posix: implement POSIX semaphore interfaces - #457
Conversation
Summary of ChangesHello @oI0ck, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request introduces comprehensive support for POSIX standard semaphore interfaces within the Highlights
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This PR introduces POSIX semaphore implementation. The changes are extensive, adding new headers and implementation files for named and unnamed semaphores. The overall structure is good, but I've found several critical issues in the implementation, including race conditions, incorrect logic leading to deadlocks, and potential memory corruption. There are also some areas where the code can be simplified and made more robust. Please address the critical issues before merging.
ba94ea8 to
da0f0fd
Compare
Unit Test Results12 396 tests 11 618 ✅ 55m 25s ⏱️ For more details on these failures, see this check. Results for commit 169a290. ♻️ This comment has been updated with latest results. |
da0f0fd to
b6d1928
Compare
b6d1928 to
20f142f
Compare
|
|
||
| #define SEM_FAILED ((sem_t *)0xDAAB0000) | ||
|
|
||
| typedef struct _sem_t { |
There was a problem hiding this comment.
_sem_t identifier is not used anywhere. If it's not required by POSIX - remove it.
cf48092 to
f3710e3
Compare
| #define SEMCTL_PATH ("/dev/posix/semctl") | ||
| #define SEMAPHORE_MAX_COUNT (128) | ||
| #define SEMAPHORE_NAME_MAX (NAME_MAX - sizeof(SEMAPHORE_PATH) - 1) | ||
| #define SEM_VALUE_MAX INT_MAX |
There was a problem hiding this comment.
-
I think this should be defined per-architecture in libphoenix/include/arch/*/limits.h (like
NAME_MAX). It can be just#define SEM_VALUE_MAX INT_MAX, but the important part is that the definition should be available via limits.h. -
Is
SEMAPHORE_MAX_COUNTused anywhere? Is should beSEM_NSEMS_MAXand defined in limits.h like in the point above. Please actually enforce the limit. Note that_POSIX_SEM_NSEMS_MAX == 256which is the minimum value for this limit. -
See
sysconf(). You could implement_SC_SEM_VALUE_MAXand_SC_SEM_NSEMS_MAX. -
Also, this is a good place to static-assert
SEM_VALUE_MAXwith_POSIX_SEM_VALUE_MAXandSEM_NSEMS_MAXwith_POSIX_SEM_NSEMS_MAXin case someone changes limits.h incorrectly. Maybe also check whether the limit does not exceed the semaphore value type size (unsigned int).
| else { | ||
| } | ||
|
|
||
| sem = (sem_t *)malloc(sizeof(*sem)); |
23e321c to
057606b
Compare
|
CI shows problems with this change, I'm converting it to a draft until I am sure that it is in mergable state. |
070fbcb to
67a05ba
Compare
959032f to
8e8cc43
Compare
a3396ff to
74bdc2c
Compare
| if (strcmp(name, dent->d_name) == 0) { | ||
| strcpy(path, SEMAPHORE_PATH); | ||
| strncpy(path + strlen(SEMAPHORE_PATH), dent->d_name, PATH_MAX - strlen(SEMAPHORE_PATH)); | ||
| lookup(path, NULL, &oid); |
There was a problem hiding this comment.
lookup could have failed here, leading to uninitialized dev oid
There was a problem hiding this comment.
Right, I got TOCTOU'd, nice catch.
| #include <sys/threads.h> | ||
| #include <sys/semaphore.h> | ||
|
|
||
| #define SEM_FAILED ((sem_t *)0xDAAB0000) |
There was a problem hiding this comment.
why this value in particular?
There was a problem hiding this comment.
are you sure this cannot be an allocated address on any of our targets?
|
|
||
| dirp = opendir(SEMAPHORE_PATH); | ||
| if (dirp == NULL) { | ||
| /* posixsrv has yet not initialized the semaphore subsystem */ |
| return SEM_FAILED; | ||
| } | ||
|
|
||
| sem = (sem_t *)malloc(sizeof(*sem)); |
There was a problem hiding this comment.
nitpick: unnecessary cast
| unsigned int value = 0; | ||
| sem_t *sem; | ||
|
|
||
| (void)mode; |
There was a problem hiding this comment.
does POSIX not enforce passing mode along? or we just don't want to handle it for now? in the second case, add a TODO here.
There was a problem hiding this comment.
create_dev() does not take a mode parameter, there is a TODO in there to add it. Devices are created by default with 0666 mode.
I can leave a comment and revisit this after this in another PR.
| if (sem->type == smNamed) { | ||
| msg.type = mtClose; | ||
| msg.oid = sem->named; | ||
| ret = msgSend(sem->named.port, &msg); |
There was a problem hiding this comment.
if (ret == 0) ret = msg.o.err probably
|
|
||
| new.type = smUnnamed; | ||
| ret = semaphoreCreate(&new.unnamed, value); | ||
| *sem = new; |
There was a problem hiding this comment.
nitpick: this is set unconditionally. What is semaphoreCreate failed?
There was a problem hiding this comment.
Will change this to returning -ENOSPC if semaphoreCreate() fails. Seems like the most appropriate errno that is compilant with POSIX.
| if (ret == EOK) { | ||
| msg.type = mtDestroy; | ||
| msg.oid = oid; | ||
| ret = msgSend(oid.port, &msg); |
There was a problem hiding this comment.
if (ret == 0) ret = msg.o.err probably
| if (path == NULL) { | ||
| errno = EINVAL; | ||
| return; | ||
| } | ||
|
|
||
| slash = strrchr(path, '/'); | ||
|
|
||
| if (slash == NULL) { | ||
| *dir = "."; | ||
| *base = path; | ||
| if (dir != NULL) { | ||
| *dir = "."; | ||
| } | ||
|
|
||
| if (base != NULL) { | ||
| *base = path; | ||
| } | ||
| } | ||
| else if (slash == path) { | ||
| *base = path + 1; | ||
| *dir = "/"; | ||
| if (base != NULL) { | ||
| *base = path + 1; | ||
| } | ||
|
|
||
| if (dir != NULL) { | ||
| *dir = "/"; | ||
| } | ||
| } | ||
| else { | ||
| *dir = path; | ||
| *base = slash + 1; | ||
| if (dir != NULL) { | ||
| *dir = path; | ||
| } | ||
|
|
||
| if (base != NULL) { | ||
| *base = slash + 1; |
There was a problem hiding this comment.
I wanted to make dir and base optional if you only want one of these. Since now I use destroy_dev(), I can drop this commit
There was a problem hiding this comment.
I'd drop it since it somewhat obfuscates the function, but that's not a bad idea IMO
| if (path == NULL) { | ||
| errno = EINVAL; | ||
| return; | ||
| } | ||
|
|
There was a problem hiding this comment.
this seems especially wrong as now we could silently change errno but return 0 (from the calling function).
| break; | ||
| } | ||
|
|
||
| if (strcmp(name, dent->d_name) == 0) { |
There was a problem hiding this comment.
Leading / is not stripped from name as it in semaphore_create() from phoenix-rtos-posixsrv.
0fcb1c0 to
78ea982
Compare
| timeout -= now; | ||
|
|
||
| if (timeout < 0) { | ||
| return SET_ERRNO(-EINVAL); |
There was a problem hiding this comment.
Try to acquire the semaphore, return 0 on success and ETIMEDOUT on failure.
There was a problem hiding this comment.
I don't understand what do you mean by that. Isn't this what happens here?
There was a problem hiding this comment.
A negative timeout should have sem_trywait() semantics, except that it should return ETIMEDOUT instead of EAGAIN when the semaphore cannot be acquired. Your code simply returns EINVAL.
There was a problem hiding this comment.
Huh, right, I guess I could add a sem_trywait() call in here.
| timeout += abstime->tv_sec * 1000000 + abstime->tv_nsec / 1000; | ||
| timeout -= now; | ||
|
|
||
| if (timeout < 0) { |
There was a problem hiding this comment.
timeout <= 0 (currently it blocks indefinitely on 0).
| gettime(&now, &offs); | ||
| now += offs; | ||
|
|
||
| timeout += abstime->tv_sec * 1000000 + abstime->tv_nsec / 1000; |
There was a problem hiding this comment.
abstime == NULL check and tv_* fields validation is missing.
| ret = semaphoreCount(&sem->unnamed); | ||
| if (ret > 0 && value != NULL) { | ||
| ret = EOK; | ||
| if (value != NULL) { |
| if (ret > 0 && value != NULL) { | ||
| ret = EOK; | ||
| if (value != NULL) { | ||
| *value = ret; |
There was a problem hiding this comment.
value is always set to 0 (see L364).
TASK: RTOS-1407
TASK: RTOS-1407
Up until C23, C used _Static_assert for compile time assertions. C23 changed it to static_assert, to match C++ keyword. Since we can include some of our headers in C++ source, this static assertions should be portable between C++ and C source. TASK: RTOS-1407
TASK: RTOS-1407
|
Please rebase thsi PR and resolve conficts. |
4 participants
Description
This PR introduces implementation of POSIX standard semaphore interfaces.
Types of changes
How Has This Been Tested?
ia32-generic-qemuChecklist:
Special treatment