Skip to content

Commit 97050a1

Browse files
kar-rahul-awskar-rahul-aws
authored
Memory Protection Unit (MPU) Enhancements (#705)
Memory Protection Unit (MPU) Enhancements This commit introduces a new MPU wrapper that places additional restrictions on unprivileged tasks. The following is the list of changes introduced with the new MPU wrapper: 1. Opaque and indirectly verifiable integers for kernel object handles: All the kernel object handles (for example, queue handles) are now opaque integers. Previously object handles were raw pointers. 2. Saving the task context in Task Control Block (TCB): When a task is swapped out by the scheduler, the task's context is now saved in its TCB. Previously the task's context was saved on its stack. 3. Execute system calls on a separate privileged only stack: FreeRTOS system calls, which execute with elevated privilege, now use a separate privileged only stack. Previously system calls used the calling task's stack. The application writer can control the size of the system call stack using new configSYSTEM_CALL_STACK_SIZE config macro. 4. Memory bounds checks: FreeRTOS system calls which accept a pointer and de-reference it, now verify that the calling task has required permissions to access the memory location referenced by the pointer. 5. System call restrictions: The following system calls are no longer available to unprivileged tasks: - vQueueDelete - xQueueCreateMutex - xQueueCreateMutexStatic - xQueueCreateCountingSemaphore - xQueueCreateCountingSemaphoreStatic - xQueueGenericCreate - xQueueGenericCreateStatic - xQueueCreateSet - xQueueRemoveFromSet - xQueueGenericReset - xTaskCreate - xTaskCreateStatic - vTaskDelete - vTaskPrioritySet - vTaskSuspendAll - xTaskResumeAll - xTaskGetHandle - xTaskCallApplicationTaskHook - vTaskList - vTaskGetRunTimeStats - xTaskCatchUpTicks - xEventGroupCreate - xEventGroupCreateStatic - vEventGroupDelete - xStreamBufferGenericCreate - xStreamBufferGenericCreateStatic - vStreamBufferDelete - xStreamBufferReset Also, an unprivileged task can no longer use vTaskSuspend to suspend any task other than itself. We thank the following people for their inputs in these enhancements: - David Reiss of Meta Platforms, Inc. - Lan Luo, Xinhui Shao, Yumeng Wei, Zixia Liu, Huaiyu Yan and Zhen Ling of School of Computer Science and Engineering, Southeast University, China. - Xinwen Fu of Department of Computer Science, University of Massachusetts Lowell, USA. - Yuequi Chen, Zicheng Wang, Minghao Lin of University of Colorado Boulder, USA.
1 parent 18e2937 commit 97050a1

File tree

123 files changed

+94813
-6526
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

123 files changed

+94813
-6526
lines changed

‎.github/lexicon.txt‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2468,6 +2468,7 @@ uxportcomparesetextram
24682468
uxpriority
24692469
uxprioritytouse
24702470
uxqueue
2471+
uxqueuegetqueueitemsize
24712472
uxqueuelength
24722473
uxqueuemessageswaiting
24732474
uxqueuespacesavailable

‎include/FreeRTOS.h‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -81,6 +81,11 @@
8181
#endif
8282
#endif
8383

84+
/* Set configUSE_MPU_WRAPPERS_V1 to 1 to use MPU wrappers v1. */
85+
#ifndef configUSE_MPU_WRAPPERS_V1
86+
#define configUSE_MPU_WRAPPERS_V1 0
87+
#endif
88+
8489
/* Basic FreeRTOS definitions. */
8590
#include "projdefs.h"
8691

‎include/mpu_prototypes.h‎

Lines changed: 159 additions & 82 deletions
Large diffs are not rendered by default.

‎include/mpu_wrappers.h‎

Lines changed: 151 additions & 81 deletions
Large diffs are not rendered by default.

‎include/portable.h‎

Lines changed: 21 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -110,13 +110,15 @@
110110
StackType_t * pxEndOfStack,
111111
TaskFunction_t pxCode,
112112
void * pvParameters,
113-
BaseType_t xRunPrivileged ) PRIVILEGED_FUNCTION;
113+
BaseType_t xRunPrivileged,
114+
xMPU_SETTINGS * xMPUSettings ) PRIVILEGED_FUNCTION;
114115
#else
115116
StackType_t * pxPortInitialiseStack( StackType_t * pxTopOfStack,
116117
TaskFunction_t pxCode,
117118
void * pvParameters,
118-
BaseType_t xRunPrivileged ) PRIVILEGED_FUNCTION;
119-
#endif
119+
BaseType_t xRunPrivileged,
120+
xMPU_SETTINGS * xMPUSettings ) PRIVILEGED_FUNCTION;
121+
#endif /* if ( portHAS_STACK_OVERFLOW_CHECKING == 1 ) */
120122
#else /* if ( portUSING_MPU_WRAPPERS == 1 ) */
121123
#if ( portHAS_STACK_OVERFLOW_CHECKING == 1 )
122124
StackType_t * pxPortInitialiseStack( StackType_t * pxTopOfStack,
@@ -229,6 +231,22 @@ void vPortEndScheduler( void ) PRIVILEGED_FUNCTION;
229231
uint32_t ulStackDepth ) PRIVILEGED_FUNCTION;
230232
#endif
231233

234+
/**
235+
* @brief Checks if the calling task is authorized to access the given buffer.
236+
*
237+
* @param pvBuffer The buffer which the calling task wants to access.
238+
* @param ulBufferLength The length of the pvBuffer.
239+
* @param ulAccessRequested The permissions that the calling task wants.
240+
*
241+
* @return pdTRUE if the calling task is authorized to access the buffer,
242+
* pdFALSE otherwise.
243+
*/
244+
#if ( portUSING_MPU_WRAPPERS == 1 )
245+
BaseType_t xPortIsAuthorizedToAccessBuffer( const void * pvBuffer,
246+
uint32_t ulBufferLength,
247+
uint32_t ulAccessRequested ) PRIVILEGED_FUNCTION;
248+
#endif
249+
232250
/* *INDENT-OFF* */
233251
#ifdef __cplusplus
234252
}

‎include/queue.h‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1752,7 +1752,7 @@ void vQueueSetQueueNumber( QueueHandle_t xQueue,
17521752
UBaseType_t uxQueueNumber ) PRIVILEGED_FUNCTION;
17531753
UBaseType_t uxQueueGetQueueNumber( QueueHandle_t xQueue ) PRIVILEGED_FUNCTION;
17541754
uint8_t ucQueueGetQueueType( QueueHandle_t xQueue ) PRIVILEGED_FUNCTION;
1755-
1755+
UBaseType_t uxQueueGetQueueItemSize( QueueHandle_t xQueue ) PRIVILEGED_FUNCTION;
17561756

17571757
/* *INDENT-OFF* */
17581758
#ifdef __cplusplus

‎include/task.h‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -66,6 +66,11 @@
6666
#define tskMPU_REGION_NORMAL_MEMORY ( 1UL << 3UL )
6767
#define tskMPU_REGION_DEVICE_MEMORY ( 1UL << 4UL )
6868

69+
/* MPU region permissions stored in MPU settings to
70+
* authorize access requests. */
71+
#define tskMPU_READ_PERMISSION ( 1UL << 0UL )
72+
#define tskMPU_WRITE_PERMISSION ( 1UL << 1UL )
73+
6974
/* The direct to task notification feature used to have only a single notification
7075
* per task. Now there is an array of notifications per task that is dimensioned by
7176
* configTASK_NOTIFICATION_ARRAY_ENTRIES. For backward compatibility, any use of the
@@ -3192,6 +3197,14 @@ TaskHandle_t pvTaskIncrementMutexHeldCount( void ) PRIVILEGED_FUNCTION;
31923197
*/
31933198
void vTaskInternalSetTimeOutState( TimeOut_t * const pxTimeOut ) PRIVILEGED_FUNCTION;
31943199

3200+
#if ( portUSING_MPU_WRAPPERS == 1 )
3201+
3202+
/*
3203+
* For internal use only. Get MPU settings associated with a task.
3204+
*/
3205+
xMPU_SETTINGS * xTaskGetMPUSettings( TaskHandle_t xTask ) PRIVILEGED_FUNCTION;
3206+
3207+
#endif /* portUSING_MPU_WRAPPERS */
31953208

31963209
/* *INDENT-OFF* */
31973210
#ifdef __cplusplus

‎portable/ARMv8M/copy_files.py‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -73,16 +73,22 @@
7373
'ARM_CM33' : [os.path.join('non_secure', 'portable', 'GCC', 'ARM_CM33')],
7474
'ARM_CM33_NTZ' : [os.path.join('non_secure', 'portable', 'GCC', 'ARM_CM33_NTZ')],
7575
'ARM_CM35P' : [os.path.join('non_secure', 'portable', 'GCC', 'ARM_CM33', 'portasm.c'),
76+
os.path.join('non_secure', 'portable', 'GCC', 'ARM_CM33', 'mpu_wrappers_v2_asm.c'),
7677
os.path.join('non_secure', 'portable', 'GCC', 'ARM_CM35P', 'portmacro.h')],
7778
'ARM_CM35P_NTZ' : [os.path.join('non_secure', 'portable', 'GCC', 'ARM_CM33_NTZ', 'portasm.c'),
79+
os.path.join('non_secure', 'portable', 'GCC', 'ARM_CM33_NTZ', 'mpu_wrappers_v2_asm.c'),
7880
os.path.join('non_secure', 'portable', 'GCC', 'ARM_CM35P', 'portmacro.h')],
7981
'ARM_CM55' : [os.path.join('non_secure', 'portable', 'GCC', 'ARM_CM33', 'portasm.c'),
82+
os.path.join('non_secure', 'portable', 'GCC', 'ARM_CM33', 'mpu_wrappers_v2_asm.c'),
8083
os.path.join('non_secure', 'portable', 'GCC', 'ARM_CM55', 'portmacro.h')],
8184
'ARM_CM55_NTZ' : [os.path.join('non_secure', 'portable', 'GCC', 'ARM_CM33_NTZ', 'portasm.c'),
85+
os.path.join('non_secure', 'portable', 'GCC', 'ARM_CM33_NTZ', 'mpu_wrappers_v2_asm.c'),
8286
os.path.join('non_secure', 'portable', 'GCC', 'ARM_CM55', 'portmacro.h')],
8387
'ARM_CM85' : [os.path.join('non_secure', 'portable', 'GCC', 'ARM_CM33', 'portasm.c'),
88+
os.path.join('non_secure', 'portable', 'GCC', 'ARM_CM33', 'mpu_wrappers_v2_asm.c'),
8489
os.path.join('non_secure', 'portable', 'GCC', 'ARM_CM85', 'portmacro.h')],
8590
'ARM_CM85_NTZ' : [os.path.join('non_secure', 'portable', 'GCC', 'ARM_CM33_NTZ', 'portasm.c'),
91+
os.path.join('non_secure', 'portable', 'GCC', 'ARM_CM33_NTZ', 'mpu_wrappers_v2_asm.c'),
8692
os.path.join('non_secure', 'portable', 'GCC', 'ARM_CM85', 'portmacro.h')]
8793
},
8894
'IAR':{
@@ -91,16 +97,22 @@
9197
'ARM_CM33' : [os.path.join('non_secure', 'portable', 'IAR', 'ARM_CM33')],
9298
'ARM_CM33_NTZ' : [os.path.join('non_secure', 'portable', 'IAR', 'ARM_CM33_NTZ')],
9399
'ARM_CM35P' : [os.path.join('non_secure', 'portable', 'IAR', 'ARM_CM33', 'portasm.s'),
100+
os.path.join('non_secure', 'portable', 'IAR', 'ARM_CM33', 'mpu_wrappers_v2_asm.S'),
94101
os.path.join('non_secure', 'portable', 'IAR', 'ARM_CM35P', 'portmacro.h')],
95102
'ARM_CM35P_NTZ' : [os.path.join('non_secure', 'portable', 'IAR', 'ARM_CM33_NTZ', 'portasm.s'),
103+
os.path.join('non_secure', 'portable', 'IAR', 'ARM_CM33_NTZ', 'mpu_wrappers_v2_asm.S'),
96104
os.path.join('non_secure', 'portable', 'IAR', 'ARM_CM35P', 'portmacro.h')],
97105
'ARM_CM55' : [os.path.join('non_secure', 'portable', 'IAR', 'ARM_CM33', 'portasm.s'),
106+
os.path.join('non_secure', 'portable', 'IAR', 'ARM_CM33', 'mpu_wrappers_v2_asm.S'),
98107
os.path.join('non_secure', 'portable', 'IAR', 'ARM_CM55', 'portmacro.h')],
99108
'ARM_CM55_NTZ' : [os.path.join('non_secure', 'portable', 'IAR', 'ARM_CM33_NTZ', 'portasm.s'),
109+
os.path.join('non_secure', 'portable', 'IAR', 'ARM_CM33_NTZ', 'mpu_wrappers_v2_asm.S'),
100110
os.path.join('non_secure', 'portable', 'IAR', 'ARM_CM55', 'portmacro.h')],
101111
'ARM_CM85' : [os.path.join('non_secure', 'portable', 'IAR', 'ARM_CM33', 'portasm.s'),
112+
os.path.join('non_secure', 'portable', 'IAR', 'ARM_CM33', 'mpu_wrappers_v2_asm.S'),
102113
os.path.join('non_secure', 'portable', 'IAR', 'ARM_CM85', 'portmacro.h')],
103114
'ARM_CM85_NTZ' : [os.path.join('non_secure', 'portable', 'IAR', 'ARM_CM33_NTZ', 'portasm.s'),
115+
os.path.join('non_secure', 'portable', 'IAR', 'ARM_CM33_NTZ', 'mpu_wrappers_v2_asm.S'),
104116
os.path.join('non_secure', 'portable', 'IAR', 'ARM_CM85', 'portmacro.h')]
105117
},
106118
}

0 commit comments

Comments
 (0)