With the rapid advancement in information technology, embedded systems have become integral to a wide range of critical applications. These systems often require continuous operation and cannot tolerate the downtime associated with traditional software updates, which typically necessitate a system reboot. To address this challenge, this paper proposes a novel hotpatching technique called Flexible Linked EXecution (FLEX) designed specifically for real-time embedded environments. FLEX enables seamless, dynamic firmware updates by redirecting all function calls and global variable accesses through a compile time generated Control Flow Table (CFT). In contrast to existing hotpatching approaches that depend on specialized hardware or impose strict limits on the number of patches and their size, FLEX is entirely hardware independent and supports scalable patching capacity bounded only by available flash memory and RAM. FLEX offers several unique features, including a relaxed consistency state synchronization mechanism to allow for gradual migration of program state, resolving all symbols at compile time into CFT indirections, applying updates via a double-buffered pointer swap to a new CFT, and a XIP compatible process that guarantees only a short, bounded pause time regardless of patch complexity. Experimental results show that FLEX maintains system stability and performance with an average execution overhead of about 11% and a predictable increase in flash memory usage of roughly 17%. These findings suggest that FLEX offers a robust and flexible solution for dynamically updating the software of embedded systems to ensure high availability and security without sacrificing performance.

Embedded systems rely on real-time operating systems (RTOS) for safety-critical applications, but the absence of fine-grained memory protection poses serious security risks. Existing protection mechanisms either require specialized hardware or rely on static configurations that fail to adapt to dynamic task behavior. This paper introduces Runtime Enforcement of Memory Access Protection (REMAP), which is a novel framework that combines LLVM-based static analysis with runtime Memory Protection Unit (MPU) reconfiguration to achieve fine-grained, dynamic compartmentalization for RTOS environments. REMAP constructs task-specific Access Control Table (ACT) at compile time and enforces them at runtime through on-demand MPU updates triggered by memory access violations. This lazy mapping strategy allows REMAP to support hundreds of compartments per task despite the limitation on the number of hardware MPU slots. Our prototype on ARMv8-M (Cortex-M33) demonstrates that REMAP enforces memory access control down to the function and variable level, protects shared buffers for secure Inter Process Communication (IPC), and prevents error propagation across tasks. Evaluation using the BEEBS benchmark suite shows that compartment merging significantly reduces fault frequency, yielding overheads under 5% across all benchmarks. Therefore, REMAP achieves precise, adaptive memory protection suitable for commercial RTOS deployments without compromising real-time performance.