Skip to content

[libcpu][riscv] fix MMU and user fault handling for Smart #11892

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
BernardXiong wants to merge 4 commits into
base: master
Choose a base branch
from
+109 −8
Open

[libcpu][riscv] fix MMU and user fault handling for Smart #11892

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
efacd97
[libcpu][riscv] fix MMU and user fault handling for Smart
BernardXiong Oct 18, 2026
88463e2
[libcpu][riscv] declare rt_hw_show_register before use
BernardXiong Oct 18, 2026
bcde514
[libcpu][riscv] clear user pgtbl entries for every hart
BernardXiong Oct 23, 2026
8206f26
[libcpu][riscv] use top-level index and lwp_self() for user faults
BernardXiong Oct 31, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 12 additions & 0 deletions libcpu/Kconfig
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -288,6 +288,10 @@ config ARCH_RISCV64
select ARCH_CPU_64BIT
bool

config ARCH_RISCV_XUANTIE
select ARCH_RISCV
bool

if ARCH_RISCV
orsource "./risc-v/Kconfig"
endif
Expand All @@ -304,6 +308,14 @@ if ARCH_RISCV64
select ARCH_USING_NEW_CTX_SWITCH
help
Using the common64 implementation under ./libcpu/risc-v

if RT_USING_SMART
config CONFIG_XUANTIE_SVPBMT
int
depends on ARCH_RISCV_XUANTIE
default 1
endif

endif

config ARCH_REMAP_KERNEL
Expand Down
31 changes: 28 additions & 3 deletions libcpu/risc-v/common/mmu.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -136,6 +136,7 @@ static int mmu_map_early(rt_ubase_t *tbl, rt_uint8_t max_level,
rt_ubase_t va, rt_ubase_t pa, rt_ubase_t attr, rt_bool_t flush)
{
rt_ubase_t page, *table, off, level_shift;
rt_ubase_t pv_off = flush ? rt_kmem_pvoff() : 0;

attr = mmu_attr_fixup(attr);

Expand Down Expand Up @@ -168,7 +169,7 @@ static int mmu_map_early(rt_ubase_t *tbl, rt_uint8_t max_level,
return MMU_MAP_ERROR_NOPAGE;
}

rt_memset((void *)page, 0, ARCH_PAGE_SIZE);
rt_memset((void *)(page - pv_off), 0, ARCH_PAGE_SIZE);
table[off] = ((page >> ARCH_PAGE_SHIFT) << PTE_BITS) | PTE_V;

if (flush)
Expand All @@ -185,7 +186,7 @@ static int mmu_map_early(rt_ubase_t *tbl, rt_uint8_t max_level,

/* Step into the next level page table */
page = (table[off] >> PTE_BITS) << ARCH_PAGE_SHIFT;
table = (rt_ubase_t *)page;
table = (rt_ubase_t *)(page - pv_off);

level_shift -= VPN_BITS;
}
Expand Down Expand Up @@ -934,6 +935,12 @@ int rt_hw_mmu_map_init(rt_aspace_t aspace, void *v_address, rt_ubase_t size,
#if __riscv_xlen == 32 && !defined(RT_USING_SMART)
/* The RV32 ioremap and MPR regions are placed below the kernel image. */
aspace_start = (rt_ubase_t)v_address - rt_mpr_size;
#elif defined(RT_USING_SMART)
/* The runtime-sized MPR can extend below the linked kernel base. */
if ((rt_ubase_t)v_address - rt_mpr_size < aspace_start)
{
aspace_start = (rt_ubase_t)v_address - rt_mpr_size;
}
#endif

rt_aspace_init(aspace, (void *)aspace_start, 0UL - aspace_start, vtable);
Expand Down Expand Up @@ -1395,10 +1402,28 @@ void *rt_hw_mmu_pgtbl_create(void)
(void *)rt_kernel_space.page_table + i * ARCH_PAGE_SIZE,
ARCH_PAGE_SIZE);
}
#else
rt_memcpy(mmu_table, rt_kernel_space.page_table, ARCH_PAGE_SIZE);
#endif

#ifdef RT_USING_SMART
/* Do not share early identity mappings with the user address space. */
rt_size_t user_start = get_top_vpn(USER_VADDR_START, satp_level_4k);
rt_size_t user_end = get_top_vpn(USER_VADDR_TOP - 1, satp_level_4k);

for (int i = 0; i < (1UL << alloc_bits); ++i)
{
rt_ubase_t *table = (void *)mmu_table + i * ARCH_PAGE_SIZE;

rt_memset(table + user_start, 0,
(user_end - user_start + 1) * sizeof(*table));
}
#endif

#ifdef MMU_PERCPU
rt_hw_cpu_dcache_ops(RT_HW_CACHE_FLUSH, mmu_table,
RT_CPUS_NR * ARCH_PAGE_SIZE);
#else
rt_memcpy(mmu_table, rt_kernel_space.page_table, ARCH_PAGE_SIZE);
rt_hw_cpu_dcache_ops(RT_HW_CACHE_FLUSH, mmu_table, ARCH_PAGE_SIZE);
#endif

Expand Down
22 changes: 19 additions & 3 deletions libcpu/risc-v/common/trap.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,6 +33,8 @@
extern long list_thread(void);
#endif

void rt_hw_show_register(struct rt_hw_stack_frame *regs);

#ifdef RT_USING_LWP
#include <mm_aspace.h>
#include <lwp.h>
Expand All @@ -46,10 +48,14 @@ static void _check_fault(struct rt_hw_stack_frame *regs, uint32_t pc_adj, char *
{
rt_thread_t th;
rt_bool_t is_user_fault = !(regs->xstatus & SR_PP);
rt_base_t saved_stat = 0;

if (is_user_fault)
{
/* User backtrace and process teardown can acquire sleeping locks. */
saved_stat = csr_read_set(CSR_STATUS, SR_IE);
rt_kprintf("%s! pc = %p\n", info, regs->epc - pc_adj);
rt_hw_show_register(regs);
}

/* User stack backtrace */
Expand All @@ -65,6 +71,8 @@ static void _check_fault(struct rt_hw_stack_frame *regs, uint32_t pc_adj, char *
lwp_core_dump(regs, pc_adj);
#endif
sys_exit_group(-1);
/* Only reached when there is no LWP to terminate */
csr_write(CSR_STATUS, saved_stat);
Comment on lines 73 to +75

@cms19859230182-lang cms19859230182-lang Oct 18, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

熊老师好呀！sys_exit_group(-1) 后面的 csr_write 按理走不到，IE 会一直开着。是不是先恢复再调更稳？如有误解请指正，谢谢！

@BernardXiong BernardXiong Oct 23, 2026

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

这里是有意把恢复放在 sys_exit_group() 之后的（commit bcde514 仅补充注释说明）：

  • 正常路径下 sys_exit_group() → lwp_exit() 不会返回，csr_write() 不会执行；此时保持 IE 开启是必要的：lwp_exit() 内部的 LWP_LOCK() 会调用 RT_DEBUG_SCHEDULER_AVAILABLE(1)，在 UP + RT_DEBUGING_CONTEXT 下如果中断关闭会直接断言；另外进程 teardown 也可能获取 sleeping lock。
  • 只有 lwp_self() 为空、sys_exit_group() 返回 -EINVAL 时，csr_write() 才会执行并恢复进入前的 sstatus。

因此没有把恢复提前，仅在 csr_write() 前加了一条注释说明该分支。

@cms19859230182-lang cms19859230182-lang Oct 24, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

搜噶搜噶

}
}

Expand Down Expand Up @@ -296,6 +304,7 @@ void rt_hw_trap(struct rt_hw_stack_frame *regs)
{
rt_ubase_t xcause = regs->xcause;
rt_ubase_t tval = csr_read_clear(CSR_TVAL, 0);
rt_bool_t is_user_fault = !(regs->xstatus & SR_PP);

/* IRQ */
if (xcause & CAUSE_IRQ_FLAG)
Expand Down Expand Up @@ -364,16 +373,23 @@ void rt_hw_trap(struct rt_hw_stack_frame *regs)
case EXC_INST_PAGE_FAULT:
case EXC_LOAD_PAGE_FAULT:
case EXC_STORE_PAGE_FAULT:
#ifdef RT_USING_SMART
if (!(regs->xstatus & SR_PP) ||
#ifdef RT_USING_SMART
if (is_user_fault ||
(tval >= USER_VADDR_START && tval < USER_VADDR_TOP))
{
if (user_fault_fixable(regs, xcause, tval))
{
return;
}

/* A failed user mapping must terminate only the LWP. */
if (is_user_fault && lwp_self())
{
_check_fault(regs, 0, "user fault");
return;
}
}
#endif /* RT_USING_SMART */
#endif /* RT_USING_SMART */

default:
LOG_E("Unhandle Execption: (%d) %s, TVAL = %p", xcause,
Expand Down
52 changes: 50 additions & 2 deletions libcpu/risc-v/common64/mmu.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,7 @@
*/

#include <rtthread.h>
#include <rthw.h>
#include <stddef.h>
#include <stdint.h>

Expand Down Expand Up @@ -85,6 +86,23 @@ void rt_hw_aspace_switch(rt_aspace_t aspace)
uint32_t hartid = rt_hw_cpu_id();
uintptr_t ptr = (uintptr_t)aspace->page_table + (uintptr_t)(hartid * ARCH_PAGE_SIZE);
uintptr_t page_table = (uintptr_t)rt_kmem_v2p((void *)ptr);

if (page_table == (uintptr_t)ARCH_MAP_FAILED)
{
/*
* During early K230 bring-up the page table pointer held by the kernel
* aspace can still be a low physical address, before the kernel has
* switched to the high virtual mapping. The formal kernel aspace only
* maps the high virtual range, so rt_kmem_v2p() cannot translate that
* low pointer, while SATP needs the physical address of the page
* table. Use such a low pointer as-is; a high virtual address that
* fails to translate is a real error and is not rewritten here.
*/
if (ptr < KERNEL_VADDR_START)
{
page_table = ptr;
}
}
Comment on lines +89 to +105

@rcitach rcitach Oct 29, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

rt_hw_mmu_setup -> rt_aspace_map_phy_static，应该做好了关于 rt_kernel_space 的映射，包含 MMUTable 所在的内存区域，即使失败应该直接 err 吧。这里 rt_kmem_v2p 返回了 ARCH_MAP_FAILED 也不能把 ptr 直接当成物理地址吧

@BernardXiong BernardXiong Oct 31, 2026

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

这里确实需要保留一个受限的回退，原因如下：

  • 在 K230 早期启动阶段，内核 aspace 持有的页表指针仍可能是低物理地址（此时还没有切换到高虚拟地址映射）。
  • rt_hw_mmu_setup() 建立的正式 rt_kernel_space 只映射高虚拟地址区间，因此 rt_kmem_v2p() 无法翻译这个低地址，返回 ARCH_MAP_FAILED 是符合预期的；而写 SATP 需要的正是页表的物理地址。
  • rt_hw_aspace_switch() 返回 void，且是启动阶段的必经路径，没有可以向上返回错误的调用者。
  • 回退条件严格限定为 ptr < KERNEL_VADDR_START；高虚拟地址翻译失败不会被当作物理地址，属于真正的错误。

已在 commit 8206f26 中把注释补充清楚。如果后续想在失败路径上更严格，可以加日志/断言，但启动早期控制台尚未就绪。

#ifndef RT_USING_SMP
current_mmu_table = aspace->page_table;
#else
Expand Down Expand Up @@ -632,14 +650,14 @@ static inline void _init_region(void *vaddr, size_t size)
{
rt_ioremap_start = vaddr;
rt_ioremap_size = size;
rt_mpr_start = rt_ioremap_start - rt_mpr_size;
rt_mpr_start = (void *)((rt_ubase_t)rt_ioremap_start - rt_mpr_size);
LOG_D("rt_ioremap_start: %p, rt_mpr_start: %p", rt_ioremap_start,
rt_mpr_start);
}
#else
static inline void _init_region(void *vaddr, size_t size)
{
rt_mpr_start = vaddr - rt_mpr_size;
rt_mpr_start = (void *)((rt_ubase_t)vaddr - rt_mpr_size);
}
#endif

Expand Down Expand Up @@ -1057,6 +1075,9 @@ void rt_hw_mem_setup_early(void *pgtbl, rt_uint64_t hartid)
vs += EARLY_MAP_PAGE_SIZE_2M;
}
#endif
/* flush page table entries from data cache before enabling MMU */
rt_hw_cpu_dcache_clean(early_pgtbl, ARCH_PAGE_SIZE);

/* apply new mapping */
asm volatile("sfence.vma x0, x0");
write_csr(satp, SATP_BASE | ((size_t)early_pgtbl >> PAGE_OFFSET_BIT));
Expand All @@ -1078,6 +1099,25 @@ rt_inline int _pgtbl_order(void)
return order;
}

#ifdef RT_USING_SMART
/*
* Early identity mappings may overlap the user address range. Clear those
* entries so they are not inherited by a user address space.
*/
static void _clear_user_pgtbl_entries(rt_ubase_t *table)
{
int i;
/* Use the runtime top-level index so Sv39/Sv48/Sv57 all work. */
int start_idx = GET_LVL_INDEX(USER_VADDR_START, 1);
int end_idx = GET_LVL_INDEX(USER_VADDR_TOP - 1, 1);

for (i = start_idx; i <= end_idx; i++)
{
table[i] = 0;
}
}
#endif /* RT_USING_SMART */

/**
* @brief Creates and initializes a new MMU page table.
*
Expand Down Expand Up @@ -1111,6 +1151,9 @@ void *rt_hw_mmu_pgtbl_create(void)
rt_ubase_t *dst = (rt_ubase_t *)((rt_ubase_t)mmu_table +
(rt_ubase_t)(h * ARCH_PAGE_SIZE));
rt_memcpy(dst, src, ARCH_PAGE_SIZE);
#ifdef RT_USING_SMART
_clear_user_pgtbl_entries(dst);
#endif
}
rt_hw_cpu_dcache_ops(RT_HW_CACHE_FLUSH, mmu_table,
(rt_ubase_t)(1 << order) * ARCH_PAGE_SIZE);
Expand All @@ -1121,6 +1164,11 @@ void *rt_hw_mmu_pgtbl_create(void)
return RT_NULL;
}
rt_memcpy(mmu_table, rt_kernel_space.page_table, ARCH_PAGE_SIZE);

#ifdef RT_USING_SMART
_clear_user_pgtbl_entries(mmu_table);
#endif

rt_hw_cpu_dcache_ops(RT_HW_CACHE_FLUSH, mmu_table, ARCH_PAGE_SIZE);
#endif

Expand Down
Loading