CV-Bowen opened a new pull request, #21147:
URL: https://github.com/apache/nuttx/pull/21147
## Summary
Three fixes in the rpmsg port uart driver:
- A frame that fails the length or CRC check at the END delimiter was
logged but still added to the ready queue, so the corrupted frame was
delivered to the endpoint callbacks. Garbage in the payload then made
callbacks follow wild pointers (seen as a heap-buffer-overflow under
AddressSanitizer in `rpmsg_rtc_ept_cb()`). Return the buffer to the
free queue instead.
- The reboot notifier wakes the peer before sending POWEROFF, and
`rpmsg_port_uart_staywake()` retries until the peer answers, so a
reboot or poweroff blocked forever once the peer was gone. Add
`rpmsg_port_uart_staywake_times()` and give up after 50 tries (about
5 seconds with the 100 ms wait per try) in the reboot notifier. Other
callers keep waiting without a limit.
- `rpuart->event.events` is `nxevent_mask_t` (unsigned long) but eight
`rpmsgdbg()` calls printed it with `%x`, so
`CONFIG_RPMSG_PORT_UART_DEBUG` did not build on 64-bit targets:
```
rpmsg_port_uart.c:250:16: error: format '%x' expects argument of type
'unsigned int', but argument 4 has type 'nxevent_mask_t' {aka 'long
unsigned int'} [-Werror=format=]
```
## Impact
Corrupted frames are dropped instead of being delivered. A reboot or
poweroff no longer hangs when the peer does not answer the wakeup. No
API or Kconfig change.
## Testing
Host: Ubuntu 22.04.5 LTS x86_64, QEMU version 10.2.1, sim: cc (Ubuntu
13.1.0-8ubuntu1~22.04) 13.1.0, qemu-armv8a: aarch64-none-elf-gcc (Arm GNU
Toolchain 12.2.Rel1 (Build arm-12.24)) 12.2.1 20221205
The qemu-armv8a server/proxy configurations bring up a port uart link
on /dev/ttyV0 (server2 <==> proxy2), so the `rpmsg ping all` cases below
run over it as well as over the virtio rpmsg device.
The debug build fix was checked by building qemu-armv8a:rpserver and
qemu-armv8a:rpproxy with `CONFIG_RPMSG_PORT_UART_DEBUG=y`: master fails
with the error above, this PR builds and boots.
Baseline (`test.sh`, cases: baseline.yaml):
- host: Ubuntu 22.04.5 LTS x86_64, QEMU version 10.2.1, sim: cc (Ubuntu
13.1.0-8ubuntu1~22.04) 13.1.0, qemu-armv8a: aarch64-none-elf-gcc (Arm GNU
Toolchain 12.2.Rel1 (Build arm-12.24)) 12.2.1 20221205
- tested: nuttx 7d8e01fc570 apps 1985c6667
- qemu-armv8a built with test-only overlay: disabled LIBC_ENVPATH
BINFMT_CHECKEXEC
- sim:rpserver + sim:rpproxy: PASS
- [x] `uname -a` (server)
- [x] `rpmsg dump all` (server)
- [x] `rpmsg ping all 10 1024 3 0` (server)
- [x] `uname -a` (proxy)
- [x] `rpmsg ping all 10 1024 3 0` (proxy)
- [x] `mount -t rpmsgfs -o cpu=server,fs=/proc /sp` (proxy)
- [x] `cat /sp/version` (proxy)
- [x] `rpmsg dump all` (proxy)
- qemu-armv8a:rpserver + qemu-armv8a:rpproxy: PASS
- [x] `uname -a` (server)
- [x] `uname -a` (proxy)
- [x] `rpmsg dump all` (server)
- [x] `rpmsg ping all 10 1024 3 0` (server)
- [x] `rpmsg ping all 10 1024 3 0` (proxy)
- [x] `mount -t rpmsgfs -o cpu=server,fs=/proc /sp` (proxy)
- [x] `cat /sp/version` (proxy)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
