RISC-V Summit

Having ported Dover Microsystems’ CoreGuard security product to several architectures, including RISC-V, we have some lessons learned about how well-intentioned features can make the task of implementing reliable, fine-grained security gratuitously difficult. While some of our talk will focus on subtle instruction set design tradeoffs, we also have a larger, more urgent message to convey to the RISC-V community about designing an architecture that is friendly to future, innovative security products. A non-exhaustive list of gotchas from RISC-V and other ISAs: (1) exception delegation, where was EPC stored? (2) multi-word load/stores operations paused or canceled due to interrupt or exception - what loads/stores were executed; also when are we resuming? (3) lazy register spills - too clever by half! (4) punning JAL for exception return - saves max 2 instructions, adds complexity. (4) register windows and wraparound - complexity better handled in compiler than HW. We strongly encourage a general, trace-based introspection feature to support a wide range of debugging and security products, rather than per-feature-ISA extensions that will eventually throttle the ISA due to complexity.