zhanxiaoqi@bytedance.com>
Allow to close the lock even the dying task is in
signal handler context. Also the file type check can
be ignored as they are already validated in create phase.
Signed-off-by: Jari Nippula <jari.nippula@tii.ae>
This adds a kernel-level performance profiler for the VFS.
By enabling CONFIG_FS_PROFILER, the core VFS system calls
(file_read, file_write, file_open, and file_close) are
instrumented to track high-resolution execution times using
clock_systime_timespec() seamlessly.
The collected statistics are exposed dynamically via a new
procfs node at /proc/fs/profile, allowing CI regression
testing without needing external debugging tools.
Signed-off-by: Sumit6307 <sumitkesar6307@gmail.com>
In proxy_fstat(), the write permission bits for a block driver proxy
were gated on `i_ops->read` instead of `i_ops->write`:
The effect is that a driver implementing read but not write would have
S_IWOTH | S_IWGRP | S_IWUSR incorrectly set in the fstat() result,
reporting the file as writable when it is not.
Fix: replace `->read` with `->write` in the write check condition.
Signed-off-by: Abhishek Mishra <mishra.abhishek2808@gmail.com>
Linux creates all files as long file name entries even if they
fit short 8.3 format. This caused issues when deleting or renaming
files as the long file name entry was not recognized and only deleted
it's short file name entry. This basically kept breaking the file
system as subsequent long file name files were not correctly stored.
The typical representation of this issue was long file name being
represented as it's short name alias.
This commit adjusts the LFN/SFN logic a bit - the code now always
fills in long file name and then checks if this could possibly be
a short file entry (we still have to do that because Windows stores
8.3 files as short file entry). This ensures compatibility with
files created both on Linux and Windows.
Signed-off-by: Michal Lenc <michallenc@seznam.cz>
Add INIT message which can be used in case ns_announcement isn't
supported on the system.
It unlocks the client flow by calling rpmsg_post() on the semaphore.
Without this or an NS announcement, the client's semaphore will wait
forever.
This is practical when the server side is running from linux userspace
using ioctl where controlling NS announcements is problematic.
Signed-off-by: Andre Heinemans <andre.heinemans@nxp.com>
debug.h is a NuttX-specific, non-POSIX header. Placing it in the
top-level include/ directory creates naming conflicts with external
projects that define their own debug.h.
This commit moves the canonical header to include/nuttx/debug.h,
following the NuttX convention for non-POSIX/non-standard headers,
and updates all in-tree references.
A backward-compatibility shim is left at include/debug.h that
emits a deprecation #warning and re-includes <nuttx/debug.h>,
allowing out-of-tree code to continue building while migrating.
Signed-off-by: Piyush Patle <piyushpatle228@gmail.com>
Correct duplicate "is is" word found in 181 files throughout the
codebase.
In most cases "is is" was changed to "is", but in contexts like
"MCU is is sleep mode" it was corrected to "MCU in sleep mode".
Also fixes a "the the" typo in net/inet/inet_sockif.c.
This is a pure style/documentation fix that improves code readability.
Signed-off-by: Huang Qi <huangqi3@xiaomi.com>
Fix 269 occurrences of duplicate "the" word typo found in 209 files
across source code, header files, and configuration.
Signed-off-by: Huang Qi <huangqi3@xiaomi.com>
This PR addresses several portability and technical debt issues in the mnemofs filesystem by resolving source-level TODO items.
Changes:
- Implemented a portable fallback for mfs\_clz (Count Leading Zeros) in fs/mnemofs/mnemofs.h using a binary search approach. This ensures compatibility with non-GCC compilers.
- Removed the redundant 8-bit mfs\_arrhash and consolidated hashing with the existing 16-bit mfs\_hash in mnemofs\_util.c.
- Removed the related TODO comments in mnemofs.h and mnemofs\_util.c.
- Fixed NuttX style (indentation and braces) in the fallback bit primitives.
Signed-off-by: Sumit <sumit6307@gmail.com>
