Security Mitigations - Revision history

Yellows8 at 05:25, 10 February 2026

2026-02-10T04:25:15Z

← Older revision		Revision as of 07:25, 10 February 2026
Line 8:		Line 8:

	= PAC =		= PAC =
			[S1] Software PAC was implemented for [[Internet_Browser\|web-applets]] in [[11.0.0]], later updated with [[12.1.0]].

	[S2] [[Switch_2:_Tegra_T239\|PAC]] is used for retaddrs on stack.		[S2] [[Switch_2:_Tegra_T239\|PAC]] is used for retaddrs on stack.

Yellows8: /* CFI (Control-Flow-Integrity) */

2026-02-10T04:22:28Z

CFI (Control-Flow-Integrity)

← Older revision		Revision as of 07:22, 10 February 2026
Line 16:		Line 16:

	= CFI (Control-Flow-Integrity) =		= CFI (Control-Flow-Integrity) =
	~~Besides the CFI used by [[Internet_Browser\|web-applets]],~~ S2 sysmodules use ~~a version of~~ CFI which validate vtable-ptrs (the address of the ptr, without accessing the data located there). PAC is not used with this. An undefined-instruction exception is triggered on CFI failure.		S2 sysmodules use CFI which validate vtable-ptrs (the address of the ptr, without accessing the data located there). PAC is not used with this. An undefined-instruction exception is triggered on CFI failure. NOTE: Unknown for funcptrs.

			== nncfi ==
			CFI was implemented for [[Internet_Browser\|web-applets]] in [[11.0.0]].

			The S2 version of nncfi was improved. Now the validation checks for "bti c" or "bti j" (jump-tables/switch-statements) at branch_addr+0, jumping to undefined instruction 0x000080C0+{reg} on failure. This essentially implements software BTI.

			The S1 version didn't have validation for jump-tables.

			Since indirect branches (funcptr/vfunc) now require "bti c", this therefore blocks calling any funcs starting with "bti".

			Since nncfi reads from .text, this can only be used when .text is R-X.

Hexkyz: /* XOM (eXecute-Only-Memory) */

2026-01-19T22:31:12Z

XOM (eXecute-Only-Memory)

← Older revision		Revision as of 01:31, 20 January 2026
Line 13:		Line 13:
	Support for --X was initially added with [19.0.0+], however it's only used on S2.		Support for --X was initially added with [19.0.0+], however it's only used on S2.

	S2 sysmodules have --X .text, starting with [[19.0.0]].		S2 sysmodules have --X .text, starting with [[Switch_2:_19.0.0\|19.0.0]].

	= CFI (Control-Flow-Integrity) =		= CFI (Control-Flow-Integrity) =
	Besides the CFI used by [[Internet_Browser\|web-applets]], S2 sysmodules use a version of CFI which validate vtable-ptrs (the address of the ptr, without accessing the data located there). PAC is not used with this. An undefined-instruction exception is triggered on CFI failure.		Besides the CFI used by [[Internet_Browser\|web-applets]], S2 sysmodules use a version of CFI which validate vtable-ptrs (the address of the ptr, without accessing the data located there). PAC is not used with this. An undefined-instruction exception is triggered on CFI failure.

Hexkyz: /* XOM (eXecute-Only-Memory) */

2026-01-19T22:30:36Z

XOM (eXecute-Only-Memory)

← Older revision		Revision as of 01:30, 20 January 2026
Line 13:		Line 13:
	Support for --X was initially added with [19.0.0+], however it's only used on S2.		Support for --X was initially added with [19.0.0+], however it's only used on S2.

	S2 sysmodules have --X .text, starting with [19.0.0].		S2 sysmodules have --X .text, starting with [[19.0.0]].

	= CFI (Control-Flow-Integrity) =		= CFI (Control-Flow-Integrity) =
	Besides the CFI used by [[Internet_Browser\|web-applets]], S2 sysmodules use a version of CFI which validate vtable-ptrs (the address of the ptr, without accessing the data located there). PAC is not used with this. An undefined-instruction exception is triggered on CFI failure.		Besides the CFI used by [[Internet_Browser\|web-applets]], S2 sysmodules use a version of CFI which validate vtable-ptrs (the address of the ptr, without accessing the data located there). PAC is not used with this. An undefined-instruction exception is triggered on CFI failure.

Hexkyz: Confirmed to be present in 19.0.0

2026-01-19T22:30:21Z

Confirmed to be present in 19.0.0

← Older revision		Revision as of 01:30, 20 January 2026
Line 11:		Line 11:

	= XOM (eXecute-Only-Memory) =		= XOM (eXecute-Only-Memory) =
	Support for --X was initially added with [19.0.0+], however it's only used on S2~~. It's unknown when S2 enabled using this~~.		Support for --X was initially added with [19.0.0+], however it's only used on S2.

	~~Sysmodules~~ have --X .text, ~~at least as of system-version 20~~.x.		S2 sysmodules have --X .text, starting with [19.0.0].

	= CFI (Control-Flow-Integrity) =		= CFI (Control-Flow-Integrity) =
	Besides the CFI used by [[Internet_Browser\|web-applets]], S2 sysmodules use a version of CFI which validate vtable-ptrs (the address of the ptr, without accessing the data located there). PAC is not used with this. An undefined-instruction exception is triggered on CFI failure.		Besides the CFI used by [[Internet_Browser\|web-applets]], S2 sysmodules use a version of CFI which validate vtable-ptrs (the address of the ptr, without accessing the data located there). PAC is not used with this. An undefined-instruction exception is triggered on CFI failure.

Hexkyz: Confirmed to be present on S2 19.0.0+

2026-01-19T20:44:54Z

Confirmed to be present on S2 19.0.0+

← Older revision		Revision as of 23:44, 19 January 2026
Line 17:		Line 17:
	= CFI (Control-Flow-Integrity) =		= CFI (Control-Flow-Integrity) =
	Besides the CFI used by [[Internet_Browser\|web-applets]], S2 sysmodules use a version of CFI which validate vtable-ptrs (the address of the ptr, without accessing the data located there). PAC is not used with this. An undefined-instruction exception is triggered on CFI failure.		Besides the CFI used by [[Internet_Browser\|web-applets]], S2 sysmodules use a version of CFI which validate vtable-ptrs (the address of the ptr, without accessing the data located there). PAC is not used with this. An undefined-instruction exception is triggered on CFI failure.

	~~This is present with sysmodules on system-version 20.x, it's unknown whether 19.0.0 has this.~~

Yellows8 at 17:28, 7 November 2025

2025-11-07T16:28:25Z

← Older revision		Revision as of 19:28, 7 November 2025
Line 16:		Line 16:

	= CFI (Control-Flow-Integrity) =		= CFI (Control-Flow-Integrity) =
	Besides the CFI used by [[Internet_Browser\|web-applets]], S2 sysmodules ~~seem to~~ use a version of CFI which validate vtable-ptrs (the ~~value~~ of the ptr, without accessing the data located there).		Besides the CFI used by [[Internet_Browser\|web-applets]], S2 sysmodules use a version of CFI which validate vtable-ptrs (the address of the ptr, without accessing the data located there). PAC is not used with this. An undefined-instruction exception is triggered on CFI failure.

			This is present with sysmodules on system-version 20.x, it's unknown whether 19.0.0 has this.

Yellows8: Created page with "= ASLR (Address Space Layout Randomization) = ASLR for userspace is supported. KASLR (kernel) was added with 5.0.0. PASLR (physical) was added with 10.0.0. = RelRo = Support for RelRo (read-only-relocations) was added with 17.0.0, binaries built for [17.0.0+] use this. = PAC = [S2] PAC is used for retaddrs on stack. = XOM (eXecute-Only-Memory) = Support for --X was initially added with [19.0.0+], however it's onl..."

2025-11-03T01:16:07Z

Created page with "= ASLR (Address Space Layout Randomization) = ASLR for userspace is supported. KASLR (kernel) was added with 5.0.0. PASLR (physical) was added with 10.0.0. = RelRo = Support for RelRo (read-only-relocations) was added with 17.0.0, binaries built for [17.0.0+] use this. = PAC = [S2] PAC is used for retaddrs on stack. = XOM (eXecute-Only-Memory) = Support for --X was initially added with [19.0.0+], however it's onl..."

New page

= ASLR (Address Space Layout Randomization) =
ASLR for userspace is [[Memory_layout|supported]].

KASLR (kernel) was added with [[5.0.0]]. PASLR (physical) was added with [[10.0.0]].

= RelRo =
Support for RelRo (read-only-relocations) was added with [[17.0.0]], binaries built for [17.0.0+] use this.

= PAC =
[S2] [[Switch_2:_Tegra_T239|PAC]] is used for retaddrs on stack.

= XOM (eXecute-Only-Memory) =
Support for --X was initially added with [19.0.0+], however it's only used on S2. It's unknown when S2 enabled using this.

Sysmodules have --X .text, at least as of system-version 20.x.

= CFI (Control-Flow-Integrity) =
Besides the CFI used by [[Internet_Browser|web-applets]], S2 sysmodules seem to use a version of CFI which validate vtable-ptrs (the value of the ptr, without accessing the data located there).