sched: add a reference count to the TCB to prevent it from being deleted.

arch/risc-v/src/common/riscv_exception.c

@@ -111,6 +111,7 @@ int riscv_exception(int mcause, void *regs, void *args)
       _alert("Segmentation fault in %s (PID %d: %s)\n", get_task_name(ptcb),
              tcb->pid, get_task_name(tcb));
 
+      nxsched_put_tcb(ptcb);
       tcb->flags |= TCB_FLAG_FORCED_CANCEL;
 
       /* Return to _exit function in privileged mode with argument SIGSEGV */

boards/arm/stm32/nucleo-f302r8/scripts/ld.script

@@ -30,7 +30,7 @@
 
 MEMORY
 {
-  flash (rx) : ORIGIN = 0x08000000, LENGTH = 64K
+  flash (rx) : ORIGIN = 0x08000000, LENGTH = 96K
   sram (rwx) : ORIGIN = 0x20000000, LENGTH = 16K
 }
 

boards/arm/stm32/nucleo-g431rb/scripts/ld.script

@@ -47,7 +47,7 @@
 
 MEMORY
 {
-    flash (rx) : ORIGIN = 0x08000000, LENGTH = 128K
+    flash (rx) : ORIGIN = 0x08000000, LENGTH = 256K
     sram (rwx) : ORIGIN = 0x20000000, LENGTH = 22K
 }
 

drivers/note/note_driver.c

@@ -2109,6 +2109,7 @@ FAR char *note_get_taskname(pid_t pid, FAR char *buf, size_t len)
   if (tcb != NULL)
     {
       strlcpy(buf, tcb->name, len);
+      nxsched_put_tcb(tcb);
       return buf;
     }
 

drivers/syslog/vsyslog.c

@@ -36,6 +36,7 @@
 #include <nuttx/streams.h>
 #include <nuttx/syslog/syslog.h>
 
+#include "sched/sched.h"
 #include "syslog.h"
 
 /****************************************************************************

fs/inode/fs_files.c

@@ -255,6 +255,7 @@ static void task_fssync(FAR struct tcb_s *tcb, FAR void *arg)
           ctcb = nxsched_get_tcb(pid);
           if (ctcb == NULL || ctcb->group == NULL || ctcb != tcb)
             {
+              nxsched_put_tcb(ctcb);
               return;
             }
 
@@ -264,6 +265,8 @@ static void task_fssync(FAR struct tcb_s *tcb, FAR void *arg)
               file_fsync(filep);
               file_put(filep);
             }
+
+          nxsched_put_tcb(ctcb);
         }
     }
 }

fs/procfs/fs_procfs.c

@@ -942,8 +942,7 @@ static int procfs_readdir(FAR struct inode *mountpt,
           /* Verify that the pid still refers to an active task/thread */
 
           pid_t pid = level0->pid[index];
-          FAR struct tcb_s *tcb = nxsched_get_tcb(pid);
-          if (!tcb)
+          if (!nxsched_verify_pid(pid))
             {
               ferr("ERROR: PID %d is no longer valid\n", pid);
               return -ENOENT;

fs/procfs/fs_procfsmeminfo.c

@@ -539,6 +539,7 @@ static ssize_t memdump_write(FAR struct file *filep, FAR const char *buffer,
         }
 
       tcb->flags |= TCB_FLAG_HEAP_DUMP;
+      nxsched_put_tcb(tcb);
       return buflen;
     }
   else if ((p = strstr(buffer, "off")) != NULL)
@@ -552,6 +553,7 @@ static ssize_t memdump_write(FAR struct file *filep, FAR const char *buffer,
         }
 
       tcb->flags &= ~TCB_FLAG_HEAP_DUMP;
+      nxsched_put_tcb(tcb);
       return buflen;
     }
 #endif

fs/procfs/fs_procfsproc.c

@@ -62,6 +62,7 @@
 #include <nuttx/lib/lib.h>
 
 #include "fs_heap.h"
+#include "sched/sched.h"
 
 #if !defined(CONFIG_SCHED_CPULOAD_NONE) || defined(CONFIG_SCHED_CRITMONITOR)
 #  include <nuttx/clock.h>
@@ -1462,7 +1463,6 @@ static int proc_open(FAR struct file *filep, FAR const char *relpath,
 {
   FAR struct proc_file_s *procfile;
   FAR const struct proc_node_s *node;
-  FAR struct tcb_s *tcb;
   FAR char *ptr;
   unsigned long tmp;
   pid_t pid;
@@ -1508,9 +1508,7 @@ static int proc_open(FAR struct file *filep, FAR const char *relpath,
   /* Now verify that a task with this task/thread ID exists */
 
   pid = (pid_t)tmp;
-
-  tcb = nxsched_get_tcb(pid);
-  if (tcb == NULL)
+  if (!nxsched_verify_pid(pid))
     {
       ferr("ERROR: PID %d is no longer valid\n", pid);
       return -ENOENT;
@@ -1663,6 +1661,8 @@ static ssize_t proc_read(FAR struct file *filep, FAR char *buffer,
 
   leave_critical_section(flags);
 
+  nxsched_put_tcb(tcb);
+
   /* Update the file offset */
 
   if (ret > 0)
@@ -1714,6 +1714,7 @@ static ssize_t proc_write(FAR struct file *filep, FAR const char *buffer,
         break;
     }
 
+  nxsched_put_tcb(tcb);
   return ret;
 }
 
@@ -1769,7 +1770,6 @@ static int proc_opendir(FAR const char *relpath,
 {
   FAR struct proc_dir_s *procdir;
   FAR const struct proc_node_s *node;
-  FAR struct tcb_s *tcb;
   unsigned long tmp;
   FAR char *ptr;
   pid_t pid;
@@ -1819,9 +1819,7 @@ static int proc_opendir(FAR const char *relpath,
   /* Now verify that a task with this task/thread ID exists */
 
   pid = (pid_t)tmp;
-
-  tcb = nxsched_get_tcb(pid);
-  if (tcb == NULL)
+  if (!nxsched_verify_pid(pid))
     {
       ferr("ERROR: PID %d is not valid\n", pid);
       return -ENOENT;
@@ -1911,7 +1909,6 @@ static int proc_readdir(FAR struct fs_dirent_s *dir,
 {
   FAR struct proc_dir_s *procdir;
   FAR const struct proc_node_s *node = NULL;
-  FAR struct tcb_s *tcb;
   unsigned int index;
   pid_t pid;
   int ret;
@@ -1939,9 +1936,7 @@ static int proc_readdir(FAR struct fs_dirent_s *dir,
       /* Verify that the pid still refers to an active task/thread */
 
       pid = procdir->pid;
-
-      tcb = nxsched_get_tcb(pid);
-      if (tcb == NULL)
+      if (!nxsched_verify_pid(pid))
         {
           ferr("ERROR: PID %d is no longer valid\n", pid);
           return -ENOENT;
@@ -2013,7 +2008,6 @@ static int proc_rewinddir(struct fs_dirent_s *dir)
 static int proc_stat(const char *relpath, struct stat *buf)
 {
   FAR const struct proc_node_s *node;
-  FAR struct tcb_s *tcb;
   unsigned long tmp;
   FAR char *ptr;
   pid_t pid;
@@ -2057,9 +2051,7 @@ static int proc_stat(const char *relpath, struct stat *buf)
   /* Now verify that a task with this task/thread ID exists */
 
   pid = (pid_t)tmp;
-
-  tcb = nxsched_get_tcb(pid);
-  if (tcb == NULL)
+  if (!nxsched_verify_pid(pid))
     {
       ferr("ERROR: PID %d is no longer valid\n", pid);
       return -ENOENT;

include/nuttx/mm/mm.h

@@ -152,7 +152,7 @@
     ((node) != NULL && (dump)->pid == (node)->pid)
 #  define MM_DUMP_LEAK(dump, node) \
     ((node) != NULL && (dump)->pid == PID_MM_LEAK && (node)->pid >= 0 && \
-     nxsched_get_tcb((node)->pid) == NULL)
+    !nxsched_verify_pid((node)->pid))
 #else
 #  define MM_DUMP_ALLOC(dump,node)  ((dump)->pid == PID_MM_ALLOC)
 #  define MM_DUMP_SEQNO(dump,node)  (true)

include/nuttx/sched.h

@@ -111,6 +111,7 @@
 #define TCB_FLAG_JOIN_COMPLETED    (1 << 14)                     /* Bit 14: Pthread join completed */
 #define TCB_FLAG_FREE_TCB          (1 << 15)                     /* Bit 15: Free tcb after exit */
 #define TCB_FLAG_PREEMPT_SCHED     (1 << 16)                     /* Bit 16: tcb is PREEMPT_SCHED */
+#define TCB_FLAG_KILL_PROCESSING   (1 << 17)                     /* Bit 17: tcb is killed */
 
 /* Values for struct task_group tg_flags */
 
@@ -227,6 +228,17 @@
 
 #define running_regs()               ((FAR void **)(g_running_tasks[this_cpu()]->xcp.regs))
 
+/****************************************************************************
+ * Name: nxsched_verify_pid
+ *
+ * Description:
+ *   Given a task ID, this function will check whether the
+ *   TCB corresponding to the PID exists.
+ *
+ ****************************************************************************/
+
+#define nxsched_verify_pid(pid)  (nxsched_get_tcb_noref(pid) != NULL)
+
 /****************************************************************************
  * Public Type Definitions
  ****************************************************************************/
@@ -727,6 +739,16 @@ struct tcb_s
   size_t level_deepest;
   size_t level;
 #endif
+
+  /* The total number that we are referenced by other tasks and
+   * The total number of other tasks that we referenced.
+   */
+
+  atomic_t refs;
+
+  /* When we exit, we need post this sem. */
+
+  sem_t    exit_sem;
 };
 
 /* struct task_tcb_s ********************************************************/
@@ -900,25 +922,22 @@ FAR struct tcb_s *nxsched_self(void);
 void nxsched_foreach(nxsched_foreach_t handler, FAR void *arg);
 
 /****************************************************************************
- * Name: nxsched_get_tcb
+ * Name: nxsched_get_tcb/nxsched_put_tcb
  *
  * Description:
- *   Given a task ID, this function will return the a pointer to the
- *   corresponding TCB (or NULL if there is no such task ID).
- *
- *   NOTE:  This function holds a critical section while examining TCB data
- *   data structures but releases that critical section before returning.
- *   When it is released, the TCB may become unstable.  If the caller
- *   requires absolute stability while using the TCB, then the caller
- *   should establish the critical section BEFORE calling this function and
- *   hold that critical section as long as necessary.
+ *   Given a task ID,
+ *   Obtain a valid TCB and increment the corresponding reference count to
+ *   prevent it from being released. nxsched_get_tcb and nxsched_put_tcb
+ *   must be called in pairs to ensure the proper release of the TCB.
  *
  ****************************************************************************/
 
 FAR struct tcb_s *nxsched_get_tcb(pid_t pid);
+FAR struct tcb_s *nxsched_get_tcb_noref(pid_t pid);
+void nxsched_put_tcb(FAR struct tcb_s *tcb);
 
 /****************************************************************************
- * Name:  nxsched_releasepid
+ * Name:  nxsched_release_tcb
  *
  * Description:
  *   When a task is destroyed, this function must be called to make its

libs/libc/gdbstub/lib_gdbstub.c

@@ -1028,6 +1028,8 @@ static void gdb_get_registers(FAR struct gdb_state_s *state)
             *(FAR uintptr_t *)(reg + g_tcbinfo.reg_off.p[i]);
         }
     }
+
+  nxsched_put_tcb(tcb);
 }
 
 /****************************************************************************
@@ -1424,6 +1426,7 @@ static int gdb_query(FAR struct gdb_state_s *state)
                 get_task_name(tcb), thread_state, tcb->sched_priority,
                 tcb->adj_stack_size);
 
+      nxsched_put_tcb(tcb);
       ret = gdb_bin2hex(state->pkt_buf, sizeof(state->pkt_buf),
                         thread_info, strlen(thread_info));
 
@@ -1502,6 +1505,7 @@ static int gdb_is_thread_active(FAR struct gdb_state_s *state)
 
   state->pid = pid - 1;
   gdb_send_ok_packet(state);
+  nxsched_put_tcb(tcb);
   return ret;
 }
 
@@ -1558,6 +1562,7 @@ static int gdb_thread_context(FAR struct gdb_state_s *state)
         }
 
       state->pid = pid - 1;
+      nxsched_put_tcb(tcb);
     }
 
   gdb_send_ok_packet(state);

mm/mm_heap/mm.h

@@ -103,6 +103,7 @@
              tmp->backtrace[0] = NULL; \
            } \
          MM_INCSEQNO(tmp); \
+         nxsched_put_tcb(tcb); \
        } \
      while (0)
 #else

mm/mm_heap/mm_memdump.c

@@ -283,6 +283,7 @@ void mm_memdump(FAR struct mm_heap_s *heap,
                            tcb->stack_alloc_ptr, tcb->adj_stack_size, name);
         }
 
+      nxsched_put_tcb(tcb);
       memdump_info_pool(&priv, heap);
     }
   else if (pid == PID_MM_FREE)

mm/tlsf/mm_tlsf.c

@@ -329,6 +329,8 @@ static void memdump_backtrace(FAR struct mm_heap_s *heap,
           buf->backtrace[ret] = NULL;
         }
     }
+
+  nxsched_put_tcb(tcb);
 #  endif
 }
 #endif
@@ -1262,6 +1264,7 @@ void mm_memdump(FAR struct mm_heap_s *heap,
                            tcb->stack_alloc_ptr, tcb->adj_stack_size, name);
         }
 
+      nxsched_put_tcb(tcb);
       memdump_info_pool(&priv, heap);
     }
   else if (pid == PID_MM_FREE)

sched/clock/clock_gettime.c

@@ -151,6 +151,11 @@ void nxclock_gettime(clockid_t clock_id, FAR struct timespec *tp)
               up_perf_convert(tcb->run_time, tp);
             }
         }
+
+      if (pid != 0)
+        {
+          nxsched_put_tcb(tcb);
+        }
 #endif
     }
 }

sched/group/group_continue.c

@@ -79,6 +79,8 @@ static int group_continue_handler(pid_t pid, FAR void *arg)
         {
           up_switch_context(this_task(), tcb);
         }
+
+      nxsched_put_tcb(rtcb);
     }
 
   /* Always return zero.  We need to visit each member of the group */

sched/group/group_exitinfo.c

@@ -84,6 +84,7 @@ int group_exitinfo(pid_t pid, FAR struct binary_s *bininfo)
   /* Get the group that this task belongs to */
 
   group = tcb->group;
+  nxsched_put_tcb(tcb);
   DEBUGASSERT(group != NULL && group->tg_bininfo == NULL);
 
   /* Save the binary info for use when the task exits */

sched/group/group_killchildren.c

@@ -112,10 +112,12 @@ static int group_cancel_children_handler(pid_t pid, FAR void *arg)
 
           if ((rtcb->flags & TCB_FLAG_TTYPE_MASK) == TCB_FLAG_TTYPE_PTHREAD)
             {
+              nxsched_put_tcb(rtcb);
               ret = pthread_cancel(pid);
             }
           else
             {
+              nxsched_put_tcb(rtcb);
               ret = nxtask_delete(pid);
             }