Generic Tagging for RISC-V Binaries

TL;DR

COGENT is a versatile tool for inserting configurable metadata tags into RISC-V binaries, enhancing security features like control-flow integrity while maintaining backward compatibility and manageable overhead.

Contribution

This paper introduces COGENT, a generic instruction tag generator for RISC-V that supports configurable tags and labels, enabling security solutions without modifying hardware.

Findings

Binary size increases by up to 29.3% with tagging.

Execution overhead ranges from 5.72% to 13.4%.

Supports configurable tag widths and labels for security enhancements.

Abstract

With the widespread popularity of RISC-V -- an open-source ISA -- custom hardware security solutions targeting specific defense needs are gaining popularity. These solutions often require specialized compilers that can insert metadata (called tags) into the generated binaries, and/or extend the RISC-V ISA with new instructions. Developing such compilers can be a tedious and time-consuming process. In this paper, we present COGENT, a generic instruction tag generator for RISC-V architecture. COGENT is capable of associating a tag of configurable and varying widths (1 to 20 bits) to each instruction. It is also capable of emitting labels that are central to the implementation of control-flow integrity (CFI) solutions. COGENT encodes all tags and labels as nop instructions thereby providing full backward compatibility. We evaluate COGENT on a subset of programs from the SPEC CPU2017 benchmark suite and report the binary size increase to be 29.3% and 18.27% for the lowest and highest tag coverage levels respectively. Additionally, we executed tagged programs on COTS RISC-V unmodified hardware and found the execution time overhead (with respect to backward compatibility) to be 13.4% and 5.72% for the lowest and highest coverage levels respectively. Finally, using a case study, we present possible use case scenarios where COGENT can be applied.