About

• Specification Name: Worldguard ISA extension

• Task Group: Fast Track

• Task Group Charter: N/A

• Spec Jira: RVS-2940: WorldGuardSpecification in Planning

Background

The purpose of this extension is to provide software isolation in a hardware platform by constraining access to system physical addresses.

WorldGuard provides Worlds, uniquely identified by a hardware World Identifier (WID), which are execution contexts that include agents (such as harts and devices) that can initiate a transaction on a physical address within a world, and resources (such as memories and peripheral devices) that respond to transactions at a physical address within a world. Worlds are created and configured by a trusted execution environment, usually at system boot time.

Overview

• Harts that support WorldGuard associate a WID with all memory accesses initiated by that hart. The WorldGuard extensions allow different privilege modes on a hart to be tagged with different WIDs.

• There are three levels of WG support on RISC-V harts.

  • The first level does not require an ISA extension and fixes the WID for all privilege modes on a hart.

  • The second level is the Smwg extension, which enables M-mode to control the WID of lower-privilege modes.

  • The third level is the Smwgd extension, which further enables M-mode to delegate to [H]S-mode the ability to assign the WID of lower-privilege modes, thereby adding the Sswg extension to [H]S-mode.

Stakeholders Identification

• Privilege IC

• Security HC

References: Active Groups and Specifications Under Development

Design Considerations

The proposed WorldGuard Smwg, Smwgd, and Sswg extensions allow a hart to assign WIDs to its privilege modes. Three new CSRs are added.

Proposed spec for reference.

Proof-of-Concept and Tests

Proof-of-Concept: SiFive implements the spec (already done in FPGA and silicon).

Software support: Trusted OS (ProvenCore), TEE (ProvenRun), Keystone (WG support in security monitor)

Simulator support: QEMU, Spike, Sail

Tests:

Software Ecosystem Impacts

Impact is on isolation of software execution contexts at platform level.

• Firmware for security monitors

• Operating systems like REE/TEE

• Hypervisors: WG enables Hypervisors to isolate Virtual Machines.

Freeze Checklists

Key Milestones

Additional Notes