CVA6-CFI: A First Glance at RISC-V Control-Flow Integrity Extensions
By Simone Manoni 1, Emanuele Parisi 2, Riccardo Tedeschi 1, Davide Rossi 1,3, Andrea Acquaviva 1, Andrea Bartolini 1
1 Department of Electrical, Electronic, and Information Engineering - University of Bologna, Italy
2 High Performance Domain-Specific Architectures Group - Barcelona Supercomputing Center, Spain
3 Department of Digital Design and Open Hardware - Chips-IT, Italy
Abstract
This work presents the first design, integration, and evaluation of the standard RISC-V extensions for Control-Flow Integrity (CFI). The Zicfiss and Zicfilp extensions aim at protecting the execution of a vulnerable program from control-flow hijacking attacks through the implementation of security mechanisms based on shadow stack and landing pad primitives. We introduce two independent and configurable hardware units implementing forward-edge and backward-edge control-flow protection, fully integrated into the open-source CVA6 core. Our design incurs in only 1.0% area overhead when synthesized in 22 nm FDX technology, and up to 15.6% performance overhead based on evaluation with the MiBench automotive benchmark subset. We release the complete implementation as open source.
Index Terms — Control-Flow Integrity, Shadow Stack, Landing Pad, RISC-V
To read the full article, click here
Related Semiconductor IP
- RISC-V Display Connectivity Subsystem (DCS)
- RISC-V IOPMP IP
- RISC-V Debug & Trace IP
- Gen#2 of 64-bit RISC-V core with out-of-order pipeline based complex
- 64-bit RISC-V core with in-order single issue pipeline. Tiny Linux-capable processor for IoT applications.
Related Articles
- A closer look at security verification for RISC-V processors
- What is JESD204C? A quick glance at the standard
- OpenAccess: first impressions at AMD
- Inside the Xilinx Kintex-7 FPGA: A closer look at the first FPGA to use HKMG technology
Latest Articles
- ZK-Flex: A Flexible and Scalable Framework for Accelerating Zero-Knowledge Proofs
- ITP-STDP: An Intrinsic-Timing Power-of-Two Learning Engine for On-Chip SNN Training
- OpenEye: A Scalable Open-Source Hardware Accelerator for DNNs
- CHIMERA: A Flexible and Scalable 3.1 TOPS/W AI-MCU with Transformer Accelerator and 563 Gb/s Shared-L2 Memory Subsystem with QoS Guarantees
- CXL-ClusterSim: Modeling CXL-based Disaggregated Memory Cluster for Pooling and Sharing using gem5 and SST