Perform pseudo-filesystem permission checks inside inode_reserve() and
inode_remove() while the inode tree lock is held, and hold that lock across
pseudorename mutations so symlink swaps cannot bypass directory checks.
Hold a read lock around pseudo-fs open permission checks.
On setuid/setgid exec, update saved set-IDs, mark the task group secure,
sanitize dangerous environment variables, clear debug/dumpable flags, and
add issetugid(), secure_getenv(), and PR_SET/GET_DUMPABLE support.
Signed-off-by: Abhishek Mishra <mishra.abhishek2808@gmail.com>
The matrix driver reported every key with KEYBOARD_PRESS and
KEYBOARD_RELEASE, so a board whose matrix has arrows or function keys
had no way to say so: the keycode ranges overlap the character range,
and the event type is what tells them apart.
A keymap entry is a uint32_t, so wrap the entry in KMATRIX_SPECIAL() to
declare that it holds a value from enum kbd_keycode_e. Existing keymaps
hold characters and are unaffected.
While here, drop the cast that truncated the keycode to sixteen bits,
and default the device to /dev/kbd0. Applications look for a keyboard
under that name, and /dev/keypad0 kept the matrix out of reach of every
one of them.
Signed-off-by: Jorge Guzman <jorge.gzm@gmail.com>
keyboard.h declares KEYBOARD_PRESS and KEYBOARD_RELEASE only, but the
type field of struct keyboard_event_s has four values: the two special
key types live in kbd_codec.h, under a different prefix.
Somebody writing a keyboard driver reads keyboard.h, sees two types, and
implements two types. Six of the nine drivers that register a keyboard
never report a special key at all, and the failure is silent: the build
is clean and the symptom is a key that does nothing.
Define all four here, as aliases of the kbd_decode() return values so
that a driver can feed both this interface and the byte stream codec
from a single source.
Signed-off-by: Jorge Guzman <jorge.gzm@gmail.com>
A keyboard driver that tracks modifier state has no way to report it.
Folding the modifier into the character that it produces loses the fact
that the key is down, so an application cannot bind an action to Ctrl or
Shift, and cannot tell that one is being held.
Add the eight modifiers to enum kbd_keycode_e and move LAST_KEYCODE to
the new end of the enumeration. Leaving LAST_KEYCODE behind would make
kbd_specpress() assert and kbd_decode() reject the new keycodes, since
both range check against it.
The keycodes are appended, so the values of the existing ones do not
change.
Signed-off-by: Jorge Guzman <jorge.gzm@gmail.com>
As analyzed, the NuttX initial keyboard API design uses event
type KBD_SPECPRESS/KBD_SPECREL to deliver special keys
and KBD_PRESS/KBD_RELEASE to deliver ASCII codes.
But it seems that this design choice has not been followed
in virtio-input, goldfish_events and sim_keyboard designs
and result is that external keyboard special keys events
are mapped to KEYCODE_xxx values which start from 0 and
overlaps with ASCII keys.
The issue is tracked under #19527 number.
This set of changes correct events reporting for mentioned
keyboards to report right event type for special keys.
The solution is only partial at this phase.
Virtual and more complex keyboards usually deliver
key pressures as scancodes (key position on keyboard)
and mapping to ASCII for keys which corresponds to letter
and other similar keys lacks mapping of national alphabets,
second row symbols and switch to capital letter according
to modifiers.
Signed-off-by: Pavel Pisa <pisa@fel.cvut.cz>
Implement POSIX real/effective/saved credential getters and paired
setters in the task group layer, with libc stubs and syscalls.
Signed-off-by: Abhishek Mishra <mishra.abhishek2808@gmail.com>
A file system that answers statfs with a magic nothing maps to shows up as
"Unrecognized" in df. Give xipfs its constant alongside the others in
sys/statfs.h and the case in fs_gettype that turns it into a name.
Assisted-by: Claude Code:claude-opus-5
Signed-off-by: Marco Casaroli <marco.casaroli@gmail.com>
ROMFS is the usual way to carry executables on a NOMMU target with memory
mapped NOR flash: it can hand out a real flash pointer from mmap(), so the
NXFLAT loader maps a module's text in place instead of copying it into RAM.
But a ROMFS image is built on the host and is read only, so a module cannot
be downloaded onto the board at run time.
xipfs is a writable file system with the same in-place property. Each file
is stored as one physically contiguous, erase-block aligned extent, so an
mmap() of it resolves to flash_base + extent_offset and a loader can execute
the file where it already lies. This needs the underlying MTD driver to
answer BIOC_XIPBASE; on the RP2350 rp23xx_flash_mtd.c does.
Files are write once. A file is created, its size is declared, it is
written sequentially, closed, and is thereafter immutable until it is
deleted. That is the whole life cycle of a downloaded module, and it is
what licenses the design: the exact extent is reserved at create time, so
no file ever grows, moves, or fragments internally. Random writes, appends
and truncation of a written file are not supported and are refused.
The only source of fragmentation is therefore free space holes left by
deletes. Allocation fails with -ENOSPC when no single contiguous run is
large enough, and never defragments on its own; the caller decides whether
to compact and retry, through XIPFSIOC_DEFRAG. Defragmentation is manual,
best effort and interruptible: it is a loop of atomic single-extent
relocations, each one copy, commit, erase, so every stop point -- a time
budget, a pinned extent, an erase error -- leaves a consistent layout that
is simply less compact. It reports the largest contiguous run it achieved,
which is what tells the caller whether the retry will fit.
Metadata is committed power safely. Two metadata block sets are used in
ping-pong, each generation carrying a sequence number and a CRC, and every
state change is ordered as write the new data, flip the metadata reference,
then erase what the old one referenced. Mount scans both sets and selects
the last fully valid generation, so a torn write costs the interrupted
operation and nothing else.
A mapping takes a pin on the extent, and the pin lives on the extent rather
than on the file descriptor, so three running instances of one module hold
three pins and the extent becomes movable only when the last one goes.
Defragmentation skips pinned extents, which is what stops it relocating
code that is executing. The pin is released by munmap() or by the task
teardown walk, so a task that dies without unmapping does not leak it.
Directories are records in that same generation, carrying their own identity
and the identity of the directory holding them; the root is implicit and owns
identity zero. They are deliberately NOT objects in the data region, which
is what keeps the commit story in one piece: mkdir and rmdir add or remove a
record and commit one generation, exactly as create and unlink do, so there
is never a multi-object update to journal or an orphan to collect at mount.
An empty directory therefore exists, survives a remount, and costs one entry
out of the volume's fixed supply and no flash blocks at all.
A name is one path component; depth comes from the parent, so XIPFS_NAME_MAX
bounds a component, which is what statfs reports it as. Mount rebuilds the
tree and checks that it is one: identities unique, names unique within a
directory, every parent a live directory, and following parents reaching the
root -- a cycle on the medium would otherwise hang a path walk rather than
merely answering wrongly. '.' and '..' are refused as components, since an
entry stored under either could never be reached again.
The commands that act on the volume rather than on one file --
XIPFSIOC_DEFRAG and XIPFSIOC_LISTPINNED -- are reached through the ioctldir
method, on a descriptor for the mountpoint directory. They are accepted on
a descriptor for a file inside the volume too, but that route holds the file
open for the duration and an open extent cannot be relocated, so a pass
asked for that way is obstructed by the act of asking.
mmap() falls back to the generic RAM copy for ordinary readers when the
media cannot be addressed directly. A module loader must not silently get
a RAM copy, so MAP_XIP_STRICT is added: with it the mapping either resolves
in place or fails with -ENXIO, which the caller can turn into defragment
and retry.
Assisted-by: Claude Code:claude-opus-5
Signed-off-by: Marco Casaroli <marco.casaroli@gmail.com>
Adds support for the PIO4IOE IO Expander, more specifically the PIO4IOE5V6408 version.
Assisted-by: Cursor IDE agents
Signed-off-by: Filipe Cavalcanti <filipe.cavalcanti@espressif.com>
Add DMA support for DAC output with configurable double-buffering
via ioctl interface:
- ANIOC_DAC_DMABUFF_INIT: Copy full buffer into DMA buffer (memcpy)
- ANIOC_DAC_DMA_START: Start DMA with optional half-transfer interrupts
- ANIOC_DAC_DMA_STOP: Stop DMA and timer
- ANIOC_DAC_DMA_GET_EVENT: Wait for half-transfer complete event
- ANIOC_DAC_DMA_WRITE_HBUF: Write half-buffer into DMA buffer
- ANIOC_DAC_INFO: Query DAC capabilities (resolution, DMA, buffer size)
Stream mode: when halfint=1, both HTIF and TCIF generate events
via a ring buffer and semaphore. User writes the completed half
while DMA fills the other half. TCIF indicates h=1, HTIF h=0.
DMA priority is configurable per-channel via Kconfig choice
(Low/Medium/High/VeryHigh), defaulting to Medium.
Signed-off-by: Andrey Sobol <andrey.sobol.nn@gmail.com>
FIOC_REFORMAT, FIOC_OPTIMIZE, FIOC_INTEGRITY and FIOC_DUMP act on a volume,
not on any one file, but the only route into a file system has been the
per-file ioctl method. A caller therefore has to open an unrelated file
just to name the volume it means.
For nxffs that is not merely awkward, it is a dead end. nxffs_ioctl()
refuses FIOC_REFORMAT while any file on the volume is open:
if (volume->ofiles)
{
ferr("ERROR: Open files\n");
ret = -EBUSY;
and every open file is on that list (nxffs_open.c). The descriptor used to
issue the command is itself such a file, so the check can never pass and
FIOC_REFORMAT is unreachable through the only interface that exposes it.
Add an optional ioctldir method to struct mountpt_operations, reached by
issuing the ioctl on a descriptor for the mountpoint directory:
fd = open("/mnt/nxffs", O_RDONLY | O_DIRECTORY);
ioctl(fd, FIOC_REFORMAT, 0);
It takes the same (mountpt, dir) pair as opendir/readdir/rewinddir, so it
reads as a member of the directory-operations family; the file system
recovers the volume from the mountpoint inode and may ignore dir. The
member is placed at the end of the structure rather than beside the other
directory operations on purpose: every file system initialises
mountpt_operations positionally, so a member inserted mid-structure would
force all of them to add a slot for a method they do not implement.
Appending keeps the change to one file system.
dir_ioctl() gives that method the first chance at every command when the
directory belongs to a mounted volume and the file system provides one, and
falls back to its own handling of FIOC_FILEPATH and BIOC_FLUSH when the file
system answers -ENOTTY. Trying the file system first is what lets a file
system override a command the VFS would otherwise answer generically; the
-ENOTTY fallback is what keeps the generic answers available to everyone
else. A file system that leaves the method NULL is unaffected: the VFS
answers exactly as before.
The existing per-file method could not simply be reused for this. It takes
a struct file, and every implementation that has an ioctl -- fat, romfs,
tmpfs, spiffs among them -- asserts on filep->f_priv and dereferences it,
so handing it a directory descriptor with no open file behind it would
fault. Making the entry point separate keeps that contract intact and
makes support explicit rather than assumed.
nxffs implements it, which is what makes its FIOC_REFORMAT reachable. The
per-file path is left in place and both share one implementation, so
nothing that works today stops working. spiffs, which has the same shape
of volume commands, can follow.
Measured on sim:nxffs, with one file written to the volume and then the
same sequence of ioctls issued on a file descriptor, on a descriptor for the
mountpoint directory, and on a descriptor for a pseudo file system directory.
Before:
FIOC_REFORMAT via file fd: ret=-1 errno=16 (EBUSY, as expected)
FIOC_REFORMAT via dir fd: ret=-1 errno=25
FIOC_FILEPATH via dir fd: ret=0 "/mnt/nxffs//"
BIOC_FLUSH via dir fd: ret=0
bogus cmd via dir fd: ret=-1 errno=25
FIOC_FILEPATH via /dev fd: ret=0 "/dev//"
bogus cmd via /dev fd: ret=-1 errno=25
name still in the raw MTD image afterwards: yes
After:
FIOC_REFORMAT via file fd: ret=-1 errno=16 (EBUSY, as expected)
FIOC_REFORMAT via dir fd: ret=0
FIOC_FILEPATH via dir fd: ret=0 "/mnt/nxffs//"
BIOC_FLUSH via dir fd: ret=0
bogus cmd via dir fd: ret=-1 errno=25
FIOC_FILEPATH via /dev fd: ret=0 "/dev//"
bogus cmd via /dev fd: ret=-1 errno=25
name still in the raw MTD image afterwards: no
Only the FIOC_REFORMAT line on the directory descriptor changes, and the raw
MTD image confirms the volume really was erased. FIOC_FILEPATH and
BIOC_FLUSH on a directory still answer even though nxffs is now consulted
ahead of them, an unrecognised command is still refused rather than
forwarded blindly, and a directory in the pseudo file system, which has no
ioctldir at all, is untouched.
Assisted-by: Claude Code:claude-opus-4-8
Assisted-by: Claude Code:claude-fable-5
Assisted-by: Claude Code:claude-opus-5
Signed-off-by: Marco Casaroli <marco.casaroli@gmail.com>
fcntl(F_GETLK/F_SETLK/F_SETLKW) is handled by VFS and reaches file
systems as private FIOC_* ioctl commands. hostfs previously forwarded
those private ioctl command numbers to the host ioctl backend, which is
not the POSIX file-locking interface and cannot be interpreted by the
host OS.
Keep hostfs on the generic host_ioctl() path and define the FIOC_* lock
command values in the hostfs host ABI. The POSIX sim backend recognizes
those commands in host_ioctl() and translates struct flock fields to the
host ABI before calling host fcntl(). Other hostfs backends keep their
existing unsupported-host-ioctl behavior.
F_SETLKW is implemented in the POSIX sim backend by retrying
non-blocking host F_SETLK with a short sleep. This preserves the
blocking NuttX API without forwarding host F_SETLKW directly.
Testing:
- Host: Ubuntu 22.04 x86_64.
- Board/config: sim:nsh with CONFIG_FS_HOSTFS=y,
CONFIG_SIM_HOSTFS=y and CONFIG_EXAMPLES_SIM_POSIX=y.
- make -j16.
- Ran examples/sim_posix from nuttx-apps. The test mounted a long
/tmp hostfs path, opened a host-backed file, and verified
fcntl(F_SETLK), fcntl(F_GETLK), fcntl(F_SETLKW), and unlocking with
F_UNLCK. The app printed "sim_posix: hostfs locks ok" and
"sim_posix: PASS".
Assisted-by: Claude:Claude-Fable-5
Signed-off-by: Lingao Meng <menglingao@xiaomi.com>
Both the UART and PTY serial drivers previously assumed all
VT100/ANSI escape sequences were fixed 3-byte CSI sequences, causing
longer CSI and SS3 key sequences (such as Home, End, Delete, and
modified keys) to leak stray characters into the terminal when local
echo was enabled. This patch replaces the fixed-length logic with a
state machine that correctly recognizes and suppresses escape
sequences of any length, while preserving the data delivered to
applications. The change only affects local echo behavior, is fully
backward compatible, and has been validated with both interactive NSH
sessions and automated PTY tests.
Signed-off-by: Alan C. Assis <acassis@gmail.com>
Assisted-by: Claude Code
Building the hello_d example with LDC ImportC fails because ImportC
does not correctly handle direct __uint128_t C-style casts such as
(__uint128_t)a and (__uint128_t)1.
Replace the direct casts with equivalent typed temporaries, preserving
the existing behavior while allowing hello_d to build successfully with
LDC ImportC.
Verified on sim:nsh with CONFIG_EXAMPLES_HELLO_D=y:
nsh> hello_d
Hello World, [skylake]!
DHelloWorld.HelloWorld: Hello, World!!
Signed-off-by: Ansh Rai <anshrai331@gmail.com>
The STM32H7, STM32F7, STM32L4 and common STM32 SDIO/SDMMC drivers failed
to program the WIDBUS bits when switching MMC/eMMC cards to 4-bit mode,
and the MMC transfer clock presets were hardwired to 1-bit bus width.
Add CLOCK_MMC_TRANSFER_4BIT to the common SDIO clock enum, add 4-bit
MMC clock presets, and update stm32_widebus() to use modifyreg32/
sdmmc_modifyreg32 to set the host controller bus width.
Signed-off-by: DuoYuWang <thirteenking.wang@gmail.com>
Introduce networking capabilities to the Creator CI20 board by leveraging
the pre-existing dm9000 ethernet driver.
To achieve this, the following changes were made:
- Integrated the jz4780 GPIO module to properly configure and enable the
interrupt pin required by the ethernet controller.
- Added `dm90x0.h` to export the dm9000 initialization function, allowing
the board-specific setup code to initialize the network interface.
Signed-off-by: Lwazi Dube <lwazeh@gmail.com>
Provide per-instance capture automonitor lookup for watchdog lower halves
that pass callback context, and avoid selecting an unrelated watchdog when
legacy lower halves provide no context. Update STM32 WWDG lower halves to pass
their instance context so multiple watchdog devices remain distinguishable.
Signed-off-by: hanzhijian <hanzhijian@zepp.com>
Assisted-by: OpenAI Codex
blksize_t is currently defined as int16_t, which overflows when a
filesystem reports a block size larger than 32767 bytes. This causes
st_blksize to become zero, leading to an integer divide-by-zero when
st_blocks is calculated in stat().
Widen blksize_t to int32_t to support larger filesystem block sizes.
Update nuttx_blksize_t in include/nuttx/fs/hostfs.h to keep it
consistent with include/sys/types.h.
struct geometry.geo_sectorsize (include/nuttx/fs/ioctl.h) is also
typed blksize_t, so every debug print of that field using a 16-bit
format specifier is updated to PRId32 to match the new width:
drivers/misc/ramdisk.c, drivers/mmcsd/mmcsd_spi.c, drivers/mtd/ftl.c,
fs/driver/fs_blockmerge.c, drivers/mtd/smart.c,
drivers/usbhost/usbhost_storage.c, drivers/mmcsd/mmcsd_sdio.c,
arch/arm/src/s32k1xx/s32k1xx_eeeprom.c,
arch/arm/src/lc823450/lc823450_mmcl.c.
Signed-off-by: Ansh Rai <anshrai331@gmail.com>
Signed-off-by: root <root@LAPTOP-9C7LKDC5.localdomain>
The existing CRYPTO_AES_CTR is the RFC 3686 profile: the last 4 bytes of
the key are a nonce, the IV is 8 bytes and only the low 32 bits of the
counter block are incremented. SSH aes128/192/256-ctr (RFC 4344) instead
uses the key as-is (no embedded nonce) and treats the whole 16-byte IV as
the initial counter block, incremented as a 128-bit big-endian integer,
with the first keystream block being E(IV).
Add CRYPTO_AES_CTR_SSH as a new enc_xform mirroring the CRYPTO_CHACHA20_DJB
addition. It reuses struct aes_ctr_ctx and the AES block; only setkey (full
key, no nonce), reinit (full 16-byte counter) and crypt (encrypt-then-
increment over all 16 bytes) differ from the RFC 3686 variant.
Keystream validated against `openssl enc -aes-128-ctr`, including a counter
that carries across byte boundaries and a non-block-aligned tail.
Signed-off-by: Felipe Moura <moura.fmo@gmail.com>
Add libelf_findsymbol() to locate a symbol in the ELF symbol table by
name, reusing the existing libelf_findsymtab/libelf_readsym/libelf_symname
helpers, and expose its prototype in include/nuttx/lib/elf.h.
Signed-off-by: anjiahao <anjiahao@xiaomi.com>
nsh_fileapp() could not apply an application's Kconfig-configured
priority/stacksize via posix_spawn() under CONFIG_BUILD_KERNEL, because
the registry table (struct builtin_s / g_builtins[]) was gated on
CONFIG_BUILTIN, which depends on !BUILD_KERNEL. Those settings were
silently ignored in KERNEL builds.
CONFIG_BUILTIN conflates the table with main_t-based dispatch, which is
meaningless under CONFIG_BUILD_KERNEL. Add a hidden derived symbol,
APP_REGISTRY, that tracks table availability independently of dispatch:
config APP_REGISTRY
bool
default y if BUILTIN || BUILD_KERNEL
Switch the guards on the table itself (Make.defs, builtin.h) from
CONFIG_BUILTIN to CONFIG_APP_REGISTRY. Call sites that dereference
builtin->main stay gated on CONFIG_BUILTIN and remain unreachable
under CONFIG_BUILD_KERNEL.
Signed-off-by: liang.huang <liang.huang@houmo.ai>
CRYPTO_CHACHA20 implements the RFC 8439/IETF parameterization (32-bit
counter + 96-bit nonce). SSH's chacha20-poly1305@openssh.com uses the
original DJB construction instead: a 64-bit block counter in state
words 12..13 and a 64-bit nonce in words 14..15 (libtomcrypt's
chacha_ivctr64). The two layouts produce different keystreams for the
same key, so an SSH server cannot interoperate with OpenSSH clients
through the IETF variant.
Signed-off-by: Felipe Moura <moura.fmo@gmail.com>
Expose the ChaCha20 stream cipher and the ChaCha20-Poly1305 AEAD through
the OCF crypto framework (/dev/crypto) so applications such as an SSH
server (chacha20-poly1305) can use them directly, and fix the underlying
ChaCha nonce/counter layout so both match RFC 8439.
RFC 8439 nonce layout fix
-------------------------
chacha_ivsetup() previously used the original DJB layout: a 64-bit block
counter (input[12..13]) followed by a 64-bit nonce (input[14..15]). RFC
8439 defines a 32-bit block counter (input[12]) and a 96-bit / 12-byte
nonce (input[13..15]). With the old layout the existing ChaCha20-Poly1305
AEAD could not reproduce the RFC 8439 test vectors (the last 4 bytes of a
12-byte nonce were consumed as the high half of the counter). This
commit switches chacha_ivsetup() to the RFC 8439 layout and updates the
ChaCha20-Poly1305 one-shot helpers to pass a 12-byte nonce accordingly.
Standalone ChaCha20 on the unified enc path
-------------------------------------------
Instead of introducing a separate multi-buffer stream path (parallel
encrypt_multi/decrypt_multi callbacks), extend the existing enc_xform
encrypt/decrypt callback signature with a length argument:
void (*encrypt)(caddr_t, FAR uint8_t *, size_t len);
void (*decrypt)(caddr_t, FAR uint8_t *, size_t len);
With that single change every cipher, block or stream, flows through the
same swcr_encdec path. swcr_encdec already handles a short final block
via buflen = MIN(i, blocksize), so arbitrary-length data works without a
second code path. This is exactly how the existing stream ciphers
(AES-CTR/OFB/CFB) already behave: the cipher keeps its own counter in the
context and swcr_encdec feeds it whole blocks (only the last one may be
shorter). chacha20_crypt likewise relies on the underlying chacha state
block counter (input[12]) to continue the keystream across calls, so no
per-call keystream caching is needed.
* chacha_private.h: chacha_ivsetup uses a 4-byte counter and a 12-byte
nonce (RFC 8439).
* chachapoly.c / chachapoly.h: split reinit into chacha20_reinit (raw,
counter 0) and chachapoly_reinit (AEAD, counter 1); chacha20_crypt
takes a length and encrypts it in one pass, mirroring aes_ctr_crypt;
12-byte nonce for the one-shot AEAD helpers.
* xform.h / xform.c: add size_t len to encrypt/decrypt; add
enc_xform_chacha20 (blocksize 64, 12-byte IV).
* cryptodev.c / cryptosoft.c: register CRYPTO_CHACHA20 as a txform
cipher, route new sessions to enc_xform_chacha20, feed the AEAD AAD
through crp_aad/crp_aadlen, and handle the short final block in
swcr_encdec.
* cryptodev.h: add CRYPTO_CHACHA20; bump EALG_MAX_BLOCK_LEN to 64.
This keeps all ciphers on one uniform path instead of maintaining two,
and any future stream cipher drops in with just an xform table entry.
Impact: extends an internal kernel callback signature (enc_xform
encrypt/decrypt). All in-tree implementations are updated in the same
commit and the user-facing /dev/crypto ABI is unchanged, so this is
self-contained and not a breaking change for existing configurations.
Testing:
Build host: Ubuntu Linux x86_64, GCC (host sim toolchain)
Target: sim:crypto (CONFIG_ARCH=sim)
Ran the crypto test apps. ChaCha20 uses RFC 8439 2.4.2 vectors
(including a 375-byte multi-block vector exercising cross-block counter
continuity); ChaCha20-Poly1305 uses the RFC 8439 2.8.2 AEAD vector.
A full regression of the other ciphers was run to confirm the extended
encrypt/decrypt signature does not change their behaviour:
nsh> chacha20
chacha20: 2/2 vectors passed
nsh> chachapoly
OK test vector 0
chachapoly: 1/1 vectors passed
nsh> des3cbc -> all vectors OK
nsh> aescbc -> all vectors OK
nsh> aesctr -> all vectors OK
nsh> aesxts -> 14 vectors OK (encrypt + decrypt)
nsh> hmac -> md5 / sha1 / sha256 all success
Signed-off-by: makejian <makejian@xiaomi.com>
The top command was added to nshlib in 2024 but was never documented.
Add a section to the NSH commands page covering syntax, options,
example output and configuration dependencies, including the
Linux-like summary header.
Also enable the command in the linum-stm32h753bi:nsh config: procfs,
CPU load measurement, stack coloration and task names, so that top
and ps are fully functional out of the box. This requires a dedicated
interrupt stack and larger IDLE/init task stacks: with SCHED_CPULOAD
the per-tick accounting runs in interrupt context, and with
ARCH_INTERRUPTSTACK=0 it lands on the stack of the interrupted task,
overflowing the 1 KiB IDLE stack and corrupting the adjacent heap.
Also add the VT100 escape sequences used by the top command screen
refresh as string literals in include/nuttx/vt100.h (VT100_STR_*),
next to the existing VT100_FMT_* definitions.
Tested on hardware.
Signed-off-by: Jorge Guzman <jorge.gzm@gmail.com>
Add lower-half uORB sensor driver for the InvenSense MPU6050 over I2C. Supports accelerometer and gyroscope sensor types, register read/write, fetch, and control operations.
All internal register definitions and full-scale range constants are placed in the private driver C file (drivers/sensors/mpu6050_uorb.c) for clean encapsulation. The device struct uses explicit named members ('accel' and 'gyro') for high readability.
Add Kconfig option CONFIG_SENSORS_MPU6050 under Sensor Drivers, and add build integration to drivers/sensors/Make.defs and CMakeLists.txt.
Signed-off-by: Shriyans S Sahoo <shriyans.s.sahoo@gmail.com>
All I2S driver operation functions say in their signature description
that negative errno values are returned on failure. However, some of
these same functions had `uint32_t` return types. This would result in
incorrect comparison of the return value against signed error code
values.
Signed-off-by: Matteo Golin <matteo.golin@gmail.com>
Since already have support for SHA2-224, extend cryptodev/cryptosoft
to support HMAC version of SHA2-224.
Signed-off-by: Peter Barada <peter.barada@gmail.com>
Add crc32_ieee() and crc32_ieeepart() that produce CRC32 values
compatible with Linux/zlib. The difference from the existing crc32():
crc32(): init=0, no final XOR (NuttX native)
crc32_ieee(): init=0xFFFFFFFF, final XOR 0xFFFFFFFF (Linux/zlib)
The existing crc32() and crc32part() are unchanged to avoid breaking
existing callers (bbsram, sbram, etc.).
New functions:
crc32_ieee(src, len) - full CRC, Linux-compatible
crc32_ieeepart(src, len, crcval) - incremental CRC, Linux-compatible
Verified on sim:nsh against known Linux zlib test vectors:
crc32_ieee("hello") = 0x3610a686 (Linux: 0x3610a686) PASS
crc32_ieee("123456789") = 0xcbf43926 (Linux: 0xcbf43926) PASS
crc32_ieee("") = 0x00000000 (Linux: 0x00000000) PASS
crc32_ieeepart incremental = 0xcbf43926 PASS
crc32("hello") = 0xf032519b (unchanged) PASS
Signed-off-by: hanzhijian <hanzhijian@zepp.com>
This addresses "FIX ME" definitions for the long double. These might not
be all long double format supported by NuttX.
The support was also added only for GCC alike compilers. Other compilers
that have CONFIG_HAVE_LONG_DOUBLE defined will fail with error that
mantisage digits have to be defined for that compiler.
Signed-off-by: Karel Kočí <kkoci@elektroline.cz>
Align the NuttX open(2) flag constants with the Linux asm-generic
values so that the FUSE wire protocol and other cross-platform
interfaces work without conversion.
All code that used '(flags & O_RDONLY)' as a bitmask check (always 0
now that O_RDONLY=0) has been updated to use '(flags & O_ACCMODE)'
comparisons.
The NUTTX_O_* constants in include/nuttx/fs/hostfs.h are updated to
match, and the sim hostfs open flag mapping is fixed.
Signed-off-by: Xiang Xiao <xiaoxiang@xiaomi.com>
O_RDOK and O_WROK are non-standard aliases for O_RDONLY and O_WRONLY
respectively. Having two names for the same flag creates confusion,
especially when aligning the flag values with Linux. Remove the
aliases and replace all uses with the standard O_RDONLY/O_WRONLY.
No functional change — O_RDOK was defined as O_RDONLY and O_WROK as
O_WRONLY, so the replacement is a pure text substitution.
Signed-off-by: Xiang Xiao <xiaoxiang@xiaomi.com>
To let developers use all procedures implemented in the corresponding
.c file when 1wire_crc.h is included.
Signed-off-by: Jiri Vlasak <jvlasak@elektroline.cz>
Add the POSIX d_ino (file serial number) member to struct dirent and
populate it on every readdir() path, so portable callers (e.g. scp in
dropbear) that read dp->d_ino observe a meaningful, non-zero inode
number:
- include/dirent.h: declare d_ino in struct dirent and drop the
outdated comment claiming the field is unimplemented.
- include/nuttx/fs/hostfs.h: add d_ino to struct nuttx_dirent_s so
the hostfs ABI can carry the inode number across the VFS boundary.
- arch/sim/src/sim/posix/sim_hostfs.c: forward the host's
ent->d_ino into entry->d_ino.
- fs/vfs/fs_dir.c (read_pseudodir): copy the in-memory inode's
i_ino into entry->d_ino for the pseudo filesystem.
- fs/yaffs/yaffs_vfs.c: forward yaffs's dirent->d_ino into
entry->d_ino.
- fs/rpmsgfs: extend struct rpmsgfs_readdir_s with an 'ino' field
and propagate it across the RPC in both rpmsgfs_server (fills it
from the underlying entry) and rpmsgfs_client (writes it back to
the caller's nuttx_dirent_s).
Signed-off-by: Xiang Xiao <xiaoxiang@xiaomi.com>
A 16-bit ino_t can only address 65536 distinct file serial numbers,
which is not enough for filesystems with large directory trees and
breaks portable software (e.g. dropbear's scp) that expects a wider
inode number space. Widen ino_t (and nuttx_ino_t in the hostfs ABI)
to uint32_t to match common POSIX practice.
Update fs/rpmsgfs/rpmsgfs.h accordingly: promote the 'ino' field in
struct rpmsgfs_stat_priv_s from uint16_t to uint32_t and move 'nlink'
into the trailing 16-bit slot previously occupied by the reserved
field, keeping the overall packed-struct layout/size unchanged.
Signed-off-by: Xiang Xiao <xiaoxiang@xiaomi.com>
Move uid_t/gid_t out of the CONFIG_SMALL_MEMORY #ifdef so they are
always defined as unsigned int regardless of SMALL_MEMORY.
Update include/nuttx/fs/hostfs.h to match: drop the int16_t variants
of nuttx_gid_t/nuttx_uid_t and keep a single unsigned int definition
so the hostfs RPC ABI stays in sync with sys/types.h.
Signed-off-by: Xiang Xiao <xiaoxiang@xiaomi.com>
Generic stdc_ functions use _Generic macro, but this requires the type
specific functions stdc_*_uc, stdc_*_ul and so on to be functions,
not just another macro definitions.
This commit fixes the issue by ensuring all type specific functions
are static inline functions, not macro definitions.
There is no change other in the functionality or implementation.
Signed-off-by: Michal Lenc <michallenc@seznam.cz>
Add getgroups() to the C library. NuttX has no supplementary group
IDs, so it reports a single group, the effective group ID, and follows
POSIX for the gidsetsize == 0 and short-buffer (EINVAL) cases.
Signed-off-by: Xiang Xiao <xiaoxiang@xiaomi.com>
NuttX has no real session/process-group abstraction, so the TTY layer
collapses the foreground process group onto the single dev->pid field
(pgrp == pid, one member per group). Extend the controlling-terminal
support so portable software (e.g. dropbear, socat) that relies on
job-control primitives works without losing the existing NuttX-specific
behaviour.
Driver (serial.c, pty.c):
- TIOCSCTTY now accepts a flag: arg > 0 keeps the historical "target
PID in arg" semantics (NSH registers the foreground command it just
spawned), while arg == 0 selects the calling task via
nxsched_getpid(), matching the POSIX flag convention used by
dropbear/socat/apue. This preserves all existing callers and makes
the previously-dead arg==0 path deliver SIGINT correctly.
- Add TIOCGPGRP/TIOCGSID (return dev->pid) and TIOCSPGRP (set it).
- pty.c gains the same handlers against pd_pid and includes
nuttx/sched.h for nxsched_getpid().
ioctl numbers (tioctl.h): TIOCGPGRP/TIOCSPGRP/TIOCGSID at 0x37-0x39.
libc wrappers:
- termios: tcgetpgrp(), tcsetpgrp(), tcgetsid() over the new ioctls.
- unistd: setsid()/getsid()/setpgid() stubs consistent with the
existing getpgrp()/getpgid() single-session model (sid == pgid ==
pid; setpgid only succeeds for pgid == pid).
Declare the new prototypes in unistd.h (tcgetsid was already in
termios.h) and register all sources in the Make.defs/CMakeLists.
Group-broadcast signalling (kill(-pgrp)) remains unsupported, so
tty signals still target the single dev->pid; a real session/process
group model is left as a follow-up.
Signed-off-by: Xiang Xiao <xiaoxiang@xiaomi.com>
Add getgrouplist() to the C library. It scans the group database for
a user's supplementary groups and always reports the primary group
first. Without CONFIG_LIBC_GROUP_FILE only the primary group is
returned, since no membership information is available.
The group file is read through lib_get_tempbuffer()/lib_put_tempbuffer()
to avoid a heap allocation on every lookup.
Signed-off-by: Xiang Xiao <xiaoxiang@xiaomi.com>
Add QSPI mode to the GD25 MTD driver alongside the existing SPI path.
When CONFIG_GD25_QSPI is selected, sector erase, chip erase, byte read,
page write, and byte write all use the QSPI command/memory interfaces
instead of SPI. Reads use the quad I/O fast-read command (1-4-4) and
writes use the quad page-program command (1-1-4) via QSPIMEM_QUADDATA.
A new Kconfig option enables the QE bit in SR2 at initialisation so the
quad I/O pins are active.
Signed-off-by: Sammy Tran <sammytran@geotab.com>
Add QSPIMEM_QUADDATA to the QSPI memory flags. This flag selects quad
data width while keeping the address phase on a single line (1-1-4),
which QSPIMEM_QUADIO cannot express (it forces quad on both address and
data phases). Update stm32_qspi_memory() to honour the new flag by
setting CCR_DMODE_QUAD without touching the address mode.
Signed-off-by: Sammy Tran <sammytran@geotab.com>
Change the 'reg' field type from uint32_t to uintptr_t in all clock
provider structs (clk_gate_s, clk_divider_s, clk_phase_s,
clk_fractional_divider_s, clk_multiplier_s, clk_mux_s) and their
corresponding clk_register_*() function prototypes.
Also update clk_write() and clk_read() inline functions to take
uintptr_t parameter and remove the now-redundant (uintptr_t) cast.
On 32-bit embedded platforms uintptr_t equals uint32_t so there is
no functional change. On 64-bit targets (e.g. sim) this fixes
-Wint-to-pointer-cast warnings that GCC15 promotes to errors.
Fixes: #16896
Signed-off-by: hanzhijian <hanzhijian@zepp.com>
struct pthread_cond_s contains three fields: sem, clockid, and
wait_count. However, PTHREAD_COND_INITIALIZER only initialized the first
two fields, which triggers -Wmissing-field-initializers when a condition
variable is statically initialized.
Initialize wait_count explicitly to zero so the macro matches the structure
definition and remains warning-free with strict compiler flags.
Validated with a minimal compile test using:
pthread_cond_t cond = PTHREAD_COND_INITIALIZER;
Signed-off-by: nicolasWDC <nicolasWDC@users.noreply.github.com>
Correct build errors when CONFIG_ENABLE_ALL_SIGNALS is not defined
- sched makefiles: Move pending-signal helpers from the ENABLE_ALL_SIGNALS-only
list to the !DISABLE_ALL_SIGNALS list so signal dispatch is available in
PARTIAL builds sched: make SIG_PREALLOC_ACTIONS, SIG_ALLOC_ACTIONS and
SIG_DEFAULT depend on ENABLE_ALL_SIGNALS
- sched: fix ifdefs around pending-signal queue access and signal-mask for
PARTIAL/DISABLE modes
- arch: gate SYS_signal_handler / _return calls and SYSCALL_LOOKUP(signal)
with ENABLE_ALL_SIGNALS
Signed-off-by: Jukka Laitinen <jukka.laitinen@tii.ae>
This removes the DEBUGASSERT in ftl_initialize_by_path. Instead, check
compile time that FTL is enabled in case some of the drivers implement
the isbad and markbad functions.
Also select the FTL_BBM for those drivers as they require it.
Signed-off-by: Jukka Laitinen <jukka.laitinen@tii.ae>
Coexistence policy does not belong in the driver. Replace the in-driver
priority-boost arbitration (the NRF91_MODEM_GNSS_BOOST_PRIO knob and the
NOT_ENOUGH_WINDOW_TIME counter heuristic) with a user space mechanism:
SNIOC_GNSS_SET_PRIORITY toggles nrf_modem_gnss priority mode on request,
leaving the when-to-use-it decision to the application.
Signed-off-by: raiden00pl <raiden00@railab.me>
