RISC-V Privileged Architecture · RISC-V Virtual Memory Control By default, S-mode can’t access...

27
RISC-V Privileged Architecture Andrew Waterman SiFive Inc. [email protected] 6 th RISC-V Workshop Shanghai Jiao Tong University May 9, 2017

Transcript of RISC-V Privileged Architecture · RISC-V Virtual Memory Control By default, S-mode can’t access...

Page 1: RISC-V Privileged Architecture · RISC-V Virtual Memory Control By default, S-mode can’t access user pages-Helps detect OS/driver bugs-Still need ability to read user memory, e.g.

RISC-VPrivilegedArchitectureAndrewWaterman

SiFive [email protected]

6th RISC-VWorkshopShanghaiJiaoTongUniversity

May9,2017

Page 2: RISC-V Privileged Architecture · RISC-V Virtual Memory Control By default, S-mode can’t access user pages-Helps detect OS/driver bugs-Still need ability to read user memory, e.g.

NewDraftSpecificationsareReleased

§ UserISAv2.2- Improvementstodocumentation-Defineshownarrow-precisionFPtypesarerepresentedinwiderFPregisters-DefinesbehaviorusingwiderFPoperationsonnarrowoperands

§ PrivilegedISAv1.10-Subjectofthistalk

§ SpecsavailableonGithub (source&PDF)§ https://github.com/riscv/riscv-isa-manual§ Movedtoeditorshipmodel

Page 3: RISC-V Privileged Architecture · RISC-V Virtual Memory Control By default, S-mode can’t access user pages-Helps detect OS/driver bugs-Still need ability to read user memory, e.g.

PrivilegedArchitectureisStable

§ 1.10keepscompatibilitywith1.9.1formachine-mode-onlyimplementations

§ Futurereleasesshouldbecompatiblewith1.10forsupervisorISA,too

§ Caveat:theseareproposals;notyetratifiedbyFoundation

Page 4: RISC-V Privileged Architecture · RISC-V Virtual Memory Control By default, S-mode can’t access user pages-Helps detect OS/driver bugs-Still need ability to read user memory, e.g.

RISC-VPrivilegedArchitecture

§ Providecleansplitbetweenlayersofthesoftwarestack§ ApplicationcommunicateswithApplicationExecutionEnvironment(AEE)viaApplicationBinaryInterface(ABI)

§ OScommunicatesviaSupervisorExecutionEnvironment(SEE)viaSystemBinaryInterface(SBI)

§ HypervisorcommunicatesviaHypervisorBinaryInterfacetoHypervisorExecutionEnvironment

§ AlllevelsofISAdesignedtosupportvirtualization4

2 1.1draft: Volume II: RISC-V Privileged Architectures

ApplicationABIAEE

ApplicationABI

OSSBISEE

ApplicationABI

SBIHypervisor

ApplicationABI

OS

ApplicationABI

ApplicationABI

OS

ApplicationABI

SBI

HBIHEE

Figure 1.1: Di↵erent implementation stacks supporting various forms of privileged execution.

the OS, which provides the AEE. Just as applications interface with an AEE via an ABI, RISC-Voperating systems interface with a supervisor execution environment (SEE) via a supervisor binaryinterface (SBI). An SBI comprises the user-level and supervisor-level ISA together with a set ofSBI function calls. Using a single SBI across all SEE implementations allows a single OS binaryimage to run on any SEE. The SEE can be a simple boot loader and BIOS-style IO system in alow-end hardware platform, or a hypervisor-provided virtual machine in a high-end server, or athin translation layer over a host operating system in an architecture simulation environment.

The rightmost configuration shows a virtual machine monitor configuration where multiple multi-programmed OSs are supported by a single hypervisor. Each OS communicates via an SBI with thehypervisor, which provides the SEE. The hypervisor communicates with the hypervisor executionenvironment (HEE) using a hypervisor binary interface, to isolate the hypervisor from details ofthe hardware platform.

Our graphical convention represents abstract interfaces using black boxes with white text, toseparate them from actual components.

The various ABI, SBI, and HBIs are still a work-in-progress, but we anticipate the SBI and HBIto support devices via virtualized device interfaces similar to virtio [2], and to support devicediscovery. In this manner, only one set of device drivers need be written that can support anyOS or hypervisor, and which can also be shared with the boot environment.

Hardware implementations of the RISC-V ISA will generally require additional features beyond theprivileged ISA to support the various execution environments (AEE, SEE, or HEE), but these weconsider separately as part of a hardware abstraction layer (HAL), as shown in Figure 1.2. Note

ApplicationABIAEEHAL

Hardware

ApplicationABI

OSSBISEE

ApplicationABI

HALHardware

SBIHypervisor

ApplicationABI

OS

ApplicationABI

ApplicationABI

OS

ApplicationABI

SBI

HBIHEE

HardwareHAL

Figure 1.2: Hardware abstraction layers (HALs) abstract underlying hardware platforms from theexecution environments.

Page 5: RISC-V Privileged Architecture · RISC-V Virtual Memory Control By default, S-mode can’t access user pages-Helps detect OS/driver bugs-Still need ability to read user memory, e.g.

RISC-VPrivilegeModes

§ Threeprivilegemodes-User(U-mode)- Supervisor(S-mode)-Machine(M-mode)

§ Supportedcombinationsofmodes:-M (simpleembeddedsystems)-M,U (embeddedsystemswithprotection)-M,S,U (systemsrunningUnix-likeoperatingsystems)

§ Plannedsupportforhypervisors

5

Page 6: RISC-V Privileged Architecture · RISC-V Virtual Memory Control By default, S-mode can’t access user pages-Helps detect OS/driver bugs-Still need ability to read user memory, e.g.

SimpleEmbeddedSystems

§ SimplestimplementationneedsonlyM-mode§ Noaddresstranslation§ Minimalmemoryprotection- Trapbadphysicaladdressesprecisely

§ Applicationcodeistrusted

§ Lowimplementationcost- 27 bitsofarchitecturalstate(inadditiontouserISA)- +27 morebitsfortimers- +27 moreforbasicperformancecounters

6

Page 7: RISC-V Privileged Architecture · RISC-V Virtual Memory Control By default, S-mode can’t access user pages-Helps detect OS/driver bugs-Still need ability to read user memory, e.g.

EmbeddedSystemswithProtection

§ Applicationcodeisnottrusted§ AddU-mode;runappcodeinU-modeandtrustedcodeinM-mode

§ PossiblyaddN extensionforuser-levelinterrupts§ Stillnoaddresstranslation§ Needmechanismtoprotectphysicalmemory

7

Page 8: RISC-V Privileged Architecture · RISC-V Virtual Memory Control By default, S-mode can’t access user pages-Helps detect OS/driver bugs-Still need ability to read user memory, e.g.

PhysicalMemoryProtectionUnit

§ Optionalnewfeatureinv1.10§ WhenPMPisimplemented,modesbelowM-modehavenomemorypermissionsbydefault

§ CangrantR/W/Xpermissionson≥4-bytegranularity§ Upto16PMPregions§ EachPMPregionisanynaturally alignedpower-of-2numberofbytes

§ CanconfigureadjacentPMPregisterstoformanarbitrarybase-and-boundsregioninstead

§ PMPscanbelocked (can’tberewrittenuntilreset),inwhichcasetheyaffectM-mode,too

8

Page 9: RISC-V Privileged Architecture · RISC-V Virtual Memory Control By default, S-mode can’t access user pages-Helps detect OS/driver bugs-Still need ability to read user memory, e.g.

SupportforUnix-likeOperatingSystems

§ AddS-modetoprovidevirtualmemory§ Memorydividedinto4KiB basepages§ Radix-treepagetables-2levelsforRV32(Sv32)-3or4levelsforRV64(Sv39,Sv48)-EncodingspacereservedforSv57/Sv64

§ Superpages possibleatalllevelsofpagetable-e.g.2MiB and1GiB forSv39

§ HardwarePTwalksspecifiedinsupervisorISA-CantraptoM-modeforsoftwareTLBrefill

Page 10: RISC-V Privileged Architecture · RISC-V Virtual Memory Control By default, S-mode can’t access user pages-Helps detect OS/driver bugs-Still need ability to read user memory, e.g.

InteractionbetweenPMPandVM

§ PhysicalMemoryProtectionandpage-basedvirtualmemoryarecomposable

§ Addresstranslationhappensfirst,possiblygeneratingpage-faultexceptions

§ PMPunitcheckstranslatedaddress,possiblygeneratingaccessexceptions

§ UsefulwhenS-modecodeisuntrusted

Page 11: RISC-V Privileged Architecture · RISC-V Virtual Memory Control By default, S-mode can’t access user pages-Helps detect OS/driver bugs-Still need ability to read user memory, e.g.

RISC-VPageTableEntries

§ SeparatelycontrolledR,W,Xpermissions- SupportsX-onlypages-W&~Rcombinationreserved

§ Supervisorcan’taccessuserpagesbydefault§ Globalbitindicatesthemappingbelongstoalladdressspaces(e.g.kernelpagesinaUnixsystem)

§ Accessed/DirtybitsoptionallymanagedbyHW-Updatesmustbeatomicw.r.t.permissionscheck- Complextoimplement,sopermittrappingwhenA/Dnotsetinstead

Page 12: RISC-V Privileged Architecture · RISC-V Virtual Memory Control By default, S-mode can’t access user pages-Helps detect OS/driver bugs-Still need ability to read user memory, e.g.

RISC-VVirtualMemoryControl

§ Bydefault,S-modecan’taccessuserpages-HelpsdetectOS/driverbugs-Stillneedabilitytoreadusermemory,e.g.onsystemcall-Set“SupervisorAccesstoUserMemory”bitinsstatus toreadusermemory,thenturnitoffagain

§ Similarly,S-modecan’treadexecute-onlypages-Set“MakeExecutableReadable”bitinsstatus tooverride-Usefulforillegal-instructiontraphandlers

§ S-modecanenable/disableVMandchoosepage-tabledepthinsatp register

Page 13: RISC-V Privileged Architecture · RISC-V Virtual Memory Control By default, S-mode can’t access user pages-Helps detect OS/driver bugs-Still need ability to read user memory, e.g.

RISC-VInterruptDesignGoals

§ Simplicity§ Supportallkindsofplatformsfrommicrocontrollerstovirtualizedservers

§ Enabletradeoffsbetweenperformanceandimplementationcost

§ Flexibilitytosupportspecializedneeds

13

Page 14: RISC-V Privileged Architecture · RISC-V Virtual Memory Control By default, S-mode can’t access user pages-Helps detect OS/driver bugs-Still need ability to read user memory, e.g.

InterruptUsesinDifferentApplications

§ High-performanceUnix-likesystems- Interrupthandlingsmallfractionofprocessingtime- Fastcores,smartdevices

-Minimalinterrupthandler- Schedulinginsoftware

§ Low/midembeddedsystems- Interrupthandlingsignificantfractionofprocessortime- Slowcores,dumbdevices

- Significantfractionofcodeinhandlers- Interruptcontrolleractsastaskscheduler

§ High-performancereal-timesystems- Can’twastetimeoninterruptoverhead- HandlerspollI/Odeviceswithregularheartbeat

§ Andeverythinginbetween

Page 15: RISC-V Privileged Architecture · RISC-V Virtual Memory Control By default, S-mode can’t access user pages-Helps detect OS/driver bugs-Still need ability to read user memory, e.g.

CategorizingSourcesofRISC-VInterrupts

§ LocalInterrupts- Directlyconnectedtoonehart-Noarbitrationbetweenhartstoservice- Determinesourcedirectlythroughxcause CSR-Onlytwostandardlocalinterrupts(software,timer)

§ Global(External)Interrupts- RoutedviaPlatform-LevelInterruptController(PLIC)- PLICarbitratesbetweenmultiplehartsclaiminginterrupt- Readofmemory-mappedregisterreturnssource

15

Page 16: RISC-V Privileged Architecture · RISC-V Virtual Memory Control By default, S-mode can’t access user pages-Helps detect OS/driver bugs-Still need ability to read user memory, e.g.

MachineInterruptPendingCSR(mip)

§ mip reflectspendingstatusofinterruptsforhart§ Separateinterruptsforeachsupportedprivilegelevel(M/S/U)

§ User-levelinterrupthandling(“N”)optionalfeaturewhenU-modepresent(discussedlater)

16

ExternalfromPLIC LocalTimer LocalSoftware

(AddNon-StandardLocalInterruptsHere)

Page 17: RISC-V Privileged Architecture · RISC-V Virtual Memory Control By default, S-mode can’t access user pages-Helps detect OS/driver bugs-Still need ability to read user memory, e.g.

SoftwareInterrupts

§ MSIP-Onlywriteableinmachine-modeviamemory-mappedcontrolregister(mappingisplatform-specific)

-Onehartcanwritetodifferenthart’sMSIPregister-Mechanismforinter-hartinterrupts

§ SSIP andUSIP- HartcanonlywritebitxSIP inownmip registerwhenrunningatprivilegemode xorgreater

§ App/OS canonlyperforminter-hartinterruptsviaABI/SBIcalls- Destinationvirtualhartmightbedescheduled- InterruptsvirtualizedbyM-modesoftwareusingMSIP

17

Page 18: RISC-V Privileged Architecture · RISC-V Virtual Memory Control By default, S-mode can’t access user pages-Helps detect OS/driver bugs-Still need ability to read user memory, e.g.

TimerInterrupts

§ MTIP- Single64-bitreal-timehardwaretimerandcomparatorinM-mode

-MTIPsetwhenmtime >=mtimecmp-MTIPclearedbywritingnewmtimecmp value

§ STIP andUTIP-M-modemultiplexessinglehardwaretimerandcomparatorforlower-privilegemodesonsamehart

- ABI/SBI callstosetuptimer-M-modesoftwarewrites/clearsSTIP/UTIP

§ MostsystemswillalsohaveotherhardwaretimersattachedviaPLICetc.

18

Page 19: RISC-V Privileged Architecture · RISC-V Virtual Memory Control By default, S-mode can’t access user pages-Helps detect OS/driver bugs-Still need ability to read user memory, e.g.

ExternalInterrupts

§ MEIP,SEIP,UEIP- InputsfromaPlatform-LevelInterruptController(PLIC)- EachprivilegemodehasitsowninputfromPLIC- Interruptsclearedwithloads/storestoPLIC- SoftwarecaninjectSEIPandUEIPinterruptstosupportvirtualizingthePLIC

19

Page 20: RISC-V Privileged Architecture · RISC-V Virtual Memory Control By default, S-mode can’t access user pages-Helps detect OS/driver bugs-Still need ability to read user memory, e.g.

Platform-LevelInterruptController(PLIC)

20

PLIC

U TimerSoftware

S TimerSoftware

M TimerSoftware

ExternalInterrupt1

ExternalInterrupt2

LocalInterruptsGlobalInterrupts

ExternalHart0

Hart1U Timer

Software

S TimerSoftware

M TimerSoftware

Page 21: RISC-V Privileged Architecture · RISC-V Virtual Memory Control By default, S-mode can’t access user pages-Helps detect OS/driver bugs-Still need ability to read user memory, e.g.

Gateway

PriorityIP

Interrupt Request

Interrupt 2 Signals

Gateway

PriorityIP

Interrupt Request

Interrupt 1 Signals

PLIC Core

PLIC Gateways

0

0 Max IDThresholdMax Pri.

EIP>? EIP Interrupt Notification

Interrupt ID}To Target

0

IE >?

101

01

IE >?

201

01

0

0 Max IDThresholdMax Pri.

EIP>? EIP Interrupt Notification

Interrupt ID}To Target

1

IE >?

101

01

IE >?

201

01

Platform-LevelInterruptController

21

Page 22: RISC-V Privileged Architecture · RISC-V Virtual Memory Control By default, S-mode can’t access user pages-Helps detect OS/driver bugs-Still need ability to read user memory, e.g.

MachineInterruptEnableCSR(mie)

§ miemirrorslayoutofmip§ providesper-interruptenables

§ Also,globalinterruptenablesinmstatus foreachprivilegemode

§ Interruptsalwaysdisabledforlowerprivilegemodes;alwaysenabledforhigherprivilegemodes

22

ExternalfromPLIC LocalTimer LocalSoftware

Page 23: RISC-V Privileged Architecture · RISC-V Virtual Memory Control By default, S-mode can’t access user pages-Helps detect OS/driver bugs-Still need ability to read user memory, e.g.

AllinterruptstraptoM-modebydefault

§ mcause registerindicateswhichinterruptoccured§ M-modecanredirecttoappropriateprivilegelevelusingMRETinstruction

23

Page 24: RISC-V Privileged Architecture · RISC-V Virtual Memory Control By default, S-mode can’t access user pages-Helps detect OS/driver bugs-Still need ability to read user memory, e.g.

OptionalInterruptHandlerDelegation

§ Candelegateinterrupt(andexception)handlingtolowerprivilegeleveltoreduceoverhead

§ mideleg hassamelayoutasmip§ Ifabitissetinmideleg thencorrespondinginterruptdelegatedtonextlowestprivilegelevel(SorU)

§ Canbedelegatedagainusingsideleg§ Oncedelegated,theinterruptwillnotaffectcurrentprivilegelevel(mie settingignored)

24

Page 25: RISC-V Privileged Architecture · RISC-V Virtual Memory Control By default, S-mode can’t access user pages-Helps detect OS/driver bugs-Still need ability to read user memory, e.g.

HypervisorStatus

§ Previousspecsketchedafourthprivilegemode,H,aboveS(M/H/S/U)

§ DesignedforType-1hypervisorsupport§ FeedbackfromcommunityledustopursueHWsupportforType-2hypervisors(likeKVM)instead-StillworkswellforType-1hypervisors

§ PlanistomakeafullproposalbySeptember

25

Page 26: RISC-V Privileged Architecture · RISC-V Virtual Memory Control By default, S-mode can’t access user pages-Helps detect OS/driver bugs-Still need ability to read user memory, e.g.

ImplementationStatus

§ SpikeandUCBRocket-Chipconformtov1.10§ Linuxporttov1.10workswithSpike/Rocket-Workingonupstreaming theLinuxkernel

§ UpstreamGCCandbinutils portsarecompatible

26

Page 27: RISC-V Privileged Architecture · RISC-V Virtual Memory Control By default, S-mode can’t access user pages-Helps detect OS/driver bugs-Still need ability to read user memory, e.g.

Questions?

27

Specsavailableathttps://github.com/riscv/riscv-isa-manual


CPC710 PCI Bridge and Memory Controller User …...CPC710 CPU Memory

CPC710 PCI Bridge and Memory Controller User …...CPC710 CPU Memory

N N RISC RISC N

N N RISC RISC N

RISC-V Memory Consistency Model Tutorial · RISC-V Memory Consistency Model Tutorial. 2 ABOUT ME • Senior Research Scientist at NVIDIA in Santa Clara, CA • PhD from Princeton

RISC-V Memory Consistency Model Tutorial · RISC-V Memory Consistency Model Tutorial. 2 ABOUT ME • Senior Research Scientist at NVIDIA in Santa Clara, CA • PhD from Princeton

Bridging the gap in the RISC-V memory models · Trippel, Micro Top Picks] [Dan Lustig, RISC-V Memory Consistency Model Tutorial] Stefanos Kaxiras Bridging the Gap in RISC-V Memory

Bridging the gap in the RISC-V memory models · Trippel, Micro Top Picks] [Dan Lustig, RISC-V Memory Consistency Model Tutorial] Stefanos Kaxiras Bridging the Gap in RISC-V Memory

The RISC-V Instruction Set Manual Volume I: User … This is version 2.2 of the document describing the RISC-V user-level architecture. The document contains the following versions

The RISC-V Instruction Set Manual Volume I: User … This is version 2.2 of the document describing the RISC-V user-level architecture. The document contains the following versions

CISC, RISC and Post RISC

CISC, RISC and Post RISC

The RISC-V Compressed Instruction Set Manual Version 1.9 ...2 RISC-V Compressed ISA V1.9 1.1 Introduction This excerpt from the RISC-V User-Level ISA Speci cation describes the current

The RISC-V Compressed Instruction Set Manual Version 1.9 ...2 RISC-V Compressed ISA V1.9 1.1 Introduction This excerpt from the RISC-V User-Level ISA Speci cation describes the current

The RISC-V Instruction Set Manual, Volume I: Base User-Level ISAkrste/papers/EECS-2011... · 2018-03-30 · The RISC-V Instruction Set Manual, Volume I: Base User-Level ISA Andrew

The RISC-V Instruction Set Manual, Volume I: Base User-Level ISAkrste/papers/EECS-2011... · 2018-03-30 · The RISC-V Instruction Set Manual, Volume I: Base User-Level ISA Andrew

Verifying RISC-V Physical Memory Protection

Verifying RISC-V Physical Memory Protection

State of the Union - RISC-V · 2019-06-12 · o RISC-V RISC-V Timeline 3 RISC-V ISA project begins 1st Rocket tapeout, EOS14, 45nm User ISA v2.0 IMAFD Hot Chips 2014 First Linux Port

State of the Union - RISC-V · 2019-06-12 · o RISC-V RISC-V Timeline 3 RISC-V ISA project begins 1st Rocket tapeout, EOS14, 45nm User ISA v2.0 IMAFD Hot Chips 2014 First Linux Port

CISC, RISC, and Post-RISC Computers

CISC, RISC, and Post-RISC Computers

RISC-V Processor Datapath - bt.nitk.ac.in · RISC-V datapath implementation – Register File, Instruction memory, Data memory Instruction interpretation and execution. Combinational

RISC-V Processor Datapath - bt.nitk.ac.in · RISC-V datapath implementation – Register File, Instruction memory, Data memory Instruction interpretation and execution. Combinational

The RISC-V Instruction Set Manual Volume I: User-Level …cs250/fa13/handouts/riscv...The RISC-V Instruction Set Manual Volume I: User-Level ISA Draft - for comment only. Version 2:0

The RISC-V Instruction Set Manual Volume I: User-Level …cs250/fa13/handouts/riscv...The RISC-V Instruction Set Manual Volume I: User-Level ISA Draft - for comment only. Version 2:0

Advanced Computer Architectureadiaz/ArqComp/02...CISC, RISC, Advanced memory systems (caches, memory, virtual memory) Advanced Instruction Level Parallelism (pipelining, superscalar,

Advanced Computer Architectureadiaz/ArqComp/02...CISC, RISC, Advanced memory systems (caches, memory, virtual memory) Advanced Instruction Level Parallelism (pipelining, superscalar,

The RISC-V Instruction Set Manual Volume I: User …content.riscv.org/wp-content/uploads/2017/05/riscv-spec...The RISC-V Instruction Set Manual Volume I: User-Level ISA Document Version

The RISC-V Instruction Set Manual Volume I: User …content.riscv.org/wp-content/uploads/2017/05/riscv-spec...The RISC-V Instruction Set Manual Volume I: User-Level ISA Document Version

The RISC-V Instruction Set Manual Volume I: User-Level ISA ...riscv.org/wp-content/uploads/2015/11/riscv-spec-v2.0.pdf · • The FENCE instruction provides ner-grain memory and I/O

The RISC-V Instruction Set Manual Volume I: User-Level ISA ...riscv.org/wp-content/uploads/2015/11/riscv-spec-v2.0.pdf · • The FENCE instruction provides ner-grain memory and I/O

Altera User Flash Memory (ALTUFM) IP Core User Guide · Altera User Flash Memory (ALTUFM) IP Core User Guide 2014.08.18 UG-040105 Subscribe Send Feedback The Altera User Flash Memory

Altera User Flash Memory (ALTUFM) IP Core User Guide · Altera User Flash Memory (ALTUFM) IP Core User Guide 2014.08.18 UG-040105 Subscribe Send Feedback The Altera User Flash Memory

User Flash Memory (ALTUFM) Megafunction User Guide

User Flash Memory (ALTUFM) Megafunction User Guide

UCB ASPIRE Lab - RISC-V...2019/06/18  · Welcome to the RISC-V revolution! •RISC-V is the open- source hardware Instruction Set Architecture (ISA) •Frozen base user spec released

UCB ASPIRE Lab - RISC-V...2019/06/18  · Welcome to the RISC-V revolution! •RISC-V is the open- source hardware Instruction Set Architecture (ISA) •Frozen base user spec released

Runway Incursion Severity Calculator (RISC) 4.2 User Guideintelligent-vehicles.org/wp-content/uploads/2017/09/RISC... · 2017. 9. 12. · The Runway Incursion Severity Calculator

Runway Incursion Severity Calculator (RISC) 4.2 User Guideintelligent-vehicles.org/wp-content/uploads/2017/09/RISC... · 2017. 9. 12. · The Runway Incursion Severity Calculator