Method, device and storage medium for running a program on a RISC-V processor

Abstract

A method, device and storage medium for running a program on a RISC-V processor, comprising: obtaining a target program to be run and a corresponding configuration file; the configuration file at least including resource address information corresponding to each virtual area, the virtual area being obtained by dividing sub-functions contained in the target application program; setting a register corresponding to each virtual area and configuring the register corresponding to each virtual area according to the configuration file, so that each virtual area corresponds to available resources; compiling the target program to obtain firmware capable of running on the divided multiple virtual areas; running the firmware, and whenever running to an operation instruction corresponding to a sub-function during the running process, controlling the target operation instruction running to use resources corresponding to a first target virtual area to which the target sub-function belongs. The embodiment of the application realizes safe running of the program without changing the hardware structure.

Description

TECHNICAL FIELD

[0001] The present application relates to processor technology, in particular to a method, device and storage medium for running a program on an open-source instruction set architecture (RISC-V) processor. BACKGROUND

[0002] With the wide application of open-source RISC-V architecture chips, the data security requirements for RISC-V processors are becoming higher and higher. In general, in order to solve the security threats faced by the processor, a trusted execution environment (Trusted Execution Environment, TEE) needs to be implemented in the processor.

[0003] In related technologies, the processor needs to cooperate with the corresponding hardware structure to implement the TEE. Typical solutions are, for example, ARM TrustZone and Intel SGX.

[0004] However, this method requires a supporting hardware structure, so the resource overhead is large when implemented on a RISC-V processor, and it is not suitable for RISC-V processors that have been widely used in the market. SUMMARY

[0005] The present application provides a method, device and storage medium for running a program on a RISC-V processor, which realizes the safe running of the program without changing the hardware structure.

[0006] In one aspect, the present application provides a method for running a program on a RISC-V processor, comprising:

[0007] obtaining a target program to be run and a configuration file corresponding to the target program; wherein the configuration file at least includes resource address information corresponding to each virtual region, the virtual region being obtained by dividing sub-functions included in the overall function to be implemented by the target application program, and the resource address information corresponding to each virtual region being used to indicate the resource address that can be used by each virtual region in the available resources of the RISC-V processor;

[0008] setting a register corresponding to each virtual region, and configuring the register corresponding to each virtual region according to the configuration file, so that each virtual region corresponds to the resource that can be used in the available resources of the RISC-V processor;

[0009] compiling the target program to obtain a firmware that can run on the divided multiple virtual regions; wherein the compiled firmware includes a series of operation instructions belonging to different sub-functions;

[0010] The firmware is run, and during the running process, whenever an operation instruction corresponding to a sub-function is run, the target operation instruction run to is controlled to use the resource corresponding to the first target virtual area to which the target sub-function belongs.

[0011] In another aspect, the application provides a RISC-V processor application running device, comprising a memory and a processor, the memory is used to save an executable program;

[0012] The processor is used to read and execute the executable program to realize the method for running a program on a RISC-V processor.

[0013] In another aspect, the application provides a storage medium, comprising computer executable commands stored on the storage medium, the computer executable commands are used to execute the method for running a program on a RISC-V processor.

[0014] Compared with the related art, the embodiments of the application divide the sub-functions contained in the overall function to be realized by the target program into multiple virtual areas, divide the available resources of the RISC-V processor, control the multiple virtual areas through the register, edit the target program in a way that it can run on the multiple virtual areas, and generate firmware, so that when the firmware is run, the operation instructions of each sub-function can be limited in the virtual area corresponding to the sub-function, and the execution is performed using the resource corresponding to the virtual area, thereby realizing the separation of resources according to functions, reducing the attack surface, and realizing the safe running of the program without changing the hardware structure.

[0015] Other features and advantages of the application will be set forth in the following description, and in part will become apparent to those skilled in the art from the description, or can be learned by practice of the application. Other advantages of the application will be realized and attained by the embodiments of the application described in the specification and claims. BRIEF DESCRIPTION OF DRAWINGS

[0016] The accompanying drawings are included to provide an understanding of the application technical scheme, and constitute a part of the specification, and are used together with the embodiments of the application to explain the application technical scheme, and do not constitute a limitation on the application technical scheme.

[0017] Figure 1 A flowchart of a method for running on a RISC-V processor according to an embodiment of the application is shown in the figure;

[0018] Figure 2 A structure diagram of a multi-area security system of a RISC-V architecture processor according to an embodiment of the application is shown in the figure;

[0019] Figure 3A RISC-V architecture privilege mode schematic diagram for an embodiment of the present application;

[0020] Figure 4 A multi-region security system kernel module structure schematic diagram for an embodiment of the present application;

[0021] Figure 5 A multi-region security system API module structure schematic diagram for an embodiment of the present application;

[0022] Figure 6 A security firmware generation process schematic diagram for an embodiment of the present application. DETAILED DESCRIPTION

[0023] A number of embodiments are described herein, but they are just examples and are not limiting, and it will be apparent to those of ordinary skill in the art that many more embodiments and implementations can be made within the scope of the embodiments described herein. Although a number of possible combinations of features have been set forth herein, many other combinations of the disclosed features can be made. Any feature of any embodiment can be used in combination with any other feature or element of any other embodiment, or in replacement of any other feature or element of any other embodiment, unless specifically restricted otherwise.

[0024] The present application includes and contemplates combinations of features and elements known to those of ordinary skill in the art. The embodiments, features, and elements disclosed herein can also be combined with any conventional features or elements to form unique inventive solutions that are within the scope of the claims. Any feature or element of any embodiment can also be combined with features or elements from other inventive solutions to form another unique inventive solution that is within the scope of the claims. Therefore, it should be understood that any feature shown and / or discussed in this application can be used, alone or in any combination, with the only limitations being set forth in the accompanying claims and their equivalents. The embodiments are not otherwise limited, except as by the appended claims and their equivalents. Moreover, various modifications and changes can be made within the scope of the following claims.

[0025] Furthermore, in describing representative embodiments, the specification can have presented the method and / or process as a particular sequence of steps. However, to the extent that the method or process depends on the particular order of steps, this description should not be construed as limiting because other steps can be performed in other sequences and / or omitted from the method or process. Therefore, the particular order of steps presented in the specification should not be construed as a limitation. Additionally, the claims should not be limited to the steps of the method and / or process in the order in which they are written, as other sequences of steps can be performed and remain within the spirit and scope of the embodiments described herein.

[0026] RISC-V architecture processors are increasingly used in general-purpose microcontrollers, and the annual shipment has reached millions of units. It becomes more and more difficult to protect these devices, because complex new requirements often need to add ready-made third-party software to meet. The RISC-V standard instruction set architecture (ISA) lacks the physical resources needed to provide trusted and untrusted separation functions, resulting in a larger attack surface and increasing the likelihood of security vulnerabilities. And with the wide application of open source RISC-V architecture chips, there is an increasing challenge to ensure that system programs, terminal parameters, security data and user data within the chip are not tampered with or illegally accessed. In order to solve the security threats faced, terminal chips usually need to provide a trusted execution environment (TEE) to ensure the security of data within the chip. At present, there are two typical schemes for terminal chips to implement a trusted execution environment (TEE):

[0027] One of them is the TrustZone technology of ARM architecture chips. ARM TrustZone is a hardware-based security function. It introduces two different permission protection domains, the secure area and the non-secure area, at the processor level by modifying the original hardware architecture. The processor only runs in one of the two environments at any time. At the same time, the two areas are completely hardware isolated and have different permissions. The application programs or operating systems running in the non-secure area are strictly limited in accessing the resources of the secure area, and vice versa, the programs running in the secure area can normally access the resources in the non-secure area.

[0028] Another one is Intel architecture new extension (Intel Software Guard Extensions, Intel SGX). Intel SGX is a new extension of Intel architecture, which adds a set of new instruction sets and memory access mechanisms to the original architecture. These extensions allow the application to implement a container called enclave, which divides a protected area in the address space of the application. The code and data in the container are protected from malicious software with special privileges.

[0029] However, both of these solutions require the processor itself to support the corresponding hardware architecture, so additional hardware structures need to be added, which is costly and not suitable for RISC-V architecture processors that have been widely used in the market.

[0030] Therefore, the embodiments of the present application provide a method for running on a RISC-V processor, as shown in the following Figure 1 The method comprises the following steps:

[0031] Step 101, obtaining a target program to be run and a configuration file corresponding to the target program; wherein the configuration file at least includes resource address information corresponding to each virtual area, the virtual area being obtained by dividing sub-functions included in the overall function to be implemented by the target application, and the resource address information corresponding to each virtual area being used to indicate the resource address that can be used by each virtual area in the available resources of the RISC-V processor;

[0032] Step 102, setting a register corresponding to each virtual area divided out, and configuring the register corresponding to each virtual area according to the configuration file, so that each virtual area corresponds to the resource that can be used in the available resources of the RISC-V processor;

[0033] Step 103, compiling the target program to obtain firmware that can run on the multiple virtual areas divided out; wherein the compiled firmware includes a series of operation instructions belonging to different sub-functions;

[0034] Step 104, running the firmware, and whenever running to the operation instruction corresponding to the sub-function in the running process, controlling the target operation instruction running to use the resource corresponding to the first target virtual area to which the target sub-function belongs.

[0035] In actual application, the target program to be run can be an application program, a system program, or any other type of program, and the embodiments of the present application do not limit this. The available resources of the RISC-V processor can be continuous memory resources for programs, data, peripherals, input / output (I / O), and interrupt sources.

[0036] The virtual areas are obtained by dividing sub-functions included in the overall function to be implemented by the target application program. The target application program includes how many sub-functions, and how many virtual areas can be divided, each sub-function corresponds to, that is, belongs to one virtual area. After the virtual area division is completed and the resource division is completed, the virtual area needs to be corresponded with the divided resources. The register stores information of resources that each virtual area can use in the available resources of the RISC-V processor, so that the virtual resources can be actually corresponded with the divided resources through register control.

[0037] The resource address information corresponding to each virtual area in the configuration file can also be called a separation strategy, which is used to divide the resources in the available resources of the RISC-V processor. The separation strategy in the configuration file can be parsed and configured by the RISC-V processor. The kernel will first determine whether the syntax rule agreed in advance in the configuration file is correct to determine whether to parse the separation strategy in the configuration file. If the syntax is correct, the kernel will start parsing and combining the existing link script to finally generate independent link scripts under each virtual area. Then, each virtual area is compiled and linked separately by combining the compilation configuration file and the link configuration file, and will not cross-reference with other areas. Finally, an independent binary file of each virtual area is generated, and after each virtual area generates its own independent binary file under the kernel processing, a third-party application is called to merge each area binary file with the required kernel resources, and the defined separation strategy is applied to generate a secure boot firmware image.

[0038] The virtual areas corresponding to the sub-functions include: virtual areas for a real-time operating system (RTOS) and tasks thereof, virtual areas for a communication stack, virtual areas for an encryption library interacting with a key, authentication, and a root of trust, and virtual areas for protecting access to various system resources in a bare-metal area.

[0039] The method for running on a RISC-V processor provided in the embodiments of the present application divides the overall function to be implemented by a target program into a plurality of virtual regions, divides the available resources of the RISC-V processor, controls the plurality of virtual regions through registers, and edits the target program to generate firmware in a manner that the target program can run in the plurality of virtual regions, so that when the firmware is run, the operation instructions of each sub-function can be limited in the virtual region corresponding to the sub-function, and the resources corresponding to the virtual region are used for execution, thereby realizing the separation of resources according to functions, reducing the attack surface, and realizing the safe running of the program without changing the hardware structure.

[0040] The method for running on a RISC-V processor provided in the embodiments of the present application proposes a solution for the problems in the related art and the security and separation required by the RISC-V architecture processor in actual application. The method does not need to redesign the existing hardware and software, but only needs to configure corresponding logic to provide hardware-enforced software-defined separation for a plurality of same-level security regions in the chip, completely control data, programs and peripheral devices, realize unprecedented security, reduce cost, and improve the performance-price ratio and efficiency of guaranteeing the data security of the RISC-V architecture processor. Moreover, the method for running on a RISC-V processor provided in the embodiments of the present application is completely independent, exposes a very small attack surface, and is based on policy driving, which means that no coding or security professional knowledge is required, and has the characteristics of lightweight.

[0041] In an example, the resource access information of each virtual region is used to indicate the type of operation that can be performed by each virtual region using the corresponding resources; and the register corresponding to each virtual region includes a register corresponding to each virtual region and a control register.

[0042] The method further includes:

[0043] For each register corresponding to a virtual region, the following operations are performed:

[0044] The resource address information corresponding to the virtual region in the configuration file is configured in the address register corresponding to the virtual region, and the resource access information corresponding to the virtual region in the configuration file is configured in the control register corresponding to the virtual region.

[0045] The resources available to each virtual region in the RISC-V processor are controlled by the address register corresponding to each virtual region, and the types of operations that can be performed by each virtual region in its corresponding resources are controlled by the control register corresponding to each virtual region, so that each virtual region can use the resources available to it and how to use the resources available to it.

[0046] In an exemplary instance, the compiled firmware further comprises: execution address information corresponding to each operation instruction; and the target operation instruction to which the control is run uses the resources corresponding to the first target virtual region to which the target sub-function belongs, including:

[0047] According to the execution address information corresponding to the target operation instruction, and according to the address register corresponding to each virtual region, the first target virtual region corresponding to the target sub-function is determined, and the target operation instruction to which the control is run uses the resources corresponding to the first target virtual region according to the control register corresponding to the first target virtual region.

[0048] Since the firmware is generated in a manner that the target program can run on the divided multiple virtual regions, and each sub-function corresponds to a virtual region, and each virtual region corresponds to a specific resource address, the generated firmware not only includes a series of operation instructions that need to be executed, but also includes execution address information corresponding to each operation instruction.

[0049] In an exemplary instance, the target operation instruction to which the control is run uses the resources corresponding to the first target virtual region according to the execution address information corresponding to the target operation instruction, and according to the address register corresponding to each virtual region, the first target virtual region corresponding to the target sub-function is determined, and the target operation instruction to which the control is run uses the resources corresponding to the first target virtual region according to the control register corresponding to the first target virtual region.

[0050] First, according to the execution address information of the target operation instruction and the resource address information in the address register corresponding to each virtual region, the virtual region corresponding to the resource address information to which the execution address information of the target operation instruction falls is determined, and the determined virtual region is taken as the first target region;

[0051] Secondly, access control information is obtained from the control register corresponding to the first target virtual region, and when it is determined that the target operation instruction can be executed according to the obtained access control information, the target operation instruction to which the control is run uses the resources corresponding to the first target virtual region.

[0052] Since each virtual region's address register controls the resources that each virtual region can use, whenever a target operation instruction is executed, it is determined which virtual region (i.e., the first target virtual region) the execution address information of the target operation instruction falls into, and it is determined whether the virtual region can perform the corresponding type of operation. The type of operation that can be performed is determined by the information in the control register corresponding to the virtual region. Therefore, according to the access control information obtained from the control register corresponding to the virtual region, it is determined whether the target operation instruction can be executed on the virtual region. When it is determined that the target operation instruction can be executed, the target operation instruction being executed uses the resources corresponding to the first target virtual region. When it is determined that the target operation instruction cannot be executed, an access exception is triggered.

[0053] In actual applications, the access to the address register and the control register can be performed through an access interface provided by the kernel of the RISC-V processor.

[0054] In an exemplary example, the resource address information corresponding to each virtual region includes a resource start address and a resource size corresponding to each virtual region.

[0055] Correspondingly, the address register corresponding to each virtual region includes a start address register and an end address register.

[0056] The configuration of the resource address information corresponding to the virtual region in the configuration file in the address register corresponding to the virtual region includes:

[0057] First, the resource end address corresponding to the virtual region is obtained according to the resource start address and the resource size corresponding to the virtual region in the configuration file.

[0058] Second, the resource start address corresponding to the virtual region is configured in the start address register corresponding to the virtual region, and the resource end address corresponding to the virtual region is configured in the end address register corresponding to the virtual region.

[0059] For a resource division mode in which resources are divided into different virtual regions in a continuous resource address, for two virtual regions with continuous resource addresses, the resource end address in the former end address register is the resource start address in the latter end address register.

[0060] In an exemplary example, whenever a sub-function corresponding operation instruction is executed during the running of the firmware, the method further includes:

[0061] Control each virtual area except the first target virtual area to keep in a listening state.

[0062] In practical applications, the control logic preset by the kernel of the RISC-V processor can be used to control each virtual area except the first target virtual area to keep in a listening state.

[0063] In an exemplary instance, the running process of the firmware further includes: the first target virtual area sends the execution result of the target operation instruction to the second target area, and after the control of the running target operation instruction uses the resource corresponding to the first target virtual area to which the running target sub-function belongs, the method further includes:

[0064] First, control the first target virtual area to send the execution result of the target operation instruction to the second target virtual area;

[0065] Second, when the second target virtual area listens to the execution result from the first target virtual area, control the second target virtual area to receive and use in subsequent execution of operation instructions on itself.

[0066] Each virtual area respectively implements a corresponding sub-function, but there may be a need to use the execution result of the previous operation instruction in the execution of an operation instruction between different sub-functions, and two operation instructions may be executed by two virtual areas, so the execution result of the operation instruction needs to be transmitted from one virtual area to another. Taking the virtual area transmitting the execution result as the first target virtual area and the virtual area needing the execution result as the second target virtual area as an example, the running process of the firmware further includes: the first target virtual area sends the execution result of the target operation instruction to the second target area. And in practical applications, the control logic preset by the kernel of the RISC-V processor can be used to control the second target virtual area to receive when the second target virtual area listens to the execution result from the first target virtual area.

[0067] In an exemplary instance, after the control of the second target virtual area to receive, the method further includes:

[0068] Control the second target area to return information that the execution result has been received to the first target area.

[0069] In an exemplary instance, the interaction between the first target area and the second target area is performed by calling the security interface provided in advance by the kernel layer of the RISC-V processor.

[0070] In an example, each virtual area corresponds to a frame header information for identifying its own identity, and before the control of the first virtual area sends the execution result of the target operation instruction to the second target virtual area, the method further comprises:

[0071] The control of each virtual area sends its own frame header information to other virtual areas and receives the frame header information sent by other areas, so that all virtual areas determine the identities of each other.

[0072] After the function configuration of each virtual area is configured in a mode similar to a background service, the secure communication layer provided by the kernel configures relevant logic to use system API interfaces in the aspect of secure communication for communication between areas. The receiving API interface is used in the area that needs to receive information, and the frame header information of other virtual areas is received in a loop. At the same time, the sending API interface is used in the area that sends information, and the frame header information is sent in a loop. After the frame header information of the two areas to be communicated corresponds, the identity of the other party is determined, and communication can be started.

[0073] The embodiment of the application also provides a multi-area secure system applied to a RISC-V architecture processor. The system is based on a physical memory protection mechanism (PMP) and a multi-layer privilege model of a RISC-V architecture processor core, virtually generates a plurality of isolated executable domains (zones), and thus realizes a trusted execution environment (TEE) on the RISC-V architecture processor. The system is suitable for RISC-V architecture series processors, realizes software-controlled security through the idea of isolation mechanism, and the system is a RISC-V processor core module supporting the PMP mechanism and the multi-layer privilege mode, a multi-area secure system kernel module, and a multi-area secure system configuration module.

[0074] A structure diagram of the multi-area secure system of the RISC-V architecture processor can be as shown in Figure 2 The multi-area secure system runs on a 32-bit or 64-bit RISC-V processor with a PMP mechanism. The system kernel module uses the secure communication of the kernel, a hardware separation strategy and other components to assist the partitioning of a user program, that is, a virtual area 1, a virtual area 2 and a virtual area 3, and finally realizes the isolation of corresponding peripheral resources in each area, that is, the virtual area 1 corresponds to a peripheral 1, the virtual area 2 corresponds to a peripheral 2, and the virtual area 3 corresponds to a peripheral 3. At the same time, under the action of the multi-area secure system configuration module, the hardware separation strategy and other components are called to complete the generation of a secure firmware.

[0075] 2.1 RISC-V processor core module

[0076] The RISC-V instruction set architecture standard is divided into two parts, one is a non-privileged instruction set architecture, and the other is a privileged instruction set architecture. It is because of the existence of the privileged instruction set architecture that an additional permission management mechanism is provided on the hardware, so as to limit the behavior of ordinary application code and prevent attacks by malicious code.

[0077] A RISC-V architecture privilege mode schematic diagram can be as shown in Figure 3 Machine mode, supervisor mode and user mode, machine mode corresponds to platform running firmware, supervisor mode corresponds to an operating system (OS), and user mode corresponds to an application program (APP). The PMP mechanism is used to protect the upper layer software in the machine mode.

[0078] Machine mode (Machine Mode) is sufficient for simple embedded systems, which provides an administrator execution environment (SEE) that can freely access the hardware platform and run platform firmware, so it is only suitable for those cases where the entire code base is trusted. The multi-region secure system software architecture is complete, but it cannot be proven correct in all aspects in advance, so the processor cannot trust all application code. Therefore, in order to provide a mechanism to protect the system from untrusted code and provide isolation protection for untrusted processes, the RISC-V processor kernel module adds an additional permission mode, user mode (User / Application Mode), to prohibit untrusted code from executing privileged instructions (such as the mret instruction) and accessing privileged control state registers (such as the mstatus register). At the same time, by encoding mstatus.MPP as 0 and then executing the mret instruction, software can enter user mode from machine mode. If an exception occurs in user mode, the RISC-V processor kernel module transfers control to machine mode for processing.

[0079] The multi-region secure system kernel module is a software-controlled isolation mechanism, so the RISC-V processor kernel module needs to limit these untrusted codes to access the memory within the respective region, and in the machine mode, it can specify the memory address that the user mode can access, and the RISC-V processor kernel module implements the physical memory protection (PMP) mechanism. The RISC-V processor kernel module sets several address registers (usually 8 to 16) and corresponding configuration registers for the PMP mechanism, which are used to configure read, write and execution permissions. The address register configures the address as a reference address, when the processor is in user mode, the address and all PMP address registers are compared, if the address is greater than or equal to PMP address register N, but less than PMP address register N+1, then the N+1 configuration register of PMP (equivalent to the control register in the above embodiment) determines whether this access can continue, if not, it will trigger an access exception.

[0080] 2.2 Multi-region secure system kernel module

[0081] The structure of the multi-region secure system kernel module is shown in Figure 4 It includes hardware initialization, parsing separation strategy, configuring PMP registers, system API layer and secure communication layer.

[0082] The kernel will perform hardware initialization according to the current application requirements and the peripheral modules (serial module) to be used, and at the same time, it will decompose the traditional complete firmware into several different functional modules, called "regions", each region is implemented in an independent main program, and through relevant logic, its function is configured into a mode similar to a background service, and its code is wrapped into a simple loop, i.e. the role of a listener, which receives input messages (requests) from other regions, processes the input according to some internal logic, returns a return message with a call (response) output, and then returns to a sleep state, waiting for the next request. A typical region is divided into: one region for RTOS and its tasks, one region for communication stack (by definition, communication stack is vulnerable to remote attacks), one region for encryption library interacting with key, authentication and trust root, and some bare-metal regions for protecting access to various system resources (such as peripherals and I / O).

[0083] The parsing separation strategy is around the configuration file in the multi-region secure system configuration module that provides the separation strategy. The kernel determines whether to parse the separation strategy in the configuration file by judging whether the syntax in the configuration file is pre-agreed. If the syntax is correct, the kernel starts parsing and combines the existing link script to finally generate independent link scripts under each region. Then, each region is compiled and linked separately without cross-referencing with other regions by combining the compilation configuration file and the link configuration file, and finally, the independent binary file of each region is generated. Meanwhile, the kernel can identify the language type in each region to call the corresponding tool chain and different versions of the compiler and library for compilation.

[0084] During the parsing of the separation strategy, the memory mapping information of each region is output. The kernel configures the corresponding PMP address register and PMP configuration register according to the information. The PMP address register is configured as the memory base address of each region, and the PMP configuration register is configured to control the access permission of each region.

[0085] After the function configuration of each region is configured in the mode similar to the background service, the secure communication layer provided by the kernel configures the related logic to use the system API interface for secure communication to communicate between regions. The receiving API interface is used in the region that needs to receive information, and the frame header information is continuously received. Meanwhile, the sending API interface is used in the region that needs to send information, and the frame header information is continuously sent. After the frame header information of the two regions to be communicated corresponds, the communication can start. Each region needs to set the frame header belonging to the region to communicate.

[0086] The API module is part of the kernel module, and the API interface used by the secure communication layer is also implemented by the API module. The API module provides an interface for users to use part of the functions of the embodiments of the application, such as using the secure communication function in the kernel. The structure diagram of the multi-region secure system API module is shown in Figure 5 The system API layer in the kernel provides four groups of API interfaces of hardware thread scheduling, secure message passing, timer management, and access to high-performance access privilege registers. These API interfaces are not implemented in the form of static or dynamic libraries that need to have a shared memory structure such as a stack. Instead, only a static C header file is provided, which contains macro expansion of assembly code. The hardware thread scheduling API interface embeds ecall instruction assembly, the secure message passing API interface embeds mv, li, and ld instruction assembly, the timer management API interface embeds li and mv instruction assembly. The access privilege register API interface does not access the CSR register by embedding the CSR instruction, but embeds li and mv instruction assembly and related logic to achieve fast access.

[0087] 2.3 Multi-region secure system configuration module

[0088] After the application is decomposed into separate regions and the functions of the regions are configured in a mode similar to a background service, a simple plain text file is defined in the multi-region secure system configuration module to define the overall hardware separation strategy for the entire system, which is subsequently provided to the kernel for parsing. The text can contain some memory mapping resources allocated for each region, which are identified by any combination of start address, size, and read / write / execute attributes. The resources include contiguous memory regions for programs, data, peripherals, I / O, and interrupt sources. The configuration text also defines the tick time of the pre-emptive kernel.

[0089] Meanwhile, after each region generates its own independent binary file under kernel processing, the multi-region secure system configuration module calls a third-party application to merge each region binary file with the required kernel resources and apply the defined separation strategy to generate a secure boot firmware image. The secure firmware generation process can be as shown in Figure 6 The multi-region secure system configuration module uses the virtual region binary file, the hardware-based separation strategy, and the single signed firmware image combined with kernel runtime conversion to call the multi-region tool chain to complete the generation of the secure firmware.

[0090] To meet the needs of increasing security and separation for RISC-V architecture processors, the embodiments of the present application propose a multi-region secure system applied to RISC-V architecture processors. The system only needs to configure the corresponding logic of the upper layer to provide hardware-enforced software-defined separation for multiple same-level secure regions within the chip, completely control data, programs, and peripherals, and achieve unprecedented security. The system is completely independent, exposes a minimal attack surface, and is policy-driven, which means that no coding or security expertise is required, has a lightweight feature, and does not require redesigning existing hardware and software, reducing complexity and cost and enhancing portability.

[0091] The embodiments of the present application also provide a device for running a program on a RISC-V processor, including a memory and a processor, the memory is used to save an executable program;

[0092] The processor is used to read and execute the executable program to realize the method for running a program on a RISC-V processor as described in any of the above embodiments.

[0093] The device for running on a RISC-V processor provided by the embodiments of the present application divides sub-functions contained in the overall function to be implemented by a target program into a plurality of virtual regions, divides the available resources of the RISC-V processor, controls the plurality of virtual regions through registers, and edits the target program to generate firmware in a manner that the target program can run in the plurality of virtual regions, so that when the firmware is run, the operation instructions of each sub-function can be limited in the virtual region corresponding to the sub-function, and the resources corresponding to the virtual region are used for execution, thereby realizing the separation of resources according to functions, reducing the attack surface, and realizing the safe running of the program without changing the hardware structure.

[0094] The embodiments of the present application also provide a storage medium, including: computer executable commands stored on the storage medium, the computer executable commands being used to execute the program running method on the RISC-V processor as described in any of the above embodiments.

[0095] Those skilled in the art can understand that all or some steps in the above disclosed method, the functions of the modules / units in the system and the device can be implemented as software, firmware, hardware and appropriate combinations thereof. In the hardware implementation, the division between the functional modules / units mentioned in the above description does not necessarily correspond to the division of physical components; for example, one physical component can have multiple functions, or one function or step can be performed by several physical components in cooperation. Some or all of the components can be implemented as software executed by a processor, such as a digital signal processor or a microprocessor, or as hardware, or as an integrated circuit, such as an application specific integrated circuit. Such software can be distributed on a computer readable medium, which can include computer storage media (or non-transitory media) and communication media (or transitory media). As known to those skilled in the art, the term computer storage media includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storage of information such as computer readable instructions, data structures, program modules or other data. Computer storage media includes, but is not limited to, RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital versatile disks (DVD) or other optical disk storage, magnetic cassettes, magnetic tapes, magnetic disk storage or other magnetic storage devices, or any other medium that can be used to store desired information and can be accessed by a computer. In addition, as known to those skilled in the art, communication media generally includes computer readable instructions, data structures, program modules or other data in modulated data signals such as carrier waves or other transmission mechanisms, and can include any information delivery medium.

Claims

1. A method for running a program on a RISC-V processor, characterized in that, include: Obtain the target program to be run and the configuration file corresponding to the target program; wherein, the configuration file includes at least: resource address information corresponding to each virtual region, the virtual region is obtained by dividing it according to the sub-functions included in the overall function to be implemented by the target program, and the resource address information corresponding to each virtual region is used to indicate the resource address that each virtual region can use in the available resources of the RISC-V processor; Set up registers corresponding to each virtual region and configure the registers corresponding to each virtual region according to the configuration file so that each virtual region corresponds to the resources that can be used in the available resources of the RISC-V processor; The target program is compiled to obtain firmware that can run on the divided virtual regions; wherein the compiled firmware includes a series of operation instructions belonging to different sub-functions; The firmware is run, and during the operation, whenever the operation instruction corresponding to the sub-function is executed, the target operation instruction is controlled to use the resources corresponding to the first target virtual area to which the target sub-function belongs.

2. The method according to claim 1, characterized in that, The configuration file also includes: resource access information for each virtual region, which indicates the type of operation that each virtual region can perform using the corresponding resources; correspondingly, the registers for each virtual region include: an address register and a control register for each virtual region. The step of configuring the registers corresponding to each virtual region according to the configuration file includes: For each virtual region's corresponding register, the following operations are performed: Configure the resource address information corresponding to the virtual region in the configuration file into the address register corresponding to the virtual region, and configure the resource access information corresponding to the virtual region in the configuration file into the control register corresponding to the virtual region.

3. The method according to claim 2, characterized in that, The compiled firmware also includes: execution address information corresponding to each operation instruction; the resources corresponding to the first target virtual region to which the target operation instruction to be executed uses the resources of the target sub-function to which the instruction is executed, including: Based on the execution address information corresponding to the target operation instruction, and based on the address registers corresponding to each virtual region, the first target virtual region corresponding to the target sub-function is determined, and based on the control register corresponding to the first target virtual region, the target operation instruction being executed is controlled to use the resources corresponding to the first target virtual region.

4. The method according to claim 3, characterized in that, The step of determining the first target virtual region corresponding to the target sub-function based on the execution address information corresponding to the target operation instruction and the address registers corresponding to each virtual region, and controlling the target operation instruction to use the resources corresponding to the first target virtual region based on the control registers corresponding to the first target virtual region, includes: Based on the execution address information of the target operation instruction and the resource address information in the address register corresponding to each virtual region, determine the virtual region corresponding to the resource address information into which the execution address information of the target operation instruction falls, and take the determined virtual region as the first target virtual region; Access control information is obtained from the control register corresponding to the first target virtual region, and when it is determined that the target operation instruction can be executed based on the obtained access control information, the target operation instruction is controlled to use the resources corresponding to the first target virtual region.

5. The method according to claim 2, characterized in that, The resource address information for each virtual region includes: the starting address and size of the resource for each virtual region; Accordingly, the address registers for each virtual region include: a start address register and an end address register; The step of configuring the resource address information corresponding to the virtual region in the configuration file into the address register corresponding to the virtual region includes: The resource termination address corresponding to the virtual region is obtained based on the resource start address and resource size corresponding to the virtual region in the configuration file. Configure the resource start address corresponding to the virtual region in the start address register corresponding to the virtual region, and configure the resource end address corresponding to the virtual region in the end address register corresponding to the virtual region.

6. The method according to claim 1, characterized in that, During the operation of the firmware, whenever the operation instruction corresponding to a sub-function is executed, the method further includes: Control each virtual region except the first target virtual region to maintain a listening state.

7. The method according to claim 6, characterized in that, The firmware operation process further includes: the first target virtual region sending the execution result of the target operation instruction to the second target virtual region; after the target operation instruction being executed uses the resources corresponding to the first target virtual region to which the executed target sub-function belongs, the method further includes: The first target virtual region is controlled to send the execution result of the target operation instruction to the second target virtual region; When the second target virtual region detects the execution result from the first target virtual region, it controls the second target virtual region to receive the result so that it can be used when executing operation instructions on itself in the future.

8. The method according to claim 7, characterized in that, After controlling the second target virtual region to receive the data, the method further includes: The second target virtual region is controlled to return information indicating that the execution result has been received to the first target virtual region.

9. The method according to claim 8, characterized in that, The interaction between the first target virtual region and the second target virtual region is performed by calling a security interface pre-provided by the kernel layer of the RISC-V processor.

10. The method according to claim 7, characterized in that, Each virtual region corresponds to a frame header information used to identify its own identity. Before the first target virtual region sends the execution result of the target operation instruction to the second target virtual region, the method further includes: Each virtual region is controlled to send its own frame header information to other virtual regions and receive frame header information sent by other regions, so that all virtual regions can identify each other.

11. A device for running programs on a RISC-V processor, characterized in that, include: A memory and a processor, wherein the memory is used to store an executable program; The processor is used to read and execute the executable program to implement the method of running the program on a RISC-V processor as described in any one of claims 1-10.

12. A storage medium, characterized in that, include: The storage medium stores computer-executable commands for executing the program as described in any one of claims 1-10 on a RISC-V processor.

Images