Real-time Thread Isolation and Trusted Execution on Embedded RISC-V

—The Internet of Things paradigm has led to an increasing demand for low-power single-core embedded devices with hardware-enforced trusted execution environments (TEE). The preeminent solution in this space is Arm TrustZone, which provides four CPU execution states, each with its own memory and instruction permissions. In 2019, physical memory protection (PMP) instructions were ratified in the RISC-V ISA, which offers enhancements similar to an Arm MPU, but does not enable the creation of TEE frameworks similar to TrustZone. In this paper, we discuss a limitation in the PMP specification which precludes the design of such a TEE framework on RISC-V without resorting to a non-standard hardware modification. We propose a simple modification to the PMP specification which would resolve this limitation without the addition of additional registers. We discuss our early ongoing work in implementing a prototype of this hardware extension and integrating it with the Zephyr real-time operating system (RTOS).