len0rd/FreeRTOS-Kernel
1
0
Fork 0
mirror of https://github.com/FreeRTOS/FreeRTOS-Kernel.git synced 2026-10-09 23:53:04 -04:00
Code Issues Projects Releases Packages Wiki Activity

Allow start scheduler and free context SVC from privileged code only (#1475)

Browse source 
Allow start scheduler and free context SVC from privileged code only

Signed-off-by: Gaurav Aggarwal <aggarg@amazon.com>
This commit is contained in:
Kody Stribrny 2026-08-21 10:24:35 -07:00 • committed by GitHub
parent a0e2097c6a
commit 3ca84562d8
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
44 changed files with 1717 additions and 799 deletions
Download patch file Download diff file Expand all files Collapse all files

31
portable/ARMv8M/non_secure/port.c
View file

@ -1109,7 +1109,6 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
{ {
#if ( ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) ) #if ( ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) )
#if defined( __ARMCC_VERSION ) #if defined( __ARMCC_VERSION )
/* Declaration when these variable are defined in code instead of being /* Declaration when these variable are defined in code instead of being
* exported from linker scripts. */ * exported from linker scripts. */
extern uint32_t * __syscalls_flash_start__; extern uint32_t * __syscalls_flash_start__;
@ -1121,6 +1120,19 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
#endif /* defined( __ARMCC_VERSION ) */ #endif /* defined( __ARMCC_VERSION ) */
#endif /* ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) */ #endif /* ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) */
#if ( configENABLE_MPU == 1 )
#if defined( __ARMCC_VERSION )
/* Declaration when these variable are defined in code instead of being
* exported from linker scripts. */
extern uint32_t * __privileged_functions_start__;
extern uint32_t * __privileged_functions_end__;
#else
/* Declaration when these variable are exported from linker scripts. */
extern uint32_t __privileged_functions_start__[];
extern uint32_t __privileged_functions_end__[];
#endif /* defined( __ARMCC_VERSION ) */
#endif /* configENABLE_MPU == 1 */
uint32_t ulPC; uint32_t ulPC;
#if ( configENABLE_TRUSTZONE == 1 ) #if ( configENABLE_TRUSTZONE == 1 )
@ -1170,7 +1182,11 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
break; break;
case portSVC_FREE_SECURE_CONTEXT: case portSVC_FREE_SECURE_CONTEXT:
#if ( configENABLE_MPU == 1 )
if( ( ulPC >= ( uint32_t ) __privileged_functions_start__ ) &&
( ulPC <= ( uint32_t ) __privileged_functions_end__ ) )
{
#endif /* configENABLE_MPU */
/* R0 contains TCB being freed and R1 contains the secure /* R0 contains TCB being freed and R1 contains the secure
* context handle to be freed. */ * context handle to be freed. */
ulR0 = pulCallerStackAddress[ 0 ]; ulR0 = pulCallerStackAddress[ 0 ];
@ -1178,10 +1194,18 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
/* Free the secure context. */ /* Free the secure context. */
SecureContext_FreeContext( ( SecureContextHandle_t ) ulR1, ( void * ) ulR0 ); SecureContext_FreeContext( ( SecureContextHandle_t ) ulR1, ( void * ) ulR0 );
#if ( configENABLE_MPU == 1 )
}
#endif /* configENABLE_MPU */
break; break;
#endif /* configENABLE_TRUSTZONE */ #endif /* configENABLE_TRUSTZONE */
case portSVC_START_SCHEDULER: case portSVC_START_SCHEDULER:
#if ( configENABLE_MPU == 1 )
if( ( ulPC >= ( uint32_t ) __privileged_functions_start__ ) &&
( ulPC <= ( uint32_t ) __privileged_functions_end__ ) )
{
#endif /* configENABLE_MPU */
#if ( configENABLE_TRUSTZONE == 1 ) #if ( configENABLE_TRUSTZONE == 1 )
{ {
/* De-prioritize the non-secure exceptions so that the /* De-prioritize the non-secure exceptions so that the
@ -1203,6 +1227,9 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
/* Setup the context of the first task so that the first task starts /* Setup the context of the first task so that the first task starts
* executing. */ * executing. */
vRestoreContextOfFirstTask(); vRestoreContextOfFirstTask();
#if ( configENABLE_MPU == 1 )
}
#endif /* configENABLE_MPU */
break; break;
#if ( ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) ) #if ( ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) )

15
portable/ARMv8M/secure/context/secure_context.c
View file

@ -290,9 +290,12 @@ secureportNON_SECURE_CALLABLE void SecureContext_FreeContext( SecureContextHandl
void * pvTaskHandle ) void * pvTaskHandle )
{ {
uint32_t ulIPSR, ulSecureContextIndex; uint32_t ulIPSR, ulSecureContextIndex;
uint8_t * pucStackLimit;
/* Read the Interrupt Program Status Register (IPSR) value. */ /* Read the Interrupt Program Status Register (IPSR) and Process Stack Limit
* Register (PSPLIM) value. */
secureportREAD_IPSR( ulIPSR ); secureportREAD_IPSR( ulIPSR );
secureportREAD_PSPLIM( pucStackLimit );
/* Do nothing if the processor is running in the Thread Mode. IPSR is zero /* Do nothing if the processor is running in the Thread Mode. IPSR is zero
* when the processor is running in the Thread Mode. */ * when the processor is running in the Thread Mode. */
@ -304,8 +307,14 @@ secureportNON_SECURE_CALLABLE void SecureContext_FreeContext( SecureContextHandl
ulSecureContextIndex = xSecureContextHandle - 1UL; ulSecureContextIndex = xSecureContextHandle - 1UL;
/* Ensure that the secure context being deleted is associated with /* Ensure that the secure context being deleted is associated with
* the task. */ * the task and is NOT the currently-loaded context. Freeing a
if( xSecureContexts[ ulSecureContextIndex ].pvTaskHandle == pvTaskHandle ) * context whose stack is currently loaded in PSPLIM would leave the
* running task referencing freed secure memory (use-after-free).
* pvTaskHandle is supplied by the non-secure side and is untrusted,
* so it is used only as an additional ownership match, not as
* authority. */
if( ( xSecureContexts[ ulSecureContextIndex ].pvTaskHandle == pvTaskHandle ) &&
( xSecureContexts[ ulSecureContextIndex ].pucStackLimit != pucStackLimit ) )
{ {
/* Free the stack space. */ /* Free the stack space. */
vPortFree( xSecureContexts[ ulSecureContextIndex ].pucStackLimit ); vPortFree( xSecureContexts[ ulSecureContextIndex ].pucStackLimit );

31
portable/GCC/ARM_CM23/non_secure/port.c
View file

@ -1109,7 +1109,6 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
{ {
#if ( ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) ) #if ( ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) )
#if defined( __ARMCC_VERSION ) #if defined( __ARMCC_VERSION )
/* Declaration when these variable are defined in code instead of being /* Declaration when these variable are defined in code instead of being
* exported from linker scripts. */ * exported from linker scripts. */
extern uint32_t * __syscalls_flash_start__; extern uint32_t * __syscalls_flash_start__;
@ -1121,6 +1120,19 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
#endif /* defined( __ARMCC_VERSION ) */ #endif /* defined( __ARMCC_VERSION ) */
#endif /* ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) */ #endif /* ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) */
#if ( configENABLE_MPU == 1 )
#if defined( __ARMCC_VERSION )
/* Declaration when these variable are defined in code instead of being
* exported from linker scripts. */
extern uint32_t * __privileged_functions_start__;
extern uint32_t * __privileged_functions_end__;
#else
/* Declaration when these variable are exported from linker scripts. */
extern uint32_t __privileged_functions_start__[];
extern uint32_t __privileged_functions_end__[];
#endif /* defined( __ARMCC_VERSION ) */
#endif /* configENABLE_MPU == 1 */
uint32_t ulPC; uint32_t ulPC;
#if ( configENABLE_TRUSTZONE == 1 ) #if ( configENABLE_TRUSTZONE == 1 )
@ -1170,7 +1182,11 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
break; break;
case portSVC_FREE_SECURE_CONTEXT: case portSVC_FREE_SECURE_CONTEXT:
#if ( configENABLE_MPU == 1 )
if( ( ulPC >= ( uint32_t ) __privileged_functions_start__ ) &&
( ulPC <= ( uint32_t ) __privileged_functions_end__ ) )
{
#endif /* configENABLE_MPU */
/* R0 contains TCB being freed and R1 contains the secure /* R0 contains TCB being freed and R1 contains the secure
* context handle to be freed. */ * context handle to be freed. */
ulR0 = pulCallerStackAddress[ 0 ]; ulR0 = pulCallerStackAddress[ 0 ];
@ -1178,10 +1194,18 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
/* Free the secure context. */ /* Free the secure context. */
SecureContext_FreeContext( ( SecureContextHandle_t ) ulR1, ( void * ) ulR0 ); SecureContext_FreeContext( ( SecureContextHandle_t ) ulR1, ( void * ) ulR0 );
#if ( configENABLE_MPU == 1 )
}
#endif /* configENABLE_MPU */
break; break;
#endif /* configENABLE_TRUSTZONE */ #endif /* configENABLE_TRUSTZONE */
case portSVC_START_SCHEDULER: case portSVC_START_SCHEDULER:
#if ( configENABLE_MPU == 1 )
if( ( ulPC >= ( uint32_t ) __privileged_functions_start__ ) &&
( ulPC <= ( uint32_t ) __privileged_functions_end__ ) )
{
#endif /* configENABLE_MPU */
#if ( configENABLE_TRUSTZONE == 1 ) #if ( configENABLE_TRUSTZONE == 1 )
{ {
/* De-prioritize the non-secure exceptions so that the /* De-prioritize the non-secure exceptions so that the
@ -1203,6 +1227,9 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
/* Setup the context of the first task so that the first task starts /* Setup the context of the first task so that the first task starts
* executing. */ * executing. */
vRestoreContextOfFirstTask(); vRestoreContextOfFirstTask();
#if ( configENABLE_MPU == 1 )
}
#endif /* configENABLE_MPU */
break; break;
#if ( ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) ) #if ( ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) )

15
portable/GCC/ARM_CM23/secure/secure_context.c
View file

@ -290,9 +290,12 @@ secureportNON_SECURE_CALLABLE void SecureContext_FreeContext( SecureContextHandl
void * pvTaskHandle ) void * pvTaskHandle )
{ {
uint32_t ulIPSR, ulSecureContextIndex; uint32_t ulIPSR, ulSecureContextIndex;
uint8_t * pucStackLimit;
/* Read the Interrupt Program Status Register (IPSR) value. */ /* Read the Interrupt Program Status Register (IPSR) and Process Stack Limit
* Register (PSPLIM) value. */
secureportREAD_IPSR( ulIPSR ); secureportREAD_IPSR( ulIPSR );
secureportREAD_PSPLIM( pucStackLimit );
/* Do nothing if the processor is running in the Thread Mode. IPSR is zero /* Do nothing if the processor is running in the Thread Mode. IPSR is zero
* when the processor is running in the Thread Mode. */ * when the processor is running in the Thread Mode. */
@ -304,8 +307,14 @@ secureportNON_SECURE_CALLABLE void SecureContext_FreeContext( SecureContextHandl
ulSecureContextIndex = xSecureContextHandle - 1UL; ulSecureContextIndex = xSecureContextHandle - 1UL;
/* Ensure that the secure context being deleted is associated with /* Ensure that the secure context being deleted is associated with
* the task. */ * the task and is NOT the currently-loaded context. Freeing a
if( xSecureContexts[ ulSecureContextIndex ].pvTaskHandle == pvTaskHandle ) * context whose stack is currently loaded in PSPLIM would leave the
* running task referencing freed secure memory (use-after-free).
* pvTaskHandle is supplied by the non-secure side and is untrusted,
* so it is used only as an additional ownership match, not as
* authority. */
if( ( xSecureContexts[ ulSecureContextIndex ].pvTaskHandle == pvTaskHandle ) &&
( xSecureContexts[ ulSecureContextIndex ].pucStackLimit != pucStackLimit ) )
{ {
/* Free the stack space. */ /* Free the stack space. */
vPortFree( xSecureContexts[ ulSecureContextIndex ].pucStackLimit ); vPortFree( xSecureContexts[ ulSecureContextIndex ].pucStackLimit );

31
portable/GCC/ARM_CM23_NTZ/non_secure/port.c
View file

@ -1109,7 +1109,6 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
{ {
#if ( ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) ) #if ( ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) )
#if defined( __ARMCC_VERSION ) #if defined( __ARMCC_VERSION )
/* Declaration when these variable are defined in code instead of being /* Declaration when these variable are defined in code instead of being
* exported from linker scripts. */ * exported from linker scripts. */
extern uint32_t * __syscalls_flash_start__; extern uint32_t * __syscalls_flash_start__;
@ -1121,6 +1120,19 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
#endif /* defined( __ARMCC_VERSION ) */ #endif /* defined( __ARMCC_VERSION ) */
#endif /* ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) */ #endif /* ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) */
#if ( configENABLE_MPU == 1 )
#if defined( __ARMCC_VERSION )
/* Declaration when these variable are defined in code instead of being
* exported from linker scripts. */
extern uint32_t * __privileged_functions_start__;
extern uint32_t * __privileged_functions_end__;
#else
/* Declaration when these variable are exported from linker scripts. */
extern uint32_t __privileged_functions_start__[];
extern uint32_t __privileged_functions_end__[];
#endif /* defined( __ARMCC_VERSION ) */
#endif /* configENABLE_MPU == 1 */
uint32_t ulPC; uint32_t ulPC;
#if ( configENABLE_TRUSTZONE == 1 ) #if ( configENABLE_TRUSTZONE == 1 )
@ -1170,7 +1182,11 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
break; break;
case portSVC_FREE_SECURE_CONTEXT: case portSVC_FREE_SECURE_CONTEXT:
#if ( configENABLE_MPU == 1 )
if( ( ulPC >= ( uint32_t ) __privileged_functions_start__ ) &&
( ulPC <= ( uint32_t ) __privileged_functions_end__ ) )
{
#endif /* configENABLE_MPU */
/* R0 contains TCB being freed and R1 contains the secure /* R0 contains TCB being freed and R1 contains the secure
* context handle to be freed. */ * context handle to be freed. */
ulR0 = pulCallerStackAddress[ 0 ]; ulR0 = pulCallerStackAddress[ 0 ];
@ -1178,10 +1194,18 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
/* Free the secure context. */ /* Free the secure context. */
SecureContext_FreeContext( ( SecureContextHandle_t ) ulR1, ( void * ) ulR0 ); SecureContext_FreeContext( ( SecureContextHandle_t ) ulR1, ( void * ) ulR0 );
#if ( configENABLE_MPU == 1 )
}
#endif /* configENABLE_MPU */
break; break;
#endif /* configENABLE_TRUSTZONE */ #endif /* configENABLE_TRUSTZONE */
case portSVC_START_SCHEDULER: case portSVC_START_SCHEDULER:
#if ( configENABLE_MPU == 1 )
if( ( ulPC >= ( uint32_t ) __privileged_functions_start__ ) &&
( ulPC <= ( uint32_t ) __privileged_functions_end__ ) )
{
#endif /* configENABLE_MPU */
#if ( configENABLE_TRUSTZONE == 1 ) #if ( configENABLE_TRUSTZONE == 1 )
{ {
/* De-prioritize the non-secure exceptions so that the /* De-prioritize the non-secure exceptions so that the
@ -1203,6 +1227,9 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
/* Setup the context of the first task so that the first task starts /* Setup the context of the first task so that the first task starts
* executing. */ * executing. */
vRestoreContextOfFirstTask(); vRestoreContextOfFirstTask();
#if ( configENABLE_MPU == 1 )
}
#endif /* configENABLE_MPU */
break; break;
#if ( ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) ) #if ( ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) )

31
portable/GCC/ARM_CM33/non_secure/port.c
View file

@ -1109,7 +1109,6 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
{ {
#if ( ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) ) #if ( ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) )
#if defined( __ARMCC_VERSION ) #if defined( __ARMCC_VERSION )
/* Declaration when these variable are defined in code instead of being /* Declaration when these variable are defined in code instead of being
* exported from linker scripts. */ * exported from linker scripts. */
extern uint32_t * __syscalls_flash_start__; extern uint32_t * __syscalls_flash_start__;
@ -1121,6 +1120,19 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
#endif /* defined( __ARMCC_VERSION ) */ #endif /* defined( __ARMCC_VERSION ) */
#endif /* ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) */ #endif /* ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) */
#if ( configENABLE_MPU == 1 )
#if defined( __ARMCC_VERSION )
/* Declaration when these variable are defined in code instead of being
* exported from linker scripts. */
extern uint32_t * __privileged_functions_start__;
extern uint32_t * __privileged_functions_end__;
#else
/* Declaration when these variable are exported from linker scripts. */
extern uint32_t __privileged_functions_start__[];
extern uint32_t __privileged_functions_end__[];
#endif /* defined( __ARMCC_VERSION ) */
#endif /* configENABLE_MPU == 1 */
uint32_t ulPC; uint32_t ulPC;
#if ( configENABLE_TRUSTZONE == 1 ) #if ( configENABLE_TRUSTZONE == 1 )
@ -1170,7 +1182,11 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
break; break;
case portSVC_FREE_SECURE_CONTEXT: case portSVC_FREE_SECURE_CONTEXT:
#if ( configENABLE_MPU == 1 )
if( ( ulPC >= ( uint32_t ) __privileged_functions_start__ ) &&
( ulPC <= ( uint32_t ) __privileged_functions_end__ ) )
{
#endif /* configENABLE_MPU */
/* R0 contains TCB being freed and R1 contains the secure /* R0 contains TCB being freed and R1 contains the secure
* context handle to be freed. */ * context handle to be freed. */
ulR0 = pulCallerStackAddress[ 0 ]; ulR0 = pulCallerStackAddress[ 0 ];
@ -1178,10 +1194,18 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
/* Free the secure context. */ /* Free the secure context. */
SecureContext_FreeContext( ( SecureContextHandle_t ) ulR1, ( void * ) ulR0 ); SecureContext_FreeContext( ( SecureContextHandle_t ) ulR1, ( void * ) ulR0 );
#if ( configENABLE_MPU == 1 )
}
#endif /* configENABLE_MPU */
break; break;
#endif /* configENABLE_TRUSTZONE */ #endif /* configENABLE_TRUSTZONE */
case portSVC_START_SCHEDULER: case portSVC_START_SCHEDULER:
#if ( configENABLE_MPU == 1 )
if( ( ulPC >= ( uint32_t ) __privileged_functions_start__ ) &&
( ulPC <= ( uint32_t ) __privileged_functions_end__ ) )
{
#endif /* configENABLE_MPU */
#if ( configENABLE_TRUSTZONE == 1 ) #if ( configENABLE_TRUSTZONE == 1 )
{ {
/* De-prioritize the non-secure exceptions so that the /* De-prioritize the non-secure exceptions so that the
@ -1203,6 +1227,9 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
/* Setup the context of the first task so that the first task starts /* Setup the context of the first task so that the first task starts
* executing. */ * executing. */
vRestoreContextOfFirstTask(); vRestoreContextOfFirstTask();
#if ( configENABLE_MPU == 1 )
}
#endif /* configENABLE_MPU */
break; break;
#if ( ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) ) #if ( ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) )

15
portable/GCC/ARM_CM33/secure/secure_context.c
View file

@ -290,9 +290,12 @@ secureportNON_SECURE_CALLABLE void SecureContext_FreeContext( SecureContextHandl
void * pvTaskHandle ) void * pvTaskHandle )
{ {
uint32_t ulIPSR, ulSecureContextIndex; uint32_t ulIPSR, ulSecureContextIndex;
uint8_t * pucStackLimit;
/* Read the Interrupt Program Status Register (IPSR) value. */ /* Read the Interrupt Program Status Register (IPSR) and Process Stack Limit
* Register (PSPLIM) value. */
secureportREAD_IPSR( ulIPSR ); secureportREAD_IPSR( ulIPSR );
secureportREAD_PSPLIM( pucStackLimit );
/* Do nothing if the processor is running in the Thread Mode. IPSR is zero /* Do nothing if the processor is running in the Thread Mode. IPSR is zero
* when the processor is running in the Thread Mode. */ * when the processor is running in the Thread Mode. */
@ -304,8 +307,14 @@ secureportNON_SECURE_CALLABLE void SecureContext_FreeContext( SecureContextHandl
ulSecureContextIndex = xSecureContextHandle - 1UL; ulSecureContextIndex = xSecureContextHandle - 1UL;
/* Ensure that the secure context being deleted is associated with /* Ensure that the secure context being deleted is associated with
* the task. */ * the task and is NOT the currently-loaded context. Freeing a
if( xSecureContexts[ ulSecureContextIndex ].pvTaskHandle == pvTaskHandle ) * context whose stack is currently loaded in PSPLIM would leave the
* running task referencing freed secure memory (use-after-free).
* pvTaskHandle is supplied by the non-secure side and is untrusted,
* so it is used only as an additional ownership match, not as
* authority. */
if( ( xSecureContexts[ ulSecureContextIndex ].pvTaskHandle == pvTaskHandle ) &&
( xSecureContexts[ ulSecureContextIndex ].pucStackLimit != pucStackLimit ) )
{ {
/* Free the stack space. */ /* Free the stack space. */
vPortFree( xSecureContexts[ ulSecureContextIndex ].pucStackLimit ); vPortFree( xSecureContexts[ ulSecureContextIndex ].pucStackLimit );

31
portable/GCC/ARM_CM33_NTZ/non_secure/port.c
View file

@ -1109,7 +1109,6 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
{ {
#if ( ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) ) #if ( ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) )
#if defined( __ARMCC_VERSION ) #if defined( __ARMCC_VERSION )
/* Declaration when these variable are defined in code instead of being /* Declaration when these variable are defined in code instead of being
* exported from linker scripts. */ * exported from linker scripts. */
extern uint32_t * __syscalls_flash_start__; extern uint32_t * __syscalls_flash_start__;
@ -1121,6 +1120,19 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
#endif /* defined( __ARMCC_VERSION ) */ #endif /* defined( __ARMCC_VERSION ) */
#endif /* ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) */ #endif /* ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) */
#if ( configENABLE_MPU == 1 )
#if defined( __ARMCC_VERSION )
/* Declaration when these variable are defined in code instead of being
* exported from linker scripts. */
extern uint32_t * __privileged_functions_start__;
extern uint32_t * __privileged_functions_end__;
#else
/* Declaration when these variable are exported from linker scripts. */
extern uint32_t __privileged_functions_start__[];
extern uint32_t __privileged_functions_end__[];
#endif /* defined( __ARMCC_VERSION ) */
#endif /* configENABLE_MPU == 1 */
uint32_t ulPC; uint32_t ulPC;
#if ( configENABLE_TRUSTZONE == 1 ) #if ( configENABLE_TRUSTZONE == 1 )
@ -1170,7 +1182,11 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
break; break;
case portSVC_FREE_SECURE_CONTEXT: case portSVC_FREE_SECURE_CONTEXT:
#if ( configENABLE_MPU == 1 )
if( ( ulPC >= ( uint32_t ) __privileged_functions_start__ ) &&
( ulPC <= ( uint32_t ) __privileged_functions_end__ ) )
{
#endif /* configENABLE_MPU */
/* R0 contains TCB being freed and R1 contains the secure /* R0 contains TCB being freed and R1 contains the secure
* context handle to be freed. */ * context handle to be freed. */
ulR0 = pulCallerStackAddress[ 0 ]; ulR0 = pulCallerStackAddress[ 0 ];
@ -1178,10 +1194,18 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
/* Free the secure context. */ /* Free the secure context. */
SecureContext_FreeContext( ( SecureContextHandle_t ) ulR1, ( void * ) ulR0 ); SecureContext_FreeContext( ( SecureContextHandle_t ) ulR1, ( void * ) ulR0 );
#if ( configENABLE_MPU == 1 )
}
#endif /* configENABLE_MPU */
break; break;
#endif /* configENABLE_TRUSTZONE */ #endif /* configENABLE_TRUSTZONE */
case portSVC_START_SCHEDULER: case portSVC_START_SCHEDULER:
#if ( configENABLE_MPU == 1 )
if( ( ulPC >= ( uint32_t ) __privileged_functions_start__ ) &&
( ulPC <= ( uint32_t ) __privileged_functions_end__ ) )
{
#endif /* configENABLE_MPU */
#if ( configENABLE_TRUSTZONE == 1 ) #if ( configENABLE_TRUSTZONE == 1 )
{ {
/* De-prioritize the non-secure exceptions so that the /* De-prioritize the non-secure exceptions so that the
@ -1203,6 +1227,9 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
/* Setup the context of the first task so that the first task starts /* Setup the context of the first task so that the first task starts
* executing. */ * executing. */
vRestoreContextOfFirstTask(); vRestoreContextOfFirstTask();
#if ( configENABLE_MPU == 1 )
}
#endif /* configENABLE_MPU */
break; break;
#if ( ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) ) #if ( ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) )

31
portable/GCC/ARM_CM35P/non_secure/port.c
View file

@ -1109,7 +1109,6 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
{ {
#if ( ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) ) #if ( ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) )
#if defined( __ARMCC_VERSION ) #if defined( __ARMCC_VERSION )
/* Declaration when these variable are defined in code instead of being /* Declaration when these variable are defined in code instead of being
* exported from linker scripts. */ * exported from linker scripts. */
extern uint32_t * __syscalls_flash_start__; extern uint32_t * __syscalls_flash_start__;
@ -1121,6 +1120,19 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
#endif /* defined( __ARMCC_VERSION ) */ #endif /* defined( __ARMCC_VERSION ) */
#endif /* ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) */ #endif /* ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) */
#if ( configENABLE_MPU == 1 )
#if defined( __ARMCC_VERSION )
/* Declaration when these variable are defined in code instead of being
* exported from linker scripts. */
extern uint32_t * __privileged_functions_start__;
extern uint32_t * __privileged_functions_end__;
#else
/* Declaration when these variable are exported from linker scripts. */
extern uint32_t __privileged_functions_start__[];
extern uint32_t __privileged_functions_end__[];
#endif /* defined( __ARMCC_VERSION ) */
#endif /* configENABLE_MPU == 1 */
uint32_t ulPC; uint32_t ulPC;
#if ( configENABLE_TRUSTZONE == 1 ) #if ( configENABLE_TRUSTZONE == 1 )
@ -1170,7 +1182,11 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
break; break;
case portSVC_FREE_SECURE_CONTEXT: case portSVC_FREE_SECURE_CONTEXT:
#if ( configENABLE_MPU == 1 )
if( ( ulPC >= ( uint32_t ) __privileged_functions_start__ ) &&
( ulPC <= ( uint32_t ) __privileged_functions_end__ ) )
{
#endif /* configENABLE_MPU */
/* R0 contains TCB being freed and R1 contains the secure /* R0 contains TCB being freed and R1 contains the secure
* context handle to be freed. */ * context handle to be freed. */
ulR0 = pulCallerStackAddress[ 0 ]; ulR0 = pulCallerStackAddress[ 0 ];
@ -1178,10 +1194,18 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
/* Free the secure context. */ /* Free the secure context. */
SecureContext_FreeContext( ( SecureContextHandle_t ) ulR1, ( void * ) ulR0 ); SecureContext_FreeContext( ( SecureContextHandle_t ) ulR1, ( void * ) ulR0 );
#if ( configENABLE_MPU == 1 )
}
#endif /* configENABLE_MPU */
break; break;
#endif /* configENABLE_TRUSTZONE */ #endif /* configENABLE_TRUSTZONE */
case portSVC_START_SCHEDULER: case portSVC_START_SCHEDULER:
#if ( configENABLE_MPU == 1 )
if( ( ulPC >= ( uint32_t ) __privileged_functions_start__ ) &&
( ulPC <= ( uint32_t ) __privileged_functions_end__ ) )
{
#endif /* configENABLE_MPU */
#if ( configENABLE_TRUSTZONE == 1 ) #if ( configENABLE_TRUSTZONE == 1 )
{ {
/* De-prioritize the non-secure exceptions so that the /* De-prioritize the non-secure exceptions so that the
@ -1203,6 +1227,9 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
/* Setup the context of the first task so that the first task starts /* Setup the context of the first task so that the first task starts
* executing. */ * executing. */
vRestoreContextOfFirstTask(); vRestoreContextOfFirstTask();
#if ( configENABLE_MPU == 1 )
}
#endif /* configENABLE_MPU */
break; break;
#if ( ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) ) #if ( ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) )

15
portable/GCC/ARM_CM35P/secure/secure_context.c
View file

@ -290,9 +290,12 @@ secureportNON_SECURE_CALLABLE void SecureContext_FreeContext( SecureContextHandl
void * pvTaskHandle ) void * pvTaskHandle )
{ {
uint32_t ulIPSR, ulSecureContextIndex; uint32_t ulIPSR, ulSecureContextIndex;
uint8_t * pucStackLimit;
/* Read the Interrupt Program Status Register (IPSR) value. */ /* Read the Interrupt Program Status Register (IPSR) and Process Stack Limit
* Register (PSPLIM) value. */
secureportREAD_IPSR( ulIPSR ); secureportREAD_IPSR( ulIPSR );
secureportREAD_PSPLIM( pucStackLimit );
/* Do nothing if the processor is running in the Thread Mode. IPSR is zero /* Do nothing if the processor is running in the Thread Mode. IPSR is zero
* when the processor is running in the Thread Mode. */ * when the processor is running in the Thread Mode. */
@ -304,8 +307,14 @@ secureportNON_SECURE_CALLABLE void SecureContext_FreeContext( SecureContextHandl
ulSecureContextIndex = xSecureContextHandle - 1UL; ulSecureContextIndex = xSecureContextHandle - 1UL;
/* Ensure that the secure context being deleted is associated with /* Ensure that the secure context being deleted is associated with
* the task. */ * the task and is NOT the currently-loaded context. Freeing a
if( xSecureContexts[ ulSecureContextIndex ].pvTaskHandle == pvTaskHandle ) * context whose stack is currently loaded in PSPLIM would leave the
* running task referencing freed secure memory (use-after-free).
* pvTaskHandle is supplied by the non-secure side and is untrusted,
* so it is used only as an additional ownership match, not as
* authority. */
if( ( xSecureContexts[ ulSecureContextIndex ].pvTaskHandle == pvTaskHandle ) &&
( xSecureContexts[ ulSecureContextIndex ].pucStackLimit != pucStackLimit ) )
{ {
/* Free the stack space. */ /* Free the stack space. */
vPortFree( xSecureContexts[ ulSecureContextIndex ].pucStackLimit ); vPortFree( xSecureContexts[ ulSecureContextIndex ].pucStackLimit );

31
portable/GCC/ARM_CM35P_NTZ/non_secure/port.c
View file

@ -1109,7 +1109,6 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
{ {
#if ( ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) ) #if ( ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) )
#if defined( __ARMCC_VERSION ) #if defined( __ARMCC_VERSION )
/* Declaration when these variable are defined in code instead of being /* Declaration when these variable are defined in code instead of being
* exported from linker scripts. */ * exported from linker scripts. */
extern uint32_t * __syscalls_flash_start__; extern uint32_t * __syscalls_flash_start__;
@ -1121,6 +1120,19 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
#endif /* defined( __ARMCC_VERSION ) */ #endif /* defined( __ARMCC_VERSION ) */
#endif /* ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) */ #endif /* ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) */
#if ( configENABLE_MPU == 1 )
#if defined( __ARMCC_VERSION )
/* Declaration when these variable are defined in code instead of being
* exported from linker scripts. */
extern uint32_t * __privileged_functions_start__;
extern uint32_t * __privileged_functions_end__;
#else
/* Declaration when these variable are exported from linker scripts. */
extern uint32_t __privileged_functions_start__[];
extern uint32_t __privileged_functions_end__[];
#endif /* defined( __ARMCC_VERSION ) */
#endif /* configENABLE_MPU == 1 */
uint32_t ulPC; uint32_t ulPC;
#if ( configENABLE_TRUSTZONE == 1 ) #if ( configENABLE_TRUSTZONE == 1 )
@ -1170,7 +1182,11 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
break; break;
case portSVC_FREE_SECURE_CONTEXT: case portSVC_FREE_SECURE_CONTEXT:
#if ( configENABLE_MPU == 1 )
if( ( ulPC >= ( uint32_t ) __privileged_functions_start__ ) &&
( ulPC <= ( uint32_t ) __privileged_functions_end__ ) )
{
#endif /* configENABLE_MPU */
/* R0 contains TCB being freed and R1 contains the secure /* R0 contains TCB being freed and R1 contains the secure
* context handle to be freed. */ * context handle to be freed. */
ulR0 = pulCallerStackAddress[ 0 ]; ulR0 = pulCallerStackAddress[ 0 ];
@ -1178,10 +1194,18 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
/* Free the secure context. */ /* Free the secure context. */
SecureContext_FreeContext( ( SecureContextHandle_t ) ulR1, ( void * ) ulR0 ); SecureContext_FreeContext( ( SecureContextHandle_t ) ulR1, ( void * ) ulR0 );
#if ( configENABLE_MPU == 1 )
}
#endif /* configENABLE_MPU */
break; break;
#endif /* configENABLE_TRUSTZONE */ #endif /* configENABLE_TRUSTZONE */
case portSVC_START_SCHEDULER: case portSVC_START_SCHEDULER:
#if ( configENABLE_MPU == 1 )
if( ( ulPC >= ( uint32_t ) __privileged_functions_start__ ) &&
( ulPC <= ( uint32_t ) __privileged_functions_end__ ) )
{
#endif /* configENABLE_MPU */
#if ( configENABLE_TRUSTZONE == 1 ) #if ( configENABLE_TRUSTZONE == 1 )
{ {
/* De-prioritize the non-secure exceptions so that the /* De-prioritize the non-secure exceptions so that the
@ -1203,6 +1227,9 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
/* Setup the context of the first task so that the first task starts /* Setup the context of the first task so that the first task starts
* executing. */ * executing. */
vRestoreContextOfFirstTask(); vRestoreContextOfFirstTask();
#if ( configENABLE_MPU == 1 )
}
#endif /* configENABLE_MPU */
break; break;
#if ( ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) ) #if ( ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) )

31
portable/GCC/ARM_CM52/non_secure/port.c
View file

@ -1109,7 +1109,6 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
{ {
#if ( ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) ) #if ( ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) )
#if defined( __ARMCC_VERSION ) #if defined( __ARMCC_VERSION )
/* Declaration when these variable are defined in code instead of being /* Declaration when these variable are defined in code instead of being
* exported from linker scripts. */ * exported from linker scripts. */
extern uint32_t * __syscalls_flash_start__; extern uint32_t * __syscalls_flash_start__;
@ -1121,6 +1120,19 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
#endif /* defined( __ARMCC_VERSION ) */ #endif /* defined( __ARMCC_VERSION ) */
#endif /* ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) */ #endif /* ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) */
#if ( configENABLE_MPU == 1 )
#if defined( __ARMCC_VERSION )
/* Declaration when these variable are defined in code instead of being
* exported from linker scripts. */
extern uint32_t * __privileged_functions_start__;
extern uint32_t * __privileged_functions_end__;
#else
/* Declaration when these variable are exported from linker scripts. */
extern uint32_t __privileged_functions_start__[];
extern uint32_t __privileged_functions_end__[];
#endif /* defined( __ARMCC_VERSION ) */
#endif /* configENABLE_MPU == 1 */
uint32_t ulPC; uint32_t ulPC;
#if ( configENABLE_TRUSTZONE == 1 ) #if ( configENABLE_TRUSTZONE == 1 )
@ -1170,7 +1182,11 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
break; break;
case portSVC_FREE_SECURE_CONTEXT: case portSVC_FREE_SECURE_CONTEXT:
#if ( configENABLE_MPU == 1 )
if( ( ulPC >= ( uint32_t ) __privileged_functions_start__ ) &&
( ulPC <= ( uint32_t ) __privileged_functions_end__ ) )
{
#endif /* configENABLE_MPU */
/* R0 contains TCB being freed and R1 contains the secure /* R0 contains TCB being freed and R1 contains the secure
* context handle to be freed. */ * context handle to be freed. */
ulR0 = pulCallerStackAddress[ 0 ]; ulR0 = pulCallerStackAddress[ 0 ];
@ -1178,10 +1194,18 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
/* Free the secure context. */ /* Free the secure context. */
SecureContext_FreeContext( ( SecureContextHandle_t ) ulR1, ( void * ) ulR0 ); SecureContext_FreeContext( ( SecureContextHandle_t ) ulR1, ( void * ) ulR0 );
#if ( configENABLE_MPU == 1 )
}
#endif /* configENABLE_MPU */
break; break;
#endif /* configENABLE_TRUSTZONE */ #endif /* configENABLE_TRUSTZONE */
case portSVC_START_SCHEDULER: case portSVC_START_SCHEDULER:
#if ( configENABLE_MPU == 1 )
if( ( ulPC >= ( uint32_t ) __privileged_functions_start__ ) &&
( ulPC <= ( uint32_t ) __privileged_functions_end__ ) )
{
#endif /* configENABLE_MPU */
#if ( configENABLE_TRUSTZONE == 1 ) #if ( configENABLE_TRUSTZONE == 1 )
{ {
/* De-prioritize the non-secure exceptions so that the /* De-prioritize the non-secure exceptions so that the
@ -1203,6 +1227,9 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
/* Setup the context of the first task so that the first task starts /* Setup the context of the first task so that the first task starts
* executing. */ * executing. */
vRestoreContextOfFirstTask(); vRestoreContextOfFirstTask();
#if ( configENABLE_MPU == 1 )
}
#endif /* configENABLE_MPU */
break; break;
#if ( ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) ) #if ( ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) )

15
portable/GCC/ARM_CM52/secure/secure_context.c
View file

@ -290,9 +290,12 @@ secureportNON_SECURE_CALLABLE void SecureContext_FreeContext( SecureContextHandl
void * pvTaskHandle ) void * pvTaskHandle )
{ {
uint32_t ulIPSR, ulSecureContextIndex; uint32_t ulIPSR, ulSecureContextIndex;
uint8_t * pucStackLimit;
/* Read the Interrupt Program Status Register (IPSR) value. */ /* Read the Interrupt Program Status Register (IPSR) and Process Stack Limit
* Register (PSPLIM) value. */
secureportREAD_IPSR( ulIPSR ); secureportREAD_IPSR( ulIPSR );
secureportREAD_PSPLIM( pucStackLimit );
/* Do nothing if the processor is running in the Thread Mode. IPSR is zero /* Do nothing if the processor is running in the Thread Mode. IPSR is zero
* when the processor is running in the Thread Mode. */ * when the processor is running in the Thread Mode. */
@ -304,8 +307,14 @@ secureportNON_SECURE_CALLABLE void SecureContext_FreeContext( SecureContextHandl
ulSecureContextIndex = xSecureContextHandle - 1UL; ulSecureContextIndex = xSecureContextHandle - 1UL;
/* Ensure that the secure context being deleted is associated with /* Ensure that the secure context being deleted is associated with
* the task. */ * the task and is NOT the currently-loaded context. Freeing a
if( xSecureContexts[ ulSecureContextIndex ].pvTaskHandle == pvTaskHandle ) * context whose stack is currently loaded in PSPLIM would leave the
* running task referencing freed secure memory (use-after-free).
* pvTaskHandle is supplied by the non-secure side and is untrusted,
* so it is used only as an additional ownership match, not as
* authority. */
if( ( xSecureContexts[ ulSecureContextIndex ].pvTaskHandle == pvTaskHandle ) &&
( xSecureContexts[ ulSecureContextIndex ].pucStackLimit != pucStackLimit ) )
{ {
/* Free the stack space. */ /* Free the stack space. */
vPortFree( xSecureContexts[ ulSecureContextIndex ].pucStackLimit ); vPortFree( xSecureContexts[ ulSecureContextIndex ].pucStackLimit );

31
portable/GCC/ARM_CM52_NTZ/non_secure/port.c
View file

@ -1109,7 +1109,6 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
{ {
#if ( ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) ) #if ( ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) )
#if defined( __ARMCC_VERSION ) #if defined( __ARMCC_VERSION )
/* Declaration when these variable are defined in code instead of being /* Declaration when these variable are defined in code instead of being
* exported from linker scripts. */ * exported from linker scripts. */
extern uint32_t * __syscalls_flash_start__; extern uint32_t * __syscalls_flash_start__;
@ -1121,6 +1120,19 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
#endif /* defined( __ARMCC_VERSION ) */ #endif /* defined( __ARMCC_VERSION ) */
#endif /* ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) */ #endif /* ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) */
#if ( configENABLE_MPU == 1 )
#if defined( __ARMCC_VERSION )
/* Declaration when these variable are defined in code instead of being
* exported from linker scripts. */
extern uint32_t * __privileged_functions_start__;
extern uint32_t * __privileged_functions_end__;
#else
/* Declaration when these variable are exported from linker scripts. */
extern uint32_t __privileged_functions_start__[];
extern uint32_t __privileged_functions_end__[];
#endif /* defined( __ARMCC_VERSION ) */
#endif /* configENABLE_MPU == 1 */
uint32_t ulPC; uint32_t ulPC;
#if ( configENABLE_TRUSTZONE == 1 ) #if ( configENABLE_TRUSTZONE == 1 )
@ -1170,7 +1182,11 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
break; break;
case portSVC_FREE_SECURE_CONTEXT: case portSVC_FREE_SECURE_CONTEXT:
#if ( configENABLE_MPU == 1 )
if( ( ulPC >= ( uint32_t ) __privileged_functions_start__ ) &&
( ulPC <= ( uint32_t ) __privileged_functions_end__ ) )
{
#endif /* configENABLE_MPU */
/* R0 contains TCB being freed and R1 contains the secure /* R0 contains TCB being freed and R1 contains the secure
* context handle to be freed. */ * context handle to be freed. */
ulR0 = pulCallerStackAddress[ 0 ]; ulR0 = pulCallerStackAddress[ 0 ];
@ -1178,10 +1194,18 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
/* Free the secure context. */ /* Free the secure context. */
SecureContext_FreeContext( ( SecureContextHandle_t ) ulR1, ( void * ) ulR0 ); SecureContext_FreeContext( ( SecureContextHandle_t ) ulR1, ( void * ) ulR0 );
#if ( configENABLE_MPU == 1 )
}
#endif /* configENABLE_MPU */
break; break;
#endif /* configENABLE_TRUSTZONE */ #endif /* configENABLE_TRUSTZONE */
case portSVC_START_SCHEDULER: case portSVC_START_SCHEDULER:
#if ( configENABLE_MPU == 1 )
if( ( ulPC >= ( uint32_t ) __privileged_functions_start__ ) &&
( ulPC <= ( uint32_t ) __privileged_functions_end__ ) )
{
#endif /* configENABLE_MPU */
#if ( configENABLE_TRUSTZONE == 1 ) #if ( configENABLE_TRUSTZONE == 1 )
{ {
/* De-prioritize the non-secure exceptions so that the /* De-prioritize the non-secure exceptions so that the
@ -1203,6 +1227,9 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
/* Setup the context of the first task so that the first task starts /* Setup the context of the first task so that the first task starts
* executing. */ * executing. */
vRestoreContextOfFirstTask(); vRestoreContextOfFirstTask();
#if ( configENABLE_MPU == 1 )
}
#endif /* configENABLE_MPU */
break; break;
#if ( ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) ) #if ( ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) )

31
portable/GCC/ARM_CM55/non_secure/port.c
View file

@ -1109,7 +1109,6 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
{ {
#if ( ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) ) #if ( ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) )
#if defined( __ARMCC_VERSION ) #if defined( __ARMCC_VERSION )
/* Declaration when these variable are defined in code instead of being /* Declaration when these variable are defined in code instead of being
* exported from linker scripts. */ * exported from linker scripts. */
extern uint32_t * __syscalls_flash_start__; extern uint32_t * __syscalls_flash_start__;
@ -1121,6 +1120,19 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
#endif /* defined( __ARMCC_VERSION ) */ #endif /* defined( __ARMCC_VERSION ) */
#endif /* ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) */ #endif /* ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) */
#if ( configENABLE_MPU == 1 )
#if defined( __ARMCC_VERSION )
/* Declaration when these variable are defined in code instead of being
* exported from linker scripts. */
extern uint32_t * __privileged_functions_start__;
extern uint32_t * __privileged_functions_end__;
#else
/* Declaration when these variable are exported from linker scripts. */
extern uint32_t __privileged_functions_start__[];
extern uint32_t __privileged_functions_end__[];
#endif /* defined( __ARMCC_VERSION ) */
#endif /* configENABLE_MPU == 1 */
uint32_t ulPC; uint32_t ulPC;
#if ( configENABLE_TRUSTZONE == 1 ) #if ( configENABLE_TRUSTZONE == 1 )
@ -1170,7 +1182,11 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
break; break;
case portSVC_FREE_SECURE_CONTEXT: case portSVC_FREE_SECURE_CONTEXT:
#if ( configENABLE_MPU == 1 )
if( ( ulPC >= ( uint32_t ) __privileged_functions_start__ ) &&
( ulPC <= ( uint32_t ) __privileged_functions_end__ ) )
{
#endif /* configENABLE_MPU */
/* R0 contains TCB being freed and R1 contains the secure /* R0 contains TCB being freed and R1 contains the secure
* context handle to be freed. */ * context handle to be freed. */
ulR0 = pulCallerStackAddress[ 0 ]; ulR0 = pulCallerStackAddress[ 0 ];
@ -1178,10 +1194,18 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
/* Free the secure context. */ /* Free the secure context. */
SecureContext_FreeContext( ( SecureContextHandle_t ) ulR1, ( void * ) ulR0 ); SecureContext_FreeContext( ( SecureContextHandle_t ) ulR1, ( void * ) ulR0 );
#if ( configENABLE_MPU == 1 )
}
#endif /* configENABLE_MPU */
break; break;
#endif /* configENABLE_TRUSTZONE */ #endif /* configENABLE_TRUSTZONE */
case portSVC_START_SCHEDULER: case portSVC_START_SCHEDULER:
#if ( configENABLE_MPU == 1 )
if( ( ulPC >= ( uint32_t ) __privileged_functions_start__ ) &&
( ulPC <= ( uint32_t ) __privileged_functions_end__ ) )
{
#endif /* configENABLE_MPU */
#if ( configENABLE_TRUSTZONE == 1 ) #if ( configENABLE_TRUSTZONE == 1 )
{ {
/* De-prioritize the non-secure exceptions so that the /* De-prioritize the non-secure exceptions so that the
@ -1203,6 +1227,9 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
/* Setup the context of the first task so that the first task starts /* Setup the context of the first task so that the first task starts
* executing. */ * executing. */
vRestoreContextOfFirstTask(); vRestoreContextOfFirstTask();
#if ( configENABLE_MPU == 1 )
}
#endif /* configENABLE_MPU */
break; break;
#if ( ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) ) #if ( ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) )

15
portable/GCC/ARM_CM55/secure/secure_context.c
View file

@ -290,9 +290,12 @@ secureportNON_SECURE_CALLABLE void SecureContext_FreeContext( SecureContextHandl
void * pvTaskHandle ) void * pvTaskHandle )
{ {
uint32_t ulIPSR, ulSecureContextIndex; uint32_t ulIPSR, ulSecureContextIndex;
uint8_t * pucStackLimit;
/* Read the Interrupt Program Status Register (IPSR) value. */ /* Read the Interrupt Program Status Register (IPSR) and Process Stack Limit
* Register (PSPLIM) value. */
secureportREAD_IPSR( ulIPSR ); secureportREAD_IPSR( ulIPSR );
secureportREAD_PSPLIM( pucStackLimit );
/* Do nothing if the processor is running in the Thread Mode. IPSR is zero /* Do nothing if the processor is running in the Thread Mode. IPSR is zero
* when the processor is running in the Thread Mode. */ * when the processor is running in the Thread Mode. */
@ -304,8 +307,14 @@ secureportNON_SECURE_CALLABLE void SecureContext_FreeContext( SecureContextHandl
ulSecureContextIndex = xSecureContextHandle - 1UL; ulSecureContextIndex = xSecureContextHandle - 1UL;
/* Ensure that the secure context being deleted is associated with /* Ensure that the secure context being deleted is associated with
* the task. */ * the task and is NOT the currently-loaded context. Freeing a
if( xSecureContexts[ ulSecureContextIndex ].pvTaskHandle == pvTaskHandle ) * context whose stack is currently loaded in PSPLIM would leave the
* running task referencing freed secure memory (use-after-free).
* pvTaskHandle is supplied by the non-secure side and is untrusted,
* so it is used only as an additional ownership match, not as
* authority. */
if( ( xSecureContexts[ ulSecureContextIndex ].pvTaskHandle == pvTaskHandle ) &&
( xSecureContexts[ ulSecureContextIndex ].pucStackLimit != pucStackLimit ) )
{ {
/* Free the stack space. */ /* Free the stack space. */
vPortFree( xSecureContexts[ ulSecureContextIndex ].pucStackLimit ); vPortFree( xSecureContexts[ ulSecureContextIndex ].pucStackLimit );

31
portable/GCC/ARM_CM55_NTZ/non_secure/port.c
View file

@ -1109,7 +1109,6 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
{ {
#if ( ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) ) #if ( ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) )
#if defined( __ARMCC_VERSION ) #if defined( __ARMCC_VERSION )
/* Declaration when these variable are defined in code instead of being /* Declaration when these variable are defined in code instead of being
* exported from linker scripts. */ * exported from linker scripts. */
extern uint32_t * __syscalls_flash_start__; extern uint32_t * __syscalls_flash_start__;
@ -1121,6 +1120,19 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
#endif /* defined( __ARMCC_VERSION ) */ #endif /* defined( __ARMCC_VERSION ) */
#endif /* ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) */ #endif /* ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) */
#if ( configENABLE_MPU == 1 )
#if defined( __ARMCC_VERSION )
/* Declaration when these variable are defined in code instead of being
* exported from linker scripts. */
extern uint32_t * __privileged_functions_start__;
extern uint32_t * __privileged_functions_end__;
#else
/* Declaration when these variable are exported from linker scripts. */
extern uint32_t __privileged_functions_start__[];
extern uint32_t __privileged_functions_end__[];
#endif /* defined( __ARMCC_VERSION ) */
#endif /* configENABLE_MPU == 1 */
uint32_t ulPC; uint32_t ulPC;
#if ( configENABLE_TRUSTZONE == 1 ) #if ( configENABLE_TRUSTZONE == 1 )
@ -1170,7 +1182,11 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
break; break;
case portSVC_FREE_SECURE_CONTEXT: case portSVC_FREE_SECURE_CONTEXT:
#if ( configENABLE_MPU == 1 )
if( ( ulPC >= ( uint32_t ) __privileged_functions_start__ ) &&
( ulPC <= ( uint32_t ) __privileged_functions_end__ ) )
{
#endif /* configENABLE_MPU */
/* R0 contains TCB being freed and R1 contains the secure /* R0 contains TCB being freed and R1 contains the secure
* context handle to be freed. */ * context handle to be freed. */
ulR0 = pulCallerStackAddress[ 0 ]; ulR0 = pulCallerStackAddress[ 0 ];
@ -1178,10 +1194,18 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
/* Free the secure context. */ /* Free the secure context. */
SecureContext_FreeContext( ( SecureContextHandle_t ) ulR1, ( void * ) ulR0 ); SecureContext_FreeContext( ( SecureContextHandle_t ) ulR1, ( void * ) ulR0 );
#if ( configENABLE_MPU == 1 )
}
#endif /* configENABLE_MPU */
break; break;
#endif /* configENABLE_TRUSTZONE */ #endif /* configENABLE_TRUSTZONE */
case portSVC_START_SCHEDULER: case portSVC_START_SCHEDULER:
#if ( configENABLE_MPU == 1 )
if( ( ulPC >= ( uint32_t ) __privileged_functions_start__ ) &&
( ulPC <= ( uint32_t ) __privileged_functions_end__ ) )
{
#endif /* configENABLE_MPU */
#if ( configENABLE_TRUSTZONE == 1 ) #if ( configENABLE_TRUSTZONE == 1 )
{ {
/* De-prioritize the non-secure exceptions so that the /* De-prioritize the non-secure exceptions so that the
@ -1203,6 +1227,9 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
/* Setup the context of the first task so that the first task starts /* Setup the context of the first task so that the first task starts
* executing. */ * executing. */
vRestoreContextOfFirstTask(); vRestoreContextOfFirstTask();
#if ( configENABLE_MPU == 1 )
}
#endif /* configENABLE_MPU */
break; break;
#if ( ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) ) #if ( ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) )

31
portable/GCC/ARM_CM85/non_secure/port.c
View file

@ -1109,7 +1109,6 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
{ {
#if ( ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) ) #if ( ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) )
#if defined( __ARMCC_VERSION ) #if defined( __ARMCC_VERSION )
/* Declaration when these variable are defined in code instead of being /* Declaration when these variable are defined in code instead of being
* exported from linker scripts. */ * exported from linker scripts. */
extern uint32_t * __syscalls_flash_start__; extern uint32_t * __syscalls_flash_start__;
@ -1121,6 +1120,19 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
#endif /* defined( __ARMCC_VERSION ) */ #endif /* defined( __ARMCC_VERSION ) */
#endif /* ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) */ #endif /* ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) */
#if ( configENABLE_MPU == 1 )
#if defined( __ARMCC_VERSION )
/* Declaration when these variable are defined in code instead of being
* exported from linker scripts. */
extern uint32_t * __privileged_functions_start__;
extern uint32_t * __privileged_functions_end__;
#else
/* Declaration when these variable are exported from linker scripts. */
extern uint32_t __privileged_functions_start__[];
extern uint32_t __privileged_functions_end__[];
#endif /* defined( __ARMCC_VERSION ) */
#endif /* configENABLE_MPU == 1 */
uint32_t ulPC; uint32_t ulPC;
#if ( configENABLE_TRUSTZONE == 1 ) #if ( configENABLE_TRUSTZONE == 1 )
@ -1170,7 +1182,11 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
break; break;
case portSVC_FREE_SECURE_CONTEXT: case portSVC_FREE_SECURE_CONTEXT:
#if ( configENABLE_MPU == 1 )
if( ( ulPC >= ( uint32_t ) __privileged_functions_start__ ) &&
( ulPC <= ( uint32_t ) __privileged_functions_end__ ) )
{
#endif /* configENABLE_MPU */
/* R0 contains TCB being freed and R1 contains the secure /* R0 contains TCB being freed and R1 contains the secure
* context handle to be freed. */ * context handle to be freed. */
ulR0 = pulCallerStackAddress[ 0 ]; ulR0 = pulCallerStackAddress[ 0 ];
@ -1178,10 +1194,18 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
/* Free the secure context. */ /* Free the secure context. */
SecureContext_FreeContext( ( SecureContextHandle_t ) ulR1, ( void * ) ulR0 ); SecureContext_FreeContext( ( SecureContextHandle_t ) ulR1, ( void * ) ulR0 );
#if ( configENABLE_MPU == 1 )
}
#endif /* configENABLE_MPU */
break; break;
#endif /* configENABLE_TRUSTZONE */ #endif /* configENABLE_TRUSTZONE */
case portSVC_START_SCHEDULER: case portSVC_START_SCHEDULER:
#if ( configENABLE_MPU == 1 )
if( ( ulPC >= ( uint32_t ) __privileged_functions_start__ ) &&
( ulPC <= ( uint32_t ) __privileged_functions_end__ ) )
{
#endif /* configENABLE_MPU */
#if ( configENABLE_TRUSTZONE == 1 ) #if ( configENABLE_TRUSTZONE == 1 )
{ {
/* De-prioritize the non-secure exceptions so that the /* De-prioritize the non-secure exceptions so that the
@ -1203,6 +1227,9 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
/* Setup the context of the first task so that the first task starts /* Setup the context of the first task so that the first task starts
* executing. */ * executing. */
vRestoreContextOfFirstTask(); vRestoreContextOfFirstTask();
#if ( configENABLE_MPU == 1 )
}
#endif /* configENABLE_MPU */
break; break;
#if ( ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) ) #if ( ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) )

15
portable/GCC/ARM_CM85/secure/secure_context.c
View file

@ -290,9 +290,12 @@ secureportNON_SECURE_CALLABLE void SecureContext_FreeContext( SecureContextHandl
void * pvTaskHandle ) void * pvTaskHandle )
{ {
uint32_t ulIPSR, ulSecureContextIndex; uint32_t ulIPSR, ulSecureContextIndex;
uint8_t * pucStackLimit;
/* Read the Interrupt Program Status Register (IPSR) value. */ /* Read the Interrupt Program Status Register (IPSR) and Process Stack Limit
* Register (PSPLIM) value. */
secureportREAD_IPSR( ulIPSR ); secureportREAD_IPSR( ulIPSR );
secureportREAD_PSPLIM( pucStackLimit );
/* Do nothing if the processor is running in the Thread Mode. IPSR is zero /* Do nothing if the processor is running in the Thread Mode. IPSR is zero
* when the processor is running in the Thread Mode. */ * when the processor is running in the Thread Mode. */
@ -304,8 +307,14 @@ secureportNON_SECURE_CALLABLE void SecureContext_FreeContext( SecureContextHandl
ulSecureContextIndex = xSecureContextHandle - 1UL; ulSecureContextIndex = xSecureContextHandle - 1UL;
/* Ensure that the secure context being deleted is associated with /* Ensure that the secure context being deleted is associated with
* the task. */ * the task and is NOT the currently-loaded context. Freeing a
if( xSecureContexts[ ulSecureContextIndex ].pvTaskHandle == pvTaskHandle ) * context whose stack is currently loaded in PSPLIM would leave the
* running task referencing freed secure memory (use-after-free).
* pvTaskHandle is supplied by the non-secure side and is untrusted,
* so it is used only as an additional ownership match, not as
* authority. */
if( ( xSecureContexts[ ulSecureContextIndex ].pvTaskHandle == pvTaskHandle ) &&
( xSecureContexts[ ulSecureContextIndex ].pucStackLimit != pucStackLimit ) )
{ {
/* Free the stack space. */ /* Free the stack space. */
vPortFree( xSecureContexts[ ulSecureContextIndex ].pucStackLimit ); vPortFree( xSecureContexts[ ulSecureContextIndex ].pucStackLimit );

31
portable/GCC/ARM_CM85_NTZ/non_secure/port.c
View file

@ -1109,7 +1109,6 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
{ {
#if ( ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) ) #if ( ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) )
#if defined( __ARMCC_VERSION ) #if defined( __ARMCC_VERSION )
/* Declaration when these variable are defined in code instead of being /* Declaration when these variable are defined in code instead of being
* exported from linker scripts. */ * exported from linker scripts. */
extern uint32_t * __syscalls_flash_start__; extern uint32_t * __syscalls_flash_start__;
@ -1121,6 +1120,19 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
#endif /* defined( __ARMCC_VERSION ) */ #endif /* defined( __ARMCC_VERSION ) */
#endif /* ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) */ #endif /* ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) */
#if ( configENABLE_MPU == 1 )
#if defined( __ARMCC_VERSION )
/* Declaration when these variable are defined in code instead of being
* exported from linker scripts. */
extern uint32_t * __privileged_functions_start__;
extern uint32_t * __privileged_functions_end__;
#else
/* Declaration when these variable are exported from linker scripts. */
extern uint32_t __privileged_functions_start__[];
extern uint32_t __privileged_functions_end__[];
#endif /* defined( __ARMCC_VERSION ) */
#endif /* configENABLE_MPU == 1 */
uint32_t ulPC; uint32_t ulPC;
#if ( configENABLE_TRUSTZONE == 1 ) #if ( configENABLE_TRUSTZONE == 1 )
@ -1170,7 +1182,11 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
break; break;
case portSVC_FREE_SECURE_CONTEXT: case portSVC_FREE_SECURE_CONTEXT:
#if ( configENABLE_MPU == 1 )
if( ( ulPC >= ( uint32_t ) __privileged_functions_start__ ) &&
( ulPC <= ( uint32_t ) __privileged_functions_end__ ) )
{
#endif /* configENABLE_MPU */
/* R0 contains TCB being freed and R1 contains the secure /* R0 contains TCB being freed and R1 contains the secure
* context handle to be freed. */ * context handle to be freed. */
ulR0 = pulCallerStackAddress[ 0 ]; ulR0 = pulCallerStackAddress[ 0 ];
@ -1178,10 +1194,18 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
/* Free the secure context. */ /* Free the secure context. */
SecureContext_FreeContext( ( SecureContextHandle_t ) ulR1, ( void * ) ulR0 ); SecureContext_FreeContext( ( SecureContextHandle_t ) ulR1, ( void * ) ulR0 );
#if ( configENABLE_MPU == 1 )
}
#endif /* configENABLE_MPU */
break; break;
#endif /* configENABLE_TRUSTZONE */ #endif /* configENABLE_TRUSTZONE */
case portSVC_START_SCHEDULER: case portSVC_START_SCHEDULER:
#if ( configENABLE_MPU == 1 )
if( ( ulPC >= ( uint32_t ) __privileged_functions_start__ ) &&
( ulPC <= ( uint32_t ) __privileged_functions_end__ ) )
{
#endif /* configENABLE_MPU */
#if ( configENABLE_TRUSTZONE == 1 ) #if ( configENABLE_TRUSTZONE == 1 )
{ {
/* De-prioritize the non-secure exceptions so that the /* De-prioritize the non-secure exceptions so that the
@ -1203,6 +1227,9 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
/* Setup the context of the first task so that the first task starts /* Setup the context of the first task so that the first task starts
* executing. */ * executing. */
vRestoreContextOfFirstTask(); vRestoreContextOfFirstTask();
#if ( configENABLE_MPU == 1 )
}
#endif /* configENABLE_MPU */
break; break;
#if ( ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) ) #if ( ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) )

31
portable/GCC/ARM_STAR_MC3/non_secure/port.c
View file

@ -1109,7 +1109,6 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
{ {
#if ( ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) ) #if ( ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) )
#if defined( __ARMCC_VERSION ) #if defined( __ARMCC_VERSION )
/* Declaration when these variable are defined in code instead of being /* Declaration when these variable are defined in code instead of being
* exported from linker scripts. */ * exported from linker scripts. */
extern uint32_t * __syscalls_flash_start__; extern uint32_t * __syscalls_flash_start__;
@ -1121,6 +1120,19 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
#endif /* defined( __ARMCC_VERSION ) */ #endif /* defined( __ARMCC_VERSION ) */
#endif /* ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) */ #endif /* ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) */
#if ( configENABLE_MPU == 1 )
#if defined( __ARMCC_VERSION )
/* Declaration when these variable are defined in code instead of being
* exported from linker scripts. */
extern uint32_t * __privileged_functions_start__;
extern uint32_t * __privileged_functions_end__;
#else
/* Declaration when these variable are exported from linker scripts. */
extern uint32_t __privileged_functions_start__[];
extern uint32_t __privileged_functions_end__[];
#endif /* defined( __ARMCC_VERSION ) */
#endif /* configENABLE_MPU == 1 */
uint32_t ulPC; uint32_t ulPC;
#if ( configENABLE_TRUSTZONE == 1 ) #if ( configENABLE_TRUSTZONE == 1 )
@ -1170,7 +1182,11 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
break; break;
case portSVC_FREE_SECURE_CONTEXT: case portSVC_FREE_SECURE_CONTEXT:
#if ( configENABLE_MPU == 1 )
if( ( ulPC >= ( uint32_t ) __privileged_functions_start__ ) &&
( ulPC <= ( uint32_t ) __privileged_functions_end__ ) )
{
#endif /* configENABLE_MPU */
/* R0 contains TCB being freed and R1 contains the secure /* R0 contains TCB being freed and R1 contains the secure
* context handle to be freed. */ * context handle to be freed. */
ulR0 = pulCallerStackAddress[ 0 ]; ulR0 = pulCallerStackAddress[ 0 ];
@ -1178,10 +1194,18 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
/* Free the secure context. */ /* Free the secure context. */
SecureContext_FreeContext( ( SecureContextHandle_t ) ulR1, ( void * ) ulR0 ); SecureContext_FreeContext( ( SecureContextHandle_t ) ulR1, ( void * ) ulR0 );
#if ( configENABLE_MPU == 1 )
}
#endif /* configENABLE_MPU */
break; break;
#endif /* configENABLE_TRUSTZONE */ #endif /* configENABLE_TRUSTZONE */
case portSVC_START_SCHEDULER: case portSVC_START_SCHEDULER:
#if ( configENABLE_MPU == 1 )
if( ( ulPC >= ( uint32_t ) __privileged_functions_start__ ) &&
( ulPC <= ( uint32_t ) __privileged_functions_end__ ) )
{
#endif /* configENABLE_MPU */
#if ( configENABLE_TRUSTZONE == 1 ) #if ( configENABLE_TRUSTZONE == 1 )
{ {
/* De-prioritize the non-secure exceptions so that the /* De-prioritize the non-secure exceptions so that the
@ -1203,6 +1227,9 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
/* Setup the context of the first task so that the first task starts /* Setup the context of the first task so that the first task starts
* executing. */ * executing. */
vRestoreContextOfFirstTask(); vRestoreContextOfFirstTask();
#if ( configENABLE_MPU == 1 )
}
#endif /* configENABLE_MPU */
break; break;
#if ( ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) ) #if ( ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) )

15
portable/GCC/ARM_STAR_MC3/secure/secure_context.c
View file

@ -290,9 +290,12 @@ secureportNON_SECURE_CALLABLE void SecureContext_FreeContext( SecureContextHandl
void * pvTaskHandle ) void * pvTaskHandle )
{ {
uint32_t ulIPSR, ulSecureContextIndex; uint32_t ulIPSR, ulSecureContextIndex;
uint8_t * pucStackLimit;
/* Read the Interrupt Program Status Register (IPSR) value. */ /* Read the Interrupt Program Status Register (IPSR) and Process Stack Limit
* Register (PSPLIM) value. */
secureportREAD_IPSR( ulIPSR ); secureportREAD_IPSR( ulIPSR );
secureportREAD_PSPLIM( pucStackLimit );
/* Do nothing if the processor is running in the Thread Mode. IPSR is zero /* Do nothing if the processor is running in the Thread Mode. IPSR is zero
* when the processor is running in the Thread Mode. */ * when the processor is running in the Thread Mode. */
@ -304,8 +307,14 @@ secureportNON_SECURE_CALLABLE void SecureContext_FreeContext( SecureContextHandl
ulSecureContextIndex = xSecureContextHandle - 1UL; ulSecureContextIndex = xSecureContextHandle - 1UL;
/* Ensure that the secure context being deleted is associated with /* Ensure that the secure context being deleted is associated with
* the task. */ * the task and is NOT the currently-loaded context. Freeing a
if( xSecureContexts[ ulSecureContextIndex ].pvTaskHandle == pvTaskHandle ) * context whose stack is currently loaded in PSPLIM would leave the
* running task referencing freed secure memory (use-after-free).
* pvTaskHandle is supplied by the non-secure side and is untrusted,
* so it is used only as an additional ownership match, not as
* authority. */
if( ( xSecureContexts[ ulSecureContextIndex ].pvTaskHandle == pvTaskHandle ) &&
( xSecureContexts[ ulSecureContextIndex ].pucStackLimit != pucStackLimit ) )
{ {
/* Free the stack space. */ /* Free the stack space. */
vPortFree( xSecureContexts[ ulSecureContextIndex ].pucStackLimit ); vPortFree( xSecureContexts[ ulSecureContextIndex ].pucStackLimit );

31
portable/GCC/ARM_STAR_MC3_NTZ/non_secure/port.c
View file

@ -1109,7 +1109,6 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
{ {
#if ( ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) ) #if ( ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) )
#if defined( __ARMCC_VERSION ) #if defined( __ARMCC_VERSION )
/* Declaration when these variable are defined in code instead of being /* Declaration when these variable are defined in code instead of being
* exported from linker scripts. */ * exported from linker scripts. */
extern uint32_t * __syscalls_flash_start__; extern uint32_t * __syscalls_flash_start__;
@ -1121,6 +1120,19 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
#endif /* defined( __ARMCC_VERSION ) */ #endif /* defined( __ARMCC_VERSION ) */
#endif /* ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) */ #endif /* ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) */
#if ( configENABLE_MPU == 1 )
#if defined( __ARMCC_VERSION )
/* Declaration when these variable are defined in code instead of being
* exported from linker scripts. */
extern uint32_t * __privileged_functions_start__;
extern uint32_t * __privileged_functions_end__;
#else
/* Declaration when these variable are exported from linker scripts. */
extern uint32_t __privileged_functions_start__[];
extern uint32_t __privileged_functions_end__[];
#endif /* defined( __ARMCC_VERSION ) */
#endif /* configENABLE_MPU == 1 */
uint32_t ulPC; uint32_t ulPC;
#if ( configENABLE_TRUSTZONE == 1 ) #if ( configENABLE_TRUSTZONE == 1 )
@ -1170,7 +1182,11 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
break; break;
case portSVC_FREE_SECURE_CONTEXT: case portSVC_FREE_SECURE_CONTEXT:
#if ( configENABLE_MPU == 1 )
if( ( ulPC >= ( uint32_t ) __privileged_functions_start__ ) &&
( ulPC <= ( uint32_t ) __privileged_functions_end__ ) )
{
#endif /* configENABLE_MPU */
/* R0 contains TCB being freed and R1 contains the secure /* R0 contains TCB being freed and R1 contains the secure
* context handle to be freed. */ * context handle to be freed. */
ulR0 = pulCallerStackAddress[ 0 ]; ulR0 = pulCallerStackAddress[ 0 ];
@ -1178,10 +1194,18 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
/* Free the secure context. */ /* Free the secure context. */
SecureContext_FreeContext( ( SecureContextHandle_t ) ulR1, ( void * ) ulR0 ); SecureContext_FreeContext( ( SecureContextHandle_t ) ulR1, ( void * ) ulR0 );
#if ( configENABLE_MPU == 1 )
}
#endif /* configENABLE_MPU */
break; break;
#endif /* configENABLE_TRUSTZONE */ #endif /* configENABLE_TRUSTZONE */
case portSVC_START_SCHEDULER: case portSVC_START_SCHEDULER:
#if ( configENABLE_MPU == 1 )
if( ( ulPC >= ( uint32_t ) __privileged_functions_start__ ) &&
( ulPC <= ( uint32_t ) __privileged_functions_end__ ) )
{
#endif /* configENABLE_MPU */
#if ( configENABLE_TRUSTZONE == 1 ) #if ( configENABLE_TRUSTZONE == 1 )
{ {
/* De-prioritize the non-secure exceptions so that the /* De-prioritize the non-secure exceptions so that the
@ -1203,6 +1227,9 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
/* Setup the context of the first task so that the first task starts /* Setup the context of the first task so that the first task starts
* executing. */ * executing. */
vRestoreContextOfFirstTask(); vRestoreContextOfFirstTask();
#if ( configENABLE_MPU == 1 )
}
#endif /* configENABLE_MPU */
break; break;
#if ( ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) ) #if ( ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) )

31
portable/IAR/ARM_CM23/non_secure/port.c
View file

@ -1109,7 +1109,6 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
{ {
#if ( ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) ) #if ( ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) )
#if defined( __ARMCC_VERSION ) #if defined( __ARMCC_VERSION )
/* Declaration when these variable are defined in code instead of being /* Declaration when these variable are defined in code instead of being
* exported from linker scripts. */ * exported from linker scripts. */
extern uint32_t * __syscalls_flash_start__; extern uint32_t * __syscalls_flash_start__;
@ -1121,6 +1120,19 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
#endif /* defined( __ARMCC_VERSION ) */ #endif /* defined( __ARMCC_VERSION ) */
#endif /* ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) */ #endif /* ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) */
#if ( configENABLE_MPU == 1 )
#if defined( __ARMCC_VERSION )
/* Declaration when these variable are defined in code instead of being
* exported from linker scripts. */
extern uint32_t * __privileged_functions_start__;
extern uint32_t * __privileged_functions_end__;
#else
/* Declaration when these variable are exported from linker scripts. */
extern uint32_t __privileged_functions_start__[];
extern uint32_t __privileged_functions_end__[];
#endif /* defined( __ARMCC_VERSION ) */
#endif /* configENABLE_MPU == 1 */
uint32_t ulPC; uint32_t ulPC;
#if ( configENABLE_TRUSTZONE == 1 ) #if ( configENABLE_TRUSTZONE == 1 )
@ -1170,7 +1182,11 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
break; break;
case portSVC_FREE_SECURE_CONTEXT: case portSVC_FREE_SECURE_CONTEXT:
#if ( configENABLE_MPU == 1 )
if( ( ulPC >= ( uint32_t ) __privileged_functions_start__ ) &&
( ulPC <= ( uint32_t ) __privileged_functions_end__ ) )
{
#endif /* configENABLE_MPU */
/* R0 contains TCB being freed and R1 contains the secure /* R0 contains TCB being freed and R1 contains the secure
* context handle to be freed. */ * context handle to be freed. */
ulR0 = pulCallerStackAddress[ 0 ]; ulR0 = pulCallerStackAddress[ 0 ];
@ -1178,10 +1194,18 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
/* Free the secure context. */ /* Free the secure context. */
SecureContext_FreeContext( ( SecureContextHandle_t ) ulR1, ( void * ) ulR0 ); SecureContext_FreeContext( ( SecureContextHandle_t ) ulR1, ( void * ) ulR0 );
#if ( configENABLE_MPU == 1 )
}
#endif /* configENABLE_MPU */
break; break;
#endif /* configENABLE_TRUSTZONE */ #endif /* configENABLE_TRUSTZONE */
case portSVC_START_SCHEDULER: case portSVC_START_SCHEDULER:
#if ( configENABLE_MPU == 1 )
if( ( ulPC >= ( uint32_t ) __privileged_functions_start__ ) &&
( ulPC <= ( uint32_t ) __privileged_functions_end__ ) )
{
#endif /* configENABLE_MPU */
#if ( configENABLE_TRUSTZONE == 1 ) #if ( configENABLE_TRUSTZONE == 1 )
{ {
/* De-prioritize the non-secure exceptions so that the /* De-prioritize the non-secure exceptions so that the
@ -1203,6 +1227,9 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
/* Setup the context of the first task so that the first task starts /* Setup the context of the first task so that the first task starts
* executing. */ * executing. */
vRestoreContextOfFirstTask(); vRestoreContextOfFirstTask();
#if ( configENABLE_MPU == 1 )
}
#endif /* configENABLE_MPU */
break; break;
#if ( ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) ) #if ( ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) )

15
portable/IAR/ARM_CM23/secure/secure_context.c
View file

@ -290,9 +290,12 @@ secureportNON_SECURE_CALLABLE void SecureContext_FreeContext( SecureContextHandl
void * pvTaskHandle ) void * pvTaskHandle )
{ {
uint32_t ulIPSR, ulSecureContextIndex; uint32_t ulIPSR, ulSecureContextIndex;
uint8_t * pucStackLimit;
/* Read the Interrupt Program Status Register (IPSR) value. */ /* Read the Interrupt Program Status Register (IPSR) and Process Stack Limit
* Register (PSPLIM) value. */
secureportREAD_IPSR( ulIPSR ); secureportREAD_IPSR( ulIPSR );
secureportREAD_PSPLIM( pucStackLimit );
/* Do nothing if the processor is running in the Thread Mode. IPSR is zero /* Do nothing if the processor is running in the Thread Mode. IPSR is zero
* when the processor is running in the Thread Mode. */ * when the processor is running in the Thread Mode. */
@ -304,8 +307,14 @@ secureportNON_SECURE_CALLABLE void SecureContext_FreeContext( SecureContextHandl
ulSecureContextIndex = xSecureContextHandle - 1UL; ulSecureContextIndex = xSecureContextHandle - 1UL;
/* Ensure that the secure context being deleted is associated with /* Ensure that the secure context being deleted is associated with
* the task. */ * the task and is NOT the currently-loaded context. Freeing a
if( xSecureContexts[ ulSecureContextIndex ].pvTaskHandle == pvTaskHandle ) * context whose stack is currently loaded in PSPLIM would leave the
* running task referencing freed secure memory (use-after-free).
* pvTaskHandle is supplied by the non-secure side and is untrusted,
* so it is used only as an additional ownership match, not as
* authority. */
if( ( xSecureContexts[ ulSecureContextIndex ].pvTaskHandle == pvTaskHandle ) &&
( xSecureContexts[ ulSecureContextIndex ].pucStackLimit != pucStackLimit ) )
{ {
/* Free the stack space. */ /* Free the stack space. */
vPortFree( xSecureContexts[ ulSecureContextIndex ].pucStackLimit ); vPortFree( xSecureContexts[ ulSecureContextIndex ].pucStackLimit );

31
portable/IAR/ARM_CM23_NTZ/non_secure/port.c
View file

@ -1109,7 +1109,6 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
{ {
#if ( ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) ) #if ( ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) )
#if defined( __ARMCC_VERSION ) #if defined( __ARMCC_VERSION )
/* Declaration when these variable are defined in code instead of being /* Declaration when these variable are defined in code instead of being
* exported from linker scripts. */ * exported from linker scripts. */
extern uint32_t * __syscalls_flash_start__; extern uint32_t * __syscalls_flash_start__;
@ -1121,6 +1120,19 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
#endif /* defined( __ARMCC_VERSION ) */ #endif /* defined( __ARMCC_VERSION ) */
#endif /* ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) */ #endif /* ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) */
#if ( configENABLE_MPU == 1 )
#if defined( __ARMCC_VERSION )
/* Declaration when these variable are defined in code instead of being
* exported from linker scripts. */
extern uint32_t * __privileged_functions_start__;
extern uint32_t * __privileged_functions_end__;
#else
/* Declaration when these variable are exported from linker scripts. */
extern uint32_t __privileged_functions_start__[];
extern uint32_t __privileged_functions_end__[];
#endif /* defined( __ARMCC_VERSION ) */
#endif /* configENABLE_MPU == 1 */
uint32_t ulPC; uint32_t ulPC;
#if ( configENABLE_TRUSTZONE == 1 ) #if ( configENABLE_TRUSTZONE == 1 )
@ -1170,7 +1182,11 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
break; break;
case portSVC_FREE_SECURE_CONTEXT: case portSVC_FREE_SECURE_CONTEXT:
#if ( configENABLE_MPU == 1 )
if( ( ulPC >= ( uint32_t ) __privileged_functions_start__ ) &&
( ulPC <= ( uint32_t ) __privileged_functions_end__ ) )
{
#endif /* configENABLE_MPU */
/* R0 contains TCB being freed and R1 contains the secure /* R0 contains TCB being freed and R1 contains the secure
* context handle to be freed. */ * context handle to be freed. */
ulR0 = pulCallerStackAddress[ 0 ]; ulR0 = pulCallerStackAddress[ 0 ];
@ -1178,10 +1194,18 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
/* Free the secure context. */ /* Free the secure context. */
SecureContext_FreeContext( ( SecureContextHandle_t ) ulR1, ( void * ) ulR0 ); SecureContext_FreeContext( ( SecureContextHandle_t ) ulR1, ( void * ) ulR0 );
#if ( configENABLE_MPU == 1 )
}
#endif /* configENABLE_MPU */
break; break;
#endif /* configENABLE_TRUSTZONE */ #endif /* configENABLE_TRUSTZONE */
case portSVC_START_SCHEDULER: case portSVC_START_SCHEDULER:
#if ( configENABLE_MPU == 1 )
if( ( ulPC >= ( uint32_t ) __privileged_functions_start__ ) &&
( ulPC <= ( uint32_t ) __privileged_functions_end__ ) )
{
#endif /* configENABLE_MPU */
#if ( configENABLE_TRUSTZONE == 1 ) #if ( configENABLE_TRUSTZONE == 1 )
{ {
/* De-prioritize the non-secure exceptions so that the /* De-prioritize the non-secure exceptions so that the
@ -1203,6 +1227,9 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
/* Setup the context of the first task so that the first task starts /* Setup the context of the first task so that the first task starts
* executing. */ * executing. */
vRestoreContextOfFirstTask(); vRestoreContextOfFirstTask();
#if ( configENABLE_MPU == 1 )
}
#endif /* configENABLE_MPU */
break; break;
#if ( ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) ) #if ( ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) )

31
portable/IAR/ARM_CM33/non_secure/port.c
View file

@ -1109,7 +1109,6 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
{ {
#if ( ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) ) #if ( ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) )
#if defined( __ARMCC_VERSION ) #if defined( __ARMCC_VERSION )
/* Declaration when these variable are defined in code instead of being /* Declaration when these variable are defined in code instead of being
* exported from linker scripts. */ * exported from linker scripts. */
extern uint32_t * __syscalls_flash_start__; extern uint32_t * __syscalls_flash_start__;
@ -1121,6 +1120,19 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
#endif /* defined( __ARMCC_VERSION ) */ #endif /* defined( __ARMCC_VERSION ) */
#endif /* ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) */ #endif /* ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) */
#if ( configENABLE_MPU == 1 )
#if defined( __ARMCC_VERSION )
/* Declaration when these variable are defined in code instead of being
* exported from linker scripts. */
extern uint32_t * __privileged_functions_start__;
extern uint32_t * __privileged_functions_end__;
#else
/* Declaration when these variable are exported from linker scripts. */
extern uint32_t __privileged_functions_start__[];
extern uint32_t __privileged_functions_end__[];
#endif /* defined( __ARMCC_VERSION ) */
#endif /* configENABLE_MPU == 1 */
uint32_t ulPC; uint32_t ulPC;
#if ( configENABLE_TRUSTZONE == 1 ) #if ( configENABLE_TRUSTZONE == 1 )
@ -1170,7 +1182,11 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
break; break;
case portSVC_FREE_SECURE_CONTEXT: case portSVC_FREE_SECURE_CONTEXT:
#if ( configENABLE_MPU == 1 )
if( ( ulPC >= ( uint32_t ) __privileged_functions_start__ ) &&
( ulPC <= ( uint32_t ) __privileged_functions_end__ ) )
{
#endif /* configENABLE_MPU */
/* R0 contains TCB being freed and R1 contains the secure /* R0 contains TCB being freed and R1 contains the secure
* context handle to be freed. */ * context handle to be freed. */
ulR0 = pulCallerStackAddress[ 0 ]; ulR0 = pulCallerStackAddress[ 0 ];
@ -1178,10 +1194,18 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
/* Free the secure context. */ /* Free the secure context. */
SecureContext_FreeContext( ( SecureContextHandle_t ) ulR1, ( void * ) ulR0 ); SecureContext_FreeContext( ( SecureContextHandle_t ) ulR1, ( void * ) ulR0 );
#if ( configENABLE_MPU == 1 )
}
#endif /* configENABLE_MPU */
break; break;
#endif /* configENABLE_TRUSTZONE */ #endif /* configENABLE_TRUSTZONE */
case portSVC_START_SCHEDULER: case portSVC_START_SCHEDULER:
#if ( configENABLE_MPU == 1 )
if( ( ulPC >= ( uint32_t ) __privileged_functions_start__ ) &&
( ulPC <= ( uint32_t ) __privileged_functions_end__ ) )
{
#endif /* configENABLE_MPU */
#if ( configENABLE_TRUSTZONE == 1 ) #if ( configENABLE_TRUSTZONE == 1 )
{ {
/* De-prioritize the non-secure exceptions so that the /* De-prioritize the non-secure exceptions so that the
@ -1203,6 +1227,9 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
/* Setup the context of the first task so that the first task starts /* Setup the context of the first task so that the first task starts
* executing. */ * executing. */
vRestoreContextOfFirstTask(); vRestoreContextOfFirstTask();
#if ( configENABLE_MPU == 1 )
}
#endif /* configENABLE_MPU */
break; break;
#if ( ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) ) #if ( ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) )

15
portable/IAR/ARM_CM33/secure/secure_context.c
View file

@ -290,9 +290,12 @@ secureportNON_SECURE_CALLABLE void SecureContext_FreeContext( SecureContextHandl
void * pvTaskHandle ) void * pvTaskHandle )
{ {
uint32_t ulIPSR, ulSecureContextIndex; uint32_t ulIPSR, ulSecureContextIndex;
uint8_t * pucStackLimit;
/* Read the Interrupt Program Status Register (IPSR) value. */ /* Read the Interrupt Program Status Register (IPSR) and Process Stack Limit
* Register (PSPLIM) value. */
secureportREAD_IPSR( ulIPSR ); secureportREAD_IPSR( ulIPSR );
secureportREAD_PSPLIM( pucStackLimit );
/* Do nothing if the processor is running in the Thread Mode. IPSR is zero /* Do nothing if the processor is running in the Thread Mode. IPSR is zero
* when the processor is running in the Thread Mode. */ * when the processor is running in the Thread Mode. */
@ -304,8 +307,14 @@ secureportNON_SECURE_CALLABLE void SecureContext_FreeContext( SecureContextHandl
ulSecureContextIndex = xSecureContextHandle - 1UL; ulSecureContextIndex = xSecureContextHandle - 1UL;
/* Ensure that the secure context being deleted is associated with /* Ensure that the secure context being deleted is associated with
* the task. */ * the task and is NOT the currently-loaded context. Freeing a
if( xSecureContexts[ ulSecureContextIndex ].pvTaskHandle == pvTaskHandle ) * context whose stack is currently loaded in PSPLIM would leave the
* running task referencing freed secure memory (use-after-free).
* pvTaskHandle is supplied by the non-secure side and is untrusted,
* so it is used only as an additional ownership match, not as
* authority. */
if( ( xSecureContexts[ ulSecureContextIndex ].pvTaskHandle == pvTaskHandle ) &&
( xSecureContexts[ ulSecureContextIndex ].pucStackLimit != pucStackLimit ) )
{ {
/* Free the stack space. */ /* Free the stack space. */
vPortFree( xSecureContexts[ ulSecureContextIndex ].pucStackLimit ); vPortFree( xSecureContexts[ ulSecureContextIndex ].pucStackLimit );

31
portable/IAR/ARM_CM33_NTZ/non_secure/port.c
View file

@ -1109,7 +1109,6 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
{ {
#if ( ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) ) #if ( ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) )
#if defined( __ARMCC_VERSION ) #if defined( __ARMCC_VERSION )
/* Declaration when these variable are defined in code instead of being /* Declaration when these variable are defined in code instead of being
* exported from linker scripts. */ * exported from linker scripts. */
extern uint32_t * __syscalls_flash_start__; extern uint32_t * __syscalls_flash_start__;
@ -1121,6 +1120,19 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
#endif /* defined( __ARMCC_VERSION ) */ #endif /* defined( __ARMCC_VERSION ) */
#endif /* ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) */ #endif /* ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) */
#if ( configENABLE_MPU == 1 )
#if defined( __ARMCC_VERSION )
/* Declaration when these variable are defined in code instead of being
* exported from linker scripts. */
extern uint32_t * __privileged_functions_start__;
extern uint32_t * __privileged_functions_end__;
#else
/* Declaration when these variable are exported from linker scripts. */
extern uint32_t __privileged_functions_start__[];
extern uint32_t __privileged_functions_end__[];
#endif /* defined( __ARMCC_VERSION ) */
#endif /* configENABLE_MPU == 1 */
uint32_t ulPC; uint32_t ulPC;
#if ( configENABLE_TRUSTZONE == 1 ) #if ( configENABLE_TRUSTZONE == 1 )
@ -1170,7 +1182,11 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
break; break;
case portSVC_FREE_SECURE_CONTEXT: case portSVC_FREE_SECURE_CONTEXT:
#if ( configENABLE_MPU == 1 )
if( ( ulPC >= ( uint32_t ) __privileged_functions_start__ ) &&
( ulPC <= ( uint32_t ) __privileged_functions_end__ ) )
{
#endif /* configENABLE_MPU */
/* R0 contains TCB being freed and R1 contains the secure /* R0 contains TCB being freed and R1 contains the secure
* context handle to be freed. */ * context handle to be freed. */
ulR0 = pulCallerStackAddress[ 0 ]; ulR0 = pulCallerStackAddress[ 0 ];
@ -1178,10 +1194,18 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
/* Free the secure context. */ /* Free the secure context. */
SecureContext_FreeContext( ( SecureContextHandle_t ) ulR1, ( void * ) ulR0 ); SecureContext_FreeContext( ( SecureContextHandle_t ) ulR1, ( void * ) ulR0 );
#if ( configENABLE_MPU == 1 )
}
#endif /* configENABLE_MPU */
break; break;
#endif /* configENABLE_TRUSTZONE */ #endif /* configENABLE_TRUSTZONE */
case portSVC_START_SCHEDULER: case portSVC_START_SCHEDULER:
#if ( configENABLE_MPU == 1 )
if( ( ulPC >= ( uint32_t ) __privileged_functions_start__ ) &&
( ulPC <= ( uint32_t ) __privileged_functions_end__ ) )
{
#endif /* configENABLE_MPU */
#if ( configENABLE_TRUSTZONE == 1 ) #if ( configENABLE_TRUSTZONE == 1 )
{ {
/* De-prioritize the non-secure exceptions so that the /* De-prioritize the non-secure exceptions so that the
@ -1203,6 +1227,9 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
/* Setup the context of the first task so that the first task starts /* Setup the context of the first task so that the first task starts
* executing. */ * executing. */
vRestoreContextOfFirstTask(); vRestoreContextOfFirstTask();
#if ( configENABLE_MPU == 1 )
}
#endif /* configENABLE_MPU */
break; break;
#if ( ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) ) #if ( ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) )

31
portable/IAR/ARM_CM35P/non_secure/port.c
View file

@ -1109,7 +1109,6 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
{ {
#if ( ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) ) #if ( ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) )
#if defined( __ARMCC_VERSION ) #if defined( __ARMCC_VERSION )
/* Declaration when these variable are defined in code instead of being /* Declaration when these variable are defined in code instead of being
* exported from linker scripts. */ * exported from linker scripts. */
extern uint32_t * __syscalls_flash_start__; extern uint32_t * __syscalls_flash_start__;
@ -1121,6 +1120,19 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
#endif /* defined( __ARMCC_VERSION ) */ #endif /* defined( __ARMCC_VERSION ) */
#endif /* ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) */ #endif /* ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) */
#if ( configENABLE_MPU == 1 )
#if defined( __ARMCC_VERSION )
/* Declaration when these variable are defined in code instead of being
* exported from linker scripts. */
extern uint32_t * __privileged_functions_start__;
extern uint32_t * __privileged_functions_end__;
#else
/* Declaration when these variable are exported from linker scripts. */
extern uint32_t __privileged_functions_start__[];
extern uint32_t __privileged_functions_end__[];
#endif /* defined( __ARMCC_VERSION ) */
#endif /* configENABLE_MPU == 1 */
uint32_t ulPC; uint32_t ulPC;
#if ( configENABLE_TRUSTZONE == 1 ) #if ( configENABLE_TRUSTZONE == 1 )
@ -1170,7 +1182,11 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
break; break;
case portSVC_FREE_SECURE_CONTEXT: case portSVC_FREE_SECURE_CONTEXT:
#if ( configENABLE_MPU == 1 )
if( ( ulPC >= ( uint32_t ) __privileged_functions_start__ ) &&
( ulPC <= ( uint32_t ) __privileged_functions_end__ ) )
{
#endif /* configENABLE_MPU */
/* R0 contains TCB being freed and R1 contains the secure /* R0 contains TCB being freed and R1 contains the secure
* context handle to be freed. */ * context handle to be freed. */
ulR0 = pulCallerStackAddress[ 0 ]; ulR0 = pulCallerStackAddress[ 0 ];
@ -1178,10 +1194,18 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
/* Free the secure context. */ /* Free the secure context. */
SecureContext_FreeContext( ( SecureContextHandle_t ) ulR1, ( void * ) ulR0 ); SecureContext_FreeContext( ( SecureContextHandle_t ) ulR1, ( void * ) ulR0 );
#if ( configENABLE_MPU == 1 )
}
#endif /* configENABLE_MPU */
break; break;
#endif /* configENABLE_TRUSTZONE */ #endif /* configENABLE_TRUSTZONE */
case portSVC_START_SCHEDULER: case portSVC_START_SCHEDULER:
#if ( configENABLE_MPU == 1 )
if( ( ulPC >= ( uint32_t ) __privileged_functions_start__ ) &&
( ulPC <= ( uint32_t ) __privileged_functions_end__ ) )
{
#endif /* configENABLE_MPU */
#if ( configENABLE_TRUSTZONE == 1 ) #if ( configENABLE_TRUSTZONE == 1 )
{ {
/* De-prioritize the non-secure exceptions so that the /* De-prioritize the non-secure exceptions so that the
@ -1203,6 +1227,9 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
/* Setup the context of the first task so that the first task starts /* Setup the context of the first task so that the first task starts
* executing. */ * executing. */
vRestoreContextOfFirstTask(); vRestoreContextOfFirstTask();
#if ( configENABLE_MPU == 1 )
}
#endif /* configENABLE_MPU */
break; break;
#if ( ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) ) #if ( ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) )

15
portable/IAR/ARM_CM35P/secure/secure_context.c
View file

@ -290,9 +290,12 @@ secureportNON_SECURE_CALLABLE void SecureContext_FreeContext( SecureContextHandl
void * pvTaskHandle ) void * pvTaskHandle )
{ {
uint32_t ulIPSR, ulSecureContextIndex; uint32_t ulIPSR, ulSecureContextIndex;
uint8_t * pucStackLimit;
/* Read the Interrupt Program Status Register (IPSR) value. */ /* Read the Interrupt Program Status Register (IPSR) and Process Stack Limit
* Register (PSPLIM) value. */
secureportREAD_IPSR( ulIPSR ); secureportREAD_IPSR( ulIPSR );
secureportREAD_PSPLIM( pucStackLimit );
/* Do nothing if the processor is running in the Thread Mode. IPSR is zero /* Do nothing if the processor is running in the Thread Mode. IPSR is zero
* when the processor is running in the Thread Mode. */ * when the processor is running in the Thread Mode. */
@ -304,8 +307,14 @@ secureportNON_SECURE_CALLABLE void SecureContext_FreeContext( SecureContextHandl
ulSecureContextIndex = xSecureContextHandle - 1UL; ulSecureContextIndex = xSecureContextHandle - 1UL;
/* Ensure that the secure context being deleted is associated with /* Ensure that the secure context being deleted is associated with
* the task. */ * the task and is NOT the currently-loaded context. Freeing a
if( xSecureContexts[ ulSecureContextIndex ].pvTaskHandle == pvTaskHandle ) * context whose stack is currently loaded in PSPLIM would leave the
* running task referencing freed secure memory (use-after-free).
* pvTaskHandle is supplied by the non-secure side and is untrusted,
* so it is used only as an additional ownership match, not as
* authority. */
if( ( xSecureContexts[ ulSecureContextIndex ].pvTaskHandle == pvTaskHandle ) &&
( xSecureContexts[ ulSecureContextIndex ].pucStackLimit != pucStackLimit ) )
{ {
/* Free the stack space. */ /* Free the stack space. */
vPortFree( xSecureContexts[ ulSecureContextIndex ].pucStackLimit ); vPortFree( xSecureContexts[ ulSecureContextIndex ].pucStackLimit );

31
portable/IAR/ARM_CM35P_NTZ/non_secure/port.c
View file

@ -1109,7 +1109,6 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
{ {
#if ( ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) ) #if ( ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) )
#if defined( __ARMCC_VERSION ) #if defined( __ARMCC_VERSION )
/* Declaration when these variable are defined in code instead of being /* Declaration when these variable are defined in code instead of being
* exported from linker scripts. */ * exported from linker scripts. */
extern uint32_t * __syscalls_flash_start__; extern uint32_t * __syscalls_flash_start__;
@ -1121,6 +1120,19 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
#endif /* defined( __ARMCC_VERSION ) */ #endif /* defined( __ARMCC_VERSION ) */
#endif /* ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) */ #endif /* ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) */
#if ( configENABLE_MPU == 1 )
#if defined( __ARMCC_VERSION )
/* Declaration when these variable are defined in code instead of being
* exported from linker scripts. */
extern uint32_t * __privileged_functions_start__;
extern uint32_t * __privileged_functions_end__;
#else
/* Declaration when these variable are exported from linker scripts. */
extern uint32_t __privileged_functions_start__[];
extern uint32_t __privileged_functions_end__[];
#endif /* defined( __ARMCC_VERSION ) */
#endif /* configENABLE_MPU == 1 */
uint32_t ulPC; uint32_t ulPC;
#if ( configENABLE_TRUSTZONE == 1 ) #if ( configENABLE_TRUSTZONE == 1 )
@ -1170,7 +1182,11 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
break; break;
case portSVC_FREE_SECURE_CONTEXT: case portSVC_FREE_SECURE_CONTEXT:
#if ( configENABLE_MPU == 1 )
if( ( ulPC >= ( uint32_t ) __privileged_functions_start__ ) &&
( ulPC <= ( uint32_t ) __privileged_functions_end__ ) )
{
#endif /* configENABLE_MPU */
/* R0 contains TCB being freed and R1 contains the secure /* R0 contains TCB being freed and R1 contains the secure
* context handle to be freed. */ * context handle to be freed. */
ulR0 = pulCallerStackAddress[ 0 ]; ulR0 = pulCallerStackAddress[ 0 ];
@ -1178,10 +1194,18 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
/* Free the secure context. */ /* Free the secure context. */
SecureContext_FreeContext( ( SecureContextHandle_t ) ulR1, ( void * ) ulR0 ); SecureContext_FreeContext( ( SecureContextHandle_t ) ulR1, ( void * ) ulR0 );
#if ( configENABLE_MPU == 1 )
}
#endif /* configENABLE_MPU */
break; break;
#endif /* configENABLE_TRUSTZONE */ #endif /* configENABLE_TRUSTZONE */
case portSVC_START_SCHEDULER: case portSVC_START_SCHEDULER:
#if ( configENABLE_MPU == 1 )
if( ( ulPC >= ( uint32_t ) __privileged_functions_start__ ) &&
( ulPC <= ( uint32_t ) __privileged_functions_end__ ) )
{
#endif /* configENABLE_MPU */
#if ( configENABLE_TRUSTZONE == 1 ) #if ( configENABLE_TRUSTZONE == 1 )
{ {
/* De-prioritize the non-secure exceptions so that the /* De-prioritize the non-secure exceptions so that the
@ -1203,6 +1227,9 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
/* Setup the context of the first task so that the first task starts /* Setup the context of the first task so that the first task starts
* executing. */ * executing. */
vRestoreContextOfFirstTask(); vRestoreContextOfFirstTask();
#if ( configENABLE_MPU == 1 )
}
#endif /* configENABLE_MPU */
break; break;
#if ( ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) ) #if ( ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) )

31
portable/IAR/ARM_CM52/non_secure/port.c
View file

@ -1109,7 +1109,6 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
{ {
#if ( ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) ) #if ( ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) )
#if defined( __ARMCC_VERSION ) #if defined( __ARMCC_VERSION )
/* Declaration when these variable are defined in code instead of being /* Declaration when these variable are defined in code instead of being
* exported from linker scripts. */ * exported from linker scripts. */
extern uint32_t * __syscalls_flash_start__; extern uint32_t * __syscalls_flash_start__;
@ -1121,6 +1120,19 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
#endif /* defined( __ARMCC_VERSION ) */ #endif /* defined( __ARMCC_VERSION ) */
#endif /* ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) */ #endif /* ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) */
#if ( configENABLE_MPU == 1 )
#if defined( __ARMCC_VERSION )
/* Declaration when these variable are defined in code instead of being
* exported from linker scripts. */
extern uint32_t * __privileged_functions_start__;
extern uint32_t * __privileged_functions_end__;
#else
/* Declaration when these variable are exported from linker scripts. */
extern uint32_t __privileged_functions_start__[];
extern uint32_t __privileged_functions_end__[];
#endif /* defined( __ARMCC_VERSION ) */
#endif /* configENABLE_MPU == 1 */
uint32_t ulPC; uint32_t ulPC;
#if ( configENABLE_TRUSTZONE == 1 ) #if ( configENABLE_TRUSTZONE == 1 )
@ -1170,7 +1182,11 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
break; break;
case portSVC_FREE_SECURE_CONTEXT: case portSVC_FREE_SECURE_CONTEXT:
#if ( configENABLE_MPU == 1 )
if( ( ulPC >= ( uint32_t ) __privileged_functions_start__ ) &&
( ulPC <= ( uint32_t ) __privileged_functions_end__ ) )
{
#endif /* configENABLE_MPU */
/* R0 contains TCB being freed and R1 contains the secure /* R0 contains TCB being freed and R1 contains the secure
* context handle to be freed. */ * context handle to be freed. */
ulR0 = pulCallerStackAddress[ 0 ]; ulR0 = pulCallerStackAddress[ 0 ];
@ -1178,10 +1194,18 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
/* Free the secure context. */ /* Free the secure context. */
SecureContext_FreeContext( ( SecureContextHandle_t ) ulR1, ( void * ) ulR0 ); SecureContext_FreeContext( ( SecureContextHandle_t ) ulR1, ( void * ) ulR0 );
#if ( configENABLE_MPU == 1 )
}
#endif /* configENABLE_MPU */
break; break;
#endif /* configENABLE_TRUSTZONE */ #endif /* configENABLE_TRUSTZONE */
case portSVC_START_SCHEDULER: case portSVC_START_SCHEDULER:
#if ( configENABLE_MPU == 1 )
if( ( ulPC >= ( uint32_t ) __privileged_functions_start__ ) &&
( ulPC <= ( uint32_t ) __privileged_functions_end__ ) )
{
#endif /* configENABLE_MPU */
#if ( configENABLE_TRUSTZONE == 1 ) #if ( configENABLE_TRUSTZONE == 1 )
{ {
/* De-prioritize the non-secure exceptions so that the /* De-prioritize the non-secure exceptions so that the
@ -1203,6 +1227,9 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
/* Setup the context of the first task so that the first task starts /* Setup the context of the first task so that the first task starts
* executing. */ * executing. */
vRestoreContextOfFirstTask(); vRestoreContextOfFirstTask();
#if ( configENABLE_MPU == 1 )
}
#endif /* configENABLE_MPU */
break; break;
#if ( ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) ) #if ( ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) )

15
portable/IAR/ARM_CM52/secure/secure_context.c
View file

@ -290,9 +290,12 @@ secureportNON_SECURE_CALLABLE void SecureContext_FreeContext( SecureContextHandl
void * pvTaskHandle ) void * pvTaskHandle )
{ {
uint32_t ulIPSR, ulSecureContextIndex; uint32_t ulIPSR, ulSecureContextIndex;
uint8_t * pucStackLimit;
/* Read the Interrupt Program Status Register (IPSR) value. */ /* Read the Interrupt Program Status Register (IPSR) and Process Stack Limit
* Register (PSPLIM) value. */
secureportREAD_IPSR( ulIPSR ); secureportREAD_IPSR( ulIPSR );
secureportREAD_PSPLIM( pucStackLimit );
/* Do nothing if the processor is running in the Thread Mode. IPSR is zero /* Do nothing if the processor is running in the Thread Mode. IPSR is zero
* when the processor is running in the Thread Mode. */ * when the processor is running in the Thread Mode. */
@ -304,8 +307,14 @@ secureportNON_SECURE_CALLABLE void SecureContext_FreeContext( SecureContextHandl
ulSecureContextIndex = xSecureContextHandle - 1UL; ulSecureContextIndex = xSecureContextHandle - 1UL;
/* Ensure that the secure context being deleted is associated with /* Ensure that the secure context being deleted is associated with
* the task. */ * the task and is NOT the currently-loaded context. Freeing a
if( xSecureContexts[ ulSecureContextIndex ].pvTaskHandle == pvTaskHandle ) * context whose stack is currently loaded in PSPLIM would leave the
* running task referencing freed secure memory (use-after-free).
* pvTaskHandle is supplied by the non-secure side and is untrusted,
* so it is used only as an additional ownership match, not as
* authority. */
if( ( xSecureContexts[ ulSecureContextIndex ].pvTaskHandle == pvTaskHandle ) &&
( xSecureContexts[ ulSecureContextIndex ].pucStackLimit != pucStackLimit ) )
{ {
/* Free the stack space. */ /* Free the stack space. */
vPortFree( xSecureContexts[ ulSecureContextIndex ].pucStackLimit ); vPortFree( xSecureContexts[ ulSecureContextIndex ].pucStackLimit );

31
portable/IAR/ARM_CM52_NTZ/non_secure/port.c
View file

@ -1109,7 +1109,6 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
{ {
#if ( ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) ) #if ( ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) )
#if defined( __ARMCC_VERSION ) #if defined( __ARMCC_VERSION )
/* Declaration when these variable are defined in code instead of being /* Declaration when these variable are defined in code instead of being
* exported from linker scripts. */ * exported from linker scripts. */
extern uint32_t * __syscalls_flash_start__; extern uint32_t * __syscalls_flash_start__;
@ -1121,6 +1120,19 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
#endif /* defined( __ARMCC_VERSION ) */ #endif /* defined( __ARMCC_VERSION ) */
#endif /* ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) */ #endif /* ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) */
#if ( configENABLE_MPU == 1 )
#if defined( __ARMCC_VERSION )
/* Declaration when these variable are defined in code instead of being
* exported from linker scripts. */
extern uint32_t * __privileged_functions_start__;
extern uint32_t * __privileged_functions_end__;
#else
/* Declaration when these variable are exported from linker scripts. */
extern uint32_t __privileged_functions_start__[];
extern uint32_t __privileged_functions_end__[];
#endif /* defined( __ARMCC_VERSION ) */
#endif /* configENABLE_MPU == 1 */
uint32_t ulPC; uint32_t ulPC;
#if ( configENABLE_TRUSTZONE == 1 ) #if ( configENABLE_TRUSTZONE == 1 )
@ -1170,7 +1182,11 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
break; break;
case portSVC_FREE_SECURE_CONTEXT: case portSVC_FREE_SECURE_CONTEXT:
#if ( configENABLE_MPU == 1 )
if( ( ulPC >= ( uint32_t ) __privileged_functions_start__ ) &&
( ulPC <= ( uint32_t ) __privileged_functions_end__ ) )
{
#endif /* configENABLE_MPU */
/* R0 contains TCB being freed and R1 contains the secure /* R0 contains TCB being freed and R1 contains the secure
* context handle to be freed. */ * context handle to be freed. */
ulR0 = pulCallerStackAddress[ 0 ]; ulR0 = pulCallerStackAddress[ 0 ];
@ -1178,10 +1194,18 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
/* Free the secure context. */ /* Free the secure context. */
SecureContext_FreeContext( ( SecureContextHandle_t ) ulR1, ( void * ) ulR0 ); SecureContext_FreeContext( ( SecureContextHandle_t ) ulR1, ( void * ) ulR0 );
#if ( configENABLE_MPU == 1 )
}
#endif /* configENABLE_MPU */
break; break;
#endif /* configENABLE_TRUSTZONE */ #endif /* configENABLE_TRUSTZONE */
case portSVC_START_SCHEDULER: case portSVC_START_SCHEDULER:
#if ( configENABLE_MPU == 1 )
if( ( ulPC >= ( uint32_t ) __privileged_functions_start__ ) &&
( ulPC <= ( uint32_t ) __privileged_functions_end__ ) )
{
#endif /* configENABLE_MPU */
#if ( configENABLE_TRUSTZONE == 1 ) #if ( configENABLE_TRUSTZONE == 1 )
{ {
/* De-prioritize the non-secure exceptions so that the /* De-prioritize the non-secure exceptions so that the
@ -1203,6 +1227,9 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
/* Setup the context of the first task so that the first task starts /* Setup the context of the first task so that the first task starts
* executing. */ * executing. */
vRestoreContextOfFirstTask(); vRestoreContextOfFirstTask();
#if ( configENABLE_MPU == 1 )
}
#endif /* configENABLE_MPU */
break; break;
#if ( ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) ) #if ( ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) )

31
portable/IAR/ARM_CM55/non_secure/port.c
View file

@ -1109,7 +1109,6 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
{ {
#if ( ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) ) #if ( ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) )
#if defined( __ARMCC_VERSION ) #if defined( __ARMCC_VERSION )
/* Declaration when these variable are defined in code instead of being /* Declaration when these variable are defined in code instead of being
* exported from linker scripts. */ * exported from linker scripts. */
extern uint32_t * __syscalls_flash_start__; extern uint32_t * __syscalls_flash_start__;
@ -1121,6 +1120,19 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
#endif /* defined( __ARMCC_VERSION ) */ #endif /* defined( __ARMCC_VERSION ) */
#endif /* ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) */ #endif /* ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) */
#if ( configENABLE_MPU == 1 )
#if defined( __ARMCC_VERSION )
/* Declaration when these variable are defined in code instead of being
* exported from linker scripts. */
extern uint32_t * __privileged_functions_start__;
extern uint32_t * __privileged_functions_end__;
#else
/* Declaration when these variable are exported from linker scripts. */
extern uint32_t __privileged_functions_start__[];
extern uint32_t __privileged_functions_end__[];
#endif /* defined( __ARMCC_VERSION ) */
#endif /* configENABLE_MPU == 1 */
uint32_t ulPC; uint32_t ulPC;
#if ( configENABLE_TRUSTZONE == 1 ) #if ( configENABLE_TRUSTZONE == 1 )
@ -1170,7 +1182,11 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
break; break;
case portSVC_FREE_SECURE_CONTEXT: case portSVC_FREE_SECURE_CONTEXT:
#if ( configENABLE_MPU == 1 )
if( ( ulPC >= ( uint32_t ) __privileged_functions_start__ ) &&
( ulPC <= ( uint32_t ) __privileged_functions_end__ ) )
{
#endif /* configENABLE_MPU */
/* R0 contains TCB being freed and R1 contains the secure /* R0 contains TCB being freed and R1 contains the secure
* context handle to be freed. */ * context handle to be freed. */
ulR0 = pulCallerStackAddress[ 0 ]; ulR0 = pulCallerStackAddress[ 0 ];
@ -1178,10 +1194,18 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
/* Free the secure context. */ /* Free the secure context. */
SecureContext_FreeContext( ( SecureContextHandle_t ) ulR1, ( void * ) ulR0 ); SecureContext_FreeContext( ( SecureContextHandle_t ) ulR1, ( void * ) ulR0 );
#if ( configENABLE_MPU == 1 )
}
#endif /* configENABLE_MPU */
break; break;
#endif /* configENABLE_TRUSTZONE */ #endif /* configENABLE_TRUSTZONE */
case portSVC_START_SCHEDULER: case portSVC_START_SCHEDULER:
#if ( configENABLE_MPU == 1 )
if( ( ulPC >= ( uint32_t ) __privileged_functions_start__ ) &&
( ulPC <= ( uint32_t ) __privileged_functions_end__ ) )
{
#endif /* configENABLE_MPU */
#if ( configENABLE_TRUSTZONE == 1 ) #if ( configENABLE_TRUSTZONE == 1 )
{ {
/* De-prioritize the non-secure exceptions so that the /* De-prioritize the non-secure exceptions so that the
@ -1203,6 +1227,9 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
/* Setup the context of the first task so that the first task starts /* Setup the context of the first task so that the first task starts
* executing. */ * executing. */
vRestoreContextOfFirstTask(); vRestoreContextOfFirstTask();
#if ( configENABLE_MPU == 1 )
}
#endif /* configENABLE_MPU */
break; break;
#if ( ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) ) #if ( ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) )

15
portable/IAR/ARM_CM55/secure/secure_context.c
View file

@ -290,9 +290,12 @@ secureportNON_SECURE_CALLABLE void SecureContext_FreeContext( SecureContextHandl
void * pvTaskHandle ) void * pvTaskHandle )
{ {
uint32_t ulIPSR, ulSecureContextIndex; uint32_t ulIPSR, ulSecureContextIndex;
uint8_t * pucStackLimit;
/* Read the Interrupt Program Status Register (IPSR) value. */ /* Read the Interrupt Program Status Register (IPSR) and Process Stack Limit
* Register (PSPLIM) value. */
secureportREAD_IPSR( ulIPSR ); secureportREAD_IPSR( ulIPSR );
secureportREAD_PSPLIM( pucStackLimit );
/* Do nothing if the processor is running in the Thread Mode. IPSR is zero /* Do nothing if the processor is running in the Thread Mode. IPSR is zero
* when the processor is running in the Thread Mode. */ * when the processor is running in the Thread Mode. */
@ -304,8 +307,14 @@ secureportNON_SECURE_CALLABLE void SecureContext_FreeContext( SecureContextHandl
ulSecureContextIndex = xSecureContextHandle - 1UL; ulSecureContextIndex = xSecureContextHandle - 1UL;
/* Ensure that the secure context being deleted is associated with /* Ensure that the secure context being deleted is associated with
* the task. */ * the task and is NOT the currently-loaded context. Freeing a
if( xSecureContexts[ ulSecureContextIndex ].pvTaskHandle == pvTaskHandle ) * context whose stack is currently loaded in PSPLIM would leave the
* running task referencing freed secure memory (use-after-free).
* pvTaskHandle is supplied by the non-secure side and is untrusted,
* so it is used only as an additional ownership match, not as
* authority. */
if( ( xSecureContexts[ ulSecureContextIndex ].pvTaskHandle == pvTaskHandle ) &&
( xSecureContexts[ ulSecureContextIndex ].pucStackLimit != pucStackLimit ) )
{ {
/* Free the stack space. */ /* Free the stack space. */
vPortFree( xSecureContexts[ ulSecureContextIndex ].pucStackLimit ); vPortFree( xSecureContexts[ ulSecureContextIndex ].pucStackLimit );

31
portable/IAR/ARM_CM55_NTZ/non_secure/port.c
View file

@ -1109,7 +1109,6 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
{ {
#if ( ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) ) #if ( ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) )
#if defined( __ARMCC_VERSION ) #if defined( __ARMCC_VERSION )
/* Declaration when these variable are defined in code instead of being /* Declaration when these variable are defined in code instead of being
* exported from linker scripts. */ * exported from linker scripts. */
extern uint32_t * __syscalls_flash_start__; extern uint32_t * __syscalls_flash_start__;
@ -1121,6 +1120,19 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
#endif /* defined( __ARMCC_VERSION ) */ #endif /* defined( __ARMCC_VERSION ) */
#endif /* ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) */ #endif /* ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) */
#if ( configENABLE_MPU == 1 )
#if defined( __ARMCC_VERSION )
/* Declaration when these variable are defined in code instead of being
* exported from linker scripts. */
extern uint32_t * __privileged_functions_start__;
extern uint32_t * __privileged_functions_end__;
#else
/* Declaration when these variable are exported from linker scripts. */
extern uint32_t __privileged_functions_start__[];
extern uint32_t __privileged_functions_end__[];
#endif /* defined( __ARMCC_VERSION ) */
#endif /* configENABLE_MPU == 1 */
uint32_t ulPC; uint32_t ulPC;
#if ( configENABLE_TRUSTZONE == 1 ) #if ( configENABLE_TRUSTZONE == 1 )
@ -1170,7 +1182,11 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
break; break;
case portSVC_FREE_SECURE_CONTEXT: case portSVC_FREE_SECURE_CONTEXT:
#if ( configENABLE_MPU == 1 )
if( ( ulPC >= ( uint32_t ) __privileged_functions_start__ ) &&
( ulPC <= ( uint32_t ) __privileged_functions_end__ ) )
{
#endif /* configENABLE_MPU */
/* R0 contains TCB being freed and R1 contains the secure /* R0 contains TCB being freed and R1 contains the secure
* context handle to be freed. */ * context handle to be freed. */
ulR0 = pulCallerStackAddress[ 0 ]; ulR0 = pulCallerStackAddress[ 0 ];
@ -1178,10 +1194,18 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
/* Free the secure context. */ /* Free the secure context. */
SecureContext_FreeContext( ( SecureContextHandle_t ) ulR1, ( void * ) ulR0 ); SecureContext_FreeContext( ( SecureContextHandle_t ) ulR1, ( void * ) ulR0 );
#if ( configENABLE_MPU == 1 )
}
#endif /* configENABLE_MPU */
break; break;
#endif /* configENABLE_TRUSTZONE */ #endif /* configENABLE_TRUSTZONE */
case portSVC_START_SCHEDULER: case portSVC_START_SCHEDULER:
#if ( configENABLE_MPU == 1 )
if( ( ulPC >= ( uint32_t ) __privileged_functions_start__ ) &&
( ulPC <= ( uint32_t ) __privileged_functions_end__ ) )
{
#endif /* configENABLE_MPU */
#if ( configENABLE_TRUSTZONE == 1 ) #if ( configENABLE_TRUSTZONE == 1 )
{ {
/* De-prioritize the non-secure exceptions so that the /* De-prioritize the non-secure exceptions so that the
@ -1203,6 +1227,9 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
/* Setup the context of the first task so that the first task starts /* Setup the context of the first task so that the first task starts
* executing. */ * executing. */
vRestoreContextOfFirstTask(); vRestoreContextOfFirstTask();
#if ( configENABLE_MPU == 1 )
}
#endif /* configENABLE_MPU */
break; break;
#if ( ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) ) #if ( ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) )

31
portable/IAR/ARM_CM85/non_secure/port.c
View file

@ -1109,7 +1109,6 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
{ {
#if ( ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) ) #if ( ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) )
#if defined( __ARMCC_VERSION ) #if defined( __ARMCC_VERSION )
/* Declaration when these variable are defined in code instead of being /* Declaration when these variable are defined in code instead of being
* exported from linker scripts. */ * exported from linker scripts. */
extern uint32_t * __syscalls_flash_start__; extern uint32_t * __syscalls_flash_start__;
@ -1121,6 +1120,19 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
#endif /* defined( __ARMCC_VERSION ) */ #endif /* defined( __ARMCC_VERSION ) */
#endif /* ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) */ #endif /* ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) */
#if ( configENABLE_MPU == 1 )
#if defined( __ARMCC_VERSION )
/* Declaration when these variable are defined in code instead of being
* exported from linker scripts. */
extern uint32_t * __privileged_functions_start__;
extern uint32_t * __privileged_functions_end__;
#else
/* Declaration when these variable are exported from linker scripts. */
extern uint32_t __privileged_functions_start__[];
extern uint32_t __privileged_functions_end__[];
#endif /* defined( __ARMCC_VERSION ) */
#endif /* configENABLE_MPU == 1 */
uint32_t ulPC; uint32_t ulPC;
#if ( configENABLE_TRUSTZONE == 1 ) #if ( configENABLE_TRUSTZONE == 1 )
@ -1170,7 +1182,11 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
break; break;
case portSVC_FREE_SECURE_CONTEXT: case portSVC_FREE_SECURE_CONTEXT:
#if ( configENABLE_MPU == 1 )
if( ( ulPC >= ( uint32_t ) __privileged_functions_start__ ) &&
( ulPC <= ( uint32_t ) __privileged_functions_end__ ) )
{
#endif /* configENABLE_MPU */
/* R0 contains TCB being freed and R1 contains the secure /* R0 contains TCB being freed and R1 contains the secure
* context handle to be freed. */ * context handle to be freed. */
ulR0 = pulCallerStackAddress[ 0 ]; ulR0 = pulCallerStackAddress[ 0 ];
@ -1178,10 +1194,18 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
/* Free the secure context. */ /* Free the secure context. */
SecureContext_FreeContext( ( SecureContextHandle_t ) ulR1, ( void * ) ulR0 ); SecureContext_FreeContext( ( SecureContextHandle_t ) ulR1, ( void * ) ulR0 );
#if ( configENABLE_MPU == 1 )
}
#endif /* configENABLE_MPU */
break; break;
#endif /* configENABLE_TRUSTZONE */ #endif /* configENABLE_TRUSTZONE */
case portSVC_START_SCHEDULER: case portSVC_START_SCHEDULER:
#if ( configENABLE_MPU == 1 )
if( ( ulPC >= ( uint32_t ) __privileged_functions_start__ ) &&
( ulPC <= ( uint32_t ) __privileged_functions_end__ ) )
{
#endif /* configENABLE_MPU */
#if ( configENABLE_TRUSTZONE == 1 ) #if ( configENABLE_TRUSTZONE == 1 )
{ {
/* De-prioritize the non-secure exceptions so that the /* De-prioritize the non-secure exceptions so that the
@ -1203,6 +1227,9 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
/* Setup the context of the first task so that the first task starts /* Setup the context of the first task so that the first task starts
* executing. */ * executing. */
vRestoreContextOfFirstTask(); vRestoreContextOfFirstTask();
#if ( configENABLE_MPU == 1 )
}
#endif /* configENABLE_MPU */
break; break;
#if ( ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) ) #if ( ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) )

15
portable/IAR/ARM_CM85/secure/secure_context.c
View file

@ -290,9 +290,12 @@ secureportNON_SECURE_CALLABLE void SecureContext_FreeContext( SecureContextHandl
void * pvTaskHandle ) void * pvTaskHandle )
{ {
uint32_t ulIPSR, ulSecureContextIndex; uint32_t ulIPSR, ulSecureContextIndex;
uint8_t * pucStackLimit;
/* Read the Interrupt Program Status Register (IPSR) value. */ /* Read the Interrupt Program Status Register (IPSR) and Process Stack Limit
* Register (PSPLIM) value. */
secureportREAD_IPSR( ulIPSR ); secureportREAD_IPSR( ulIPSR );
secureportREAD_PSPLIM( pucStackLimit );
/* Do nothing if the processor is running in the Thread Mode. IPSR is zero /* Do nothing if the processor is running in the Thread Mode. IPSR is zero
* when the processor is running in the Thread Mode. */ * when the processor is running in the Thread Mode. */
@ -304,8 +307,14 @@ secureportNON_SECURE_CALLABLE void SecureContext_FreeContext( SecureContextHandl
ulSecureContextIndex = xSecureContextHandle - 1UL; ulSecureContextIndex = xSecureContextHandle - 1UL;
/* Ensure that the secure context being deleted is associated with /* Ensure that the secure context being deleted is associated with
* the task. */ * the task and is NOT the currently-loaded context. Freeing a
if( xSecureContexts[ ulSecureContextIndex ].pvTaskHandle == pvTaskHandle ) * context whose stack is currently loaded in PSPLIM would leave the
* running task referencing freed secure memory (use-after-free).
* pvTaskHandle is supplied by the non-secure side and is untrusted,
* so it is used only as an additional ownership match, not as
* authority. */
if( ( xSecureContexts[ ulSecureContextIndex ].pvTaskHandle == pvTaskHandle ) &&
( xSecureContexts[ ulSecureContextIndex ].pucStackLimit != pucStackLimit ) )
{ {
/* Free the stack space. */ /* Free the stack space. */
vPortFree( xSecureContexts[ ulSecureContextIndex ].pucStackLimit ); vPortFree( xSecureContexts[ ulSecureContextIndex ].pucStackLimit );

31
portable/IAR/ARM_CM85_NTZ/non_secure/port.c
View file

@ -1109,7 +1109,6 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
{ {
#if ( ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) ) #if ( ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) )
#if defined( __ARMCC_VERSION ) #if defined( __ARMCC_VERSION )
/* Declaration when these variable are defined in code instead of being /* Declaration when these variable are defined in code instead of being
* exported from linker scripts. */ * exported from linker scripts. */
extern uint32_t * __syscalls_flash_start__; extern uint32_t * __syscalls_flash_start__;
@ -1121,6 +1120,19 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
#endif /* defined( __ARMCC_VERSION ) */ #endif /* defined( __ARMCC_VERSION ) */
#endif /* ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) */ #endif /* ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) */
#if ( configENABLE_MPU == 1 )
#if defined( __ARMCC_VERSION )
/* Declaration when these variable are defined in code instead of being
* exported from linker scripts. */
extern uint32_t * __privileged_functions_start__;
extern uint32_t * __privileged_functions_end__;
#else
/* Declaration when these variable are exported from linker scripts. */
extern uint32_t __privileged_functions_start__[];
extern uint32_t __privileged_functions_end__[];
#endif /* defined( __ARMCC_VERSION ) */
#endif /* configENABLE_MPU == 1 */
uint32_t ulPC; uint32_t ulPC;
#if ( configENABLE_TRUSTZONE == 1 ) #if ( configENABLE_TRUSTZONE == 1 )
@ -1170,7 +1182,11 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
break; break;
case portSVC_FREE_SECURE_CONTEXT: case portSVC_FREE_SECURE_CONTEXT:
#if ( configENABLE_MPU == 1 )
if( ( ulPC >= ( uint32_t ) __privileged_functions_start__ ) &&
( ulPC <= ( uint32_t ) __privileged_functions_end__ ) )
{
#endif /* configENABLE_MPU */
/* R0 contains TCB being freed and R1 contains the secure /* R0 contains TCB being freed and R1 contains the secure
* context handle to be freed. */ * context handle to be freed. */
ulR0 = pulCallerStackAddress[ 0 ]; ulR0 = pulCallerStackAddress[ 0 ];
@ -1178,10 +1194,18 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
/* Free the secure context. */ /* Free the secure context. */
SecureContext_FreeContext( ( SecureContextHandle_t ) ulR1, ( void * ) ulR0 ); SecureContext_FreeContext( ( SecureContextHandle_t ) ulR1, ( void * ) ulR0 );
#if ( configENABLE_MPU == 1 )
}
#endif /* configENABLE_MPU */
break; break;
#endif /* configENABLE_TRUSTZONE */ #endif /* configENABLE_TRUSTZONE */
case portSVC_START_SCHEDULER: case portSVC_START_SCHEDULER:
#if ( configENABLE_MPU == 1 )
if( ( ulPC >= ( uint32_t ) __privileged_functions_start__ ) &&
( ulPC <= ( uint32_t ) __privileged_functions_end__ ) )
{
#endif /* configENABLE_MPU */
#if ( configENABLE_TRUSTZONE == 1 ) #if ( configENABLE_TRUSTZONE == 1 )
{ {
/* De-prioritize the non-secure exceptions so that the /* De-prioritize the non-secure exceptions so that the
@ -1203,6 +1227,9 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
/* Setup the context of the first task so that the first task starts /* Setup the context of the first task so that the first task starts
* executing. */ * executing. */
vRestoreContextOfFirstTask(); vRestoreContextOfFirstTask();
#if ( configENABLE_MPU == 1 )
}
#endif /* configENABLE_MPU */
break; break;
#if ( ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) ) #if ( ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) )

31
portable/IAR/ARM_STAR_MC3/non_secure/port.c
View file

@ -1109,7 +1109,6 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
{ {
#if ( ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) ) #if ( ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) )
#if defined( __ARMCC_VERSION ) #if defined( __ARMCC_VERSION )
/* Declaration when these variable are defined in code instead of being /* Declaration when these variable are defined in code instead of being
* exported from linker scripts. */ * exported from linker scripts. */
extern uint32_t * __syscalls_flash_start__; extern uint32_t * __syscalls_flash_start__;
@ -1121,6 +1120,19 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
#endif /* defined( __ARMCC_VERSION ) */ #endif /* defined( __ARMCC_VERSION ) */
#endif /* ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) */ #endif /* ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) */
#if ( configENABLE_MPU == 1 )
#if defined( __ARMCC_VERSION )
/* Declaration when these variable are defined in code instead of being
* exported from linker scripts. */
extern uint32_t * __privileged_functions_start__;
extern uint32_t * __privileged_functions_end__;
#else
/* Declaration when these variable are exported from linker scripts. */
extern uint32_t __privileged_functions_start__[];
extern uint32_t __privileged_functions_end__[];
#endif /* defined( __ARMCC_VERSION ) */
#endif /* configENABLE_MPU == 1 */
uint32_t ulPC; uint32_t ulPC;
#if ( configENABLE_TRUSTZONE == 1 ) #if ( configENABLE_TRUSTZONE == 1 )
@ -1170,7 +1182,11 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
break; break;
case portSVC_FREE_SECURE_CONTEXT: case portSVC_FREE_SECURE_CONTEXT:
#if ( configENABLE_MPU == 1 )
if( ( ulPC >= ( uint32_t ) __privileged_functions_start__ ) &&
( ulPC <= ( uint32_t ) __privileged_functions_end__ ) )
{
#endif /* configENABLE_MPU */
/* R0 contains TCB being freed and R1 contains the secure /* R0 contains TCB being freed and R1 contains the secure
* context handle to be freed. */ * context handle to be freed. */
ulR0 = pulCallerStackAddress[ 0 ]; ulR0 = pulCallerStackAddress[ 0 ];
@ -1178,10 +1194,18 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
/* Free the secure context. */ /* Free the secure context. */
SecureContext_FreeContext( ( SecureContextHandle_t ) ulR1, ( void * ) ulR0 ); SecureContext_FreeContext( ( SecureContextHandle_t ) ulR1, ( void * ) ulR0 );
#if ( configENABLE_MPU == 1 )
}
#endif /* configENABLE_MPU */
break; break;
#endif /* configENABLE_TRUSTZONE */ #endif /* configENABLE_TRUSTZONE */
case portSVC_START_SCHEDULER: case portSVC_START_SCHEDULER:
#if ( configENABLE_MPU == 1 )
if( ( ulPC >= ( uint32_t ) __privileged_functions_start__ ) &&
( ulPC <= ( uint32_t ) __privileged_functions_end__ ) )
{
#endif /* configENABLE_MPU */
#if ( configENABLE_TRUSTZONE == 1 ) #if ( configENABLE_TRUSTZONE == 1 )
{ {
/* De-prioritize the non-secure exceptions so that the /* De-prioritize the non-secure exceptions so that the
@ -1203,6 +1227,9 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
/* Setup the context of the first task so that the first task starts /* Setup the context of the first task so that the first task starts
* executing. */ * executing. */
vRestoreContextOfFirstTask(); vRestoreContextOfFirstTask();
#if ( configENABLE_MPU == 1 )
}
#endif /* configENABLE_MPU */
break; break;
#if ( ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) ) #if ( ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) )

15
portable/IAR/ARM_STAR_MC3/secure/secure_context.c
View file

@ -290,9 +290,12 @@ secureportNON_SECURE_CALLABLE void SecureContext_FreeContext( SecureContextHandl
void * pvTaskHandle ) void * pvTaskHandle )
{ {
uint32_t ulIPSR, ulSecureContextIndex; uint32_t ulIPSR, ulSecureContextIndex;
uint8_t * pucStackLimit;
/* Read the Interrupt Program Status Register (IPSR) value. */ /* Read the Interrupt Program Status Register (IPSR) and Process Stack Limit
* Register (PSPLIM) value. */
secureportREAD_IPSR( ulIPSR ); secureportREAD_IPSR( ulIPSR );
secureportREAD_PSPLIM( pucStackLimit );
/* Do nothing if the processor is running in the Thread Mode. IPSR is zero /* Do nothing if the processor is running in the Thread Mode. IPSR is zero
* when the processor is running in the Thread Mode. */ * when the processor is running in the Thread Mode. */
@ -304,8 +307,14 @@ secureportNON_SECURE_CALLABLE void SecureContext_FreeContext( SecureContextHandl
ulSecureContextIndex = xSecureContextHandle - 1UL; ulSecureContextIndex = xSecureContextHandle - 1UL;
/* Ensure that the secure context being deleted is associated with /* Ensure that the secure context being deleted is associated with
* the task. */ * the task and is NOT the currently-loaded context. Freeing a
if( xSecureContexts[ ulSecureContextIndex ].pvTaskHandle == pvTaskHandle ) * context whose stack is currently loaded in PSPLIM would leave the
* running task referencing freed secure memory (use-after-free).
* pvTaskHandle is supplied by the non-secure side and is untrusted,
* so it is used only as an additional ownership match, not as
* authority. */
if( ( xSecureContexts[ ulSecureContextIndex ].pvTaskHandle == pvTaskHandle ) &&
( xSecureContexts[ ulSecureContextIndex ].pucStackLimit != pucStackLimit ) )
{ {
/* Free the stack space. */ /* Free the stack space. */
vPortFree( xSecureContexts[ ulSecureContextIndex ].pucStackLimit ); vPortFree( xSecureContexts[ ulSecureContextIndex ].pucStackLimit );

31
portable/IAR/ARM_STAR_MC3_NTZ/non_secure/port.c
View file

@ -1109,7 +1109,6 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
{ {
#if ( ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) ) #if ( ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) )
#if defined( __ARMCC_VERSION ) #if defined( __ARMCC_VERSION )
/* Declaration when these variable are defined in code instead of being /* Declaration when these variable are defined in code instead of being
* exported from linker scripts. */ * exported from linker scripts. */
extern uint32_t * __syscalls_flash_start__; extern uint32_t * __syscalls_flash_start__;
@ -1121,6 +1120,19 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
#endif /* defined( __ARMCC_VERSION ) */ #endif /* defined( __ARMCC_VERSION ) */
#endif /* ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) */ #endif /* ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) */
#if ( configENABLE_MPU == 1 )
#if defined( __ARMCC_VERSION )
/* Declaration when these variable are defined in code instead of being
* exported from linker scripts. */
extern uint32_t * __privileged_functions_start__;
extern uint32_t * __privileged_functions_end__;
#else
/* Declaration when these variable are exported from linker scripts. */
extern uint32_t __privileged_functions_start__[];
extern uint32_t __privileged_functions_end__[];
#endif /* defined( __ARMCC_VERSION ) */
#endif /* configENABLE_MPU == 1 */
uint32_t ulPC; uint32_t ulPC;
#if ( configENABLE_TRUSTZONE == 1 ) #if ( configENABLE_TRUSTZONE == 1 )
@ -1170,7 +1182,11 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
break; break;
case portSVC_FREE_SECURE_CONTEXT: case portSVC_FREE_SECURE_CONTEXT:
#if ( configENABLE_MPU == 1 )
if( ( ulPC >= ( uint32_t ) __privileged_functions_start__ ) &&
( ulPC <= ( uint32_t ) __privileged_functions_end__ ) )
{
#endif /* configENABLE_MPU */
/* R0 contains TCB being freed and R1 contains the secure /* R0 contains TCB being freed and R1 contains the secure
* context handle to be freed. */ * context handle to be freed. */
ulR0 = pulCallerStackAddress[ 0 ]; ulR0 = pulCallerStackAddress[ 0 ];
@ -1178,10 +1194,18 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
/* Free the secure context. */ /* Free the secure context. */
SecureContext_FreeContext( ( SecureContextHandle_t ) ulR1, ( void * ) ulR0 ); SecureContext_FreeContext( ( SecureContextHandle_t ) ulR1, ( void * ) ulR0 );
#if ( configENABLE_MPU == 1 )
}
#endif /* configENABLE_MPU */
break; break;
#endif /* configENABLE_TRUSTZONE */ #endif /* configENABLE_TRUSTZONE */
case portSVC_START_SCHEDULER: case portSVC_START_SCHEDULER:
#if ( configENABLE_MPU == 1 )
if( ( ulPC >= ( uint32_t ) __privileged_functions_start__ ) &&
( ulPC <= ( uint32_t ) __privileged_functions_end__ ) )
{
#endif /* configENABLE_MPU */
#if ( configENABLE_TRUSTZONE == 1 ) #if ( configENABLE_TRUSTZONE == 1 )
{ {
/* De-prioritize the non-secure exceptions so that the /* De-prioritize the non-secure exceptions so that the
@ -1203,6 +1227,9 @@ void vPortSVCHandler_C( uint32_t * pulCallerStackAddress ) /* PRIVILEGED_FUNCTIO
/* Setup the context of the first task so that the first task starts /* Setup the context of the first task so that the first task starts
* executing. */ * executing. */
vRestoreContextOfFirstTask(); vRestoreContextOfFirstTask();
#if ( configENABLE_MPU == 1 )
}
#endif /* configENABLE_MPU */
break; break;
#if ( ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) ) #if ( ( configENABLE_MPU == 1 ) && ( configUSE_MPU_WRAPPERS_V1 == 1 ) )