4 ms·
Execute-only memory on ARM is a footgun (bypasses PAN); Linux and macOS both block it. OpenBSD probably should too.
by saagarjha 2y ago
Execute-only memory on ARM is a footgun (bypasses PAN); Linux and macOS both block it. OpenBSD probably should too.
- brynet 2y agoWhy? OpenBSD seems to think execute-only in userland is important. We've had SMAP on x86 for many years, it helped fixed bugs early, these bugs are rare now, so why is everyone concerned about kernel accesses that aren't using copyin(9)? EPAN is already supported, hardware is now arriving, it's used if available, but the idea that execute-only was less important than PAN was probably misguided.
- saagarjha 2y agoIf you have EAN feel free to turn it back on but I generally believe that execute-only is less important than PAN, yes.
- crest 2y agoHow does execute only memory disable privileged access never memory? The bigger problem I expect is the overhead of loosing PC-relative loads unless the hardware still allows these as instruction fetching related? Would you have to dedicated one of your 31 GPRs as the table of contents pointer similar to PowerPC’s ABI (e.g. sizeof(void()(void)) == 2sizeof(void *))?
- saagarjha 2y agohttps://blog.siguza.net/PAN/ https://blog.siguza.net/PAN/ has a nice summary of the PAN issue. Also, you can't load data under execute-only but you can execute it (e.g. by jumping there). If you are compiling under this scheme you need to tell your compiler that this is the case.