| Age | Commit message (Collapse) | Author |
|---|
|
This was reverted because a NetX Secure regression test segfaulted with it
in place. The cause was the test: it hands the certificate verify path a
stack-local certificate whose signature it never assigns, and this change
moves the stack layout that decides whether the unassigned slot reads null
or a readable leftover. That test has been fixed, so the retry comes back.
Measured with the test unfixed and this change in place, on a layout built
without the stack protector: eight of eight runs segfault, the fault read
from the faulting process as a null signature dereferenced by the ECDSA
verify. With the test fixed, nineteen build configurations run it eight
times each with no fault.
Without this change, a thread signalled into the port's suspend handler
never returns to the contended-mutex loop, the next unlock's wake-up is
lost, the scheduler is left parked, and the timer interrupt never runs --
which stalls the tick and hangs about 0.39% of instances of a few TCP
tests for their full timeout.
|
|
The backport fixes a real deadlock and is right in itself, but on this branch it
reproducibly breaks the NetX Duo nx_secure suite: nx_secure_tls_coverage_test
segfaults in 8 of 19 configurations on one run and 9 of 19 on a re-run of the same
commit, against four consecutive runs with none before it.
Whether the retry causes that or merely exposes something latent is not known. The
first guess, a kernel object outliving its stack frame, is wrong: that test's
sessions are file scope and its creates and deletes balance. The deadlock the
retry cures costs one configuration's coverage data at roughly 0.4% of test
instances, which the union absorbs, so the branch is measurably worse with it than
without while the interaction is unexplained.
This is a deferral, not a dismissal. The diagnosis stands, the reproduction is
recorded, and re-applying is one cherry-pick. The upstream fix is unaffected.
This reverts commit ac95c32c.
Assisted-by: Claude Code (Opus 5) <[email protected]>
|
|
The port suspends a thread with a signal whose handler calls sigsuspend and does
not return until resumed, and takes its critical section with a bare
pthread_mutex_lock. A thread signalled while parked on _tx_linux_mutex never
returns to glibc's contended-mutex loop, so the next unlock's wake-up goes to a
thread that will not act on it and every other waiter is left parked on a mutex
that is free.
tx_linux_mutex_lock now calls a helper that waits with pthread_mutex_timedlock and
retries every TX_LINUX_MUTEX_RETRY_NSEC, one millisecond, so a lost wake-up costs a
retry period instead of the process.
The original fix was made by inspection, on a port never observed to deadlock. It
has now been observed. A stalled regression test reads the mutex free, owner zero,
with the scheduler still on its futex word; it never posts _tx_linux_isr_semaphore,
the timer thread never returns from _tx_thread_context_restore, and the simulated
clock stops. Bounding a wait cannot save it: one capture held 116 ticks of timeout
unchanged across 40 seconds.
Measured on netx_tcp_overlapping_packet_test_10, six workers on four pinned CPUs:
5 stalls in 1,266 runs before, 0 in 2,034 after, three held frozen through 60
seconds of untraced /proc sampling. netxduo/default_build_coverage is unmoved at
914/914, 121 skipped, 497 files, 11230/11256 lines and 6912/6925 branches.
(cherry picked from commit b567428f2a826fa24e78fc82f6a5dd46a87b079c)
Assisted-by: Claude Code (Opus 5) <[email protected]>
|
|
The byte allocate saves the time stamp of its own trace entry and comes back to
fill in the address it allocated, unless a later event overwrote the entry
meanwhile. Interrupts are off across all of the service but the pool search, and
nothing in the kernel writes a trace event in that gap, so the other arm never
ran.
The Linux port already calls out to the harness inside that gap:
TX_BYTE_ALLOCATE_EXTENSION exists for coverage work and sits between the restore
and the disable that bracket the search. It gains a second clause, under its own
flag, calling a routine the harness declares weakly. A new test filters the byte
pool event class so the allocate's own insert writes nothing and leaves the
buffer parked on the saved entry, then has the hook write a user event, which
lands on exactly that entry. Neither half reaches the arm alone.
One configuration cannot take it at all, and that is a property of the port
rather than of the test: under TX_MISRA_ENABLE the trace time stamp comes from a
function whose body returns zero, so every entry reads zero and the comparison
is 0 == 0 whatever overwrites it. The test drives the overwrite there too and
asserts the consequence only where the time source is real.
805/805 in each of the seven configurations. Union coverage is 4383/4383 lines
and 3150/3170 branches against 3147/3168; the denominator gains the new clause's
two outcomes and both are covered. Gate raised to 99.30.
Assisted-by: Claude Code (Opus 5) <[email protected]>
|
|
performs misaligned ULONG accesses
The Linux, Win32 and SMP Linux simulation ports build a fake initial stack pointer
by subtracting a fixed 8 bytes from tx_thread_stack_end. That field addresses the
last byte of the thread's stack area, so it is one less than an aligned address and
the resulting pointer is misaligned by construction, however well aligned the stack
the application supplied was.
Two ULONG accesses then use that pointer. _tx_thread_stack_build() itself clears the
word below it, and _tx_thread_create() copies it into tx_thread_stack_highest_ptr,
which TX_THREAD_STACK_CHECK dereferences on every suspend and resume when
TX_ENABLE_STACK_CHECKING is defined. Both are undefined behaviour. They happen to
work on x86 and are reported by GCC's undefined behaviour sanitizer.
The fake stack pointer is now rounded down to a ULONG boundary, which leaves it
inside the stack area and makes both accesses aligned.
This is a backport of the same fix from the development branch. It differs from that
version in one respect: the conversions are written inline rather than through
TX_POINTER_TO_ALIGN_TYPE_CONVERT and TX_ALIGN_TYPE_TO_POINTER_CONVERT, because
tx_api.h defines those two macros only in its non-MISRA branch and the port therefore
does not compile with TX_MISRA_ENABLE defined. That defect is reported upstream as
issue #741. Substituting the ULONG conversion pair would not be equivalent: ALIGN_TYPE
is 64-bit on __x86_64__ while ULONG is 32-bit, so a ULONG round trip would truncate
the pointer.
No certified source is touched, and coverage is unchanged: 4314/4339 lines and
4546/4627 branches merged over the six build configurations, identical line for line
and branch for branch to the measurement before this change. 107 of 107 tests pass in
each of the six.
Assisted-by: Claude Code (Opus 5) <[email protected]>
|
|
|
|
|
|
|
|
|
|
* Add error handling in lock initialization.
* Update release data and version.
|
|
* Update version number in API header
* Update release date and version
|
|
* Added thumb mode support for threadX GNU ports on armv7a platforms.
https://msazure.visualstudio.com/One/_workitems/edit/26105175/
* move the swi interrupt to tx_initialize_low_level.S.
* update the test log.
|
|
|
|
tool in cortex-A5 GNU port (#306)
https://msazure.visualstudio.com/One/_workitems/edit/25153813/
|
|
tool in cortex-A9 GNU port. (#303)
https://msazure.visualstudio.com/One/_workitems/edit/25153785/
|
|
tool in cortex-A8 GNU port. (#302)
https://msazure.visualstudio.com/One/_workitems/edit/25139203/
|
|
* Fixed the issue of the data/bss section cannot be read from ARM FVP debug tool in cortex-A7 GNU port.
https://msazure.visualstudio.com/One/_workitems/edit/24597276/
* remove untracked files.
|
|
* Unify ThreadX and SMP for ARMv8-A.
* Fix path in pipeline to check ports arch.
* Add ignore folders for ARM DS
* Generate ThreadX and SMP ports for ARMv8-A.
* Ignore untracked files for ports_arch check.
* Use arch instead of CPU to simplify the project management.
|
|
|
|
|
|
* Include tx_user.h in ARMv7-M IAR port
* Include tx_user.h in ARMv7-M AC5 port
* Include tx_user.h in cortex_m3/4/7 IAR and AC5 port
|
|
files (#250)
* Release ARMv7-A architecture ports
* Add tx_user.h to GNU port assembly files
* Update GitHub action to perform check for Cortex-A ports
|
|
af5702cbf Include tx_user.h only when TX_INCLUDE_USER_DEFINE_FILE is defined for assembly files
|
|
cee19603d Include tx_user.h conditionally.
e40e08007 Update owners
d69641273 Update release date and version
394aee52f Add tx_user.h to GNU port assembly files
5cca2ddd0 RISC-V 64 bit port for Microchip
e0f2c373c Link Winmm.lib that required by the high-resolution timer.
6af472a68 Update Win32 port with high resolution timer.
aea7b556a Add DMB ISH barrier inst in ARMv8-A SMP scheduler
19091a262 Add .section .preamble to m3 m4 m7 module ports
ced60e1b7 Add missing parenthesis in ports assembly file
309dc77ca Modules Cortex-A7 IAR new port
c752a4063 Modules Cortex-A7 GNU new port
dc224b90f Fix race condition in tx_thread_wait_abort and update regression test
6e261f5b7 create threadx cmsis-pack
|
|
9c3acb6ce armv8-m compile time FPU fix
37daa35e7 added tx_trace.h include to module stop.c
39824289f Remove internal deprecated files.
fe2f80f43 Add a notice for not released file.
7fdd3782a Upgrade to the latest Container Images.
|
|
b5d5df511 #include tx_user.h in assembly files for cortex-m ports
33e04e3d5 initial port of MIPS SMP for GHS and GNU
2eda2c17d capitalize extensions for M23 asm files
21c354ccb Fix armv7-m MPU settings for corner case, unify txm_module_port.h files
4a1ff93f9 remove uneeded include for ac6
c823e91ff update riscv iar example for latest iar tools
5559d185d check module stack for overlap (not kernel stack)
efa9ce7b7 apply patch from mobileye to fix time slice processing
75fdcb722 Updated copy_armv7_cm.yml
de04b9904 initialize unused MPU settings so that aliasing will work
79b317b60 add config directory to IAR RISC-V port in order to use simulator
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
control defines, and added missing thread preemption logic.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
check link error
|
|
|
|
|
|
|
