修复thread被释放后内存被重复访问的问题

mkrtos_user/lib/sys/src/u_thread.c

@@ -68,8 +68,8 @@ msg_tag_t thread_run(obj_handler_t obj, uint8_t prio)
     register volatile umword_t r0 asm("r0");
 
     syscall(syscall_prot_create(RUN_THREAD, THREAD_PROT, obj),
-            prio,
             0,
+            prio,
             0,
             0,
             0,

mkrtos_user/lib/sys_util/src/u_hd_man.c

@@ -55,6 +55,10 @@ obj_handler_t handler_alloc(void)
 void handler_free(obj_handler_t hd_inx)
 {
     hd_inx -= HANDLER_START_INX;
+    if (hd_inx < 0)
+    {
+        return;
+    }
     umword_t word_offset = hd_inx / WORD_BITS;
     umword_t bits_offset = hd_inx % WORD_BITS;
 
@@ -73,6 +77,6 @@ void handler_free(obj_handler_t hd_inx)
  */
 void handler_free_umap(obj_handler_t hd_inx)
 {
-    task_unmap(TASK_THIS, vpage_create_raw3(0, 0, hd_inx));
     handler_free(hd_inx);
+    task_unmap(TASK_THIS, vpage_create_raw3(0, 0, hd_inx));
 }

mkrtos_user/server/init/src/main.c

@@ -33,28 +33,30 @@ int main(int argc, char *args[])
     mm_test();
     app_test();
     mpu_test();
-#endif
     ipc_test();
-    uenv_t env = *u_get_global_env();
-    obj_handler_t ipc_hd;
-    int ret = rpc_creaite_bind_ipc(THREAD_MAIN, NULL, &ipc_hd);
-    assert(ret >= 0);
-    env.ns_hd = ipc_hd;
+#endif
+    thread_press_test();
+    // uenv_t env = *u_get_global_env();
+    // obj_handler_t ipc_hd;
+    // int ret = rpc_creaite_bind_ipc(THREAD_MAIN, NULL, &ipc_hd);
+    // assert(ret >= 0);
+    // env.ns_hd = ipc_hd;
 
-    // ret = app_load("fatfs", &env);
+    // // ret = app_load("fatfs", &env);
+    // // if (ret < 0)
+    // // {
+    // //     printf("app load fail, 0x%x\n", ret);
+    // // }
+
+    // ret = app_load("app", &env);
     // if (ret < 0)
     // {
     //     printf("app load fail, 0x%x\n", ret);
     // }
-
-    ret = app_load("app", &env);
-    if (ret < 0)
-    {
-        printf("app load fail, 0x%x\n", ret);
-    }
     // namespace_init(ipc_hd);
 
     // namespace_loop();
+    while(1);
     task_unmap(TASK_THIS, vpage_create_raw3(KOBJ_DELETE_RIGHT, 0, TASK_THIS)); // 删除当前task，以及申请得所有对象
     printf("exit init.\n");
     return 0;

mkrtos_user/server/init/src/test/test.h

@@ -13,3 +13,5 @@ void thread_exit_test(void);
 void map_test(void);
 void ipc_timeout_test(void);
 void irq_test(void);
+void thread_press_test(void);
+void sleep_tick(int tick);

mkrtos_user/server/init/src/test/thread_press_test.c

@@ -0,0 +1,53 @@
+#include "u_log.h"
+#include "u_prot.h"
+#include "u_mm.h"
+#include "u_factory.h"
+#include "u_thread.h"
+#include "u_task.h"
+#include "u_ipc.h"
+#include "u_hd_man.h"
+#include <assert.h>
+#include <stdio.h>
+#include "test.h"
+static umword_t th1_hd = 0;
+static umword_t ipc_hd = 0;
+
+#define STACK_SIZE 1024
+static __attribute__((aligned(8))) uint8_t stack0[STACK_SIZE];
+
+static void thread_test_func(void)
+{
+    // char *buf;
+    // umword_t len;
+    // thread_msg_buf_get(th1_hd, (umword_t *)(&buf), NULL);
+    // printf("thread_test_func.\n");
+    ulog_write_str(LOG_PROT, ".");
+    // task_unmap(TASK_PROT, vpage_create_raw3(KOBJ_DELETE_RIGHT, 0, th1_hd));
+    handler_free_umap(ipc_hd);
+    handler_free_umap(th1_hd);
+    printf("Error\n");
+}
+
+void thread_press_test(void)
+{
+    int i = 100;
+    while (i--)
+    {
+        th1_hd = handler_alloc();
+        assert(th1_hd != HANDLER_INVALID);
+        ipc_hd = handler_alloc();
+        assert(ipc_hd != HANDLER_INVALID);
+
+        msg_tag_t tag = factory_create_ipc(FACTORY_PROT, vpage_create_raw3(KOBJ_ALL_RIGHTS, 0, ipc_hd));
+        assert(msg_tag_get_prot(tag) >= 0);
+        tag = factory_create_thread(FACTORY_PROT, vpage_create_raw3(KOBJ_ALL_RIGHTS, 0, th1_hd));
+        assert(msg_tag_get_prot(tag) >= 0);
+        tag = thread_exec_regs(th1_hd, (umword_t)thread_test_func, (umword_t)stack0 + STACK_SIZE, RAM_BASE(), 0);
+        assert(msg_tag_get_prot(tag) >= 0);
+        tag = thread_bind_task(th1_hd, TASK_THIS);
+        assert(msg_tag_get_prot(tag) >= 0);
+        tag = thread_run(th1_hd, 2);
+        ulog_write_str(LOG_PROT, "\n");
+        // sleep_tick(20);
+    }
+}

mkrtos_user/server/init/src/test/util_test.c

@@ -0,0 +1,17 @@
+#include "u_log.h"
+#include "u_prot.h"
+#include "u_mm.h"
+#include "u_factory.h"
+#include "u_thread.h"
+#include "u_task.h"
+#include "u_ipc.h"
+#include "u_hd_man.h"
+
+void sleep_tick(int tick)
+{
+    obj_handler_t hd = handler_alloc();
+
+    factory_create_ipc(FACTORY_PROT, vpage_create_raw3(KOBJ_ALL_RIGHTS, 0, hd));
+    ipc_call(hd, msg_tag_init4(0, 0, 0, 0), ipc_timeout_create2(tick, 0));
+    handler_free_umap(hd);
+}