Not knowing anything about ARM, I didn't get how this bit is supposed to work: We enforce this rule by restricting the sorts of operations that progra

Not knowing anything about ARM, I didn't get how this bit is supposed to work: We enforce this rule by restricting the sorts of operations that programs can use to alter sp. Programs can alter sp by adding or subtracting an immediate, as a side-effect of a load or store: ldr rX, [sp], #4! ; loads from stack, then adds 4 to sp These are safe because, as we mentioned before, the largest immediate available in a load or store is ±4095. Even after adding or subtracting 4095, the stack pointer will still be within the sandbox or guard regions. I get the idea of the guard protecting against the biggest immediate offset, but what stops me doing an SP-updating LDR with a big offset multiple times, pushing SP beyond my "safe" memory segment? EDIT: I guess I might be taking: Any other operation that alters sp must be followed by a guard instruction. too precisely, and you could just follow every ldr which writes back SP with a BIC too. Maybe I'm missing the point. EDIT2: Wait, wait, I get it now. Once the stack pointer is in the guard area, the CPU faults if you do another LDR. Don't mind me!