2 ms·
There was a paper on this topic last year (different authors AFAICT): https://arxiv.org/abs/2211.16212 https://arxiv.org/abs/2211.16212 Also an earlier attempt
by rwmj 4y ago
There was a paper on this topic last year (different authors AFAICT): https://arxiv.org/abs/2211.16212 https://arxiv.org/abs/2211.16212 Also an earlier attempt to fix it with a custom RISC-V extension: https://ieeexplore.ieee.org/document/8714980 https://ieeexplore.ieee.org/document/8714980 which was implemented in an FPGA.
It seems like the consensus is this problem (on all architectures) is going to be solved in software, not hardware. Clang has a pretty comprehensive software-only approach already, although it needs porting to each architecture.
- wahern 4y ago> It seems like the consensus is this problem (on all architectures) is going to be solved in software, not hardware. Hardware-based shadow stacks and return address signing are already shipping and running on x86-64 and arm64 systems, respectively. Rolling these out required upgrades to compilation and runtime software environments, and there are other software-based CFI techniques that augment these facilities, but it's already clear that hardware primitives are an integral part of the solution. And it couldn't be otherwise. Between JIT, dynamically loadable modules, and a host of other complexities on real systems, software-only solutions that depend on exhaustive static analysis for robust CFI have little chance of comprehensively closing all the loopholes, especially in the environments that matter most.
- brucehoult 4y agoQuite a lot of detailed design work has already been done on this for RISC-V. It is currently expected to be ratified in Q3 this year. https://github.com/riscv/riscv-cfi/raw/main/riscv-cfi.pdf https://github.com/riscv/riscv-cfi/raw/main/riscv-cfi.pdf