diff --git a/portable/GCC/ARM_CM3_MPU/port.c b/portable/GCC/ARM_CM3_MPU/port.c
index 2233f8db9..5693a2ff7 100644
--- a/portable/GCC/ARM_CM3_MPU/port.c
+++ b/portable/GCC/ARM_CM3_MPU/port.c
@@ -584,6 +584,7 @@ __attribute__(( weak )) void vPortSetupTimerInterrupt( void )
 
 static void prvSetupMPU( void )
 {
+extern uint32_t __privileged_functions_start__[];
 extern uint32_t __privileged_functions_end__[];
 extern uint32_t __FLASH_segment_start__[];
 extern uint32_t __FLASH_segment_end__[];
@@ -593,7 +594,7 @@ extern uint32_t __privileged_data_end__[];
 	/* Check the expected MPU is present. */
 	if( portMPU_TYPE_REG == portEXPECTED_MPU_TYPE_VALUE )
 	{
-		/* First setup the entire flash for unprivileged read only access. */
+		/* First setup the unprivileged flash for unprivileged read only access. */
 		portMPU_REGION_BASE_ADDRESS_REG =	( ( uint32_t ) __FLASH_segment_start__ ) | /* Base address. */
 											( portMPU_REGION_VALID ) |
 											( portUNPRIVILEGED_FLASH_REGION );
@@ -603,16 +604,15 @@ extern uint32_t __privileged_data_end__[];
 										( prvGetMPURegionSizeSetting( ( uint32_t ) __FLASH_segment_end__ - ( uint32_t ) __FLASH_segment_start__ ) ) |
 										( portMPU_REGION_ENABLE );
 
-		/* Setup the first 16K for privileged only access (even though less
-		 * than 10K is actually being used).  This is where the kernel code is
-		 * placed. */
-		portMPU_REGION_BASE_ADDRESS_REG =	( ( uint32_t ) __FLASH_segment_start__ ) | /* Base address. */
+		/* Setup the privileged flash for privileged only access.  This is where
+		 * the kernel code is * placed. */
+		portMPU_REGION_BASE_ADDRESS_REG =	( ( uint32_t ) __privileged_functions_start__ ) | /* Base address. */
 											( portMPU_REGION_VALID ) |
 											( portPRIVILEGED_FLASH_REGION );
 
 		portMPU_REGION_ATTRIBUTE_REG =	( portMPU_REGION_PRIVILEGED_READ_ONLY ) |
 										( portMPU_REGION_CACHEABLE_BUFFERABLE ) |
-										( prvGetMPURegionSizeSetting( ( uint32_t ) __privileged_functions_end__ - ( uint32_t ) __FLASH_segment_start__ ) ) |
+										( prvGetMPURegionSizeSetting( ( uint32_t ) __privileged_functions_end__ - ( uint32_t ) __privileged_functions_start__ ) ) |
 										( portMPU_REGION_ENABLE );
 
 		/* Setup the privileged data RAM region.  This is where the kernel data
diff --git a/portable/GCC/ARM_CM4_MPU/port.c b/portable/GCC/ARM_CM4_MPU/port.c
index 63026d85c..5f9697cea 100644
--- a/portable/GCC/ARM_CM4_MPU/port.c
+++ b/portable/GCC/ARM_CM4_MPU/port.c
@@ -640,6 +640,7 @@ static void prvSetupMPU( void )
 #if defined( __ARMCC_VERSION )
 	/* Declaration when these variable are defined in code instead of being
 	 * exported from linker scripts. */
+	extern uint32_t * __privileged_functions_start__;
 	extern uint32_t * __privileged_functions_end__;
 	extern uint32_t * __FLASH_segment_start__;
 	extern uint32_t * __FLASH_segment_end__;
@@ -647,6 +648,7 @@ static void prvSetupMPU( void )
 	extern uint32_t * __privileged_data_end__;
 #else
 	/* Declaration when these variable are exported from linker scripts. */
+	extern uint32_t __privileged_functions_start__[];
 	extern uint32_t __privileged_functions_end__[];
 	extern uint32_t __FLASH_segment_start__[];
 	extern uint32_t __FLASH_segment_end__[];
@@ -656,7 +658,7 @@ static void prvSetupMPU( void )
 	/* Check the expected MPU is present. */
 	if( portMPU_TYPE_REG == portEXPECTED_MPU_TYPE_VALUE )
 	{
-		/* First setup the entire flash for unprivileged read only access. */
+		/* First setup the unprivileged flash for unprivileged read only access. */
 		portMPU_REGION_BASE_ADDRESS_REG =	( ( uint32_t ) __FLASH_segment_start__ ) | /* Base address. */
 											( portMPU_REGION_VALID ) |
 											( portUNPRIVILEGED_FLASH_REGION );
@@ -666,16 +668,15 @@ static void prvSetupMPU( void )
 										( prvGetMPURegionSizeSetting( ( uint32_t ) __FLASH_segment_end__ - ( uint32_t ) __FLASH_segment_start__ ) ) |
 										( portMPU_REGION_ENABLE );
 
-		/* Setup the first nK for privileged only access (even though less
-		than 10K is actually being used).  This is where the kernel code is
-		placed. */
-		portMPU_REGION_BASE_ADDRESS_REG =	( ( uint32_t ) __FLASH_segment_start__ ) | /* Base address. */
+		/* Setup the privileged flash for privileged only access.  This is where
+		the kernel code is placed. */
+		portMPU_REGION_BASE_ADDRESS_REG =	( ( uint32_t ) __privileged_functions_start__ ) | /* Base address. */
 											( portMPU_REGION_VALID ) |
 											( portPRIVILEGED_FLASH_REGION );
 
 		portMPU_REGION_ATTRIBUTE_REG =	( portMPU_REGION_PRIVILEGED_READ_ONLY ) |
 										( portMPU_REGION_CACHEABLE_BUFFERABLE ) |
-										( prvGetMPURegionSizeSetting( ( uint32_t ) __privileged_functions_end__ - ( uint32_t ) __FLASH_segment_start__ ) ) |
+										( prvGetMPURegionSizeSetting( ( uint32_t ) __privileged_functions_end__ - ( uint32_t ) __privileged_functions_start__ ) ) |
 										( portMPU_REGION_ENABLE );
 
 		/* Setup the privileged data RAM region.  This is where the kernel data
diff --git a/portable/IAR/ARM_CM4F_MPU/port.c b/portable/IAR/ARM_CM4F_MPU/port.c
index 39e7e4015..6b4dd0a78 100644
--- a/portable/IAR/ARM_CM4F_MPU/port.c
+++ b/portable/IAR/ARM_CM4F_MPU/port.c
@@ -506,6 +506,7 @@ __weak void vPortSetupTimerInterrupt( void )
 
 static void prvSetupMPU( void )
 {
+extern uint32_t __privileged_functions_start__[];
 extern uint32_t __privileged_functions_end__[];
 extern uint32_t __FLASH_segment_start__[];
 extern uint32_t __FLASH_segment_end__[];
@@ -515,7 +516,7 @@ extern uint32_t __privileged_data_end__[];
 	/* Check the expected MPU is present. */
 	if( portMPU_TYPE_REG == portEXPECTED_MPU_TYPE_VALUE )
 	{
-		/* First setup the entire flash for unprivileged read only access. */
+		/* First setup the unprivileged flash for unprivileged read only access. */
 		portMPU_REGION_BASE_ADDRESS_REG =	( ( uint32_t ) __FLASH_segment_start__ ) | /* Base address. */
 											( portMPU_REGION_VALID ) |
 											( portUNPRIVILEGED_FLASH_REGION );
@@ -525,16 +526,15 @@ extern uint32_t __privileged_data_end__[];
 										( prvGetMPURegionSizeSetting( ( uint32_t ) __FLASH_segment_end__ - ( uint32_t ) __FLASH_segment_start__ ) ) |
 										( portMPU_REGION_ENABLE );
 
-		/* Setup the first 16K for privileged only access (even though less
-		 * than 10K is actually being used).  This is where the kernel code is
-		 * placed. */
-		portMPU_REGION_BASE_ADDRESS_REG =	( ( uint32_t ) __FLASH_segment_start__ ) | /* Base address. */
+		/* Setup the privileged flash for privileged only access.  This is where
+		 * the kernel code is placed. */
+		portMPU_REGION_BASE_ADDRESS_REG =	( ( uint32_t ) __privileged_functions_start__ ) | /* Base address. */
 											( portMPU_REGION_VALID ) |
 											( portPRIVILEGED_FLASH_REGION );
 
 		portMPU_REGION_ATTRIBUTE_REG =	( portMPU_REGION_PRIVILEGED_READ_ONLY ) |
 										( portMPU_REGION_CACHEABLE_BUFFERABLE ) |
-										( prvGetMPURegionSizeSetting( ( uint32_t ) __privileged_functions_end__ - ( uint32_t ) __FLASH_segment_start__ ) ) |
+										( prvGetMPURegionSizeSetting( ( uint32_t ) __privileged_functions_end__ - ( uint32_t ) __privileged_functions_start__ ) ) |
 										( portMPU_REGION_ENABLE );
 
 		/* Setup the privileged data RAM region.  This is where the kernel data
diff --git a/portable/RVDS/ARM_CM4_MPU/port.c b/portable/RVDS/ARM_CM4_MPU/port.c
index ab0b2ba39..59ae308d3 100644
--- a/portable/RVDS/ARM_CM4_MPU/port.c
+++ b/portable/RVDS/ARM_CM4_MPU/port.c
@@ -638,6 +638,7 @@ __asm void vPortEnableVFP( void )
 
 static void prvSetupMPU( void )
 {
+extern uint32_t __privileged_functions_start__;
 extern uint32_t __privileged_functions_end__;
 extern uint32_t __FLASH_segment_start__;
 extern uint32_t __FLASH_segment_end__;
@@ -647,7 +648,7 @@ extern uint32_t __privileged_data_end__;
 	/* Check the expected MPU is present. */
 	if( portMPU_TYPE_REG == portEXPECTED_MPU_TYPE_VALUE )
 	{
-		/* First setup the entire flash for unprivileged read only access. */
+		/* First setup the unprivileged flash for unprivileged read only access. */
 		portMPU_REGION_BASE_ADDRESS_REG =	( ( uint32_t ) __FLASH_segment_start__ ) | /* Base address. */
 											( portMPU_REGION_VALID ) |
 											( portUNPRIVILEGED_FLASH_REGION );
@@ -657,16 +658,15 @@ extern uint32_t __privileged_data_end__;
 										( prvGetMPURegionSizeSetting( ( uint32_t ) __FLASH_segment_end__ - ( uint32_t ) __FLASH_segment_start__ ) ) |
 										( portMPU_REGION_ENABLE );
 
-		/* Setup the first 16K for privileged only access (even though less
-		 * than 10K is actually being used).  This is where the kernel code is
-		 * placed. */
-		portMPU_REGION_BASE_ADDRESS_REG =	( ( uint32_t ) __FLASH_segment_start__ ) | /* Base address. */
+		/* Setup the privileged flash for privileged only access.  This is where
+		 * the kernel code is placed. */
+		portMPU_REGION_BASE_ADDRESS_REG =	( ( uint32_t ) __privileged_functions_start__ ) | /* Base address. */
 											( portMPU_REGION_VALID ) |
 											( portPRIVILEGED_FLASH_REGION );
 
 		portMPU_REGION_ATTRIBUTE_REG =	( portMPU_REGION_PRIVILEGED_READ_ONLY ) |
 										( portMPU_REGION_CACHEABLE_BUFFERABLE ) |
-										( prvGetMPURegionSizeSetting( ( uint32_t ) __privileged_functions_end__ - ( uint32_t ) __FLASH_segment_start__ ) ) |
+										( prvGetMPURegionSizeSetting( ( uint32_t ) __privileged_functions_end__ - ( uint32_t ) __privileged_functions_start__ ) ) |
 										( portMPU_REGION_ENABLE );
 
 		/* Setup the privileged data RAM region.  This is where the kernel data