Control Flow Integrity on RISC-V Linux

CFI motivation on RISC-V

Security engineer "debug" from Revos describes bringing control-flow integrity to RISC-V Linux for data-center workloads. Drawing on prior work at AWS, Intel (including CET-related ISA work), and McAfee, he explains how memory corruption enables attackers to hijack indirect control-flow transfers.

Software and hardware precedents

Existing mitigations include LLVM CFI, SafeStack, Microsoft Control Flow Guard, and x86 CET shadow stacks that validate return addresses. RISC-V lacks identical hardware features, so the Linux community must adapt CFI concepts to RISC-V instruction formats and calling conventions.

RISC-V-specific challenges

RISC-V's variable-length encodings and 20-bit immediate limits in J-type branches constrain how jump targets are encoded. Features like AUIPC enable PC-relative addressing across roughly ±2 GB, affecting how forward-edge and backward-edge protections can be implemented in kernel and userspace code.