Security Mitigations: Difference between revisions

(2 intermediate revisions by 2 users not shown)

Line 8:

= PAC =

[S2] [[Switch_2:_Tegra_T239|PAC]] is used for ~~retaddrs~~ on stack.

[S1] Software PAC based on mul+crc32x was implemented for [[Internet_Browser|web-applets]] in [[11.0.0]], later updated with [[12.1.0]]. See [[11.0.0#Web-applets|here]] for the algorithm.

[S2] [[Switch_2:_Tegra_T239|PAC]] is used for return-addresses on stack for games, applets and sysmodules. S1 compatibility processes have PAC enabled on S2 but S1 game binaries are compiled without PAC.

Starting with 21.0.0, S2 applets have PAC on vtable-pointers and function-pointers.

= XOM (eXecute-Only-Memory) =

Line 16:

Line 20:

= CFI (Control-Flow-Integrity) =

S2 sysmodules use CFI which validate vtable-ptrs (the address of the ptr, without accessing the data located there). PAC is not used with this. An undefined-instruction exception is triggered on CFI failure. NOTE: Unknown ~~for funcptrs~~.

S2 sysmodules use CFI which validate vtable-ptrs (the address of the ptr, without accessing the data located there). PAC is not used with this. An undefined-instruction exception is triggered on CFI failure. NOTE: Unknown how function pointers are handled.

== nncfi ==

CFI was implemented for [[Internet_Browser|web-applets]] in [[11.0.0]].

[S1] Forward-edge CFI was implemented for [[Internet_Browser|web-applets]] in [[11.0.0]].

The S2 version of nncfi was improved. Now the validation checks for "bti c" or "bti j" (jump-tables/switch-statements) at branch_addr+0, jumping to undefined instruction 0x000080C0+{reg} on failure. This essentially implements software BTI.

The S1 version didn't have validation for jump-tables.

[S2] Nncfi was improved. Now the validation checks for "bti c" or "bti j" (jump-tables/switch-statements) at branch_addr+0, jumping to undefined instruction 0x000080C0+{reg} on failure. This essentially implements software BTI. The S1 version didn't have validation for jump-tables.

Since indirect branches (funcptr/vfunc) now require "bti c", this therefore blocks calling any funcs starting with "bti".

Since nncfi reads from .text, this can only be used when .text is R-X.

@@ Line 8: / Line 8: @@
 = PAC =
-[S2] [[Switch_2:_Tegra_T239|PAC]] is used for retaddrs on stack.
+[S1] Software PAC based on mul+crc32x was implemented for [[Internet_Browser|web-applets]] in [[11.0.0]], later updated with [[12.1.0]]. See [[11.0.0#Web-applets|here]] for the algorithm.
+[S2] [[Switch_2:_Tegra_T239|PAC]] is used for return-addresses on stack for games, applets and sysmodules. S1 compatibility processes have PAC enabled on S2 but S1 game binaries are compiled without PAC.
+Starting with 21.0.0, S2 applets have PAC on vtable-pointers and function-pointers.
 = XOM (eXecute-Only-Memory) =
@@ Line 16: / Line 20: @@
 = CFI (Control-Flow-Integrity) =
-S2 sysmodules use CFI which validate vtable-ptrs (the address of the ptr, without accessing the data located there). PAC is not used with this. An undefined-instruction exception is triggered on CFI failure. NOTE: Unknown for funcptrs.
+S2 sysmodules use CFI which validate vtable-ptrs (the address of the ptr, without accessing the data located there). PAC is not used with this. An undefined-instruction exception is triggered on CFI failure. NOTE: Unknown how function pointers are handled.
 == nncfi ==
-CFI was implemented for [[Internet_Browser|web-applets]] in [[11.0.0]].
+[S1] Forward-edge CFI was implemented for [[Internet_Browser|web-applets]] in [[11.0.0]].
-The S2 version of nncfi was improved. Now the validation checks for "bti c" or "bti j" (jump-tables/switch-statements) at branch_addr+0, jumping to undefined instruction 0x000080C0+{reg} on failure. This essentially implements software BTI.
-The S1 version didn't have validation for jump-tables.
+[S2] Nncfi was improved. Now the validation checks for "bti c" or "bti j" (jump-tables/switch-statements) at branch_addr+0, jumping to undefined instruction 0x000080C0+{reg} on failure. This essentially implements software BTI. The S1 version didn't have validation for jump-tables.
 Since indirect branches (funcptr/vfunc) now require "bti c", this therefore blocks calling any funcs starting with "bti".
 Since nncfi reads from .text, this can only be used when .text is R-X.