mirror of
https://github.com/FreeRTOS/FreeRTOS-Kernel.git
synced 2025-10-17 10:17:45 -04:00
Prove buffer lemmas (#124)
* Prove buffer lemmas * Update queue proofs to latest kernel source All changes were syntactic due to uncrustify code-formatting * Strengthen prvCopyDataToQueue proof * Add extract script for diff comparison Co-authored-by: Yuhui Zheng <10982575+yuhui-zheng@users.noreply.github.com>
This commit is contained in:
Nathan Chong
GitHub
parent
c720c18ada
commit
8e36bee30e
26 changed files with 2021 additions and 1762 deletions
|
|
@ -23,184 +23,186 @@
|
|||
#include "proof/queue.h"
|
||||
#include "proof/queuecontracts.h"
|
||||
|
||||
BaseType_t xQueuePeek( QueueHandle_t xQueue, void * const pvBuffer, TickType_t xTicksToWait )
|
||||
BaseType_t xQueuePeek( QueueHandle_t xQueue,
|
||||
void * const pvBuffer,
|
||||
TickType_t xTicksToWait )
|
||||
/*@requires [1/2]queuehandle(xQueue, ?N, ?M, ?is_isr) &*& is_isr == false &*&
|
||||
[1/2]queuesuspend(xQueue) &*&
|
||||
chars(pvBuffer, M, ?x);@*/
|
||||
[1/2]queuesuspend(xQueue) &*&
|
||||
chars(pvBuffer, M, ?x);@*/
|
||||
/*@ensures [1/2]queuehandle(xQueue, N, M, is_isr) &*&
|
||||
[1/2]queuesuspend(xQueue) &*&
|
||||
(result == pdPASS ? chars(pvBuffer, M, _) : chars(pvBuffer, M, x));@*/
|
||||
[1/2]queuesuspend(xQueue) &*&
|
||||
(result == pdPASS ? chars(pvBuffer, M, _) : chars(pvBuffer, M, x));@*/
|
||||
{
|
||||
BaseType_t xEntryTimeSet = pdFALSE;
|
||||
TimeOut_t xTimeOut;
|
||||
int8_t *pcOriginalReadPosition;
|
||||
BaseType_t xEntryTimeSet = pdFALSE;
|
||||
TimeOut_t xTimeOut;
|
||||
int8_t * pcOriginalReadPosition;
|
||||
#ifdef VERIFAST /*< const pointer declaration */
|
||||
Queue_t * pxQueue = xQueue;
|
||||
Queue_t * pxQueue = xQueue;
|
||||
#else
|
||||
Queue_t * const pxQueue = xQueue;
|
||||
Queue_t * const pxQueue = xQueue;
|
||||
|
||||
/* Check the pointer is not NULL. */
|
||||
configASSERT( ( pxQueue ) );
|
||||
/* Check the pointer is not NULL. */
|
||||
configASSERT( ( pxQueue ) );
|
||||
|
||||
/* The buffer into which data is received can only be NULL if the data size
|
||||
is zero (so no data is copied into the buffer. */
|
||||
configASSERT( !( ( ( pvBuffer ) == NULL ) && ( ( pxQueue )->uxItemSize != ( UBaseType_t ) 0U ) ) );
|
||||
|
||||
/* Cannot block if the scheduler is suspended. */
|
||||
#if ( ( INCLUDE_xTaskGetSchedulerState == 1 ) || ( configUSE_TIMERS == 1 ) )
|
||||
{
|
||||
configASSERT( !( ( xTaskGetSchedulerState() == taskSCHEDULER_SUSPENDED ) && ( xTicksToWait != 0 ) ) );
|
||||
}
|
||||
#endif
|
||||
/* The buffer into which data is received can only be NULL if the data size
|
||||
* is zero (so no data is copied into the buffer. */
|
||||
configASSERT( !( ( ( pvBuffer ) == NULL ) && ( ( pxQueue )->uxItemSize != ( UBaseType_t ) 0U ) ) );
|
||||
|
||||
/* Cannot block if the scheduler is suspended. */
|
||||
#if ( ( INCLUDE_xTaskGetSchedulerState == 1 ) || ( configUSE_TIMERS == 1 ) )
|
||||
{
|
||||
configASSERT( !( ( xTaskGetSchedulerState() == taskSCHEDULER_SUSPENDED ) && ( xTicksToWait != 0 ) ) );
|
||||
}
|
||||
#endif
|
||||
#endif
|
||||
|
||||
/*lint -save -e904 This function relaxes the coding standard somewhat to
|
||||
allow return statements within the function itself. This is done in the
|
||||
interest of execution time efficiency. */
|
||||
for( ;; )
|
||||
/*@invariant [1/2]queuehandle(xQueue, N, M, is_isr) &*&
|
||||
[1/2]queuesuspend(xQueue) &*&
|
||||
chars(pvBuffer, M, x) &*&
|
||||
u_integer(&xTicksToWait, _) &*&
|
||||
xTIME_OUT(&xTimeOut);@*/
|
||||
{
|
||||
taskENTER_CRITICAL();
|
||||
/*@assert queue(pxQueue, ?Storage, N, M, ?W, ?R, ?K, ?is_locked, ?abs);@*/
|
||||
{
|
||||
const UBaseType_t uxMessagesWaiting = pxQueue->uxMessagesWaiting;
|
||||
/*lint -save -e904 This function relaxes the coding standard somewhat to
|
||||
* allow return statements within the function itself. This is done in the
|
||||
* interest of execution time efficiency. */
|
||||
for( ; ; )
|
||||
/*@invariant [1/2]queuehandle(xQueue, N, M, is_isr) &*&
|
||||
[1/2]queuesuspend(xQueue) &*&
|
||||
chars(pvBuffer, M, x) &*&
|
||||
u_integer(&xTicksToWait, _) &*&
|
||||
xTIME_OUT(&xTimeOut);@*/
|
||||
{
|
||||
taskENTER_CRITICAL();
|
||||
/*@assert queue(pxQueue, ?Storage, N, M, ?W, ?R, ?K, ?is_locked, ?abs);@*/
|
||||
{
|
||||
const UBaseType_t uxMessagesWaiting = pxQueue->uxMessagesWaiting;
|
||||
|
||||
/* Is there data in the queue now? To be running the calling task
|
||||
must be the highest priority task wanting to access the queue. */
|
||||
if( uxMessagesWaiting > ( UBaseType_t ) 0 )
|
||||
{
|
||||
/* Remember the read position so it can be reset after the data
|
||||
is read from the queue as this function is only peeking the
|
||||
data, not removing it. */
|
||||
pcOriginalReadPosition = pxQueue->u.xQueue.pcReadFrom;
|
||||
/* Is there data in the queue now? To be running the calling task
|
||||
* must be the highest priority task wanting to access the queue. */
|
||||
if( uxMessagesWaiting > ( UBaseType_t ) 0 )
|
||||
{
|
||||
/* Remember the read position so it can be reset after the data
|
||||
* is read from the queue as this function is only peeking the
|
||||
* data, not removing it. */
|
||||
pcOriginalReadPosition = pxQueue->u.xQueue.pcReadFrom;
|
||||
|
||||
/*@close queue(pxQueue, Storage, N, M, W, R, K, is_locked, abs);@*/
|
||||
prvCopyDataFromQueue( pxQueue, pvBuffer );
|
||||
traceQUEUE_PEEK( pxQueue );
|
||||
/*@close queue(pxQueue, Storage, N, M, W, R, K, is_locked, abs);@*/
|
||||
prvCopyDataFromQueue( pxQueue, pvBuffer );
|
||||
traceQUEUE_PEEK( pxQueue );
|
||||
|
||||
/* The data is not being removed, so reset the read pointer. */
|
||||
pxQueue->u.xQueue.pcReadFrom = pcOriginalReadPosition;
|
||||
/* The data is not being removed, so reset the read pointer. */
|
||||
pxQueue->u.xQueue.pcReadFrom = pcOriginalReadPosition;
|
||||
|
||||
/* The data is being left in the queue, so see if there are
|
||||
any other tasks waiting for the data. */
|
||||
if( listLIST_IS_EMPTY( &( pxQueue->xTasksWaitingToReceive ) ) == pdFALSE )
|
||||
{
|
||||
if( xTaskRemoveFromEventList( &( pxQueue->xTasksWaitingToReceive ) ) != pdFALSE )
|
||||
{
|
||||
/* The task waiting has a higher priority than this task. */
|
||||
queueYIELD_IF_USING_PREEMPTION();
|
||||
}
|
||||
else
|
||||
{
|
||||
mtCOVERAGE_TEST_MARKER();
|
||||
}
|
||||
}
|
||||
else
|
||||
{
|
||||
mtCOVERAGE_TEST_MARKER();
|
||||
}
|
||||
/* The data is being left in the queue, so see if there are
|
||||
* any other tasks waiting for the data. */
|
||||
if( listLIST_IS_EMPTY( &( pxQueue->xTasksWaitingToReceive ) ) == pdFALSE )
|
||||
{
|
||||
if( xTaskRemoveFromEventList( &( pxQueue->xTasksWaitingToReceive ) ) != pdFALSE )
|
||||
{
|
||||
/* The task waiting has a higher priority than this task. */
|
||||
queueYIELD_IF_USING_PREEMPTION();
|
||||
}
|
||||
else
|
||||
{
|
||||
mtCOVERAGE_TEST_MARKER();
|
||||
}
|
||||
}
|
||||
else
|
||||
{
|
||||
mtCOVERAGE_TEST_MARKER();
|
||||
}
|
||||
|
||||
/*@close queue(pxQueue, Storage, N, M, W, R, K, is_locked, abs);@*/
|
||||
taskEXIT_CRITICAL();
|
||||
return pdPASS;
|
||||
}
|
||||
else
|
||||
{
|
||||
if( xTicksToWait == ( TickType_t ) 0 )
|
||||
{
|
||||
/* The queue was empty and no block time is specified (or
|
||||
the block time has expired) so leave now. */
|
||||
/*@close queue(pxQueue, Storage, N, M, W, R, K, is_locked, abs);@*/
|
||||
taskEXIT_CRITICAL();
|
||||
traceQUEUE_PEEK_FAILED( pxQueue );
|
||||
return errQUEUE_EMPTY;
|
||||
}
|
||||
else if( xEntryTimeSet == pdFALSE )
|
||||
{
|
||||
/* The queue was empty and a block time was specified so
|
||||
configure the timeout structure ready to enter the blocked
|
||||
state. */
|
||||
vTaskInternalSetTimeOutState( &xTimeOut );
|
||||
xEntryTimeSet = pdTRUE;
|
||||
}
|
||||
else
|
||||
{
|
||||
/* Entry time was already set. */
|
||||
mtCOVERAGE_TEST_MARKER();
|
||||
}
|
||||
}
|
||||
}
|
||||
/*@close queue(pxQueue, Storage, N, M, W, R, K, is_locked, abs);@*/
|
||||
taskEXIT_CRITICAL();
|
||||
/*@close queue(pxQueue, Storage, N, M, W, R, K, is_locked, abs);@*/
|
||||
taskEXIT_CRITICAL();
|
||||
return pdPASS;
|
||||
}
|
||||
else
|
||||
{
|
||||
if( xTicksToWait == ( TickType_t ) 0 )
|
||||
{
|
||||
/* The queue was empty and no block time is specified (or
|
||||
* the block time has expired) so leave now. */
|
||||
/*@close queue(pxQueue, Storage, N, M, W, R, K, is_locked, abs);@*/
|
||||
taskEXIT_CRITICAL();
|
||||
traceQUEUE_PEEK_FAILED( pxQueue );
|
||||
return errQUEUE_EMPTY;
|
||||
}
|
||||
else if( xEntryTimeSet == pdFALSE )
|
||||
{
|
||||
/* The queue was empty and a block time was specified so
|
||||
* configure the timeout structure ready to enter the blocked
|
||||
* state. */
|
||||
vTaskInternalSetTimeOutState( &xTimeOut );
|
||||
xEntryTimeSet = pdTRUE;
|
||||
}
|
||||
else
|
||||
{
|
||||
/* Entry time was already set. */
|
||||
mtCOVERAGE_TEST_MARKER();
|
||||
}
|
||||
}
|
||||
}
|
||||
/*@close queue(pxQueue, Storage, N, M, W, R, K, is_locked, abs);@*/
|
||||
taskEXIT_CRITICAL();
|
||||
|
||||
/* Interrupts and other tasks can send to and receive from the queue
|
||||
now the critical section has been exited. */
|
||||
/* Interrupts and other tasks can send to and receive from the queue
|
||||
* now the critical section has been exited. */
|
||||
|
||||
/*@close exists<QueueHandle_t>(pxQueue);@*/
|
||||
vTaskSuspendAll();
|
||||
prvLockQueue( pxQueue );
|
||||
/*@close exists<QueueHandle_t>(pxQueue);@*/
|
||||
vTaskSuspendAll();
|
||||
prvLockQueue( pxQueue );
|
||||
|
||||
/* Update the timeout state to see if it has expired yet. */
|
||||
if( xTaskCheckForTimeOut( &xTimeOut, &xTicksToWait ) == pdFALSE )
|
||||
{
|
||||
/* Timeout has not expired yet, check to see if there is data in the
|
||||
queue now, and if not enter the Blocked state to wait for data. */
|
||||
if( prvIsQueueEmpty( pxQueue ) != pdFALSE )
|
||||
{
|
||||
traceBLOCKING_ON_QUEUE_PEEK( pxQueue );
|
||||
/*@open queue_locked_invariant(xQueue)();@*/
|
||||
vTaskPlaceOnEventList( &( pxQueue->xTasksWaitingToReceive ), xTicksToWait );
|
||||
/*@close queue_locked_invariant(xQueue)();@*/
|
||||
prvUnlockQueue( pxQueue );
|
||||
/*@close exists<QueueHandle_t>(pxQueue);@*/
|
||||
if( xTaskResumeAll() == pdFALSE )
|
||||
{
|
||||
portYIELD_WITHIN_API();
|
||||
}
|
||||
else
|
||||
{
|
||||
mtCOVERAGE_TEST_MARKER();
|
||||
}
|
||||
}
|
||||
else
|
||||
{
|
||||
/* There is data in the queue now, so don't enter the blocked
|
||||
state, instead return to try and obtain the data. */
|
||||
prvUnlockQueue( pxQueue );
|
||||
/* Update the timeout state to see if it has expired yet. */
|
||||
if( xTaskCheckForTimeOut( &xTimeOut, &xTicksToWait ) == pdFALSE )
|
||||
{
|
||||
/* Timeout has not expired yet, check to see if there is data in the
|
||||
* queue now, and if not enter the Blocked state to wait for data. */
|
||||
if( prvIsQueueEmpty( pxQueue ) != pdFALSE )
|
||||
{
|
||||
traceBLOCKING_ON_QUEUE_PEEK( pxQueue );
|
||||
/*@open queue_locked_invariant(xQueue)();@*/
|
||||
vTaskPlaceOnEventList( &( pxQueue->xTasksWaitingToReceive ), xTicksToWait );
|
||||
/*@close queue_locked_invariant(xQueue)();@*/
|
||||
prvUnlockQueue( pxQueue );
|
||||
|
||||
/*@close exists<QueueHandle_t>(pxQueue);@*/
|
||||
if( xTaskResumeAll() == pdFALSE )
|
||||
{
|
||||
portYIELD_WITHIN_API();
|
||||
}
|
||||
else
|
||||
{
|
||||
mtCOVERAGE_TEST_MARKER();
|
||||
}
|
||||
}
|
||||
else
|
||||
{
|
||||
/* There is data in the queue now, so don't enter the blocked
|
||||
* state, instead return to try and obtain the data. */
|
||||
prvUnlockQueue( pxQueue );
|
||||
#ifdef VERIFAST /*< void cast of unused return value */
|
||||
/*@close exists<QueueHandle_t>(pxQueue);@*/
|
||||
xTaskResumeAll();
|
||||
/*@close exists<QueueHandle_t>(pxQueue);@*/
|
||||
xTaskResumeAll();
|
||||
#else
|
||||
( void ) xTaskResumeAll();
|
||||
( void ) xTaskResumeAll();
|
||||
#endif
|
||||
}
|
||||
}
|
||||
else
|
||||
{
|
||||
/* The timeout has expired. If there is still no data in the queue
|
||||
exit, otherwise go back and try to read the data again. */
|
||||
prvUnlockQueue( pxQueue );
|
||||
}
|
||||
}
|
||||
else
|
||||
{
|
||||
/* The timeout has expired. If there is still no data in the queue
|
||||
* exit, otherwise go back and try to read the data again. */
|
||||
prvUnlockQueue( pxQueue );
|
||||
#ifdef VERIFAST /*< void cast of unused return value */
|
||||
/*@close exists<QueueHandle_t>(pxQueue);@*/
|
||||
xTaskResumeAll();
|
||||
/*@close exists<QueueHandle_t>(pxQueue);@*/
|
||||
xTaskResumeAll();
|
||||
#else
|
||||
( void ) xTaskResumeAll();
|
||||
( void ) xTaskResumeAll();
|
||||
#endif
|
||||
|
||||
if( prvIsQueueEmpty( pxQueue ) != pdFALSE )
|
||||
{
|
||||
traceQUEUE_PEEK_FAILED( pxQueue );
|
||||
return errQUEUE_EMPTY;
|
||||
}
|
||||
else
|
||||
{
|
||||
mtCOVERAGE_TEST_MARKER();
|
||||
}
|
||||
}
|
||||
} /*lint -restore */
|
||||
if( prvIsQueueEmpty( pxQueue ) != pdFALSE )
|
||||
{
|
||||
traceQUEUE_PEEK_FAILED( pxQueue );
|
||||
return errQUEUE_EMPTY;
|
||||
}
|
||||
else
|
||||
{
|
||||
mtCOVERAGE_TEST_MARKER();
|
||||
}
|
||||
}
|
||||
} /*lint -restore */
|
||||
}
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue