mirror of
https://github.com/apache/nuttx.git
synced 2026-09-29 18:45:22 +00:00
43694933ce
The base firmware and an FDPIC module disagree about what a function pointer is. Firmware is not built FDPIC, so to it a pointer is a code address and it branches there. A module passes the address of a two word descriptor instead, because its code and data are placed independently and a bare code address would leave the callee unable to find its own data. A firmware routine that takes a callback therefore branches into the module's data segment and faults. So the ten entry points that can be handed a callback by a module resolve the descriptor before storing or branching to it: qsort, bsearch, pthread_create, signal, sigaction, task_create and task_create_with_stack, task_spawn, pthread_once, scandir, and mq_notify and timer_create with SIGEV_THREAD. Which one resolves matters as much as that one does. Resolving twice would take an already resolved code address for a descriptor and read two words from the instruction stream, so each pointer is resolved exactly once, at the outermost point that sees it. signal() passes its argument through untouched because sigaction() and then nxsig_action() will resolve it, which covers a module calling sigaction() directly as well. qsort() is split so that the public entry resolves and the recursive implementation does not. scandir() resolves its filter but not its comparison function, which it hands to qsort(). Whether a caller is a module at all is asked of the PIC base register, which up_initial_state() sets only for a task that has a D-Space. A plain kernel task therefore reads zero and is left alone. SIGEV_THREAD is the case the register cannot answer, because the callback runs later on a work queue worker that carries no module's base at all. The base is captured instead when the notification is registered, in the module's own context, and installed around the call. All of it is behind CONFIG_FDPIC, which defaults off. Built for mps3-an547:picostest both ways; with it off the entry points compile to what they were. Assisted-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Signed-off-by: Marco Casaroli <marco.casaroli@gmail.com> |
||
|---|---|---|
| .. | ||
| android | ||
| arpa | ||
| crypto | ||
| cxx | ||
| net | ||
| netinet | ||
| netpacket | ||
| nuttx | ||
| ssp | ||
| sys | ||
| .gitignore | ||
| aio.h | ||
| alloca.h | ||
| assert.h | ||
| byteswap.h | ||
| ctype.h | ||
| debug.h | ||
| dirent.h | ||
| dlfcn.h | ||
| dsp.h | ||
| dspb16.h | ||
| elf.h | ||
| elf32.h | ||
| elf64.h | ||
| endian.h | ||
| err.h | ||
| errno.h | ||
| execinfo.h | ||
| fcntl.h | ||
| fixedmath.h | ||
| fnmatch.h | ||
| ftw.h | ||
| gcov.h | ||
| getopt.h | ||
| glob.h | ||
| grp.h | ||
| hex2bin.h | ||
| iconv.h | ||
| ifaddrs.h | ||
| imx_container.h | ||
| inttypes.h | ||
| iso646.h | ||
| langinfo.h | ||
| libgen.h | ||
| libintl.h | ||
| limits.h | ||
| locale.h | ||
| lzf.h | ||
| malloc.h | ||
| mqueue.h | ||
| netdb.h | ||
| nl_types.h | ||
| nxflat.h | ||
| obstack.h | ||
| paths.h | ||
| poll.h | ||
| pthread.h | ||
| pty.h | ||
| pwd.h | ||
| regex.h | ||
| resolv.h | ||
| sched.h | ||
| search.h | ||
| semaphore.h | ||
| shadow.h | ||
| signal.h | ||
| spawn.h | ||
| stdbool.h | ||
| stddef.h | ||
| stdint.h | ||
| stdio.h | ||
| stdlib.h | ||
| stdnoreturn.h | ||
| string.h | ||
| strings.h | ||
| syscall.h | ||
| syslog.h | ||
| termios.h | ||
| threads.h | ||
| time.h | ||
| ulimit.h | ||
| unistd.h | ||
| utime.h | ||
| uuid.h | ||
| wait.h | ||
| wchar.h | ||
| wctype.h | ||