RISC-V Needs Secure 'Wheels': the MCU Initiator-Side Perspective

Sandro Pinto,Jose Martins,Manuel Rodriguez,Luis Cunha,Georg Schmalz,Uwe Moslehner,Kai Dieffenbach,Thomas Roecker

2024-10-13

Abstract:The automotive industry is experiencing a massive paradigm shift. Cars are becoming increasingly autonomous, connected, and computerized. Modern electrical/electronic (E/E) architectures are pushing for an unforeseen functionality integration density, resulting in physically separate Electronic Control Units (ECUs) becoming virtualized and mapped to logical partitions within a single physical microcontroller (MCU). While functional safety (FuSa) has been pivotal for vehicle certification for decades, the increasing connectivity and advances have opened the door for a number of car hacks and attacks. This development drives (cyber-)security requirements in cars, and has paved the way for the release of the new security certification standard ISO21434. RISC-V has great potential to transform automotive computing systems, but we argue that current ISA/extensions are not ready yet. This paper provides our critical perspective on the existing RISC-V limitations, particularly on the upcoming WorldGuard technology, to address virtualized MCU requirements in line with foreseen automotive applications and ISO21434 directives. We then present our proposal for the required ISA extensions to address such limitations, mainly targeting initiator-side protection. Finally, we explain our roadmap towards a full open-source proof-of-concept (PoC), which includes extending QEMU, an open-source RISC-V core, and building a complete software stack.

Cryptography and Security,Hardware Architecture

What problem does this paper attempt to address?

### What problems does this paper attempt to solve?

This paper aims to solve the problems of insufficient security and virtualization support in the application of the RISC - V Instruction Set Architecture (ISA) in the automotive field. Specifically, the paper focuses on how to make the RISC - V architecture meet the requirements of modern automotive Electronics/Electrical (E/E) architectures, especially providing sufficient isolation mechanisms to ensure the security and functional independence between multiple virtualized Microcontroller Units (vMCUs) under the premise of conforming to the ISO21434 standard.

#### Main problems include:

1. **Limitations of existing ISA extensions**:
- **Limitations of WorldGuard technology**: The existing WorldGuard technology cannot fully support the multi - privilege - level isolation requirements in a virtualized environment, especially for the newly introduced privilege levels (such as VS - mode and VU - mode), and the support for more than 32 unique World IDs.
- **Inefficient design of SPMP (Supervisor Physical Memory Protection)**: Currently, SPMP defines different PMPs for non - virtualized and virtualized modes respectively, which results in static and inefficient resource allocation, and may waste SPMP entries under certain configurations.

2. **High requirements for isolation mechanisms in automotive applications**:
- **Real - time performance and low latency**: Automotive applications need to ensure low latency and real - time response while ensuring functional safety.
- **Flexible application configuration model**: Different application scenarios require flexible configuration options to adapt to different security and performance requirements.
- **System - level protection**: In addition to CPU - level protection, protection for non - CPU initiators such as DMA and encryption accelerators is also required.

3. **Meeting the requirements of the ISO21434 standard**:
- ISO21434 is a new international standard for automotive network security, which requires risk assessment during the development process and proposes corresponding security measures. The current RISC - V ISA extensions have not yet fully met the requirements of this standard, especially in terms of virtualization and isolation mechanisms.

### Main contributions of the paper

1. **Analysis of the requirements of modern E/E architectures**: The paper analyzes in detail the requirements of modern automotive E/E architectures for security and isolation mechanisms, and points out the gaps in the RISC - V ISA in achieving these requirements.

2. **Proposing extension suggestions**:
- **Improving the WorldGuard specification**: In order to better support the virtualized environment, the paper proposes to extend the WorldGuard specification so that it can handle more World IDs (up to 128), and enhance the interoperability with the Hypervisor extension.
- **Unifying the SPMP design**: A unified SPMP model is proposed, which combines the originally separated SPMP and hgPMP into a single SPMP, which is controlled by the Hypervisor, thereby improving resource utilization and flexibility.

3. **Open - source PoC roadmap**: The paper also discusses the specific steps to implement these extensions, including extending QEMU, implementing an open - source RISC - V CPU for WG and other extensions, and building a complete software stack based on the Bao Hypervisor.

Through these improvements, the paper aims to make the RISC - V architecture more suitable for future automotive computing systems, especially in terms of meeting the ISO21434 standard and providing efficient and secure virtualization support.