Skip to main content

Milestone 5

Milestone 5 Status​

This milestone is planned.

Background​

Landing Pads are used to implement forward-edge control-flow integrity.  This is a security mechanism that helps prevent attackers from redirecting program execution to unintended locations by ensuring that indirect calls and jumps only target designated "landing pad" instructions. 

Compilers emit a landing pad instruction as the first instruction of an address-taken function, as well as at any indirect jump targets. A landing pad instruction is not required in functions that are only reached using a direct call or direct jump.

The landing pad is designed to provide integrity to control transfers performed using indirect calls and jumps, and this is referred to as forward-edge protection.   On RISC-V using the Zicfilp ISA extension, the CPU tracks an expected landing pad (ELP) state that is updated by an indirect_call or indirect_jump to require a landing pad instruction at the target of the branch. If the instruction at the target is not a landing pad, then a software-check exception is raised.

Milestone Description​

Milestone 5 defines the design for adding RISC-V hardware landing-pad support to OP-TEE core and trusted applications.

Requirements​

  • Base the feature on the RISC-V Zicfilp ISA extension.
  • Cover both OP-TEE core and trusted applications.
  • Define configuration-controlled enablement for GCC and LLVM/Clang.
  • Account for expected-landing-pad state across OP-TEE exception and context-switch paths.
  • Define validation using both compiler families.
  • Define optee_test procedures that verify indirect branches accept designated landing pads and reject invalid targets.
  • Define the required optee_doc documentation.

Deliverables​

  • An RFC describing the proposed OP-TEE landing-pad architecture, implementation plan, and validation strategy.
  • Circulation of the RFC to the RISE security working group and the OP-TEE upstream community for review.