Swatantra-66 opened a new pull request, #21140:
URL: https://github.com/apache/nuttx/pull/21140
## Summary
Follow-up to commit 50a4f8061da ("arch/arm64: refuse reserved syscalls from
user space") and commit fd57ce76957 ("arch/risc-v: refuse reserved syscalls
from user mode") by Royyan Zahir, as well as refinement commits a9066e5de2 and
03fd785795 by @casaroli
Currently on ARM (armv7-a, armv7-r, armv8-r, armv6-m, armv7-m, and armv8-m),
unprivileged user-mode execution of kernel-reserved system calls (`cmd <
CONFIG_SYS_RESERVED`, e.g. `SYS_restore_context`, `SYS_switch_context`, or
undispatched `SYS_signal_handler_return`) is not rejected upfront and falls
through into privileged dispatch paths.
This PR brings the 32-bit ARM architectures to parity with ARM64 and RISC-V:
1. Rejects unprivileged user-mode system calls below `CONFIG_SYS_RESERVED`
with `-ENOSYS`.
2. Adds the `USER_SIGRETURN(tcb, cmd)` helper macro to ensure
`SYS_signal_handler_return` from user mode is only accepted when returning from
an active dispatched user signal handler (`tcb->xcp.sigreturn != 0`) under
`CONFIG_BUILD_PROTECTED` / `CONFIG_BUILD_KERNEL` with
`CONFIG_ENABLE_ALL_SIGNALS`.
3. In all other signal/build configurations, disallows reserved syscalls
from user mode entirely.
4. Aligns and corrects the `xcp.sigreturn` declaration guards in
`arch/arm/include/armv7-r/irq.h` and `arch/arm/include/armv8-r/irq.h` with the
dispatch configurations (`#if defined(CONFIG_BUILD_PROTECTED) ||
defined(CONFIG_BUILD_KERNEL)`).
## Impact
- **Security & Stability**: Unprivileged user code can no longer invoke
privileged context switches or counterfeit signal handler returns.
- **Portability & Parity**: Consistent reserved syscall behavior across ARM,
ARM64, and RISC-V architectures.
- **Build Configurations**: Clean compilation across flat, protected,
kernel, full-signals, and partial/disabled signal configurations.
## Testing
- Verified 100% `nxstyle` compliance (0 errors, line length <= 78 cols, 0
tabs, clean preprocessor blocks).
- Validated macro logic across flat, protected, kernel, and partial-signal
permutations.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
