AI
Why NVIDIA Replaced Falcon with RISC-V
Each NVIDIA chip ships between 10 and 50 microcontrollers. They ran on Falcon, a proprietary ISA, until the product line outgrew it. Data center GPUs, standalone accelerators, Tegra SoCs, and Jetson devices each carry a different threat model. Scaling security across all of them on one legacy architecture stopped being viable.
NVIDIA replaced Falcon with RISC-V and built Peregrine, a single configurable hardware-software foundation for every microcontroller across every product. One investment in the foundation benefits all of them.
The Real Costs of Building on an Open ISA
RISC-V’s openness creates fragmentation. Profiles (RVA, RVB) reduce the gap but are not mutually compatible: RVA22 makes the vector extension optional while RVA23 makes it mandatory. A custom extension also locks you in if RISC-V International later ratifies something covering the same ground. Custom hardware means custom software, and you carry that maintenance cost alone.
When NVIDIA adopted RISC-V, there was no address sanitizer for the ISA. NVIDIA modified its compiler to add one. The broader community eventually followed.
Scaling Vulnerability Detection Across the Ecosystem
“Software is the biggest attack surface.” — Adam Zabrocki
Manual security research doesn’t scale across 50 microcontrollers per chip. NVIDIA needed hardware-assisted fuzzing. RISC-V had no hardware address sanitizer, so Adam Zabrocki developed the Pointer Masking extension and brought it to RISC-V International. Google independently built a similar proposal for the same reasons. The two teams merged their work into a single standard. Ratification took more than four years. The extension is now an umbrella for five sub-extensions covering hardware AS, memory tagging, and pointer authentication. Today NVIDIA fuzzes GSP firmware and the resource manager with hardware AS enabled, and bare-metal microcode fuzzing is in preparation.
Hardware Control-Flow and Memory Safety Extensions
NVIDIA’s CFI extension covers two sub-extensions. The shadow stack enforces backward-edge integrity: hardware keeps a private copy of return addresses and raises an exception if they don’t match on return. Because shadow stacks replace stack cookies, code size stays flat. Landing pads enforce forward-edge integrity by requiring every indirect branch to land on an instruction with a 20-bit label, enabling fine-grained CFI. Both sub-extensions are now in RISC-V profiles. Full hardware and software support ships in the Rubin (GR20X) chips.
Multipartition Architecture and Formal Verification
Peregrine runs a multipartition architecture modeled on the MILS pattern from defense and avionics. Each partition is an isolated execution environment defined by a signed manifest and policy, signed separately from partition images so software updates cannot alter access controls. The separation kernel reads those policies, configures hardware primitives, and hands execution over. It is not a hypervisor: partition software gets direct hardware access. The kernel and immutable boot ROM are both written in Ada SPARK, formally verified to be free of runtime errors.
Lessons from Securing a Billion-Core Ecosystem
Hardware extensions and memory-safe languages both have limits. Formally verified Ada SPARK code still contains design bugs and race conditions. Third-party libraries won’t be rewritten in safe languages anytime soon, so hybrid software stacks are permanent. Hardware CFI and memory tagging help constrain unsafe code within bounds rather than replace it.
Hybrid attacks are rising. Rowhammer and speculative execution were not considered threats until they were. Zabrocki’s advice: design for flexibility from the start, and join working groups to read where the industry is heading before formal decisions land.
Notable Quotes
Software is the biggest attack surface. Adam Zabrocki · ▶ 14:37
defense in depth remains the most reliable guiding principle Marco Midik · ▶ 33:47
innovate when you must Marco Midik · ▶ 33:41
Key Takeaways
- NVIDIA standardized 10-to-50 microcontrollers per chip on one RISC-V platform to share security investments across all products.
- Four years of work produced the ratified Pointer Masking extension, now shipping hardware address-sanitizer support in GSP firmware and resource manager.
- Ada SPARK formal verification proves whole classes of runtime errors cannot occur in the separation kernel that enforces partition isolation.