Open Source Software Supply Chain for RISC-V Ecosystem

Open source software has gradually become the mainstream mode for software co-development and distribution. The rapid growth of the number of open source software and its increasingly widespread applications have made it an important need in the current information industry to build high-quality open source software supply chains, and also a core competitiveness of the instruction set ecosystem. RISC-V, as a new generation of reduced instruction set architectures, compared with the mature and prosperous X86 and ARM ecosystems, needs to quickly build a high-quality RISC-V open source software supply chain for its ecosystem to be sustainable and prosperous. We first introduce the definition and characteristics of open source software supply chains, as well as the current status of the rapid development of the RISC-V instruction set. Then, the critical links in the open source software supply chain for RISC-V instruction sets, such as the general open source IP core, general basic software, open source code migration tools, open source software upstream communities, and ecological fragmentation management, are deeply analyzed. At the same time, we point out the potential intellectual property risks, software vulnerability risks, vulnerability propagation risks, and continuous maintenance risks that need to be addressed in building an open source software supply chain, as well as possible solutions under RISC-V. We believe that the combination of the RISC-V instruction set and the open source software supply chain will bring a new and more prosperous hardware and software ecosystem.