NuttX implemented fork() and vfork() as the same function. Both were libc
wrappers around a single up_fork() syscall; vfork() differed only by a
trailing waitpid(). Underneath, the child joined the parent's address
environment -- the same addrenv_join() that pthread_create() uses -- and got
a private copy of the stack. So the child shared .data, .bss and the heap
with its parent and ran concurrently with it.
That is not fork(). It is vfork()-with-a-private-stack under fork()'s name,
and the history says so: today's fork() is NuttX's old vfork(), renamed in
c33d1c9c97 (2023) without any change of behaviour. The failure was silent --
a program written against POSIX fork() compiled, ran, and had its child's
writes land in the parent's variables.
Separate them into two primitives, chosen by which function the caller
called rather than by what the hardware happens to be:
fork() child gets its own copy of the parent's memory at the same
virtual addresses; runs concurrently. Only where an address
environment can be duplicated -- elsewhere it is not declared at
all, so calling it is a build error naming the function.
vfork() child shares the parent's memory; parent suspended until the
child _exit()s or exec()s. Implementable everywhere.
Below libc there is still one syscall. up_fork() gains a bool saying which
primitive the caller used, since the per-architecture register snapshot is
the same for both, and passes it to nxtask_setup_fork(), which is the single
place the memory semantics are decided. The argument arrives in the first
argument register and is never touched: each architecture's snapshot takes
some other call-clobbered register for its scratch, so the flag is simply
still there when the C worker is called.
The vfork() parent suspension moves out of libc into nxtask_start_fork(),
released from nxsched_release_tcb() by nxtask_resume_vfork(). Two things
follow: the parent is resumed at exec(), since exec_swap() has already handed
the child's pid to the loaded program by the time the vfork stub exits, and
vfork() no longer depends on CONFIG_SCHED_WAITPID.
Releasing there requires one fix in nxtask_exit(). It raises rtcb->lockcount
directly rather than through sched_lock() while it tears the TCB down, so the
nxsem_post() that wakes the vfork() parent leaves it queued where a blocked
task collects while pre-emption is off -- g_pendingtasks, or g_readytorun on
SMP -- and the matching raw lockcount-- does not publish it the way
sched_unlock() would, leaving the parent stranded with nothing to move it on.
The fix mirrors sched_unlock() for each case: nxsched_merge_pending(), or
nxsched_deliver_task() under CONFIG_SMP. Both are no-ops while pre-emption is
still disabled, and up_exit() re-reads this_task() afterwards, so a change of
the ready-to-run head is honoured. Without it vfork() deadlocks wherever no
other task happens to call sched_unlock() afterwards -- rv-virt:nsh64 and
rv-virt:pnsh64, where NSH is blocked in waitpid() holding the lock, and
qemu-armv8a:citest_smp, which hangs the moment the vfork() test runs.
fork() is built on a new addrenv_fork(), backed by an up_addrenv_fork() hook
that duplicates an address environment into freshly allocated pages mapped at
the same virtual addresses -- unlike up_addrenv_clone(), which copies only
the representation and leaves both pointing at the same page tables. The
child then adopts the parent's stack geometry rather than being given a
relocated copy: a pointer to a stack local taken before fork() must name the
same object in the child that it named in the parent, and the parent's stack
is already in the duplicate, with its contents, at the parent's address.
No architecture implements up_addrenv_fork() yet, so this commit leaves
fork() unavailable everywhere. That is the intended state. It withdraws
fork() from ARCH_ARM, flat ARCH_ARM64, ARCH_RISCV, ARCH_SIM and ARCH_X86_64,
where until now it named the sharing primitive; per-architecture patches
restore it, with POSIX semantics, as up_addrenv_fork() lands. In the
meantime the sharing primitive is still there under the name that describes
it: vfork() for a child that runs a program, pthread_create() for a second
flow of control that shares memory, posix_spawn() for both at once.
Kconfig: ARCH_HAVE_VFORK inherits ARCH_HAVE_FORK's select lines, conditions
included, so no configuration gains machinery; ARCH_HAVE_FORK is redefined to
mean "can provide POSIX fork() semantics" and now depends on ARCH_ADDRENV.
There is one deliberate departure from "verbatim". ARCH_ARM selected the
fork family unconditionally, BUILD_KERNEL included, and that has never
worked: on a kernel build the architecture's fork entry point sees the
kernel's return address and stack pointer rather than the caller's, so the
child resumes at a kernel address. On qemu-armv7a:knsh master faults in
ostest's fork case with "Child did not run" and then a data abort; without
the condition this change faults the same way through vfork(). ARCH_ARM64
and ARCH_X86_64 already carried "if !BUILD_KERNEL" for exactly this reason --
ARM was the outlier. Conditioning it turns a runtime fault into an honest
absence, which is the whole point of the change; arch/arm takes the condition
off again in the patch that adds its saved-syscall-frame path. Only the
MMU-capable ARM ports are affected, since Cortex-M cannot build BUILD_KERNEL
at all.
Also fixes two latent syntax errors found on the way: a missing comma in
riscv_fork.c and mips_fork.c, both in *_FRAMEPOINTER && !SAVE_GP branches
that are never compiled today.
BREAKING CHANGE: fork() is withdrawn from every architecture. It is no
longer declared in unistd.h, so code that calls it fails to build with an error
naming the function, and the sharing behaviour it used to have is gone rather
than renamed. CONFIG_ARCH_HAVE_FORK no longer means "fork() exists"; it means
"this configuration can provide POSIX fork() semantics", and no architecture
selects it yet.
Quick fix, chosen by why the call was made:
to run a program vfork() + exec*(), or better posix_spawn()
a second flow of control that pthread_create()
shares the caller's memory
a genuinely independent copy keep fork(), and wait for the per-arch patch
of the process that implements up_addrenv_fork() and selects
CONFIG_ARCH_HAVE_FORK
Out-of-tree code that tests CONFIG_ARCH_HAVE_FORK to decide whether a
fork-then-exec path is available wants CONFIG_ARCH_HAVE_VFORK instead, which is
selected in exactly the places CONFIG_ARCH_HAVE_FORK used to be. The full
migration guide is Documentation/guides/fork_vfork_migration.rst.
Assisted-by: Claude Code:claude-opus-5
Signed-off-by: Marco Casaroli <marco.casaroli@gmail.com>
Perform pseudo-filesystem permission checks inside inode_reserve() and
inode_remove() while the inode tree lock is held, and hold that lock across
pseudorename mutations so symlink swaps cannot bypass directory checks.
Hold a read lock around pseudo-fs open permission checks.
On setuid/setgid exec, update saved set-IDs, mark the task group secure,
sanitize dangerous environment variables, clear debug/dumpable flags, and
add issetugid(), secure_getenv(), and PR_SET/GET_DUMPABLE support.
Signed-off-by: Abhishek Mishra <mishra.abhishek2808@gmail.com>
posix_spawnattr_init() no longer pre-fills attr->stacksize and
attr->priority (it leaves them zero, as memset already does). When a
caller does not set them, the binary loader supplies them from the
loaded ELF (binp->stacksize / binp->priority, parsed from the nx_*
symbols), and nxtask_spawn_exec() falls back to the parent priority and
CONFIG_POSIX_SPAWN_DEFAULT_STACKSIZE for the posix_spawn() function-task
path.
This lets an application's stack size and priority embedded as ELF
symbols actually drive the spawned task, instead of being overridden by
the spawnattr defaults.
Signed-off-by: anjiahao <anjiahao@xiaomi.com>
Correct build errors when CONFIG_ENABLE_ALL_SIGNALS is not defined
- sched makefiles: Move pending-signal helpers from the ENABLE_ALL_SIGNALS-only
list to the !DISABLE_ALL_SIGNALS list so signal dispatch is available in
PARTIAL builds sched: make SIG_PREALLOC_ACTIONS, SIG_ALLOC_ACTIONS and
SIG_DEFAULT depend on ENABLE_ALL_SIGNALS
- sched: fix ifdefs around pending-signal queue access and signal-mask for
PARTIAL/DISABLE modes
- arch: gate SYS_signal_handler / _return calls and SYSCALL_LOOKUP(signal)
with ENABLE_ALL_SIGNALS
Signed-off-by: Jukka Laitinen <jukka.laitinen@tii.ae>
debug.h is a NuttX-specific, non-POSIX header. Placing it in the
top-level include/ directory creates naming conflicts with external
projects that define their own debug.h.
This commit moves the canonical header to include/nuttx/debug.h,
following the NuttX convention for non-POSIX/non-standard headers,
and updates all in-tree references.
A backward-compatibility shim is left at include/debug.h that
emits a deprecation #warning and re-includes <nuttx/debug.h>,
allowing out-of-tree code to continue building while migrating.
Signed-off-by: Piyush Patle <piyushpatle228@gmail.com>
Fix violations of MISRA C:2012 Rule 10.4 (operand of unsigned and signed)
in cancellation point handling code.
Changed all CANCEL_FLAG_* macro definitions and their usage to use unsigned
literals (1u instead of 1) to ensure consistent unsigned arithmetic when
performing bitwise operations. This eliminates mixed signed/unsigned operand
violations in:
- CANCEL_FLAG_NONCANCELABLE
- CANCEL_FLAG_CANCEL_ASYNC
- CANCEL_FLAG_CANCEL_PENDING
The changes affect cancellation point entry/exit logic, cancellation state
management, and cancellation type handling across both kernel and libc
implementations.
Signed-off-by: fangxinyong <fangxinyong@xiaomi.com>
Fix violations of MISRA C:2012 Rule 10.4 (essential type operand of
unsigned and signed) in posix_spawn attribute handling code.
Changed all POSIX_SPAWN_* flag macro definitions to use unsigned literals
(1u instead of 1) to ensure consistent unsigned arithmetic when performing
bitwise operations. This eliminates mixed signed/unsigned operand violations
in the following flags:
- POSIX_SPAWN_RESETIDS
- POSIX_SPAWN_SETPGROUP
- POSIX_SPAWN_SETSCHEDPARAM
- POSIX_SPAWN_SETSCHEDULER
- POSIX_SPAWN_SETSIGDEF
- POSIX_SPAWN_SETSIGMASK
- POSIX_SPAWN_SETSID
Updated all flag checking comparisons in spawn_execattrs() to compare
against 0u instead of 0 for consistency.
Signed-off-by: fangxinyong <fangxinyong@xiaomi.com>
Move pthread mutex operations from kernel-space syscall
interface to user-space implementations
to reduce syscall overhead. Relocate mutex holder list
tracking from task control block (tcb) to
thread local storage (tls) to improve memory layout and
cache efficiency. Add helper macros for
conditional mutex implementations and update syscall
interface accordingly.
Signed-off-by: hujun5 <hujun5@xiaomi.com>
Refactor nxtask_setup_stackargs() to use a single ret exit path.
Avoid partially-initialized state on error paths and improve readability.
Addresses Coverity HIS_metric_violation: RETURN.
Signed-off-by: fangxinyong <fangxinyong@xiaomi.com>
Initialize ret and propagate scheduler/param errors via a single return.
Make spawn_file_is_duplicateable() decision explicit using a dup state.
Addresses Coverity HIS_metric_violation: RETURN.
Signed-off-by: fangxinyong <fangxinyong@xiaomi.com>
Replace early return with a ret flag to unify the exit path.
Keep critical section behavior unchanged while simplifying control flow.
Addresses Coverity HIS_metric_violation: RETURN.
Signed-off-by: fangxinyong <fangxinyong@xiaomi.com>
Use a local ret variable and return once at the end.
This keeps the IDLE_PROCESS_ID fallback behavior unchanged.
Addresses Coverity HIS_metric_violation: RETURN.
Signed-off-by: fangxinyong <fangxinyong@xiaomi.com>
Add pid field to task_info_s and move getpid() implementation to user
space TLS access. Remove getpid from syscall interface as it now returns
cached PID from thread local storage instead of kernel lookup.
Signed-off-by: hujun5 <hujun5@xiaomi.com>
Move tls_dup_info() call to after child process priority is set, ensuring
the child's pid is properly initialized before duplicating TLS information.
This fixes incorrect thread ID assignment during task fork operations.
Signed-off-by: hujun5 <hujun5@xiaomi.com>
Move nxsched_switch_context() call after setting TSTATE_TASK_INACTIVE to ensure
proper IRQ count state before context switching, preventing assertion failures
in enter_critical_section() when rtcb->irqcount is incorrectly zero during termination.
Signed-off-by: hujun5 <hujun5@xiaomi.com>
Move kernel stack allocation from exec_module() (binary format execution) to
nxtask_init() (task initialization) with proper type checking. Add conditional
check to allocate kernel stack only for non-kernel tasks (ttype != TCB_FLAG_TTYPE_KERNEL).
Enables kernel stack allocation for both exec'd tasks and regular task_create()
calls in protected builds, allowing userspace to create tasks with proper kernel
stack isolation.
Signed-off-by: hujun5 <hujun5@xiaomi.com>
Signals in NuttX serve two primary purposes:
1. Synchronization and wake-up:
Signals can be used to block threads on specific signal sets and later
wake them up by delivering the corresponding signals to those threads.
2. Asynchronous notification:
Signals can also be used to install callback handlers for specific signals, allowing threads to
asynchronously invoke those handlers when the signals are delivered.
This change introduces the ability to disable all signal functionality to reduce footprint for NuttX.
Signed-off-by: Chengdong Wang wangchengdong@lixiang.com
Signals in NuttX serve two primary purposes:
1. Synchronization and wake-up:
Signals can be used to block threads on specific signal sets and later
wake them up by delivering the corresponding signals to those threads.
2. Asynchronous notification:
Signals can also be used to install callback handlers for specific signals, allowing threads to
asynchronously invoke those handlers when the signals are delivered.
This change introduces the ability to partially disable signal functionality: to disable only signal functions for
Asynchronous notification, keeping functions for Synchronization and wake-up.
This enables finer-grained control over signal usage while preserving existing behavior for supported use cases.
Co-authored-by: Guo Shichao guoshichao@xiaomi.com
Signed-off-by: Chengdong Wang wangchengdong@lixiang.com
Move addrenv_join() call after group_initialize() in nxtask_setup_fork() to fix
null pointer dereference. addrenv_join() accesses child->group which is
initialized by group_initialize(), so the operations must be sequenced
correctly. Reorder initialization to ensure child task group is set up before
address environment join operations.
Signed-off-by: hujun5 <hujun5@xiaomi.com>
The TCB initializes the pid early, but the argvstack is not initialized
at that time. This may cause invalid addresses to be obtained when
nxsched_get_stackargs is called during task enumeration.
Initialize the argv pointer to NULL to enable safe validity checks.
Signed-off-by: hujun5 <hujun5@xiaomi.com>
Since the task and group structures are no longer allocated in the same space, the memory for group is allocated in the group_allocate() function, and no further allocation is needed during the task allocation process.
Signed-off-by: wangzhi16 <wangzhi16@xiaomi.com>
This reverts commit 29e50ffa73.
reason:
Placing the main thread and the gourd in the same memory block, and allocating and freeing memory simultaneously, presents the following two problems：
When the main thread creates a child thread and performs a detach operation, there is a possibility that the main thread may have exited, but the main thread's TCB (Transaction Control Block) may not have been released.
This could potentially cause the main thread's TCB to be double-freed. The core contradiction in this problem lies in binding the main thread's TCB (Trust Container Registry) and the group together. When releasing the main thread's TCB, an additional check is needed to ensure the main thread was the last to leave the group. If this check and the free operation are atomically guaranteed, the logic is sound, and double freeing won't occur. However, this atomicity cannot be completely guaranteed. If other free operations cause a block, problems still arise.
Signed-off-by: wangzhi16 <wangzhi16@xiaomi.com>
If the thread is blocked waiting on a event, then the
thread must be unblocked from the evnet to handle
the task cancellation.
Signed-off-by: Chengdong Wang wangchengdong@lixiang.com
Currently, there is duplicated code in nxsig_wait_irq() and nxsig_timeout().
This patch updates the input parameters of nxsig_wait_irq() so that it can
be reused in nxsig_timeout(), reducing code duplication and improving
maintainability.
Signed-off-by: Chengdong Wang <wangchengdong@lixiang.com>
Replace all nxsched_suspend/resume_*** with nxsched_switch_context
Delete nxsched_resume_scheduler in up_exit and call it uniformly in task_exit
Co-authored-by: yinshengkai <yinshengkai@xiaomi.com>
Signed-off-by: guoshengyuan1 <guoshengyuan1@xiaomi.com>
When the task has TCB_FLAG_CPU_LOCKED it is locked to the CPU regardless
of the affinity. There is no need to switch the affinity back and forth.
Signed-off-by: Jukka Laitinen <jukka.laitinen@tii.ae>
Change every occurence of up_switch_context to use this_task() as the first parameter.
"nxsched_add_readytorun" returns "true" if context switch is required. "nxsched_add_readytorun"
typically could only switch the assigned/running task to the one which is passed in as parameter.
But this is not strictly guaranteed in SMP; if other CPUs tweak with affinities or priorities,
it may be possible that the running task after the call is changed, but is some other
task from the readytorun list (and it should be, if there is higher priority one available or the
affinity of the added task prevents it to be scheduled in, but the previous head of the readytorun
list should run.
this_task() is always the correct one to switch to, since it always points to the tcb which was
just switched in by the nxsched_add_readytorun.
This is also a precursor to re-writing the SMP queue logic to remove pending lists for SMP.
Signed-off-by: Jukka Laitinen <jukka.laitinen@tii.ae>
This patch is a rework of the NuttX file descriptor implementation. The
goal is two-fold:
1. Improve POSIX compliance. The old implementation tied file description
to inode only, not the file struct. POSIX however dictates otherwise.
2. Fix a bug with descriptor duplication (dup2() and dup3()). There is
an existing race condition with this POSIX API that currently results
in a kernel side crash.
The crash occurs when a partially open / closed file descriptor is
duplicated. The reason for the crash is that even if the descriptor is
closed, the file might still be in use by the kernel (due to e.g. ongoing
write to file). The open file data is changed by file_dup3() and this
causes a crash in the device / drivers themselves as they lose access to
the inode and private data.
The fix is done by separating struct file into file and file descriptor
structs. The file struct can live on even if the descriptor is closed,
fixing the crash. This also fixes the POSIX issue, as two descriptors
can now point to the same file.
Signed-off-by: Ville Juven <ville.juven@unikie.com>
Signed-off-by: dongjiuzhu1 <dongjiuzhu1@xiaomi.com>
For some SMP calls it is necessary to lock the current CPU for the process
receiving the SMP call. This is done by setting the CPU affinity to the
current CPU and preventing the CPU selection algorithm from switching
CPUs.
dtcb->flags |= TCB_FLAG_CPU_LOCKED;
CPU_SET(dtcb->cpu, &dtcb->affinity);
However, this logic is currently broken, as CPU_SET is defined as:
#define CPU_SET(c,s) do { *(s) |= (1u << (c)); } while (0)
In order to assign tcb->cpu (the current CPU) to the affinity mask, the
mask must be cleared first by calling CPU_ZERO.
test:
1.use mps3-an547 build helloxx as module and run it
2.use qemu-armv7a:knsh test kernel build helloxx and run it
Signed-off-by: anjiahao <anjiahao@xiaomi.com>
There is no need for a gettid() syscall, as the thread ID is stable through
the life of the process. It is safe to put a copy of TID to TLS. This way
a user processes can access TID quickly via its own stack, instead of
having to use an expensive syscall.
Signed-off-by: Ville Juven <ville.juven@unikie.com>
reason:
The old implementation of the SMP call, even when using the "no wait" parameter,
could still result in waiting, if invoking it within a critical section
may lead to deadlocks. Therefore, in order to implement a truly asynchronous SMP
call strategy, we have added nxsched_smp_call_async.
Signed-off-by: hujun5 <hujun5@xiaomi.com>
The comment about the CPU index remaining stable is incorrect. There is no
guarantee the task does not yield during the exit process, meaning the CPU
can most definitely change. Also, there is no reason why it should not be
allowed to change.
This fixes a full system crash during process exit when the CPU changes
and we query the current task from the old CPU.
after
text data bss dec hex filename
269732 51065 63335 384132 5dc84 nuttx
before
text data bss dec hex filename
269784 51065 63335 384184 5dcb8 nuttx
size -50
Signed-off-by: hujun5 <hujun5@xiaomi.com>
