Commit graph

29 commits

Author SHA1 Message Date
Catalin Visinescu
081e4c478a drivers/: Multiple Drivers Are Registered With World Writable - Part 2
Permissions (Part 2)

Description:

In kernel builds, any unprivileged process running on the NuttX
device can open /dev/efuse and attempt to read/write fuse content.
Reading the fuses may provide valuable information to an attacker
controlling the user process. The write operation, in extreme cases
where the fuse blocks are not locked, may brick the device.

DISCLAIMER: I tried to be strict with the settings, better to relax them
later if it's needed.

This is part of https://github.com/apache/nuttx/issues/19410

See https://github.com/apache/nuttx/issues/19410

Compiles ok.

Signed-off-by: Catalin Visinescu <catalin_visinescu@yahoo.com>
2026-07-15 15:27:28 +08:00
hanzj
283742e29c drivers/rpmsg: Fix typo rpmsg_device_destory -> rpmsg_device_destroy
Rename rpmsg_device_destory() to rpmsg_device_destroy() to fix a
spelling error in the function name.  The function is declared in the
private header drivers/rpmsg/rpmsg.h and used only within the
drivers/rpmsg/ subsystem (rpmsg.c, rpmsg_virtio.c,
rpmsg_router_edge.c, rpmsg_port.c), so there is no public API or
ABI impact.

Signed-off-by: hanzj <hanzjian@zepp.com>
2026-05-30 17:49:03 +08:00
Bowen Wang
960bd97bb0 drivers/rpmsg: use NuttX atomic_t API instead of C11 atomics
Replace C11 atomic types and operations with NuttX native atomic
interfaces (atomic_t, atomic_set, atomic_fetch_and_acquire,
atomic_fetch_or_acquire) to avoid build failures on toolchains
that lack full C11 atomics support.

Signed-off-by: chenrun1 <chenrun1@xiaomi.com>
Signed-off-by: Bowen Wang <wangbowen6@xiaomi.com>
2026-05-21 06:28:36 +08:00
liaoao
198a8fe108 drivers/rpmsg: add rpmsg_get_timestamp to retrieve buffer timestamps
Add rpmsg_get_timestamp() API to get the TX/RX timestamps of an rpmsg
buffer. This is useful for latency measurement and debugging purposes.

The new rpmsg_timestamp_s structure contains:
  - tx_nsec: timestamp when the buffer was transmitted
  - rx_nsec: timestamp when the buffer was received

Signed-off-by: liaoao <liaoao@xiaomi.com>
Signed-off-by: Bowen Wang <wangbowen6@xiaomi.com>
2026-02-01 01:14:49 +08:00
Yongrong Wang
f56ea30479 drivers/rpmsg: refactor internal APIs to private header
Move rpmsg internal APIs from public header include/nuttx/rpmsg/rpmsg.h
to private header drivers/rpmsg/rpmsg.h. These APIs are only used within
the rpmsg driver implementation and should not be exposed to external
modules.

Moved APIs:
- rpmsg_modify_signals()
- rpmsg_ns_bind() / rpmsg_ns_unbind()
- rpmsg_device_created() / rpmsg_device_destory()
- rpmsg_register() / rpmsg_unregister()

Signed-off-by: Yongrong Wang <wangyongrong@xiaomi.com>
Signed-off-by: Bowen Wang <wangbowen6@xiaomi.com>
2026-01-26 17:23:31 -03:00
Yongrong Wang
aa567d43f6 drivers/rpmsg: fix struct alignment issue by removing zero array member
This commit fixes a memory alignment issue in the rpmsg subsystem.
The previous implementation used a flexible array member (rdev[0])
in struct rpmsg_s, but due to automatic 8-byte padding, rpmsg->rdev
could differ from the transport layer's rdev address (e.g.,
rpmsg_virtio->rvdev.rdev), causing potential memory corruption.

Changes:
- Remove rdev[0] flexible array member from struct rpmsg_s
- Add rpmsg_get_rdev_by_rpmsg() inline helper to calculate rdev
  address as (rpmsg + 1), ensuring correct pointer arithmetic
- Update all rpmsg->rdev references to use the new helper function
- Fix rpmsg_virtio_notify_wait() to use correct container_of macro

Signed-off-by: Yongrong Wang <wangyongrong@xiaomi.com>
2026-01-26 21:12:34 +08:00
Bowen Wang
2795918932 drivers/rpmsg: unify cpuname/local_cpuname to struct rpmsg_s
Unify all the cpuname/local_cpuname to struct rpmsg_s, so we can
remove the ops->get_cpuname and ops->get_local_cpuname in
struct rpmsg_ops_s.

Signed-off-by: Bowen Wang <wangbowen6@xiaomi.com>
2026-01-24 17:10:18 +08:00
yangao1
9903b11656 drivers/rpmsg: remove unnecessary header files, revise make.def and cmake
Already copy the rpmsg_internal.h from openamp to the nuttx/include,
so do not need add the include patch for .c files.

Signed-off-by: yangao1 <yangao1@xiaomi.com>
Signed-off-by: wangshaoxin <wangshaoxin@xiaomi.com>
2026-01-19 23:14:53 +08:00
yintao
f671ec648e drivers/rpmsg: add signals router for rpmsg router
Now the rpmsg router transport also support get the signals, and
this signals value is modified by other physical rpmsg transport
(port, virtio) other routed by the rpmsg router.

Signed-off-by: yintao <yintao@xiaomi.com>
2026-01-15 16:13:24 -03:00
yintao
492abaa052 drivers/rpmsg: unitfy the rpmsg signals from transport to struct rpmsg_s
Now all the rpmsg transport use the signals in struct rpmsg_s instead
add element in its own private struct.

Signed-off-by: yintao <yintao@xiaomi.com>
2026-01-15 16:13:24 -03:00
mazhuang
45f6d86f37 drivers/rpmsg: add rpmsg_test to test rpmsg hold/release rx buffer
rpmsg_test is a rpmsg api test service inside the kernel, and user
can use ioctl to start this test.

Signed-off-by: mazhuang <mazhuang@xiaomi.com>
Signed-off-by: Bowen Wang <wangbowen6@xiaomi.com>
Signed-off-by: wangshaoxin <wangshaoxin@xiaomi.com>
2026-01-08 22:44:35 +08:00
Yongrong Wang
9d6edc37e7 rpmsg: fix rpmsg dead lock and ns bind race condition problem
If a ns_bind message come at between traverse g_rpmsg_cb and add g_rpmsg_cb list,
the cb->node has not been added to the g_rpmsg_cb list yet.
So rpmsg_ns_bind will not find this callback and not call the cb->ns_bind()
to notify the rpmsg services.

Signed-off-by: Yongrong Wang <wangyongrong@xiaomi.com>
2026-01-07 22:47:09 +08:00
Yongrong Wang
906d5a8204 rpmsg: Add rpmsg_get_signals API and rpmsg transport ops support
provide get_signals ops to the transport layer implementation.
add rpmsg_get_signals API for rpmsg service to get remote core's
status.

Signed-off-by: Yongrong Wang <wangyongrong@xiaomi.com>
Signed-off-by: cuiziwei <cuiziwei@xiaomi.com>
Signed-off-by: Bowen Wang <wangbowen6@xiaomi.com>
2026-01-06 02:15:43 +08:00
liaoao
d019a638ab rpmsg: call unbound_cb if service used as server/client when it is destroyed
Before this patch, the rpmsg services will not be destroied after
call the rpmsg_device_destory(). And will cause error after
call rpmsg_device_created() at the secound connecting witt peer.

Signed-off-by: liaoao <liaoao@xiaomi.com>
Signed-off-by: Bowen Wang <wangbowen6@xiaomi.com>
2026-01-04 21:06:10 +08:00
Alin Jerpelea
286d37026c drivers: migrate to SPDX identifier
Most tools used for compliance and SBOM generation use SPDX identifiers
This change brings us a step closer to an easy SBOM generation.

Signed-off-by: Alin Jerpelea <alin.jerpelea@sony.com>
2024-11-06 18:02:25 +08:00
wangyongrong
8e799ff823 rpmsg: upgrade API passing on parameters with the upgrade of OpenAMP
All the rpmsg transport layer and rpmsg services sync the API
with new OpenAMP

Signed-off-by: wangyongrong <wangyongrong@xiaomi.com>
2024-10-09 23:32:58 +08:00
chao an
4195851845 drivers/rpmsg: replace metal_list_for_each to safety version
replace metal_list_for_each to safety version to avoid invalid access to deleted node in destory flow

Signed-off-by: chao an <anchao@lixiang.com>
2024-09-26 08:36:14 +08:00
wangjianyu3
73b7128fb6 drivers/rpmsg: Fix a typo error of rpmsg_device_destory()
Signed-off-by: wangjianyu3 <wangjianyu3@xiaomi.com>
2024-09-25 01:51:18 +08:00
wangjianyu3
b8029d28a3 drivers/rpmsg: Using safe list iterating in rpmsg_device_created()
To fix list access after delete error

Test:
  /* Export */
  rpmsgdev_export("SERVER", "/dev/DEVNAME");

  /* Register */
  rpmsgdev_register("CLIENT", "/dev/DEVNAME", "/dev/server-DEVNAME", 0);

Log:
  [ap] kasan_report: kasan detected a read access error, address at 0x40b7ae78,size is 8, return address: 0x402a3c50
  [ap] kasan_show_memory: Shadow bytes around the buggy address:
  [ap] kasan_show_memory:   0x40b7ae20: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  [ap] kasan_show_memory:   0x40b7ae30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  [ap] kasan_show_memory:   0x40b7ae40: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  [ap] kasan_show_memory:   0x40b7ae50: 20 af b7 40 00 00 00 00 c0 17 2a 40 00 00 00 00
  [ap] kasan_show_memory:   0x40b7ae60: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  [ap] kasan_show_memory:   0x40b7ae70: 00 00 00 00 00 00 00 00[b0 f7 b3 40 00 00 00 00]
  [ap] kasan_show_memory:   0x40b7ae80: c8 48 b8 40 00 00 00 00 00 00 00 00 00 00 00 00
  [ap] kasan_show_memory:   0x40b7ae90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  [ap] kasan_show_memory:   0x40b7aea0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  [ap] kasan_show_memory:   0x40b7aeb0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

  $ addr2line -fe nuttx/nuttx 0x402a3c50
  rpmsg_device_created
  /workspace/nuttx/drivers/rpmsg/rpmsg.c:395 (discriminator 2)

Reported by rongyichang@xiaomi.com

Signed-off-by: wangjianyu3 <wangjianyu3@xiaomi.com>
2024-09-25 01:51:18 +08:00
Bowen Wang
ab47465dd5 drivers/rpmsg: add get_local_cpuname to rpmsg ops
Add get_local_cpuname to the rpmsg framework ops to support communicate
with the same remote core with multi rpmsg transport.

Some rpmsg services will send local cpu name to remote core and then let
remote core to connect local core by using this cpu name, when there are
multi rpmsg channels with same remote core, the remote core may connect
to incorrect core, so use the error rpmsg channel.

For example, there are two rpmsg channels between ap and audio:

ap core                     audio core
 [ap1] <-- rpmsg virtio1 --> [audio1]
 [ap2] <-- rpmsg virtio2 --> [audio2]

When we want to use the rpmsg virtio1 to communicate, ap core may send
local cpuname "ap2" to audio, so the audio core use remote cpu "ap2" to
connect with ap, and resulting in the use of incorrect rpmsg channel.

Signed-off-by: Bowen Wang <wangbowen6@xiaomi.com>
2024-09-17 01:55:51 +08:00
yintao
38af7001b6 drivers/rpmsg: fix the race condtion about rpmsg_device_created
xxx_rpmsg_device_created may be called repeatedly.

rptun thread				app thread

rptun_dev_start				xxx_rpmsg_init

...					rpmsg_register_callback
priv->...= rpmsg_ns_unbind;
priv->..= rptun_notify_wait;
					if (ns_unbind_cb)
(switch app thread)				device_created()
						xxx_rpmsg_device_created

					metal_list_add_tail(g_cb);
...
rpmsg_device_created();
	cb->device_created
	xxx_rpmsg_device_created;

Signed-off-by: yintao <yintao@xiaomi.com>
2024-09-14 17:34:52 +08:00
Bowen Wang
1f96a0b5e9 drivers/rpmsg: fix recursive assert when call rpmsg_dump_all() in irq
Because call mutex lock is forbidden in interrupt.

Signed-off-by: Bowen Wang <wangbowen6@xiaomi.com>
2024-09-14 17:34:52 +08:00
Xiang Xiao
56745e300a rpmsg: Reformat drivers/rpmsg/rpmsg.c
Signed-off-by: Xiang Xiao <xiaoxiang@xiaomi.com>
2024-08-27 01:48:16 +08:00
Yongrong Wang
88ec55f6af rpmsg.c: move onceinit judge logic to common part
move rptun/rpmsg_virtio onceinit judge logic to rpmsg_register.

Signed-off-by: Yongrong Wang <wangyongrong@xiaomi.com>
2024-08-27 01:48:16 +08:00
wangyongrong
10a8c2be92 rptun ioctl: Strip rpmsg ioctl and rptun ioctl.
rptun ioctl only handle RPTUNIOC_START, RPTUNIOC_STOP, RPTUNIOC_RESET,
rpmsg ioctl handles the public ioctl commands part.

Signed-off-by: wangyongrong <wangyongrong@xiaomi.com>
2024-02-19 02:15:45 -08:00
wangyongrong
ce832c6377 rptun_ping: Strip rptun_ping out of rptun and rename to rpmsg_ping
It should be possible to use ping without rptun being enabled, so striped rptun_ping out of rptun and rename to rpmsg_ping.

Signed-off-by: wangyongrong <wangyongrong@xiaomi.com>
2024-01-30 04:08:59 -08:00
wangyongrong
5651612f45 rptun: extract rptun char to rpmsg/rpmsg.c
Signed-off-by: wangyongrong <wangyongrong@xiaomi.com>
2024-01-26 00:42:28 -08:00
wangyongrong
5018964155 rpmsgfs: decoupling rpmsgfs server and rpmsg virtio.
create a new general api to make rpmsgfs work with virtio/spi/uart transport.

Signed-off-by: wangyongrong <wangyongrong@xiaomi.com>
2024-01-24 06:52:13 -08:00
wangyongrong
7508a10e20 rptun: Strip rpmsg and rptun
nuttx/driver/rpmsg: new folder, extract common rpmsg api in rptun.c to rpmsg.c.
rpmsg provide rpmsg_ops to each backend for specific implementation.

Signed-off-by: wangyongrong <wangyongrong@xiaomi.com>
2024-01-16 15:58:32 +01:00