Area Comparison of CHERIoT and PMP in Ibex

TL;DR

This paper addresses memory-safety for Ibex-based embedded processors by comparing two architectural approaches: PMP and CHERIoT/CHERI. It conducts a hardware-area study using synthesis in FreePDK45, reporting core-area overheads of $42\%$ for PMP and $57\%$ for CHERIoT, while demonstrating that system-wide impact on a complete SoC like OpenTitan Earl Grey remains modest ($0.6\%$ and $1\%$ respectively). The analysis highlights that PMP and CHERIoT provide strong security benefits with only small increases to overall chip area, due to the core occupying a small fraction of the total system. The results support using memory-safety extensions in secure embedded designs as a favorable trade-off between security guarantees and silicon cost.

Abstract

Memory safety is a critical concern for modern embedded systems, particularly in security-sensitive applications. This paper explores the area impact of adding memory safety extensions to the Ibex RISC-V core, focusing on physical memory protection (PMP) and Capability Hardware Extension to RISC-V for Internet of Things (CHERIoT). We synthesise the extended Ibex cores using a commercial tool targeting the open FreePDK45 process and provide a detailed area breakdown and discussion of the results. The PMP configuration we consider is one with 16 PMP regions. We find that the extensions increase the core size by 24 thousand gate-equivalent (kGE) for PMP and 33 kGE for CHERIoT. The increase is mainly due to the additional state required to store information about protected memory. While this increase amounts to 42% for PMP and 57% for CHERIoT in Ibex's area, its effect on the overall system is minimal. In a complete system-on-chip (SoC), like the secure microcontroller OpenTitan Earl Grey, where the core represents only a fraction of the total area, the estimated system-wide overhead is 0.6% for PMP and 1% for CHERIoT. Given the security benefits these extensions provide, the area trade-off is justified, making Ibex a compelling choice for secure embedded applications.

Figures (4)

• Figure 1: Area comparison between the Baseline, the -enabled, and the -enabled Ibex cores, with the area increase annotated relative to the Baseline Ibex for modules that change more than 1%. The modules in black are modules unique to the specific configuration.
• Figure 2: Block diagram of the OpenTitan Earl Grey opentitanDocs. The synthesised top level discussed in this paper is coloured in purple.
• Figure 3: Area breakdown of Earl Grey Top with baseline Ibex configuration. The blocks are grouped by their functionality. The AON Managers block comprises the PWM, Power Manager, Sysrst Controller, AON Timers, Clk/Rst Managers, ADC Controller, Sensor Control. The Misc block summarizes the Timers and the Pattern generators.
• Figure 4: Earl Grey based breakdown. The pie chart shows the distribution of logic and memory macros in our Earl Grey based , highlighting Ibex's contribution.