An unprivileged task that touched memory it does not own took the whole
system down. The MMU refused the access, as it should, and then
x86_64_fault_panic_isr() panicked -- so a contained application bug
became a system-wide outage. x86_64 had no user-fault recovery at all,
while arm64, RISC-V and esp32s3 each have one, and ISR13 and ISR14 here
went straight to a handler whose own comment says "Don't even brother
to recover, just dump the regs and PANIC."
The decision has to be made in the handler. The user-task check in
_assert() looks like it already covers this, but a fault arrives as an
exception, so up_interrupt_context() is already true by the time it is
reached and the panic branch is taken no matter who faulted.
The CPL in the saved CS is the whole test, and on this architecture it
is exact: everything that runs on behalf of a user task inside the
kernel -- a system call body, an interrupt handler, a kernel thread --
runs in ring 0, so a fault there is correctly refused recovery. That is
what RISC-V reads out of STATUS_PPP and arm64 out of SPSR_MODE_EL0T.
x86_64 cannot use TCB_FLAG_SYSCALL the way those two do: it has never
set it, and making it do so is a separate change with its own hazards
(see the note in x86_64_syscall()). The task type is checked as well,
as RISC-V does, so that a frame that cannot be trusted -- an early-boot
fault, before any user task exists -- cannot talk its way in with a
stale selector.
Recovery is the same shape as the other architectures -- RIP to _exit,
first argument SIGSEGV, TCB_FLAG_FORCED_CANCEL raised -- plus the three
x86_64 specifics:
* CS and SS move to the kernel selectors together with RIP. The frame
being rewritten is the one x86_64_fullcontextrestore() is about to
iretq from, and iretq takes the target privilege level from the CS
it pops; in long mode it pops SS with it even when the level does
not change.
* RSP moves to the top of the task's own kernel stack. _exit() must
not run on the user stack the fault came from, because the address
environment that stack belongs to is torn down while _exit() is
still running. The kernel stack is free -- the fault was taken in
user mode, so no system call of this task is in flight. The -8
reproduces the offset a call would have left, which is what the SysV
ABI states its 16-byte rule against and what up_initial_state() sets
up for the same reason.
* RFLAGS is reset to the value up_initial_state() gives a new thread
rather than carried over. The faulting task's flags are its own to
set, and DF in particular must be clear on entry to any C function.
ISR6 is routed through the same handler. An invalid opcode is
attributable to the instruction that raised it, so a user task running
garbage should die on its own rather than take the system with it --
the same conclusion esp32s3 reached for EXCCAUSE_ILLEGAL. ISR8 keeps
panicking unconditionally: a double fault says an exception could not be
delivered at all, and there is nothing left to trust.
The message gives the fault address (CR2) only for a page fault, because
the other exceptions do not set CR2.
X86_GDT_PL_MASK and X86_GDT_RPL_USER now live in intel64/arch.h beside
the selectors they mask; x86_64_fork.c had a private copy of the latter.
Verified on qemu-intel64:knsh_romfs under QEMU TCG with
apps/examples/sandbox. The probe targets kernel .text at _stext
(0x100909000). This config sets CONFIG_RAM_START to 0x0, a Kconfig
default, so the address is given on the command line. The "x" probes
call the address; that mode was added to the sandbox locally for the
test.
sandbox r 0x100909000 -> Exception 14, error code 5, 2816
sandbox w 0x100909000 -> Exception 14, error code 7, 2816
sandbox x 0x100909000 -> Exception 14 at RIP=100909000, 2816
sandbox r 0x8000000000000000 -> Exception 13 (non-canonical), 2816
sandbox x 0x80000000d -> Exception 6 at RIP=80000000d, 2816
All five probes run in one boot and report CONTAINED. The offender
dies with SIGSEGV, the parent survives, a canary thread keeps running,
and the memory and descriptors of the offender come back. The shell
answers after the last probe. Without this change each probe panics
the system.
ostest exits with status 0 on knsh_romfs, fork and vfork included. It
also exits with status 0 on the flat qemu-intel64:nsh with
CONFIG_SCHED_THREAD_LOCAL disabled. With it enabled, ostest faults in
sched_thread_local_test() with and without this change.
Each vector is reached deliberately. A non-canonical address is a #GP
rather than a #PF, which the read and call probes never produce on their
own. The #UD needs no corrupt binary either: the crt0 stub this
architecture links into every user ELF already ends in a ud2 at
_stext+0xd, and with CONFIG_ARCH_TEXT_VBASE at 0x800000000 the call
probe can simply be aimed at it, executing an invalid opcode in ring 3
out of the process's own text.
The negative direction was checked too, on the flat build, where the
same non-canonical read is taken at CPL 0: it reaches
x86_64_fault_panic_isr() exactly as before and panics with a full
register dump reporting CPL 0.
Assisted-by: Claude Code:claude-opus-5-5
Signed-off-by: Marco Casaroli <marco.casaroli@gmail.com>
Remove the per-arch testset implementation from the spinlock layer.
The testset abstraction predates the unified spinlock.h API and is no
longer used now that all arches provide spin_lock_irqsave()/
spin_unlock_irqrestore() directly. Drop the per-arch *_testset.{c,S}
implementations and spinlock.h files for arm, sim, sparc, tricore,
x86_64, and xtensa, along with the CXD56_TESTSET,
CXD56_TESTSET_WITH_HWSEM, and CXD56_ATOMIC_WITH_HWSEM Kconfig options
in arch/arm/src/cxd56xx, and simplify the CXD56 semaphore pool loop
in cxd56_sph.c to a single unconditional range.
Signed-off-by: zhangyu117 <zhangyu117@xiaomi.com>
Add support for legacy xAPIC alongside x2APIC.
This way we can run nuttx x86_64 on qemu without the --enable-kvm option
Signed-off-by: p-szafonimateusz <p-szafonimateusz@xiaomi.com>
In a kernel build vfork() is reached through a system call, so the return
address and stack pointer the architecture's entry point can see for itself
are the kernel's, not the caller's. A child built from those resumes at a
kernel address, which is why x86_64 selected the fork family only for the
flat build.
x86_64_syscall() now publishes the caller's frame in xcp.sregs for the
duration of the stub call, and x86_64_fork() builds the child from it:
x86_64_fork_syscall() when xcp.sregs is non-NULL, so that the child
returns from the very same `syscall' instruction as
the parent, in user mode, on its own stack;
x86_64_fork_direct() otherwise, which is the flat build and any kernel
thread that calls the entry point as a plain
function.
The discriminator is xcp.sregs rather than TCB_FLAG_SYSCALL, which arm64 and
RISC-V use: that flag also defers signal actions, x86_64 has never raised it,
and its kernel-build signal path does not survive being made to -- a
pre-existing problem that does not belong to this work.
Two properties of SYSCALL/SYSRET shape the child's frame. The instruction
leaves the caller's RIP and RFLAGS in RCX and R11 rather than on a stack, so
they are moved into the RIP and RFLAGS slots of the interrupt frame the child
is resumed from; and the hardware never records the caller's CS and SS at all,
SYSRETQ reconstructing them from IA32_STAR, so the child's are filled in with
the user code and data selectors at RPL 3. The frame is therefore not copied
wholesale: the extended state and the general registers are inherited, while
the segment registers and the thread pointer stay as up_initial_state() left
them, the child's stack being a fresh allocation the parent's FS base does not
describe.
x86_64_fork_relocfp() is new and is not optional here. A function returns
with `leave', which feeds the frame pointer into the stack pointer, so
relocating only the RBP the child resumes with gets it exactly one frame:
the next return loads a saved RBP still pointing into the parent's stack.
With that in place ARCH_X86_64 can select ARCH_HAVE_VFORK unconditionally.
Build-verified on qemu-intel64:knsh_romfs and qemu-intel64:ostest. NuttX on
qemu-intel64 requires tsc-deadline and pcid, which TCG does not implement, so
it cannot be run on this host.
Assisted-by: Claude Code:claude-opus-5
Signed-off-by: Marco Casaroli <marco.casaroli@gmail.com>
Signed-off-by: humzak711 <humzak711@gmail.com>
This commit defines the UP_WFE() macro as the 'pause' instruction for
x86_64. This optimization reduces power consumption and prevents
pipeline flushes caused by memory ordering violations during contended
spinlock acqusitions
Rename STACK_ALIGNMENT macro to STACKFRAME_ALIGN throughout the codebase
to provide clearer naming semantics. The new name better reflects the macro's
purpose of frame alignment rather than general stack alignment.
Signed-off-by: hujun5 <hujun5@xiaomi.com>
When an interrupt occurs, the hardware automatically pushes the current RIP/RSP onto the interrupt stack. During the interrupt return, the iretq instruction pops them back. The problem is that the RIP/RSP modified by the signal is stored in the XCP context, whereas iretq operates on the interrupt stack. As a result, the RIP/RSP modified by the signal does not take effect in the iretq instruction, causing the task receiving the signal to fail to jump correctly to the signal handler. This behavior appears as if the signal is lost
Signed-off-by: liwenxiang1 <liwenxiang1@xiaomi.com>
add acpi procfs function
Signed-off-by: liwenxiang1 <liwenxiang1@xiaomi.com>
arch/x64:Fix the issue of dereferencing before null check
Signed-off-by: liwenxiang1 <liwenxiang1@xiaomi.com>
Add support to disable signals actions related struct
Co-authored-by: guoshichao <guoshichao@xiaomi.com>
Signed-off-by: Chengdong Wang <wangchengdong@lixiang.com>
/home/ajh/work/vela_system/nuttx/include/arch/syscall.h:181: Error: operand type mismatch for `movq'
`rax`: Used in 64-bit mode, suitable for storing 64 bits of data.
`eax`: In 64-bit mode, typically used for operating on 32-bit data. When writing to `eax`, the high 32 bits of `rax` are automatically cleared to zero.
`nbr` is an unsigned int, is 32-bit.
Signed-off-by: anjiahao <anjiahao@xiaomi.com>
On newer x86 CPUs, the MSR_IA32_TSC_ADJUST register is utilized to fine-tune the offset of the Time Stamp Counter (TSC). This commit introduces support for MSR_IA32_TSC_ADJUST and enhances the TSC tickless
driver, optimizing its performance.
Signed-off-by: ouyangxiangzhen <ouyangxiangzhen@xiaomi.com>
Add support for stack canaries for x86.
This includes mostly fixes for TLS support that are required for stack canaries
in x86. The FSBASE register must be unique per thread so we have to keep it in
thread registers area.
Signed-off-by: p-szafonimateusz <p-szafonimateusz@xiaomi.com>
This commit fixed `fb_putc` for early-print.
- Modified fb_putc to return an int instead of void.
- Handled error cases where the character is not found by replacing it with a '.'.
- Ensured cursor position is updated correctly after each character is processed.
- Fixed above 4G framebuffer memory mapping.
Signed-off-by: ouyangxiangzhen <ouyangxiangzhen@xiaomi.com>
This commit introduces support for querying TSC frequency using CPUID 0x40000010. This function can be tested with the following command: `sudo qemu-system-x86_64 -enable-kvm -cpu host,+invtsc,+vmware-cpuid-freq -m 2G -kernel nuttx -nographic -serial mon:stdio -s`
Signed-off-by: ouyangxiangzhen <ouyangxiangzhen@xiaomi.com>
Inline & inline_function both used make confuze, let's modify all inline
in irq.h to inline_function, also clear the always_inline_funcion
declaration.
Signed-off-by: buxiasen <buxiasen@xiaomi.com>
By default in SMP, obtaining this_task requires disabling interrupts, obtaining the current CPU index, accessing a global variable, and re-enabling interrupts. Storing this_task in percpu makes retrieval faster.
Signed-off-by: liwenxiang1 <liwenxiang1@xiaomi.com>
Most tools used for compliance and SBOM generation use SPDX identifiers
This change brings us a step closer to an easy SBOM generation.
Signed-off-by: Alin Jerpelea <alin.jerpelea@sony.com>
Most tools used for compliance and SBOM generation use SPDX identifiers
This change brings us a step closer to an easy SBOM generation.
Signed-off-by: Alin Jerpelea <alin.jerpelea@sony.com>
We save interrupted TCB state on tcb->xcp.regs not interrupt stack now
which allows us to remove x86_64_savestate() from up_switch_context()
and other places.
Signed-off-by: p-szafonimateusz <p-szafonimateusz@xiaomi.com>
Signed-off-by: hujun5 <hujun5@xiaomi.com>
Some app with same code runs on different cores in AMP mode,
need the physical core on which the function is called.
Signed-off-by: hujun5 <hujun5@xiaomi.com>
Signed-off-by: fangxinyong <fangxinyong@xiaomi.com>
