22.d2s3-7-0821_Final_[101]_The practical use cases of the RISC-V IOPMP.pdf

1、The Practical Use Cases of the RISC-V IOPMP Andes SoCs Rapid-k ModelAugust 24,2023Dr.Paul Shan-Chyun KuAndes TechnologySpeaker:Dr.Paul Shan-Chyun KuExperience:The Chair of IOPMP Task Group(2022-)The Vice-chair of TEE TG(2021-2022)Deputy Technical Director,Andes TechTaking RISC-V Mainstream3A Typical

2、 PlatformInterconnect-1RISC-V CPUAddr,Len,R/W/XDMA,NIC,orDisplay CTLRDSP/GPUAddr,Len,R/W/XAddr,Len,R/Winterconnect-2devicesdevicesdevicesFlash memorySRAM/DRAMCrypto EngineAddr,Len,R/WregionregionregionregionregionregiondevicesdevicesPMPTaking RISC-V Mainstream4Subject to change without noticeCopyrig

3、ht 2021 Andes TechnologyVulnerability and Threat RISC-V CPUs transactions are checked by PMP/ePMP:By Where,How,and Which to access The other I/O agents:DSP,GPU,DMA,NIC,LCDC Transactions from them are NOT CHECKED vulnerability!A malicious SW that can control the I/O agents to access anywhere becomes

4、the threat.EX:an attack asks the I/O agent to read the sensitive asset without PMP/ePMPs check and store it to its own legal space.IOPMP is the tool to mitigate the such a threat.The IOPMP task group under the RISC-V international is working on the architecture spec.Taking RISC-V Mainstream5A Platfo

5、rm with IOPMPsInterconnect-1 w/SIDCPUSIDAddr,Len,R/W/XDMA,or OtherI/O AgentDSP/GPUSIDAddr,Len,R/W/XSIDAddr,Len,R/Winterconnect-2 w/o SIDIOPMP-3devicesdevicesdevicesIOPMP-2FlashIOPMP-1SRAM/DRAMentries entries entries Crypto EngineSIDAddr,Len,R/WSIDSIDSIDregionregionregionregionregionregionCTRLCTRLCTR

6、LPMPTaking RISC-V Mainstream6Crypto Engine Read Privat KeyInterconnect w/SIDSID=0Addr,Len,R/W/XDMAGPUSID=1Addr,Len,R/W/XSID=3Addr,Len,R/Winterconnect-2 w/o SIDIOPMP-3devicesKey(RoT)devicesIOPMP-2FlashIOPMP-1SRAM/DRAMCrypto EngineSID=2Addr,Len,R/WSIDSIDSIDregionregionregionregionregionregionCTRLCTRLC