Starting method, related equipment and readable storage medium

Abstract

The invention provides a starting method, related equipment and a readable storage medium, and is applied to the technical field of computers, the method is applied to a system-on-chip configured with a main processor and a bus monitoring module, the bus monitoring module provides an initialization operation sequence, and the operation sequence of the main processor is initialized based on the pre-stored initialization operation sequence. The bus monitoring module initializes the main processor and awakens the main processor after a first starting address of the main processor is configured, the first starting address is obtained after the main processor is awakened, and target starting firmware needing to be executed after the main processor is initialized is executed according to the first starting address. And the bus monitoring module initializes the main processor by using the pre-stored initialization operation sequence and skips a BL1 stage and a BL33 stage, so that the interaction times of BL1 firmware and BL33 firmware in the initialization process of the processor are reduced, the exposure risk is reduced, and the running safety of the processor is improved.

Description

Technical Field

[0001] This application relates to the field of computer technology, and particularly to a startup method, related devices, and readable storage media. Background Art

[0002] The firmware required to run during the processor startup process includes multiple ones, such as BL1 firmware, BL2 firmware, and BL33 firmware, etc. Among them, BL1 firmware is the earliest firmware to run during the startup process and is also the secure firmware stored in ROM (Read-Only Memory). BL33 firmware can include the firmware running in the normal world and can be used to enable the processor function modules required in the customer application scenario customarily by the customer, including different types and quantities of function modules.

[0003] During the existing processor startup process, BL1 firmware usually starts before BL33 firmware, and during the startup process of BL33 firmware, it needs to interact with BL1 firmware, that is, transmit the initialization configuration information and initialization instructions obtained during the execution of BL33 firmware to BL1 firmware. Since BL1 firmware runs in the secure domain and BL33 firmware runs in the non-secure domain, therefore, every time the processor is initialized, BL1 firmware has a risk of being exposed to the non-secure domain once. Repeated startup of the processor will increase the risk of BL1 exposure, which has a serious impact on the running security of the processor. Summary of the Invention

[0004] In view of this, this application is committed to providing a startup method, related devices, and readable storage media. A bus monitoring module is newly added in the system-on-chip, and the bus monitoring module provides a pre-stored initialization operation sequence to reduce the number of interactions between BL1 firmware and BL33 firmware, thereby reducing the risk of BL1 firmware exposure and helping to improve the running security of the processor.

[0005] In a first aspect, this application provides a startup method, which is applied to a system-on-chip. The system-on-chip includes a main processor and a bus monitoring module. The method includes the following steps executed by the bus monitoring module:

[0006] Initialize the main processor based on a pre-stored initialization operation sequence, where the initialization operation sequence includes the configuration information and initialization instructions obtained during the first execution of BL1 firmware and BL33 firmware by the main processor;

[0007] Configure a first startup address of the main processor, where the first startup address includes the storage address of the target startup firmware required to be executed after the main processor is initialized;

[0008] Wake up the main processor so that the main processor executes the target startup firmware according to the first startup address.

[0009] In an alternative embodiment, initializing the main processor based on a pre-stored initialization operation sequence includes:

[0010] Obtain a first enable instruction output by the main processor after determining that the system-on-chip is not starting up for the first time;

[0011] In response to the first enable instruction, initialize the main processor based on a pre-stored initialization operation sequence.

[0012] In an alternative embodiment, the startup method provided in the first aspect of the present application further includes:

[0013] Obtain a second enable instruction output by the main processor after determining that the system-on-chip is starting up for the first time;

[0014] In response to the second enable instruction, record the configuration information and initialization instructions transmitted by the main processor during the execution of the BL1 firmware and the BL33 firmware.

[0015] In an alternative embodiment, initializing the main processor based on a pre-stored initialization operation sequence includes:

[0016] Determine whether the system-on-chip is starting up for the first time;

[0017] If the system-on-chip is not starting up for the first time, initialize the main processor based on a pre-stored initialization operation sequence.

[0018] In an alternative embodiment, the startup method provided in the first aspect of the present application further includes:

[0019] In the case where the system-on-chip starts up for the first time, verify the signature of the BL1 firmware of the main processor;

[0020] If the signature verification of the BL1 firmware is successful, wake up the main processor so that the main processor jumps to the BL33 stage after entering the BL1 stage;

[0021] Obtain the initialization operation sequence provided by the main processor in the BL33 stage.

[0022] In an alternative embodiment, configuring the first startup address of the main processor includes:

[0023] Obtain the signature verification result of the target startup firmware;

[0024] If the signature verification result indicates that the verification of the target startup firmware is successful, configure the storage address of the target startup firmware;

[0025] Determine that the storage address of the target startup firmware is the first startup address of the main processor.

[0026] In an alternative embodiment, the target startup firmware includes BL2 firmware;

[0027] Obtaining the signature verification result of the target startup firmware includes:

[0028] Verify the BL2 firmware to obtain the signature verification result of the BL2 firmware.

[0029] In an alternative embodiment, the system-on-chip further includes a system controller;

[0030] Wake up the main processor so that the main processor executes the target startup firmware according to the first startup address, including:

[0031] Send the first startup address to the system controller so that the system controller outputs a startup instruction including the first startup address, and the startup instruction is used to instruct the main processor to execute the target startup firmware according to the first startup address.

[0032] In a second aspect, the present application provides a startup method applied to a system-on-chip, the system-on-chip including a main processor and a bus monitoring module, and the method includes the following steps executed by the main processor:

[0033] After being awakened, obtain the first startup address;

[0034] Wherein, the first startup address is configured by the bus monitoring module after initializing the main processor based on a pre-stored initialization operation sequence, and the initialization operation sequence includes configuration information and initialization instructions obtained during the main processor's first execution of the BL1 firmware and the BL33 firmware;

[0035] Execute the target startup firmware required after the initialization of the main processor according to the first startup address.

[0036] In an alternative embodiment, the startup method provided in the second aspect of the present application further includes:

[0037] After being awakened, obtain a second startup address, and the second startup address includes the storage address of the BL1 firmware;

[0038] Enter the BL1 stage according to the second startup address, and determine whether the system-on-chip is starting up for the first time in the BL1 stage;

[0039] If the system-on-chip is not started for the first time, a first enable instruction is generated, and the first enable instruction is used to trigger the bus monitoring module to initialize the main processor based on a pre-stored initialization operation sequence.

[0040] In an optional implementation manner, the startup method provided in the second aspect of the present application further includes:

[0041] If the system-on-chip is started for the first time, a second enable instruction is generated, and the second enable instruction is used to trigger the bus monitoring module to monitor bus information to record the initialization operation sequence transmitted by the main processor during the execution of the BL1 firmware and the BL33 firmware;

[0042] Jump to the BL33 stage to obtain the initialization operation sequence required for initialization;

[0043] Jump back to the BL1 stage and generate a disable instruction, and the disable instruction is used to trigger the bus monitoring module to stop monitoring bus information.

[0044] In an optional implementation manner, the startup method provided in the second aspect of the present application further includes:

[0045] In the BL1 stage, verify the signature of the BL2 firmware;

[0046] If the signature verification of the BL2 firmware is successful, jump to the BL2 stage.

[0047] In an optional implementation manner, the startup method provided in the second aspect of the present application further includes:

[0048] After being awakened, obtain a second startup address, and the second startup address includes the storage address of the BL1 firmware;

[0049] Enter the BL1 stage according to the second startup address;

[0050] Jump from the BL1 stage to the BL33 stage, and obtain the initialization operation sequence required for initialization in the BL33 stage;

[0051] Send the initialization operation sequence to the bus monitoring module;

[0052] Jump back to the BL1 stage.

[0053] In an optional implementation manner, the startup method provided in the second aspect of the present application further includes:

[0054] Obtain the signature verification result of the BL2 firmware;

[0055] If the signature verification of the BL2 firmware is successful, jump to the BL2 stage.

[0056] In an alternative embodiment, the target startup firmware includes BL2 firmware;

[0057] Execute the target startup firmware required to be executed after the initialization of the main processor according to the first startup address, including:

[0058] Execute the BL2 firmware according to the first startup address to enter the BL2 stage.

[0059] In an alternative embodiment, the startup method provided in the second aspect of the present application further includes:

[0060] In the BL2 stage, determine whether the main processor is successfully initialized;

[0061] If the initialization is successful, wake up each coprocessor configured by the system-on-chip;

[0062] After waking up each coprocessor, sequentially jump to the BL31 stage, the BL32 stage, and the BL33 stage until the operating system loaded by the system-on-chip is started.

[0063] In a third aspect, the present application provides a bus monitoring module, which is configured to execute the startup method according to any one of the first aspects of the present application.

[0064] In a fourth aspect, the present application provides a main processor, which is configured to execute the startup method according to any one of the second aspects of the present application.

[0065] In a fifth aspect, the present application provides a system-on-chip, including: an on-chip network, a system controller, a bus monitoring module according to the third aspect of the present application, at least one coprocessor, and at least one main processor, wherein,

[0066] The at least one main processor includes a main processor according to the fourth aspect of the present application;

[0067] Each coprocessor, the main processor, the system controller, and the bus monitoring module are respectively connected to the on-chip network.

[0068] In a sixth aspect, the present application provides an electronic device, including: a system-on-chip according to the fifth aspect of the present application.

[0069] In a seventh aspect, the present application provides a computer-readable storage medium, storing a computer program, and when the computer program is executed, it implements the startup method according to any one of the first aspect or the second aspect of the present application.

[0070] Based on the above, the startup method provided by the present application is applied to a system-on-chip configured with a main processor and a bus monitoring module. The bus monitoring module provides a pre-stored initialization operation sequence, which includes configuration information and initialization instructions obtained during the first execution of the BL1 firmware and the BL33 firmware by the main processor. Based on the pre-stored initialization operation sequence, the bus monitoring module initializes the main processor, and after configuring the first startup address of the main processor, wakes up the main processor. After the main processor wakes up, it obtains the first startup address and executes the target startup firmware required after the initialization of the main processor according to the first startup address. It can be seen that through the startup method provided by the present application, the bus monitoring module uses the pre-stored initialization operation sequence to initialize the main processor, skipping the BL1 stage and the BL33 stage, thereby reducing the number of interactions between the BL1 firmware and the BL33 firmware during the processor initialization process, reducing the risk of exposure of the BL1 firmware, and helping to improve the security of the processor operation. BRIEF DESCRIPTION OF THE DRAWINGS

[0071] In order to more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the following will briefly introduce the drawings required for use in the description of the embodiments or the prior art. Obviously, the drawings in the following description are some embodiments of the present invention. For those of ordinary skill in the art, without creative efforts, other drawings can be obtained based on these drawings.

[0072] Figure 1 It is a schematic structural diagram of a system-on-chip provided by the present application.

[0073] Figure 2 It is a flowchart of a startup method provided by the present application.

[0074] Figure 3 It is a flowchart of another startup method provided by the present application.

[0075] Figure 4 It is a flowchart of still another startup method provided by the present application.

[0076] Figure 5 It is a flowchart of yet another startup method provided by the present application.

[0077] Figure 6 It is a schematic structural diagram of a bus monitoring module provided by the present application. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0078] Next, the technical solutions in the embodiments of the present application will be clearly and completely described in conjunction with the accompanying drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative efforts shall fall within the protection scope of the present application.

[0079] In existing applications, the processor completes the initialization work and the operating system loading through the bootloader. In this process, it is necessary to first verify the signatures of each firmware included in the bootloader, and then run each firmware after the signature verification of each firmware is successful until the operating system is finally loaded. As mentioned above, there are multiple firmwares required to run during the processor startup process, such as BL (Boot Loader) 1 firmware, BL2 firmware, and BL33 firmware, etc.

[0080] Regarding these firmwares, it should be emphasized that the BL1 firmware is the earliest running firmware during the startup process and is also a secure firmware stored in the ROM (Read-Only Memory), which is invisible to users. In some types of trusted firmware technologies, the BL1 firmware is the root of trust for everything. The BL1 firmware can be used to initialize the core hardware of the computing device (such as Trusted SRAM, serial port, etc.) and find the BL2 firmware. In some cases, the BL1 firmware will verify the signature of the BL2 firmware. The BL1 firmware runs at the EL3 privilege level. Based on the above content, it can be seen that in existing applications, the security requirements for the BL1 firmware are very high.

[0081] The BL33 firmware can include firmwares running in the normal world, such as UEFI (Unified Extensible Firmware Interface) firmware or UBOOT (bootloader for the embedded field) firmware for desktop, server and other fields, and can also include the Linux Kernel, and of course, can also include OPTEE (Open Portable Trusted Execution Environment) firmware, etc. In practical applications, it can be used to enable the processor function modules required in the customer application scenario customarily by the customer, including different types and quantities of function modules. It can be seen that the BL33 firmware is a firmware that needs to interact with users. Since it runs in the normal world, that is, the non-secure domain, its security requirements are much lower than those of the BL1 firmware.

[0082] During the startup process of an existing processor, the BL1 firmware running in the secure domain usually starts up prior to the BL33 firmware running in the non-secure domain. During the startup process of the BL33 firmware, it is necessary to interact with the BL1 firmware to transmit the configuration information and initialization instructions required for the processor initialization process. This means that for each startup initialization process of the processor, the BL1 firmware needs to perform an initialization information interaction with the BL33 firmware, that is, each initialization process corresponds to an exposed risk. Repeated startups of the processor will increase the risk exposed by the BL1, which has a serious impact on the secure operation of the processor.

[0083] To solve the above problems, the present application provides a system-on-chip as shown in Figure 1 The system-on-chip provided by the present application includes: an on-chip network 10, a system controller 20, at least one main processor 30, at least one coprocessor 40, and a bus monitoring module 50.

[0084] The on-chip network 10 serves as a data interaction channel and can enable data interaction between any two or more functional units connected to the on-chip network 10. For example, the system controller 20 sends a startup instruction to the main processor 30 through the on-chip network 10, indicating the storage address of the first instruction to be loaded first after the main processor 30 is started (this process will be elaborated in detail in the subsequent content). Another example is that the bus monitoring module 50 monitors the data interaction process between the main processor 30 and the coprocessor 40 through the on-chip network 10 and executes the startup method provided by the present application based on the on-chip network 10. Yet another example is that the non-secure memory 60 and the secure memory 70 outside the system-on-chip are also respectively connected to the on-chip network 10. Based on this, some functional units inside the system-on-chip can perform data read and write operations on the non-secure memory 60 or the secure memory 70 through the on-chip network 10. As for other functions of the on-chip network 10, they can be implemented with reference to related technologies and will not be elaborated here.

[0085] In the system-on-chip provided in this application, the system controller 20 is specifically used to provide power management functions for all the power-consuming loads of the system-on-chip, and strip the system security-related functions integrated in the system controller 20 in the related art, such as program signature verification, data encryption and other functions. Of course, as mentioned above, the system controller 20 is also responsible for the first address boot during the startup process of the main processor 30. In practical applications, one or more system controllers can be set inside the system-on-chip. In the case of setting multiple system controllers, one of them serves as the main system controller, and the rest serve as auxiliary system controllers. Each system controller is responsible for the power management of the corresponding power-consuming load. After the system-on-chip is powered on, the main system controller executes the control system startup firmware, and after the startup is completed, controls the startup of other system controllers. After all the system controllers are started up, they jointly are responsible for the power supply of each part of the system-on-chip. As for the functional division between the system controllers, reference can be made to the related art, and this application does not make any limitations in this regard.

[0086] In the system-on-chip, usually at least one main processor 30 is provided. It can be understood that the specific number of main processors 30 is related to the specific functions implemented by the system-on-chip. This application does not limit the number of main processors 30. The main processor 30 is usually used to carry the operating system and application programs, execute most of the tasks at the application layer, and perform necessary information interactions with users. In the case where a coprocessor is provided in the system-on-chip, it can also cooperate with the coprocessor to complete more system tasks. It should be emphasized that, as mentioned above, at least one main processor is provided in the system-on-chip. Based on this, in the case where two or more main processors are provided in the system-on-chip, one of the main processors is used to execute the startup program of the system-on-chip, that is, execute the startup firmware for guiding the operating system mentioned above. This main processor starts up before other main processors. The main processor mentioned in the subsequent content of this application refers to the main processor used to execute the startup program of the system-on-chip.

[0087] As mentioned above, the coprocessor is a processor defined relative to the main processor inside the system-on-chip. The coprocessor is used to execute the processing work that the main processor cannot execute or the execution efficiency is low. Therefore, in practical applications, the specific functions implemented by the system-on-chip are different, and the number of coprocessors 40 provided and the specific functions will also be different. This application does not limit the specific setting situation of the coprocessor in the system-on-chip. Common coprocessors can include: input / output processors, image processors, peripheral controllers, etc. The startup method provided in this application involves the signature verification of each coprocessor, which will be specifically elaborated in the subsequent content and will not be detailed here for the time being.

[0088] The bus monitoring module 50 is a newly added functional module in the system-on-chip provided by this application. It can cooperate with the main processor and is used to execute the startup methods provided in the subsequent embodiments of this application. Further, the bus monitoring module 50 can also monitor the bus information transmitted in the on-chip network 10, extract the target bus data from the bus information according to the preset screening conditions. At the same time, the bus monitoring module 50 is also configured with a data recurrence function, that is, when needed, it recurs the target bus data to the on-chip network 10. Based on this, without the need to execute the relevant software or functional units, the target bus data for implementing the specified function can be provided to the relevant parties, thus saving the time required for the relevant software or functional units to generate recurrence data and improving the efficiency of providing recurrence data.

[0089] Further, in Figure 1 In the shown system-on-chip, the on-chip network 10 is also connected to a non-secure memory 60 and a secure memory 70. It can be understood that, in terms of the storage medium used by the memory, there is no essential difference between the non-secure memory 60 and the secure memory 70. For example, both can choose Flash memory. The main difference between them lies in the security requirements for the data access process. The access security requirements of the secure memory 70 are higher than those of the non-secure memory 60. It should be noted that in Figure 1 In the shown system-on-chip, both the non-secure memory 60 and the secure memory 70 are shown as external memories outside the system-on-chip. In another alternative embodiment, the non-secure memory 60 and the secure memory 70 can also be internal memories provided inside the system-on-chip.

[0090] Based on the system-on-chip provided by this application, this application also provides a startup method, which is specifically applied to Figure 1 the main processor 30 and the bus monitoring module 50 in the shown system-on-chip. In the startup method provided by this application, the bus monitoring module initializes the main processor using the pre-stored initialization operation sequence, skipping the BL1 stage and the BL33 stage, thereby reducing the number of interactions between the BL1 firmware and the BL33 firmware during the processor initialization process, reducing the risk of exposure of the BL1 firmware, and helping to improve the security of the processor operation.

[0091] See Figure 2 As shown, the startup method provided by this application may include the following steps.

[0092] S100. The bus monitoring module initializes the main processor based on the pre-stored initialization operation sequence.

[0093] As described above, in the system on chip provided by the present application, a new bus monitoring module is added. The bus monitoring module can monitor the bus information transmitted by the network on the chip and extract the target bus data in the bus information according to the application requirements. Based on this, the startup method provided by the present application is based on the bus monitoring module to monitor and record the initialization operation sequence interacted through the network on the chip during the first execution of the BL1 firmware and the BL33 firmware by the main processor. In an alternative embodiment, the initialization operation sequence includes configuration information and initialization instructions related to the initialization process of the main processor. Of course, the specific configuration information required by different main processors during the initialization process and the specific initialization instructions executed are different, and will not be listed one by one here. Without exceeding the scope of the core idea of the present application, any information related to the initialization process of the main processor is within the scope of protection of the present application. As for the specific implementation process of the bus monitoring module to monitor and record the initialization operation sequence, it will be elaborated in the following content and will not be described in detail here.

[0094] Furthermore, based on the above related content about the initialization operation sequence, it can be understood that the initialization operation sequence is obtained during the first execution of the BL1 firmware and the BL33 firmware by the main processor. Therefore, the startup method provided in this embodiment is mainly applied to the startup process after the first startup of the main processor.

[0095] In practical applications, based on the aforementioned data recurrence function, the bus monitoring module recurrences the initialization operation sequence to the main processor through the network on the chip to complete the initialization operation of the main processor, thereby skipping the BL1 stage and the BL33 stage that need to be executed every time the system is powered on in the prior art, effectively avoiding the exposure risk of the BL1 firmware during this process. As for the specific process of the main processor to execute the initialization operation based on the obtained initialization operation sequence, it can be implemented with reference to the related technology and will not be elaborated here.

[0096] S110. The bus monitoring module configures the first startup address of the main processor.

[0097] As described above, there are multiple firmware that the main processor needs to run during the startup process. After completing the initialization of the main processor through the foregoing steps, the main processor needs to further execute the startup firmware that needs to be executed after initialization. For the sake of convenience of description, the present application defines this startup firmware as the target startup firmware. Correspondingly, the storage address of the target storage firmware is defined as the first startup address.

[0098] In an alternative embodiment, after the main processor completes initialization, it needs to further execute the BL2 firmware. Based on this, the bus monitoring module further obtains the verification result of the target startup firmware, that is, the BL2 firmware. If the verification result of the target startup firmware indicates that the verification of the target startup firmware is successful, configure the storage address of the target startup firmware, and use the storage address of the target startup firmware as the first startup address of the main processor. Combined with Figure 1 As shown, as an alternative embodiment, before the target startup firmware is verified, the target startup firmware can be stored in the secure memory. When the verification result of the target startup firmware indicates that the verification of the target startup firmware is successful, that is, when it is determined that the target startup firmware is secure, the bus monitoring module moves the target startup firmware from the non-secure memory to the secure memory. During the process of storing the target startup firmware in the secure memory, that is, configure the storage address of the target startup firmware, and use this storage address as the first startup address.

[0099] As for the bus monitoring module to obtain the verification result of the target startup firmware, there are various implementation methods. In an alternative embodiment, the bus monitoring module is configured with a firmware verification function, and the bus monitoring module verifies the target startup firmware to directly obtain the verification result of the target startup firmware. In another alternative embodiment, the main processor itself or other functional units in the system-on-chip complete the verification of the target startup firmware, and the bus monitoring module obtains the corresponding verification result. As an alternative embodiment, a flag register can be configured for each startup firmware in the system-on-chip, and the verification result of the corresponding startup firmware is recorded through the flag register. Based on this, the bus monitoring module can access the flag register corresponding to the target startup firmware to obtain the verification result of the target startup firmware.

[0100] Furthermore, if the obtained verification result indicates that the verification of the target startup firmware fails, it means that the target startup firmware has a risk of being tampered with and is currently in an insecure state. In this case, the current startup process can be exited.

[0101] S120. The bus monitoring module sends the first startup address to the main processor.

[0102] In practical applications, when the main processor executes each startup firmware, it starts from the first instruction pointed to by the storage address of the startup firmware. Based on this, after the bus monitoring module configures the first startup address of the target startup firmware, it sends the first startup address to the main processor.

[0103] In an alternative embodiment, the process of the main processor executing the startup firmware is triggered by the system controller in the system-on-chip. In this case, the bus monitoring module sends the first startup address to the system controller, and the system controller generates a startup instruction carrying the first startup address and sends the startup instruction to the main processor, thereby providing the first startup address to the main processor.

[0104] S130. The main processor obtains the first startup address.

[0105] The main processor receives the first startup address, which is the storage address of the target startup firmware, and the storage address of the first instruction of the target startup firmware that needs to be executed during the process of the main processor executing the target startup firmware.

[0106] Continuing with the previous example, in the case where the system controller provides a startup instruction carrying the first startup address, the main processor parses the obtained startup instruction and extracts the first startup address carried in the startup instruction.

[0107] S140. The main processor executes the target startup firmware required after the main processor is initialized according to the first startup address.

[0108] After the main processor obtains the first startup address, it can access the storage space corresponding to the first startup address, obtain the first instruction stored in the storage space, and further execute the first instruction and other instructions included in the target startup firmware until the execution of the target startup firmware is completed. As for the specific process of the main processor executing the target startup firmware, it can be implemented with reference to related technologies, and this application does not make specific limitations in this regard.

[0109] It can be understood that after executing the target startup firmware, the main processor also needs to further execute other firmware related to the startup process. The specific execution process will be elaborated in the subsequent content and will not be elaborated here for the time being.

[0110] In summary, for the startup method provided by this application, the bus monitoring module provides a pre-stored initialization operation sequence, which includes configuration information and initialization instructions obtained during the process of the main processor first executing the BL1 firmware and the BL33 firmware. Based on the pre-stored initialization operation sequence, the bus monitoring module initializes the main processor, and after configuring the first startup address of the main processor, wakes up the main processor. After the main processor wakes up, it obtains the first startup address and executes the target startup firmware required after the main processor is initialized according to the first startup address. It can be seen that through this method, the bus monitoring module initializes the main processor using the pre-stored initialization operation sequence, skips the BL1 stage and the BL33 stage, thereby reducing the number of interactions between the BL1 firmware and the BL33 firmware during the processor initialization process, reducing the risk of exposure of the BL1 firmware, and helping to improve the security of the processor operation.

[0111] As described above, in order to ensure system security, before the main processor loads and starts the firmware, it is necessary to verify the signatures of each startup firmware related to the startup process. The verification process can be implemented by a bus monitoring module or other functional units in the system-on-chip. Based on the startup method provided in the foregoing embodiment, the corresponding startup methods are respectively proposed for two cases where the bus monitoring module is responsible for firmware signature verification and not responsible for firmware signature verification. At the same time, the acquisition process of the foregoing pre-stored initialization operation sequence is elaborated in detail.

[0112] In the case where the bus monitoring module does not verify the signature of the startup firmware, the startup method provided in this application may include the following steps as Figure 3 shown.

[0113] S200. After the main processor is awakened, obtain the second startup address.

[0114] In the related art, the Power Policy Unit (PPU) is a component specifically used for power management in the system-on-chip. After the system-on-chip is powered on, the power policy unit, as the core component of power management, starts before other components inside the system-on-chip. In practical applications, the power policy unit can be integrated into the system controller or the bus monitoring module. Depending on the integration location of the power policy unit, the startup sequence of the system controller and the bus monitoring module and the wake-up process of the main processor will also be different.

[0115] In an optional implementation manner, the power policy unit is integrated into the bus monitoring module. After the power policy unit starts, it preferentially powers the bus monitoring module. The bus monitoring module is released from reset before the system manager, that is, it completes startup before the system manager. Further, the bus monitoring module controls the release of the system controller from reset. After the system controller starts, the system controller wakes up the main processor.

[0116] In another optional implementation manner, the power policy unit is integrated into the system controller. After the power policy unit starts, it preferentially powers the system controller. The system controller is released from reset before the bus monitoring module. After the system controller completes startup, it further powers the bus monitoring module to drive the bus monitoring module to be released from reset and complete the startup of the bus monitoring module. Moreover, the system controller also controls the release of the main processor (as described above, specifically the main processor for executing the startup program) from reset, that is, wakes up the main processor.

[0117] Further, after the main processor wakes up, according to the preset startup firmware loading process, it first enters the BL1 stage. Based on this, the system controller also sends a startup instruction to the main processor. The startup instruction carries the storage address of the first instruction executed by the main processor in the BL1 stage. After the main processor is woken up, it can obtain the startup instruction through the on-chip network. By parsing the obtained startup instruction, the second startup address can be obtained.

[0118] S201. The main processor enters the BL1 stage according to the second startup address.

[0119] The main processor executes the instructions of the BL1 firmware according to the second startup address, that is, enters the BL1 stage. As for the specific execution process of the main processor entering the BL1 stage based on the second startup address, it can refer to the related technology implementation and will not be elaborated here.

[0120] In an optional implementation manner, before the main processor executes the BL1 firmware, it can first obtain the verification signature result of the BL1 firmware. If the verification signature of the BL1 firmware is successful, the foregoing operations are executed to enter the BL1 stage. On the contrary, if the verification signature of the BL1 firmware fails, the current startup process is exited to ensure system security.

[0121] As for the verification signature result of the BL1 firmware, it can be obtained in two ways. In an optional implementation manner, the main processor calls the verification signature program of the BL1 firmware and verifies the BL1 firmware through the corresponding verification signature program to obtain the verification signature result of the BL1 firmware. In another optional implementation manner, other functional units of the system-on-chip verify the BL1 firmware, and the main processor obtains the verification signature result of the BL1 firmware by accessing the flag register corresponding to the BL1 firmware. Of course, the BL1 firmware can also be verified in other ways. In short, when ensuring the security and trustworthiness of the BL1 firmware, the main processor enters the BL1 stage.

[0122] S202. The main processor determines whether the system-on-chip starts for the first time. If so, execute S203; if not, execute S211.

[0123] In the BL1 stage, the main processor determines whether the system-on-chip starts for the first time. If the system-on-chip starts for the first time, it means that the foregoing initialization operation sequence has not been recorded yet, and S203 is executed. On the contrary, if it is determined that the system-on-chip does not start for the first time, S211 is executed.

[0124] In an alternative embodiment, a status register is further configured in the system-on-chip. Whether the system-on-chip is started for the first time is recorded through the status register. For example, the system-on-chip is indicated to be started for the first time by a first value, such as 0. Correspondingly, the system-on-chip is indicated not to be started for the first time by a second value, such as 1. Based on this, the main processor accesses the status register. If the current value of the status register is the first value, it is determined that the system-on-chip is started for the first time. On the contrary, if the current value of the status register is the second value, it is determined that the system-on-chip is not started for the first time.

[0125] S203. The main processor generates a second enable instruction.

[0126] In the case where it is determined that the system-on-chip is started for the first time, the main processor sends a second enable instruction to the bus monitoring module to trigger the bus monitoring module to monitor the bus information and record the initialization operation sequence transmitted by the main processor during the execution of the BL1 firmware and the BL33 firmware. As for the specific implementation of the main processor generating the second enable instruction and transmitting the second enable instruction, reference can be made to the related technology, and the present application does not make any limitations in this regard.

[0127] S204. The bus monitoring module obtains the second enable instruction.

[0128] After the main processor sends the second enable instruction through the on-chip network, the bus monitoring module also connected to the on-chip network can obtain the second enable instruction through the on-chip network.

[0129] S205. The bus monitoring module responds to the second enable instruction and records the configuration information and initialization instructions transmitted by the main processor during the execution of the BL1 firmware and the BL33 firmware.

[0130] The bus monitoring module responds to the second enable instruction, monitors the entire process of the main processor jumping from the BL1 stage to the BL33 stage and transmitting configuration information and initialization instructions to the BL1 firmware during the BL33 stage, and stores the obtained initialization operation sequence in a preset storage space. As for the optional implementation manner of the monitoring function of the bus monitoring module, it will be elaborated in the subsequent content and will not be described in detail here.

[0131] S206. The main processor jumps to the BL33 stage and obtains the initialization operation sequence required for initialization.

[0132] After the monitoring function of the bus monitoring module is enabled through the second enable instruction, the main processor jumps from the BL1 stage to the BL33 stage and obtains the initialization operation sequence required for the initialization of the main processor.

[0133] In an alternative embodiment, before jumping to the BL33 stage, the main processor first obtains the signature verification result of the BL33 firmware. If the signature verification of the BL33 firmware is successful, the storage address of the BL33 firmware is obtained, and the storage address is accessed to execute the BL33 firmware, that is, to jump from the BL1 stage to the BL33 stage. On the contrary, if the signature verification of the BL33 firmware fails, the current startup process is exited.

[0134] As described above, the BL33 firmware includes the firmware running in the non-secure domain, while the BL1 firmware runs in the secure domain. Therefore, the process of obtaining the configuration information related to the initialization and normal operation of the main processor in the BL33 stage and transmitting the obtained configuration information to the BL1 firmware can be completed through the SMC (Secure Monitor Call) instruction. SMC is a hardware-based security mechanism used to protect the security of the system. Through the SMC instruction, access control of sensitive hardware resources, that is, resources in the secure domain, can be achieved. In practical applications, information interaction between the secure domain and the non-secure domain can be realized through the execution of SMC. Based on this, in the BL33 stage, the main processor can obtain the foregoing initialization operation sequence based on the SMC instruction. As for the specific implementation of this process, reference can be made to the related technology and will not be elaborated here.

[0135] It should be noted that since the BL33 firmware belongs to the non-secure domain firmware and the BL1 firmware belongs to the secure domain firmware, obtaining the initialization operation sequence in the BL33 stage requires information interaction with the applications in the non-secure domain, exposing the BL1 firmware to the non-secure domain. This is the only opportunity in the startup method provided by this application to expose the secure domain firmware to the non-secure domain application firmware.

[0136] It should also be noted that, as can be seen from Figure 3 shown, while the main processor obtains the initialization operation sequence in the BL33 stage, the bus monitoring module is recording the bus information transmitted in the on-chip network during this process, that is, recording the initialization operation sequence. That is to say, S204, S205, S206 and subsequent S207 occur synchronously. This embodiment is introduced in a certain order mainly to more clearly explain the execution process of this method, rather than a strict limitation on the execution order of the foregoing steps.

[0137] S207. The main processor jumps back to the BL1 stage and generates a de-enable instruction.

[0138] After the execution of the BL33 stage ends, the main processor jumps back from the BL33 stage to the BL1 stage. In the BL1 stage, a disabling instruction is generated and sent to the bus monitoring module. The bus monitoring module is triggered to stop monitoring bus information through the disabling instruction. As for the specific form and sending method of the disabling instruction, they can be implemented with reference to related technologies, and this application does not make specific limitations in this regard.

[0139] S208. The bus monitoring module responds to the disabling instruction and ends the monitoring.

[0140] The bus monitoring module responds to the disabling instruction provided by the main processor and ends the monitoring of the on-chip network. So far, the bus monitoring module has completed the monitoring and storage operations of the initialization operation sequence during the first startup process of the on-chip system. During the subsequent startup process of the on-chip system, the obtained initialization operation sequence can be directly used to initialize the main processor. The specific process will be elaborated in the subsequent steps and will not be detailed here for the time being.

[0141] S209. The main processor verifies the signature of the BL2 firmware in the BL1 stage.

[0142] After S207, the main processor has jumped back from the BL33 stage to the BL1 stage and completed the initialization operation for the first startup of the on-chip system. After that, according to the preset execution order among the startup firmwares of the main processor, the next startup firmware after the initialization is completed needs to be further executed.

[0143] In an alternative implementation, the next startup firmware after the main processor executes the initialization operation is the BL2 firmware. In this case, to ensure system security, the main processor first calls the signature verification program of the BL2 firmware to verify the signature of the BL2 firmware through this program.

[0144] S210. If the signature verification of the BL2 firmware is successful, the main processor jumps to the BL2 stage.

[0145] If the signature verification of the BL2 firmware is successful and the BL2 firmware is determined to be secure and trustworthy, the main processor jumps from the BL1 stage to the BL2 stage. So far, the storage process of the initialization operation sequence in the case of the first startup of the on-chip system has been clarified. The execution process when entering the BL2 stage and other startup firmwares will be elaborated in the subsequent content and will not be detailed here for the time being.

[0146] S211. The main processor generates a first enabling instruction.

[0147] In the case where it is determined in S202 that the on-chip system is not starting up for the first time, this step and subsequent related steps are executed.

[0148] As described above, the initialization operation sequence has been stored during the first startup process of the system-on-chip. When it is determined that the system-on-chip is not starting for the first time, the pre-stored initialization operation sequence can be actually used to initialize the main processor. Based on this, the main processor sends a first enable instruction to the bus monitoring module, and triggers the bus monitoring module to initialize the main processor based on the pre-stored initialization operation sequence through the first enable instruction.

[0149] S212. The bus monitoring module responds to the first enable instruction and initializes the main processor based on the pre-stored initial operation sequence.

[0150] In an alternative embodiment, the specific implementation of S212 can refer to Figure 2 the relevant content of S100 in the illustrated embodiment, which will not be repeated here.

[0151] S213. The bus monitoring module configures the first startup address of the main processor.

[0152] In an alternative embodiment, the specific implementation of S213 can refer to Figure 2 the relevant content of S110 in the illustrated embodiment, which will not be repeated here.

[0153] It should be noted that in an alternative embodiment, after the BL1 firmware, the startup firmware that the main processor needs to further execute is the BL2 firmware. Therefore, the first startup address mentioned in this embodiment includes the storage address of the BL2 firmware.

[0154] S214. The bus monitoring module sends the first startup address.

[0155] In an alternative embodiment, the specific implementation of S214 can refer to Figure 2 the relevant content of S120 in the illustrated embodiment, which will not be repeated here.

[0156] S215. The main processor obtains the first startup address and executes the BL2 firmware according to the first startup address, entering the BL2 stage.

[0157] As described above, when the first startup address is the storage address of the BL2 firmware, the main processor executes the BL2 firmware according to the first startup address and enters the BL2 stage. The startup process after entering the BL2 stage will be elaborated in the subsequent content and will not be described in detail here.

[0158] In summary, by integrating a bus monitoring module in the system on a chip, the present application only needs to jump from the BL1 stage to the BL33 stage during the first startup of the system on a chip to obtain the initialization operation sequence, and the bus monitoring module records the initialization operation sequence transmitted during this process. During subsequent startups after the first startup, the bus monitoring module initializes the processor based on the pre-stored initialization operation sequence. Since there is only one chance to interact with the non-secure domain, this method has at most only one risk of exposing the BL firmware, that is, there is one exposure risk during the first startup process. Compared with the prior art where there is an exposure risk every time it starts up, this method can greatly improve the security and reliability of the processor startup process.

[0159] In the case where the bus monitoring module verifies the signature of the startup firmware, the startup method provided by the present application may include the following steps as shown Figure 4 below.

[0160] S300. The bus monitoring module determines whether the system on a chip is starting up for the first time. If so, execute S301; if not, execute S312.

[0161] In this embodiment, the bus monitoring module verifies the signature of the relevant startup firmware. Based on this, when the bus monitoring module initializes the main processor based on the pre-stored initialization operation sequence, it first determines whether the system on a chip is starting up for the first time. If it is the first startup, then execute S301 and subsequent related steps, and record the initialization operation sequence during the startup process, including initialization-related configuration information and initialization instructions, for use during subsequent startup processes. On the contrary, if it is not the first startup, then execute S312, skip the BL1 stage and the BL33 stage, and directly enter the BL2 stage.

[0162] In an alternative embodiment, a status register is further configured in the system on a chip, and the status register records whether the system on a chip is starting up for the first time. For example, the first value, such as 0, represents that the system on a chip is starting up for the first time. Correspondingly, the second value, such as 1, represents that the system on a chip is not starting up for the first time. Based on this, the bus monitoring module accesses the status register. If the current value of the status register is the first value, it is determined that the system on a chip is starting up for the first time. On the contrary, if the current value of the status register is the second value, it is determined that the system on a chip is not starting up for the first time.

[0163] The wake-up process of the bus monitoring module itself can also include various implementation methods. In an alternative implementation, the power policy unit is integrated within the bus monitoring module. After the power policy unit is started, power is supplied to the bus monitoring module preferentially, and the bus monitoring module is released from reset prior to the system manager, that is, it completes startup prior to the system manager. In another alternative implementation, the power policy unit is integrated within the system controller. After the power policy unit is started, power is supplied to the system controller preferentially. The system controller is released from reset prior to the bus monitoring module. After the system controller completes startup, it further supplies power to the bus monitoring module to drive the bus monitoring module to be released from reset, completing the startup of the bus monitoring module. Of course, the bus monitoring module can also be woken up in other ways during the startup process of the system-on-chip, which will not be elaborated here one by one.

[0164] S301. The bus monitoring module verifies the signature of the BL1 firmware of the main processor.

[0165] In the case of determining that the system-on-chip starts for the first time, the bus monitoring module calls the signature verification program corresponding to the BL1 firmware to verify the signature of the BL1 firmware. As for the specific process of signature verification, reference can be made to related technologies. This application does not limit the specific implementation of the signature verification program and the specific process of verifying the signature of the BL1 firmware through the signature verification program.

[0166] In an alternative implementation, the system-on-chip is configured with a flag register. Each startup firmware related to the startup process of the main processor corresponds to a flag register. The signature verification result of the corresponding startup firmware is recorded through the flag register. Based on this, if the signature verification of the BL1 firmware is successful, a first value indicating successful signature verification, such as 1, is written into the flag register corresponding to the BL1 firmware. On the contrary, if the signature verification of the BL1 firmware fails, a second value indicating failed signature verification, such as 0, is written into the flag register corresponding to the BL1 firmware.

[0167] S302. If the signature verification of the BL1 firmware is successful, the bus monitoring module wakes up the main processor.

[0168] In the case of successful signature verification of the BL1 firmware, the bus monitoring module wakes up the main processor. In an alternative implementation, the bus monitoring module sends a wake-up instruction to the main processor to wake up the main processor through the wake-up instruction. In this implementation, any instruction form that can wake up the main processor is optional, and within the scope not exceeding the core idea of this application, it also belongs to the scope protected by this application.

[0169] In another alternative implementation, the system controller for implementing the power management of the system-on-chip also starts prior to the main processor. The bus monitoring module sends a wake-up instruction to the system controller. In response to the obtained wake-up instruction, the system controller controls the main processor to power on, thereby waking up the main processor.

[0170] Based on the foregoing embodiments, in another alternative embodiment, when the system controller is in an operating state (i.e., has been awakened), the bus monitoring module can directly send a second startup address to the system controller. The second startup address is the storage address of the BL1 firmware and the storage address of the first instruction in the BL1 firmware. After obtaining the second startup address, the system controller sends a startup instruction carrying the second startup address to the main processor, wakes up the main processor through the startup instruction, and executes the BL1 firmware according to the second startup address.

[0171] S303. After being awakened, the main processor obtains the second startup address.

[0172] After being awakened, the main processor first enters the BL1 stage according to the preset startup firmware loading process. Based on this, the system controller also sends a startup instruction to the main processor. The startup instruction carries the storage address of the first instruction executed by the main processor in the BL1 stage, that is, the second startup address. After being awakened, the main processor can obtain the startup instruction through the on-chip network, and can obtain the second startup address by parsing the obtained startup instruction.

[0173] S304. The main processor enters the BL1 stage according to the second startup address.

[0174] The main processor executes the instructions of the BL1 firmware according to the second startup address, that is, enters the BL1 stage. As for the specific execution process of the main processor entering the BL1 stage based on the second startup address, it can be implemented with reference to the related technology and will not be elaborated here.

[0175] S305. The main processor jumps from the BL1 stage to the BL33 stage and obtains the initialization operation sequence required for initialization in the BL33 stage.

[0176] The main processor obtains the signature verification result of the BL33 firmware in the BL1 stage. If the signature verification result of BL33 indicates that the BL33 firmware signature verification is successful, the main processor directly adjusts from the BL1 stage to the BL33 stage. On the contrary, if the signature verification result of BL33 indicates that the BL33 firmware signature verification fails, the current startup process is exited.

[0177] In an alternative embodiment, the bus monitoring module performs signature verification on the BL33 firmware. The bus monitoring module calls the signature verification program corresponding to the BL33 firmware, verifies the BL33 firmware through the obtained signature verification program, and further stores the signature verification result of the BL33 firmware in the flag register corresponding to the BL33 firmware. The main processor can obtain the signature verification result of the BL33 firmware by accessing the flag register corresponding to the BL33 firmware.

[0178] Further, after the BL33 firmware signature verification is successful and the jump from the BL1 stage to the BL33 stage is completed, the main processor obtains the initialization operation sequence required for initialization in the BL33 stage. As mentioned above, the BL33 firmware includes the firmware running in the non-secure domain. Therefore, the process of obtaining the configuration information related to the initialization and normal operation of the main processor in the BL33 stage can be completed through the SMC (Secure Monitor Call) instruction. As for the specific implementation of this process, reference can be made to the related technology and will not be elaborated here.

[0179] It should be noted that since the BL33 firmware belongs to the non-secure domain firmware, obtaining the initialization operation sequence in the BL33 stage requires information interaction with the applications in the non-secure domain, exposing the BL1 firmware to the non-secure domain. This is the only opportunity for the startup method provided in this application to expose the secure domain firmware to the non-secure domain application firmware.

[0180] S306. The main processor sends the initialization operation sequence to the bus monitoring module.

[0181] It should be emphasized that in the related technology, in the BL33 stage, the BL33 firmware and the BL1 firmware interact with the initialization operation sequence through the SMC instruction, and the BL1 firmware parses the initialization configuration information in the initialization operation sequence. That is to say, the BL1 firmware can accurately obtain the configuration information of the user during the application of the system-on-chip. Obviously, these configuration information are crucial for the user and cannot be open-sourced in actual applications, that is, cannot be known by a third party other than the user.

[0182] Different from the prior art, in the startup method provided in this embodiment, the BL33 firmware directly feeds back the obtained initialization operation sequence to the bus monitoring module, and the initialization operation sequence is invisible to the BL1 firmware. Therefore, the initialization operation sequence will not be recorded in the entire system firmware. This step is also one of the key technical features that distinguish this embodiment from the related technology and the startup methods provided in the foregoing embodiments.

[0183] S307. The bus monitoring module obtains the initialization operation sequence provided by the main processor in the BL33 stage and initializes the main processor based on the initialization operation sequence.

[0184] In response to the initialization operation sequence provided by the main processor, the bus monitoring module starts the monitoring function, obtains and stores the initialization operation sequence provided by the main processor in the BL33 stage. It can be understood that, as a preferred implementation manner, the bus monitoring module stores the obtained initialization operation sequence in the Figure 1 secure memory shown to ensure the security of the initialization operation sequence.

[0185] Furthermore, in this embodiment, since the initialization operation sequence is not provided to the BL1 firmware but directly sent to the bus monitoring module, the initialization operation of the main processor during the first startup of the system-on-chip is also completed by the bus monitoring module. In practical applications, the bus monitoring module uses the configured data recurrence function to recur the obtained initialization operation sequence to the main processor through the on-chip network to complete the initialization operation of the main processor. As for the specific implementation process of initializing the main processor based on the initialization operation sequence, it can be implemented with reference to related technologies, and this application does not make specific limitations on this.

[0186] S308. The main processor jumps back to the BL1 stage and generates a disable instruction.

[0187] After the acquisition and transmission of the initialization operation sequence are completed in the BL33 stage, the main processor jumps back from the BL33 stage to the BL1 stage.

[0188] After returning to the BL1 stage, the main processor sends a disable instruction to the bus monitoring module.

[0189] S309. The bus monitoring module responds to the disable instruction and ends the monitoring.

[0190] In an alternative embodiment, the specific implementation of S309 can refer to Figure 3 the relevant content of S208 in the illustrated embodiment, which will not be repeated here.

[0191] As an alternative embodiment, the next startup firmware executed by the main processor after completing the initialization operation is the BL2 firmware. In this case, to ensure system security, the bus monitoring module first calls the signature verification program of the BL2 firmware to verify the signature of the BL2 firmware through this signature verification program.

[0192] S310. The main processor obtains the signature verification result of the BL2 firmware.

[0193] The main processor obtains the signature verification result of the BL2 firmware, and the specific obtaining method can refer to the relevant content of the foregoing embodiment, which will not be repeated here.

[0194] S311. If the signature verification of the BL2 firmware is successful, the main processor jumps to the BL2 stage.

[0195] If the signature verification of the BL2 firmware is successful and it is determined that the BL2 firmware is secure and trustworthy, the main processor jumps from the BL1 stage to the BL2 stage. Thus, the storage process of the initialization operation sequence in the case of the first startup of the system-on-chip has been clarified. The execution process of entering the BL2 stage and other startup firmwares will be elaborated in the subsequent content and will not be detailed here for the time being.

[0196] S312. The bus monitoring module initializes the main processor based on the pre-stored initialization operation sequence.

[0197] When it is determined in S300 that the system-on-chip is not starting for the first time, this step and subsequent related steps are executed.

[0198] As mentioned above, the initialization operation sequence has been stored during the first startup process of the system-on-chip. When it is determined that the system-on-chip is not starting for the first time, the pre-stored initialization operation sequence can be actually used to initialize the main processor. Based on this, the bus monitoring module calls the initialization operation sequence stored in the secure memory through the data recurrence function, and sends the initialization operation sequence to the main processor through the system-on-chip to complete the initialization of the main processor. For other implementation processes not elaborated in detail, reference can be made to Figure 2 the relevant content of S100 in the illustrated embodiment, which will not be repeated here.

[0199] S313. The bus monitoring module configures the first startup address of the main processor.

[0200] In an optional implementation manner, the specific implementation of S313 can refer to Figure 2 the relevant content of S110 in the illustrated embodiment, which will not be repeated here.

[0201] It should be noted that in an optional implementation manner, after the BL1 firmware, the startup firmware that the main processor needs to further execute is the BL2 firmware. Therefore, the first startup address mentioned in this embodiment includes the storage address of the BL2 firmware.

[0202] S314. The bus monitoring module sends the first startup address to the main processor.

[0203] In an optional implementation manner, the specific implementation of S314 can refer to Figure 2 the relevant content of S120 in the illustrated embodiment, which will not be repeated here.

[0204] S315. The main processor obtains the first startup address and executes the BL2 firmware according to the first startup address to enter the BL2 stage.

[0205] As mentioned above, when the first startup address is the storage address of the BL2 firmware, the main processor executes the BL2 firmware according to the first startup address to enter the BL2 stage. The startup process after entering the BL2 stage will be elaborated in detail in the subsequent content and will not be elaborated here for the time being.

[0206] In summary, through the startup method provided in this embodiment, a bus monitoring module is integrated in the system-on-chip. Only when the system is started for the first time, it is necessary to switch from the BL1 stage to the BL33 stage to obtain the initialization operation sequence. The bus monitoring module stores the obtained initialization operation sequence and completes the initialization of the main processor during the first startup. During subsequent startup processes after the first startup, the pre-stored initialization operation sequence is provided by the bus monitoring module. Since there is only interaction with the non-secure domain during the first startup of the system-on-chip, therefore, this method will have at most only one risk of exposing the BL1 firmware. Compared with the prior art where there is a risk of exposure every time the system starts, this method can greatly improve the security and reliability of the processor startup process.

[0207] Furthermore, based on the above execution process, it can be seen that during the system startup process, the initialization operation sequence obtained in the BL33 stage is directly fed back to the bus monitoring module and stored by the bus monitoring module. The startup firmware of the system will not record the initialization operation sequence. The BL1 stage will not be responsible for the initialization of the main processor, and there will be fewer special tasks originally undertaken by the startup firmware and less information exposed. Therefore, the startup firmware can be open-sourced.

[0208] Furthermore, Figure 3 as shown in the Figure 4 embodiment and Figure 3 the execution process of the Figure 4 embodiment, it can be seen that for the startup method provided in the

[0209] embodiment, the bus monitoring module has less work content. Compared with the startup methods in related technologies, the changes are smaller and it is easier to implement. While for the startup method provided in the Figure 4 embodiment, the bus monitoring module has more work content, which is not conducive to troubleshooting and analysis in actual applications. However, due to its higher security, the startup firmware of the main processor can be open-sourced to ecological users, which is conducive to the establishment of the chip ecosystem and the promotion of the chip.

[0209] For the startup method provided in any of the above embodiments, the main processor only executes up to the BL2 stage. According to the startup firmware that the main processor needs to execute as stipulated in related technologies, the startup method provided in any of the above embodiments may further include Figure 5 the following steps executed by the main processor as shown in

[0210] S400. Determine whether the main processor is initialized successfully. If so, execute S401; if not, execute S408.

[0211] After the main processor enters the BL2 stage, it determines whether the main processor is initialized successfully. If the initialization is successful, then execute S401; on the contrary, if the initialization fails, then execute S408.

[0212] In an alternative embodiment, the initialization process of the main processor configures some functional units, registers, and system parameters of the main processor. Based on this, it is possible to determine whether the main processor is successfully initialized based on the configuration status of the main processor. Of course, it is also possible to determine whether the initialization is successful through other means, which will not be elaborated here one by one. For details, reference can be made to the related technologies.

[0213] In another alternative embodiment, after the main processor determines that the initialization is successful, it writes a first value indicating successful initialization to the aforementioned status register. Correspondingly, after determining that the initialization fails, it can also write a second value indicating failed initialization to the status register. With such a setting, referring to the relevant content of the foregoing embodiment, during the subsequent startup process after the first startup, the main processor or the bus monitoring module can directly determine whether the system-on-chip is starting up for the first time by accessing the status register.

[0214] S401. In the BL2 stage, wake up each coprocessor configured by the system-on-chip.

[0215] On the premise that the initialization of the main processor is successful, the main processor wakes up each coprocessor configured by the system-on-chip in sequence during the BL2 stage, such as the input / output processor, peripheral controller, etc.

[0216] Taking the input / output processor as an example, the main processor first obtains the signature verification result of the relevant firmware of the input / output processor. If all the relevant firmware passes the signature verification, the main processor further wakes up the input / output processor. If the signature verification of the relevant firmware fails, the input / output processor is skipped, and the signature verification results of other coprocessors are continued to be obtained. This process is repeated until all coprocessors are traversed. As for the specific implementation process of the main processor to wake up any coprocessor, reference can be made to the related technologies, which will not be elaborated here.

[0217] S402. Determine whether the BL31 firmware passes the signature verification. If so, execute S403; if not, execute S408.

[0218] After the main processor wakes up each coprocessor, it obtains the signature verification result of the BL31 firmware during the BL2 stage. If the BL31 firmware passes the signature verification, then execute S403. On the contrary, if the BL31 firmware fails the signature verification, then execute S408.

[0219] S403. Jump to the BL31 stage.

[0220] In the case where the BL31 firmware passes the signature verification, the main processor jumps from the BL2 stage to the BL31 stage and executes the BL31 firmware.

[0221] S404. Determine whether the BL32 firmware passes the signature verification. If so, execute S405; if not, execute S408.

[0222] In the BL31 stage, the main processor obtains the signature verification result of the BL32 firmware. If the signature verification of the BL32 firmware is successful, S405 is executed. On the contrary, if the signature verification of the BL32 firmware fails, S408 is executed.

[0223] S405: Jump to the BL32 stage.

[0224] When the signature verification of the BL32 firmware is successful, the main processor jumps from the BL31 stage to the BL32 stage and executes the BL32 firmware.

[0225] S406: Determine whether the signature verification of the BL33 firmware is successful. If so, S407 is executed. If not, S408 is executed.

[0226] In the BL32 stage, the main processor obtains the signature verification result of the BL33 firmware. If the signature verification of the BL33 firmware is successful, S407 is executed. On the contrary, if the signature verification of the BL33 firmware fails, S408 is executed.

[0227] In an alternative embodiment, if it is the first startup of the system-on-chip, the BL33 firmware has been signature-verified during the initialization of the main processor. In this case, this step can be omitted, that is, directly jump to the BL33 stage after completing the BL32 stage.

[0228] S407: Jump to the BL33 stage until the operating system starts.

[0229] When the signature verification of the BL33 firmware is successful, jump to the BL33 stage, execute the BL33 firmware, and finally complete the startup of the operating system running on the main processor in the BL33 stage. This process can be implemented with reference to the related technology and will not be elaborated here.

[0230] S408: Exit the current startup process.

[0231] Combined with Figure 5 As shown, in the case where the signature verification of any of the foregoing startup firmwares fails and the initialization of the main processor fails, S408 is jumped to, and the current startup process is exited. When the system-on-chip is started next time, the system-on-chip is started again according to the startup method provided in this application.

[0232] It should be noted that Figure 5 For obtaining the signature verification results of each firmware involved in the embodiments shown, reference can be made to the relevant content in the foregoing embodiments, and this embodiment will not be repeated one by one.

[0233] It can be understood that the startup method provided in any of the foregoing Figures 2 to 4 embodiments can be combined with Figure 5Combined with the startup method shown, the complete startup process of the system-on-chip is thus achieved.

[0234] Furthermore, the present application also provides a main processor, which is configured to execute the steps executed by the main processor in the startup method provided in any of the foregoing embodiments of the present application.

[0235] The present application also provides a bus monitoring module, which is configured to execute the steps executed by the bus monitoring module in the startup method provided in any of the foregoing embodiments of the present application.

[0236] See Figure 6 As shown, the bus monitoring module provided by the present application may include: a preprocessing unit 501, a general data processing unit 502, a dedicated data processing unit 503, a transmission unit 504, and a data recurrence unit 505.

[0237] Specifically, the input end of the preprocessing unit 501 is connected to the on-chip network 10 to obtain the bus signal transmitted by the on-chip network 10. The first output end of the preprocessing unit 501 is connected to the general data processing unit 502, and the second output end is connected to the dedicated data processing unit 503. After obtaining the bus signal, the preprocessing unit 501 converts the bus signal into bus data. Further, the preprocessing unit 501 will also provide an enable signal when the obtained bus data meets the preset dedicated data screening condition to trigger the operation of the dedicated data processing unit 503. Further, in combination with the startup method provided in the foregoing embodiments, the activation of the monitoring function of the bus monitoring module is controlled by the main processor. Based on this, as an optional implementation manner, the foregoing second enable instruction and disable instruction may be responded to by the preprocessing unit 501, that is, in response to the second enable instruction, the monitoring function is activated to obtain bus data, or in response to the disable instruction, the acquisition of bus data is stopped, that is, the monitoring is stopped.

[0238] The general data processing unit 502 receives the bus data provided by the preprocessing unit 501 and extracts the target general data in the bus data according to the preset general data screening condition; the dedicated data processing unit 503 responds to the enable signal provided by the preprocessing unit 501 and obtains the target dedicated data according to the preset dedicated data screening condition.

[0239] In an optional implementation manner, the preset general data screening condition may be set based on transaction characteristics, and the transaction characteristics used to set the preset general data screening condition may include at least one of the address of the bus request, the identification identifier of the bus request, the data content in the bus information, and the response content of the bus request.

[0240] Compared with the target general data, the target specific data has stronger pertinence. It can be the data of a certain specified functional unit under the operation of the system on a chip. For example, when it is necessary to analyze or handle errors in the operation state of a peripheral controller, the target specific data mainly refers to the data related to the operation process of the peripheral controller. Of course, it can also be the preset instruction sequence mentioned in the foregoing content of this application.

[0241] As can be seen from the foregoing content, the target specific data can come from a certain specific target functional unit. Since the target functional unit also transmits data through the bus, the obtained bus data may also include the target specific data. Based on this, in an optional implementation manner, the dedicated data processing unit 503 can extract the target specific data from the bus data according to the preset dedicated data screening conditions.

[0242] It should be noted that when the bus monitoring module is applied to the startup method provided in this application, the foregoing initialization operation sequence can be stored as target specific data or as target general data, and can be selected in combination with actual requirements in actual applications. This application does not make specific limitations in this comparison.

[0243] The dedicated data channel of the transmission unit 504 is connected to the dedicated data processing unit 503, and the general data channel is connected to the general data processing unit 502. The output end of the transmission unit 504 is connected to the on-chip network 10. The transmission unit 504 is used to store the target general data and the target specific data into the secure memory 70, that is, to store the initialization operation sequence into the secure memory 70.

[0244] It should be noted that in Figure 6 In the illustrated embodiment, the secure memory 70 is an external memory connected to the bus, and the transmission unit 504 stores the target general data and the target specific data into the external memory through the on-chip network 10. In another optional implementation manner, an internal memory can also be provided inside the bus monitoring module. In this case, the transmission unit 504 can directly store the target general data and the target specific data into the internal memory without passing through the on-chip network 10.

[0245] The input and output ends of the data recurrence unit 505 are respectively connected to the on-chip network 10. According to the relevant content of the startup method provided in the foregoing embodiment, after determining that the on-chip system is not starting for the first time, the data recurrence unit 505 accesses the secure memory 70 to obtain the initialization operation sequence recorded and stored during the first startup process of the on-chip system, and further according to the startup method provided in the foregoing embodiment, sends the initialization operation sequence to the main processor through the on-chip network to complete the initialization of the main processor, so that the on-chip system does not need to go through the BL1 stage and the BL33 stage during non-first startup, improving the system security. As an alternative implementation, the first enable instruction mentioned in the startup method provided in the foregoing embodiment can be responded to by the data recurrence unit 505, that is, when the first enable instruction is received, the initialization operation sequence is recurrently sent to the main processor through the on-chip network.

[0246] It can be understood that since the recurrent data comes from the target general data and / or the target specific data, the data recurrence process must occur after the transmission unit 50 stores the target general data and the target specific data in the secure memory 70. Therefore, in practical applications, it is necessary to combine the storage status of the target specific data and the target general data to ensure that the data recurrence unit 505 can successfully extract the recurrent data from the memory.

[0247] Furthermore, the present application also provides an electronic device, including the on-chip system provided in any one of the foregoing embodiments of the present application.

[0248] In some embodiments, the present embodiment also provides a computer-readable storage medium, such as a floppy disk, an optical disk, a hard disk, a flash memory, a USB flash drive, an SD (Secure Digital Memory Card) card, an MMC (Multimedia Card) card, etc. One or more instructions for implementing the above steps are stored in the computer-readable storage medium. When the one or more instructions are executed by one or more processors, the processor executes the startup method described above. For the relevant specific implementation, please refer to the foregoing description and will not be elaborated here.

[0249] In addition to the above methods and devices, the embodiments of the present application can also be a computer program product, which includes computer program instructions. When the computer program instructions are run by a processor, the processor executes the steps in the startup methods according to various embodiments of the present application described in the above content of this specification.

[0250] A computer program product may be written in any combination of one or more programming languages to write program code for performing the operations of the embodiments of the present application. The programming languages include object-oriented programming languages such as Java, C++, etc., and also include conventional procedural programming languages such as the "C" language or similar programming languages. The program code may be executed entirely on the user's computing device, partially on the user's device, executed as a stand-alone software package, partially on the user's computing device and partially on a remote computing device, or entirely on a remote computing device or server.

[0251] Those skilled in the art can understand that the content disclosed in the present disclosure may have various variations and improvements. For example, the various devices or components described above may be implemented by hardware, or may be implemented by software, firmware, or some or all of the combinations of the three.

[0252] In addition, although the present disclosure makes various references to certain units in the systems according to the embodiments of the present disclosure, however, any number of different units may be used and run on the client and / or server. The units are only illustrative, and different aspects of the system and method may use different units.

[0253] Flowcharts are used in the present disclosure to illustrate the steps of the methods according to the embodiments of the present disclosure. It should be understood that the steps before or after do not necessarily have to be carried out precisely in order. On the contrary, they can be carried out in reverse order or various steps can be processed simultaneously. At the same time, other operations can also be added to these processes.

[0254] Those of ordinary skill in the art can understand that all or part of the steps in the above methods can be completed by instructing relevant hardware through a computer program, and the program can be stored in a computer-readable storage medium such as a read-only memory, etc. Optionally, all or part of the steps of the above embodiments can also be implemented using one or more integrated circuits. Accordingly, the various modules / units in the above embodiments can be implemented in the form of hardware or in the form of software function modules. The present disclosure is not limited to any specific form of the combination of hardware and software.

[0255] Unless otherwise defined, all terms used herein have the same meaning as commonly understood by those of ordinary skill in the art to which the present disclosure belongs. It should also be understood that terms such as those defined in a common dictionary should be interpreted as having a meaning consistent with their meaning in the context of the relevant art, and should not be interpreted in an idealized or overly formal sense unless expressly so defined herein.

[0256] The foregoing is a description of the present disclosure and should not be construed as a limitation thereof. Although several exemplary embodiments of the present disclosure have been described, those skilled in the art will readily appreciate that many modifications can be made to the exemplary embodiments without departing from the novel teachings and advantages of the present disclosure. Accordingly, all such modifications are intended to be included within the scope of the present disclosure as defined by the claims. It should be understood that the foregoing is a description of the present disclosure and should not be considered limited to the particular embodiments disclosed, and modifications to the disclosed embodiments as well as other embodiments are intended to be included within the scope of the appended claims. The present disclosure is defined by the claims and their equivalents.

Claims

1. A startup method, characterized in that: Applied to a system on chip, the system on chip includes a main processor and a bus snooping module, and the method includes the following steps performed by the bus snooping module: Initializing the main processor based on a pre-stored initialization operation sequence, the initialization operation sequence including configuration information and initialization instructions obtained during the first execution of BL1 firmware and BL33 firmware by the main processor; Configuring a first boot address of the main processor, wherein the first boot address includes a storage address of a target boot firmware to be executed after the main processor is initialized; The first boot address is sent to the main processor, so that the main processor executes the target boot firmware according to the first boot address.

2. The startup method according to claim 1, characterized in that: Initializing the main processor based on a pre-stored initialization operation sequence, comprising: Obtaining a first enabling instruction, where the first enabling instruction is output by the main processor after determining that the system on chip is not started for the first time; In response to the first enable instruction, the main processor is initialized based on a pre-stored initialization operation sequence.

3. The startup method according to claim 2, characterized in that: The method further comprises: Obtaining a second enabling instruction, where the second enabling instruction is output by the main processor after determining that the system on chip is started for the first time; In response to the second enabling instruction, the configuration information and initialization instructions transmitted by the main processor during the execution of the BL1 firmware and the BL33 firmware are recorded.

4. The startup method according to claim 1, characterized in that: Initializing the main processor based on a pre-stored initialization operation sequence, comprising: Determining whether the system on chip is started for the first time; If the system on chip is not started for the first time, the main processor is initialized based on a pre-stored initialization operation sequence.

5. The startup method according to claim 4, characterized in that: The method further comprises: When the system on chip is started for the first time, verifying the signature of the BL1 firmware of the main processor; If the BL1 firmware verification is successful, the main processor is awakened so that the main processor jumps to the BL33 stage after entering the BL1 stage; An initialization operation sequence provided by the main processor in the BL33 stage is obtained, and the main processor is initialized based on the initialization operation sequence.

6. The startup method according to claim 5, characterized in that: The system on chip also includes a system controller; Waking up the main processor, comprising: The second boot address is sent to the system controller, so that the system controller outputs a boot instruction including the second boot address, wherein the boot instruction is used to instruct the main processor to execute the BL1 firmware according to the second boot address.

7. The startup method according to claim 1, characterized in that: Configuring a first boot address of the main processor includes: Obtaining the signature verification result of the target boot firmware; If the signature verification result indicates that the signature verification of the target boot firmware is successful, configuring the storage address of the target boot firmware; The storage address of the target boot firmware is determined to be the first boot address of the main processor.

8. The startup method according to claim 7, characterized in that: The target boot firmware includes BL2 firmware; Obtain the signature verification result of the target boot firmware, including: The BL2 firmware is signature verified to obtain a signature verification result of the BL2 firmware.

9. A startup method, characterized in that: Applied to a system on chip, the system on chip includes a main processor and a bus monitoring module, and the method includes the following steps performed by the main processor: Get the first startup address; The first boot address is configured by the bus monitoring module after initializing the main processor based on a pre-stored initialization operation sequence, wherein the initialization operation sequence includes configuration information and initialization instructions obtained during the first execution of BL1 firmware and BL33 firmware by the main processor; The target startup firmware required to be executed after the main processor is initialized is executed according to the first startup address.

10. The startup method according to claim 9, characterized in that: Also includes: After being awakened, obtaining a second boot address, where the second boot address includes a storage address of the BL1 firmware; Entering the BL1 stage according to the second boot address, and determining in the BL1 stage whether the system on chip is started for the first time; If the system on chip is not started for the first time, a first enabling instruction is generated, where the first enabling instruction is used to trigger the bus monitoring module to initialize the main processor based on a pre-stored initialization operation sequence.

11. The startup method according to claim 10, characterized in that: Also includes: If the system on chip is started for the first time, a second enabling instruction is generated, wherein the second enabling instruction is used to trigger the bus monitoring module to monitor bus information to record the initialization operation sequence transmitted by the main processor during the execution of the BL1 firmware and the BL33 firmware; Jump to the BL33 stage to obtain the initialization operation sequence required for initialization; Jump back to the BL1 stage and generate a disable instruction, wherein the disable instruction is used to trigger the bus monitoring module to stop monitoring bus information.

12. The startup method according to claim 11, characterized in that: Also includes: In the BL1 stage, the BL2 firmware is signed; If the BL2 firmware verification is successful, jump to the BL2 stage.

13. The startup method according to claim 9, characterized in that: Also includes: After being awakened, obtaining a second boot address, where the second boot address includes a storage address of the BL1 firmware; Entering the BL1 stage according to the second boot address; Jump from the BL1 stage to the BL33 stage, and obtain the initialization operation sequence required for initialization in the BL33 stage; Sending the initialization operation sequence to the bus monitoring module; Jump back to BL1 stage.

14. The startup method according to claim 13, characterized in that: Also includes: Get the signature verification result of BL2 firmware; If the BL2 firmware verification is successful, jump to the BL2 stage.

15. The startup method according to claim 9, characterized in that: The target boot firmware includes BL2 firmware; Executing the target startup firmware required to be executed after the main processor is initialized according to the first startup address includes: The BL2 firmware is executed according to the first boot address to enter the BL2 stage.

16. The startup method according to any one of claims 12, 14 and 15, characterized in that: Also includes: In the BL2 stage, determining whether the main processor is initialized successfully; If the initialization is successful, waking up each coprocessor configured in the system on chip; After waking up each of the coprocessors, the system jumps to the BL31 stage, the BL32 stage, and the BL33 stage in sequence until the operating system carried by the system on chip is started.

17. A bus monitoring module, characterized in that: The bus monitoring module is configured to execute the startup method according to any one of claims 1 to 8.

18. A main processor, characterized in that: The main processor is configured to execute the startup method according to any one of claims 9 to 16.

19. A system on chip, characterized in that: include: A network on chip, a system controller, a bus snooping module as claimed in claim 17, at least one coprocessor and at least one main processor, wherein: The at least one host processor comprises a host processor as claimed in claim 18; Each of the coprocessor, the main processor, the system controller and the bus monitoring module is connected to the on-chip network respectively.

20. An electronic device, characterized in that: include: The system on chip as claimed in claim 19.

21. A computer-readable storage medium, characterized in that: A computer program is stored, and when the computer program is executed, the startup method according to any one of claims 1 to 8 or claims 9 to 16 is implemented.

Images