mirror of
https://github.com/apache/nuttx.git
synced 2026-08-20 13:08:26 +00:00
Some checks are pending
MemBrowse Memory Report / changes-filter (push) Waiting to run
MemBrowse Memory Report / load-targets (push) Waiting to run
MemBrowse Memory Report / identical (push) Blocked by required conditions
MemBrowse Memory Report / analyze (push) Blocked by required conditions
A mutex records its holder as a task id in the low 31 bits of a word whose top bit means "someone is blocked on this". The id was stored without masking, so an id with its top bit set became a holder with the blocking bit raised. Task ids are normally small and positive, but not always. nxsched_gettid() reports -ESRCH for a context that no longer maps to a running task, and there is a window where that is exactly what the running context is: nxtask_exit() marks the next task ready to run while the dying task is still executing on its own stack, and only then releases the TCB. Freeing the group inside that release takes and drops the group's mutexes, so the lock stores 0xfffffffd and the unlock compares 0x7ffffffd, which are not equal. With assertions enabled the unlock trips its holder check, and every exit of a process that frees memory panics. In a kernel build that is every exit, so no program could be run twice, and running one at all took the shell down with it. Without assertions the failure is silent: the accidental blocking bit sends the unlock looking for a waiter that never existed. Encode the id the same way everywhere it is stored or compared, so that a lock and an unlock from one context agree whatever the id's sign. The masked forms of -1 and -2 would alias the "no holder" and "reset" values, but nxsched_gettid() yields only valid ids and -ESRCH. mm_lock() already sidesteps this window with a note that gettid() may return -ESRCH during a context switch; this gives the generic mutex the same footing rather than a second special case. Test case, on the EIC7700 EVB, which is a kernel build with assertions: nsh> hello Hello, World!! Before, that printed and then panicked in sem_post, taking the shell with it, every time. After, five runs in a row complete and the shell survives. ps over telnet still completes. Assisted-by: Claude:claude-opus-5 Signed-off-by: Justin Hammond <justin@dynam.ac>
174 lines
4.7 KiB
C
174 lines
4.7 KiB
C
/****************************************************************************
|
|
* libs/libc/semaphore/sem_trywait.c
|
|
*
|
|
* SPDX-License-Identifier: Apache-2.0
|
|
*
|
|
* Licensed to the Apache Software Foundation (ASF) under one or more
|
|
* contributor license agreements. See the NOTICE file distributed with
|
|
* this work for additional information regarding copyright ownership. The
|
|
* ASF licenses this file to you under the Apache License, Version 2.0 (the
|
|
* "License"); you may not use this file except in compliance with the
|
|
* License. You may obtain a copy of the License at
|
|
*
|
|
* http://www.apache.org/licenses/LICENSE-2.0
|
|
*
|
|
* Unless required by applicable law or agreed to in writing, software
|
|
* distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
|
* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
|
|
* License for the specific language governing permissions and limitations
|
|
* under the License.
|
|
*
|
|
****************************************************************************/
|
|
|
|
/****************************************************************************
|
|
* Included Files
|
|
****************************************************************************/
|
|
|
|
#include <nuttx/config.h>
|
|
|
|
#include <errno.h>
|
|
#include <assert.h>
|
|
#include <sched.h>
|
|
|
|
#include <nuttx/sched.h>
|
|
#include <nuttx/init.h>
|
|
#include <nuttx/semaphore.h>
|
|
#include <nuttx/atomic.h>
|
|
#include <nuttx/irq.h>
|
|
|
|
/****************************************************************************
|
|
* Public Functions
|
|
****************************************************************************/
|
|
|
|
/****************************************************************************
|
|
* Name: sem_trywait
|
|
*
|
|
* Description:
|
|
* This function locks the specified semaphore only if the semaphore is
|
|
* currently not locked. In either case, the call returns without
|
|
* blocking.
|
|
*
|
|
* Input Parameters:
|
|
* sem - the semaphore descriptor
|
|
*
|
|
* Returned Value:
|
|
* Zero (OK) on success or -1 (ERROR) if unsuccessful. If this function
|
|
* returns -1(ERROR), then the cause of the failure will be reported in
|
|
* errno variable as:
|
|
*
|
|
* EINVAL - Invalid attempt to get the semaphore
|
|
* EAGAIN - The semaphore is not available.
|
|
*
|
|
****************************************************************************/
|
|
|
|
int sem_trywait(FAR sem_t *sem)
|
|
{
|
|
int ret;
|
|
|
|
if (sem == NULL)
|
|
{
|
|
set_errno(EINVAL);
|
|
return ERROR;
|
|
}
|
|
|
|
/* Let nxsem_trywait do the real work */
|
|
|
|
ret = nxsem_trywait(sem);
|
|
if (ret < 0)
|
|
{
|
|
set_errno(-ret);
|
|
ret = ERROR;
|
|
}
|
|
|
|
return ret;
|
|
}
|
|
|
|
/****************************************************************************
|
|
* Name: nxsem_trywait
|
|
*
|
|
* Description:
|
|
* This function locks the specified semaphore only if the semaphore is
|
|
* currently not locked. In either case, the call returns without
|
|
* blocking.
|
|
*
|
|
* Input Parameters:
|
|
* sem - the semaphore descriptor
|
|
*
|
|
* Returned Value:
|
|
* This is an internal OS interface and should not be used by applications.
|
|
* It follows the NuttX internal error return policy: Zero (OK) is
|
|
* returned on success. A negated errno value is returned on failure.
|
|
* Possible returned errors:
|
|
*
|
|
* - EINVAL - Invalid attempt to get the semaphore
|
|
* - EAGAIN - The semaphore is not available.
|
|
*
|
|
****************************************************************************/
|
|
|
|
int nxsem_trywait(FAR sem_t *sem)
|
|
{
|
|
bool fastpath = true;
|
|
bool mutex;
|
|
|
|
DEBUGASSERT(sem != NULL);
|
|
|
|
/* This API should not be called from the idleloop or interrupt */
|
|
|
|
#if defined(CONFIG_BUILD_FLAT) || defined(__KERNEL__)
|
|
DEBUGASSERT(!OSINIT_IDLELOOP() || !sched_idletask() ||
|
|
up_interrupt_context());
|
|
#endif
|
|
|
|
mutex = NXSEM_IS_MUTEX(sem);
|
|
|
|
/* Disable fast path if priority protection is enabled on the semaphore */
|
|
|
|
#ifdef CONFIG_PRIORITY_PROTECT
|
|
if ((sem->flags & SEM_PRIO_MASK) == SEM_PRIO_PROTECT)
|
|
{
|
|
fastpath = false;
|
|
}
|
|
#endif
|
|
|
|
/* Disable fast path on a counting semaphore with priority inheritance */
|
|
|
|
#ifdef CONFIG_PRIORITY_INHERITANCE
|
|
if (!mutex && (sem->flags & SEM_PRIO_MASK) != SEM_PRIO_NONE)
|
|
{
|
|
fastpath = false;
|
|
}
|
|
#endif
|
|
|
|
while (fastpath)
|
|
{
|
|
FAR atomic_t *val = mutex ? NXSEM_MHOLDER(sem) : NXSEM_COUNT(sem);
|
|
int32_t old = atomic_read(val);
|
|
int32_t new;
|
|
|
|
if (mutex)
|
|
{
|
|
if (old != NXSEM_NO_MHOLDER)
|
|
{
|
|
return -EAGAIN;
|
|
}
|
|
|
|
new = NXSEM_MAKE_MHOLDER(_SCHED_GETTID());
|
|
}
|
|
else
|
|
{
|
|
if (old < 1)
|
|
{
|
|
return -EAGAIN;
|
|
}
|
|
|
|
new = old - 1;
|
|
}
|
|
|
|
if (atomic_try_cmpxchg_acquire(val, &old, new))
|
|
{
|
|
return OK;
|
|
}
|
|
}
|
|
|
|
return nxsem_trywait_slow(sem);
|
|
}
|