112b2414ac
In a protected build arm_svcall.c treats the caller's CONTROL as part of the saved system call state: it stores it in xcp.syscall[].ctrlreturn on entry and restores it from there on SYS_syscall_return. All three Cortex-M profiles do this -- armv6-m, armv7-m and armv8-m each define the field in arch/arm/include/<arch>/irq.h and use it symmetrically. arm_fork_direct() copied sysreturn and excreturn to the child but not ctrlreturn. The child's TCB comes from kmm_zalloc(), so the field was zero, and CONTROL == 0 is nPRIV clear: the child returned to user space privileged while its parent returned unprivileged. The child ran out its life with the MPU restrictions its parent is under silently lifted, which is the isolation BUILD_PROTECTED exists to provide. Nothing faults, and that is why this survived. CONTROL == 0 also selects MSP, which sounds like it should crash immediately, but NuttX already runs Cortex-M threads on MSP -- the parent's saved value is 0x1, nPRIV set and SPSEL clear -- so the two differ only in the privilege bit and there is no stack change to trip over. Privileged code then passes every test unprivileged code passes, so ostest cannot see it either. Measured on an RP2350 (Cortex-M33) in BUILD_PROTECTED, breaking at the nxtask_start_fork() call in arm_fork_direct() during task_fork_test: parent ctrlreturn 0x00000001, child ctrlreturn 0x00000000. With this change both read 0x00000001. BUILD_FLAT is unaffected: without CONFIG_LIB_SYSCALL, nsyscalls is 0 and the whole block is skipped. armv7-a and armv7-r are unaffected too; they carry cpsr instead, and that is already copied. Assisted-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Signed-off-by: Marco Casaroli <marco.casaroli@gmail.com> |
||
|---|---|---|
| .github | ||
| arch | ||
| audio | ||
| binfmt | ||
| boards | ||
| cmake | ||
| crypto | ||
| Documentation | ||
| drivers | ||
| dummy | ||
| fs | ||
| graphics | ||
| include | ||
| libs | ||
| mm | ||
| net | ||
| openamp | ||
| pass1 | ||
| sched | ||
| syscall | ||
| tools | ||
| video | ||
| wireless | ||
| .asf.yaml | ||
| .codespell-ignore-lines | ||
| .codespellrc | ||
| .editorconfig | ||
| .gitignore | ||
| .gitmessage | ||
| .pre-commit-config.yaml | ||
| .yamllint | ||
| AUTHORS | ||
| CMakeLists.txt | ||
| CONTRIBUTING.md | ||
| INVIOLABLES.md | ||
| Kconfig | ||
| LICENSE | ||
| Makefile | ||
| NOTICE | ||
| README.md | ||
| ReleaseNotes | ||
Apache NuttX is a real-time operating system (RTOS) with an emphasis on standards compliance and small footprint. Scalable from 8-bit to 64-bit microcontroller environments, the primary governing standards in NuttX are POSIX and ANSI standards. Additional standard APIs from Unix and other common RTOSs (such as VxWorks) are adopted for functionality not available under these standards, or for functionality that is not appropriate for deeply-embedded environments (such as fork()).
For brevity, many parts of the documentation will refer to Apache NuttX as simply NuttX.
Getting Started
First time on NuttX? Read the Getting Started guide! If you don't have a board available, NuttX has its own simulator that you can run on terminal.
Documentation
You can find the current NuttX documentation on the Documentation Page.
Alternatively, you can build the documentation yourself by following the Documentation Build Instructions.
The old NuttX documentation is still available in the Apache wiki.
Supported Boards
NuttX supports a wide variety of platforms. See the full list on the Supported Platforms page.
Contributing
If you wish to contribute to the NuttX project, read the Contributing guidelines for information on Git usage, coding standard, workflow and the NuttX principles.
License
The code in this repository is under either the Apache 2 license, or a license compatible with the Apache 2 license. See the License Page for more information.