分支着陆：基于Bloom过滤器的源授权用于RISC-V的前缘控制流完整性
Branch Landing: Bloom Filter-Based Source Authorization for Forward-Edge CFI on RISC-V
AI总结：
本文提出Branch Landing框架，通过Bloom过滤器实现RISC-V前缘控制流完整性，解决传统方法在源域授权精度不足的问题，采用轻量ISA扩展和可配置的Section粒度，实现高效授权验证。
摘要：
Jump-Oriented Programming (JOP)攻击利用间接控制转移绕过后缘防御，但现有前缘CFI机制缺乏精确的源域授权：基于类型的CFI允许所有相同签名的调用者，而基于标签的硬件CFI受限于固定宽度寄存器存储，限制了同时授权源的数量。我们提出Branch Landing (BRL)，一种针对RISC-V的前缘CFI框架，用Bloom过滤器成员查询取代固定容量检查。两个轻量ISA扩展，bld和brl，通过专用的BRState寄存器传播源Section标识符(SID)，并在每个着陆点以固定探测延迟验证，该延迟与授权源数量无关。Section粒度可配置，支持从基于类型到CFG衍生授权的策略。我们实现了Branch Landing在LLVM RISC-V后端，并在81个BEEBS基准测试上评估了两种代表性策略配置：函数级基于类型的策略和基本块级基于CFG衍生的策略。在3个周期brl延迟模型下，两种配置的平均运行时间开销仅为0.210%和0.421%，平均代码大小增长分别为0.46%和0.52%。与基于类型的策略相比，CFG衍生策略将平均等价类大小减少了32.5%，且所有评估执行均未出现BRL强制失败。
英文摘要：
Jump-Oriented Programming (JOP) attacks exploit indirect control transfers to bypass backward-edge defenses, yet existing forward-edge CFI mechanisms lack precise source-domain authorization: type-based CFI admits all same-signature callers, while tag-based hardware CFI is limited by fixed-width register storage that caps the number of simultaneously authorized sources. We propose Branch Landing (BRL), a landing-based forward-edge CFI framework for RISC-V that replaces fixed-capacity checks with Bloom filter membership queries. Two lightweight ISA extensions, bld and brl, propagate a source Section Identifier (SID) through a dedicated BRState register and validate it at each landing site with fixed-probe latency that is independent of the number of authorized sources under a chosen filter configuration. Section granularity is configurable, supporting policies from type-based to CFG-derived authorization within a single mechanism. We implement Branch Landing in the LLVM RISC-V backend and evaluate it on 81 BEEBS benchmarks under two representative policy configurations: a function-level, type-based policy and a basic-block-level, CFG-derived policy. Under a 3-cycle brl latency model, the two configurations incur average runtime overheads of only 0.210% and 0.421%, with mean code size growth of 0.46% and 0.52% respectively. The CFG-derived policy reduces the average equivalence class size by 32.5% compared to the type-based policy, and all evaluated executions complete without BRL enforcement failures.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
