This topic can be extended so that it can be worked on as a topic for a Master's thesis.

Shadow stacks are a state of the art means to detect return address corruption. A copy of each return address is placed onto a separate shadow stack. Before a function returns, the return address is compared with its copy to ensure it was not altered. Parallel shadow stacks are a variation that does not use a dedicated shadow stack pointer. Instead it keeps the layout of the main stack and uses the regular stack pointer and a fixed offset to reach the shadow stack. While this results in a fast and simple implementation, it is not very memory efficient. Some architectures, in this specific case the Xtensa architecture, have a specific alignment for their stack frames which makes possible positions for return addresses predictable. Carefully adjusting the start positions of such shadow stacks makes it possible to increase the memory usage by placing them in the same memory area, or intertwining them.

This brings new challenges to a memory allocator for such intertwined parallel shadow stacks as a chunk of memory may only be partially used by a shadow stack and may still be free for another one. Typically, dynamic memory is managed using an in-place list of free chunks. The student needs to adapt this concept to account for the special memory structure of intertwined parallel shadow stacks. Additionally, it should be possible to configure the memory allocator the be used in different scenarios, such as a shadow stack that only stores return addresses, or one that also stores stack pointers and therefore allows less intertwining.

Supervisor: Kai Lehniger M.Sc. (lehniger@ihp-microelectronics.com)