OS/ThreadX: Fix task stack corruption in SMP PortThreadSwitch

Move the stack swap around PortThreadSwitch into the SMP context
switch path so the scheduler runs on the per-core interrupt stack
rather than the outgoing task stack.

This prevents the saved task stack from being touched after that
task becomes runnable on another CPU, avoiding stack overwrite and
other undefined failures during SMP scheduling.

Also publish the selected thread through _tx_thread_current_ptr[coreid]
so the restore path uses the exact thread claimed during the switch.

Signed-off-by: Huaqi Fang <578567190@qq.com>

Author: fanghuaqi

OS/ThreadX/ports_smp/nuclei/gcc/context.S

@@ -168,7 +168,13 @@ eclic_msip_handler:
     STORE sp, 2 * REGBYTES(t0)
 
 _tx_thread_save_switch:
+    /* Switch from the thread stack to the per-core interrupt stack to avoid
+       corrupting the thread stack during scheduling. */
+    csrrw sp, CSR_MSCRATCHCSWL, sp
     jal PortThreadSwitch
+    csrrw sp, CSR_MSCRATCHCSWL, sp
+    /* Switch back to the saved thread stack for now; a new stack pointer will
+       be loaded for the selected thread below. */
 
     /* PortThreadSwitch has claimed and published the selected thread in
        _tx_thread_current_ptr[coreid].  Restore that exact thread instead of

OS/ThreadX/ports_smp/nuclei/iar/context.S

@@ -166,7 +166,13 @@ eclic_msip_handler:
     STORE sp, 2 * REGBYTES(t0)
 
 _tx_thread_save_switch:
+    /* Switch from the thread stack to the per-core interrupt stack to avoid
+       corrupting the thread stack during scheduling. */
+    csrrw sp, CSR_MSCRATCHCSWL, sp
     jal PortThreadSwitch
+    csrrw sp, CSR_MSCRATCHCSWL, sp
+    /* Switch back to the saved thread stack for now; a new stack pointer will
+       be loaded for the selected thread below. */
 
     /* PortThreadSwitch has claimed and published the selected thread in
        _tx_thread_current_ptr[coreid].  Restore that exact thread instead of

OS/ThreadX/ports_smp/nuclei/port.c

@@ -135,39 +135,37 @@ void PortThreadSwitch(void)
     rdy_thread = _tx_thread_execute_ptr[coreid];
     if ((!rdy_thread) || (rdy_thread -> tx_thread_smp_core_control != 1)) {
         if (coreid == 0) {
-            /* increase the timer interrupt to higher priority to enable interrupt nesting */
+            /* Raise the timer interrupt priority temporarily so interrupt
+               nesting remains available while searching for a ready thread. */
             ECLIC_SetLevelIRQ(SysTimer_IRQn, KERNEL_INTERRUPT_PRIORITY + 1);
             __RWMB();
         }
-        /* swap task stack to interrupt stack to avoid interrupt nesting on task stack */
-        __ASM volatile("csrrw sp, " STRINGIFY(CSR_MSCRATCHCSWL) ", sp");
         __RWMB();
-        /* mcause must be saved and restore if interrupt nested */
+        /* Save mcause/msubm because they may be overwritten when interrupts
+           are re-enabled and nested here. */
         rv_csr_t mcause = __RV_CSR_READ(CSR_MCAUSE);
         rv_csr_t msubm = __RV_CSR_READ(CSR_MSUBM);
         __enable_irq();
         __RWMB();
-        /* Claim the selected thread while on the interrupt stack.  Publish it
-           as current only after switching back to the task stack below. */
-        _tx_find_ready_thread(TX_TRUE);
-        /* disable interrupt to avoid interrupt nesting since new task handle found */
+        rdy_thread = _tx_find_ready_thread(TX_FALSE);
+        /* Disable interrupts again after a candidate thread has been found to
+           prevent further nesting during the handoff. */
         __disable_irq();
         __RWMB();
-        /* restore mcause which is necessary since interrupt nested manually by us */
+        /* Restore mcause/msubm because nested interrupts were allowed
+           explicitly in the search window above. */
         __RV_CSR_WRITE(CSR_MSUBM, msubm);
         __RV_CSR_WRITE(CSR_MCAUSE, mcause);
-        /* swap interrupt stack back to task stack */
-        __ASM volatile("csrrw sp, " STRINGIFY(CSR_MSCRATCHCSWL) ", sp");
         __RWMB();
-        /* restore timer interrupt to origin kernel interrupt priority */
+        /* Restore the timer interrupt to its normal kernel priority. */
         if (coreid == 0) {
             ECLIC_SetLevelIRQ(SysTimer_IRQn, KERNEL_INTERRUPT_PRIORITY);
             __RWMB();
         }
     } else {
-        _tx_find_ready_thread(TX_TRUE);
+        rdy_thread = _tx_find_ready_thread(TX_FALSE);
     }
-    rdy_thread = _tx_thread_current_ptr[coreid];
+    _tx_thread_current_ptr[coreid] = rdy_thread;
     /* Clear the execution control flag.  */
     rdy_thread -> tx_thread_smp_core_control = 0;
     rdy_thread -> tx_thread_run_count ++;