Skip to main content

Milestone 6

Milestone 6 Status​

This milestone is planned.

Background​

Landing Pads are used to implement forward-edge control-flow integrity.  This is a security mechanism that helps prevent attackers from redirecting program execution to unintended locations by ensuring that indirect calls and jumps only target designated "landing pad" instructions. 

Compilers emit a landing pad instruction as the first instruction of an address-taken function, as well as at any indirect jump targets. A landing pad instruction is not required in functions that are only reached using a direct call or direct jump.

The landing pad is designed to provide integrity to control transfers performed using indirect calls and jumps, and this is referred to as forward-edge protection.   On RISC-V using the Zicfilp ISA extension, the CPU tracks an expected landing pad (ELP) state that is updated by an indirect_call or indirect_jump to require a landing pad instruction at the target of the branch. If the instruction at the target is not a landing pad, then a software-check exception is raised.

Milestone Description​

Milestone 6 implements forward-edge control-flow integrity for OP-TEE core and trusted applications using RISC-V landing pads based on the design from Milestone 5.

Requirements​

  • Use the RISC-V Zicfilp extension.
  • Enable landing pads for OP-TEE core and trusted applications through an OP-TEE configuration option.
  • Support both GCC and LLVM/Clang.
  • Ensure address-taken functions and indirect-jump targets contain appropriate landing-pad instructions.
  • Manage expected-landing-pad state correctly across exceptions and context switches.
  • Raise the expected software-check exception when an indirect control transfer reaches an invalid target.
  • Document RISC-V landing-pad support in optee_doc.
  • Add optee_test coverage for OP-TEE core and trusted applications.

Deliverables​

  • OP-TEE core changes for hardware landing-pad support when OP-TEE is compiled with that support.
  • Trusted-application changes for hardware landing-pad support when a trusted application is compiled with that support.
  • Validation coverage and user-facing documentation.