From 0f75c1951a8a46519577d267332d762fad6d6598 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fr=C3=A9d=C3=A9ric=20Desbiens?= Date: Thu, 22 Oct 2026 11:37:00 -0400 Subject: [PATCH] Refused user mode and memory protection on the Cortex-A35 module ports Fixes #816 The Cortex-A35 and Cortex-A35 SMP module ports listed TXM_MODULE_USER_MODE and TXM_MODULE_MEMORY_PROTECTION as supported, so a module requesting them loaded, but the ports implement neither: module threads run at the Module Manager's exception level and call it directly, and no memory management is configured for a module. A module that asked for user mode ran privileged, and one that asked for memory protection was not confined and had most of its service calls refused. The four port headers now list only TXM_MODULE_SHARED_EXTERNAL_MEMORY_ACCESS, so the existing load check refuses both properties with TXM_MODULE_INVALID_PROPERTIES. A module whose preamble sets TXM_MODULE_USER_MODE must clear it; the bit never had an effect on these ports. The inside-data check now reads TX_FALSE instead of TX_SUCCESS, which has the same value and is no longer reachable. scripts/check_gcc.sh (Arm GNU 14.3.rel1) and scripts/check_clang.sh (ATfE 22.1.0) pass every stage with zero warnings, including the A35 and A35 SMP module manager sources, 31 of 31 each, and all 45 example builds. The AI disclosure check passes. No executable line changed; not run on A35 hardware or a model. Assisted-by: Claude Code (Opus 5.5) --- ports_module/cortex_a35/ac6/inc/txm_module_port.h | 12 ++++++++---- ports_module/cortex_a35/gnu/inc/txm_module_port.h | 12 ++++++++---- .../cortex_a35_smp/ac6/inc/txm_module_port.h | 12 ++++++++---- .../cortex_a35_smp/gnu/inc/txm_module_port.h | 12 ++++++++---- 4 files changed, 32 insertions(+), 16 deletions(-) diff --git a/ports_module/cortex_a35/ac6/inc/txm_module_port.h b/ports_module/cortex_a35/ac6/inc/txm_module_port.h index cbe6b8e37..51eb13621 100644 --- a/ports_module/cortex_a35/ac6/inc/txm_module_port.h +++ b/ports_module/cortex_a35/ac6/inc/txm_module_port.h @@ -8,6 +8,7 @@ * * SPDX-License-Identifier: MIT **************************************************************************/ +// Portions of this file were generated with AI assistance. /**************************************************************************/ @@ -114,9 +115,11 @@ The following extensions must also be defined in tx_port.h: #define TXM_MODULE_SHARED_EXTERNAL_MEMORY_ACCESS 0x00000004 -/* Define the supported options for this module. */ +/* Define the supported options for this module. Module threads run at the Module Manager's + exception level and call it directly, so this port cannot isolate a module and refuses + user mode and memory protection at load. */ -#define TXM_MODULE_MANAGER_SUPPORTED_OPTIONS (TXM_MODULE_USER_MODE | TXM_MODULE_MEMORY_PROTECTION | TXM_MODULE_SHARED_EXTERNAL_MEMORY_ACCESS) +#define TXM_MODULE_MANAGER_SUPPORTED_OPTIONS (TXM_MODULE_SHARED_EXTERNAL_MEMORY_ACCESS) #define TXM_MODULE_MANAGER_REQUIRED_OPTIONS 0 @@ -255,8 +258,9 @@ typedef struct TXM_MODULE_MANAGER_MEMORY_FAULT_INFO_STRUCT /* Define the macros to perform port-specific checks when passing pointers to the kernel. */ -/* Define macro to make sure object is inside the module's data. */ -#define TXM_MODULE_MANAGER_CHECK_INSIDE_DATA(module_instance, obj_ptr, obj_size) (TX_SUCCESS) +/* Define macro to make sure object is inside the module's data. No module on this port has + memory protection, so this is never asked; any range is refused if it is. */ +#define TXM_MODULE_MANAGER_CHECK_INSIDE_DATA(module_instance, obj_ptr, obj_size) (TX_FALSE) /* Define some internal prototypes to this module port. */ diff --git a/ports_module/cortex_a35/gnu/inc/txm_module_port.h b/ports_module/cortex_a35/gnu/inc/txm_module_port.h index e5654cde7..9daa63083 100644 --- a/ports_module/cortex_a35/gnu/inc/txm_module_port.h +++ b/ports_module/cortex_a35/gnu/inc/txm_module_port.h @@ -8,6 +8,7 @@ * * SPDX-License-Identifier: MIT **************************************************************************/ +// Portions of this file were generated with AI assistance. /**************************************************************************/ @@ -114,9 +115,11 @@ The following extensions must also be defined in tx_port.h: #define TXM_MODULE_SHARED_EXTERNAL_MEMORY_ACCESS 0x00000004 -/* Define the supported options for this module. */ +/* Define the supported options for this module. Module threads run at the Module Manager's + exception level and call it directly, so this port cannot isolate a module and refuses + user mode and memory protection at load. */ -#define TXM_MODULE_MANAGER_SUPPORTED_OPTIONS (TXM_MODULE_USER_MODE | TXM_MODULE_MEMORY_PROTECTION | TXM_MODULE_SHARED_EXTERNAL_MEMORY_ACCESS) +#define TXM_MODULE_MANAGER_SUPPORTED_OPTIONS (TXM_MODULE_SHARED_EXTERNAL_MEMORY_ACCESS) #define TXM_MODULE_MANAGER_REQUIRED_OPTIONS 0 @@ -255,8 +258,9 @@ typedef struct TXM_MODULE_MANAGER_MEMORY_FAULT_INFO_STRUCT /* Define the macros to perform port-specific checks when passing pointers to the kernel. */ -/* Define macro to make sure object is inside the module's data. */ -#define TXM_MODULE_MANAGER_CHECK_INSIDE_DATA(module_instance, obj_ptr, obj_size) (TX_SUCCESS) +/* Define macro to make sure object is inside the module's data. No module on this port has + memory protection, so this is never asked; any range is refused if it is. */ +#define TXM_MODULE_MANAGER_CHECK_INSIDE_DATA(module_instance, obj_ptr, obj_size) (TX_FALSE) /* Define some internal prototypes to this module port. */ diff --git a/ports_module/cortex_a35_smp/ac6/inc/txm_module_port.h b/ports_module/cortex_a35_smp/ac6/inc/txm_module_port.h index 97930b4f6..35ec29c45 100644 --- a/ports_module/cortex_a35_smp/ac6/inc/txm_module_port.h +++ b/ports_module/cortex_a35_smp/ac6/inc/txm_module_port.h @@ -8,6 +8,7 @@ * * SPDX-License-Identifier: MIT **************************************************************************/ +// Portions of this file were generated with AI assistance. /**************************************************************************/ @@ -114,9 +115,11 @@ The following extensions must also be defined in tx_port.h: #define TXM_MODULE_SHARED_EXTERNAL_MEMORY_ACCESS 0x00000004 -/* Define the supported options for this module. */ +/* Define the supported options for this module. Module threads run at the Module Manager's + exception level and call it directly, so this port cannot isolate a module and refuses + user mode and memory protection at load. */ -#define TXM_MODULE_MANAGER_SUPPORTED_OPTIONS (TXM_MODULE_USER_MODE | TXM_MODULE_MEMORY_PROTECTION | TXM_MODULE_SHARED_EXTERNAL_MEMORY_ACCESS) +#define TXM_MODULE_MANAGER_SUPPORTED_OPTIONS (TXM_MODULE_SHARED_EXTERNAL_MEMORY_ACCESS) #define TXM_MODULE_MANAGER_REQUIRED_OPTIONS 0 @@ -250,8 +253,9 @@ typedef struct TXM_MODULE_MANAGER_MEMORY_FAULT_INFO_STRUCT /* Define the macros to perform port-specific checks when passing pointers to the kernel. */ -/* Define macro to make sure object is inside the module's data. */ -#define TXM_MODULE_MANAGER_CHECK_INSIDE_DATA(module_instance, obj_ptr, obj_size) (TX_SUCCESS) +/* Define macro to make sure object is inside the module's data. No module on this port has + memory protection, so this is never asked; any range is refused if it is. */ +#define TXM_MODULE_MANAGER_CHECK_INSIDE_DATA(module_instance, obj_ptr, obj_size) (TX_FALSE) /* Define some internal prototypes to this module port. */ diff --git a/ports_module/cortex_a35_smp/gnu/inc/txm_module_port.h b/ports_module/cortex_a35_smp/gnu/inc/txm_module_port.h index 99e7d0569..c92ea9ce5 100644 --- a/ports_module/cortex_a35_smp/gnu/inc/txm_module_port.h +++ b/ports_module/cortex_a35_smp/gnu/inc/txm_module_port.h @@ -8,6 +8,7 @@ * * SPDX-License-Identifier: MIT **************************************************************************/ +// Portions of this file were generated with AI assistance. /**************************************************************************/ @@ -114,9 +115,11 @@ The following extensions must also be defined in tx_port.h: #define TXM_MODULE_SHARED_EXTERNAL_MEMORY_ACCESS 0x00000004 -/* Define the supported options for this module. */ +/* Define the supported options for this module. Module threads run at the Module Manager's + exception level and call it directly, so this port cannot isolate a module and refuses + user mode and memory protection at load. */ -#define TXM_MODULE_MANAGER_SUPPORTED_OPTIONS (TXM_MODULE_USER_MODE | TXM_MODULE_MEMORY_PROTECTION | TXM_MODULE_SHARED_EXTERNAL_MEMORY_ACCESS) +#define TXM_MODULE_MANAGER_SUPPORTED_OPTIONS (TXM_MODULE_SHARED_EXTERNAL_MEMORY_ACCESS) #define TXM_MODULE_MANAGER_REQUIRED_OPTIONS 0 @@ -250,8 +253,9 @@ typedef struct TXM_MODULE_MANAGER_MEMORY_FAULT_INFO_STRUCT /* Define the macros to perform port-specific checks when passing pointers to the kernel. */ -/* Define macro to make sure object is inside the module's data. */ -#define TXM_MODULE_MANAGER_CHECK_INSIDE_DATA(module_instance, obj_ptr, obj_size) (TX_SUCCESS) +/* Define macro to make sure object is inside the module's data. No module on this port has + memory protection, so this is never asked; any range is refused if it is. */ +#define TXM_MODULE_MANAGER_CHECK_INSIDE_DATA(module_instance, obj_ptr, obj_size) (TX_FALSE) /* Define some internal prototypes to this module port. */