Skip to content
STIMSMITH

μCFI: Formal Verification of Microarchitectural Control-flow Integrity

Paper
First seen 7/6/2026
Last seen 7/6/2026
Evidence 15 chunks

NEIGHBORHOOD

No graph connections found for this entity yet. It may appear in future ingestion runs.

explore full graph →

RELATIONSHIPS

30 connections
The paper verifies μCFI over unbounded instruction sequences.
static design analysis uses → 90% 2e
The paper uses static design analysis to automatically extract taint injection conditions from CPU designs.
Information Flow Tracking (IFT) uses → 100% 2e
The paper uses Information Flow Tracking to formally verify the μCFI property.
formal verification uses → 100% 2e
The paper applies formal verification to verify the μCFI property on RISC-V CPUs.
Model Checking uses → 100% 2e
The paper uses a model checker to exhaustively verify the μCFI property over hardware designs.
logic abstraction uses → 90% 2e
The paper uses logic abstraction to disconnect signals from their driving logic in verification.
Kronos RISC-V CPU evaluates → 100% 2e
The paper evaluates the μCFI property on the Kronos RISC-V CPU.
PicoRV32 RISC-V CPU evaluates → 100% 2e
The paper evaluates the μCFI property on the PicoRV32 RISC-V CPU.
Ibex RISC-V CPU evaluates → 100% 2e
The paper evaluates the μCFI property on the Ibex RISC-V CPU.
Scarv RISC-V CPU evaluates → 100% 2e
The paper evaluates the μCFI property on the Scarv RISC-V CPU.
taint tracking uses → 100% 2e
The paper uses taint tracking as a core mechanism for information flow analysis.
Register-Transfer Level (RTL) uses → 100% 2e
The paper operates at the Register Transfer Level for hardware verification.
CVE (Common Vulnerabilities and Exposures) mentions → 100% 2e
The paper reports five new security vulnerabilities including 4 CVEs found through μCFI verification.
Microarchitectural Control-Flow Integrity (μCFI) introduces → 100% 2e
The paper introduces μCFI as a new generic security property.
CellIFT uses → 100% 2e
The paper uses CellIFT for information flow tracking in the verification approach.
Yosys uses → 95% 2e
The paper uses Yosys passes for static design analysis and taint condition generation.
SystemVerilog Assertions (SVA) uses → 100% 2e
The paper uses SystemVerilog Assertions to express the μCFI property for formal verification.
cell-level taint instrumentation uses → 100% 2e
The paper uses cell-level taint instrumentation via CellIFT and CellDFT.
Katharina Ceesay-Seitz authored by → 100% 1e
Katharina Ceesay-Seitz is listed as an author of the paper.
Flavien Solt authored by → 100% 1e
Flavien Solt is listed as an author of the paper.
Kaveh Razavi authored by → 100% 1e
Kaveh Razavi is listed as an author of the paper.
Instruction Operand Constraint (IOC) uses → 100% 1e
The paper uses the Instruction Operand Constraint to isolate verification of information flows to specific instructions.
μCFI verification toolchain introduces → 95% 1e
The paper introduces and open-sources the μCFI verification toolchain.
CellDFT introduces → 95% 1e
The paper introduces CellDFT, a new data flow tracking variant of CellIFT.
delay injection attack mentions → 85% 1e
The paper mentions delay injection attacks as a class of vulnerability captured by μCFI.
Jasper FPV uses → 95% 1e
The paper uses Jasper FPV as the formal model checker for verification.
The paper mentions RISC-V's DIEL mode as motivation for microarchitectural CT verification.
Hardware fuzzing mentions → 90% 1e
The paper mentions hardware fuzzing as a related but incomplete verification approach.
precise taint injection uses → 100% 1e
The paper uses precise taint injection to correctly attribute information flows to specific instructions.
timing side-channel attack mentions → 90% 1e
The paper discusses timing side-channel attacks as a threat model addressed by μCFI.