Black Hat USA 2025 | How to Secure Unique Ecosystem Shipping 1 Billion+ Cores?

Why It Matters

Nvidia’s RISC‑V‑based security stack enables a unified, scalable defense for billions of cores, setting a new benchmark for heterogeneous AI hardware and influencing industry‑wide open‑ISA adoption.

Key Takeaways

• Nvidia unified over a billion cores on a single RISC‑V ecosystem.
• Adopted RISC‑V to replace legacy Falcon for scalability and openness.
• Built configurable isolation using PMP, IOPMP, and Nvidia’s NVMPU.
• Developed custom extensions like pointer‑masking and hardware fuzzing accelerators.
• Emphasized automated vulnerability detection, contributing back to RISC‑V community.

Summary

At Black Hat USA 2025, Nvidia’s offensive security director Adam Zabrai and system software manager Marco Midik outlined how the company secures a sprawling ecosystem that now ships more than one billion processor cores across data‑center GPUs, consumer graphics, Jetson modules and emerging products. The talk emphasized that despite the diversity of form‑factors and threat models, all these devices share a common execution substrate built on RISC‑V, replacing Nvidia’s legacy Falcon architecture to achieve greater scalability, openness, and performance.

The presenters detailed the architectural shift: each Nvidia chip integrates 10‑50 micro‑controllers that run on a configurable RISC‑V core, leveraging hardware isolation primitives such as Physical Memory Protection (PMP), I/O PMP, and Nvidia’s proprietary NVMPU. By standardizing on a single‑core strategy, Nvidia can apply uniform security extensions—point‑masking, control‑flow integrity, and memory‑tagging—across all product lines while still tailoring trust levels for mixed‑criticality workloads.

Key examples included the decision to forego traditional ASLR in favor of stronger, hardware‑assisted protections, the creation of a custom pointer‑masking extension, and the deployment of a dedicated fuzzing accelerator to boost automated vulnerability discovery. Nvidia also retrofitted the RISC‑V toolchain with address‑sanitizer support, a capability that later entered the broader open‑source ecosystem.

The broader implication is a more future‑proof, scalable security foundation that can keep pace with Nvidia’s rapid AI‑centric growth. By contributing extensions back to the RISC‑V foundation, Nvidia helps mitigate fragmentation risks while ensuring that its massive, heterogeneous fleet remains resilient against emerging threats.

Original Description

Security research has historically been focused on securing well-known, widely replicated ecosystems—where problems and solutions are shared across the industry. But what happens when you build something no one else has? How do you secure an architecture that's both proprietary and deployed at billion-core scale?

In 2016, NVIDIA began transitioning its internal Falcon microprocessor—used as a logic controller in nearly all GPU products—to a RISC-V-based architecture. Today, each chipset includes 10 to 40 RISC-V cores, and in 2024, NVIDIA surpassed 1 billion RISC-V cores shipped. This success came with unique security challenges—ones that existing models couldn't solve.

To address them, we developed a custom software and hardware security architecture from scratch. This includes a purpose-built Separation Kernel software, novel RISC-V ISA extensions like Pointer Masking and IOPMP (later ratified), and unique secure boot and attestation mechanisms. But how do you future-proof a proprietary ecosystem against tomorrow's threats?

In this talk, we'll share what we learned—and what's next. From hardware-assisted memory safety (HWASAN, MTE) to control-flow integrity (CFI) and CHERI-like models, we'll explore how NVIDIA is preparing not only its RISC-V ecosystem for the evolving threat landscape. If you care about real-world security at an unprecedented scale, this is a journey you won't want to miss.

By:

Adam Zabrocki | Director of Offensive Security, NVIDIA

Marko Mitic | System Software Manager, NVIDIA

Presentation Materials Available at:

https://blackhat.com/us-25/briefings/schedule/?#how-to-secure-unique-ecosystem-shipping-1-billion-cores-46384