CVA6-CFI: A First Glance at RISC-V Control-Flow Integrity Extensions
Abstract
This work presents the first design, integration, and evaluation of the standard RISC-V extensions for Control-Flow Integrity (CFI). The Zicfiss and Zicfilp extensions aim at protecting the execution of a vulnerable program from control-flow hijacking attacks through the implementation of security mechanisms based on shadow stack and landing pad primitives. We introduce two independent and configurable hardware units implementing forward-edge and backward-edge control-flow protection, fully integrated into the open-source CVA6 core. Our design incurs in only 1.0% area overhead when synthesized in 22 nm FDX technology, and up to 15.6% performance overhead based on evaluation with the MiBench automotive benchmark subset. We release the complete implementation as open source.
Cite
@article{arxiv.2602.04991,
title = {CVA6-CFI: A First Glance at RISC-V Control-Flow Integrity Extensions},
author = {Simone Manoni and Emanuele Parisi and Riccardo Tedeschi and Davide Rossi and Andrea Acquaviva and Andrea Bartolini},
journal= {arXiv preprint arXiv:2602.04991},
year = {2026}
}
Comments
Accepted as a lecture at the 2026 IEEE International Symposium on Circuits and Systems. Preprint version