An implementation and verification method for a RISC-V physical memory protection mechanism

Abstract

The application discloses an implementation method for a RISC-V physical memory protection mechanism, and comprises the following steps: according to the RISC-V ISA specification, analyzing the physical memory protection mechanism module structure, the input and output of the module, designing the module framework according to the document requirements, and then using the SystemVerilog language to implement the module; according to the ISA specification, performing property analysis on the PMP module, classifying the properties obtained through the analysis, and using a formal language to describe the properties; based on the implemented physical memory protection module, combining the extracted properties, using the assertion-based formal verification tool Symbiyosys to perform formal verification on the properties, and integrating the verification results to ensure the correctness of the RISC-V physical memory protection mechanism.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of memory security, and particularly relates to a realization and verification method for a RISC-V physical memory protection mechanism. BACKGROUND

[0002] With the rapid development of mobile Internet and cloud computing technology, more and more data are stored, shared and calculated in the cloud environment. Therefore, data security and privacy protection in the cloud environment have become a hot issue of concern in the academic and industrial circles. Traditional privacy protection technologies are mainly based on cryptographic algorithms and protocols, such as secure multi-party computation and homomorphic encryption. Although these technologies have high security and reliability, due to the performance bottleneck of complex computation, they are difficult to be applied on a large scale in actual scenarios.

[0003] As an alternative solution, a trusted execution (TEE) environment is thus generated. TEE is an independent processing environment with computing and storage functions. It allocates a separate memory for sensitive data in hardware, and all sensitive data computations are performed in this memory. Except for authorized interfaces, other parts cannot access the information in the isolated memory, thereby realizing private computation of sensitive data.

[0004] RISC-V is an open standard instruction set architecture (ISA) based on the established principles of reduced instruction set computer (RISC). Unlike most other ISA designs, RISC-V is provided with a free open source license. Physical memory protection (PMP) is a standard RISC-V function that allows firmware to specify physical memory regions and control memory access permissions. Many systems have adopted PMP to protect memory regions of high-privilege binaries (such as firmware) or devices. For example, PMP is used to allow firmware to protect its own memory region at machine startup. PMP is also used in the RISC-V-based trusted execution environment Keystone, which uses multiple PMP entries to isolate each enclave from the rest of the system, including privileged operating systems, and manages shared memory regions. Keystone utilizes multiple PMP rules (such as whitelist-based or priority address matching) to implement a flexible memory isolation scheme. Therefore, it can be said that the entire security guarantee of Keystone relies on the functional correctness of PMP. SUMMARY

[0005] To ensure the security of the Keystone system and the like, formal verification needs to be performed on the PMP first. Meanwhile, due to the fact that there are certain differences in the implementation of the PMP mechanism of RISC-V in different processors, such as out-of-order execution and cache coherence strategy, different PMP implementations bring difficulties to the verification work. In order to facilitate the verification of the RISC-V PMP mechanism, the present application develops a standard RISC-V PMP module based on the RISC-V ISA specification document, and performs formal verification on the RISC-V PMP mechanism based on the module.

[0006] The design and verification method for the RISC-V physical memory protection mechanism disclosed in the present application comprises the following steps:

[0007] Step one: according to the RISC-V ISA document specification, carefully study the function and requirement of the PMP module, determine the basic function and information of the PMP module;

[0008] Step two: according to the information in step one, design the overall structure and interface of the PMP module, determine the state, control signal and data path inside the module, build the module framework, and implement the PMP module using SystemVerilog language;

[0009] Step three: according to the RISC-V ISA document specification, perform property analysis on the PMP module, classify the properties obtained by analysis, and extract PMP abstract assertions based on the properties;

[0010] Step four: perform simulation execution based on the implemented PMP module;

[0011] Step five: based on the PMP module verified through simulation, combine the abstract assertions to build the physical memory protection mechanism module based on assertions.

[0012] In the design and verification method for the RISC-V physical memory protection mechanism disclosed in the present application, the step one comprises:

[0013] Based on RISC-V ISA, RISC-V PMP related information is extracted, the basic function and application scenario of the module are obtained, the functions of the PMP module related registers are analyzed, and the basic function and principle are analyzed.

[0014] In the design and verification method for the RISC-V physical memory protection mechanism disclosed in the present application, the step two comprises:

[0015] For the PMP basic information, the PMP function is sorted out, the input and output, data path, control signal and other information of the module are determined, and the overall framework of the module is determined.

[0016] For RISC-V PMP, its function can be divided into two parts, one is the register control part, and the other is the memory access request part. For these two cases, the corresponding input control needs to be designed to distinguish them.

[0017] For the register control part: the input of this part is the current privilege mode, the register group number to be modified, the control register and data register information to be modified; the output is whether the register modification is successful. The basic function of its module is to modify the specified PMP register group according to the input information. It specifically includes the following steps:

[0018] Step A1: check the current privilege mode, only allow M mode to configure;

[0019] Step A2: check the lock state of the PMP register group to be configured, if the register group is locked, refuse to modify;

[0020] Step A3: check whether the next register group of the PMP register group to be configured is in TOR mode and is locked, if it meets this condition, refuse to configure the PMP register.

[0021] For the memory access request part: the input of this part is the current privilege mode, the base address of the memory access, the size of the memory access region, and the required permission of the memory access; the output is whether the memory access is allowed. The basic function of its module is to judge the access request according to the PMP register group. It specifically includes the following steps:

[0022] Step B1: match the address of the first address of this access according to the priority among PMP register groups. Determine the register group matched by the access base address.

[0023] Step B2: on the premise that the register group has been matched, match the access termination address again to confirm whether the first address and the termination address are matched in the same register group.

[0024] Step B3: if the access first address and the termination address are both in the PMP register group, it is necessary to check whether the address space between the first address and the termination address is covered by the PMP register with higher priority.

[0025] Step B4: after the address matching is completed, it is necessary to further check whether the XWR permission of this memory access is matched with the PMP register group, and only in the permission matching is allowed this memory access

[0026] And the memory address access in the privileged mode needs to be based on the following rules:

[0027] C1 In M mode, if no PMP register is matched in the address matching process, this match is allowed; in S / U mode, the access is rejected.

[0028] C2 In M mode, if the matched PMP register is not locked, the read / write permission check step B4 is not needed; if the matched PMP register is locked, the read / write permission check step B4 is still needed.

[0029] The step three further comprises the following steps in the design and verification method for the RISC-V physical memory protection mechanism.

[0030] Based on the ISA, the properties related to the RISC-V PMP are classified, and the classification includes:

[0031] D1 All memory accesses are allowed when the PMP register group is not configured

[0032] D2 Properties required to be met when the PMP register group is configured

[0033] D3 Properties required to be met when accessing memory

[0034] D4 Properties required to be met inside the implemented PMP module

[0035] Further refined analysis of these classifications is performed to obtain the properties:

[0036] D1 The classification includes the following properties:

[0037] When the PMP register group is not configured, the PMP does not perform memory protection, and at this time, all PMP register accesses are allowed.

[0038] For RISC-V, PMP is a memory protection extension that does not require mandatory enforcement, so for the case where the PMP register is not configured, all accesses are allowed to pass.

[0039] D2 The classification includes the following properties:

[0040] E1 Modification of the register group is not allowed in non-M mode

[0041] The PMP register group is only allowed to be modified in privileged mode, because the security of S / U mode cannot be ensured.

[0042] E2 Modification of the register group is not allowed when the register group to be modified is in a locked state

[0043] According to the RISC-V ISA rule description, once the lock is set, the locked register group will remain unchanged during this run until the hardware thread is reset.

[0044] E3 When E3 is in the lock state at the next register group of the register group to be modified, and the addressing mode is TOR, the modification of the address register of the register group is not allowed.

[0045] This property is related to the previous property. Since the address of the register group is based on the address register of the previous register group in the TOR addressing mode, in order to ensure that the address range controlled by the register group does not change, the setting of the address register of the previous register group is not allowed.

[0046] D3 The classification includes the following properties:

[0047] F1 The start address and the end address of the memory access are located in the same register group

[0048] During the memory access process, if the start address and the end address are not in the same register, it can be considered that the priority of the address range where the start address is located is different from the priority of the address range where the end address is located; such access is not allowed for memory safety.

[0049] F2 The address range of the memory access is not covered by the register group of a higher priority matched by the register group

[0050] As in F1, if the address region between the start address and the end address is in the management of a higher priority register group, in order to ensure memory safety, access to the high priority memory region is not allowed.

[0051] F3 In S / U mode, the memory access request must match the permission mode XWR of the register group

[0052] In S / U mode, the permission required to be declared must match the register group, and over-reach access is not allowed; special rules are handled in M mode.

[0053] F4 In M mode, if the register group is not locked, no permission check is required; if the register group is locked, permission check is required

[0054] According to the RISC-V ISA specification, in M mode, all permissions are allowed for an unlocked register; for a locked register, permission check is required even in M mode.

[0055] F5 If the memory access does not match any register group, the access is allowed in M mode; the access is denied in S / U mode

[0056] According to the RISC-V ISA specification requirements, the M mode allows it to obtain all permissions when it is not successfully matched to the PMP register; and in the S / U mode, since the PMP is configured, it is not allowed to access the unauthorized memory area for memory safety.

[0057] The D4 classification includes the following properties:

[0058] The logical relationship between the implemented module internal register groups needs to be satisfied.

[0059] In the specific implementation module, some auxiliary registers can be used to optimize performance. After adding these auxiliary registers, it is ensured that they will not affect the functional integrity and correctness of the PMP itself.

[0060] In the design and verification method for the RISC-V physical memory protection mechanism, the step four further includes the following steps:

[0061] Step G1: For the constructed RISC-V physical memory protection mechanism model and RISC-V ISA, a plurality of corresponding test cases are designed;

[0062] Step G2: The simulation execution is performed using the designed test cases, and the simulation results are recorded and compared with the expected results;

[0063] Step G3: If the simulation results all meet the expected results, it is considered that the constructed model meets the simulation verification requirements; if the simulation results do not meet the expected results, the constructed RISC-V physical memory protection mechanism model needs to be modified.

[0064] In the design and verification method for the RISC-V physical memory protection mechanism, the step five further includes the following steps:

[0065] Step H1: For each property, a corresponding assertion is generated and added to the implemented physical memory protection module, and an assertion module is generated;

[0066] In order to ensure the independent correctness of the assertion and the module, each assertion is combined with the module respectively, so as to facilitate adjustment during testing.

[0067] Step H2: For all properties, a set of assertions is integrated to cover all properties, and is added to the implemented physical memory protection module, and an integrated module is generated.

[0068] In order to ensure the correctness of the module, only verifying each property separately is not enough to prove the correctness of the module, and the integrated assertion verification of the module is needed.

[0069] Based on the above memory protection mechanism, the application further proposes a verification method for the RISC-V physical memory protection mechanism, comprising:

[0070] Using the formal verification tool Symbiyosys based on assertion, combined with the assertion-based physical memory protection module developed in step five, formal verification is carried out, and the verification results are integrated. If the verification fails, it is necessary to determine whether the model is wrong or the assertion is wrong, and according to the results, the assertion or the model is modified again; if the verification is passed, the safety of the implemented PMP module is proved, and the PMP module verified by assertion is generated. Specifically, it includes the following steps:

[0071] Step I1: For the single assertion module constructed in step five, formal verification is carried out using the formal verification tool Symbiyosys, and each module is verified one by one.

[0072] Based on the idea of unit testing, each assertion is verified.

[0073] Step I2: During the module verification process, if the assertion verification fails, the assertion itself or the model needs to be modified again; and after modification, the previously verified modules that have passed the verification need to be updated and verified to ensure that the modified module is correct. Similarly, simulation execution needs to be performed again to ensure the correctness of the module.

[0074] Based on the idea of regression testing, when modifying the module or the assertion, it may affect the previously verified modules, and the verified modules need to be re-verified to ensure correctness,

[0075] Step I3: Formal verification is carried out on the integrated module to ensure the correctness of the module after all assertions are integrated, and to ensure the correctness of the entire module.

[0076] In order to ensure the correctness of the module, the integrated module needs to be verified to solve the possible conflicts between different assertions and ensure the correctness of the module.

[0077] In the design and verification method for the RISC-V physical memory protection mechanism described in the application, the step I2 further comprises the following steps:

[0078] Step J1: When the verification fails to successfully pass the verification, the assertion module is analyzed;

[0079] When the verification fails, it is necessary to determine the reason for the verification failure and analyze whether it is an assertion error or a module error.

[0080] Step J2: After finding the root cause, the module or the assertion is modified;

[0081] After finding the error cause, if it is a module error, the module needs to be modified based on the RISC-V ISA; if it is an assertion error, the assertion needs to be modified based on the RISC-V ISA.

[0082] Step J3: Reintegrate the modified module or assertion, and re-perform formal verification on the module.

[0083] After modifying the error part, the assertion and the module need to be reintegrated, a physical memory protection mechanism module based on the assertion is generated, and the module is used to re-perform verification.

[0084] The application discloses a design and formal verification method for a RISC-V physical memory protection mechanism. The method comprises the following steps: according to the RISC-V ISA specification, analyzing the physical memory protection mechanism module structure, the input and output of the module, designing a module framework according to the document requirements, and then implementing the module using the SystemVerilog language; according to the ISA specification, performing property analysis on the PMP module, classifying the properties obtained through analysis, and describing the properties using a formal language; based on the implemented physical memory protection module, combining the extracted properties, using the formal verification tool Symbiyosys based on the assertion, performing formal verification on the properties, and integrating the verification results to ensure the correctness of the RISC-V physical memory protection mechanism. BRIEF DESCRIPTION OF DRAWINGS

[0085] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the following will briefly introduce the drawings needed to be used in the embodiments or the prior art description. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor on the basis of these drawings.

[0086] Figure 1 The present application is a general flow chart for designing and verifying the RISC-V physical memory protection mechanism.

[0087] Figure 2 The present application is a register group configuration flow chart for the RISC-V physical memory protection mechanism.

[0088] Figure 3 The present application is a memory access flow chart for the RISC-V physical memory protection mechanism.

[0089] Figure 4 The present application is a simulation execution flow chart for the RISC-V physical memory protection mechanism.

[0090] Figure 5The flowchart of the assertion verification process of the RISC-V physical memory protection mechanism of the present application.

[0091] Figure 6 The simulation execution specific example of the RISC-V physical memory protection mechanism of the present application. DETAILED DESCRIPTION

[0092] The application is further described in detail in combination with the following specific examples and drawings. The process, conditions, experimental methods, etc. for implementing the present application are the general knowledge and common sense in the art, except for the following specifically mentioned contents, and the present application does not have special restrictions.

[0093] The present application proposes a design and verification method for the physical memory protection mechanism of the open source RISC-V hardware architecture. The method first analyzes the physical memory protection mechanism according to the RISC-V ISA specification, implements the physical memory protection module using the SystemVerilog language according to the specification, extracts the properties that the physical memory protection module needs to satisfy from the specification, and extracts abstract assertions according to the properties. Then, test cases are designed for the implemented physical memory protection module, and the correctness of the implemented module is verified using simulation execution. Then, the extracted assertions are combined with the implemented module to generate an assertion-based physical memory protection module, and the correctness of the module is verified using the Symbiyosys formal verification tool. According to the formal verification result, corresponding processing is performed until the physical memory protection module that has passed the assertion verification is generated.

[0094] The present application proposes a design, implementation and verification method for the RISC-V physical memory protection mechanism. The properties of RISC-V are mainly analyzed, and the RISC-V PMP module is verified by using test cases for simulation verification and using formal tools for assertion verification. Finally, the physical memory protection module that has passed the assertion verification is generated.

[0095] The present application expands the analysis of the security of the RISC-V PMP in the existing research. In the existing research, the security analysis of the RISC-V physical memory protection mechanism mostly focuses on the trusted execution environment of the upper architecture, and the research on the PMP module used in the implementation of the trusted execution environment is relatively scarce. A small amount of related research does not consider the use of the physical memory protection mechanism in all scenarios. Based on the analysis of the existing research, the present application expands the analysis of the RISC-V physical memory protection mechanism, completes the implementation and verification of the RISC-V physical memory protection mechanism, and aims to completely analyze the security of the RISC-V physical memory protection mechanism.

[0096] As Figure 1As shown, the present application includes the following steps in the implementation process:

[0097] Step one: according to the RISC-V ISA document specification, carefully study the function and requirement of PMP module, determine the basic function and information of PMP module, analyze the basic composition of the module, including the registers needed to be used, input, and the output of the module, etc., analyze the input and output relationship of PMP module.

[0098] Step two: according to the information in step one, design the overall structure and interface of PMP module, determine the internal state, control signal and data path of the module, divide the internal function of PMP into two parts of PMP register modification and memory access, analyze the internal operation process of the two parts, construct the module framework according to this, and realize the PMP module using SystemVerilog language;

[0099] Step three: according to the RISC-V ISA document specification, combining the input and output relationship of PMP module and the possible logical relationship existing in the specific module, analyze the nature of PMP module, and classify the nature obtained by analysis according to the sub-module, and extract PMP abstract assertion based on the nature.

[0100] Step four: according to the RISC-V ISA, design test cases based on the implemented PMP module, and use these test cases to perform simulation execution, verify the correctness of the implemented module. If the test cases cannot pass, the implemented module needs to be modified until all test cases pass, and the function correctness of the module is verified.

[0101] Step five: based on the implemented PMP module, combining the extracted abstract assertion, inserting the abstract assertion in the implemented module using SystemVerilogAssertion, respectively generating the assertion module corresponding to a single property and the assertion module integrating all properties, and constructing the physical memory protection mechanism module based on the assertion.

[0102] The verification method for RISC-V physical memory protection mechanism proposed in the present application includes the following steps:

[0103] The formal verification is performed on each module obtained by using the formal verification tool Symbiyosys based on the assertion, integrating the verification results, and processing according to the correctness of the verification results. If a module fails the verification, it is necessary to determine the reason for the failure, analyze whether the implemented module is wrong or the extracted property is wrong, and make targeted modifications. After the modifications are completed, the assertion module is regenerated, and the formal verification is performed again. If the verification is passed, the safety of the implemented PMP module is proved, and the PMP module that has passed the assertion verification is generated.

[0104] Embodiment 1

[0105] The embodiment is verified by the flow shown in Figure 4 The flow of the embodiment is verified by the flow shown in Figure 2 and Figure 3 The embodiment is verified by the flow shown in

[0106] The test case designed in the embodiment is shown in the flowchart shown in Figure 6 First, the test case is designed as follows: configure the register group PMP0 address space 0x000000-0x001000, the lock bit is 0, the permission bit is read, and the privilege mode is M; the memory access start address is 0x002000, the access space size is 0x001000, the privilege mode is S / U mode, and the access permission bit is read, write, and execute; the memory access start address is 0x002000, the memory access size is 0x001000, the privilege mode is M mode, and the access permission bit is read, write, and execute.

[0107] The expected result of this test case is that the configuration of the register group is successfully passed, and the two memory accesses are rejected in the first access and passed in the second access.

[0108] Embodiment 2

[0109] The embodiment is verified by the flow shown in Figure 5 The safety detection of the PMP physical memory protection module combined with the assertion is a specific embodiment of the verification method of the RISC-V physical memory protection mechanism. In this example, the property F5 extracted in step three is verified. F5 requires that for each memory access, if the accessed address space cannot match any configured PMP register, the privilege mode of this memory access is determined; in M mode, this access is allowed, and in S / U mode, this memory access is rejected. The specific steps are as follows:

[0110] Step I1: The physical memory protection module combined with the F5 property assertion in step five is subjected to formal verification by using the formal verification tool Symbiyosys, and the verification results are obtained.

[0111] Step I2: Check the verification result, if the verification is passed, it proves that the assertion module meets the formal verification; if the verification fails, additional steps are needed.

[0112] Step J1: When the module verification fails, it is needed to analyze whether the problem is in the set module or the designed assertion F5. After analysis, it is found that the problem is in the module in this embodiment.

[0113] Step J2: According to the analyzed problem, the relevant part in the module is modified, and the simulation execution test is performed again.

[0114] Step J3: After the simulation execution passes, the assertion is integrated with the module again to form an assertion-based physical memory protection module, and the assertion verification is performed again.

[0115] Step I3: After the single-module verification passes, the integrated assertion module needs to be verified, and the possible property conflicts in the integrated module need to be analyzed and solved.

[0116] The present application focuses on proposing a method for implementing, analyzing and verifying the RISC-V physical memory protection mechanism, successfully verifying the function and safety of the implemented model according to the steps in the embodiment, which helps to provide protection in the RISC-V security aspect, further confirms the safety of RISC-V at the hardware level, and makes the security architecture implemented on the RISC-V physical memory protection mechanism more reliable.

[0117] The protection content of the present application is not limited to the above embodiments. Changes and advantages that can be thought of by those skilled in the art without departing from the spirit and scope of the present application are included in the present application, and are protected by the appended claims.

Claims

1. A method for implementing a RISC-V physical memory protection mechanism, the method comprising: The method comprises the following steps: ​ Step one: according to the function and requirement of PMP module in RISC-V ISA document specification, the basic function and information of PMP module are determined; Step two: according to the information in step one, the overall structure and interface of PMP module are designed, the state, control signal and data path in the module are determined, the module framework is constructed, and the PMP module is implemented by using SystemVerilog language; Step three: according to the RISC-V ISA document specification, the properties of the PMP module are analyzed, the properties obtained by analysis are classified, and the PMP abstract assertion is extracted based on the properties; The classification of the properties of the PMP module in step three comprises: allowing all memory accesses when the PMP register group is not configured, the properties required to be satisfied when the PMP register group is configured, the properties required to be satisfied when the memory is accessed, and the properties required to be satisfied in the implemented PMP module; The allowing all memory accesses when the PMP register group is not configured comprises: when the PMP register group is not configured, the PMP does not perform memory protection, and all PMP register accesses are allowed at this time; The properties required to be satisfied when the PMP register group is configured comprise: not allowing to modify the register group in the non-M mode, not allowing to modify the register group when the register group to be modified is in the locked state, and not allowing to modify the address register of the register group when the next register group of the register group to be modified is in the locked state and the addressing mode is TOR; The properties required to be satisfied when the memory is accessed comprise: the start address and the end address of the memory access are located in the same register group, the address interval of the memory access is not covered by the register group with higher priority matched by the register group, in the S / U mode, the memory access request needs to match the permission mode XWR of the register group, in the M mode, if the register group is not locked, permission check is not required, if the register group is locked, permission check is required, if the memory access does not match any register group, the access is allowed in the M mode, and the access is refused in the S / U mode; The properties required to be satisfied in the implemented PMP module comprise: the logical relationship between the register groups in the implemented module needs to be satisfied; Step four: simulation execution is performed based on the implemented PMP module; Step five: based on the PMP module verified by simulation, an assertion-based physical memory protection mechanism module is constructed combined with the abstract assertion; The step five comprises the following steps: Step H1: for each property, an assertion corresponding to the property is generated and added to the implemented physical memory protection module to generate an assertion module; Step H2: for all properties, a group of assertions is integrated to cover all properties, and the integrated group of assertions is added to the implemented physical memory protection module to generate an integrated module.

2. The method for implementing the RISC-V physical memory protection mechanism according to claim 1, wherein, In step one, RISC-V PMP related information is extracted based on RISC-V ISA to obtain the basic functions and application scenarios of the module, the functions of the PMP module related registers are analyzed, the basic functions and principles are analyzed, including the registers needed to be used, the input, and the output of the module, and the input and output relationship of the PMP module is analyzed.

3. The method for implementing the RISC-V physical memory protection mechanism according to claim 1, wherein, The module framework constructed in step two includes: input information and output information, a PMP register group, and two independent sub-modules: a PMP register control module and a memory access request module.

4. The method for implementing the RISC-V physical memory protection mechanism according to claim 3, wherein, The PMP register control module modifies the specified PMP register group, including the following steps: Step A1: Check the current privilege mode, and only allow configuration in M mode; Step A2: Check the lock state of the PMP register group to be configured, and refuse to modify if the register group is already locked; Step A3: Check whether the next register group of the PMP register group to be configured is in TOR mode and is locked, and refuse PMP register configuration if the condition is met.

5. The method for implementing the RISC-V physical memory protection mechanism according to claim 3, wherein, The memory access request module in normal mode includes the following steps: Step B1: Perform address matching on the first address of this access, match according to the priority among PMP register groups, and determine the register group matched with the access base address; Step B2: On the premise that the register group has been matched, further match the access termination address, and confirm whether the first address and the termination address are matched in the same register group; Step B3: If the access first address and the termination address are both in the PMP register group, check whether the address space between the first address and the termination address is covered by a higher priority PMP register; Step B4: After the address matching is completed, further check whether the XWR permission of this memory access is matched with the PMP register group, and only allow this memory access after the permission is matched.

6. The method for implementing the RISC-V physical memory protection mechanism according to claim 3, wherein, The memory access request module in privileged mode includes the following special rules: Step C1: In M mode, if no PMP register is matched in the address matching process, this matching is allowed; in S / U mode, the access is refused; Step C2: In M mode, if the matched PMP register is not locked, read and write permission check is not needed; if the matched PMP register is locked, read and write permission check is still needed.

7. The method for implementing a RISC-V physical memory protection mechanism according to claim 1, wherein, The step four includes the following steps: Step G1: Design multiple test cases; Step G2: Perform simulation test and record the simulation execution results, and compare with the expected results; Step G3: If all test cases have the same execution results as the expected results, the simulation test is passed; if there is a simulation execution that does not match the expected result, the module is modified.

8. A verification method for RISC-V physical memory protection mechanism implemented by the method of any one of claims 1-7, wherein, Using the assertion-based formal verification tool Symbiyosys, the developed assertion-based physical memory protection module is used for formal verification, and the verification results are integrated; If the verification fails, it needs to be judged whether the model is wrong or the assertion is wrong, and the assertion or model is modified according to the result; If the verification is passed, the security of the implemented PMP module is proved, and the PMP module that has passed the assertion verification is generated.

9. The method of claim 8, wherein, The formal verification includes the following steps: Step I1: verifying each individual assertion module to ensure the correctness of the single assertion; Step I2: re-modifying the physical memory protection module and the abstract assertion for the module that fails to pass the verification, and re-verifying all single assertions to ensure the correctness of the modification; Step I3: performing formal verification on the integrated module to ensure the correctness of the module after the integration of all assertions.

10. The method of claim 9, wherein, The formal verification performed in step I2 includes the following steps: Step J1: analyzing the assertion module when the verification fails to pass the verification successfully; Step J2: returning to modify the module or the assertion after finding the root cause of the problem; Step J3: re-integrating the modified module or the assertion and re-performing formal verification on the module.

Images