Implementation of the RISC-V ISA Extensions for Control-Flow Integrity

About the Organization

<p>Control-flow integrity (CFI) is a fundamental security mechanism that prevents attackers from hijacking a program's execution flow. By exploiting memory vulnerabilities, such as stack-smashing or use-after-free bugs, malicious attackers can corrupt pointers or overwrite return addresses, thereby silently redirecting execution to arbitrary malicious code. RISC-V has recently ratified two ISA extensions to enforce CFI at the hardware level through two complementary primitives. The shadow stack maintains a separate, hardware-protected copy of return addresses, preventing a corrupted call stack from redirecting returns to malicious code. Landing pads require that all valid indirect jumps must land at an explicitly marked location with a special instruction, preventing attackers from redirecting execution to unintended locations.</p><p><br></p><p>In collaboration between the Barcelona Supercomputing Center (BSC) and the SUSHI research team (Inria Rennes), this project aims to implement both CFI extensions on Sargantana, an open-source, Linux-capable, RISC-V core. The mentees will begin by studying the RISC-V CFI specification and the Sargantana microarchitecture, and will then produce an architectural plan of the required pipeline modifications. The mentee will then implement the shadow stack mechanism, including hardware enforcement of shadow stack semantics and access-protection logic. This will be followed by landing pad support, which will involve pipeline enhancements to validate indirect branch targets at commit time. Finally, the mentee will use the Sargantana emulation infrastructure to ensure functional correctness of the implemented extensions and to study the hardware overhead they impose.</p>