Monitoring protection extension system for RISC-V memory sensitive area, monitoring protection method and application

Abstract

The invention discloses a monitoring protection expansion system and a monitoring protection method for an RISC-V memory sensitive area and application. The invention discloses a monitoring protection method for an RISC-V memory sensitive area, and the method achieves the monitoring protection through the configuration of monitoring parameters and the polling scanning of the memory sensitive area, the detection of tampering and the processing of abnormity. Comprising the steps that 1, a kernel calls a monitor configuration instruction to configure monitor state parameters and a monitored area; 2, the processor receives and transmits the configuration parameters to the monitor for processing analysis and verification, if the configuration parameters are legal, the configuration parameters are written into the control state register and the exclusive memory space of the monitor, and otherwise, the monitor is closed; 3, the processor calls a monitor to execute a scanning process according to a set instruction interval when an interval condition is met; step 4, the monitor checks the value and address mapping of the monitored area, and performs processing according to a preset exception processing strategy when an error occurs; 5, after the scanning process is completed, the monitor executes ending emptying state operation, and the system program is returned to execute the main process. The invention further discloses a monitoring protection extension system for implementing the method, and the system has wide application value.

Description

Technical Field

[0001] The present invention relates to the field of computer processor technology, and in particular to an expansion method, system, and application for memory protection based on the RISC-V architecture. Background Art

[0002] With the growing trend of localization, a growing number of open-source technologies and architectures are gaining popularity and being developed by numerous companies and institutions. RISC-V is an indispensable member of this trend. RISC-V is an open-source processor instruction set architecture (ISA). Its low power consumption, customizability, modularity, and scalability have rapidly led to significant academic and commercial success in China. Currently, RISC-V has a vast number of extensions, allowing manufacturers seeking customized functionality to develop new extensions or select existing ones to manufacture chips. Within the software ecosystem, compiler toolchains such as GCC and LLVM, as well as simulators such as QEMU, GEM5, and SPIKE, all support the RISC-V architecture. Many of these software applications rely on open-source support, particularly SPIKE, the official RISC-V simulator. SPIKE not only continuously updates its features as RISC-V continues to evolve, but also makes its codebase publicly available on GitHub for future developers and researchers to reference and use.

[0003] In real-world applications, kernel memory issues frequently occur. These issues not only waste valuable memory resources but can also severely impact program efficiency and even endanger system security. To address these issues, numerous memory protection technologies have emerged, including memory monitoring and protection technology. This technology monitors memory usage in real time, including but not limited to memory utilization, available memory, total memory usage, and memory read and write activity. This allows for timely identification of memory issues and further assistance in resolving them, improving system performance and security. Summary of the Invention

[0004] In response to the frequent occurrence of memory data security issues in current operating system kernels, the present invention provides a monitoring and protection extension system, monitoring and protection method, and application for RISC-V memory sensitive areas. The monitoring extension is developed using the C++ language based on the official RISC-V simulator SPIKE. By adding several necessary control status registers and memory space partitioning layout methods, the system assists the monitor in performing polling monitoring and scanning of the kernel's designated memory space, effectively and timely detecting tampering, recording, and providing solutions, thereby achieving the goal of protecting the designated memory space. In the present invention, the user arranges the designated memory area range and monitor function configuration options into parameter call configuration instructions and sends a configuration request to the monitor. The monitor completes the configuration of the monitor after verifying the parameters and configuring them correctly. After the configuration is completed, the processor determines whether to enter the next round of scanning before each prefetch instruction. If it is confirmed that the scan can be entered, the monitor is called again for the current round of scanning. Then, after completing the pre-scan initialization, the monitor begins to verify the contents of the monitored area. If a verification error is found, an exception is thrown. Otherwise, the scan continues until all monitored areas are scanned. After the final scan is completed, the monitor performs the corresponding finishing actions and returns the execution right to the processor to continue normal program execution.

[0005] The present invention provides a monitoring and protection method for RISC-V memory sensitive areas. The method realizes monitoring and protection by configuring monitoring parameters and performing polling and scanning of memory sensitive areas, detecting tampering and handling exceptions. The method comprises:

[0006] Step 1: The kernel calls the monitor configuration instruction to configure the monitor state parameters and monitored areas;

[0007] Step 2: The processor receives and transmits the configuration parameters to the monitor for processing, analysis and verification. If they are legal, they are written into the control status register; otherwise, the monitor is turned off.

[0008] Step 3: The processor calls the monitor to execute the scanning process according to the set instruction interval when the interval condition is met;

[0009] Step 4: The monitor verifies the value and address mapping of the monitored area and handles errors according to the preset exception handling strategy;

[0010] Step 5: After the scanning process is completed, the monitor performs the final clearing state operation and returns to the system program to execute the main process.

[0011] Specifically,

[0012] In order to accurately implement monitoring and protection, the implementation of the monitoring and protection method of the present invention is divided into two processes: configuration and runtime scanning.

[0013] The configuration process is divided into the following steps:

[0014] Step i: The kernel, as the user, prepares the parameters for the monitored area and monitor configuration and provides them to the processor by calling the monitor configuration instructions. There are two configuration instructions: addmon instruction (monitor area configuration addmon instruction) and monconf instruction (monitor configuration monconf instruction);

[0015] The monconf instruction is used to configure the monitor status register. After receiving the configuration parameters from the kernel (S and higher modes), the instruction parses and adjusts the data according to the specified format and assigns a value to the monitor status register.

[0016] The addmon instruction is used to configure the monitored area. When the instruction is called, the actions performed by the monitor include but are not limited to: recording the values ​​stored in the monitored area, the starting address and its size, the physical address corresponding to each logical address, and recording related content and legitimacy.

[0017] Step ii: After receiving the parameters provided by the configuration instruction, the processor transmits them to the monitor for processing and analysis;

[0018] Step iii: After obtaining the parameters, the monitor parses and verifies the configuration parameters. Only when the parameter configuration is legal and there are no exceptions in the monitor configuration process will the monitor be turned on and a configuration success message will be returned; otherwise, the monitor will remain closed and a configuration failure message will be returned.

[0019] Step iv: After the kernel receives the result returned by calling the command, it can determine whether the configuration is successful and whether the monitoring protection is started. If the configuration fails, the kernel can determine the cause of the failure based on the returned result and adjust the parameters to call the configuration command again and try again.

[0020] In the configuration process of the monitoring and protection method for RISC-V memory sensitive areas described in the present invention, step i includes:

[0021] The configuration instructions including addmon instruction and monconf instruction are called separately, and addmon instruction needs to be called before monconf instruction. addmon instruction is used to configure the monitored areas. The starting address and size of these monitored areas are stored by the kernel in a specified memory space, and then the starting address of this memory space storing the starting address and size is placed in the parameter register; the number of monitored areas is placed in another parameter register, forming the two input parameters required by the addmon instruction, namely the starting address of the memory space storing the starting address and size of the monitored area and the number of monitored areas; monconf instruction is used to configure the monitor status register. The kernel needs to adjust the configuration parameters to the parameter layout status of the monitor status register. The monitor status register layout is as follows: Figure 3 As shown, they are all put into a parameter register as the only input parameter of the monconf instruction; the configuration parameters are the parameters of the monitor configuration, including the monitor startup status, the lowest privilege mode that can access the monitor, the exception occurrence processing mode, the exception return processing mode, the number of instructions between adjacent scans, the exception occurrence count threshold, the privilege mode during configuration, etc.

[0022] In the configuration process of the monitoring and protection method for RISC-V memory sensitive areas described in the present invention, step ii includes:

[0023] After receiving the configuration instruction, the processor will first unlock the monitor in order to proceed to the next configuration action. If an exception occurs during the configuration process without changing the original data, the processor will directly throw an exception when the instruction is executed; if the original data has been modified, the processor will first restore the scene and then return the instruction result of the failed configuration. In addition, regardless of whether the result is successfully returned, the processor needs to re-lock the monitor state to ensure that the monitor is not subject to arbitrary access from the outside world. Even if an exception occurs, it will not be thrown after locking, so even if an exception occurs, it will not affect the security of the monitor. It should also be noted that there are strict mode requirements for calling monitor instructions. The processor can only receive parameters and perform the next step of execution in the lowest privilege mode allowed by the monitor. When the lowest privilege mode accessible to the monitor is set to S mode, both S mode and M mode can access the monitor's configuration; when set to M mode, only M mode can access the monitor's configuration.

[0024] In the configuration process of the monitoring and protection method for RISC-V memory sensitive areas described in the present invention, step iii includes:

[0025] The monitor has different logic for parsing the addmon command and the monconf command.

[0026] The addmon instruction needs to be executed first, and the monitor first obtains the two parameters provided by the addmon instruction. First, it accesses the starting address of the memory space that stores the starting address and size of the monitored area, and then obtains the starting address and size of each monitored area according to the number of monitored areas. After the starting address and size of each monitored area are obtained, on the one hand, each area is accessed and the benign value stored in the area is obtained and filled into the benign benign value area in the monitor's exclusive memory space as a comparison reference value for subsequent scanning. The benign benign value area records the reference data for comparison during the scanning process. The monitor will use the value of this area as a reference to determine whether the content of the monitored area has been tampered with during the scan; on the other hand, each starting address and size are stored in the mapping monitoring address storage area in the monitor's exclusive memory space so that they can be used to find the area to be monitored during scanning. The mapping monitoring address storage area records the starting address and space size of each monitoring space. The monitor scans When scanning, the location to be monitored and scanned will be obtained from the area before starting this round of scanning; on the other hand, when accessing each space to obtain the reference value, the physical address corresponding to each logical address will be recorded and stored in the checkout address verification area in the monitoring-specific memory space. The checkout address verification area records the physical address corresponding to each logical address in the monitored area, which can be used to verify the mapping relationship between the logical address and the physical address at the same time during scanning. During each scan, the monitor must not only check whether the data content of the monitoring space has been tampered with, but also check whether the translated physical address corresponds to the physical address recorded in the area. If the physical address is different, it means that the address mapping of the monitoring space has also been tampered with. After the accessed addresses are correct and the obtained content is correct, the monitor will eventually mark the legal position as one in both the benign value area and the mapping monitoring address storage area; otherwise, if any error occurs in the address access process and / or there is a problem with the content, the legal bits in both areas will be set to zero. In addition, regardless of whether an exception occurs or whether the legal bit is marked as one, the enable bit (i.e., monitor switch) in the corresponding monitor status register will be set to zero to turn off the monitor to prevent the entire system from being abnormal if the originally turned on monitor is scanned according to the wrong memory address and / or wrong value. The final return result is composed of the two legal bits and the result of the configuration is successful only when both legal bits are set to one; otherwise, the configuration failure is returned.

[0027] The monconf instruction must be executed after the addmon instruction. After the monitor receives the configuration parameters from the configuration instruction, it must first access the valid bits in the benign value area and the mapping monitoring address storage area. Only after both valid bits are marked as valid will the next step of parameter parsing be performed. The monitor must split the configuration parameters and parse each section according to the layout pattern of the monitor status register. For example, if the monitor switch in the parameter is off, the configuration can be terminated directly (this is also the only case where the monconf instruction can be executed without the addmon instruction) and a configuration success result will be returned. In addition, if the parameters contain some mode parameters that the monitor does not support or several mutually exclusive modes are matched together, the configuration will fail and a configuration failure result will be returned. After the monitor parsing and configuration process is completed, if the configuration is successful, the monitor will also clear several other related monitor-specific registers (i.e., the monitor instruction interval number register and the monitor watchdog register) to zero for the next scanning process. If the configuration fails, regardless of whether an exception is thrown, the enable bit of the monitor status register will be set to zero to disable the monitor, preventing incorrect scanning from causing more serious consequences.

[0028] In the configuration process of the monitoring and protection method for RISC-V memory sensitive areas described in the present invention, step iv includes:

[0029] Both the addmon instruction and the monconf instruction have an output parameter register (rd register) to provide the result output. The kernel can know the result of the instruction call by reading the value of the rd register. If an exception occurs during the instruction call, the exception thrown by the monitor will also jump to the corresponding handler according to the content indicated by the system's exception vector table to execute the trap process, interrupt the current execution process, and handle the exception. In addition, the kernel can call this instruction multiple times to configure the monitor when needed, that is, it can configure the monitor for the first time to turn on the monitor during initialization, and it can also modify the monitor configuration to meet its own needs when the monitor is turned on (the monitor is not in the execution scanning process state).

[0030] The runtime scanning process is divided into the following steps:

[0031] Step a: The monitor clears the execution status and polls to determine whether the scan has started;

[0032] Step b: When the current scanning condition is met, the processor calls the monitor and transfers the execution right to the monitor. The monitor checks the execution condition and makes preparations before executing the scan.

[0033] Step c: The monitor obtains the actual value from the monitored area and compares it with the reference value to determine whether the content in the monitored area has been tampered with, thereby ensuring the security of the monitored area;

[0034] Step d: After the scanning process is completed, the monitor performs the final clearing state operation and returns to the system program to execute the main process.

[0035] In the scanning process of the monitoring and protection method for RISC-V memory sensitive areas described in the present invention, step a includes:

[0036] When the monitor is enabled, the monitor instruction interval number register is cleared. Before each round of prefetching instructions, the processor first accesses the monitor instruction interval number register to obtain the number of instructions currently executed. At the same time, it obtains the interval instruction number between two adjacent monitor scans stored in the monitor status register and compares the two. If the former is not less than the latter, it means that the current scan condition has been met and the scan can begin; otherwise, the monitor instruction interval number register is incremented normally. In addition, the scanning process must ensure that the interrupt enable is turned on to ensure that the current process is not stuck.

[0037] In the scanning process of the monitoring and protection method for RISC-V memory sensitive areas described in the present invention, step b includes:

[0038] The monitor first resets the lock state to zero, indicating that the current monitor has taken over the system execution. It then obtains the number of monitored areas and the starting address of the benign value area from the monitor's dedicated memory area as auxiliary information for subsequent scans. In addition, the monitor's watchdog register is cleared to record the number of anomalies that occurred during this scan.

[0039] In the scanning process of the monitoring and protection method for RISC-V memory sensitive areas described in the present invention, step c includes:

[0040] The address of the monitored area is obtained from the mapping monitoring address storage area. When the actual value is obtained from the monitored area, the memory management unit will record the translated physical address and provide it to the monitor. It will be compared with the reference value obtained from the benign value area and the reference physical address obtained from the checkout address verification area. If there is at least one inconsistency in the comparison results, it means that the content and / or mapping has been tampered with. An exception is directly thrown and handled according to the exception handling mode specified during configuration. At the same time, the monitor watchdog register is incremented to record the number of exceptions that occurred in this round of scanning; otherwise, the content of the next unit position is compared until the contents of all monitored areas are scanned.

[0041] The exception handling mode is specified when the kernel is configured, and can be specifically divided into M mode to handle this exception, S mode to handle this exception, and directly ignoring this exception and continuing to scan. If you choose to handle this exception by M mode, when an exception occurs during the scanning process, the monitor will transfer the execution right back to the processor, and the processor will access the exception vector table to find the corresponding exception handler for processing; if you choose to handle this exception by S mode (kernel), when an exception occurs during scanning, the monitor will also transfer the execution right back to the processor, and the kernel will access its exception handler to process the exception; if you choose to ignore this exception, no action will be taken when the exception occurs, and the scan will proceed directly. When the exception is handled, the scanning process will be returned according to the immediate action mode selected during configuration after the monitoring exception handling is completed.

[0042] The exception handler (either M-mode or S-mode) is user-defined. If M-mode is selected for scanning exceptions, the exception handler must be embedded throughout the system initialization process. If S-mode is selected for scanning exceptions, the kernel must configure the exception handler during kernel startup, and exceptions during scanning will also be delegated to S-mode.

[0043] The immediate action after the monitoring exception handling is completed and returned is executed by the monitor after the exception handling is completed and the processor transfers the execution right to the monitor again. The optional immediate actions include rescanning the location of the exception, skipping the location of the exception, skipping the current round of scanning, restarting the current round of scanning, etc. After returning to the scan, it is also necessary to compare the number of exception records in the monitor watchdog register and the threshold of the number of exception occurrences in the monitor status register. If the former reaches the latter, the exception of too many exceptions in a single round of scanning will occur again; otherwise, the remaining scanning process will continue. Among them:

[0044] The position of the abnormality is re-scanned. In this mode, the monitor maintains the register state when the abnormality occurs and continues the current round of scanning;

[0045] The position of the abnormality is skipped. In this mode, the monitor continues the current round of scanning directly from the position of the next unit where the abnormality occurs;

[0046] The present scanning round is skipped and the monitor directly enters step d in this mode to complete the present scanning round;

[0047] When restarting the current round of scanning, the monitor in this mode will clear the existing scan execution status (but not including the content of the monitor watchdog register) and restart the current round of scanning.

[0048] In the scanning process of the monitoring and protection method for RISC-V memory sensitive areas described in the present invention, step d includes:

[0049] The monitor clears the value stored in the monitor instruction interval number register to zero to re-record the number of instructions executed before the next scan; and re-locks the monitor to ensure that the monitor cannot be easily accessed.

[0050] To ensure the normal operation of the two main processes of configuration and scanning mentioned above, the present invention expands a number of auxiliary component processes based on SPIKE. For example, it adds monitor memory area checks in the memory management unit addressing process, adds new exception types, adds new monitor configuration instructions, and adds new monitor-specific control status registers. Among them:

[0051] The monitor memory area check will check the translated physical address when the memory management unit accesses the memory. If the accessed memory is not within the monitor's exclusive memory range, it means that this memory access will not affect the normal operation of the monitor and the normal memory access will be performed. If the accessed memory is within the monitor's exclusive memory range, a series of monitor checks are required. If the monitor is not turned on, it also means that this memory access is a normal memory access; otherwise, subsequent checks will still be performed. When the monitor is turned on, the monitor will record the physical address for verification during scanning. Finally, check the privileged mode of the memory access and the monitor lock status. Only when the current privileged mode is not lower than the lowest privileged mode allowed by the monitor and the monitor is not locked, the access to the monitor's exclusive memory is legal. Otherwise, an exception will be thrown directly.

[0052] The new exception type is a monitor-related exclusive exception, including read and write monitor exclusive memory errors, read and write monitor control status register errors, access monitor exclusive memory cross-region errors, monitor illegal access errors, monitor scan value mismatch errors, monitor exception count too many errors, and monitor check map tampering errors;

[0053] The new monitor configuration instructions, namely the addmon instruction and monconf instruction mentioned above, have already pointed out their uses and instruction processes, so they will not be described in detail here.

[0054] The new monitor-exclusive control status register includes a monitor status register, a monitor instruction interval register, and a monitor exception threshold register, wherein the contents recorded in the monitor status register include the monitor switch, that is, whether the monitor is enabled; the lowest privilege mode allowed to be used, which is responsible for ensuring the current privilege mode. If the monitor-related content is accessed, it is ensured that the visitor is in a high privilege mode rather than an unauthorized low privilege mode; a monitoring exception handling mode, which is a processing mode adopted when an exception occurs during the monitor scan process. The mode details have been listed in the previous article and will not be elaborated on here; an immediate action mode after the monitoring exception is handled and returned. The mode details have been listed in the previous article and will not be elaborated on here; the number of interval instructions between two adjacent monitoring scans, that is, the number of instructions that should be executed and can only be executed from the end of this scan to the next scan, each time it is experienced After so many instructions, a round of scanning is required; the threshold of the number of exceptions allowed to occur during each round of scanning. In each round of scanning process, there may be multiple addresses with data tampering or mapping tampering, and even the exception handler provided by the user may not handle the exception properly, resulting in continuous exceptions in this round of scanning so that the system cannot execute normal programs. In order to avoid such a situation, the threshold of the number of exceptions will come into play. It will issue a unique exception when the number of exceptions reaches the threshold, and the handler for handling the unique exception can also be customized; the privileged mode when configuring the monitor. When accessing the monitored memory space during the scan, the address stored during the configuration is used, and the privileged mode during configuration is not necessarily the same as the privileged mode during the scan. In order to ensure the normal scanning process of the monitor, this configuration is required to ensure that the monitored area can be found during the scan and to verify whether its mapping and content have been tampered with.

[0055] The present invention also provides a monitoring protection extension system for implementing the above method. The system is built on the basis of the SPIKE simulator architecture and includes: a monitor control register module, a monitor exclusive memory space module, a monitor configuration instruction module, a scanning process trigger module, and a memory access check module;

[0056] The monitor control register module is used to configure, record and manage the monitor's enabled status, scanning parameters and exception handling strategy to ensure the orderly execution of the monitoring process and system security;

[0057] The monitor-specific memory space module is an independent area divided in the overall system memory space for exclusive use by the monitor. The memory area has a structural layout for storing monitored addresses, reference data, and legitimacy verification data;

[0058] The monitor configuration instruction module is used to set the parameters of the monitor by calling the dedicated configuration instruction when the kernel needs to perform intermittent monitoring and scanning of the specified memory area, so as to ensure that the monitor performs monitoring and verification operations as expected during operation;

[0059] The scanning process triggering module is used to automatically trigger the monitor to start a round of monitoring scanning operation after the processor executes instructions for a set number of intervals, so as to ensure periodic verification of the monitored area;

[0060] The memory access check module is used to determine whether the access involves the monitor exclusive area when the memory management unit accesses the memory, and perform a legality check operation under the condition that the privileged mode and lock state requirements are met.

[0061] Furthermore, the monitor control register module includes: a monitor status register, a monitor instruction interval number register, and a monitor watchdog register;

[0062] The monitor status register is used to record the monitor's enabled state, the lowest accessible monitor privilege mode, the exception handling mode, the exception handling return mode, the number of scan interval instructions, the threshold of the number of exceptions allowed per scan round, and the privilege mode during configuration;

[0063] The monitor instruction interval number register is used to record the number of executed instructions during the normal program execution phase to determine whether the interval condition for starting the scan is met;

[0064] The monitor watchdog register is used to record the number of exceptions that have occurred in each round of scanning to prevent the exceptions from blocking the system operation.

[0065] The present invention also provides the above method or the application of the above system in implementing monitoring protection, etc. in the RISC-V proxy kernel (PK).

[0066] The beneficial effects of this invention include: It is the first to integrate a region scanning function into an architecture extension. To mitigate the risk of memory tampering, this invention prioritizes architectural design, fundamentally reducing the potential for memory tampering. This avoids potential vulnerabilities introduced by secondary add-on components used in finished processors, minimizing the complexity and security of additional components during actual application operation. By promptly detecting and resolving memory tampering issues, system security and stability are ensured. BRIEF DESCRIPTION OF THE DRAWINGS

[0067] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without paying any creative work.

[0068] Figure 1 This is an overall flow chart of the present invention's monitoring and protection extension for RISC-V memory sensitive areas.

[0069] Figure 2 This is a flow chart of the configuration instructions for the monitoring and protection extension of RISC-V memory sensitive areas in the present invention.

[0070] Figure 3 This is a specific schematic diagram of various control status registers for monitoring and protecting sensitive areas of RISC-V memory extended by the present invention.

[0071] Figure 4 Schematic diagram of the exclusive memory area division for monitoring and protection extension of RISC-V memory sensitive areas in the present invention.

[0072] Figure 5 This is a schematic diagram of the exclusive configuration instruction format for the monitoring and protection extension of RISC-V memory sensitive areas.

[0073] Figure 6 This is a scanning execution flow chart of the present invention's monitoring and protection extension for RISC-V memory sensitive areas.

[0074] Figure 7 This is a flowchart of the exception handling process during the scanning process of the monitoring protection extension for RISC-V memory sensitive areas of the present invention. DETAILED DESCRIPTION

[0075] The present invention is further described in detail with reference to the following specific examples and accompanying drawings. The processes, conditions, experimental methods, etc. for implementing the present invention, except for those specifically mentioned below, are common knowledge and common common sense in the art and are not particularly limited by the present invention.

[0076] The present invention proposes a monitoring and protection method for sensitive memory areas of RISC-V. The method first analyzes and summarizes the existing tampering problems in sensitive memory areas, considers the use of extensions to prevent and control such problems from the perspective of the underlying architecture, and simultaneously analyzes and proposes the necessary elements and main logic required for the new extension. Without affecting the existing stable extension architecture of RISC-V, a monitoring and protection extension system is proposed, and the new extension system is implemented using the C++ language on the RISC-V official architecture simulator SPIKE. Next, the logic and structural elements in the present invention are refined, and the overall execution logic is divided into two major parts: configuration and scanning execution. The element components related to monitoring include a monitor control status register module, a monitor exclusive memory space module, and a monitor exclusive configuration instruction module. The execution logic and element components complement each other and depend on each other to jointly ensure the data and mapping security of sensitive memory areas.

[0077] The present invention proposes a monitoring and protection method for sensitive areas of RISC-V memory, which mainly detects and prevents potential hidden dangers of tampering in the memory that may cause system abnormal crashes. By inserting a scan between the specified number of instructions when the processor normally executes the program, and throwing an exception in time when a data comparison error is found, the system is notified of the potential content tampering risks in sensitive areas, ultimately achieving the purpose of improving the security of memory data.

[0078] This invention proposes a monitoring and protection extension system for sensitive RISC-V memory areas. This system, with the core purpose of monitoring kernel-specified monitored areas, utilizes a spike simulator as its architectural foundation for development. This extension includes a control status register module, a memory space layout module, and a new monitor configuration instruction module specifically tailored for memory monitoring. Through a scanning process interspersed between fixed instruction intervals and a series of checks during memory access by the memory management unit, the extension system is inaccessible to any low-privilege users. Its access and exit interfaces with the outside world are single, ensuring its independence and security. Furthermore, the monitors included in the extension are flexibly configurable and compatible with the original system, ensuring compatibility, flexibility, and modularity.

[0079] The monitoring protection extension system of the present invention mainly includes a monitor control status register module, a monitor exclusive memory space module and its layout, and a monitor exclusive configuration instruction module; wherein:

[0080] The monitor control status register is as follows Figure 3As shown, it is mainly used to store a series of states when the monitor is enabled to ensure the normal operation of the monitor and effective isolation from the normal external programs; it includes three control status registers: MON_STATUS (monitor status register), MON_TIMER (monitor instruction interval number register), and MON_WDOG (monitor watchdog register). Among them:

[0081] The MON_STATUS records some necessary status of the monitor, and its field distribution is as follows Figure 3 As shown in the figure. From high to low, they are the monitor enable bit (monitor switch), the delegation bit (the lowest privilege mode that allows access to the monitor), the exception handling mode during scanning, the scan exception return mode, the number of interval instructions between two adjacent monitoring scans, the threshold of the number of exceptions allowed to occur during each scan, and the privilege mode when configuring the monitor. These configuration contents can be configured and set by the kernel calling the dedicated monitor configuration instruction according to certain parameter rules. Among them:

[0082] The monitor enable bit, when set to 1, indicates that the monitor is on; otherwise, it indicates that the monitor is off;

[0083] The delegation bit marks the lowest privilege mode in which the external access monitor should be located. When it is set to 1, it indicates that the lowest privilege mode of the access monitor is S mode; otherwise, it is M mode.

[0084] The scan exception handling mode marks the path to resolve the exception when an exception occurs during the scanning process. When the value is 0b'00, it means ignoring the current exception and continuing the scan; when the value is 0b'10, it means entrusting the S mode to handle this exception; when the value is 0b'11, it means that the M mode will handle this exception;

[0085] The scan exception return mode marks the immediate action when returning after the scan exception processing is completed. When the value is 0b'00 (REPEAT mode), it means continuing the current scan from the point where the exception occurred; when the value is 0b'01 (STEP mode), it means skipping the point where the exception occurred and continuing the current scan; when the value is 0b'10 (RESTART mode), it means restarting the current scan; when the value is 0b'11 (SKIP mode), it means skipping the current scan and returning to the main program flow;

[0086] The number of interval instructions between two adjacent monitoring scans indicates how many instructions need to be executed from the start of configuration completion or the previous scan before entering the next scan round. However, the actual value represents the power of 2 of the field value. That is, if the field value is 20, it actually takes 220 instructions to execute after the end of one scan round before the next scan round begins.

[0087] The threshold of the number of exceptions allowed to occur during each round of scanning represents the maximum number of exceptions that can occur during each round of scanning. When the number of exceptions in a single round of scanning reaches this value, the monitor will throw an exception indicating that the number of exceptions is too high.

[0088] The privileged mode in which the monitor is configured is used to translate the physical address according to the logical address given during configuration during the memory access process when the monitor is scanned. That is, if the monitor is configured by the kernel in S mode, then the monitoring area addresses provided are all logical addresses in S mode, and the addresses stored in the auxiliary memory space of the monitor are also logical addresses in S mode. Subsequent scans may scan these monitoring areas in U mode. At this time, access errors will occur when accessing these areas in U mode. This field ensures that the state of accessing these areas during the scan is consistent with the privileged mode state during configuration, avoiding interference from other problems besides the verification content.

[0089] The MON_TIMER, when the monitor is turned on, records the number of instructions currently executed by the system program. Specifically, the system records the number of instructions currently executed during the normal program execution phase before the next scan, so as to determine whether the next scan can be performed. Before each prefetch instruction, the processor compares the value of MON_TIMER with the actual value of the interval instruction count between two adjacent monitoring scans in MON_STATUS. If the former reaches the latter, the next scan is started.

[0090] The MON_WDOG control status register records the total number of exceptions that occurred during each scan. By recording the number of monitor-related exceptions that have occurred during the scan, the normal operation of the system can be prevented from being seriously blocked due to excessive exceptions during the scan.

[0091] The monitor-specific memory space module divides an area in the memory of the monitor as the auxiliary memory space of the monitor, which serves as the tool memory space in the process of monitoring and scanning, and plays the function of storing the judgment of the legality of the monitored area and the reference space, as well as the function of providing reference data when the monitor performs the monitoring and scanning function; in a specific embodiment of the present invention, the space layout is as follows Figure 4 As shown, it includes MON_LAYOUT area, MON_BENIGN area, MON_MAPPING area, and MON_CHECKOUT area. Among them:

[0092] The MON_LAYOUT area records the starting addresses of the remaining areas;

[0093] The MON_BENIGN area records the benign reference value obtained from the monitored area during configuration. During scanning, it is provided to the monitor as a reference value for comparison with the actual value obtained from the monitored area. In addition, the initial area records whether the area is legal during configuration to assist in completing the monitor configuration.

[0094] The MON_MAPPING area records all the starting addresses and sizes of the monitored areas provided during configuration. During scanning, the starting address and size of each monitored area are obtained and scanned sequentially. In addition, the initial area records whether the area is legal during configuration, which helps the monitor configuration complete;

[0095] The MON_CHECKOUT area records each physical address translated when obtaining benign values ​​from the monitored area during configuration. When scanning and accessing memory, it will be compared with the corresponding translated physical address, and the total number of blocks in the monitored area is recorded in the initial area;

[0096] The monitor-specific configuration instruction module is mainly used to be called by the kernel when it needs to perform intermittent monitoring and scanning of the specified memory space to configure a series of functional parameters of the monitor on demand to ensure that the monitor runs in the expected manner when performing the monitoring and scanning function; it consists of the addmon instruction and the monconf instruction, and the instruction format is as follows: Figure 5 As shown, where:

[0097] The addmon instruction, an R-type instruction, accepts two input parameter registers, RS1 and RS2, which store a section of space and the number of blocks in the monitored area, respectively. The space stores the starting address and size of each monitored area; and the RD destination output register, which is used to store the configuration result after the instruction is called;

[0098] The monconf instruction, an R-type instruction, accepts an input parameter register RS1 to store the configuration of the monitor. The user needs to organize the configuration parameters into Figure 4 The format shown in the MON_STATUS register; and the RD destination output register, which is used to store the configuration results after the instruction is called.

[0099] The monitoring protection extension system of the present invention further comprises: a scanning process triggering module, a memory access checking module;

[0100] The scanning process triggering module is used to automatically trigger the monitor to start a round of monitoring scanning operation after the processor executes instructions for a set number of intervals, so as to ensure periodic verification of the monitored area;

[0101] The memory access check module is used to determine whether the access involves the monitor exclusive area when the memory management unit accesses the memory, and perform a legality check operation under the condition that the privileged mode and lock state requirements are met.

[0102] In a specific implementation of the present invention, the processor intermittently calls the monitor to execute the scanning process interspersed between fixed instruction number intervals, wherein:

[0103] The fixed instruction interval is provided as a parameter to the monitor by the kernel during configuration and stored in the monitor status register. Before each prefetch, the processor obtains the number of instructions executed during the normal program execution phase before the next scan and the number of instruction intervals between two adjacent scans from the monitor instruction interval register and the monitor status register, respectively. If they are equal, the current scan process is continued.

[0104] The scanning process is executed by the monitor, which needs to complete the inspection including whether the values ​​and address mappings stored in the monitored area have been tampered with, and when an error occurs in the inspection, it throws or ignores the exception in the manner specified by the kernel (stored in the monitor status register).

[0105] In one embodiment of the present invention, a series of checks performed by the memory management unit when accessing memory include whether the translated physical address is in the monitor's dedicated memory space, the monitor's enabled state, whether the monitor is in a locked state, and whether the current privilege mode is higher than the lowest privilege mode allowed by the monitor, where:

[0106] Whether the translated physical address is in the monitor's exclusive memory space during memory access determines whether a subsequent check is performed. A subsequent check is performed only when the accessed physical address is in the monitor's exclusive memory space; otherwise, memory access is performed normally according to the program.

[0107] The monitor is turned on, so that when it is turned off, it will not affect the normal memory access of the program, and only when it is turned on will the subsequent series of checks be performed;

[0108] Whether the current privilege mode is higher than the lowest privilege mode allowed by the monitor, this check will be performed after the above two checks, that is, when the physical address being accessed is in the monitor's exclusive memory space and the monitor is in the on state, if the current privilege mode is in low privilege mode, it means that it is very likely that this access was initiated by an unauthorized or ordinary user in low privilege mode or even a malicious user, which may cause the content of the monitor's exclusive memory space to be seriously tampered with, and the memory management unit will directly throw an exception; otherwise, the next check will be executed;

[0109] Whether the monitor is in a locked state will be checked after the above two checks. That is, when the accessed physical address is in the monitor's exclusive memory space and the monitor is in the turned-on state, if the current monitor is in the locked state, it means that this memory access is an illegal memory access, and the memory management unit will directly throw an exception; otherwise, it means that this memory access is a memory access request initiated by the monitor to the memory management unit in order to scan or configure the monitor.

[0110] like Figure 1 As shown, the present invention includes the following steps during application:

[0111] Step 1: (Configuration Process) The kernel configures instruction parameters based on its own monitoring requirements and passes the parameters to the processor by calling the monitor configuration instruction. After receiving the instruction, the processor unlocks the monitor and transfers the obtained parameters and execution rights to the monitor.

[0112] Step 2: (Configuration Process) After the monitor receives the parameters, it parses and verifies them. After confirming that the parameters are correct, it configures its own dedicated memory area and control status register. If any abnormality occurs during the entire process, the monitor will clear the corresponding legal bit and turn off the monitor switch to avoid subsequent meaningless scanning that will damage system performance and even consume system resources. Only when the configuration process is completely correct will the monitor set the corresponding legal bit and turn on the monitor switch according to the parameter requirements brought by the instruction. The configuration of the monitor is completed and it will begin to function subsequently;

[0113] Step 3: (Scanning Process) The processor periodically calls the monitor to perform a new scan after a certain number of instructions have passed since the last scan or configuration is completed, according to the number of instructions in the interval configured at the beginning (i.e., the number of instructions corresponding to the cycle between two consecutive scans). When a scan begins, the monitor first performs a series of initializations to prepare for this round of scanning.

[0114] Step 4: (Scanning process) The monitor will extract the reference value from its own dedicated auxiliary memory and compare it with the actual value obtained in the monitored area. If the data is consistent, it will continue to proceed; otherwise, it will throw an exception handling process for exception handling;

[0115] Step 5: (Scanning process) Regardless of whether the data is consistent or the exception is handled, the monitor will continue to scan the next address. If the next address reaches the end address of the monitored area, the current scan ends; otherwise, it returns to step 4 to continue scanning the next address.

[0116] Step 6: (Scanning process) After the current round of scanning is completed, the processor returns to the execution of the main program and restarts counting the number of interval instructions before the next scan in preparation for the next round of scanning.

[0117] The configuration process can be divided into addmon directive configuration and monconf directive configuration, such as Figure 2 shown.

[0118] The addmon instruction configuration is first called by the kernel to the processor, and the memory area to be monitored is organized into parameters and passed to the processor. The processor then unlocks the monitor and passes the parameters to the monitor; the monitor parses the obtained parameters to obtain the range information of the area to be monitored, and checks the range of the area. If the range is legal and there is no overlap, the next configuration is performed; otherwise, this configuration fails directly, and the kernel needs to check the range and then call the addmon instruction again; after the area range is correct, the monitor will obtain the corresponding data in these areas and record the translated physical address. If there is no abnormality in the process, the monitor will store these contents in its own exclusive auxiliary memory; otherwise, the legal bits in the auxiliary memory are cleared, and this configuration fails directly; after storing the monitoring data and physical address, the monitor will set the legal bits in the auxiliary memory to legal, and then the processor will re-lock the monitor, and this configuration is completed, and the addmon instruction call is completed.

[0119] The monconf instruction configuration is first called by the kernel to the processor, and the configuration method to be set is organized into parameters and passed to the processor. The processor then unlocks the monitor and passes the parameters to the monitor. The monitor first verifies the current permission status and obtains the value of the monitor status register. If the monitor status register does not have the permission to access the monitor status register, the configuration fails directly and the monitor is turned off. Otherwise, the monitor obtains the value of the monitor status register and saves it. After that, the monitor begins to try to write a new value to the monitor status register. Before officially writing, the monitor needs to verify the new parameter value obtained. If the new value is legal and there is no logical conflict, it continues to check whether the legal bits in the auxiliary memory are legal. Only after both checks are passed can the monitor write the new value to the status register and open the register according to the parameters. Otherwise, as long as any one check fails, the configuration will be directly judged to have failed and the monitor will be turned off. After the monitor is turned on, this configuration is successful and the monconf instruction call is completed.

[0120] The scanning process, such as Figure 6 As shown, the scanning process can be divided into the following steps:

[0121] Step I: The processor checks the value of the monitor instruction interval number register. When the value reaches the interval instruction number stored in MON_STATUS, the monitor is called to prepare to start scanning.

[0122] Step II: The monitor first opens the locked state, clears the value of the watchdog register, sets the pointer to the start address of benign (denoted as benign pointer) and the start address pointer of checkout (denoted as checkout pointer), and obtains the number of monitored areas from the checkout area;

[0123] Step III: Start scanning the first area;

[0124] Step IV: Get the starting address and size of the current area from the mapping area, and set the pointer of the current monitored area (referred to as the mapping pointer) according to the obtained starting address;

[0125] Step V: Obtain the values ​​pointed to by the benign pointer and the mapping pointer respectively for comparison, and when accessing the content pointed to by the mapping pointer, obtain its corresponding physical address and compare it with the value pointed to by the checkout pointer, and check whether the two comparison results are consistent;

[0126] Step VI: If the comparison results are consistent, move the three pointers and continue the comparison at the next position, then jump to step VII. Otherwise, increase the value of the watchdog register and throw a checksum error exception to the corresponding exception handler. After the exception is handled, jump to step VIII.

[0127] Step VII: Check whether the pointer has reached the end of the current region. If so, jump to step IX; otherwise, jump to step V.

[0128] Step VIII: Check whether the value of the watchdog register exceeds the exception count threshold. If so, clear the value of the watchdog register and jump to the corresponding excessive exception count exception handler for processing. After the exception is handled, jump to this step; otherwise, move the three pointers according to the exception return mode set during configuration and jump to step VII.

[0129] Step IX: Determine the location of the current area. If it is the first area, jump to step III; if it is the last area, jump to step X; otherwise, jump to step IV;

[0130] Step X: Final action, clear the value of the monitor instruction interval register, lock the monitor, return the execution authority to the processor, execute the main program, and end this round of scanning.

[0131] The exception handling process is as follows Figure 7 As shown, the exception handling process can be divided into the following steps:

[0132] Step 1): The monitor throws an exception after an exception occurs during the scanning process;

[0133] Step 2): The monitor first checks the value of MON_STATUS and extracts the field indicating the exception handling mode. If it indicates ignoring the exception, the monitor prepares to return to the scanning process and jumps to step 5). If it indicates that the exception is handled in M ​​mode, the monitor finds the corresponding exception handler based on the exception number and prepares to handle the exception, and jumps to step 3). If it indicates that the exception is handled in S mode, the monitor jumps to step 4.

[0134] Step 3): Check whether a handler corresponding to the exception is stored in M ​​mode. If so, the exception is handled by the found exception handler. After the exception is handled, jump to step 5);

[0135] Step 4): The processor checks whether the current exception number is set in the exception delegation register. If so, the kernel finds the corresponding exception handling subroutine to handle the exception. After the exception is handled, the processor jumps to step 5); otherwise, the processor jumps to step 3);

[0136] Step 5): Before returning to the scanning process, check the value of the watchdog register to obtain the number of exceptions that have occurred. If the number of exceptions exceeds the threshold, clear the value of the watchdog register and jump to step 2); otherwise, continue to the next step;

[0137] Step 6); Check the value of MON_STATUS and extract the exception return field. If it indicates STEP mode, move the benign, mapping, and checkout pointers to the next unit position; if it indicates REPEAT mode, no processing will be performed; if it indicates RESTART mode, move the benign, mapping, and checkout pointers back to the first area and return to the first area for rescanning; if it indicates SKIP mode, move the benign, mapping, and checkout pointers to the end address of the last area; this exception handling is completed.

[0138] Example

[0139] This embodiment uses Figure 6 Taking the scanning process shown above as an example, we simulate and analyze a round of scanning after the kernel has configured the monitored area. The first test case we designed is as follows:

[0140] The logical address of the monitored area is set to 0xFFFFFFFF0090000, the size is 0x1000, and the translated address range is 0x80040000~0x80041000. The configured monitor function options are: turn on the monitor, the minimum privilege mode for accessing the monitor is S mode, the exception handling mode is S mode processing, the exception return mode is STEP mode, the instruction interval number is 218, and the exception count threshold is 0x100.

[0141] When the value stored in MON_TIMER reaches 218, the processor calls the monitor to start this round of scanning. The monitor first unlocks, clears the watchdog register, finds the benign value, and the starting position of the checkout physical address record, and points the benign pointer and checkout pointer to the corresponding position, and obtains the number of monitored areas from the checkout area as 1; the monitor starts to obtain the logical address 0xFFFFFFFF0090000 and size 0x1000 from the mapping area, and records the mapping pointer as 0xFFFFFFFF0090000; the monitor accesses the address pointed to by the mapping pointer, obtains the physical address through the memory management unit translation, and obtains Get the stored value, compare the physical address and the obtained value with the value pointed to by the checkout pointer and the value pointed to by the benign pointer respectively. If the comparison results are inconsistent, a checksum error exception is thrown; otherwise, continue to compare the next position until the mapping pointer points to 0xFFFFFFFF0090FF8 and the value pointed to by the checkout pointer is 0x80040FF8, reaching the end position of the monitored area, which is also the last position of this round of scanning. The monitor clears the value of MON_TIMER and sets the lock status to 1. The execution permission is returned to the processor to continue executing the main program and polling access to MON_TIMER and increase the value of MON_TIMER before each instruction execution until the next scan.

[0142] In addition, the present invention has been applied to the RISC-V Proxy Kernel (PK). The PK kernel can scan for related exception numbers and delegate these exceptions to PK itself for processing by configuring the exception delegation register. During operation, the PK code is modified, and the addmon and monconf instructions are called during initialization to monitor and protect certain text areas of the kernel.

[0143] Before calling the addmon command, the starting address and size of the area to be protected are stored in temporarily allocated memory. This memory starting address and the number of areas to be protected are then assigned to the parameter registers in the addmon call. If the command completes without any exceptions, a successful configuration is returned, indicating that the information about the monitored areas has been recorded in the monitor's dedicated memory space.

[0144] Before calling the monconf instruction, the configuration to be entered is organized into a 32-bit integer according to the layout of the monitor status register. From high to low, they are the monitor enable bit (set to 1 to enable the monitor), the delegate bit (set to 1, which allows S mode to access the configuration monitor at the lowest level), the exception handling mode during scanning (set to 0b'10, and the exception is handled by S mode), the immediate action after the exception handling is completed (set to 0b'01, STEP mode, skip the exception and continue scanning), the number of interval instructions (set to 0xa, and execute 2 every time). 10 A new round of scanning is performed when a new instruction is generated), the exception occurrence threshold (set to 0x20, the upper limit of the number of exceptions allowed in a single round of scanning is 32 times), and the privileged mode during configuration (no need to set, the monitor will automatically fill in the privileged mode during configuration).

[0145] In addition, write exception handlers related to these scans in the kernel. The execution actions are: print the address where the exception occurred recorded in the MTVAL CSR, and return the exception handling completion (in the actual kernel execution process, the corresponding exception handler can be modified according to its own needs).

[0146] Finally, the modified kernel executable was compiled using the riscv64-unknown-elf-gcc compiler and run with the included spike extension. As long as the designated monitored areas were not tampered with, the kernel remained operational. However, when a user test program attempted to modify the monitored areas, modify monitor-specific registers or memory space, or call dedicated instructions to change the configuration, the kernel would display error messages in the terminal. This demonstrates the protection effectiveness of the extension under both normal and abnormal usage conditions.

[0147] Compared with the measures to reduce the risk of memory tampering, the current industry mainly adopts the method of adding additional devices or adding redundant code logic to monitor fixed memory areas, which is more likely to cause physical / logical burden problems on the system. The focus of the present invention is to propose a monitoring and protection extension system and monitoring and protection method for RISC-V memory sensitive areas, which successfully performs periodic scanning on the memory area specified by the kernel in the example and points out possible errors therein, which helps to provide guarantees in terms of RISC-V memory security, further confirms the security and stability of the kernel running on RISC-V, and enhances the architecture of the RISC-V memory protection mechanism to be more secure and reliable when the user can choose.

[0148] The protection content of the present invention is not limited to the above embodiments. Without departing from the spirit and scope of the present invention, changes and advantages that can be thought of by those skilled in the art are included in the present invention and are protected by the appended claims.

Claims

1. A monitoring and protection method for RISC-V memory sensitive areas, characterized in that: The method implements monitoring protection by configuring monitoring parameters and performing polling scans on sensitive memory areas to detect tampering and handle exceptions; the method includes: Step 1: The kernel calls the monitor configuration instruction to configure the monitor state parameters and monitored areas; Step 2: The processor receives and transmits the configuration parameters to the monitor for processing, analysis, and verification. If they are legal, they are written into the control status register and the monitor's dedicated memory space. Otherwise, the monitor is shut down. Step 3: The processor calls the monitor to execute the scanning process according to the set instruction interval when the interval condition is met; Step 4: The monitor verifies the value and address mapping of the monitored area and handles errors according to the preset exception handling strategy; Step 5: After the scanning process is completed, the monitor performs the final clearing state operation and returns to the system program to execute the main process.

2. The method according to claim 1, wherein In step 1, the monitor configuration instructions include: addmon instruction and monconf instruction; the addmon instruction needs to be called before the monconf instruction; The addmon instruction is used to configure the monitored area, and the monconf instruction is used to configure the monitor status register; The starting address of the memory space storing the starting address and size of the monitored area and the number of monitored areas are input parameters of the addmon instruction and are placed in two parameter registers respectively; Adjust the configuration parameters to the parameter layout status of the monitoring status register, put them into a parameter register, and use them as the only input parameter of the monconf instruction.

3. The method according to claim 1, wherein In step 2, after the processor receives the configuration parameters, it needs to unlock the monitor before configuring it; before returning the configuration results, it needs to re-lock the monitor state; Select the result feedback strategy based on the changes to the original data during configuration: If the metadata is not modified, the exception result is returned directly when an exception occurs during the configuration instruction; If the original data has been modified, restore the configuration site and then return the abnormal result; The monitor can only be configured in the least privileged mode allowed by the monitor.

4. The method according to claim 1, wherein In the monitor configuration steps, the addmon command must be executed before the monconf command, including the following operations: The processor obtains two input parameters of the addmon instruction. The starting address of the memory space storing the starting address and size of the monitored area provides the monitor with a list of the starting addresses and sizes of the monitored areas. The monitor determines the number of monitoring blocks based on the number of monitored areas and reads the starting address and size of each monitored area from the address pointed to by the starting address of the memory space storing the starting address and size of the monitored area. Access the memory content corresponding to each address segment, extract its current value as the benign value, and write it into the benign value area to be used as a scanning comparison benchmark; At the same time, the address and size of each monitored area are recorded in the mapping monitoring address storage area, and the physical address after the logical address translation is obtained and stored in the checkout address verification area; If the access process is normal and the data is correctly acquired, the legal flag position of the benign area and the mapping area is set to 1, otherwise the legal position is set to 0; and the enable position in the monitor status register is set to 0 to turn off the monitor and stop the monitoring function; The monconf instruction needs to be executed after the addmon instruction. After the monitor obtains the configuration parameters transmitted by the configuration instruction, it needs to first access the legal bits of the benign benign value area and the mapping monitoring address storage area, and then parse the parameters after marking them as legal.

5. The method according to claim 4, wherein The parameter parsing means that the monitor needs to split the configuration parameters transmitted, parse and judge each section according to the layout mode of the monitor status register, and return the configuration success result; if the configuration fails, the configuration failure result is fed back; If the configuration is successful, the monitor clears the relevant monitor-specific registers for the scanning process; If the configuration fails, the enable bit of the monitor status register is set to 0 to turn off the monitor; and / or, The configuration results of the addmon and monconf instructions are written to the output parameter register rd. The kernel determines whether the configuration is successful by reading the value of the rd register. If an exception occurs during the configuration process, the execution will jump to the corresponding exception handler according to the exception vector and fall into the process.

6. The method according to claim 1, wherein In step three, when the number of instructions currently executed in the monitor instruction interval register is not less than the number of interval instructions between two adjacent monitoring scans stored in the monitor status register, the interval condition is met and the processor will call the monitor for a new round of scanning.

7. The method according to claim 1, wherein During the fourth step of the scan, the monitor first obtains the address and size of the monitored area from the mapping area. This allows the monitor to access the monitored area and obtain the actual value for verification. This includes: reading the current actual value from the monitored area and comparing it with the benign value in the benign value area; and recording the translated physical address of the access address when accessing the monitored area, and comparing it with the physical check address in the checkout address verification area. Only when both data are correct will the monitor proceed to the next address.

8. A monitoring and protection extension system for implementing the method according to any one of claims 1 to 7, characterized in that: The system is built on the SPIKE simulator architecture and includes: a monitor control register module, a monitor exclusive memory space module, a monitor configuration instruction module, a scanning process trigger module, and a memory access check module; The monitor control register module is used to configure, record and manage the monitor's enabled status, scanning parameters and exception handling strategy to ensure the orderly execution of the monitoring process and system security; The monitor-specific memory space module is an independent area divided in the overall system memory space for exclusive use by the monitor. The memory area has a structural layout for storing monitored addresses, reference data, and legitimacy verification data; The monitor configuration instruction module is used to set the parameters of the monitor by calling the dedicated configuration instruction when the kernel needs to perform intermittent monitoring and scanning of the specified memory area, so as to ensure that the monitor performs monitoring and verification operations as expected during operation; The scanning process triggering module is used to automatically trigger the monitor to start a round of monitoring scanning operation after the processor executes instructions for a set number of intervals, so as to ensure periodic verification of the monitored area; The memory access check module is used to determine whether the access involves the monitor exclusive area when the memory management unit accesses the memory, and perform a legality check operation under the condition that the privileged mode and lock state requirements are met.

9. The system according to claim 8, wherein The monitor control register module includes: a monitor status register, a monitor instruction interval number register, and a monitor watchdog register; The monitor status register is used to record the monitor's enabled state, the lowest accessible monitor privilege mode, the exception handling mode, the exception handling return mode, the number of scan interval instructions, the threshold of the number of exceptions allowed per scan round, and the privilege mode during configuration; The monitor instruction interval number register is used to record the number of executed instructions during the normal program execution phase to determine whether the interval condition for starting the scan is met; The monitor watchdog register is used to record the number of exceptions that have occurred in each round of scanning to prevent the exceptions from blocking the system operation.

10. Application of the method according to any one of claims 1 to 7, or the system according to claim 8 or 9, in implementing monitoring protection in a RISC-V agent kernel.

Images