Control Flow Integrity on RISCV
summary
RISC-V CFI splits into ZICFI-LP landing pad checks that force all indirect branches to target an embedded label (with exceptions for AUIPC+JALR idioms) and ZICFI-SS shadow stack with CSR_SSP that uses new SS_PUSH and SS_POP_CHECK instructions to verify returns and raise a software check exception on mismatch. Kernel-side uses a map_shadow_stack style mapping and a prot_shadow_stack/VMA encoding with store-page-fault-driven COW; eBPF and kprobe workflows require codegen or probe placement updates but otherwise work.
AI-written summary · about
chapters (9)
- 0:00Introduction to CFI
- 1:25Landing pad extensions
- 3:07Shadow stack implementation
- 6:26Shadow stack page faults
- 7:46Runtime CFI considerations
- 10:22Probing and text patching
- 12:34Memory management and CFI
- 14:41User mode enabling
- 16:57Q&A session
related talks
41mRISC-V Control-Flow Integrity (CFI)
35mControl Flow Integrity on RISC-V Linux
27mControl Flow Integrity on RISC-V
27mFiner-grained kernel control flow integrity and challenges
39mControl Flow Integrity in the Linux Kernel
45mControl Flow Integrity in the Linux Kernel
44mLinux Kernel Control-Flow Integrity Sup...
18mCPU Security in the Context of RISC-V