Implementation and verification method for RISC-V physical memory protection mechanism

Abstract

The invention discloses an implementation method for an RISC-V physical memory protection mechanism, and the method comprises the following steps: analyzing a physical memory protection mechanism module structure and the input and output of a module according to an RISC-V ISA standard, designing a module framework according to document requirements, and implementing the module by using a SystemVerilog language; performing property analysis on the PMP module according to the ISA specification, classifying the properties obtained by analysis, and describing the properties by using a formalized language; and based on the realized physical memory protection module, combining with the extracted properties, performing formalized verification on the properties by using an assertion-based formalized verification tool Symbiyosys, and integrating verification results to ensure the correctness of the RISC-V physical memory protection mechanism.

Description

Technical Field

[0001] The present invention belongs to the field of memory security technology, and specifically relates to an implementation and verification method for a RISC-V physical memory protection mechanism. Background Art

[0002] With the rapid development of mobile Internet and cloud computing technologies, more and more data are stored, shared and calculated in cloud environments. Therefore, data security and privacy protection in cloud environments have become hot issues of concern to academia and industry. Traditional privacy protection technologies are mainly based on cryptographic algorithms and protocols, such as secure multi-party computing and homomorphic encryption. Although these technologies have high security and reliability, they are difficult to apply on a large scale in actual scenarios due to the performance bottleneck of complex computing.

[0003] As an alternative, the Trusted Execution Environment (TEE) was created. TEE is an independent processing environment with computing and storage functions. It allocates an isolated memory for sensitive data in the hardware, and all sensitive data calculations are performed in this memory. Except for authorized interfaces, other parts cannot access the information in this isolated memory, thereby achieving privacy computing of sensitive data.

[0004] RISC-V is an open standard instruction set architecture (ISA) based on established Reduced Instruction Set Computer (RISC) principles. Unlike most other ISA designs, RISC-V is provided under a free open source license. Physical Memory Protection (PMP) is a standard RISC-V feature that allows firmware to specify physical memory regions and control memory access permissions. Many systems have adopted PMP to protect memory regions of privileged binaries (such as firmware) or devices. For example, PMP is used to allow firmware to protect its own memory regions when the machine boots. PMP is also used in the RISC-V-based trusted execution environment Keystone, which uses multiple PMP entries to isolate each enclave from the rest of the system (including the privileged operating system) and manage shared memory regions. Keystone utilizes multiple PMP rules (such as whitelist-based or priority address matching) to implement flexible memory isolation schemes. Therefore, it can be said that the entire security guarantee of Keystone relies on the functional correctness of PMP. Summary of the invention

[0005] In order to ensure the security of systems such as Keystone, it is necessary to first formally verify PMP. At the same time, since the implementation of RISC-V's PMP mechanism is different between different processors, such as out-of-order execution and cache consistency strategy, different PMP implementations bring difficulties to the verification work. To facilitate the verification of the RISC-VPMP mechanism, the present invention develops a standard RISC-V PMP module based on the RISC-V ISA specification document, and formally verifies the RISC-VPMP mechanism based on the module.

[0006] The design and verification method for the RISC-V physical memory protection mechanism of the present invention comprises the following steps:

[0007] Step 1: According to the RISC-V ISA document specifications, carefully study the functions and requirements of the PMP module and determine the basic functions and information of the PMP module;

[0008] Step 2: Based on the information in step 1, design the overall structure and interface of the PMP module, determine the internal state, control signals and data paths of the module, build the module framework, and implement the PMP module using the SystemVerilog language;

[0009] Step 3: According to the RISC-V ISA document specification, perform property analysis on the PMP module, classify the properties obtained by the analysis, and extract PMP abstract assertions based on the properties;

[0010] Step 4: Perform simulation based on the implemented PMP module;

[0011] Step 5: Based on the PMP module verified by simulation and combined with abstract assertions, build an assertion-based physical memory protection mechanism module.

[0012] In the design and verification method for the RISC-V physical memory protection mechanism described in the present invention, step 1 includes:

[0013] Extract RISC-V PMP related information based on RISC-V ISA, obtain the basic functions and application scenarios of the module, analyze the functions of the relevant registers of the PMP module, and analyze its basic functions and principles.

[0014] In the design and verification method for the RISC-V physical memory protection mechanism described in the present invention, the step 2 includes:

[0015] Based on the basic information of PMP, sort out the PMP functions, determine the input and output, data path, control signal and other information of the module, and determine the overall framework of the module.

[0016] For RISC-V PMP, its functions can be divided into two parts: one is the register control part, and the other is the memory access request part. For these two cases, corresponding input controls need to be designed to distinguish them.

[0017] For the register control part: the input of this part is the current privileged mode, the register group number to be modified, the control register and data register information to be modified; the output is whether the register modification is successful. The basic function of this module is to modify the specified PMP register group according to the input information. It specifically includes the following steps:

[0018] Step A1: Check the current privilege mode and only allow configuration in M ​​mode;

[0019] Step A2: Check the lock status of the PMP register group to be configured, and refuse to modify if the register group is locked;

[0020] Step A3: Check whether the next register group of the PMP register group to be configured is in TOR mode and locked. If this condition is met, the PMP register configuration is rejected.

[0021] For the memory access request part: the input of this part is the current privileged mode, the base address of the memory access, the size of the memory access area, and the permissions required for the memory access; the output is whether the memory access is allowed. The basic function of this module is to judge the access request based on the PMP register group. It specifically includes the following steps:

[0022] Step B1: Perform address matching on the first address of this access, and match according to the priority between PMP register groups. Determine the register group that matches the access base address.

[0023] Step B2: On the premise that the register group has been matched, the access end address is matched again to confirm whether the first address and the end address are matched in the same register group.

[0024] Step B3: If the accessed first address and the end address are both under the PMP register group, it is necessary to check whether the address space between the first address and the end address is covered by a higher priority PMP register.

[0025] Step B4: After the address matching is completed, it is necessary to further check whether the XWR permission of this memory access matches the PMP register group. Only when the permission matches, the memory access is allowed.

[0026] In privileged mode, memory address access must follow the following rules:

[0027] In M mode, if no PMP register is matched during the address matching process, C1 allows the match; in S / U mode, access is denied.

[0028] C2 is in M ​​mode. If the matched PMP register is not locked, there is no need to perform the read / write permission check step B4. If the matched PMP register is locked, a read / write permission check is still required, and step B4 is executed.

[0029] In the design and verification method for the RISC-V physical memory protection mechanism described in the present invention, the step three further includes the following steps:

[0030] Based on ISA, the properties involved in RISC-V PMP are classified into the following categories:

[0031] D1 allows all memory accesses when the PMP register set is not configured

[0032] D2 Properties that need to be met when configuring the PMP register group

[0033] The properties that D3 memory access needs to satisfy

[0034] The properties that need to be satisfied within the PMP module implemented by D4

[0035] Further refinement of these classifications yields the following properties:

[0036] D1 classification includes the following properties:

[0037] When the PMP register set is not configured, the PMP does not perform memory protection, and all PMP registers are allowed to be accessed.

[0038] For RISC-V, PMP is a memory protection extension that is not required to be enforced, so all accesses are allowed if the PMP register is not configured.

[0039] The D2 classification includes the following properties:

[0040] E1 does not allow register group modification in non-M mode

[0041] The PMP register set can only be modified in privileged mode because the security of S / U mode cannot be guaranteed.

[0042] E2 does not allow modification of the register group when the register group to be modified is in the locked state

[0043] According to the RISC-V ISA rules, once the lock bit is set, the locked register group will remain unchanged during this operation until the hardware thread is reset.

[0044] E3 When the next register group of the register group to be modified is in the locked state and the addressing mode is TOR, modification of the address register of the register group is not allowed.

[0045] This property is related to the previous property. In the TOR addressing mode, the addressing address of the register group is based on the address register of the previous register group. Therefore, in order to ensure that the address range controlled by the register group remains unchanged, the address register of the previous register group is not allowed to be set.

[0046] The D3 classification includes the following properties:

[0047] The first and last addresses of F1 memory access are both located in the same register group.

[0048] During memory access, if the first address and the end address are not in the same register, it can be considered that the address range where the first address is located and the address range where the end address is located have different priorities; such access is not allowed for memory security.

[0049] The address range of the F2 memory access is not covered by a register group with a higher priority than the matched register group

[0050] Same as F1, if the address area between the first address and the end address is managed by a higher priority register group, access to the high priority memory area is not allowed to ensure memory security.

[0051] In F3 S / U mode, memory access requests must match the permission mode XWR of the register group.

[0052] In S / U mode, when executing memory access, the permissions required to be declared must match those in the register group, and unauthorized access is not allowed; in M ​​mode, there are special rules for processing.

[0053] In F4 M mode, if the register group is not locked, no permission check is required; if the register group is locked, a permission check is required

[0054] According to the RISC-V ISA specification, in M ​​mode, all permissions are granted to unlocked registers; for locked registers, permission checks are required even in M ​​mode.

[0055] F5 If the memory access does not match any register group, the access is allowed in M ​​mode; the access is denied in S / U mode

[0056] According to the RISC-V ISA specification, M mode allows it to obtain full permissions when it fails to successfully match the PMP register; in S / U mode, since PMP has been configured, it is not allowed to access unauthorized memory areas for memory security.

[0057] The D4 classification includes the following properties:

[0058] The logical relationship between the register groups within the implemented module needs to be satisfied.

[0059] In the specific implementation module, some auxiliary registers may be used to optimize performance. After adding these auxiliary registers, it is necessary to ensure that they do not affect the functional integrity and correctness of the PMP itself.

[0060] In the design and verification method for the RISC-V physical memory protection mechanism described in the present invention, the step 4 further includes the following steps:

[0061] Step G1: Design multiple groups of corresponding test cases for the constructed RISC-V physical memory protection mechanism model and RISC-V ISA;

[0062] Step G2: Use the designed test cases to perform simulations, record the simulation results, and compare them with the expected results;

[0063] Step G3: If the simulation results are consistent with the expected results, it is considered that the constructed model meets the simulation verification requirements; if the simulation results are inconsistent with the expected results, the constructed RISC-V physical memory protection mechanism model needs to be modified.

[0064] In the design and verification method for the RISC-V physical memory protection mechanism described in the present invention, the step five further includes the following steps:

[0065] Step H1: for each property, generate a corresponding assertion and add it to the implemented physical memory protection module to generate an assertion module;

[0066] To ensure the independent correctness of assertions and modules, each assertion is combined with a module separately to facilitate adjustments during testing.

[0067] Step H2: For all properties, integrate a set of assertions to cover all properties, and add them to the implemented physical memory protection module to generate an integrated module.

[0068] To ensure the correctness of the module, verifying each property individually is not enough to explain the correctness of the module, and the module needs to be integrated with assertion verification.

[0069] Based on the above memory protection mechanism, the present invention also proposes a verification method for the RISC-V physical memory protection mechanism, including:

[0070] Use the assertion-based formal verification tool Symiyosys, combined with the assertion-based physical memory protection module developed in step 5, to perform formal verification and integrate the verification results. If the verification fails, it is necessary to determine whether it is a model error or an assertion error, and modify the assertion or model based on the result; if the verification passes, the security of the implemented PMP module is proven, and a PMP module that has been verified by the assertion is generated. Specifically, the following steps are included:

[0071] Step I1: For the single assertion module constructed in step 5, use the formal verification tool Symbiyosys to perform formal verification on it, verifying each module one by one.

[0072] Based on the idea of ​​unit testing, each assertion is verified.

[0073] Step I2: During the module verification process, if the assertion verification fails, the assertion itself or the model needs to be modified again; and after the modification, the module that has passed the previous verification needs to be updated and verified to ensure that the modified module is correct. It is also necessary to re-simulate to ensure the correctness of the module.

[0074] Based on the idea of ​​regression testing, when modifying a module or assertion, it may have an impact on the previously verified modules, and the verified parts need to be re-verified to ensure correctness.

[0075] Step I3: Formal verification of the integrated module is performed to ensure the correctness of the module after all assertions are integrated to ensure the correctness of the entire module.

[0076] To ensure the correctness of the module, the integrated module needs to be verified to resolve possible conflicts between different assertions and ensure the correctness of the module.

[0077] In the design and verification method for the RISC-V physical memory protection mechanism described in the present invention, the step I2 further includes the following steps:

[0078] Step J1: When a problem occurs during verification and verification fails, analyze the assertion module;

[0079] When verification fails, it is necessary to determine the cause of the failure and analyze whether it is an assertion error or a module error.

[0080] Step J2: After finding the root cause of the problem, return to modify the module or assertion;

[0081] After finding the cause of the error, if it is a module error, you need to modify the module based on RISC-V ISA; if it is an assertion error, you need to modify the assertion based on RISC-V ISA.

[0082] Step J3: Reintegrate the modified module or assertion and re-perform formal verification on the module.

[0083] After modifying the erroneous part, you need to reintegrate the assertion and the module, generate an assertion-based physical memory protection mechanism module, and use this module to re-verify.

[0084] The present invention discloses a design and formal verification method for a RISC-V physical memory protection mechanism. The method comprises the following steps: according to the RISC-V ISA specification, analyzing the module structure of the physical memory protection mechanism, the input and output of the module, designing the module framework according to the document requirements, and then implementing the module using the SystemVerilog language; according to the ISA specification, performing property analysis on the PMP module, and classifying the properties obtained by the analysis, and describing these properties using a formal language; based on the physical memory protection module that has been implemented, combined with the extracted properties, using the assertion-based formal verification tool Symbiyosys, formally verifying the properties, and integrating the verification results to ensure the correctness of the RISC-V physical memory protection mechanism. BRIEF DESCRIPTION OF THE DRAWINGS

[0085] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without paying any creative work.

[0086] Figure 1 This is an overall flow chart of the design and verification of the RISC-V physical memory protection mechanism of the present invention.

[0087] Figure 2 This is a flow chart of register group configuration for the RISC-V physical memory protection mechanism of the present invention.

[0088] Figure 3 This is a memory access flow chart of the RISC-V physical memory protection mechanism according to the present invention.

[0089] Figure 4 This is a simulation execution flow chart of the present invention for the RISC-V physical memory protection mechanism.

[0090] Figure 5This is an assertion verification flow chart of the present invention for the RISC-V physical memory protection mechanism.

[0091] Figure 6 This is a specific example of the simulation execution of the RISC-V physical memory protection mechanism of the present invention. DETAILED DESCRIPTION

[0092] The invention is further described in detail with reference to the following specific embodiments and drawings. The process, conditions, experimental methods, etc. for implementing the present invention, except for the contents specifically mentioned below, are all common knowledge and common common sense in the art and are not particularly limited by the present invention.

[0093] The present invention proposes a design and verification method for a physical memory protection mechanism for an open source RISC-V hardware architecture. The method first analyzes the physical memory protection mechanism according to the RISC-V ISA specification, implements a physical memory protection module using the SystemVerilog language according to the specification, extracts properties that the physical memory protection module needs to satisfy from the specification, and extracts abstract assertions based on the properties. Next, a test case is designed for the implemented physical memory protection module, and the correctness of the implemented module is verified by simulation execution. Then, the extracted assertions are combined with the implemented module to generate an assertion-based physical memory protection module, and the Symbiyosys formal verification tool is used to verify its correctness, and corresponding processing is performed according to the formal verification results until an assertion-verified physical memory protection module is generated.

[0094] The present invention proposes a design, implementation and verification method for RISC-V physical memory protection mechanism, which mainly analyzes the properties of RISC-V, verifies the RISC-V PMP module by using test cases for simulation verification and formal tools for assertion verification, and finally generates a physical memory protection module verified by assertion.

[0095] The present invention expands the analysis of RISC-V PMP security in existing research. In existing research, the security analysis of RISC-V physical memory protection mechanism mostly focuses on its upper-layer architecture trusted execution environment. There is a relative lack of research on the PMP module used for the specific implementation of the trusted execution environment. The few related studies do not consider the use of the physical memory protection mechanism in all scenarios. Based on the existing research and analysis, the present invention expands the analysis of RISC-V's physical memory protection mechanism, completes the implementation and verification of the RISC-V physical memory protection mechanism, and aims to fully perform a security analysis of the RISC-V physical memory protection mechanism.

[0096] like Figure 1As shown, the present invention comprises the following steps during implementation:

[0097] Step 1: According to the RISC-V ISA document specifications, carefully study the functions and requirements of the PMP module, determine the basic functions and information of the PMP module, analyze the basic structure of the module, including the registers, inputs, and outputs required by the module, and analyze the input and output relationship of the PMP module.

[0098] Step 2: Based on the information in step 1, design the overall structure and interface of the PMP module, determine the internal status, control signals and data paths of the module, divide the internal functions of the PMP into blocks, divide the specific implementation process into two parts: PMP register modification and memory access, and analyze the internal operation process of these two parts. Based on this, build a module framework and implement the PMP module using the SystemVerilog language;

[0099] Step 3: According to the RISC-V ISA document specification, combined with the input and output relationship of the PMP module and the possible logical relationship within the specific module implemented, the properties of the PMP module are analyzed, and the properties obtained by the analysis are classified according to the sub-modules to which they belong, and PMP abstract assertions are extracted based on the properties.

[0100] Step 4: Design test cases based on the implemented PMP module according to RISC-V ISA, and use these test cases to perform simulations to verify the correctness of the implemented module. If all test cases cannot pass, the implemented module needs to be modified until all test cases pass to verify the functional correctness of the module.

[0101] Step 5: Based on the implemented PMP module and the extracted abstract assertions, use SystemVerilogAssertion to insert abstract assertions into the implemented module, generate assertion modules corresponding to a single property and assertion modules integrating all properties, and build an assertion-based physical memory protection mechanism module.

[0102] The verification method for the RISC-V physical memory protection mechanism proposed in the present invention comprises the following steps:

[0103] Use the assertion-based formal verification tool Symiyosys, combined with the assertion-based physical memory protection module developed in step five, to perform formal verification on each module obtained, integrate the verification results, and process according to the correctness of the verification results. If there is a module that fails the verification, it is necessary to determine the reason for the failure, analyze whether it is an error in the implemented module or an error in the extracted properties, and make targeted modifications. After the modification is completed, regenerate the assertion module and perform formal verification. If the verification passes, the security of the implemented PMP module is proved, and a PMP module that has been verified by the assertion is generated.

[0104] Example 1

[0105] In this embodiment, Figure 4 The process shown is Figure 2 and Figure 3 The process is verified by simulating and executing a specific embodiment in step 4 to detect the correctness of the implemented physical memory protection mechanism.

[0106] The test designed in this embodiment is used for example Figure 6 As shown, the test cases designed first are as follows: configure the register group PMP0 address space 0x000000-0x001000, the lock bit is 0, the permission bit is read, and the privilege mode is M; the memory access starting address is 0x002000, the access space size is 0x001000, the privilege mode is S / U mode, and the access permission bits are read, write, and execute; the memory access starting address is 0x002000, the memory access size is 0x001000, the privilege mode is M mode, and the access permission bits are read, write, and execute.

[0107] The expected results for this test case are: the configuration of the register group passes smoothly, the first of the two memory accesses is rejected, and the second access passes.

[0108] Example 2

[0109] In this embodiment, Figure 5 As shown, the security check of the PMP physical memory protection module combined with the assertion is a specific implementation method of the verification method of the RISC-V physical memory protection mechanism. In this example, the property F5 extracted in step three is verified. F5 requires that for each memory access, if the accessed address space cannot match any configured PMP register, the privileged mode of this memory access is determined; this access is allowed in M ​​mode, and this memory access is denied in S / U mode. The specific steps are as follows:

[0110] Step I1: Use the Symiyosys formal verification tool to perform formal verification on the physical memory protection module that has been combined with the F5 property assertion in step 5 to obtain the verification result.

[0111] Step I2: Check the verification results. If the verification passes, it proves that the assertion module meets the formal verification requirements. If the verification fails, additional steps are required.

[0112] Step J1: When module verification fails, it is necessary to analyze whether the root cause of the failure is a problem in the set module or a problem in the designed assertion F5. After analysis, this embodiment has a problem in the module.

[0113] Step J2: Based on the analyzed problems, modify the relevant parts in the module and re-simulate and test.

[0114] Step J3: After the simulation execution passes, the assertion and the module are reintegrated into an assertion-based physical memory protection module, and the assertion verification is performed again;

[0115] Step I3: After the single module verification is passed, the integrated assertion module needs to be verified; and the possible property conflicts in the integrated module need to be analyzed and resolved.

[0116] The present invention focuses on proposing a method for realizing, analyzing and verifying the properties of the RISC-V physical memory protection mechanism. Successfully performing functional verification and security verification on the implemented model according to the steps in the embodiment helps to provide protection for RISC-V security, further confirm the security of RISC-V at the hardware level, and make the security architecture implemented on the RISC-V physical memory protection mechanism more reliable.

[0117] The protection content of the present invention is not limited to the above embodiments. Without departing from the spirit and scope of the inventive concept, changes and advantages that can be thought of by those skilled in the art are included in the present invention and are protected by the attached claims.

Claims

1. A method for implementing a RISC-V physical memory protection mechanism, characterized in that: The following steps are involved: Step 1: Determine the basic functions and information of the PMP module according to the functions and requirements of the PMP module in the RISC-V ISA document specification; Step 2: Based on the information in step 1, design the overall structure and interface of the PMP module, determine the internal state, control signals and data paths of the module, build the module framework, and implement the PMP module using the SystemVerilog language; Step 3: According to the RISC-VISA document specification, analyze the properties of the PMP module, classify the properties obtained by the analysis, and extract PMP abstract assertions based on the properties; Step 4: Perform simulation based on the implemented PMP module; Step 5: Based on the PMP module verified by simulation and combined with abstract assertions, build an assertion-based physical memory protection mechanism module.

2. The method for implementing the RISC-V physical memory protection mechanism as claimed in claim 1, characterized in that: In step one, extract RISC-V PMP related information based on RISC-VISA, obtain the basic functions and application scenarios of the module, analyze the functions of the relevant registers of the PMP module, analyze its basic functions and principles, including the registers it needs to use, inputs, and outputs of the module, and analyze the input and output relationship of the PMP module.

3. The method for implementing the RISC-V physical memory protection mechanism as claimed in claim 1, characterized in that: The module framework constructed in step 2 includes: input information and output information, a PMP register group, and two independent sub-modules: a PMP register control module and a memory access request module.

4. The method for implementing the RISC-V physical memory protection mechanism as claimed in claim 3, characterized in that: The PMP register control module modifies the specified PMP register group, including the following steps: Step A1: Check the current privilege mode and only allow configuration in M ​​mode; Step A2: Check the lock status of the PMP register group to be configured, and refuse to modify if the register group is locked; Step A3: Check whether the next register group of the PMP register group to be configured is in TOR mode and locked. If this condition is met, the PMP register configuration is rejected.

5. The method for implementing the RISC-V physical memory protection mechanism as claimed in claim 3, characterized in that: The memory access request module comprises the following steps in normal mode: Step B1: performing address matching on the first address of the access, matching according to the priority between PMP register groups; determining the register group that matches the access base address; Step B2: On the premise that the register group has been matched, the access end address is matched again to confirm whether the first address and the end address are matched in the same register group; Step B3: If the accessed first address and the end address are both under the PMP register group, check whether the address space between the first address and the end address is covered by a PMP register with a higher priority; Step B4: After the address matching is completed, further check whether the XWR permission of this memory access matches the PMP register group, and only allow this memory access if the permission matches; and / or, The memory access request module includes the following special rules in privileged mode: Step C1: In M mode, if no PMP register is matched during the address matching process, the match is allowed; in S / U mode, the access is denied; Step C2: In M mode, if the matched PMP register is not locked, there is no need to perform a read / write permission check; if the matched PMP register is locked, a read / write permission check is still required.

6. The method for implementing the RISC-V physical memory protection mechanism as claimed in claim 1, characterized in that: The classification of the PMP module properties in step 3 includes: allowing all memory accesses when the PMP register group is not configured, properties that need to be satisfied when the PMP register group is configured, properties that need to be satisfied when the memory is accessed, and properties that need to be satisfied inside the implemented PMP module; wherein, The allowing all memory accesses when the PMP register set is not configured includes: when the PMP register set is not configured, the PMP does not perform memory protection, and all PMP register accesses are allowed at this time; The properties that need to be met when configuring the PMP register group include: not allowing modification of the register group in non-M mode, not allowing modification of the register group when the register group to be modified is in a locked state, and not allowing modification of the address register of the register group when the register group next to the register group to be modified is in a locked state and the addressing mode is TOR; The properties that need to be met during the memory access include: the starting address and the ending address of the memory access are both located in the same register group, the address range of the memory access is not covered by a register group with a higher priority than the matched register group, in S / U mode, the memory access request must match the permission mode XWR of the register group, in M ​​mode, if the register group is not locked, no permission check is required; if the register group is locked, a permission check is required, if the memory access does not match any register group, the access is allowed in M ​​mode; in S / U mode, the access is denied; The properties that need to be satisfied inside the implemented PMP module include: the logical relationship between the register groups inside the implemented module needs to be satisfied.

7. The method for implementing the RISC-V physical memory protection mechanism as claimed in claim 1, characterized in that: The step 4 comprises the following steps: Step G1: Design multiple test cases; Step G2: Execute simulation test, record simulation execution results, and compare with expected results; Step G3: If the execution results of all test cases are consistent with the expected results, the simulation test passes; if the simulation execution does not match the expected results, the module is modified.

8. The method for implementing the RISC-V physical memory protection mechanism as claimed in claim 1, characterized in that: The step five comprises the following steps: Step H1: for each property, generate a corresponding assertion and add it to the implemented physical memory protection module to generate an assertion module; Step H2: For all properties, integrate a set of assertions to cover all properties, and add them to the implemented physical memory protection module to generate an integrated module.

9. A verification method for RISC-V physical memory protection mechanism, characterized in that: Use the assertion-based formal verification tool Symiyosys, combined with the developed assertion-based physical memory protection module, to perform formal verification and integrate the verification results; If the verification fails, you need to determine whether it is a model error or an assertion error, and modify the assertion or model based on the result; If the verification passes, the security of the implemented PMP module is proven, and a PMP module that has been verified by the assertion is generated.

10. The method according to claim 9, characterized in that The formal verification includes the following steps: Step I1: Verify each individual assertion module to ensure the correctness of the individual assertions; Step I2: For the modules that failed, re-modify the physical memory protection module and abstract assertions, and re-verify all individual assertions to ensure the correctness of the modification; Step I3: Perform formal verification on the integrated module to ensure the correctness of the module after all assertions are integrated; and / or, The formal verification performed in step I2 includes the following steps: Step J1: When a problem occurs during verification and verification fails, analyze the assertion module; Step J2: After finding the root cause of the problem, return to modify the module or assertion; Step J3: Reintegrate the modified module or assertion and re-perform formal verification on the module.

Images