1. revert 4946904, This patch is to solve the crash problem caused by reboot operation. The phenomenon is: when reboot operation is executed, the system will call binder_flush, which will cause the use after free to be called when proc is destroyed.
2. Now, we can rename BIOC_FLUSH to BINDER_FLUSH to avoid system call binder_flush.
3. why revert 4946904, because when we set looper_need_return in advance, it will cause the child thread of the binder thread pool to be unable to exit when it really wants to exit.
Signed-off-by: cuiziwei <cuiziwei@xiaomi.com>
Add noinstrument_function attribute to up_perf_gettime and its helper
functions (like cp15_pmu_rdccr) across all architectures. These functions
are called by perf_gettime which is used in the instrument callback path,
and must not be instrumented to avoid infinite recursion when
CONFIG_ARCH_INSTRUMENT_ALL is enabled.
Signed-off-by: yezhonghui <yezhonghui@xiaomi.com>
When CONFIG_ARCH_INSTRUMENT_ALL is enabled, the note driver functions
get instrumented, which causes infinite recursion because
sched_note_event_ip is called by __cyg_profile_func_enter/exit callbacks.
Use nuttx_add_aux_library to create a separate object library with
-fno-instrument-functions flag to prevent this recursion.
Signed-off-by: yezhonghui <yezhonghui@xiaomi.com>
Add a work queue call in goldfish_battery_register() to trigger an initial
battery state update immediately after driver initialization.
Previously, the battery state was only updated when a interrupt occurred.
This could cause the battery_state uORB topic to have no data
available during early boot, leading to failures when applications tried
to read battery information via orb_copy().
Signed-off-by: chenzihan1 <chenzihan1@xiaomi.com>
Fix two issues:
1. gnss_close: Fix missing '%' before PRIu8 in sminfo format string
2. gnss_unregister: Add missing nxmutex_destroy for upper->lock
and upper->bufferlock to prevent mutex resource leaks
Signed-off-by: wangjianyu3 <wangjianyu3@xiaomi.com>
Commit 29d1b2a342b removed the compile-time static disable of
g_default_channel sc_state, expecting DFX to handle it at runtime
via SYSLOGIOC_SETFILTER. However, before DFX initializes, the
channel remains enabled (sc_state = 0), violating the PANIC_ONLY
semantic that the default channel should only output during panic.
Restore the initial SYSLOG_CHANNEL_DISABLE in g_default_channel
when CONFIG_SYSLOG_DEFAULT_PANIC_ONLY is enabled, using the proper
bitmask instead of the previous bare `true`.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: xuxingliang <xuxingliang@xiaomi.com>
This reverts commit a14f0514f3bf930cdf9f6a4b63d60ec8e0d5ddeb.
Reason for revert: revert type warning process
Signed-off-by: zhangyu117 <zhangyu117@xiaomi.com>
Remove the compile-time static disable of the default syslog channel
(sc_state = true) since DFX now handles disabling dynamically at
runtime via SYSLOGIOC_SETFILTER ioctl. Fix the panic notifier to use
proper bitmask operation instead of clearing all state bits. Update
Kconfig help text to reflect the new runtime behavior.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: xuxingliang <xuxingliang@xiaomi.com>
The original pl011_putc() busy-waits for the TX FIFO to drain
without any lock protection. On SMP this allows two CPUs to race
past the TXFF check simultaneously and write DR into a full FIFO,
losing characters.
More critically, because pl011_putc holds no lock while other paths
(pl011_txint, pl011_rxint) do hold sport->lock when they
read-modify-write the IMSC register, the unprotected pl011_putc
creates a window where concurrent IMSC updates from the interrupt
call-back chain can clobber each other, resulting in IMSC being
zeroed. Once IMSC == 0 the UART stops generating interrupts and
RX input is lost while TX (polled via putc) continues to work.
Fix by using a try-lock loop in pl011_putc: take sport->lock,
check TXFF, if not full write DR and release; if full release
immediately and retry. This ensures the TXFF check and DR write
are atomic while never busy-waiting with the lock held, so the
interrupt path and other CPUs can always make progress.
Signed-off-by: guanyi3 <guanyi3@xiaomi.com>
up_putc() uses disableuartint/restoreuartint to temporarily suppress
all UART interrupts while doing polled TX output. This includes
clearing CTRL.RX_INT_ENABLE.
On the CMSDK APB UART, the hardware only sets INTSTATUS_RX when a
character is received AND RX_INT_ENABLE is asserted at that moment.
If a character arrives during the window where up_putc() has cleared
RX_INT_ENABLE, the UART latches RX_BUF_FULL in STATE but does NOT
set INTSTATUS_RX. When restoreuartint() re-enables RX_INT_ENABLE
the interrupt is never generated, so the byte stays in the single-
entry holding register forever. Because RX_BUF_FULL blocks further
reception, the UART is permanently stalled — no more RX interrupts
fire, and if the console reader task blocks on input the TX path
stalls as well.
Fix this by having up_putc() only disable/restore the TX-side
interrupt enables (TX_INT_ENABLE and TX_OVERRUN_INT_ENABLE). Polled
character transmission has no need to suppress RX interrupts, so
leaving them enabled closes the race window entirely.
Signed-off-by: ligd <liguiding1@xiaomi.com>
Problem:
The pm_wakelock_init() was called after rpmsg_queue_work() in rpmsg_virtio_probe(), which creates a race condition. The worker thread (rpmsg_virtio_start_worker) may start executing and access priv->wakelock through rpmsg_virtio_pm_action() before the wakelock is properly initialized.
This race leads to anomalous wakelock behavior where:
- The wakelock count becomes inconsistent (e.g., count=0 when it should be non-zero)
- The wakelock node remains in the PM domain queue (dq) even when count=0, violating the invariant that count=0 implies removal from the queue
Root Cause:
Call chain when worker starts before wakelock init:
rpmsg_virtio_start_worker()
-> rpmsg_init_vdev_with_config()
-> rpmsg_virtio_rx_dispatch()
-> rpmsg_virtio_tx_notify() (via callback)
-> rpmsg_virtio_pm_action()
-> pm_wakelock_stay(&priv->wakelock) // UNINITIALIZED!
Solution:
Move pm_wakelock_init() before rpmsg_queue_work() to ensure the wakelock is fully initialized before the worker thread can access it.
Impact:
Fixes PM wakelock corruption that prevented proper power management state transitions and could lead to system staying awake unnecessarily or entering low-power states prematurely.
Signed-off-by: guanyi3 <guanyi3@xiaomi.com>
To avoid the carsh log is too large to casue part of the crash log
is missed when flush the rpmsg syslog buffer.
Signed-off-by: Bowen Wang <wangbowen6@xiaomi.com>
The CMSDK UART has only a 1-byte receive buffer with no FIFO.
During boot, uart_cmsdk_setup() enables RX (CTRL.RX_EN) but the
RX interrupt (CTRL.RX_INTEN) is not enabled until later when
uart_cmsdk_rxint(enable=true) is called.
If a character arrives in this window, the hardware sets RXFULL
but does not set INTSTATUS.RX (because RX_INTEN is still off).
Once RXFULL is stuck at 1, the UART refuses to accept any new
characters and RX is permanently stalled. Enabling RX_INTEN
afterwards does not retroactively generate the missed interrupt.
Fix this by checking rxavailable() right after enabling the RX
interrupt. If data is already present, call uart_recvchars() to
drain it immediately, clearing RXFULL so the UART can receive
new characters again.
Also add proper spinlock protection that was missing from rxint().
Signed-off-by: ligd <liguiding1@xiaomi.com>
nuttx/drivers/serial/uart_gsmmux.c:369:15: error: format '%ld' expects argument of type 'long int', but argument 4 has type 'int' [-Werror=format=]
nuttx/drivers/serial/uart_gsmmux.c:406:15: error: format '%ld' expects argument of type 'long int', but argument 4 has type 'int' [-Werror=format=]
Signed-off-by: buxiasen <buxiasen@xiaomi.com>
Fix signal write break the mutex.
Need nopreempt as there is post and cause possible recursive in diff
threads.
Avoid the circbuf_uninit/free cause lock/sched_switch, unlock before
free should prefer.
The resize possible do malloc/free cause break rspinlock, need do
malloc/free with pipe unlocked.
Signed-off-by: buxiasen <buxiasen@xiaomi.com>
usbhost/usbhost_xhci_pci.c:4438:16: error: cast to pointer from integer of different size [-Werror=int-to-pointer-cast]
Signed-off-by: yangsong8 <yangsong8@xiaomi.com>
Add detailed logging to improve debugging of rptun reset scenarios:
- Log reset reason when remote core triggers a reset
- Log reset reason in both driver-specific and default reset paths
- Minor formatting cleanup for existing panic log
This helps diagnose remote processor failures by capturing the reset
cause and CPU name in emergency logs.
Signed-off-by: Bowen Wang <wangbowen6@xiaomi.com>
If user received signal when waiting command to complete, the driver
will quit the waiting and release the sem, then the complete callback
will post on a freed sem.
Signed-off-by: Zhe Weng <wengzhe@xiaomi.com>
- Change mm_initialize_heap and mm_initialize_pool to return int (0 on success, <0 on error),
and return the heap pointer via the first argument (struct mm_heap_s **heap_out).
- Update all callers to use the new interface
- This improves error handling and avoids confusion with pointer return values.
Signed-off-by: ligd <liguiding1@xiaomi.com>
The THERMAL_CRITICAL trip point can trigger aggressive thermal actions
like system shutdown. Change the 90 trip point from THERMAL_CRITICAL
to THERMAL_HOT to allow more graceful thermal management and avoid
unexpected system behavior.
Signed-off-by: ligd <liguiding1@xiaomi.com>
When /dev/log is opened with O_DIRECT flag, writes bypass the syslog
stream and call up_nputs() directly for lower-latency console output.
This is useful for performance-critical logging scenarios where the
overhead of syslog stream processing is undesirable.
Implementation:
- Add open handler to detect O_DIRECT flag and store state in f_priv
- Modify write handler to route based on O_DIRECT mode:
- O_DIRECT set: call up_nputs() directly
- O_DIRECT not set: use lib_syslograwstream (existing behavior)
Backward compatibility is maintained - default behavior unchanged
when O_DIRECT is not used
Signed-off-by: xuxingliang <xuxingliang@xiaomi.com>
unregister_driver() will call pty_unlink(), which may call
pty_destroy() to free devpair if pp_nopen == 0. So we must return
here directly to avoid use-after-free
Adjust the order in which minor are released, unregistering the driver
first to avoid race conditions.
Signed-off-by: yangsong8 <yangsong8@xiaomi.com>
On devices with large program sizes, due to byte
alignment requirements, there may be insufficient
space utilization in the ate space
Signed-off-by: zhaoxingyu1 <zhaoxingyu1@xiaomi.com>
The USB CDCACM has not yet been successfully recognized at this
point, and executing `file_open` will return an error.
Signed-off-by: yangsong8 <yangsong8@xiaomi.com>
rootcause:
use stack mem to init rtc_time in up_rtc_getdatetime_with_subseconds without initialize to zero,
depends on rdtime function to init rtctime, may lead to same bug for different rdtime implement.
init local variable to zero to avoid this bug
Signed-off-by: huojianchao <huojianchao@xiaomi.com>
wangjianyu3