2009-05-28 Joel Sherrill <joel.sherrill@OARcorp.com>

	PR 1415/cpukit
	* rtems/src/semcreate.c, rtems/src/semtranslatereturncode.c,
	score/include/rtems/score/coremutex.h,
	score/inline/rtems/score/coremutex.inl, score/src/coremutex.c:
	Address two paths where a task with a priority above the ceiling
	could obtain a priority ceiling mutex.

6 files changed, 34 insertions, 16 deletions

diff --git a/cpukit/ChangeLog b/cpukit/ChangeLog
index 33e3121f52..60eda3183c 100644
--- a/cpukit/ChangeLog
+++ b/cpukit/ChangeLog
@@ -1,3 +1,12 @@
+2009-05-28	Joel Sherrill <joel.sherrill@OARcorp.com>
+
+	PR 1415/cpukit
+	* rtems/src/semcreate.c, rtems/src/semtranslatereturncode.c,
+	score/include/rtems/score/coremutex.h,
+	score/inline/rtems/score/coremutex.inl, score/src/coremutex.c:
+	Address two paths where a task with a priority above the ceiling
+	could obtain a priority ceiling mutex.
+
 2009-05-27	Sebastian Huber <sebastian.huber@embedded-brains.de>
 
 	* libcsupport/include/rtc.h: New RTC driver interface.
diff --git a/cpukit/rtems/src/semcreate.c b/cpukit/rtems/src/semcreate.c
index d5274daeea..09969d89be 100644
--- a/cpukit/rtems/src/semcreate.c
+++ b/cpukit/rtems/src/semcreate.c
@@ -80,7 +80,6 @@ rtems_status_code rtems_semaphore_create(
   register Semaphore_Control *the_semaphore;
   CORE_mutex_Attributes       the_mutex_attributes;
   CORE_semaphore_Attributes   the_semaphore_attributes;
-  uint32_t                    lock;
 
   if ( !rtems_is_name_valid( name ) )
     return RTEMS_INVALID_NAME;
@@ -146,6 +145,8 @@ rtems_status_code rtems_semaphore_create(
    */
 
   if ( !_Attributes_Is_counting_semaphore( attribute_set ) ) {
+    CORE_mutex_Status mutex_status;
+
     if ( _Attributes_Is_inherit_priority( attribute_set ) )
       the_mutex_attributes.discipline = CORE_MUTEX_DISCIPLINES_PRIORITY_INHERIT;
     else if ( _Attributes_Is_priority_ceiling( attribute_set ) )
@@ -176,16 +177,17 @@ rtems_status_code rtems_semaphore_create(
 
     the_mutex_attributes.priority_ceiling = priority_ceiling;
 
-    if ( count == 1 )
-      lock = CORE_MUTEX_UNLOCKED;
-    else
-      lock = CORE_MUTEX_LOCKED;
-
-    _CORE_mutex_Initialize(
+    mutex_status = _CORE_mutex_Initialize(
       &the_semaphore->Core_control.mutex,
       &the_mutex_attributes,
-      lock
-    );
+      (count == 1) ? CORE_MUTEX_UNLOCKED : CORE_MUTEX_LOCKED
+     ); 
+
+     if ( mutex_status == CORE_MUTEX_STATUS_CEILING_VIOLATED ) {
+       _Semaphore_Free( the_semaphore );
+       _Thread_Enable_dispatch();
+       return RTEMS_INVALID_PRIORITY;
+     }
   } else {
     if ( _Attributes_Is_priority( attribute_set ) )
       the_semaphore_attributes.discipline = CORE_SEMAPHORE_DISCIPLINES_PRIORITY;
diff --git a/cpukit/rtems/src/semtranslatereturncode.c b/cpukit/rtems/src/semtranslatereturncode.c
index 261aaa57de..b22cf0ff44 100644
--- a/cpukit/rtems/src/semtranslatereturncode.c
+++ b/cpukit/rtems/src/semtranslatereturncode.c
@@ -15,7 +15,7 @@
  *     + acquire a semaphore
  *     + release a semaphore
  *
- *  COPYRIGHT (c) 1989-2007.
+ *  COPYRIGHT (c) 1989-2009.
  *  On-Line Applications Research Corporation (OAR).
  *
  *  The license and distribution terms for this file may be
@@ -71,10 +71,9 @@ const rtems_status_code _Semaphore_Translate_core_mutex_return_code_[] = {
 #ifdef __RTEMS_STRICT_ORDER_MUTEX__
     CORE_MUTEX_RELEASE_NOT_ORDER,
 #endif
-  RTEMS_INTERNAL_ERROR     /* CORE_MUTEX_STATUS_CEILING_VIOLATED */
+  RTEMS_INVALID_PRIORITY   /* CORE_MUTEX_STATUS_CEILING_VIOLATED */
 };
 
-
 rtems_status_code _Semaphore_Translate_core_mutex_return_code (
   uint32_t   status
 )
diff --git a/cpukit/score/include/rtems/score/coremutex.h b/cpukit/score/include/rtems/score/coremutex.h
index 73a68189d8..35007652c8 100644
--- a/cpukit/score/include/rtems/score/coremutex.h
+++ b/cpukit/score/include/rtems/score/coremutex.h
@@ -8,7 +8,7 @@
  */
 
 /*
- *  COPYRIGHT (c) 1989-2008.
+ *  COPYRIGHT (c) 1989-2009.
  *  On-Line Applications Research Corporation (OAR).
  *
  *  The license and distribution terms for this file may be
@@ -257,8 +257,10 @@ typedef struct {
  *  @param[in] the_mutex_attributes is the attributes associated with this
  *         mutex instance
  *  @param[in] initial_lock is the initial value of the mutex
+ *
+ *  @return This method returns CORE_MUTEX_STATUS_SUCCESSFUL if successful.
  */
-void _CORE_mutex_Initialize(
+CORE_mutex_Status _CORE_mutex_Initialize(
   CORE_mutex_Control           *the_mutex,
   CORE_mutex_Attributes        *the_mutex_attributes,
   uint32_t                      initial_lock
diff --git a/cpukit/score/inline/rtems/score/coremutex.inl b/cpukit/score/inline/rtems/score/coremutex.inl
index 7680f98561..bcb86058fe 100644
--- a/cpukit/score/inline/rtems/score/coremutex.inl
+++ b/cpukit/score/inline/rtems/score/coremutex.inl
@@ -6,7 +6,7 @@
  */
 
 /*
- *  COPYRIGHT (c) 1989-2006.
+ *  COPYRIGHT (c) 1989-2009.
  *  On-Line Applications Research Corporation (OAR).
  *
  *  The license and distribution terms for this file may be
@@ -185,6 +185,7 @@ RTEMS_INLINE_ROUTINE int _CORE_mutex_Seize_interrupt_trylock_body(
       }
       /* if ( current < ceiling ) */ {
         executing->Wait.return_code = CORE_MUTEX_STATUS_CEILING_VIOLATED;
+        the_mutex->lock       = CORE_MUTEX_UNLOCKED;
         the_mutex->nest_count = 0;     /* undo locking above */
         executing->resource_count--;   /* undo locking above */
         _ISR_Enable( level );
diff --git a/cpukit/score/src/coremutex.c b/cpukit/score/src/coremutex.c
index 24b36cbef1..6d8a64e75d 100644
--- a/cpukit/score/src/coremutex.c
+++ b/cpukit/score/src/coremutex.c
@@ -42,7 +42,7 @@
  *  Output parameters:  NONE
  */
 
-void _CORE_mutex_Initialize(
+CORE_mutex_Status _CORE_mutex_Initialize(
   CORE_mutex_Control           *the_mutex,
   CORE_mutex_Attributes        *the_mutex_attributes,
   uint32_t                      initial_lock
@@ -65,6 +65,9 @@ void _CORE_mutex_Initialize(
     if ( _CORE_mutex_Is_inherit_priority( &the_mutex->Attributes ) ||
          _CORE_mutex_Is_priority_ceiling( &the_mutex->Attributes ) ) {
       
+      if ( _Thread_Executing->current_priority < 
+             the_mutex->Attributes.priority_ceiling )
+       return CORE_MUTEX_STATUS_CEILING_VIOLATED;
 #ifdef __RTEMS_STRICT_ORDER_MUTEX__
        _Chain_Prepend_unprotected( &_Thread_Executing->lock_mutex,
                                    &the_mutex->queue.lock_queue );
@@ -86,4 +89,6 @@ void _CORE_mutex_Initialize(
     STATES_WAITING_FOR_MUTEX,
     CORE_MUTEX_TIMEOUT
   );
+
+  return CORE_MUTEX_STATUS_SUCCESSFUL;
 }