switcher: enable IRQs while in fault handlers Fault handlers should not run with IRQs disabled, as that would allow any compartment with a fault handler to wedge the machine (and while in principle still auditable, that's a big step back from the structured IRQ disposition programming otherwise present in the RTOS). This implies that invariants established and protected under IRQ deferral no longer hold on the fault path; the attendant loss of atomicity is just something the compartment will have to deal with.

diff --git a/sdk/core/switcher/entry.S b/sdk/core/switcher/entry.S
index 1ea2bbf..c113d26 100644
--- a/sdk/core/switcher/entry.S
+++ b/sdk/core/switcher/entry.S

@@ -777,6 +777,9 @@
 	cmove              csp, ca0
 
 .Linvoke_error_handler:
+	// Enable interrupts before invoking the handler
+	csrsi              mstatus, 0x8
+
 	// Clear all registers except:
 	// cra is set by cjalr.  csp and cgp are needed for the called compartment.
 	// ca0, used for the register state
@@ -786,6 +789,15 @@
 	// Call the handler.
 	cjalr              cra
 
+	/*
+	 * Now that we're back, defer interrupts again before we do anything that
+	 * manipulates the TrustedStack.
+	 *
+	 * TODO: Eventually we'd like to move this down onto the paths where it
+	 * actually matters and let most of this code run with IRQs enabled.
+	 */
+	csrci              mstatus, 0x8
+
 	// Move the return value to a register that will be cleared in a forced
 	// unwind and zero the return registers.
 	move               s0, a0