Using PMP, ePMP and Rust to Protect Embedded Kernels, Even from Themselves
summary
Demonstrates that Tock OS uses RISC-V PMP write-xor-execute to mark kernel stack/data non-executable and kernel text read-only, and that ePMP default-deny adds fine-grained, locked regions so user space can be denied by default while allowing controlled shared buffers. Explains implementation tradeoffs: Tock needs two PMP entries per region (start/end), typical cores ship only four regions so realistic deployments often need ~16 entries for full stack/heap protection, and return-oriented programming still bypasses DEP-style defenses.
AI-written summary · about
chapters (10)
- 0:00Introduction to embedded security
- 0:37DEP and W^X mechanisms
- 2:43Tock OS and memory safety
- 3:40Kernel architecture
- 5:39Using RISC-V PMP for isolation
- 7:56Kernel W^X enforcement
- 8:40Advanced protection with ePMP
- 10:22Limitations of current security
- 11:38Hardware and design constraints
- 14:15Conclusion and Q&A
related talks
12mBuilding Low-Latency Secure Embedded System Using eBPF
23mRISC V Enclaves A Clean Slate Approach To Linux Security
50mMPK/PKS Linux Kernel Compartmentalization
17mEnhancing OP-TEE for RISC-V: Leveraging IOPMP and Enabling RTOS Integration
32mGood Motive but Bad Design: Pitfalls in MPU Usage in Embedded Systems in the Wild
19mEPK: Scalable and Efficient Memory Protection Keys
30mKernel Hardening With Protection Keys
01h 37mHow to Secure a RISC V System in 90 minutes From Single Core MCU to Mixed