posix: implement POSIX semaphore interfaces - #457
Conversation
Summary of ChangesHello @oI0ck, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request introduces comprehensive support for POSIX standard semaphore interfaces within the Highlights
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This PR introduces POSIX semaphore implementation. The changes are extensive, adding new headers and implementation files for named and unnamed semaphores. The overall structure is good, but I've found several critical issues in the implementation, including race conditions, incorrect logic leading to deadlocks, and potential memory corruption. There are also some areas where the code can be simplified and made more robust. Please address the critical issues before merging.
ba94ea8 to
da0f0fd
Compare
Unit Test Results12 396 tests +1 089 11 618 ✅ +1 018 55m 45s ⏱️ + 1m 54s For more details on these failures, see this check. Results for commit 78ea982. ± Comparison against base commit b7974a5. ♻️ This comment has been updated with latest results. |
da0f0fd to
b6d1928
Compare
b6d1928 to
20f142f
Compare
|
|
||
| #define SEM_FAILED ((sem_t *)0xDAAB0000) | ||
|
|
||
| typedef struct _sem_t { |
There was a problem hiding this comment.
_sem_t identifier is not used anywhere. If it's not required by POSIX - remove it.
cf48092 to
f3710e3
Compare
| #define SEMCTL_PATH ("/dev/posix/semctl") | ||
| #define SEMAPHORE_MAX_COUNT (128) | ||
| #define SEMAPHORE_NAME_MAX (NAME_MAX - sizeof(SEMAPHORE_PATH) - 1) | ||
| #define SEM_VALUE_MAX INT_MAX |
There was a problem hiding this comment.
-
I think this should be defined per-architecture in libphoenix/include/arch/*/limits.h (like
NAME_MAX). It can be just#define SEM_VALUE_MAX INT_MAX, but the important part is that the definition should be available via limits.h. -
Is
SEMAPHORE_MAX_COUNTused anywhere? Is should beSEM_NSEMS_MAXand defined in limits.h like in the point above. Please actually enforce the limit. Note that_POSIX_SEM_NSEMS_MAX == 256which is the minimum value for this limit. -
See
sysconf(). You could implement_SC_SEM_VALUE_MAXand_SC_SEM_NSEMS_MAX. -
Also, this is a good place to static-assert
SEM_VALUE_MAXwith_POSIX_SEM_VALUE_MAXandSEM_NSEMS_MAXwith_POSIX_SEM_NSEMS_MAXin case someone changes limits.h incorrectly. Maybe also check whether the limit does not exceed the semaphore value type size (unsigned int).
| else { | ||
| } | ||
|
|
||
| sem = (sem_t *)malloc(sizeof(*sem)); |
23e321c to
057606b
Compare
|
CI shows problems with this change, I'm converting it to a draft until I am sure that it is in mergable state. |
070fbcb to
67a05ba
Compare
959032f to
8e8cc43
Compare
TASK: RTOS-1407
a3396ff to
74bdc2c
Compare
| if (strcmp(name, dent->d_name) == 0) { | ||
| strcpy(path, SEMAPHORE_PATH); | ||
| strncpy(path + strlen(SEMAPHORE_PATH), dent->d_name, PATH_MAX - strlen(SEMAPHORE_PATH)); | ||
| lookup(path, NULL, &oid); |
There was a problem hiding this comment.
lookup could have failed here, leading to uninitialized dev oid
There was a problem hiding this comment.
Right, I got TOCTOU'd, nice catch.
| #include <sys/threads.h> | ||
| #include <sys/semaphore.h> | ||
|
|
||
| #define SEM_FAILED ((sem_t *)0xDAAB0000) |
There was a problem hiding this comment.
why this value in particular?
There was a problem hiding this comment.
are you sure this cannot be an allocated address on any of our targets?
|
|
||
| dirp = opendir(SEMAPHORE_PATH); | ||
| if (dirp == NULL) { | ||
| /* posixsrv has yet not initialized the semaphore subsystem */ |
| return SEM_FAILED; | ||
| } | ||
|
|
||
| sem = (sem_t *)malloc(sizeof(*sem)); |
There was a problem hiding this comment.
nitpick: unnecessary cast
| unsigned int value = 0; | ||
| sem_t *sem; | ||
|
|
||
| (void)mode; |
There was a problem hiding this comment.
does POSIX not enforce passing mode along? or we just don't want to handle it for now? in the second case, add a TODO here.
There was a problem hiding this comment.
create_dev() does not take a mode parameter, there is a TODO in there to add it. Devices are created by default with 0666 mode.
I can leave a comment and revisit this after this in another PR.
| if (sem->type == smNamed) { | ||
| msg.type = mtClose; | ||
| msg.oid = sem->named; | ||
| ret = msgSend(sem->named.port, &msg); |
There was a problem hiding this comment.
if (ret == 0) ret = msg.o.err probably
|
|
||
| new.type = smUnnamed; | ||
| ret = semaphoreCreate(&new.unnamed, value); | ||
| *sem = new; |
There was a problem hiding this comment.
nitpick: this is set unconditionally. What is semaphoreCreate failed?
There was a problem hiding this comment.
Will change this to returning -ENOSPC if semaphoreCreate() fails. Seems like the most appropriate errno that is compilant with POSIX.
| if (ret == EOK) { | ||
| msg.type = mtDestroy; | ||
| msg.oid = oid; | ||
| ret = msgSend(oid.port, &msg); |
There was a problem hiding this comment.
if (ret == 0) ret = msg.o.err probably
| if (path == NULL) { | ||
| errno = EINVAL; | ||
| return; | ||
| } | ||
|
|
||
| slash = strrchr(path, '/'); | ||
|
|
||
| if (slash == NULL) { | ||
| *dir = "."; | ||
| *base = path; | ||
| if (dir != NULL) { | ||
| *dir = "."; | ||
| } | ||
|
|
||
| if (base != NULL) { | ||
| *base = path; | ||
| } | ||
| } | ||
| else if (slash == path) { | ||
| *base = path + 1; | ||
| *dir = "/"; | ||
| if (base != NULL) { | ||
| *base = path + 1; | ||
| } | ||
|
|
||
| if (dir != NULL) { | ||
| *dir = "/"; | ||
| } | ||
| } | ||
| else { | ||
| *dir = path; | ||
| *base = slash + 1; | ||
| if (dir != NULL) { | ||
| *dir = path; | ||
| } | ||
|
|
||
| if (base != NULL) { | ||
| *base = slash + 1; |
There was a problem hiding this comment.
I wanted to make dir and base optional if you only want one of these. Since now I use destroy_dev(), I can drop this commit
There was a problem hiding this comment.
I'd drop it since it somewhat obfuscates the function, but that's not a bad idea IMO
| if (path == NULL) { | ||
| errno = EINVAL; | ||
| return; | ||
| } | ||
|
|
There was a problem hiding this comment.
this seems especially wrong as now we could silently change errno but return 0 (from the calling function).
| break; | ||
| } | ||
|
|
||
| if (strcmp(name, dent->d_name) == 0) { |
There was a problem hiding this comment.
Leading / is not stripped from name as it in semaphore_create() from phoenix-rtos-posixsrv.
| now += offs; | ||
|
|
||
| timeout += abs_timeout->tv_sec * 1000000 + abs_timeout->tv_nsec / 1000; | ||
| timeout -= now; |
There was a problem hiding this comment.
Note that with absolute timeout this could be negative value (timeout could be in the past) which is not handled correctly by sem_msg_down (results in unbounded down).
| else { | ||
| ret = -EINVAL; | ||
| } | ||
|
|
There was a problem hiding this comment.
sem memory is not freed.
| * SPDX-License-Identifier: BSD-3-Clause | ||
| */ | ||
|
|
||
| #include <time.h> |
There was a problem hiding this comment.
Missing C++ support (extern "C).
| * SPDX-License-Identifier: BSD-3-Clause | ||
| */ | ||
|
|
||
| #include <assert.h> |
There was a problem hiding this comment.
Missing C++ support (extern "C).
c06bb0a to
0fcb1c0
Compare
TASK: RTOS-1407
Up until C23, C used _Static_assert for compile time assertions. C23 changed it to static_assert, to match C++ keyword. Since we can include some of our headers in C++ source, this static assertions should be portable between C++ and C source. TASK: RTOS-1407
TASK: RTOS-1407
4 participants
Description
This PR introduces implementation of POSIX standard semaphore interfaces.
Types of changes
How Has This Been Tested?
ia32-generic-qemuChecklist:
Special treatment