Password acquisition method based on RISC-V architecture

Abstract

The invention discloses a password acquisition method based on an RISC-V architecture, and relates to the technical field of information security, and the method comprises the following steps: S1, environment initialization and resource pre-configuration; s2, constructing a lightweight mode switching mechanism; s3, implementing a compatibility adaptation layer; s4, establishing a fault recovery mechanism; and S5, obtaining a complete process of the password. According to the method and the device, switching preparation time consumption is reduced through M mode environment preloading, authentication requests are processed in batches, the number of times of switching from the U mode to the M mode is reduced, state recording and recovery logic are simplified, unnecessary steps are omitted, mode switching time and resource overhead are greatly reduced, performance loss is remarkably reduced, the system response speed is increased, and system compatibility is greatly improved; the dynamic adaptation layer can automatically match mode support conditions of different RISC-V architectures, a pseudo-U mode scheme and degraded operation options cover simplified and old RISC-V systems, and a unified interface is compatible with third-party security software and biological recognition hardware.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of information security, in particular to a password acquisition method based on RISC-V architecture. BACKGROUND

[0002] The password acquisition based on RISC-V architecture refers to the technical process of implementing cryptography-related operations such as key generation, encryption / decryption, and hash calculation under the RISC-V instruction set architecture, and also involves the secure acquisition of password information and potential attack methods under this architecture.

[0003] For example, Chinese patent CN114090209B discloses a password acquisition method based on RISC-V architecture, which includes: the RISC-V system normally starts, and the system runs in U mode; normal business processing is carried out in U mode, and when no password processing is involved, the business runs normally; when password and fingerprint information business needs to be processed and run, the system runs in M mode; the system acquires passwords and fingerprints in M mode, and then performs password authentication-related operations; after the password authentication-related operations are completed, the M mode is exited, and the password-related operation record information is cleared.

[0004] In the above-mentioned patent, although the system switches different modes to solve the problem of insufficient security processing level and easy leakage of passwords by only using software for simple security management, the switching of U mode and M mode is triggered every time a password / fingerprint business is processed, including steps such as locking U mode operation, recording state, unlocking and restoring, and frequent switching will increase system response delay. SUMMARY

[0005] The present application aims to provide a password acquisition method based on RISC-V architecture to solve the problem of frequent switching of U mode and M mode triggered every time a password / fingerprint business is processed, including steps such as locking U mode operation, recording state, unlocking and restoring, and frequent switching will increase system response delay.

[0006] To achieve the above-mentioned purpose, the present application provides the following technical solution: a password acquisition method based on RISC-V architecture, comprising the following steps: S1, environment initialization and resource pre-configuration: prepare M mode security environment to reduce dynamic switching overhead; adapt to different RISC-V architecture mode support conditions, including M mode security environment preloading and RISC-V architecture dynamic detection; S2, construct a lightweight mode switching mechanism: reduce the number of mode switching between U and M and state processing overhead through authentication request buffer queue design and simplified state recording and recovery; when designing the authentication request buffer queue, the following contents are included: S21, create a ring buffer queue in U mode to store password acquisition requests for a short period of time, and the queue elements include: request ID, user input password plaintext pointer, and processing result callback function; S22, set a queue trigger threshold, and when triggered, switch to M mode through an environment call instruction at one time to process all requests in batches; S3, compatibility adaptation layer implementation: through mode adaptation intermediate layer and pseudo U mode adaptation of simplified RISC-V, adapt systems that only support part of the mode or simplified RISC-V architecture; S4, establish a fault recovery mechanism: use state real-time backup and rollback, timeout monitoring and forced unlocking to safely recover U mode business when M mode is abnormal, and perform real-time backup and timeout protection; S5, complete password acquisition process: the user inputs the password in the APP, the plaintext is temporarily stored in the stack memory of U mode, the password pointer is stored in req_queue, and after reaching the threshold, it is switched to M mode through ecall, M mode security processing is performed, then the result is returned and the state is recovered, and if an exception occurs, the recovery mechanism of S4 is triggered.

[0007] Preferably, in step S1, when the M mode security environment is preloaded, the system enters the M mode initialization phase at system startup, the physical memory protection mechanism is configured to reserve a physical memory protection area for storing core functions and temporary buffer areas for password processing in M mode, the peripheral interface in M mode is pre-initialized, and the interface handle is stored in a fixed address in the physical memory protection area to avoid repeated initialization when switching.

[0008] Preferably, in step S1, the riscv_arch_detect() function is designed to determine the supported mode and privilege level function of the current system by reading the RISC-V machine mode instruction set architecture register, generate an architecture configuration table based on the detection result, and record whether the U mode is supported, the type of mode switching instruction, and the PMP support granularity.

[0009] Preferably, in step S2, when the state is recorded and restored, only the core state of U mode is recorded before switching to M mode, and the data structure for saving the key running state of the user mode is stored in the PMP area. After M mode processing is completed, the supervisor mode exception program counter and the supervisor mode state register are restored through the mret instruction, and the queue processing logic of U mode is directly returned.

[0010] Preferably, in step S21, when creating a ring buffer queue, define a queue structure in the user mode memory of U mode, which includes buffer, pointer, and key information for state control.

[0011] Preferably, in step S3, when the mode adaptation intermediate layer is adapted, based on the arch_config_t of S1, the dynamic binding implementation is realized, if U and M modes are supported, it is bound to the U to M batch switching processing logic, and if only M mode is supported, it is bound to the M mode internal isolation processing logic.

[0012] Preferably, in step S3, when the pseudo U mode of the simplified RISC-V is adapted, for the system without U mode, two memory regions are divided in the M mode through PMP, and the two are prevented from accessing out of bounds through memory isolation.

[0013] Preferably, in step S4, when the state is backed up and rolled back in real time, if a crash occurs in the M mode running, the system reads the fault_safe_backup stored after restarting, restores the U mode state through mret, and marks the unfinished password request as failed.

[0014] Preferably, in step S4, if the password processing is timed out, the timer in the M mode triggers an interrupt, clears the sensitive data in the M mode, restores the U mode state, forcibly returns to the U mode and notifies the business layer that the authentication is timed out, and completes the forced unlocking.

[0015] Preferably, in the M mode security processing, the password plaintext is read from the req_queue, encryption is completed in the PMP region, the processing result is stored in the result buffer, when the structure is returned and the state is restored, the U mode is returned through mret, the callback function is called to notify the business layer of the processing result, and the password plaintext in the U mode and the M mode is cleared.

[0016] Compared with the prior art, the present application has the following advantages: In the present application, the preparation time consumption of switching is reduced through the M mode environment preloading, the number of U to M mode switching is reduced through the batch processing of authentication requests, unnecessary steps are omitted through the simplified state recording and recovery logic, the time and resource consumption of mode switching are greatly reduced, the performance loss is significantly reduced, the system response speed is improved, the system response delay is reduced, the system compatibility is greatly improved, the dynamic adaptation layer can automatically match the mode support conditions of different RISC-V architectures, the pseudo U mode scheme and the downgrade running option cover the simplified and old RISC-V systems, the unified interface is compatible with third-party security software and biometric hardware, and the application range of the technical scheme is expanded; Real-time backup U mode core state and queue information, abnormal when can quickly rollback business; Timeout protection mechanism avoids mode switching deadlocks, crashes automatically clear sensitive data and restore system operation, protect business continuity and data security, strengthen fault recovery capability, PMP mechanism realizes M mode password processing area of hardware level isolation, U mode can not access sensitive resources; Sensitive data processing through memset_ () forced overwrite, avoid memory retention leakage, combined with M mode highest privilege level isolation, resist malicious attacks and interference, upgrade password processing security, integration and use more convenient, unified password processing interface shield underlying mode difference, reduce the difficulty of development and integration; Configurable queue threshold, timeout and other parameters, adapt to different scenarios such as high security, ordinary civilian needs, security and practicality. BRIEF DESCRIPTION OF DRAWINGS

[0017] Figure 1 A flowchart of a password acquisition method based on the RISC-V architecture. DETAILED DESCRIPTION

[0018] The technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative labor fall within the scope of the present application.

[0019] Embodiment 1: Refer to Figure 1 As shown in the figure, a password acquisition method based on the RISC-V architecture, the core of the password acquisition method based on the RISC-V architecture is to solve the problem of response delay caused by frequent switching of traditional modes while ensuring the security of password processing through four mechanisms of pre-configuration, lightweight switching, compatible adaptation and fault recovery, and to realize efficient, compatible and secure password acquisition.

[0020] 1. Environment initialization and resource pre-configuration: build a solid foundation, reduce switching preparation overhead, build M mode security environment in advance, adapt to different RISC-V architectures, and avoid repeated operations during dynamic switching.

[0021] (1) Key operations: M mode security environment preloading: enter M mode when the system starts, reserve physical memory protection area through PMP mechanism, store password processing core function and temporary cache, pre-initialize peripheral interface and fix handle, only M mode can access.

[0022] (2) Architecture dynamic detection: Read the misa register through the riscv_arch_detect() function, generate an architecture configuration table, record the U-mode support situation, switch instruction type, etc., and provide the basis for subsequent adaptation.

[0023] 2. Lightweight mode switching mechanism: Core optimization, reduce switching and processing overhead, reduce U / M mode switching times and state processing steps, shorten response delay.

[0024] (1) Key operation: Authentication request buffer queue: Create a ring buffer queue in U mode, store password requests for a short period of time, and switch to M mode for batch processing when the threshold is reached.

[0025] (2) Simplified state recording and recovery: Record only the U-mode core state before switching, and directly restore it through the mret instruction after processing is completed, omitting unnecessary register operations.

[0026] 3. Compatibility adaptation layer: Widening the scope, adapting to different architecture systems, making the solution compatible with RISC-V architectures that only support partial modes or simplified versions.

[0027] (1) Key operation: Mode adaptation intermediate layer: Based on the architecture configuration table, dynamically bind the logic, support U+M mode switching, and only support M mode by dividing the isolation area through PMP instead of switching.

[0028] (2) Pseudo-U mode adaptation: Systems without U mode divide user business area and secure processing area in M mode through PMP, simulate U mode functions, and achieve memory isolation.

[0029] 4. Fault recovery mechanism: Ensure stability, handle abnormal scenarios, avoid M mode exceptions (crash, timeout) causing system deadlock or data leakage, and ensure business continuity.

[0030] (1) Key operation: Real-time state backup and rollback: Backup U-mode state and queue information to the fault_safe_backup area before switching, verify backup data after M-mode crash, restore U-mode operation and mark incomplete requests as failed.

[0031] (2) Timeout monitoring and forced unlocking: M mode starts a hardware timer, and when it times out, it triggers an interrupt, clears sensitive data, forces U mode to recover and notifies the business layer of the timeout.

[0032] 5. Complete password acquisition process: Connect modules to achieve end-to-end processing.

[0033] User enters password in APP, plaintext is temporarily stored in U mode stack memory, password pointer is enqueued, after the queue reaches the threshold, it switches to M mode, completes password encryption processing in PMP area, returns to U mode through mret, calls callback function to inform processing result, and clears plaintext in U / M mode, if exception occurs, automatically triggers fault recovery mechanism.

[0034] Embodiment 2: Refer to Figure 1 As shown: a password acquisition method based on RISC-V architecture, comprising the following steps: Step 1: Environment initialization and resource pre-configuration: prepare M mode security environment, reduce dynamic switching overhead; adapt to different RISC-V architecture mode support, including the following contents: 11, M mode security environment preloading: when the system starts, enter the M mode initialization stage, reserve the physical memory protection area through the configuration of the physical memory protection mechanism, which is used to store the core functions and temporary buffer area of password processing in M mode, pre-initialize the peripheral interface in M mode, store the interface handle into the fixed address of PMP area, avoid repeated initialization when switching, when reserving the physical memory protection area, the system has completed the basic initialization in M mode at startup, reserve the protection area through the following steps: 111, determine the physical address range of the protection area: clearly define the memory area that needs to be protected, the physical address is continuous and aligned, and the size is fixed; 112, select PMP entry and configure address register: RISC-V chip usually provides multiple PMP entries, select an unused entry, configure its address register, the value of the address register depends on the matching mode, the commonly used mode is NAPOT; 113, configure PMP configuration register (pmpcfg): define the matching mode and access permission of the protection area by configuring the 0th entry field (8 bits) of the register pmpcfg0 (control the 0th~3rd PMP entry); 114, enable PMP and verify: the effectiveness of the timing, PMP configuration takes effect immediately after writing the register, all subsequent memory access is limited by it. Verify the protection effect, try to read / write / execute the protection area address in M mode, should access normally; after switching to U mode, try to access the same address, should trigger load / store access exception, which is captured by the exception handling program of M mode, to ensure that U mode cannot tamper with or read the protection area data; 115, return to low privilege level through mret instruction: after completing PMP configuration, M mode returns to U mode through mret instruction, at this time, the reserved memory protection area has been locked at the hardware level, only M mode can access, the core logic of subsequent password processing can be safely stored in this area, avoiding interference or leakage of U mode business.

[0035] 12. RISC-V architecture dynamic detection: The riscv_arch_detect() function is designed to read the RISC-V misa register, determine the supported mode and privilege level function of the current system, generate an architecture configuration table based on the detection result, record whether U mode is supported, the type of mode switching instruction, PMP support granularity, etc., and provide dynamic adaptation for subsequent modules.

[0036] Step two, build a lightweight mode switching mechanism: reduce the number of U and M mode switching and state processing overhead, including authentication request buffer queue design and simplified state record and recovery, in the authentication request buffer queue design: A1. Create a ring buffer queue (req_queue) in U mode to store password acquisition requests for a short period of time. The queue element contains: request ID, user input password plaintext pointer, processing result callback function; Set the queue trigger threshold, trigger by ecall instruction to switch to M mode once, and process all requests in batch; When creating a ring buffer queue, define a queue structure in the user mode memory of U mode, including buffer, pointer, and state control key information. Initialize the memory space, pointer state, and lock of the queue when the U mode business starts. When the user inputs the password in U mode, write the request to the queue and update the state and time. When the trigger mode switching is triggered, all requests in the queue are taken out in U mode and are ready to be submitted to M mode. In U mode, design the trigger logic to trigger the switch from U to M mode when any of the following conditions is met. When the U mode business exits, release the memory occupied by the queue to avoid memory leakage.

[0037] A2. When simplifying state record and recovery, only record the core state of U mode before switching to M mode: sepc (user mode next instruction address), sstatus (user mode state register), and req_queue current pointer (used for queue processing recovery). Store in the u_state_backup structure in the PMP area to avoid the performance loss of complete context saving. After M mode processing is completed, restore sepc and sstatus through mret instruction, and directly return to U mode queue processing logic, omitting unnecessary register recovery. When restoring, read the U mode context from the backup area, restore mepc register, restore mstatus register, execute mret instruction, and return to U mode. Among them, mret switches to the original privilege level (U mode) according to mstatus.MPP, and assigns the value of mepc to the program counter of U mode, and restores the original mode interrupt state.

[0038] Step three, compatibility adaptation layer implementation, adapt to systems that only support part of the mode or simplified RISC-V architecture: 1、Mode adaptation intermediate layer, define a unified password processing interface riscv_crypto_process(), clear input and output parameters and return value, realize the abstraction of the underlying mode; Get system architecture configuration information, based on the arch_config_t structure defined in step 1, through the initialization function such as arch_detect(), detect the mode support capability of the current system, store the result in the arch_config_t instance, dynamically bind the implementation, according to the mode identifier of global_arch_config, bind riscv_crypto_process() to the corresponding implementation in the adaptation layer initialization stage, if U+M mode is supported, bind to U to M batch switching processing logic, user mode (U mode) traps into machine state (M mode) through ECALL instruction, saves the U mode context, and then processes the password in M mode in batches, restores the U mode context after processing is completed, and returns the result; If only M mode is supported: bind to M mode isolation processing logic, divide user business area and password processing area through PMP (physical memory protection) configuration, and limit the access authority of the two areas; The intermediate layer interface is executed in M mode, and the password processing is completed in the isolation area through permission check to avoid that the user business code directly touches the sensitive logic; 2、Simplified version of RISC-V pseudo U mode adaptation: for systems without U mode, divide the memory area through PMP, configure the PMP register during M mode initialization, and divide two independent memory areas, user_area: simulate U mode, used to run user business code; secure_area: used to run password processing logic, store sensitive data, set PMP rules, limit user_area to only access its own memory, prohibit access to secure_area; secure_area only allows password processing logic to access, refuses read and write requests of user_area; The data flow mechanism of user area and secure area is realized, the password plaintext input by the user is first stored in the specified buffer of user area by the user business code (due to PMP limitation, it cannot be directly written into secure area); the intermediate layer transfer, the riscv_crypto_process() interface is called, which is executed under the permission of M mode, first verifies the legitimacy of the user area buffer, and then copies the password plaintext from the user area to the internal buffer of the secure area through a secure copy function such as secure_memcpy()); secure processing, the password processing logic is executed in the secure area, and the user area business code cannot interfere during the process due to PMP protection; result return, after the processing is completed, the intermediate layer interface copies the result from the secure area back to the result buffer of the user area through secure_memcpy(), which is read by the user business code; strengthen access control and exception handling, configure PMP as "white list" mode: only allow legal access of user area and secure area, and other memory regions are prohibited by default; register exception handling function: when user area tries to access secure area beyond the boundary (trigger PMP exception), the exception handling function immediately terminates the operation and returns an error, preventing sensitive data leakage.

[0039] Step four, establish a fault recovery mechanism, safely restore U mode business in M mode exception, real-time backup and timeout protection, including state real-time backup and rollback, timeout monitoring and forced unlocking; State real-time backup and rollback: before switching from U mode to M mode each time, first perform backup operation, temporarily disable U mode interrupt to prevent request queue from being concurrently modified, ensure data consistency; read the real-time state of the current U mode and request queue; write these data into the fault_safe_backup area of MRAM, and calculate the checksum and store it in the backup area; after completion, re-enable the U mode interrupt, and then enter the M mode processing logic; rollback process after crash: when M mode runs crash, the system restarts, first verifies the checksum of fault_safe_backup to confirm that the backup data is valid; if valid, read the backup U mode state, restore program counter, state register, etc., to accurately locate the running position before the U mode interrupt; at the same time, restore the request queue, and mark the unprocessed requests in it as failed to avoid business stagnation due to uncompleted requests; finally, return to U mode through mret instruction and continue normal operation.

[0040] Timeout monitoring and forced unlocking: a hardware timer is started in M mode, a timeout threshold is set, if the password processing is timed out, the timer triggers an interrupt, and the force_unlock() function is executed: the sensitive data in M mode is cleared, the U mode state in the fault_safe_backup is restored, the U mode is forced to return and the authentication timeout is notified to the business layer, so that the business layer can handle the subsequent logic; the timer interrupt is disabled, and finally the mret instruction is used to force the system to return to the U mode, ensuring that the system returns to normal operation; Step five, the complete password acquisition process includes the following contents: 51, U mode receives user input: the user inputs the password in the APP, and the plaintext is temporarily stored in the stack memory of the U mode; 52, request queuing and switching triggered: store the password pointer in req_queue, and switch to M mode through ecall when the threshold is reached; 53, M mode security processing: read the password plaintext from req_queue, and complete encryption in the PMP area, such as HMAC verification with the local key, and store the processing result in the result buffer; 54, result return and state recovery: return to U mode through mret, call the callback function to notify the business layer of the processing result (success / failure), and clear the password plaintext in U mode and M mode; 55, exception handling: if a crash / timing out occurs, trigger the recovery mechanism of step 4 to ensure system availability and prevent sensitive data from being leaked.

[0041] Method for using the application and working principle: first, when the M mode security environment is preloaded, the system starts in M mode, a continuous aligned physical memory protection area is reserved through the physical memory protection mechanism, which is used to store: ① password processing core function, ② temporary buffer area, ③ pre-initialized M mode peripheral interface handle, RISC-V architecture detection: design the riscv_arch_detect() function, read the RISC-V misa register to determine the core capability of the current system, and generate an architecture configuration table, create a queue in U mode (user mode) to store password acquisition requests for a short period of time, the queue element includes request ID, password plaintext pointer, and processing result callback function; at the same time, set the queue trigger threshold, when the threshold is reached, switch to M mode through the ecall instruction, process all requests in batches, before switching to M mode, only record the core state of U mode: including sepc, sstatus, req_queue current pointer, and store these states in the u_state_backup structure in the PMP protection area; after M mode processing is completed, the sepc and sstatus are directly restored through the mret instruction, skipping the restoration step of unnecessary registers, and quickly returning to the queue processing logic of U mode; The mode support difference of different RISC-V architectures is adapted through intermediate layer dynamic binding and pseudo U mode simulation, a unified password processing interface riscv_crypto_process() is defined to shield the difference of the underlying layer; based on the architecture configuration table (arch_config_t) dynamic binding processing logic, in the pure M mode system, two independent memory areas are divided through PMP; the user password plaintext is first stored in user_area, and then copied to secure_area for processing through the intermediate layer interface, and the processing result is returned to user_area; for M mode crash, processing timeout and other exceptions, through real-time backup and timeout forced recovery, the system is ensured not to be stuck, and sensitive data is ensured not to be leaked, before switching from U mode to M mode each time, the backup is executed: ① temporarily disable U mode interrupt; ② read U mode core state and req_queue real-time state; ③ write data to the fault_safe_backup area of MRAM and calculate the checksum; if M mode crashes, after the system restarts: ① verify the checksum; ② restore the U mode state; ③ mark the unprocessed requests in the queue as failed; ④ return to U mode through mret to continue running, M mode starts the hardware timer and sets the timeout threshold; if the password processing is timed out, the timer interrupt is triggered, and the force_unlock() function is executed: ① clear the sensitive data in M mode; ② restore the U mode state in fault_safe_backup; ③ disable the timer interrupt; ④ return to U mode through mret and notify the business layer of the authentication timeout.

[0042] Although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art can modify the technical solutions recorded in the foregoing embodiments, or make equivalent replacements to part of the technical features, any modification, equivalent replacement, improvement, etc. made within the spirit and principles of the present application shall be included in the protection scope of the present application.

Claims

1. A method for obtaining cryptography based on a RISC-V architecture, characterized in that: Includes the following steps: S1. Environment Initialization and Resource Pre-configuration: Prepare the M-mode security environment to reduce dynamic switching overhead; adapt to the mode support of different RISC-V architectures, including M-mode security environment pre-loading and RISC-V architecture dynamic detection. S2. Construct a lightweight mode switching mechanism: By designing an authentication request buffer queue and simplifying state recording and recovery, reduce the number of mode switches and state processing overhead between U and M. The authentication request buffer queue design includes the following: S21. In U mode, create a circular buffer queue (req_queue) to store password retrieval requests within a short period of time. The queue elements include: request ID, a pointer to the plaintext password entered by the user, and a callback function for the processing result. S22. Set the queue trigger threshold. When triggered, switch to M mode all at once through environment call instruction (ecall) to process all requests in batches. S3. Compatibility adaptation layer implementation: Through the mode adaptation intermediate layer and the pseudo-U mode adaptation of simplified RISC-V, it adapts to systems that only support some modes or simplified RISC-V architecture. S4. Establish a fault recovery mechanism: Utilize real-time state backup and rollback, timeout monitoring and forced unlocking to safely restore U-mode services when M-mode is abnormal, and perform real-time backup and timeout protection. S5. Password Acquisition Complete Process: The user enters the password in the APP, and the plaintext is temporarily stored in the stack memory of U mode. The password pointer is stored in req_queue. After the threshold is reached, the system switches to M mode through ecall for M mode security processing. Then, the result is returned and the state is restored. If an exception occurs, the recovery mechanism of S4 is triggered.

2. The cryptographic acquisition method based on RISC-V architecture according to claim 1, characterized in that: In step S1, during the preloading of the M-mode security environment, the system enters the M-mode initialization phase upon startup. By configuring the physical memory protection mechanism, a physical memory protection area is reserved to store the core functions of password processing and temporary buffers in M-mode. The peripheral interfaces in M-mode are pre-initialized, and the interface handles are stored in a fixed address in the physical memory protection area (PMP) to avoid repeated initialization during switching.

3. The cryptographic acquisition method based on RISC-V architecture according to claim 1, characterized in that: In step S1, during dynamic detection of the RISC-V architecture, the riscv_arch_detect() function is designed to read the RISC-V machine mode instruction set architecture register (MISA register) to determine the modes and privilege levels supported by the current system. Based on the detection results, an architecture configuration table is generated, recording whether U mode is supported, the mode switching instruction type, and the granularity of PMP support.

4. The cryptographic acquisition method based on RISC-V architecture according to claim 1, characterized in that: In step S2, during the simplified state recording and recovery, before switching to M mode, only the core state of U mode is recorded and stored in the data structure (u_state_backup structure) of the user mode key running state in the PMP area. After the M mode processing is completed, the abnormal program counter (sepc) and the supervisory mode status register (sstatus) of the supervisory mode are restored by the mret instruction, and the queue processing logic of U mode is directly returned.

5. The cryptographic acquisition method based on RISC-V architecture according to claim 1, characterized in that: In step S21, when creating the circular buffer queue, a queue structure is defined in the user-space memory of U mode, containing key information such as buffers, pointers, and state control.

6. The cryptographic acquisition method based on RISC-V architecture according to claim 1, characterized in that: In step S3, when adapting the mode to the intermediate layer, dynamic binding is implemented based on arch_config_t in S1. If U and M modes are supported, it is bound to the U to M batch switching processing logic. If only M mode is supported, it is bound to the isolation processing logic within M mode.

7. The cryptographic acquisition method based on RISC-V architecture according to claim 1, characterized in that: In step S3, when adapting the simplified RISC-V pseudo-U mode, for systems without U mode, two memory regions are divided in M ​​mode using PMP, and the two regions are isolated from each other to prevent out-of-bounds access.

8. The cryptographic acquisition method based on RISC-V architecture according to claim 1, characterized in that: In step S4, during real-time state backup and rollback, if a crash occurs during M mode operation, the system restarts and reads the backup structure (fault_safe_backup) stored in the non-volatile storage area, restores the U mode state through mret, and marks incomplete password requests as failed.

9. The cryptographic acquisition method based on RISC-V architecture according to claim 1, characterized in that: In step S4, if the password processing times out, the timer in M ​​mode triggers an interrupt, clears the sensitive data in M ​​mode, restores the U mode state, forces a return to U mode, and notifies the business layer that the authentication timeout has occurred, thus completing the forced unlocking.

10. The cryptographic acquisition method based on RISC-V architecture according to claim 1, characterized in that: In step S4, during the M-mode security processing, the plaintext password is read from req_queue, encrypted within the PMP area, and the processing result is stored in the result buffer. When the structure returns and the state is restored, the U-mode is returned via mret, and the callback function is called to notify the business layer of the processing result. At the same time, the plaintext password in both U-mode and M-mode is cleared.

Images