casaroli opened a new pull request, #20509: URL: https://github.com/apache/nuttx/pull/20509
## Summary In `CONFIG_BUILD_PROTECTED`, `riscv_fault_handler()` can kill only the user task that faulted, but the whole recovery block is inside `#ifdef CONFIG_ARCH_KERNEL_STACK`. Configurations without a kernel stack, such as `rv-virt:pnsh` and `rv-virt:pnsh64`, fall through to `PANIC_WITH_REGS()`, so one bad user access stops the whole system. Only the `REG_SP = tcb->xcp.ktopstk` line needs a kernel stack. This change narrows the guard to that line. Without a kernel stack, the exception frame and all system calls of the task already run on the user stack, so `_exit` running there is not a new exposure. Such a build cannot select `CONFIG_ARCH_ADDRENV`, so the stack stays mapped. ## Impact Protected builds without a kernel stack now kill only the offending task with SIGSEGV and continue to run. The recovery runs only for faults from U-mode, so flat builds keep the panic path. Kernel builds select `ARCH_KERNEL_STACK`, so their code does not change. ## Testing QEMU, `rv-virt:pnsh` and `rv-virt:pnsh64` with apps `examples/sandbox` and `ostest`, xPack riscv-none-elf-gcc 14.3.0. `rv-virt:knsh` builds, and its `riscv_exception.o` differs only in the `__LINE__` value of the PANIC call. Note: on current master, pnsh and pnsh64 do not start the shell (`Error Starting service 'console': 2`). Since #20119 moved them to nxinit, nxinit needs a `boardctl(BOARDIOC_BUILTINS)` call that is not in apps master. I added it locally for this test only. Before (master), `sandbox kernel`: ``` riscv_exception: EXCEPTION: Load access fault. MCAUSE: 00000005, EPC: 80041f88, MTVAL: 8003fff0 riscv_fault_handler: PANIC!!! Exception = 00000005 dump_assert_info: Assertion failed panic: at file: common/riscv_exception.c:146 task: sandbox process: sandbox 0x80041dc0 ``` After: ``` riscv_exception: EXCEPTION: Load access fault. MCAUSE: 00000005, EPC: 80041f88, MTVAL: 8003fff0 riscv_fault_handler: Segmentation fault in sandbox (PID 9: sandbox) sandbox: the offender exited with status 2816 sandbox: PASS - the offending process was terminated sandbox: PASS - this process survived sandbox: PASS - another thread ran (8 -> 22) ``` The same result occurs for a write, and on pnsh64. The shell, `ps` and `hello` work after the fault. `ostest` exits with status 0 on pnsh and pnsh64, before and after this change. `tools/checkpatch.sh -c -u -m -g` passes. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
