Patent Application
20250165655
The present invention is related to switching between a privileged mode and an unprivileged mode, and more particularly, to a method for executing a system task in the unprivileged mode and an associated electronic device.
For a software stack running on a processor of an electronic device, switching between a privileged mode and an unprivileged mode can provide protection for different components of the software stack. In the privileged mode, all resources of the software stack and the protected memory regions can be accessed. For example, a system task can be run in the privileged mode. In the unprivileged mode, some system regions and protected memory regions are restricted from being accessed. For example, hardware, a kernel, an operating system (OS), and an OS driver are prevented from being accessed. Considering robustness and security of the electronic device, user programs need to run in the unprivileged mode to prevent some malicious user programs. Some problems may occur, however. Under a condition that the processor is initially in the privileged mode and a plurality of user programs are required to be executed, when each of the plurality of user programs starts to be executed, it is required to switch from the privileged mode to the unprivileged mode. After the each of the plurality of user programs is executed, it is required to switch back to the privileged mode for executing the system task, which may cause latency. For a conventional method, the plurality of user programs to be executed will be combined into a combined user program, however, not all user programs are capable of being combined, and the design flexibility may be limited. In addition, the execution of the combined user program may reduce the overall performance. As a result, a novel method and an associated electronic device than can execute the system task in the unprivileged mode are urgently needed, to reduce the number of mode switching.
It is therefore one of the objectives of the present invention to provide a method for executing a system task in an unprivileged mode and an associated electronic device, to address the above-mentioned issues.
According to an embodiment of the present invention, an electronic device is provided. The electronic device comprises a processor and a hardware component. The processor is arranged to utilize an instruction set architecture (ISA) to transmit a first request with a first verification key to a hardware component, for requesting the hardware component to execute a system task in an unprivileged mode, wherein the ISA corresponds to the hardware component, and the system task requests to access a target hardware address. The hardware component is arranged to determine whether to access the target hardware address according to the first verification key.
According to an embodiment of the present invention, a method for executing a system task in an unprivileged mode is provided. The method comprises: utilizing, by a processor, an ISA to transmit a first request with a first verification key to a hardware component, for requesting the hardware component to execute the system task in the unprivileged mode, wherein the ISA corresponds to the hardware component, and the system task requests to access a target hardware address; and determine, by the hardware component, whether to access the target hardware address according to the first verification key.
One of the benefits of the present invention is that, by comparing the verification key read from the target hardware address and the verification key obtained from the processor, the system task can be executed in the unprivileged mode. In this way, by a configuration of the hardware component, the ISA, and the verification keys, the number of switching between the privileged mode and the unprivileged mode can be reduced, which can greatly improve the latency caused by the mode switching. In addition, the security and the robustness of the electronic device can be ensured.
These and other objectives of the present invention will no doubt become obvious to those of ordinary skill in the art after reading the following detailed description of the preferred embodiment that is illustrated in the various figures and drawings.
Certain terms are used throughout the following description and claims, which refer to particular components. As one skilled in the art will appreciate, electronic equipment manufacturers may refer to a component by different names. This document does not intend to distinguish between components that differ in name but not in function. In the following description and in the claims, the terms “include” and “comprise” are used in an open-ended fashion, and thus should be interpreted to mean “include, but not limited to . . . ”.
The super-loop architecture may include an infinite loop. After the processor 12 is powered on, a main function of the super-loop starts to be executed, an initialization is performed, and the infinite loop is entered. The infinite loop may include 4 Steps S100, S102, S104, and S106.
In Step S100, a current status of the processor 12 is checked. For example, it is checked that whether there is any user program to be executed.
In Step S102, in response to there being a user program to be executed, the user program is started to be executed by the processor 12.
In Step S104, after the user program is executed, a completion response is returned to a user.
In Step S106, some hardware values that are modified due to execution of the user program are recovered to original values, and Step S100 is returned.
The above operations can be expressed by the following pseudo code.
{
In response to the execution of the system task SYS_T in the unprivileged mode UPR_M, the processor 12 may utilize an instruction set architecture (ISA) to transmit a request REQ_ST with a first verification key FV_KEY to the hardware component 16, for requesting the hardware component 16 to execute the system task SYS_T in the unprivileged mode UPR_M, wherein the ISA corresponds to the hardware component 16, and the system task SYS_T requests to access a target hardware address 20. After receiving the request REQ_ST, the hardware component 16 may be arranged to determine whether to access the target hardware address 20 according to the FIRST verification key FV_KEY. Specifically, please refer to
Afterwards, the processor is switched from the privileged mode PR_M to the unprivileged mode UPR_M due to execution of the user programs UP_1-UP_N. In the unprivileged mode UPR_M, in response to the execution of the system task SYS_T, the processor 12 may transmit the request REQ_ST with the first verification key FV_KEY to the hardware component 16. The hardware component 16 may read the second verification key SV_KEY from the target hardware address 20, and compare the first verification key FV_KEY with the second verification key SV_KEY to generate a comparison result COM_R. In response to the comparison result COM_R indicating that the first verification key FV_KEY matches the second verification key SV_KEY, the hardware component 16 may determine to access the target hardware address 20 according to the request REQ_ST to generate an access result ACC_R, and transmit the access result ACC_R and a success response SU_R to the processor 12. In response to the comparison result COM_R indicating that the first verification key FV_KEY does not match the second verification key SV_KEY, the hardware component 16 may determine not to access the target hardware address 20, and transmit a failure response FA_R to the processor 12.
In this embodiment, by comparing the second verification key SV_KEY read from the target hardware address 20 and the first verification key FV_KET obtained from the processor 12, the system task SYS_T can be executed in the unprivileged mode UPR_M. By generating the key KE in the privileged mode PR_M and storing the key KE in the software stack and the target hardware address 20 as the first verification key FV_KEY and the second verification key SV_KEY, respectively, the derivation of the key KE can be regarded as an extension of the privilege, which can ensure the security of the execution of the system task SYS_T requesting to access the target hardware address 20 in the unprivileged mode UPR_M. It should be noted that every time the processor 12 is returned from the unprivileged mode UPR_M to the privileged mode PR_M, the processor 12 may request the hardware component 16 to regenerate the key KE, to make the key KE time-sensitive.
In Step S400, by the processor 12, the ISA is utilized to transmit the request REQ_ST with the first verification key FV_KEY to the hardware component 16, for requesting the hardware component 16 to execute the system task SYS_T in the unprivileged mode UPR_M, wherein the ISA corresponds to the hardware component 16, and the system task SYS_T requests to access the target hardware address 20.
In Step S402, by the hardware component 16, it is determined whether to access the target hardware address 20 according to the first verification key FV_KEY.
Since a person skilled in the pertinent art can readily understand details of the steps after reading above paragraphs, further descriptions are omitted here for brevity.
In summary, by comparing the second verification key SV_KEY read from the target hardware address 20 and the first verification key FV_KET obtained from the processor 12, the system task SYS_T can be executed in the unprivileged mode UPR_M. In this way, by a configuration of the hardware component 16, the ISA, and the verification keys (e.g., the first verification key FV_KET and the second verification key SV_KEY), the number of switching between the privileged mode PR_M and the unprivileged mode UPR_M can be reduced, which can greatly improve the latency caused by the mode switching. In addition, the security and the robustness of the electronic device 10 can be ensured.
Those skilled in the art will readily observe that numerous modifications and alterations of the device and method may be made while retaining the teachings of the invention. Accordingly, the above disclosure should be construed as limited only by the metes and bounds of the appended claims.
