RISC-V Control-Flow Integrity (CFI)
summary
Ratified RISC‑V extensions Zicfiss (shadow stack) and Zicfilp (landing pads) provide concrete CFI: hardware shadow stacks with an SSP register and SS push/SS pop instructions that compare shadow return addresses, an atomic SS AmoSwap for stack switching, and a VM page type that only accepts shadow-stack stores. Forward edges use landing pads with 20‑bit landing labels and a small hardware state machine that traps mismatches. Toolchain/kernel work is underway: shadow stack support is implemented in GCC and Linux VM/syscall changes exist; LLVM and GDB are partially done.
AI-written summary · about
chapters (15)
- 0:00Introduction
- 0:15Control-flow integrity concepts
- 6:32Shadow stack extension
- 6:54Shadow stack hardware
- 15:44Landing pad extension
- 17:41Indirect branch guarding
- 19:25Toolchain and ABI support
- 28:00Linux kernel support
- 35:30Q&A session
- 36:17Advanced security discussion
- 37:20Memory protection inquiries
- 38:12Summary and conclusion
- 38:26Concluding remarks
- 40:16Technical clarification
- 40:32Closing words
related talks
20mControl Flow Integrity on RISCV
35mControl Flow Integrity on RISC-V Linux
27mControl Flow Integrity on RISC-V
27mFiner-grained kernel control flow integrity and challenges
01h 46mA little Introduction to Control Flow Integrity
01h 34mA Little Introduction to Control Flow Integrity in C++
19mSecuring the Hypervisor with Control-Flow Integrity
21mSecurity Features status update