| Age | Commit message (Collapse) | Author |
|---|
|
This was reverted because a NetX Secure regression test segfaulted with it
in place. The cause was the test: it hands the certificate verify path a
stack-local certificate whose signature it never assigns, and this change
moves the stack layout that decides whether the unassigned slot reads null
or a readable leftover. That test has been fixed, so the retry comes back.
Measured with the test unfixed and this change in place, on a layout built
without the stack protector: eight of eight runs segfault, the fault read
from the faulting process as a null signature dereferenced by the ECDSA
verify. With the test fixed, nineteen build configurations run it eight
times each with no fault.
Without this change, a thread signalled into the port's suspend handler
never returns to the contended-mutex loop, the next unlock's wake-up is
lost, the scheduler is left parked, and the timer interrupt never runs --
which stalls the tick and hangs about 0.39% of instances of a few TCP
tests for their full timeout.
|
|
The backport fixes a real deadlock and is right in itself, but on this branch it
reproducibly breaks the NetX Duo nx_secure suite: nx_secure_tls_coverage_test
segfaults in 8 of 19 configurations on one run and 9 of 19 on a re-run of the same
commit, against four consecutive runs with none before it.
Whether the retry causes that or merely exposes something latent is not known. The
first guess, a kernel object outliving its stack frame, is wrong: that test's
sessions are file scope and its creates and deletes balance. The deadlock the
retry cures costs one configuration's coverage data at roughly 0.4% of test
instances, which the union absorbs, so the branch is measurably worse with it than
without while the interaction is unexplained.
This is a deferral, not a dismissal. The diagnosis stands, the reproduction is
recorded, and re-applying is one cherry-pick. The upstream fix is unaffected.
This reverts commit ac95c32c.
Assisted-by: Claude Code (Opus 5) <[email protected]>
|
|
The port suspends a thread with a signal whose handler calls sigsuspend and does
not return until resumed, and takes its critical section with a bare
pthread_mutex_lock. A thread signalled while parked on _tx_linux_mutex never
returns to glibc's contended-mutex loop, so the next unlock's wake-up goes to a
thread that will not act on it and every other waiter is left parked on a mutex
that is free.
tx_linux_mutex_lock now calls a helper that waits with pthread_mutex_timedlock and
retries every TX_LINUX_MUTEX_RETRY_NSEC, one millisecond, so a lost wake-up costs a
retry period instead of the process.
The original fix was made by inspection, on a port never observed to deadlock. It
has now been observed. A stalled regression test reads the mutex free, owner zero,
with the scheduler still on its futex word; it never posts _tx_linux_isr_semaphore,
the timer thread never returns from _tx_thread_context_restore, and the simulated
clock stops. Bounding a wait cannot save it: one capture held 116 ticks of timeout
unchanged across 40 seconds.
Measured on netx_tcp_overlapping_packet_test_10, six workers on four pinned CPUs:
5 stalls in 1,266 runs before, 0 in 2,034 after, three held frozen through 60
seconds of untraced /proc sampling. netxduo/default_build_coverage is unmoved at
914/914, 121 skipped, 497 files, 11230/11256 lines and 6912/6925 branches.
(cherry picked from commit b567428f2a826fa24e78fc82f6a5dd46a87b079c)
Assisted-by: Claude Code (Opus 5) <[email protected]>
|
|
The byte allocate saves the time stamp of its own trace entry and comes back to
fill in the address it allocated, unless a later event overwrote the entry
meanwhile. Interrupts are off across all of the service but the pool search, and
nothing in the kernel writes a trace event in that gap, so the other arm never
ran.
The Linux port already calls out to the harness inside that gap:
TX_BYTE_ALLOCATE_EXTENSION exists for coverage work and sits between the restore
and the disable that bracket the search. It gains a second clause, under its own
flag, calling a routine the harness declares weakly. A new test filters the byte
pool event class so the allocate's own insert writes nothing and leaves the
buffer parked on the saved entry, then has the hook write a user event, which
lands on exactly that entry. Neither half reaches the arm alone.
One configuration cannot take it at all, and that is a property of the port
rather than of the test: under TX_MISRA_ENABLE the trace time stamp comes from a
function whose body returns zero, so every entry reads zero and the comparison
is 0 == 0 whatever overwrites it. The test drives the overwrite there too and
asserts the consequence only where the time source is real.
805/805 in each of the seven configurations. Union coverage is 4383/4383 lines
and 3150/3170 branches against 3147/3168; the denominator gains the new clause's
two outcomes and both are covered. Gate raised to 99.30.
Assisted-by: Claude Code (Opus 5) <[email protected]>
|
|
|
|
|
|
* Update version number in API header
* Update release date and version
|
|
|
|
|
|
cee19603d Include tx_user.h conditionally.
e40e08007 Update owners
d69641273 Update release date and version
394aee52f Add tx_user.h to GNU port assembly files
5cca2ddd0 RISC-V 64 bit port for Microchip
e0f2c373c Link Winmm.lib that required by the high-resolution timer.
6af472a68 Update Win32 port with high resolution timer.
aea7b556a Add DMB ISH barrier inst in ARMv8-A SMP scheduler
19091a262 Add .section .preamble to m3 m4 m7 module ports
ced60e1b7 Add missing parenthesis in ports assembly file
309dc77ca Modules Cortex-A7 IAR new port
c752a4063 Modules Cortex-A7 GNU new port
dc224b90f Fix race condition in tx_thread_wait_abort and update regression test
6e261f5b7 create threadx cmsis-pack
|
|
|
|
|
|
|
|
|
|
|
|
|
