[Xenomai-core] [bug] broken PI-chain

[Jan Kiszka <jan.kiszka@domain.hid>]

[-- Attachment #1.1: Type: text/plain, Size: 1054 bytes --]

Hi,

the following (academic?) scenario is not handled as expected by the
nucleus:

 Prio	^
	|                  -- T2
	|                 /
	|  T0 <----- T1 <- M1
	| (M0)  M0  (M1)
	+------------------------

That means: Task T0 at, e.g., prio 1 holds mutex M0. T1, also at prio 1,
happens to interrupt T0 (round-robin?). T1 already holds M1 and now
tries to acquire M0. As both are at the same prio level, no boosting
takes place, all fine. Then T2 comes in play. It's at prio 2 and tries
to gain access to M1. T1 gets therefore boosted to prio 2 as well, but
T0 will stay at prio 1 under Xenomai.

I hacked this scenario in the attached demo. Set MAX to 2 to let it
work, leave it 3 and it breaks.

The problem looks on first sight like this test [1]: the claiming
relation is only establish if there is a priority delta on entry, but
that breaks when the claiming thread's prio changes later. Can we simply
remove this test?

Jan

[1]http://www.rts.uni-hannover.de/xenomai/lxr/source/ksrc/nucleus/synch.c?v=SVN-trunk#L193

[-- Attachment #1.2: pip-chain.c --]
[-- Type: text/plain, Size: 903 bytes --]

#include <stdio.h>
#include <sys/mman.h>
#include <native/task.h>
#include <native/mutex.h>

#define MAX	3

RT_MUTEX mutex[3];

void task_func(void *arg)
{
	int index = (int)arg;

	rt_mutex_lock(&mutex[index], TM_INFINITE);
	rt_mutex_lock(&mutex[index-1], TM_INFINITE);
	rt_mutex_unlock(&mutex[index]);
}


int main(int argc, char **argv)
{
	RT_TASK task[3];
	RT_TASK_INFO info;
	int i;

	mlockall(MCL_CURRENT|MCL_FUTURE);

	for (i = 0; i < 3; i++)
		rt_mutex_create(&mutex[i], NULL);

	rt_task_shadow(&task[0], NULL, 1, 0);

	rt_mutex_lock(&mutex[0], TM_INFINITE);

	for (i = 1; i < MAX; i++)
		rt_task_spawn(&task[i], NULL, 0, (i == MAX-1) ? 2 : 1, 0, task_func, (void *)i);

	rt_task_inquire(NULL, &info);
	printf("MAX=%d, prio=%d\n", MAX, info.cprio);

	rt_mutex_unlock(&mutex[0]);

	for (i = 0; i < 3; i++)
		rt_mutex_delete(&mutex[i]);

	return 0;
}

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 250 bytes --]