armv7-m mpu (memory protection unit) xn example
TRANSCRIPT
12/19/16 2
BitSec Demo
Memory protection using MPUEach MPU can set 8 region onCortex-M4To achieve program isolationAnd, can set the region toeXecution Never (XN)
12/19/16 3
BitSec Demo
12/19/16 4
BitSec Demo
PC 0x08008000
12/19/16 5
BitSec Demo
PC 0x08008000
If attacker put malicious code at0x20004000, and set PC to
0x20004000
12/19/16 6
BitSec Demo
Then, CPU will try to fetch0x20004000 value as next instruction
PC 0x20004000
12/19/16 7
BitSec Demo
Attack done.
PC 0x20004000
12/19/16 8
BitSec Demo
But If we setting MPU region and set region not to execute
12/19/16 9
BitSec Demo
But If we setting MPU region and set region not to execute
Base: 0x20004000, Size: 2 ** 12, Attr: 1000Range: 0x20004000 ~ 0x20005000
MPU protect, XN is true
0x20004000
0x20005000
12/19/16 10
BitSec Demo
When PC value been changed to 0x20004008CPU try to fetch 0x20004008
as next instruction
MPU protect, XN is truePC 0x200040080x20004000
0x20005000
12/19/16 11
BitSec Demo
This invalid memory access will trigger MPUthen generate a
memory manage fault exception
MPU protect, XN is truePC 0x200040080x20004000
0x20005000
12/19/16 12
BitSec Demo
It will handle bymem_manage_fault_handler
to avoid attack
MPU protect, XN is true
PC 0x0800605Emem manage fault handler
0x20004000
0x20005000