RISC-V Poster Preview

RISC-V Poster Preview 7th RISC-V Workshop End-to-end formal ISA verification of RISC-V processors with riscv-formal ● Framework for formally verifying RISC-V processor cores ● Only requires Open Source tools (Yosys, ABC, Yices2, etc.) ● Every core that implements the RVFI trace port is supported (can easily be added to existing cores) ● End-to-end ISA verification is hard. We break the problem down into 100+ small problems that can be proven independently. This yields a tractable formal verification problem. ● Monitor core for tandem verification using same formal spec and RVFI trace port is available. ● Is being used to formally verify real-world processors right now (not vapourware, not just for “academic toy processors”) − https://github.com/cliffordwolf/riscv-formal Results, Status, Future Work

● Found bugs in ● Future Work − RISC-V Rocket − Atomics − PicoRV32 − F/D/Q support − Spike (riscv-isa-sim) − Priv. Spec, CSRs − The prose ISA Spec − Better support for non-free flows − Verification of other ● Currently supports RISC-V formal specs − RV32 / RV64 − More cores − C extension − M extension Power Matters.TM

MicroPython Port for RISC-V soft Processor Badal Nilawar

▪ Microsemi ported MicroPython on RISCV

▪ Porting activity involves ▪ Startup code ▪ RISCV HAL integration ▪ Tool chain ▪ Driver porting

▪ Features ▪ Machine modules like Pin, mtime ▪ REPL ▪ Advanced Math Library ▪ Soft Float

▪ Features Planned ▪ SPI, I2C, Ethernet ▪ Multi Threading ▪ File system support ▪ Distributing on Github TM © 2015 Microsemi Corporation. Power Matters. 5 Century Gothic Slide Title – 36pt Century Gothic Subhead – 24pt Century Gothic Content Title – 24pt Century Gothic Content Text – 20pt Century Gothic Compare Heading – 18pt Century Gothic Image Caption – 16pt Century Gothic Table Text & Caption Text – 14pt Micriµm The larger text sizes have condensed spacing, between 1.5 and 0.5 pt.

Presentation Colors Jean J. Labrosse R:137 G:137 B:137 Founder and Chief Software Architect R:88 G:88 B:88 [email protected] R:244 G:146 B:45 R:17 G:59 B:149 R:12 G:35 B:83 Century Gothic Slide Title – 36pt Century Gothic Subhead – 24pt Leading Embedded RTOS and Century Gothic Content Title – 24pt Century Gothic Content Text – 20pt Stacks Century Gothic Compare Heading – 18pt Tools Century Gothic Image Caption – 16pt RTOS IAR, Keil, GNU, Other Century Gothic Table Text & Caption Text – 14pt µC/OS-II or µC/OS-III The larger text sizes have condensed spacing, between 1.5 and 0.5 pt. µC/Probe Stacks

µC/FS Presentation Colors µC/TCP-IP (IPv4 and IPv6) µC/CAN R:137 G:137 B:137 SystemView µC/USB-H and µC/USB-H µC/GUI R:88 G:88 B:88 µC/Modbus

R:244 G:146 B:45 Tracealyzer R:17 G:59 B:149 R:12 G:35 B:83 Century Gothic Slide Title – 36pt Century Gothic Subhead – 24pt Century Gothic Content Title – 24pt RTOS (µC/OS-II and µC/OS-III) Century Gothic Content Text – 20pt Century Gothic Compare Heading – 18pt • Professional Grade, Fully Supported Century Gothic Image Caption – 16pt • Ported to over 45 CPU architectures Century Gothic Table Text & Caption Text – 14pt • Certified in numerous verticals: The larger text sizes have condensed – Avionics spacing, between 1.5 and 0.5 pt. – Medical – Industrial – Nuclear Presentation Colors • µC/OS-II on Mars Curiosity Rover R:137 G:137 B:137 • Books by MicriµmPress: R:88 G:88 B:88 – 7 on µC/OS-III – 5 on µC/TCP-IP R:244 G:146 B:45 – 1 on µC/USB-D

R:17 G:59 B:149 R:12 G:35 B:83 Century Gothic Slide Title – 36pt Century Gothic Subhead – 24pt Century Gothic Content Title – 24pt µC/OS-II / µC/OS-III and the RISC-V Century Gothic Content Text – 20pt

Century Gothic Compare Heading – 18pt • Ported onto the Microsemi Creative Board

Century Gothic Image Caption – 16pt – SoftConsole Century Gothic Table Text & Caption Text – 14pt The larger text sizes have condensed spacing, between 1.5 and 0.5 pt.

Presentation Colors

R:137 G:137 B:137 R:88 G:88 B:88 • Available soon on: – Digilent ARTY Artix-7 FPGA Dev Board with Segger Embedded Studio and R:244 G:146 B:45 J-Link R:17 G:59 B:149 R:12 G:35 B:83 Power Matters.TM

Enabling Safe Crypto Using RISC-V Soft Processor

Sathish Odiga

▪ Microsemi PolarFire® FPGAs represent the industry’s most advanced secure programmable FPGAs. • Built-in Athena's TeraFire® crypto processor supports the CNSA suite and beyond, and includes side-channel analysis resistant countermeasures. ▪ RISC-V soft processor is a perfect complement to the PolarFire FPGAs for building secure and reliable systems. • Open-source RISC-V ISA enables application-specific processor implementations • Unlike competing processors, the RISC-V processors allow inspection of the RTL to build trust on the processor implementation. ▪ Secure boot is the starting point for implementing secure systems • Process of guaranteeing that the boot code and all subsequent codes are authentic is called Secure Boot. • PolarFire FPGAs have built-in security capabilities to support secure boot of soft RISC-V processor

PolarFire FPGA 1. At power-up, System Controller copies authenticated bootloader reset from sNVM to SRAM. reset MiV_RV32IMA_L1_AHB init_done (RISC-V CPU) AHB_MST_MEM AHB_MST_MMIO 2. Processor executes the bootloader from SRAM.

AXI Interconnect Bus 3. Bootloader fetches the application keys from sNVM. AHBL Bus SPI System DDR SRAM Slash Controller Controller 4. Bootloader commands Crypto (Encrypted and Processor for application signed Application) Crypto Processor authentication and decryption. sNVM System Services 5. Bootloader copies the (Trusted Bootloader and Keys) (Protected by SRAM-PUF) authenticated application from SPI Flash to DRAM and DDR executes it. Memory

RISC-V based Lockstep Processor Implementation

Sathish Odiga

▪ Increasing levels of automation driving broader adoption of safety-critical systems • Systems must function correctly in order to avoid hazardous situations • Faults must be detected and controlled ▪ Safety-critical systems heavily rely on embedded processors • Need methodologies for fault detection due to random faults in the embedded processor. ▪ Lockstep processor provides real-time diagnostics using an additional slave processor and a comparator. • Two identical processors run in lockstep with address, data and controls compared for consistency. • Temporal and spatial separation of cores increases reliability ▪ Flash FPGAs are attractive in safety-critical applications • Flexibility to implement custom hardware • Built-in security and reliability features

Provides a mechanism for fast access to specialized functional units and (some) devices without crossing privilege levels

● Allows interaction with engine resources by the regular pipeline ● Can be used for specialized functional units, also devices ● Engines bound to engine handles prior to use ● Engines have states to control resource usage, aid virtualization ● Virtualization through suspend/resume capability ● Security through ownership/access masks History of the Extension

● Originated as an attempt to design a crypto extension ● “Crypto engines” envisioned as special functional units to decouple instructions from specific algorithms ● States and transitions emerged as a way to allow for automation injection of pseudo-ops to “fuzz” side-channels ● Discussions on the isa-dev list led to improvements ● DMA capabilities accounted for (no modification needed) ● At this point, the extension could potentially function as an I/O instruction set

Cloud-Based RISC-V SoC design and Co-simulation Mohamed Shalan, American University Cairo (Presented by Sam Steffl, Brown Univ)

Mohamed Shalan, Ph.D., Ahmed Agiza, Ahmed ElShafey, Karim Hasebou, Mohamed Gaber, Veronia Bahaa The American University in Cairo Sherief Reda, Ph.D. -- Brown University Presenter: Samuel Steffl – Brown University

•

• •

An online digital design platform with RISC-V at the core. dwarfRV32: A small footprint RV32I CPU

SoC Editor: An online rule-based editor using dwarfRV32

Beekeeper: A bus functional model/debugger leveraging the Verilog Procedural Interface DBT-RISE: Addressing the RISC-V VP Challenge Eyck Jentzsch Wolf-Ekkehard Matzke DBT-RISE RISC-V Start SW development even before having RTL or silicon

Dynamic Binary Translation - Retargetable ISS Environment

VM ARCH

ADAPTER GDB SERVER

HiFive1

UARTUART GPIO SPI PWM RAM PLIC Available as Open Source

system environment/test bench Professional Services on request th Page ▪ 26 7 RISC-V Workshop – Eyck Jentzsch, Wolf-Ekkehard Matzke DBT-RISE

Focus on Development driven by real-world • Performance customer requirements • Easy integration • Straightforward generation of • Accuracy ISSs • Adaptability & Extensibility • Convenient VP authoring • Considerable flexibility

Applied to RISC-V to foster VP development ➔ Demo: HiFive 1

th Page ▪ 27 7 RISC-V Workshop – Eyck Jentzsch, Wolf-Ekkehard Matzke contact

address phones online

MINRES Technologies GmbH phone +49-89-67807688 www.minres.com Keltenhof 2 fax +49-89-67807689 github.com/minres/ 85579 Neubiberg [email protected] Germany

th Page ▪ 28 7 RISC-V Workshop – Eyck Jentzsch, Wolf-Ekkehard Matzke Detecting Advanced Malware as Instruction and Microarchitectural Anomalies

Pranav Kumar, Austin Harris, Mohit Tiwari SPARK Lab University of Texas at Austin The Initial Problem

● SW and OS defenses detect malware (trojans, viruses, worms, backdoors).

App 1 App 2

Application Framework Usual Attacks

Libraries System Call Monitor Operating System OS defenses

Drivers

CPU The Problem

● SW and OS defenses cannot detect advanced malware.

App 1 App 2

Application Framework

Libraries Side channel data leaks, rowhammer, analog hardware Operating System

Drivers CPU

What about these attacks? Hardware-based Malware Detectors! Solution?

● Closing off individual channels would have limited coverage and probably incur overheads. ● Thus, we look at modeling the execution of a program to label it as benign or malicious in real-time. Evaluation on x86

Advanced Malware Under Test True False AUC Positives Positives

Floating Point Timing Channel 100 0 0.99

Rowhammer 100 0 0.99

JIT-Spray 99.98 0.93 0.89

Breaking ASLR using prefetch 100 0 0.96

Cache and Memory Covert channels 100 0 0.97 Shortcomings with current systems

● Intel only allows counting up to 4 performance counters at one time ● Unable to distinguish interference or contention ● Coarse granularity plays a bottleneck ● Low flexibility Need ...

Monitoring should be --

● Fine-grained (multiple granularities) ● Programmable ● Low-overhead Proposed Solution ...

A RISC-V Solution

● Fine grained -- Add hardware signals to extract: e.g., contention counters ● Programmable -- Software chooses the signals which will leak info. ● Low-overhead -- Hardware co-processor to extract features and run the anomaly detection Comparison of two JIT compiler approaches for RISC-V Boris Shingarov LabWare Target-Agnostic

Use logic programming to automatically infer the dynamic code generator from a formal description of the ISA written in a Processor Description Language

Formal Verification

The dynamic code generator is developed in the Coq interactive proof assistant and its executable form is extracted from the proof Target-Agnostic JIT

From: B. Shingarov, Live Introspection of Target-Agnostic JIT in Simulation. IWST’15, Brescia, Italy. ACM, 2017. Formal Verification

From: B. Shingarov, Programming a Smalltalk VM in Coq. IWST’17, Maribor, Slovenia. ACM, 2017. FPGA-BASED CNN HARDWARE ACCELERATOR WITH RISC-V PROCESSOR

RISC-V Workshop Poster

Marcela Zachariasova, [email protected] Harald Weiss, [email protected] CODASIP KORTIQ FPGA-BASED CNN HARDWARE ACCELERATOR WITH RISC-V PROCESSOR RIOT-OS Port to RISC-V

Craig Steele and JP Bonn Tautline LLC Flagstaff, Arizona RIOT-OS Port to RISC-V

RIOT-OS Features: IoT Target HW: 8-32b MCUs, noMMU Small Footprint + Low Power Multi-Threaded Microkernel C/C++ Coding RIOT-OS Port to RISC-V HiFive1 initial target: Arduino-ish Large Slow Flash: 16MiB Small Fast SRAM: 16KiB I-Cache Performance Tuning/Detuning UltraZed & MCU Security Experiments SCRx cores extensibility overview

Alexander Redkin Syntacore

www.syntacore.com [email protected] SCRx cores extensibility features

Extensibility features: Baseline cores: ❏ Computational capabilities ❏ SCR1: Minimalistic MCU-class open-source core New functions using existing HW Minimal area configuration is <15 kGates New functional units ❏ SCR3: High-perf 32-bit MCU with privilege modes ❏ Extended storage Competitive characteristics Mems/RF, addressable or state ❏ SCR4: 32-bit MCU core with high-perf FPU Custom AGU IEEE 754-2008 compatible ❏ I/O ports ❏ SCR5: Efficient mid-range APU/embedded core 1GHz@28nm, virtual memory, 2-4 cores SMP, Linux ❏ Specialized system behavior Specialized processing for standard events Stable designs available for evaluation Custom events -FPGA-based SDKs, silicon samples, tools, documentation One-stop service:

workload analysis, implementation, tools SCR5 extensibility example

Custom ISA extension for AES & other crypto kernels acceleration ■ Data ◆ RV32G – FPGA-based devkit, g++ 5.2.0, Linux 4.6, optimized C++ implementation ◆ RV32G + custom – same + intrinsics ◆ Core i7 6800K @ 3.4GHz, g++ 5.4.0, Linux 64, optimized C++ implementation ■ Area increase: 11.7% core, 3.7% at the CPU cluster level

Disclaimer: Authors are aware AES allows for more efficient dedicated accelerators designs, used as a sample algorithm RISC-V Security:

SHAVE and Beyond

Sponsored by the Air Force Research Laboratory (AFRL) and developed with funding from the Defense Advanced Research Projects Agency (DARPA) under contract number FA8650-16-C-7665. Any views, opinions, findings, conclusions and/or recommendations expressed in this material are those of the author(s) and do not necessarily reflect the views of the United States Air Force, the Department of Defense or the U.S. Government. © 2017 Galois All rights reserved. © 2017 Galois All rights reserved. © 2017 Galois All rights reserved. Experiments in

RISC-V Trusted Boot

Commercially Supported RISC-V Simulation and Platform Development Tools Simon Davidmann, Imperas Software Ltd. Who are Imperas? ▪ Leading independent commercial simulation vendor, established 10 years ▪ Solutions for small single core controller users all the way to high end 64bit MP Arm, MIPS architectural licensees ▪ Single licenses to enterprise wide regression farms ▪ Formed Open Virtual Platforms (OVP) to drive industry ▪ Oxford, UK HQ, Calif. US Sales, Distributors RoW ▪ Focus on embedded software development utilizing simulation ▪ models, simulators, tools, methodologies, solutions

62 © 2017 Imperas Software Ltd. 7th RISC-V Workshop, Nov. 2017 What we provide for Embedded Software Developer ▪ Fast Processor Models (200+) for different vendors/ISA (10+) ▪ High performance IA Simulator ▪ integrateable into 3rd party & test environments ▪ Tools for non-intrusive C Application profiling and line coverage ▪ GUI, Debugger - multi-processor debugger ▪ Eclipse based, extended for hetero MP, programmers view ▪ Source code level, instruction, platform ▪ ISS and Extendable Platform Kits for flexibility and quick start ▪ Variety of extendable reference models of standard platforms running various operating systems (FreeRTOS, Linux, …) ▪ Includes over 200 peripheral component models of standard parts (Ethernet, USB, CAN, …) to easily create own platforms ▪ OS-aware tools for porting and bring up of operating systems, hypervisors, drivers ▪ Simulator designed to be used in regression test and Continuous Integration / Continuous Test environments

▪ Highest performance RISC-V simulator: 25+ X faster than Spike

▪ All 32/64bit RISC-V CPU features implemented in simulator, currently 12 variant models, 6 vendor core models ▪ CPU models easily user extendable using standard tool features adding customer specific registers, instructions, behaviors

▪ CPU Model Code Coverage tool ▪ CPU Instruction Coverage tool ▪ CPU Cycle Approximate simulation using CPU cycle timing estimation ▪ CPU performance simulator interface e.g. to Gem5 ▪ Interfaces for use with 3rd party simulators, RTL testbenches for DV

▪ Imperas RISC-V processor verification tools/suite

▪ OEM of Imperas commercially supported simulator and vendor specific models, platforms

For more information about the leading commercial simulation, models, and tools for RISC-V designs: www.imperas.com www.OVPworld.org

CoreGuard™ from Dover Microsystems

Jothy Rosenberg, Greg Sullivan, Andrew Sutherland, Julian Scherding Cyber security software adds more vulnerabilities and ruins performance

Even the best hackers have ▪ Processors blindly run vulnerable software “ not figured out a way to ▪ Today’s security responds with more software download changes to your

microprocessor… you ▪ But adding more layers of software—even security software—just adds more bugs can’t alter the silicon

- Larry Ellison “ ▪ Plus each layer of software substantially degrades system performance

▪ Today’s processors are defenseless CoreGuard: Security IP that bolts onto existing processors

▪ Compatible with leading embedded processor architectures (optimized for RISC-V) and application software.

▪ Flexible design allows for power, performance, area, and security optimization.

▪ Delivered as an IP Block (hardware design files) to semiconductor companies and embedded system designers.

▪ Maintains metadata for every word in memory and checks each instruction against customer-defined security rules. CoreGuard: How it works Dynamically integrates two proprietary components

Micro-policies 1 Tell CoreGuard which instructions to let pass and which to block based on metadata. Micro-policies and metadata give the processor the knowledge it needs to distinguish good from bad.

Policy Enforcer 2 Hardware that prevents malicious instructions from being processed. Enforces security at each instruction and isolates micro-policy code and metadata from host code. RISC-V COMPLIANCE TASK GROUP UPDATE

Marcela Zachariasova [email protected] COMPLIANCE TASK GROUP

Group started on the last workshop

Group chair: Marcela Zachariasova (Codasip)

Vice-chair: Stuart Hoad (Microsemi)

Members: 19

Actions done from the last workshops:

several meetings and email discussions

1 kick-off document

2 proposals on the structure of the tests All members (and others) please visit CTG discussion on Thursday! WHAT WE HAVE DONE + PLANS

Compliance tests for RV32I provided by Codasip:

Reflect discussions and proposals done in CTG Tests + manually inspected reference from Spike + TVM environment for running tests + documentation

Currently under review by CTG members (Imperas, Mentor)

PLANS:

Considering other reference models than Spike (e.g. formal model)

Improving specification coverage (now manually tracked)

Implementing compliance tests for other RV instructions

Defining more comprehensive test framework RISC-V Software Task Group Update Arun Thomas Software Task Group Overview

Task Group Charter:

● Build the RISC-V software ecosystem ● Standardize RISC-V software interfaces

Lots of software ecosystem progress:

● Upstreamed support for GCC, LLVM, binutils, Linux kernel, FreeBSD, Zephyr, RTEMS ● Full status: https://riscv.org/software-status What’s Next?

More software porting/upstreaming:

● Distros: Debian, Fedora, OpenWRT, and OpenEmbedded ● GDB, QEMU

Standardization:

● RISC-V processor-specific ABI (psABI) ● Supervisor Binary Interface (SBI) Join the Software Task Group!

Heads up: Individuals can join the RISC-V Foundation

● Membership fees are waived for open-source contributors ● https://riscv.org/membership-application

Software Task Group meetings:

● Monthly teleconference: 4th Wednesdays @ 9am Pacific ● Next meeting: Thursday 11/30 @ 3:15pm (in-person) Contact

Chair: Arun Thomas, Draper

Vice Chair: Palmer Dabbelt, SiFive

RISC-V Literature Dave Patterson 2 Classic Architecture Textbooks now use RISC-V

COD 5th RISC-V Edition Availability: Now $85 on Amazon, 676 pages Publisher: Elsevier Most popular undergraduate textbook in computer architecture

CA:AQA 6th Edition (RISC-V) Availability: 12/15/17 $105 on Amazon, 900 pages Publisher: Elsevier Most popular graduate textbook New chapter on Domain Specific Architectures: Google TPU, Microsoft Catapult, Google Pixel Visual Core, (Intel NNP) The RISC-V Reader: An Open Architecture Atlas David Patterson and Andrew Waterman 1st Edition Availability: Now $20 on Amazon, 200 pages Publisher: Strawberry Canyon * Introduces RISC-V in only 100 pages, including 75 figures * Instruction Translation Guide from ARM-32 / x86-32 to RISC-V * 2-page RISC-V Reference Card that summarizes all instructions * 50-page Instruction Glossary that defines every instruction in detail * 75 spotlights of good architecture design using the icons above * 50 sidebars with interesting commentary and RISC-V history * 25 quotes to pass along wisdom of noted scientists and engineers http://www.riscbook.com/ In Praise of RISC-V Reader

I can imagine this book becoming a well-worn This book tells what RISC-V can do and why its reference guide for many RISC-V practitioners. designers chose to endow it with those abilities. —Prof. Krste Asanović, UC Berkeley Even more interesting, the authors tell why RISC-V omits things found in earlier machines. The I like RISC-V and this book as they are reasons are at least as interesting as RISC-V’s elegant—brief, to the point, and complete. The endowments and omissions. book’s commentaries provide a gratuitous history, —Ivan Sutherland, the father of computer graphics motivation, and architecture critique. —C. Gordon Bell, PDP-11/VAX-11 architect RISC-V will change the world, and this book will help you become part of that change. This clearly-written book offers a good introduction —Prof. Michael B. Taylor, University of to RISC-V, augmented with insightful comments on Washington its evolutionary history and comparisons with other familiar architectures. This book will be an invaluable reference for —John Mashey, one of the MIPS architects anyone working with the RISC-V ISA. —Megan Wachs, PhD, SiFive Engineer RISC-V Reader, RISC-V COD Available tonight!

$20 for RISC-V Reader $80 for COD in RISC-V (Cash only) Authors will sign your copy RISC-V Core IP Demos Debugging, RTOS, and Linux

• E51: 64-bit embedded core

Low-power, 32-bit and High-performance, 64-bit Embedded CPU Unix-capable, 32-bit and IP 64-bit CPU IP • U54-MC: Multicore, • Standard RISC-V • Standard RISC-V extensions and extensions and Coherent, 64-bit Linux privileged modes privileged modes • Physical Memory • Virtual Memory Support capable core complex Protection • Application Processors, • Microcontrollers, IOT, Datacenter Housekeeping cores Accelerators

Lauterbach Segger SiFive

J-Link Probe Support Freedom Studio Demos – RTOS/Linux Person Detection DEMO Lattice FPGA 2.5mm w/ VectorBlox ORCA CPU 5,280 LUTs, 1Mb RV32IM, BSD License + Vector Instructions + CNN Accelerator (> 40 ops/cycle) Camera 5,000 LUTs, 24MHz 3mm 73x (~1.75 GHz RISC-V) 640x480 5mW See the talk @ 4:36pm Wednesday Strong Formal Verification for RISC-V: From Instruction-Set Manual to RTL

Adam Chlipala, Arvind, Thomas Bourgeat, Joonwon Choi, Ian Clester, Samuel Duchovni, Jamey Hicks, Muralidaran Vijayaraghavan, Andrew Wright Existing Formal What we have verified