risc-v poster preview · mohamed shalan, ph.d., ahmed agiza, ahmed elshafey, karim hasebou, mohamed...

RISC-V Poster Preview7th RISC-V Workshop

End-to-end formal ISA verification ofRISC-V processors with riscv-formal

● Framework for formally verifying RISC-V processor cores● Only requires Open Source tools (Yosys, ABC, Yices2, etc.)● Every core that implements the RVFI trace port is supported (can easily be

added to existing cores)● End-to-end ISA verification is hard. We break the problem down into 100+

small problems that can be proven independently. This yields a tractable formal verification problem.

● Monitor core for tandem verification using same formal spec and RVFI trace port is available.

● Is being used to formally verify real-world processors right now (not vapourware, not just for “academic toy processors”)− https://github.com/cliffordwolf/riscv-formal

https://github.com/cliffordwolf/riscv-formal

Results, Status, Future Work● Found bugs in

− RISC-V Rocket− PicoRV32− Spike (riscv-isa-sim)− The prose ISA Spec

● Currently supports− RV32 / RV64− C extension− M extension

● Future Work− Atomics− F/D/Q support− Priv. Spec, CSRs− Better support for

non-free flows− Verification of other

RISC-V formal specs− More cores

© 2015 Microsemi Corporation. 4

Power Matters.TM

MicroPython Port for RISC-V soft ProcessorBadal Nilawar

Power Matters.TM 5© 2015 Microsemi Corporation.

MicroPython (RISCV) Software Architecture

▪ Microsemi ported MicroPython on RISCV

▪ Porting activity involves▪ Startup code▪ RISCV HAL integration▪ Tool chain▪ Driver porting

▪ Features▪ Machine modules like Pin, mtime▪ REPL▪ Advanced Math Library▪ Soft Float

▪ Features Planned▪ SPI, I2C, Ethernet▪ Multi Threading▪ File system support▪ Distributing on Github

R:12 G:35 B:83

R:17 G:59 B:149

R:244 G:146 B:45

R:88 G:88 B:88

Century Gothic Slide Title – 36pt

Century Gothic Content Title – 24ptCentury Gothic Content Text – 20pt

Century Gothic Subhead – 24pt

Century Gothic Compare Heading – 18pt

Presentation Colors

R:137 G:137 B:137

Century Gothic Image Caption – 16pt

Century Gothic Table Text & Caption Text – 14pt

The larger text sizes have condensed spacing, between 1.5 and 0.5 pt.

Micriµm

Jean J. LabrosseFounder and Chief Software [email protected]

R:12 G:35 B:83

R:17 G:59 B:149

R:244 G:146 B:45

R:88 G:88 B:88





Presentation Colors

R:137 G:137 B:137




Leading Embedded RTOS and Stacks

µC/OS-II or µC/OS-III

µC/Probe

SystemView

Tracealyzer

µC/TCP-IP (IPv4 and IPv6)

µC/USB-H and µC/USB-H

µC/GUI

µC/CAN

µC/Modbus

µC/FS

IAR, Keil, GNU, Other

Tools RTOS

Stacks

R:12 G:35 B:83

R:17 G:59 B:149

R:244 G:146 B:45

R:88 G:88 B:88





Presentation Colors

R:137 G:137 B:137




RTOS (µC/OS-II and µC/OS-III)• Professional Grade, Fully Supported• Ported to over 45 CPU architectures• Certified in numerous verticals:

– Avionics – Medical – Industrial – Nuclear

• µC/OS-II on Mars Curiosity Rover • Books by MicriµmPress:

– 7 on µC/OS-III– 5 on µC/TCP-IP– 1 on µC/USB-D

R:12 G:35 B:83

R:17 G:59 B:149

R:244 G:146 B:45

R:88 G:88 B:88





Presentation Colors

R:137 G:137 B:137




µC/OS-II / µC/OS-III and the RISC-V• Ported onto the Microsemi Creative Board

– SoftConsole

• Available soon on:– Digilent ARTY Artix-7 FPGA Dev Board with Segger Embedded Studio and

J-Link

© 2017 Microsemi Corporation. Company Proprietary 10

Power Matters.TM

Enabling Safe Crypto Using RISC-V Soft Processor

Sathish Odiga

Power Matters.TM 11© 2017 Microsemi Corporation. Company Proprietary

▪ Microsemi PolarFire® FPGAs represent the industry’s most advanced secure programmable FPGAs.• Built-in Athena's TeraFire® crypto processor supports the CNSA suite and beyond, and includes

side-channel analysis resistant countermeasures.

▪ RISC-V soft processor is a perfect complement to the PolarFire FPGAs for building secure and reliable systems. • Open-source RISC-V ISA enables application-specific processor implementations• Unlike competing processors, the RISC-V processors allow inspection of the RTL to build trust on the

processor implementation.

▪ Secure boot is the starting point for implementing secure systems• Process of guaranteeing that the boot code and all subsequent codes are authentic is called Secure

Boot. • PolarFire FPGAs have built-in security capabilities to support secure boot of soft RISC-V processor

Introduction


Secure Boot RISC-V Processor

MiV_RV32IMA_L1_AHB(RISC-V CPU)

AHBL Bus

Crypto Processor

AHB_MST_MEM

AXI Interconnect Bus

SRAM

AHB_MST_MMIO

SPI Slash

System Controller

1. At power-up, System Controller copies authenticated bootloader from sNVM to SRAM.

2. Processor executes the bootloader from SRAM.

3. Bootloader fetches the application keys from sNVM.

4. Bootloader commands Crypto Processor for application authentication and decryption.

5. Bootloader copies the authenticated application from SPI Flash to DRAM and executes it.

SystemServices

sNVM

PolarFire FPGA

DDR Controller

DDR Memory

resetreset

(Encrypted and signed Application)

(Trusted Bootloader and Keys) (Protected by SRAM-PUF)

init_done

© 2017 Microsemi Corporation. Company Proprietary 13

Power Matters.TM

RISC-V based Lockstep Processor Implementation

Sathish Odiga


▪ Increasing levels of automation driving broader adoption of safety-critical systems• Systems must function correctly in order to avoid hazardous situations• Faults must be detected and controlled

▪ Safety-critical systems heavily rely on embedded processors• Need methodologies for fault detection due to random faults in the embedded processor.

▪ Lockstep processor provides real-time diagnostics using an additional slave processor and a comparator.• Two identical processors run in lockstep with address, data and controls compared for consistency. • Temporal and spatial separation of cores increases reliability

▪ Flash FPGAs are attractive in safety-critical applications• Flexibility to implement custom hardware• Built-in security and reliability features

Motivation


Dual-core Lockstep Processor Demo

An Engines Extension for RISC-V

Eric L. McCorkle

Overview of the ExtensionProvides a mechanism for fast access to specialized functional units and (some) devices without crossing privilege levels

● Allows interaction with engine resources by the regular pipeline● Can be used for specialized functional units, also devices● Engines bound to engine handles prior to use● Engines have states to control resource usage, aid virtualization● Virtualization through suspend/resume capability● Security through ownership/access masks

History of the Extension● Originated as an attempt to design a crypto extension● “Crypto engines” envisioned as special functional units to decouple

instructions from specific algorithms● States and transitions emerged as a way to allow for automation injection of

pseudo-ops to “fuzz” side-channels● Discussions on the isa-dev list led to improvements● DMA capabilities accounted for (no modification needed)● At this point, the extension could potentially function as an I/O instruction set

Cloud-Based RISC-V SoC design and Co-simulation

Mohamed Shalan, American University Cairo(Presented by Sam Steffl, Brown Univ)

Mohamed Shalan, Ph.D., Ahmed Agiza, Ahmed ElShafey, Karim Hasebou, Mohamed Gaber, Veronia BahaaThe American University in Cairo

Sherief Reda, Ph.D. -- Brown UniversityPresenter: Samuel Steffl – Brown University

•

••

An online digital design platform with RISC-V at the core.

dwarfRV32: A small footprint RV32I CPU

SoC Editor: An online rule-based editor using dwarfRV32

Beekeeper: A bus functional model/debugger leveraging the Verilog Procedural Interface

DBT-RISE:Addressing the RISC-V VP Challenge

Eyck JentzschWolf-Ekkehard Matzke

Page ▪ 26

DBT-RISE RISC-VStart SW development even before having RTL or silicon

UART

VMA

DA

PTE

R

GD

B

SE

RV

ER

ARCH

UART GPIO SPI PWM RAM

system environment/test bench

PLIC

HiFive1

Dynamic Binary Translation -Retargetable ISS Environment

7th RISC-V Workshop – Eyck Jentzsch, Wolf-Ekkehard Matzke

Available as Open SourceProfessional Services on request

Page ▪ 27

DBT-RISEFocus on• Performance• Easy integration• Accuracy• Adaptability & Extensibility

Development driven by real-world customer requirements• Straightforward generation of

ISSs• Convenient VP authoring• Considerable flexibility


Applied to RISC-V to foster VP development➔ Demo: HiFive 1

Page ▪ 28

contact


address

MINRES Technologies GmbH

Keltenhof 2

85579 Neubiberg

Germany

phones

phone +49-89-67807688

fax +49-89-67807689

online

www.minres.com

github.com/minres/

[email protected]

Detecting Advanced Malware as Instruction and Microarchitectural

AnomaliesPranav Kumar, Austin Harris, Mohit Tiwari

SPARK LabUniversity of Texas at Austin

The Initial Problem● SW and OS defenses detect malware (trojans, viruses, worms, backdoors).

App 2

Application Framework

Libraries

Operating System

Drivers

CPU

App 1

Usual Attacks

System Call MonitorOS defenses

The Problem● SW and OS defenses cannot detect advanced malware.

What about these attacks? Hardware-based Malware Detectors!

App 2

Application Framework

Libraries

Operating System

Drivers

CPU

App 1

Side channel data leaks, rowhammer, analog hardware

Solution?● Closing off individual channels would have limited coverage and probably

incur overheads.● Thus, we look at modeling the execution of a program to label it as benign

or malicious in real-time.

Evaluation on x86

Advanced Malware Under Test True Positives

False Positives

AUC

Floating Point Timing Channel 100 0 0.99

Rowhammer 100 0 0.99

JIT-Spray 99.98 0.93 0.89

Breaking ASLR using prefetch 100 0 0.96

Cache and Memory Covert channels 100 0 0.97

Shortcomings with current systems

● Intel only allows counting up to 4 performance counters at one time

● Unable to distinguish interference or contention● Coarse granularity plays a bottleneck● Low flexibility

Need ...

Monitoring should be --

● Fine-grained (multiple granularities)● Programmable● Low-overhead

Proposed Solution ...

A RISC-V Solution

● Fine grained -- Add hardware signals to extract: e.g., contention counters

● Programmable -- Software chooses the signals which will leak info.

● Low-overhead -- Hardware co-processor to extract features and run the anomaly detection

Comparison of twoJIT compiler approaches

for RISC-VBoris Shingarov

LabWare

Target-AgnosticUse logic programming to automatically infer the dynamic code generator from a formal description of the ISA written in a Processor Description Language

Formal VerificationThe dynamic code generator is developed in the Coq interactive proof assistant and its executable form is extracted from the proof

Target-Agnostic JIT

From: B. Shingarov, Live Introspection of Target-Agnostic JIT in Simulation.IWST’15, Brescia, Italy. ACM, 2017.

Formal Verification

From: B. Shingarov, Programming a Smalltalk VM in Coq.IWST’17, Maribor, Slovenia. ACM, 2017.

FPGA-BASED CNN HARDWARE ACCELERATOR

WITH RISC-V PROCESSORRISC-V Workshop Poster

Marcela Zachariasova, [email protected]

Harald Weiss, [email protected]

mailto:[email protected]


CODASIP KORTIQ

FPGA-BASED CNN HARDWARE ACCELERATOR

WITH RISC-V PROCESSOR

RIOT-OS Port to RISC-VCraig Steele and JP Bonn

Tautline LLCFlagstaff, Arizona

RIOT-OS Port to RISC-V

RIOT-OS Features:IoT Target HW: 8-32b MCUs, noMMUSmall Footprint + Low PowerMulti-Threaded MicrokernelC/C++ Coding

RIOT-OS Port to RISC-VHiFive1 initial target: Arduino-ishLarge Slow Flash: 16MiBSmall Fast SRAM: 16KiBI-Cache Performance Tuning/Detuning

UltraZed & MCU Security Experiments

SCRx cores extensibility overview

Alexander RedkinSyntacore

[email protected]

http://www.syntacore.com


SCRx cores extensibility featuresBaseline cores:❏ SCR1: Minimalistic MCU-class open-source core

Minimal area configuration is <15 kGates

❏ SCR3: High-perf 32-bit MCU with privilege modesCompetitive characteristics

❏ SCR4: 32-bit MCU core with high-perf FPUIEEE 754-2008 compatible

❏ SCR5: Efficient mid-range APU/embedded core1GHz@28nm, virtual memory, 2-4 cores SMP, Linux

Stable designs available for evaluation-FPGA-based SDKs, silicon samples, tools, documentation

Extensibility features:

❏ Computational capabilitiesNew functions using existing HW

New functional units

❏ Extended storageMems/RF, addressable or state

Custom AGU

❏ I/O ports

❏ Specialized system behaviorSpecialized processing for standard events

Custom events

One-stop service: workload analysis, implementation, tools

SCR5 extensibility exampleCustom ISA extension for AES & other crypto kernels acceleration

■ Data◆ RV32G – FPGA-based devkit, g++ 5.2.0, Linux 4.6, optimized C++ implementation◆ RV32G + custom – same + intrinsics◆ Core i7 6800K @ 3.4GHz, g++ 5.4.0, Linux 64, optimized C++ implementation

■ Area increase: 11.7% core, 3.7% at the CPU cluster level

Disclaimer: Authors are aware AES allows for more efficient dedicated accelerators designs, used as a sample algorithm

RISC-V Security: SHAVE and Beyond

Sponsored by the Air Force Research Laboratory (AFRL) and developed with funding from the Defense Advanced Research Projects Agency (DARPA) under contract number

FA8650-16-C-7665. Any views, opinions, findings, conclusions and/or recommendations expressed in this material are those of the author(s) and do not necessarily reflect the views of

the United States Air Force, the Department of Defense or the U.S. Government.

Experiments in RISC-V Trusted Boot

Sponsored by the Air Force Research Laboratory (AFRL) and developed with funding from the Defense Advanced Research Projects Agency (DARPA) under contract number

FA8650-16-C-7665. Any views, opinions, findings, conclusions and/or recommendations expressed in this material are those of the author(s) and do not necessarily reflect the views of

the United States Air Force, the Department of Defense or the U.S. Government.

Commercially Supported RISC-V Simulation and Platform Development ToolsSimon Davidmann, Imperas Software Ltd.

© 2017 Imperas Software Ltd. 7th RISC-V Workshop, Nov. 201762

Who are Imperas?▪ Leading independent commercial simulation vendor,

established 10 years▪ Solutions for small single core controller users all the way to high

end 64bit MP Arm, MIPS architectural licensees▪ Single licenses to enterprise wide regression farms▪ Formed Open Virtual Platforms (OVP) to drive industry▪ Oxford, UK HQ, Calif. US Sales, Distributors RoW

▪ Focus on embedded software development utilizing simulation▪ models, simulators, tools, methodologies, solutions


What we provide for Embedded Software Developer▪ Fast Processor Models (200+) for different vendors/ISA (10+)▪ High performance IA Simulator

▪ integrateable into 3rd party & test environments▪ Tools for non-intrusive C Application profiling and line coverage▪ GUI, Debugger - multi-processor debugger

▪ Eclipse based, extended for hetero MP, programmers view ▪ Source code level, instruction, platform

▪ ISS and Extendable Platform Kits for flexibility and quick start▪ Variety of extendable reference models of standard platforms running various operating

systems (FreeRTOS, Linux, …)▪ Includes over 200 peripheral component models of standard parts (Ethernet, USB, CAN, …) to

easily create own platforms▪ OS-aware tools for porting and bring up of operating systems, hypervisors, drivers▪ Simulator designed to be used in regression test and Continuous Integration /

Continuous Test environments


What do we offer for RISC-V processor developers▪ Commercially supported models, simulator, tools focused on RISC-V

▪ Highest performance RISC-V simulator: 25+ X faster than Spike

▪ All 32/64bit RISC-V CPU features implemented in simulator, currently 12 variant models, 6 vendor core models

▪ CPU models easily user extendable using standard tool features adding customer specific registers, instructions, behaviors

▪ CPU Model Code Coverage tool▪ CPU Instruction Coverage tool▪ CPU Cycle Approximate simulation using CPU cycle timing estimation▪ CPU performance simulator interface e.g. to Gem5▪ Interfaces for use with 3rd party simulators, RTL testbenches for DV

▪ Imperas RISC-V processor verification tools/suite

▪ OEM of Imperas commercially supported simulator and vendor specific models, platforms


Imperas and Microsemi collaborate on RISC-V simulation models and tools

▪ Mi-V Imperas FreeRTOS Extendable Platform Kit


Thank you!

For more information about the leading commercial simulation, models, and tools for RISC-V designs:

www.imperas.com

www.OVPworld.org

http://www.imperas.com/

http://www.ovpworld.org/

Making Today’s Processors Immune to Cyber Attacks

CoreGuard™ from Dover Microsystems

Jothy Rosenberg, Greg Sullivan, Andrew Sutherland, Julian Scherding

Cyber security software addsmore vulnerabilities andruins performance

▪ Processors blindly run vulnerable software

▪ Today’s security responds with more software

▪ But adding more layers of software—even security software—just adds more bugs

▪ Plus each layer of software substantially degrades system performance

▪ Today’s processors are defenseless

Even the best hackers have

not figured out a way to

download changes to your

microprocessor… you

can’t alter the silicon

- Larry Ellison

“

“

▪ Compatible with leading embedded processor architectures

(optimized for RISC-V) and application software.

▪ Flexible design allows for power, performance, area, and

security optimization.

▪ Delivered as an IP Block (hardware design files) to

semiconductor companies and embedded system designers.

▪ Maintains metadata for every word in memory and checks each

instruction against customer-defined security rules.

CoreGuard: Security IP that boltsonto existing processors

Tell CoreGuard which instructions to let pass and which to block based on metadata. Micro-policies and metadata give the processor the knowledge it needs to distinguish good from bad.

1

2

Micro-policies

Hardware that prevents malicious instructions from being processed. Enforces security at each instruction and isolates micro-policy code and metadata from host code.

Policy Enforcer

CoreGuard: How it worksDynamically integrates two proprietary components

Marcela Zachariasova [email protected]

RISC-V COMPLIANCE TASK GROUP UPDATE


COMPLIANCE TASK GROUPGroup started on the last workshop

Group chair: Marcela Zachariasova (Codasip)

Vice-chair: Stuart Hoad (Microsemi)

Members: 19

Actions done from the last workshops:

� several meetings and email discussions

� 1 kick-off document

� 2 proposals on the structure of the tests

All members (and others) please visit CTG discussion on Thursday!

WHAT WE HAVE DONE + PLANS

Compliance tests for RV32I provided by Codasip:

� Reflect discussions and proposals done in CTG

� Tests + manually inspected reference from Spike + TVM environment for running tests + documentation

� Currently under review by CTG members (Imperas, Mentor)

PLANS:

� Considering other reference models than Spike (e.g. formal model)

� Improving specification coverage (now manually tracked)

� Implementing compliance tests for other RV instructions

� Defining more comprehensive test framework

RISC-V Software Task Group Update

Arun Thomas

Software Task Group Overview

Task Group Charter:

● Build the RISC-V software ecosystem● Standardize RISC-V software interfaces

Lots of software ecosystem progress:

● Upstreamed support for GCC, LLVM, binutils, Linux kernel, FreeBSD, Zephyr, RTEMS

● Full status: https://riscv.org/software-status

What’s Next?

More software porting/upstreaming:

● Distros: Debian, Fedora, OpenWRT, and OpenEmbedded● GDB, QEMU

Standardization:

● RISC-V processor-specific ABI (psABI)● Supervisor Binary Interface (SBI)

Join the Software Task Group!

Heads up: Individuals can join the RISC-V Foundation

● Membership fees are waived for open-source contributors● https://riscv.org/membership-application

Software Task Group meetings:

● Monthly teleconference: 4th Wednesdays @ 9am Pacific● Next meeting: Thursday 11/30 @ 3:15pm (in-person)

Contact

Chair: Arun Thomas, Draper

<[email protected]>

Vice Chair: Palmer Dabbelt, SiFive

<[email protected]>



RISC-V LiteratureDave Patterson

2 Classic Architecture Textbooks now use RISC-VCOD 5th RISC-V Edition Availability: Now$85 on Amazon, 676 pagesPublisher: ElsevierMost popular undergraduate textbook in computer architecture

CA:AQA 6th Edition (RISC-V)Availability: 12/15/17$105 on Amazon, 900 pagesPublisher: ElsevierMost popular graduate textbookNew chapter on Domain Specific Architectures: Google TPU, Microsoft Catapult, Google Pixel Visual Core, (Intel NNP)

The RISC-V Reader: An Open Architecture AtlasDavid Patterson and Andrew Waterman

1st Edition Availability: Now$20 on Amazon, 200 pagesPublisher: Strawberry Canyon* Introduces RISC-V in only 100 pages, including 75 figures* Instruction Translation Guide from ARM-32 / x86-32 to RISC-V * 2-page RISC-V Reference Card that summarizes all instructions* 50-page Instruction Glossary that defines every instruction in detail* 75 spotlights of good architecture design using the icons above* 50 sidebars with interesting commentary and RISC-V history* 25 quotes to pass along wisdom of noted scientists and engineers http://www.riscbook.com/

In Praise of RISC-V ReaderI can imagine this book becoming a well-worn reference guide for many RISC-V practitioners.—Prof. Krste Asanovic, UC Berkeley

I like RISC-V and this book as they are elegant—brief, to the point, and complete. The book’s commentaries provide a gratuitous history, motivation, and architecture critique. —C. Gordon Bell, PDP-11/VAX-11 architect

This clearly-written book offers a good introduction to RISC-V, augmented with insightful comments on its evolutionary history and comparisons with other familiar architectures.—John Mashey, one of the MIPS architects

This book tells what RISC-V can do and why its designers chose to endow it with those abilities. Even more interesting, the authors tell why RISC-V omits things found in earlier machines. The reasons are at least as interesting as RISC-V’s endowments and omissions.—Ivan Sutherland, the father of computer graphics

RISC-V will change the world, and this book will help you become part of that change.—Prof. Michael B. Taylor, University of Washington

This book will be an invaluable reference for anyone working with the RISC-V ISA.—Megan Wachs, PhD, SiFive Engineer

RISC-V Reader, RISC-V COD Available tonight!

$20 for RISC-V Reader

$80 for COD in RISC-V

(Cash only)

Authors will sign your copy

SiFive RISC-V Core IPsTailored RISC-V Solutions for Chip Designers

SiFive Core IP

Low-power, 32-bit and 64-bit Embedded CPU IP

• Standard RISC-V extensions and privileged modes

• Physical Memory Protection

• Microcontrollers, IOT, Housekeeping cores

High-performance, Unix-capable, 32-bit and 64-bit CPU IP

• Standard RISC-V extensions and privileged modes

• Virtual Memory Support• Application Processors,

Datacenter Accelerators

© 2017 SiFive. All Rights Reserved.

• E31: 32-bit embedded core

• E51: 64-bit embedded core

• U54-MC: Multicore, Coherent, 64-bit Linux capable core complex

Demos – Debugging / Development

Segger

J-Link Probe Support

Lauterbach SiFive

Freedom Studio

Demos – RTOS/Linux

Person Detection DEMOw/ VectorBlox ORCA CPU

RV32IM, BSD License+ Vector Instructions+ CNN Accelerator (> 40 ops/cycle)

5,000 LUTs, 24MHz73x (~1.75 GHz RISC-V)5mW

See the talk @ 4:36pm Wednesday

Lattice FPGA2.5mm

5,280 LUTs, 1Mb

Camera3mm

640x480

Strong Formal Verification for RISC-V: From Instruction-Set Manual to RTL

Adam Chlipala, Arvind, Thomas Bourgeat, Joonwon Choi, Ian Clester, Samuel Duchovni, Jamey Hicks, Muralidaran Vijayaraghavan, Andrew Wright

Existing Formal

What we have verified

risc-v poster preview · mohamed shalan, ph.d., ahmed agiza, ahmed elshafey, karim hasebou, mohamed...

Documents