This work presents the first design, integration, and evaluation of the standard RISC-V extensions for Control-Flow Integrity (CFI). The Zicfiss and Zicfilp extensions aim at protecting the execution of a vulnerable program from control-flow hijacking attacks through the implementation of security mechanisms based on shadow stack and landing pad primitives. We introduce two independent and configurable hardware units implementing forward-edge and backward-edge control-flow protection, fully integrated into the open-source CVA6 core. Our design incurs in only 1.0% area overhead when synthesized in 22 nm FDX technology, and up to 15.6% performance overhead based on evaluation with the MiBench automotive benchmark subset. We release the complete implementation as open source.

翻译：本研究首次对标准RISC-V控制流完整性（CFI）扩展进行了设计、集成与评估。Zicfiss与Zicfilp扩展旨在通过基于影子栈和着陆垫原语的安全机制，保护易受攻击程序免受控制流劫持攻击。我们提出了两个独立可配置的硬件单元，分别实现前向边与后向边控制流保护，并将其完整集成至开源CVA6内核中。采用22纳米FDX工艺综合时，该设计仅产生1.0%的面积开销；基于MiBench汽车基准测试子集的评估显示，其性能开销最高为15.6%。我们已将完整实现开源发布。