Traphalt: Indirect Core Halt via Trap Handling to Halt a RISC-V Core from User Mode through Kernel-Mediated Fault Handling

Modern processors rely on strict privilege separation to prevent user applications from manipulating privileged architectural state directly. In RISC-V systems, user-mode programs cannot access privileged control and status registers (CSRs) or execute privileged instructions. Still, exceptions raised by user programs are handled by the operating system kernel through the trap mechanism, which runs at a higher privilege level. This interaction between user-level faults and kernel trap handling can introduce subtle system behaviours that affect processor control state. In this work, we show that a RISC-V CPU core can be indirectly halted from user mode by deliberately triggering kernel trap handling with carefully crafted illegal instruction sequences. A user-space program forces the kernel to process a fault condition that propagates through OpenSBI’s unhandled-fault path to sbi hart hang(), suspending the hart in an infinite wfi() loop. We demonstrate this behaviour on a SiFive HiFive Premier P550 platform running Linux with OpenSBI v1.6. Our results highlight how user-triggered exceptions can cause unexpected system-level effects and stress the need for careful validation of exception-handling paths in RISC-V platforms.