Updates to CM4_MPU GCC port

- System calls are now only allowed from kernel code. This change can be turned on
  or off using configENFORCE_SYSTEM_CALLS_FROM_KERNEL_ONLY.
- MPU is disabled before reprogramming it and enabled afterwards to be compliant
  with ARM recommendations.

git-svn-id: https://svn.code.sf.net/p/freertos/code/trunk@2766 1d2547de-c912-0410-9cb9-b8ca96c0e9e2

diff --git a/FreeRTOS/Source/portable/GCC/ARM_CM4_MPU/port.c b/FreeRTOS/Source/portable/GCC/ARM_CM4_MPU/port.c
index a09da158cd382aac6aabf82d8dca140f4f71f074..8f9119c2ceaeceffe2965fb542ef0d97ce239e84 100644 (file)
--- a/FreeRTOS/Source/portable/GCC/ARM_CM4_MPU/port.c
+++ b/FreeRTOS/Source/portable/GCC/ARM_CM4_MPU/port.c
@@ -134,7 +134,7 @@ void vPortSetupTimerInterrupt( void );
  * Standard FreeRTOS exception handlers.\r
  */\r
 void xPortPendSVHandler( void ) __attribute__ (( naked )) PRIVILEGED_FUNCTION;\r
-void xPortSysTickHandler( void )  __attribute__ ((optimize("3"))) PRIVILEGED_FUNCTION;\r
+void xPortSysTickHandler( void ) PRIVILEGED_FUNCTION;\r
 void vPortSVCHandler( void ) __attribute__ (( naked )) PRIVILEGED_FUNCTION;\r
 \r
 /*\r
@@ -260,10 +260,25 @@ void vPortSVCHandler( void )
 static void prvSVCHandler(     uint32_t *pulParam )\r
 {\r
 uint8_t ucSVCNumber;\r
+uint32_t ulPC;\r
+#if( configENFORCE_SYSTEM_CALLS_FROM_KERNEL_ONLY == 1 )\r
+       #if defined( __ARMCC_VERSION )\r
+               /* Declaration when these variable are defined in code instead of being\r
+               * exported from linker scripts. */\r
+               extern uint32_t * __syscalls_flash_start__;\r
+               extern uint32_t * __syscalls_flash_end__;\r
+       #else\r
+               /* Declaration when these variable are exported from linker scripts. */\r
+               extern uint32_t __syscalls_flash_start__[];\r
+               extern uint32_t __syscalls_flash_end__[];\r
+       #endif /* #if defined( __ARMCC_VERSION ) */\r
+#endif /* #if( configENFORCE_SYSTEM_CALLS_FROM_KERNEL_ONLY == 1 ) */\r
+\r
+       /* The stack contains: r0, r1, r2, r3, r12, LR, PC and xPSR.  The first\r
+       argument (r0) is pulParam[ 0 ]. */\r
+       ulPC = pulParam[ portOFFSET_TO_PC ];\r
+       ucSVCNumber = ( ( uint8_t * ) ulPC )[ -2 ];\r
 \r
-       /* The stack contains: r0, r1, r2, r3, r12, r14, the return address and\r
-       xPSR.  The first argument (r0) is pulParam[ 0 ]. */\r
-       ucSVCNumber = ( ( uint8_t * ) pulParam[ portOFFSET_TO_PC ] )[ -2 ];\r
        switch( ucSVCNumber )\r
        {\r
                case portSVC_START_SCHEDULER    :       portNVIC_SYSPRI1_REG |= portNVIC_SVC_PRI;\r
@@ -280,6 +295,23 @@ uint8_t ucSVCNumber;
 \r
                                                                                        break;\r
 \r
+       #if( configENFORCE_SYSTEM_CALLS_FROM_KERNEL_ONLY == 1 )\r
+               case portSVC_RAISE_PRIVILEGE    :       /* Only raise the privilege, if the\r
+                                                                                        * svc was raised from any of the\r
+                                                                                        * system calls. */\r
+                                                                                       if( ulPC >= ( uint32_t ) __syscalls_flash_start__ &&\r
+                                                                                               ulPC <= ( uint32_t ) __syscalls_flash_end__ )\r
+                                                                                       {\r
+                                                                                               __asm volatile\r
+                                                                                               (\r
+                                                                                                       "       mrs r1, control         \n" /* Obtain current control value. */\r
+                                                                                                       "       bic r1, #1                      \n" /* Set privilege bit. */\r
+                                                                                                       "       msr control, r1         \n" /* Write back new control value. */\r
+                                                                                                       ::: "r1", "memory"\r
+                                                                                               );\r
+                                                                                       }\r
+                                                                                       break;\r
+       #else\r
                case portSVC_RAISE_PRIVILEGE    :       __asm volatile\r
                                                                                        (\r
                                                                                                "       mrs r1, control         \n" /* Obtain current control value. */\r
@@ -288,6 +320,7 @@ uint8_t ucSVCNumber;
                                                                                                ::: "r1", "memory"\r
                                                                                        );\r
                                                                                        break;\r
+       #endif /* #if( configENFORCE_SYSTEM_CALLS_FROM_KERNEL_ONLY == 1 ) */\r
 \r
                default                                                 :       /* Unknown SVC call. */\r
                                                                                        break;\r
@@ -307,9 +340,23 @@ static void prvRestoreContextOfFirstTask( void )
                "       ldr r1, [r3]                                    \n"\r
                "       ldr r0, [r1]                                    \n" /* The first item in the TCB is the task top of stack. */\r
                "       add r1, r1, #4                                  \n" /* Move onto the second item in the TCB... */\r
+               "                                                                       \n"\r
+               "       dmb                                                             \n" /* Complete outstanding transfers before disabling MPU. */\r
+               "       ldr r2, =0xe000ed94                             \n" /* MPU_CTRL register. */\r
+               "       ldr r3, [r2]                                    \n" /* Read the value of MPU_CTRL. */\r
+               "       bic r3, #1                                              \n" /* r3 = r3 & ~1 i.e. Clear the bit 0 in r3. */\r
+               "       str r3, [r2]                                    \n" /* Disable MPU. */\r
+               "                                                                       \n"\r
                "       ldr r2, =0xe000ed9c                             \n" /* Region Base Address register. */\r
-               "       ldmia r1!, {r4-r11}                             \n" /* Read 4 sets of MPU registers. */\r
+               "       ldmia r1!, {r4-r11}                             \n" /* Read 4 sets of MPU registers from TCB. */\r
                "       stmia r2!, {r4-r11}                             \n" /* Write 4 sets of MPU registers. */\r
+               "                                                                       \n"\r
+               "       ldr r2, =0xe000ed94                             \n" /* MPU_CTRL register. */\r
+               "       ldr r3, [r2]                                    \n" /* Read the value of MPU_CTRL. */\r
+               "       orr r3, #1                                              \n" /* r3 = r3 | 1 i.e. Set the bit 0 in r3. */\r
+               "       str r3, [r2]                                    \n" /* Enable MPU. */\r
+               "       dsb                                                             \n" /* Force memory writes before continuing. */\r
+               "                                                                       \n"\r
                "       ldmia r0!, {r3-r11, r14}                \n" /* Pop the registers that are not automatically saved on exception entry. */\r
                "       msr control, r3                                 \n"\r
                "       msr psp, r0                                             \n" /* Restore the task stack pointer. */\r
@@ -506,9 +553,23 @@ void xPortPendSVHandler( void )
                "       ldr r1, [r3]                                            \n"\r
                "       ldr r0, [r1]                                            \n" /* The first item in the TCB is the task top of stack. */\r
                "       add r1, r1, #4                                          \n" /* Move onto the second item in the TCB... */\r
+               "                                                                               \n"\r
+               "       dmb                                                                     \n" /* Complete outstanding transfers before disabling MPU. */\r
+               "       ldr r2, =0xe000ed94                                     \n" /* MPU_CTRL register. */\r
+               "       ldr r3, [r2]                                            \n" /* Read the value of MPU_CTRL. */\r
+               "       bic r3, #1                                                      \n" /* r3 = r3 & ~1 i.e. Clear the bit 0 in r3. */\r
+               "       str r3, [r2]                                            \n" /* Disable MPU. */\r
+               "                                                                               \n"\r
                "       ldr r2, =0xe000ed9c                                     \n" /* Region Base Address register. */\r
-               "       ldmia r1!, {r4-r11}                                     \n" /* Read 4 sets of MPU registers. */\r
+               "       ldmia r1!, {r4-r11}                                     \n" /* Read 4 sets of MPU registers from TCB. */\r
                "       stmia r2!, {r4-r11}                                     \n" /* Write 4 sets of MPU registers. */\r
+               "                                                                               \n"\r
+               "       ldr r2, =0xe000ed94                                     \n" /* MPU_CTRL register. */\r
+               "       ldr r3, [r2]                                            \n" /* Read the value of MPU_CTRL. */\r
+               "       orr r3, #1                                                      \n" /* r3 = r3 | 1 i.e. Set the bit 0 in r3. */\r
+               "       str r3, [r2]                                            \n" /* Enable MPU. */\r
+               "       dsb                                                                     \n" /* Force memory writes before continuing. */\r
+               "                                                                               \n"\r
                "       ldmia r0!, {r3-r11, r14}                        \n" /* Pop the registers that are not automatically saved on exception entry. */\r
                "       msr control, r3                                         \n"\r
                "                                                                               \n"\r
@@ -576,12 +637,22 @@ static void vPortEnableVFP( void )
 \r
 static void prvSetupMPU( void )\r
 {\r
-extern uint32_t __privileged_functions_end__[];\r
-extern uint32_t __FLASH_segment_start__[];\r
-extern uint32_t __FLASH_segment_end__[];\r
-extern uint32_t __privileged_data_start__[];\r
-extern uint32_t __privileged_data_end__[];\r
-\r
+#if defined( __ARMCC_VERSION )\r
+       /* Declaration when these variable are defined in code instead of being\r
+        * exported from linker scripts. */\r
+       extern uint32_t * __privileged_functions_end__;\r
+       extern uint32_t * __FLASH_segment_start__;\r
+       extern uint32_t * __FLASH_segment_end__;\r
+       extern uint32_t * __privileged_data_start__;\r
+       extern uint32_t * __privileged_data_end__;\r
+#else\r
+       /* Declaration when these variable are exported from linker scripts. */\r
+       extern uint32_t __privileged_functions_end__[];\r
+       extern uint32_t __FLASH_segment_start__[];\r
+       extern uint32_t __FLASH_segment_end__[];\r
+       extern uint32_t __privileged_data_start__[];\r
+       extern uint32_t __privileged_data_end__[];\r
+#endif\r
        /* Check the expected MPU is present. */\r
        if( portMPU_TYPE_REG == portEXPECTED_MPU_TYPE_VALUE )\r
        {\r
@@ -693,10 +764,21 @@ void vResetPrivilege( void ) /* __attribute__ (( naked )) */
 \r
 void vPortStoreTaskMPUSettings( xMPU_SETTINGS *xMPUSettings, const struct xMEMORY_REGION * const xRegions, StackType_t *pxBottomOfStack, uint32_t ulStackDepth )\r
 {\r
-extern uint32_t __SRAM_segment_start__[];\r
-extern uint32_t __SRAM_segment_end__[];\r
-extern uint32_t __privileged_data_start__[];\r
-extern uint32_t __privileged_data_end__[];\r
+#if defined( __ARMCC_VERSION )\r
+       /* Declaration when these variable are defined in code instead of being\r
+        * exported from linker scripts. */\r
+       extern uint32_t * __SRAM_segment_start__;\r
+       extern uint32_t * __SRAM_segment_end__;\r
+       extern uint32_t * __privileged_data_start__;\r
+       extern uint32_t * __privileged_data_end__;\r
+#else\r
+       /* Declaration when these variable are exported from linker scripts. */\r
+       extern uint32_t __SRAM_segment_start__[];\r
+       extern uint32_t __SRAM_segment_end__[];\r
+       extern uint32_t __privileged_data_start__[];\r
+       extern uint32_t __privileged_data_end__[];\r
+#endif\r
+\r
 int32_t lIndex;\r
 uint32_t ul;\r
 \r

diff --git a/FreeRTOS/Source/portable/GCC/ARM_CM4_MPU/portmacro.h b/FreeRTOS/Source/portable/GCC/ARM_CM4_MPU/portmacro.h
index ff8ddb6c65370c36197985682db2117781f492ee..415255f6fd5ba8717f30fe51b9774f02928d7c9d 100644 (file)
--- a/FreeRTOS/Source/portable/GCC/ARM_CM4_MPU/portmacro.h
+++ b/FreeRTOS/Source/portable/GCC/ARM_CM4_MPU/portmacro.h
@@ -73,12 +73,13 @@ typedef unsigned long UBaseType_t;
 #define portUSING_MPU_WRAPPERS         1\r
 #define portPRIVILEGE_BIT                      ( 0x80000000UL )\r
 \r
-#define portMPU_REGION_READ_WRITE                              ( 0x03UL << 24UL )\r
-#define portMPU_REGION_PRIVILEGED_READ_ONLY            ( 0x05UL << 24UL )\r
-#define portMPU_REGION_READ_ONLY                               ( 0x06UL << 24UL )\r
-#define portMPU_REGION_PRIVILEGED_READ_WRITE   ( 0x01UL << 24UL )\r
-#define portMPU_REGION_CACHEABLE_BUFFERABLE            ( 0x07UL << 16UL )\r
-#define portMPU_REGION_EXECUTE_NEVER                   ( 0x01UL << 28UL )\r
+#define portMPU_REGION_READ_WRITE                                                              ( 0x03UL << 24UL )\r
+#define portMPU_REGION_PRIVILEGED_READ_ONLY                                            ( 0x05UL << 24UL )\r
+#define portMPU_REGION_READ_ONLY                                                               ( 0x06UL << 24UL )\r
+#define portMPU_REGION_PRIVILEGED_READ_WRITE                                   ( 0x01UL << 24UL )\r
+#define portMPU_REGION_PRIVILEGED_READ_WRITE_UNPRIV_READ_ONLY  ( 0x02UL << 24UL )\r
+#define portMPU_REGION_CACHEABLE_BUFFERABLE                                            ( 0x07UL << 16UL )\r
+#define portMPU_REGION_EXECUTE_NEVER                                                   ( 0x01UL << 28UL )\r
 \r
 #define portUNPRIVILEGED_FLASH_REGION          ( 0UL )\r
 #define portPRIVILEGED_FLASH_REGION                    ( 1UL )\r
@@ -293,6 +294,11 @@ portFORCE_INLINE static void vPortSetBASEPRI( uint32_t ulNewMaskValue )
 \r
 #define portMEMORY_BARRIER() __asm volatile( "" ::: "memory" )\r
 \r
+#ifndef configENFORCE_SYSTEM_CALLS_FROM_KERNEL_ONLY\r
+       #warning "configENFORCE_SYSTEM_CALLS_FROM_KERNEL_ONLY is not defined. We recommend defining it to 1 in FreeRTOSConfig.h for better security."\r
+       #define configENFORCE_SYSTEM_CALLS_FROM_KERNEL_ONLY 0\r
+#endif\r
+/*-----------------------------------------------------------*/\r
 #ifdef __cplusplus\r
 }\r
 #endif\r