1
2
Memory Protection Unit (MPU)
Andriy Petlovanyy
Senior Solution Architect
October 2020
3
Agenda
• Introduction
• What to protect?
• MPU is not MMU
• RTOS without MPU
• RTOS with MPU
• Custom MPU Support
4
Andriy Petlovanyy
• Senior Solution Architect at GlobalLogic
== 15 months
• In IT
> 19 years
• Co-founder of
55
What to protect?
6
What to protect?
• Buffer overflow
• Stack overflow
• Access violation
• Executing code from stack
7
Buffer Overflow
• Memory type
- static
- stack
• Protection
- extra parameters of function
• snprintf
• memcpy_s
- size assertions
8
Stack Overflow
• Causes
- deep call stack
- recursions
• Protection
- Cortex M33
• stack limit register
9
Access Violation
• Causes
- overflows
- “wild” pointers
- bit flipping (for external devices)
• Protection
- CRC
- Inverse copies
• Debugging is hard
1010
MPU is not MMU
11
MPU
• trimmed MMU
• only memory protection
• low power CPU
• memory regions
• MemFault
• ARM Core peripheral
12
MPU
• ARMv8-M up to 16 regions
• 8 sub-regions (equal size)
• alignment to size of region (power of 2)
• Privileged => Unprivileged
• Unprivileged ! => Privileged
13
Cortex M
ARM Core Cortex
M0[2]
Cortex
M0+[3]
Cortex
M1[4]
Cortex
M3[5]
Cortex
M4[6]
Cortex
M7[7]
Cortex
M23[8]
Cortex
M33[12]
Cortex
M35P
Memory Protection
Unit (MPU)
No
Optional
(0,8)
No
Optional
(0,8)
Optional
(0,8)
Optional
(0,8,16)
Optional
(0,4,8,12,16)
Optional
(0,4,8,12,16)
Optional
*
1414
RTOS without MPU
15
Stack
• Verify SP value
• Stack canaries
Stack #1
Stack #2
Stack #3
Stack #4
16
Memory
• Special instruction on
- unused memory
- null pointer address
1717
RTOS with MPU
18
Red Zones
• MPU protected parts
• Similar to canaries
Stack #1
Stack #2
Stack #3
Stack #4
19
• Unprivileged tasks can
- access their own stack
- up to three user memory regions
• Kernel in protected region of
Flash
• Calling an API function causes a
temporary switch to Privilege
mode
FreeRTOS
2020
Custom MPU Support
21
What
• Stack protection
• Private RAM regions
22
Stack Protection Overview
• Using Cortex M4 native feature
• Give access to thread to its own
stack
• Protect modification of code from
other processes
23
Stack Protection Zone 1
• Whole Internal RAM is covered
• Read permission
• Priority 0
• Allow all threads to access memory
on Read
24
Stack Protection Zone 2
• Read & Write permission
• Priority 1
• Allow Interruptions to access stack
• Allow modification of global data
25
Stack Protection Zone 3
• Read & Write permission
• Priority 2
• Allow thread to use it’s stack
• Disallow to access neighbor’s
stacks
• Is changed during context switch
26
Tool for MPU Registers
• Rearrangement of stacks to fulfill
MPU specs
• Stack size realigned to 512 Bytes
• Allow recalculation in case of
resizing
27
28
Summary
• Powerful hardware feature
• Improve fixing time for hard to tackle issues
• Immediate detection of stack memory corruption
• Precise location of “intruder” to memory space
29
Thank you
30

Memory protection unit