...

Security Issues Fixed In This Release

Compatibility Concerns

API Changes

Default Semaphore Protocol Changed

When NuttX is built with priority inheritance (CONFIG_PRIORITY_INHERITANCE), priority inheritance can be enabled or disabled per semaphore and care must be taken to make the correct choice based on how each semaphore is used.

When a semaphore is used as a mutual exclusion lock ("locking semaphore"), a thread that needs exclusive access to a resource waits on the semaphore, uses the resource, and then posts the semaphore. In this case, priority inheritance should be enabled for the semaphore (sem_setprotocol(sem, SEM_PRIO_INHERIT)) to mitigate priority inversion which could occur when multiple threads with different priorities compete for various resources.

In contrast, when a semaphore is used to signal an event from one thread to another ("signaling semaphore"), one thread waits on the semaphore and another thread posts it when the anticipated event occurs. In this case, since the thread that posts the semaphore is different than the one that waits on it, priority inheritance must not be enabled for the semaphore (sem_setprotocol(sem, SEM_PRIO_NONE)).

In earlier releases, priority inheritance was enabled by default for all semaphores whenever NuttX was built with CONFIG_PRIORITY_INHERITANCE. If a semaphore was used for signaling across threads, the non-standard API sem_setprotocol(sem, SEM_PRIO_NONE) had to be used to selectively disable priority inheritance for that semaphore.

Starting with this release, the default is changed: priority inheritance is disabled by default for all semaphores. To enable priority inheritance for a semaphore, first NuttX needs to be built with CONFIG_PRIORITY_INHERITANCE, then priority inheritance needs to be enabled for the semaphore in question with sem_setprotocol(sem, SEM_PRIO_INHERIT).

The benefit of this change is easier porting and maintenance of standards-compliant applications to NuttX by eliminating the need for 3rd party applications to call the non-standard API sem_setprotocol().

In addition, this is a safer default: Having priority inheritance inadvertently enabled for a signaling semaphore can cause incorrect behavior, while the impact of having it inadvertently disabled for a locking semaphore is limited to reduced performance.

This change was introduced in PR # 5070 https://github.com/apache/incubator-nuttx/pull/5070, git commits 4e1d967bcd0031bd07a6a46f022c75216cf98404, e5fbbd416d5f1e74e3f705677b2e99b0b8c544d3, 9a4b66fbb306d388e2ce431807a139848604a9f0, and 125de66b63b316a2c2a2912dd408f4bac2fc85c3.

All semaphore uses within the NuttX repositories have been updated; those used for locking have been replaced with mutexes (mutex_t instead of sem_t). See PR # 6965, git commits 

ef3919e4eb75b1ab854a21c98124d7e90e5c5e14, 590e0d5666c47dcb91ccd35faa57681ca26d4b1d, and 5db565c78d7c009eaea8517f01a2d138ab5f0028.

Downstream users need to call sem_setprotocol(sem, SEM_PRIO_INHERIT) when setting up each semaphore used for mutual exclusion locking. In addition, they may optionally remove calls to sem_setprotocol(sem, SEM_PRIO_NONE) for signaling semaphores.

Changes to Build System

Renamed or Modified Kconfig Options

...