There was a race conditon in the reference counting of file descriptors
during a close() operation. After the call to the close handler, the
rtems_libio_free() function cleared the flags to zero. However, at this
point in time there may still exist some holders of the file descriptor.
With RTEMS_DEBUG enabled this could lead to failed assertions in
rtems_libio_iop_drop().
Change the code to use only atomic read-modify-write operations on the
rtems_libio_iop::flags.
Add a simplified path evaluation function IMFS_eval_path_devfs() for a
device only IMFS configuration.
The code size can be further reduced by the application if it disables
the support for legacy IO drivers via:
#define CONFIGURE_IMFS_DISABLE_MKNOD
#define CONFIGURE_IMFS_DISABLE_MKNOD_DEVICE
Obsolete CONFIGURE_MAXIMUM_DEVICES. Remove BSP_MAXIMUM_DEVICES.
Update #3894.
Update #3898.
The CONFIGURE_IMFS_MEMFILE_BYTES_PER_BLOCK value is validated by
<rtems/confdefs/libio.h>. Changing this value during runtime could lead
to memory corruption.
Update #3894.
Remove IMFS_NODE_FLAG_NAME_ALLOCATED and instead replace the node
control in rename operations. This avoids a special case in the general
node destruction which pulled in free().
Update #3894.
In uniprocessor configurations, use compile-time constants for
rtems_scheduler_get_processor_maximum() and
rtems_scheduler_get_processor(). This helps compilers and static
analyzers to deduce that some loop bodies are only executed once and
some conditional statements have a fixed outcome (may improve code
generation and reduce false positives).
In SMP configurations, directly provide the internal implementation for
performance reasons.
Allow enabling ASSUME_VALID_INPUT to disable sanity checks on the device
tree and the parameters to libfdt. This assumption covers that cases where
the problem could be with either.
Signed-off-by: Simon Glass <sjg@chromium.org>
Message-Id: <20200220214557.176528-5-sjg@chromium.org>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
Support ASSUME_VALID_DTB to disable some sanity checks
If we assume that the DTB itself is valid then we can skip some checks and
save code space. Add various conditions to handle this.
Signed-off-by: Simon Glass <sjg@chromium.org>
Message-Id: <20200220214557.176528-4-sjg@chromium.org>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
Add a new ASSUME_MASK option, which allows for some control over the
checks used in libfdt. With all assumptions enabled, libfdt assumes that
the input data and parameters are all correct and that internal errors
cannot happen.
By default no assumptions are made and all checks are enabled.
Signed-off-by: Simon Glass <sjg@chromium.org>
Message-Id: <20200220214557.176528-3-sjg@chromium.org>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
There does not seem to be a strong reason to inline this function. Also
we are about to add some extra code to it which will increase its size.
Move it into fdt.c and use a simple declaration in libfdt.h
Signed-off-by: Simon Glass <sjg@chromium.org>
Message-Id: <20200220214557.176528-2-sjg@chromium.org>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
This function returns an int32_t, however the prototype in
libfdt_internal.h shows it returning an int. We haven't caught this before
because they're the same type on nearly all platforms this gets built on.
Apparently it's not the case on FreeRTOS, so someone hit this mismatch
building for that platform.
Reported-by: dharani kumar <dharanikumarsrvn@gmail.com>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
Including libfdt.h in a C++ project fails during compilation with recent
version of GCC or Clang.
This simple example:
extern "C" {
#include <libfdt.h>
}
int main(void) { return 0; }
leads to the following errors with GCC 9.1.0:
/usr/include/libfdt.h: In function ‘void fdt32_st(void*, uint32_t)’:
/usr/include/libfdt.h:139:16: error: invalid conversion from ‘void*’ to ‘uint8_t*’ {aka ‘unsigned char*’} [-fpermissive]
139 | uint8_t *bp = property;
| ^~~~~~~~
| |
| void*
/usr/include/libfdt.h: In function ‘void fdt64_st(void*, uint64_t)’:
/usr/include/libfdt.h:163:16: error: invalid conversion from ‘void*’ to ‘uint8_t*’ {aka ‘unsigned char*’} [-fpermissive]
163 | uint8_t *bp = property;
| ^~~~~~~~
| |
| void*
This commit adds an explicit cast to uint8_t* to fix this issue.
Signed-off-by: Luc Michel <luc.michel@greensocs.com>
Message-Id: <20190910104824.1321594-1-luc.michel@greensocs.com>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
c12b2b0c20eb "libfdt: fdt_address_cells() and fdt_size_cells()" introduced
a bug as it consolidated code between the helpers for getting
#address-cells and #size-cells. Specifically #size-cells is allowed to
be 0, and is frequently found so in practice for /cpus. IEEE1275 only
requires implementations to handle 1..4 for #address-cells, although one
could make a case for #address-cells == #size-cells == 0 being used to
represent a bridge with a single port.
While we're there, it's not totally obvious that the existing implicit
cast of a u32 to int will give the correct results according to strict C,
although it does work in practice. Straighten that up to cast only after
we've made our range checks.
Reported-by: yonghuhaige via https://github.com/dgibson/dtc/issues/28
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
In libfdt we often sanity test fdt_totalsize(fdt) fairly early, then
trust it (but *only* that header field) for the remainder of our work.
However, Coverity gets confused by this - it sees the byteswap in
fdt32_ld() and assumes that means it is coming from an untrusted source
everytime, resulting in many tainted data warnings.
Most of these end up with logic in fdt_get_string() as the unsafe
destination for this tainted data, so let's tweak the logic there to make
it clearer to Coverity that this is ok.
We add a sanity test on fdt_totalsize() to fdt_probe_ro_(). Because the
interface allows bare ints to be used for offsets, we already have the
assumption that totalsize must be 31-bits or less (2GiB would be a
ludicrously large fdt). This makes this more explicit.
We also make fdt_probe_ro() return the size for convenience, and change the
logic in fdt_get_string() to keep it in a local so that Coverity can see
that it has already been bounds-checked.
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
