Fixed race condition and message loss in Cortex-M ports (#523)

* Fixed race condition and message loss in Cortex-M GNU, AC6, and IAR ports (#516)

- Added compiler memory barriers to BASEPRI management functions in tx_port.h.
- Added architectural barriers (DSB/ISB) to scheduler return paths in tx_port.h and tx_thread_system_return.S to prevent fall-through before context switch.
- These changes address spurious thread resumption and lost messages, especially when TX_NOT_INTERRUPTABLE is enabled.
- These changes ensure that pending interrupts (specifically PendSV) are recognised before subsequent instructions are executed, following Kairalite's feedback and ARM architectural guidelines.

 Assisted-by: Gemini (Gemini 2.0 Flash)

-----

* Added a comment in common/tx_queue_cleanup to document why the NI path omits revalidation guards

- In `TX_NOT_INTERRUPTABLE` mode, the caller keeps interrupts disabled across the entire cleanup call, so the race window that makes the guards necessary in the interruptable path cannot occur. Add a comment explaining this, and noting that all paths that resume a suspended thread clear tx_thread_suspend_cleanup before calling
_tx_thread_system_ni_resume, making double-cleanup impossible.

This prevents future false-positive suggestions (e.g. from AI tools) to add redundant checks to the NI path.

Relates to: eclipse-threadx/threadx#516

Co-authored-by: Copilot <[email protected]>

1 files changed, 13 insertions, 0 deletions

diff --git a/common/src/tx_queue_cleanup.c b/common/src/tx_queue_cleanup.c
index 05a423b3..90607183 100644
--- a/common/src/tx_queue_cleanup.c
+++ b/common/src/tx_queue_cleanup.c
@@ -109,6 +109,19 @@ TX_THREAD           *previous_thread;
                     {
 #else
 
+                        /* TX_NOT_INTERRUPTABLE path: the revalidation guards present in the
+                           interruptable path above (cleanup pointer, suspension sequence, NULL
+                           queue pointer, queue ID, and suspended count checks) are intentionally
+                           omitted here.  Those guards exist to handle the race window that opens
+                           when the interruptable path calls TX_RESTORE before invoking cleanup,
+                           allowing another context to service or abort the suspension in between.
+                           In TX_NOT_INTERRUPTABLE mode the caller keeps interrupts disabled across
+                           the entire cleanup call, so that race window never exists.  Additionally,
+                           every path that resumes a suspended thread (tx_queue_send, tx_queue_receive,
+                           tx_queue_flush, tx_queue_delete) clears tx_thread_suspend_cleanup before
+                           calling _tx_thread_system_ni_resume, making a double-cleanup impossible
+                           under the NI serialisation guarantee.  */
+
                         /* Setup pointer to queue control block.  */
                         queue_ptr =  TX_VOID_TO_QUEUE_POINTER_CONVERT(thread_ptr -> tx_thread_suspend_control_block);
 #endif