ROLoad-PMP: Securing Sensitive Operations for Kernels and Bare-Metal Firmware

2026-08-13

AI Summary

Existing protection mechanisms struggle to simultaneously achieve broad coverage and high performance, particularly in resource-constrained low-level systems. This work proposes ROLoad-PMP, a lightweight hardware-software co-design that introduces a keyed read-only memory load instruction to enforce strong integrity for sensitive operations such as control-flow transfers. By integrating compile-time operand classification with a runtime secure loading mechanism, the approach synergistically combines a RISC-V instruction extension, memory layout optimization, and Physical Memory Protection (PMP). Evaluated on an FPGA prototype, ROLoad-PMP incurs less than 1.40% hardware overhead and only 0.853% runtime performance degradation while supporting diverse defenses including forward-edge control-flow integrity, demonstrating superior protection strength compared to ARM BTI and Intel CET.

Abstract

A common way for attackers to compromise victim systems is hijacking sensitive operations (e.g., control-flow transfers) with attacker-controlled inputs. Existing solutions in general only protect parts of these targets and have high performance overheads, which are impractical and hard to deploy on systems with limited resources (e.g., IoT devices) or for low-level software like kernels and bare-metal firmware. In this paper, we present a lightweight hardware-software co-design solution ROLoad-PMP to protect sensitive operations from being hijacked for low-level software. First, we propose new instructions, which only load data from read-only memory regions with specific keys, to guarantee the integrity of pointees pointed by (potentially corrupted) data pointers. Then, we provide a program hardening mechanism to protect sensitive operations, by classifying and placing their operands into read-only memory with different keys at compile-time and loading them with ROLoad-PMP-family instructions at runtime. We have implemented an FPGA-based prototype of ROLoad-PMP based on RISC-V, and demonstrated an important defense application, i.e., forward-edge control-flow integrity. Results showed that ROLoad-PMP only costs few extra hardware resources (< 1.40%). Moreover, it enables many lightweight (e.g., with negligible overheads < 0.853%) defenses, and provides broader and stronger security guarantees than existing hardware solutions, e.g., ARM BTI and Intel CET.

Problem

• sensitive operations
• control-flow integrity
• hardware-software co-design
• low-level software
• security overhead

Innovation

• ROLoad-PMP
• hardware-software co-design
• control-flow integrity
• read-only memory protection
• lightweight security