48 ms·
> their segmented memory nonsense was also a waste of development time and I'm glad to see them finally acknowledge it. People tend to remember mostly how dif
by Findecanor 3y ago
> their segmented memory nonsense was also a waste of development time and I'm glad to see them finally acknowledge it.
People tend to remember mostly how difficult it was to program with segmentation in 286's 16-bit mode and earlier.
But in 32-bit mode, user-space code didn't need to bother if the OS didn't use it.
I've read several papers lately about schemes with compiler/OS co-design for securing the return pointer on the stack, function pointers and other sensitive variables from hacking attacks.
This problem was already mostly solved on x86-32 where the stack can be in its own segment.
But to get achieve this in 64-bit mode (and on ARM and RISC-V), researchers have resorted to various tricks such as randomising addresses regularly [SafeHidden], switching access to the (safe) stack on and off with Intel MPK, using the Intel shadow-stack (in CET) for storing variables [CETIS], and even running user code in privileged mode [Seimi], [InversOS](ARM) ...
Some of these these schemes are tricks using the CPU in ways it wasn't intended, and therefore perhaps broken on future CPUs. Several are only available on newer Intel processors with certain extensions, and most have considerable run-time overhead. Therefore, you will never see any like it in a mainstream OS. But the x86-32's safe stack would have been, as "Safe Stack" schemes relying on randomisation already got widespread adoption.
[SafeHidden] https://www.semanticscholar.org/paper/SafeHidden%3A-An-Efficient-and-Secure-Information-Wang-Wu/e6315c85d0e83727be327ea04ed3203a5c168530 https://www.semanticscholar.org/paper/SafeHidden%3A-An-Effic...
[CETIS] https://www.semanticscholar.org/paper/CETIS%3A-Retrofitting-Intel-CET-for-Generic-and-Xie-Wu/d1643d2542c360330ff8ca9905008f7f24725f0e https://www.semanticscholar.org/paper/CETIS%3A-Retrofitting-...
[Seimi] https://www.semanticscholar.org/paper/SEIMI%3A-Efficient-and-Secure-SMAP-Enabled-Memory-Wang-Wu/812607001031f55e2245f1d67377c873e331fa1e https://www.semanticscholar.org/paper/SEIMI%3A-Efficient-and...
[InversOS] https://www.semanticscholar.org/paper/InversOS%3A-Efficient-Control-Flow-Protection-for-Shen-Criswell/a29a9856c3fbadcb61be838575a602ffd6e1fdac https://www.semanticscholar.org/paper/InversOS%3A-Efficient-...