lowRISC tagged memory tutorial

By Wei Song

Release version 0.1 (04-2015)

Introduction

lowRISC is a not-for-profit organisation whose goal is to produce a fully open source System-on-Chip (SoC) in volume. We are building upon RISC-V processor core implementations from the RISC-V team at UC Berkeley. We will produce a SoC design to populate a low-cost community development board and to act as an ideal starting point for deritivative open-source and commercial designs.

This tutorial introduces an extension to the Rocket chip [1] that adds preliminary support for tagged memory. The tutorial also acts as an introduction to the RISC-V tools and provides a step-by-step guide to setting up the environment necessary to run test programs either in simulation or on an FPGA.

The Rocket chip generator is a parameterized SoC generator written in Chisel by the RISC-V team at UC Berkeley. Chisel can generate code to produce a cycle-accurate C++ emulator, Verilog optimised for FPGAs or Verilog for use in an ASIC flow. These cache-coherent multicore SoCs are powered by the 64-bit 5-stage scalar RISC-V Rocket core.

The implementation of tagged memory presented here provides only the most basic support by extending on-chip caches to hold tags and by adding a tag cache. Instruction set support is provided in the form of load and store tag (ltag, stag) instructions. While these are useful for some experiments they are insufficient for more general use cases. Richer instruction set support and the ability to trigger interrupts based on tagged memory accesses will be added in subsequent releases. A future release will also provide the necessary modifications to the Linux kernel to ensure tagged memory is fully supported [2] (e.g. support in the VM subsystem, when copying memory and for the fork operation). Note: no such OS support is provided in this release.

Tagged memory provides the ability to associate metadata, in the form of one or more tag bits, with each memory location. Tag bits can then be employed to provide fine-grained memory protection, e.g. to protect return addresses, vtable pointers and other code pointers on the stack and heap in order to prevent code hijacking attacks. We are also keen to explore other potential uses of tagged memory, e.g. the potential for aiding debugging, accelerating runtime services and providing fine-grained memory synchronization [3]. In the current implementation the default configuration associates 4-bit tags with every double word (64-bits) in memory.

Contents

1. Overview of the Rocket chip
2. Overview of the Rocket core
3. Tagged memory support
   • Adding HW/SW support for the load and store tag instructions
   • Tagged memory tests
4. Setting up the development environment
5. Running simulations
   • Using the Spike Simulator
   • Using the C++ emulator generated by Chisel
   • Simulating the Verilog (ASIC target) generated by Chisel
   • Simulating the Verilog (FPGA target) generated by Chisel
6. Running tests on the Zedboard FPGA
7. Performance results (coming soon)
8. Future work
9. Appendix
   • Rebuilding the boot image
   • Modifying the contents of the RAMDisk
   • Building the front-end server

Other useful sources of information

• Rocket Chip Generator
• Setting up the RISC-V tools

Acknowledgements

Many thanks to the RISC-V team at Berkeley for all their support and guidance. Special thanks to Yunsup Lee, Henry Cook and Scott Beamer for fielding numerous questions from us about the implementation details of the Rocket core and chip.

Bibliography

[1]: Yunsup Lee, “RISC-V Rocket Chip Generator”, RISC-V workshop, January 2015 slides

[2] Robert N. M. Watson, Jonathan Woodruff, Peter G. Neumann, Simon W. Moore, Jonathan Anderson, David Chisnall, Nirav Dave, Brooks Davis, Khilan Gudka, Ben Laurie, Steven J. Murdoch, Robert Norton, Michael Roe, Stacey Son, and Munraj Vadera. “CHERI: A Hybrid Capability-System Architecture for Scalable Software Compartmentalization”, Proceedings of the 36th IEEE Symposium on Security and Privacy (“Oakland”), San Jose, California, USA, May 2015.

[3] Tagged memory and minion cores in the lowRISC SoC, lowRISC-MEMO 2014-001