Control Flow Integrity on RISC-V Linux
Talkat Linux Security Summit North America 2024 · on Thursday, 2024-04-18· at 12:00· Terrace Suite 1+2·
summary
Hardware-backed CFI for RISC-V uses a landing‑pad instruction plus a hardware shadow stack and a new Z CFI LP extension; userland patches (v3) and kernel RFCs land feature discovery and activation, and a rootfs boots with CFI enabled. Tooling uses clang/LLVM, qemu, and md5 hashes of function signatures to measure label collisions: 20‑bit labels give ~12% loss for C++ and ~3% for C. Measured code size growth ≈1.99% and indirect gadget reduction 99.43%; kernel enablement lands in ~12 patches.
AI-written summary · about
chapters (13)
- 0:00Control Flow Integrity intro
- 1:26What is Control Flow Integrity and its importance
- 3:11Memory safety and hijacking
- 7:30RISC-V basics and calling convs
- 10:01RISC-V instruction formats
- 13:19Indirect control transfers
- 18:15ZiCFI LP extension
- 21:48ZiCFI SS extension
- 26:41Shadow stack rules
- 28:27CFI differences on RISC-V
- 30:57CFI in Linux user mode
- 32:44Label collision and performance
- 34:50Resources and future
related talks
20mControl Flow Integrity on RISCV
41mRISC-V Control-Flow Integrity (CFI)
27mFiner-grained kernel control flow integrity and challenges
27mControl Flow Integrity on RISC-V
45mControl Flow Integrity in the Linux Kernel
39mControl Flow Integrity in the Linux Kernel
44mLinux Kernel Control-Flow Integrity Sup...
18mCPU Security in the Context of RISC-V