riscv: stop teardown freeing shared kernel tables; wire kernel satp root

Two RISC-V process-exit memory-safety bugs surfaced by the 2026-06-03
kernel correctness review and confirmed against the code. Both are
independent of the page-table-root self-free common to x86_64 + riscv
(see "Out of scope").

What:

1. reclaim_process_page_tables (src/memory/mod.rs, the shared aarch64/
   riscv arm) walked the full L0 range 0..512. On RISC-V there is no
   TTBR split, so create_process_page_table copies the kernel-half
   descriptors (L0[256..512]) into every user table; those point at the
   shared *static* BOOT_L2_IDENTITY / BOOT_L2_KERNEL tables in
   arch::riscv64::entry. Walking the upper half therefore reached those
   shared tables and frame_alloc.free zero-filled them — destroying the
   HHDM and kernel map that every CPU and every address space depend on
   (global corruption, strictly worse than a single-process brick).
   Fix: walk only the user half (0..256), matching x86_64's
   paging::reclaim_process_page_tables. Harmless narrowing on AArch64
   (user L0 upper half is always zero; kernel lives in TTBR1) and a
   standing guard against a future kernel-half copy there.

2. kmain_riscv64 (src/microkernel/main.rs) never set the canonical
   kernel page-table root, so kernel_cr3() stayed 0. The portable
   scheduler substitutes kernel_cr3() as the switch hint for kernel/idle
   tasks (cr3 == 0); the riscv satp reload gate skips when that hint is
   0, so a kernel/idle task kept the previous user satp loaded after the
   owning process exited — a use-after-free of a freed root. Fix: wire
   set_kernel_cr3(boot_root_phys) from BOOT_SATP, mirroring the x86_64
   (CR3) / aarch64 (TTBR1) wiring already in kmain.

Why: x86_64 and aarch64 already wire kernel_cr3() and already walk the
user half only; RISC-V was the lone gap on both. Found while
adversarially verifying the deferred-reclaim design across all three
arches.

Out of scope: the active-root self-free common to x86_64 and RISC-V (a
dying task frees + zeroes the page-table root still loaded in its own
CR3/satp before it yields). That is the deferred-reclaim mechanism,
landing next. After this commit RISC-V process exit still bricks on that
common path; what changes is that the catastrophic *global* HHDM
corruption (bug 1) and the satp UAF (bug 2) are gone.

Verification:
  - make check-all: x86_64 + aarch64 + riscv64 build cleanly.
  - check-assumptions / check-deferrals / check-unsafe-coverage: pass.
    The two baseline files carry only line-number resyncs for the 3
    (assumptions) + 8 (deferrals) pre-existing entries my added comments
    shifted; no new bounds or deferrals introduced.
  - Not boot-tested under QEMU: riscv boot-smoke is not yet in CI, and
    riscv process exit still bricks on the common active-root self-free
    above, so a boot would not yet demonstrate a clean exit. Verified by
    code inspection + the tri-arch build.

Staged files:
  src/memory/mod.rs
  src/microkernel/main.rs
  tools/check-assumptions-baseline.txt
  tools/check-deferrals-baseline.txt

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: riccajason

src/memory/mod.rs

@@ -419,6 +419,21 @@ pub mod paging {
     /// by `ProcessDescriptor::reclaim_user_vmas()`. This function frees
     /// only the intermediate page-table structures.
     ///
+    /// **Walks only the user half (L0[0..256]).** User mappings live in
+    /// the low half on every arch (matching x86_64's
+    /// `paging::reclaim_process_page_tables`, which walks 0..256). The
+    /// upper half (256..512) is NOT process-owned: on RISC-V there is no
+    /// TTBR split, so `create_process_page_table` copies the kernel-half
+    /// descriptors from the boot root — and those point at the *shared
+    /// static* `BOOT_L2_IDENTITY` / `BOOT_L2_KERNEL` tables in
+    /// `arch::riscv64::entry`. Descending there and freeing them would
+    /// zero the HHDM and kernel map that every CPU and every address
+    /// space depend on (global corruption, strictly worse than a single
+    /// process brick). On AArch64 the upper half is always zero (kernel
+    /// lives in TTBR1), so 0..256 is a no-op narrowing there — and a
+    /// standing regression guard should a future change ever copy the
+    /// kernel half into an AArch64 user L0.
+    ///
     /// Returns the total number of frames freed (including the L0).
     pub fn reclaim_process_page_tables(
         l0_phys: u64,
@@ -435,7 +450,10 @@ pub mod paging {
         // terminated so no CPU has this table loaded.
         let l0_virt = phys_to_virt(l0_phys) as *const u64;
 
-        for l0_idx in 0..512usize {
+        // User half only (see the doc comment). The upper half (256..512)
+        // is shared kernel state on RISC-V (copied static tables) or empty
+        // on AArch64 — freeing it would corrupt the global kernel map.
+        for l0_idx in 0..256usize {
             // SAFETY: l0_virt points to a 4 KiB page table with 512
             // 8-byte entries. l0_idx < 512.
             let l0_entry = unsafe { core::ptr::read(l0_virt.add(l0_idx)) };

src/microkernel/main.rs

@@ -681,6 +681,19 @@ unsafe extern "C" fn kmain_riscv64(hart_id: u64, dtb_phys: u64) -> ! {
     init_kernel_heap();
     init_frame_allocator();
 
+    // Capture the boot satp root as the canonical kernel page table, so
+    // the (portable) scheduler substitutes it for kernel/idle tasks
+    // (cr3 == 0) and the satp reload gate in arch::riscv64 actually fires
+    // on a switch onto one. Without this, kernel_cr3() == 0, the gate's
+    // `if page_table_root != 0` skips the reload, and a kernel/idle task
+    // keeps the previous user satp loaded after that user process exits —
+    // a use-after-free of a freed page-table root. Mirrors the x86_64
+    // (CR3) / aarch64 (TTBR1) set_kernel_cr3 wiring in kmain. BOOT_SATP
+    // holds `(MODE << 60) | PPN`; set_kernel_cr3 wants the root phys.
+    let boot_satp = cambios_core::arch::riscv64::entry::BOOT_SATP
+        .load(core::sync::atomic::Ordering::Acquire);
+    cambios_core::set_kernel_cr3((boot_satp & ((1u64 << 44) - 1)) << 12);
+
     // Smoke-test: allocate a Box and verify the pointer + stored value.
     // Confirms the heap + allocator + paging are all wired correctly.
     {

tools/check-assumptions-baseline.txt

@@ -318,9 +318,9 @@ src/memory/frame_allocator.rs:67:BITMAP_WORDS
 src/memory/heap.rs:17:MIN_BLOCK_SIZE
 src/memory/heap.rs:20:HEAP_ALIGN
 src/memory/mod.rs:77:ENTRIES_PER_TABLE
-src/memory/mod.rs:611:BOOTLOADER_BASE
-src/memory/mod.rs:614:KERNEL_LOAD_ADDR
-src/memory/mod.rs:617:EXTENDED_MEMORY_BASE
+src/memory/mod.rs:629:BOOTLOADER_BASE
+src/memory/mod.rs:632:KERNEL_LOAD_ADDR
+src/memory/mod.rs:635:EXTENDED_MEMORY_BASE
 src/pci/mod.rs:36:MAX_PCI_DEVICES
 src/policy/mod.rs:75:DECISION_NONE
 src/policy/mod.rs:76:DECISION_ALLOW

tools/check-deferrals-baseline.txt

@@ -87,14 +87,14 @@ src/ipc/capability.rs:727:deferred
 src/ipc/capability.rs:780:TODO
 src/ipc/capability.rs:788:for-now
 src/lib.rs:100:TBD
-src/memory/mod.rs:633:placeholder
-src/memory/mod.rs:642:placeholder
-src/microkernel/main.rs:930:for-now
-src/microkernel/main.rs:1022:for-now
-src/microkernel/main.rs:1611:deferred
-src/microkernel/main.rs:2029:deferred
-src/microkernel/main.rs:2058:deferred
-src/microkernel/main.rs:2361:for-now
+src/memory/mod.rs:651:placeholder
+src/memory/mod.rs:660:placeholder
+src/microkernel/main.rs:943:for-now
+src/microkernel/main.rs:1035:for-now
+src/microkernel/main.rs:1624:deferred
+src/microkernel/main.rs:2042:deferred
+src/microkernel/main.rs:2071:deferred
+src/microkernel/main.rs:2374:for-now
 src/platform/mod.rs:353:for-now
 src/process.rs:992:deferred
 src/process.rs:993:deferred