Security Mitigations: Difference between revisions
Created page with "= ASLR (Address Space Layout Randomization) = ASLR for userspace is supported. KASLR (kernel) was added with 5.0.0. PASLR (physical) was added with 10.0.0. = RelRo = Support for RelRo (read-only-relocations) was added with 17.0.0, binaries built for [17.0.0+] use this. = PAC = [S2] PAC is used for retaddrs on stack. = XOM (eXecute-Only-Memory) = Support for --X was initially added with [19.0.0+], however it's onl..." |
|||
| (8 intermediate revisions by 3 users not shown) | |||
| Line 8: | Line 8: | ||
= PAC = | = PAC = | ||
[S2] [[Switch_2:_Tegra_T239|PAC]] is used for | [S1] Software PAC based on mul+crc32x was implemented for [[Internet_Browser|web-applets]] in [[11.0.0]], later updated with [[12.1.0]]. See [[11.0.0#Web-applets|here]] for the algorithm. | ||
[S2] [[Switch_2:_Tegra_T239|PAC]] is used for return-addresses on stack for games, applets and sysmodules. S1 compatibility processes have PAC enabled on S2 but S1 game binaries are compiled without PAC. | |||
Starting with 21.0.0, S2 applets have PAC on vtable-pointers and function-pointers. | |||
= XOM (eXecute-Only-Memory) = | = XOM (eXecute-Only-Memory) = | ||
Support for --X was initially added with [19.0.0+], however it's only used on S2 | Support for --X was initially added with [19.0.0+], however it's only used on S2. | ||
S2 sysmodules have --X .text, starting with [[Switch_2:_19.0.0|19.0.0]]. | |||
= CFI (Control-Flow-Integrity) = | = CFI (Control-Flow-Integrity) = | ||
S2 sysmodules use CFI which validate vtable-ptrs (the address of the ptr, without accessing the data located there). PAC is not used with this. An undefined-instruction exception is triggered on CFI failure. NOTE: Unknown how function pointers are handled. | |||
== nncfi == | |||
[S1] Forward-edge CFI was implemented for [[Internet_Browser|web-applets]] in [[11.0.0]]. | |||
[S2] Nncfi was improved. Now the validation checks for "bti c" or "bti j" (jump-tables/switch-statements) at branch_addr+0, jumping to undefined instruction 0x000080C0+{reg} on failure. This essentially implements software BTI. The S1 version didn't have validation for jump-tables. | |||
Since indirect branches (funcptr/vfunc) now require "bti c", this therefore blocks calling any funcs starting with "bti". | |||
Since nncfi reads from .text, this can only be used when .text is R-X. | |||
Latest revision as of 21:36, 19 July 2026
ASLR (Address Space Layout Randomization)
ASLR for userspace is supported.
KASLR (kernel) was added with 5.0.0. PASLR (physical) was added with 10.0.0.
RelRo
Support for RelRo (read-only-relocations) was added with 17.0.0, binaries built for [17.0.0+] use this.
PAC
[S1] Software PAC based on mul+crc32x was implemented for web-applets in 11.0.0, later updated with 12.1.0. See here for the algorithm.
[S2] PAC is used for return-addresses on stack for games, applets and sysmodules. S1 compatibility processes have PAC enabled on S2 but S1 game binaries are compiled without PAC.
Starting with 21.0.0, S2 applets have PAC on vtable-pointers and function-pointers.
XOM (eXecute-Only-Memory)
Support for --X was initially added with [19.0.0+], however it's only used on S2.
S2 sysmodules have --X .text, starting with 19.0.0.
CFI (Control-Flow-Integrity)
S2 sysmodules use CFI which validate vtable-ptrs (the address of the ptr, without accessing the data located there). PAC is not used with this. An undefined-instruction exception is triggered on CFI failure. NOTE: Unknown how function pointers are handled.
nncfi
[S1] Forward-edge CFI was implemented for web-applets in 11.0.0.
[S2] Nncfi was improved. Now the validation checks for "bti c" or "bti j" (jump-tables/switch-statements) at branch_addr+0, jumping to undefined instruction 0x000080C0+{reg} on failure. This essentially implements software BTI. The S1 version didn't have validation for jump-tables.
Since indirect branches (funcptr/vfunc) now require "bti c", this therefore blocks calling any funcs starting with "bti".
Since nncfi reads from .text, this can only be used when .text is R-X.