sched: add a reference count to the TCB to prevent it from being deleted.

arch/arm/src/armv7-m/arm_svcall.c

@@ -240,7 +240,7 @@ int arm_svcall(int irq, void *context, void *arg)
        *   R4 = ucontext
        */
 
-#ifdef CONFIG_BUILD_PROTECTED
+#if defined(CONFIG_BUILD_PROTECTED) && defined(CONFIG_ENABLE_ALL_SIGNALS)
       case SYS_signal_handler:
         {
           struct tcb_s *rtcb   = this_task();
@@ -282,7 +282,7 @@ int arm_svcall(int irq, void *context, void *arg)
        *   R0 = SYS_signal_handler_return
        */
 
-#ifdef CONFIG_BUILD_PROTECTED
+#if defined(CONFIG_BUILD_PROTECTED) && defined(CONFIG_ENABLE_ALL_SIGNALS)
       case SYS_signal_handler_return:
         {
           struct tcb_s *rtcb   = this_task();

arch/risc-v/src/common/riscv_exception.c

@@ -111,6 +111,7 @@ int riscv_exception(int mcause, void *regs, void *args)
       _alert("Segmentation fault in %s (PID %d: %s)\n", get_task_name(ptcb),
              tcb->pid, get_task_name(tcb));
 
+      nxsched_put_tcb(ptcb);
       tcb->flags |= TCB_FLAG_FORCED_CANCEL;
 
       /* Return to _exit function in privileged mode with argument SIGSEGV */

boards/arm/sam34/sam3u-ek/configs/knsh/defconfig

@@ -6,11 +6,9 @@
 # modifications.
 #
 # CONFIG_ARCH_RAMFUNCS is not set
-# CONFIG_LIBC_TEMPBUFFER is not set
 # CONFIG_MMCSD_HAVE_CARDDETECT is not set
 # CONFIG_MMCSD_MMCSUPPORT is not set
 # CONFIG_NSH_DISABLE_IFCONFIG is not set
-# CONFIG_SYSTEM_DD is not set
 CONFIG_ARCH="arm"
 CONFIG_ARCH_BOARD="sam3u-ek"
 CONFIG_ARCH_BOARD_SAM3UEK=y
@@ -24,19 +22,13 @@ CONFIG_ARM_MPU=y
 CONFIG_ARM_TOOLCHAIN_BUILDROOT_OABI=y
 CONFIG_BOARD_LOOPSPERMSEC=8720
 CONFIG_BUILD_PROTECTED=y
-CONFIG_DISABLE_PTHREAD=y
+CONFIG_DEFAULT_SMALL=y
 CONFIG_FS_FAT=y
 CONFIG_INIT_ENTRYPOINT="nsh_main"
-CONFIG_LINE_MAX=64
 CONFIG_MMCSD=y
 CONFIG_MM_REGIONS=3
-CONFIG_NSH_DISABLE_LOSETUP=y
-CONFIG_NSH_DISABLE_MKRD=y
-CONFIG_NSH_FILEIOSIZE=512
-CONFIG_NSH_READLINE=y
 CONFIG_NUTTX_USERSPACE=0x00090000
 CONFIG_PASS1_BUILDIR="boards/arm/sam34/sam3u-ek/kernel"
-CONFIG_PREALLOC_TIMERS=4
 CONFIG_RAM_SIZE=32768
 CONFIG_RAM_START=0x20000000
 CONFIG_RR_INTERVAL=200

boards/arm/sam34/sam3u-ek/kernel/sam_userspace.c

@@ -94,7 +94,9 @@ const struct userspace_s userspace locate_data(".userspace") =
 
   /* Signal handler trampoline */
 
+#ifdef CONFIG_ENABLE_ALL_SIGNALS
   .signal_handler   = up_signal_handler,
+#endif
 
   /* User-space work queue support (declared in include/nuttx/wqueue.h) */
 

drivers/note/note_driver.c

@@ -2106,6 +2106,7 @@ FAR char *note_get_taskname(pid_t pid, FAR char *buf, size_t len)
   if (tcb != NULL)
     {
       strlcpy(buf, tcb->name, len);
+      nxsched_put_tcb(tcb);
       return buf;
     }
 

drivers/syslog/vsyslog.c

@@ -36,6 +36,7 @@
 #include <nuttx/streams.h>
 #include <nuttx/syslog/syslog.h>
 
+#include "sched/sched.h"
 #include "syslog.h"
 
 /****************************************************************************

fs/inode/fs_files.c

@@ -265,6 +265,7 @@ static void task_fssync(FAR struct tcb_s *tcb, FAR void *arg)
           ctcb = nxsched_get_tcb(pid);
           if (ctcb == NULL || ctcb->group == NULL || ctcb != tcb)
             {
+              nxsched_put_tcb(ctcb);
               return;
             }
 
@@ -274,6 +275,8 @@ static void task_fssync(FAR struct tcb_s *tcb, FAR void *arg)
               file_fsync(filep);
               file_put(filep);
             }
+
+          nxsched_put_tcb(ctcb);
         }
     }
 }

fs/procfs/fs_procfs.c

@@ -942,8 +942,7 @@ static int procfs_readdir(FAR struct inode *mountpt,
           /* Verify that the pid still refers to an active task/thread */
 
           pid_t pid = level0->pid[index];
-          FAR struct tcb_s *tcb = nxsched_get_tcb(pid);
-          if (!tcb)
+          if (!nxsched_verify_pid(pid))
             {
               ferr("ERROR: PID %d is no longer valid\n", pid);
               return -ENOENT;

fs/procfs/fs_procfsmeminfo.c

@@ -540,6 +540,7 @@ static ssize_t memdump_write(FAR struct file *filep, FAR const char *buffer,
         }
 
       tcb->flags |= TCB_FLAG_HEAP_DUMP;
+      nxsched_put_tcb(tcb);
       return buflen;
     }
   else if ((p = strstr(buffer, "off")) != NULL)
@@ -553,6 +554,7 @@ static ssize_t memdump_write(FAR struct file *filep, FAR const char *buffer,
         }
 
       tcb->flags &= ~TCB_FLAG_HEAP_DUMP;
+      nxsched_put_tcb(tcb);
       return buflen;
     }
 #endif

fs/procfs/fs_procfsproc.c

@@ -62,6 +62,7 @@
 #include <nuttx/lib/lib.h>
 
 #include "fs_heap.h"
+#include "sched/sched.h"
 
 #if !defined(CONFIG_SCHED_CPULOAD_NONE) || defined(CONFIG_SCHED_CRITMONITOR)
 #  include <nuttx/clock.h>
@@ -1526,7 +1527,6 @@ static int proc_open(FAR struct file *filep, FAR const char *relpath,
 {
   FAR struct proc_file_s *procfile;
   FAR const struct proc_node_s *node;
-  FAR struct tcb_s *tcb;
   FAR char *ptr;
   unsigned long tmp;
   pid_t pid;
@@ -1572,9 +1572,7 @@ static int proc_open(FAR struct file *filep, FAR const char *relpath,
   /* Now verify that a task with this task/thread ID exists */
 
   pid = (pid_t)tmp;
-
-  tcb = nxsched_get_tcb(pid);
-  if (tcb == NULL)
+  if (!nxsched_verify_pid(pid))
     {
       ferr("ERROR: PID %d is no longer valid\n", pid);
       return -ENOENT;
@@ -1727,6 +1725,8 @@ static ssize_t proc_read(FAR struct file *filep, FAR char *buffer,
 
   leave_critical_section(flags);
 
+  nxsched_put_tcb(tcb);
+
   /* Update the file offset */
 
   if (ret > 0)
@@ -1778,6 +1778,7 @@ static ssize_t proc_write(FAR struct file *filep, FAR const char *buffer,
         break;
     }
 
+  nxsched_put_tcb(tcb);
   return ret;
 }
 
@@ -1833,7 +1834,6 @@ static int proc_opendir(FAR const char *relpath,
 {
   FAR struct proc_dir_s *procdir;
   FAR const struct proc_node_s *node;
-  FAR struct tcb_s *tcb;
   unsigned long tmp;
   FAR char *ptr;
   pid_t pid;
@@ -1883,9 +1883,7 @@ static int proc_opendir(FAR const char *relpath,
   /* Now verify that a task with this task/thread ID exists */
 
   pid = (pid_t)tmp;
-
-  tcb = nxsched_get_tcb(pid);
-  if (tcb == NULL)
+  if (!nxsched_verify_pid(pid))
     {
       ferr("ERROR: PID %d is not valid\n", pid);
       return -ENOENT;
@@ -1975,7 +1973,6 @@ static int proc_readdir(FAR struct fs_dirent_s *dir,
 {
   FAR struct proc_dir_s *procdir;
   FAR const struct proc_node_s *node = NULL;
-  FAR struct tcb_s *tcb;
   unsigned int index;
   pid_t pid;
   int ret;
@@ -2003,9 +2000,7 @@ static int proc_readdir(FAR struct fs_dirent_s *dir,
       /* Verify that the pid still refers to an active task/thread */
 
       pid = procdir->pid;
-
-      tcb = nxsched_get_tcb(pid);
-      if (tcb == NULL)
+      if (!nxsched_verify_pid(pid))
         {
           ferr("ERROR: PID %d is no longer valid\n", pid);
           return -ENOENT;
@@ -2077,7 +2072,6 @@ static int proc_rewinddir(struct fs_dirent_s *dir)
 static int proc_stat(const char *relpath, struct stat *buf)
 {
   FAR const struct proc_node_s *node;
-  FAR struct tcb_s *tcb;
   unsigned long tmp;
   FAR char *ptr;
   pid_t pid;
@@ -2121,9 +2115,7 @@ static int proc_stat(const char *relpath, struct stat *buf)
   /* Now verify that a task with this task/thread ID exists */
 
   pid = (pid_t)tmp;
-
-  tcb = nxsched_get_tcb(pid);
-  if (tcb == NULL)
+  if (!nxsched_verify_pid(pid))
     {
       ferr("ERROR: PID %d is no longer valid\n", pid);
       return -ENOENT;

include/nuttx/mm/mm.h

@@ -154,7 +154,7 @@
     ((node) != NULL && (dump)->pid == (node)->pid)
 #  define MM_DUMP_LEAK(dump, node) \
     ((node) != NULL && (dump)->pid == PID_MM_LEAK && (node)->pid >= 0 && \
-     nxsched_get_tcb((node)->pid) == NULL)
+    !nxsched_verify_pid((node)->pid))
 #else
 #  define MM_DUMP_ALLOC(dump,node)  ((dump)->pid == PID_MM_ALLOC)
 #  define MM_DUMP_SEQNO(dump,node)  (true)

include/nuttx/sched.h

@@ -110,6 +110,7 @@
 #define TCB_FLAG_JOIN_COMPLETED    (1 << 14)                     /* Bit 14: Pthread join completed */
 #define TCB_FLAG_FREE_TCB          (1 << 15)                     /* Bit 15: Free tcb after exit */
 #define TCB_FLAG_PREEMPT_SCHED     (1 << 16)                     /* Bit 16: tcb is PREEMPT_SCHED */
+#define TCB_FLAG_KILL_PROCESSING   (1 << 17)                     /* Bit 17: tcb is killed */
 
 /* Values for struct task_group tg_flags */
 
@@ -226,6 +227,17 @@
 
 #define running_regs()               ((FAR void **)(g_running_tasks[this_cpu()]->xcp.regs))
 
+/****************************************************************************
+ * Name: nxsched_verify_pid
+ *
+ * Description:
+ *   Given a task ID, this function will check whether the
+ *   TCB corresponding to the PID exists.
+ *
+ ****************************************************************************/
+
+#define nxsched_verify_pid(pid)  (nxsched_get_tcb_noref(pid) != NULL)
+
 /****************************************************************************
  * Public Type Definitions
  ****************************************************************************/
@@ -729,6 +741,16 @@ struct tcb_s
   size_t level_deepest;
   size_t level;
 #endif
+
+  /* The total number that we are referenced by other tasks and
+   * The total number of other tasks that we referenced.
+   */
+
+  atomic_t refs;
+
+  /* When we exit, we need post this sem. */
+
+  sem_t    exit_sem;
 };
 
 /* struct pthread_tcb_s *****************************************************/
@@ -884,25 +906,22 @@ FAR struct tcb_s *nxsched_self(void);
 void nxsched_foreach(nxsched_foreach_t handler, FAR void *arg);
 
 /****************************************************************************
- * Name: nxsched_get_tcb
+ * Name: nxsched_get_tcb/nxsched_put_tcb
  *
  * Description:
- *   Given a task ID, this function will return the a pointer to the
- *   corresponding TCB (or NULL if there is no such task ID).
- *
- *   NOTE:  This function holds a critical section while examining TCB data
- *   data structures but releases that critical section before returning.
- *   When it is released, the TCB may become unstable.  If the caller
- *   requires absolute stability while using the TCB, then the caller
- *   should establish the critical section BEFORE calling this function and
- *   hold that critical section as long as necessary.
+ *   Given a task ID,
+ *   Obtain a valid TCB and increment the corresponding reference count to
+ *   prevent it from being released. nxsched_get_tcb and nxsched_put_tcb
+ *   must be called in pairs to ensure the proper release of the TCB.
  *
  ****************************************************************************/
 
 FAR struct tcb_s *nxsched_get_tcb(pid_t pid);
+FAR struct tcb_s *nxsched_get_tcb_noref(pid_t pid);
+void nxsched_put_tcb(FAR struct tcb_s *tcb);
 
 /****************************************************************************
- * Name:  nxsched_releasepid
+ * Name:  nxsched_release_tcb
  *
  * Description:
  *   When a task is destroyed, this function must be called to make its

include/sys/syscall_lookup.h

@@ -397,7 +397,9 @@ SYSCALL_LOOKUP(settimeofday,               2)
 
 /* ANSI C signal handling */
 
+#ifdef CONFIG_ENABLE_ALL_SIGNALS
 SYSCALL_LOOKUP(signal,                     2)
+#endif
 
 #ifdef CONFIG_SCHED_INSTRUMENTATION_DUMP
   SYSCALL_LOOKUP(sched_note_vprintf_ip,    5)

libs/libc/gdbstub/lib_gdbstub.c

@@ -1032,6 +1032,8 @@ static void gdb_get_registers(FAR struct gdb_state_s *state)
             *(FAR uintptr_t *)(reg + g_tcbinfo.reg_off.p[i]);
         }
     }
+
+  nxsched_put_tcb(tcb);
 }
 
 /****************************************************************************
@@ -1428,6 +1430,7 @@ static int gdb_query(FAR struct gdb_state_s *state)
                 get_task_name(tcb), thread_state, tcb->sched_priority,
                 tcb->adj_stack_size);
 
+      nxsched_put_tcb(tcb);
       ret = gdb_bin2hex(state->pkt_buf, sizeof(state->pkt_buf),
                         thread_info, strlen(thread_info));
 
@@ -1506,6 +1509,7 @@ static int gdb_is_thread_active(FAR struct gdb_state_s *state)
 
   state->pid = pid - 1;
   gdb_send_ok_packet(state);
+  nxsched_put_tcb(tcb);
   return ret;
 }
 
@@ -1562,6 +1566,7 @@ static int gdb_thread_context(FAR struct gdb_state_s *state)
         }
 
       state->pid = pid - 1;
+      nxsched_put_tcb(tcb);
     }
 
   gdb_send_ok_packet(state);

mm/mm_heap/mm.h

@@ -103,6 +103,7 @@
              tmp->backtrace[0] = NULL; \
            } \
          MM_INCSEQNO(tmp); \
+         nxsched_put_tcb(tcb); \
        } \
      while (0)
 #else

mm/mm_heap/mm_memdump.c

@@ -283,6 +283,7 @@ void mm_memdump(FAR struct mm_heap_s *heap,
                            tcb->stack_alloc_ptr, tcb->adj_stack_size, name);
         }
 
+      nxsched_put_tcb(tcb);
       memdump_info_pool(&priv, heap);
     }
   else if (pid == PID_MM_FREE)

mm/tlsf/mm_tlsf.c

@@ -333,6 +333,8 @@ static void memdump_backtrace(FAR struct mm_heap_s *heap,
           buf->backtrace[ret] = NULL;
         }
     }
+
+  nxsched_put_tcb(tcb);
 #  endif
 }
 #endif
@@ -1292,6 +1294,7 @@ void mm_memdump(FAR struct mm_heap_s *heap,
                            tcb->stack_alloc_ptr, tcb->adj_stack_size, name);
         }
 
+      nxsched_put_tcb(tcb);
       memdump_info_pool(&priv, heap);
     }
   else if (pid == PID_MM_FREE)