/Raft

Hardware-assisted Dynamic Information Flow Tracking for Runtime Protection on RISC-V

Primary LanguageScala

Raft-prototype

Overview

Our prototype is built from Programmable Hardware Monitor (PHMon) 1. We run our experiments on the Xilinx Kintex-7 FPGA KC705 evaluation board. Considering code size, we only show the necessary modifications in this repository.

Contents

  • llvm: patches for LLVM Compiler Infrastructure.
  • rocket-chip: patches for Rocket Chip Generator.
  • rocket-chip/varanus: code of the coprocessor.
  • security policy: code to enable/disable the coprocessor.
  • security policy/copro.c: code of the policy configuration.
  • wrapper: patches for Wrapper for Rocket-Chip on FPGAs
  • kernel.patch: patches for Linux Kernel.
  • opensbi.patch: patches for RISC-V Open Source Supervisor Binary Interface.
  • uboot.patch: patches for Das U-Boot Source Tree.
  • bitstreams: generated bitstreams.
  • debian-riscv64-boot: linux kernel and bootloader.

Usage

Make sure to install llvm, elf-gcc, and linux-gcc and set RISCV variable in advance. A Xilinx Kintex-7 FPGA KC705 evaluation board, an SD card, and a Vivado installation are required. We provide the generated bitstream, linux kernel, and bootloader in the repository. In addition, we recommend vivado-risc-v2 as the wrapper on KC705.

  1. Compile the protected program

    $ cd security-policy
$ make

    then you should get enable.riscv, disable.riscv, and test.riscv. Change the copro.c if you want to specify a new security policy and remake.

  2. Program the FPGA

    • Drag compiled programs and debian-riscv64-boot/ into the SD card.
    • Connect your KC705 with a USB cable and power it on.
    • Open Hardware Manager in Vivado and program FPGA with the bitstream.

  3. Boot linux

    You can login over UART console:

    $ sudo microcom −p /dev/ttyUSB0 −s 115200

    after Linux boot, you can run the protected program.

    $ ./enable.riscv 
$ mv test.riscv t1.riscv 
$ ./t1.riscv

    Note that we need to manually rename the protected program to t1.riscv in the current implementation. You can also disable the coprocessor by running disable.riscv.

Additional Information

Citation

If you use this repository for research, please cite our paper:

@inproceedings{wang2023raft,
  title={Raft: Hardware-assisted Dynamic Information Flow Tracking for Runtime Protection on RISC-V},
  author={Wang, Yu and Wu, Jinting and Zheng, Haodong and Ning, Zhenyu and He, Boyuan and Zhang, Fengwei},
  booktitle={Proceedings of the 26th International Symposium on Research in Attacks, Intrusions and Defenses (RAID'23)},
  year={2023}
}

Publication

Wang, Yu, et al. "Raft: Hardware-assisted Dynamic Information Flow Tracking for Runtime Protection on RISC-V." Proceedings of the 26th International Symposium on Research in Attacks, Intrusions and Defenses (RAID'23). 2023.

Others

Reference

Footnotes

  1. PHMon: A Programmable Hardware Monitor and Its Security Use Cases. https://github.com/bu-icsg/PHMon ↩

  2. Xilinx Vivado block designs for FPGA RISC-V SoC running Debian Linux distro. https://github.com/eugene-tarassov/vivado-risc-v ↩