MMU ↔ PAN: Does PAN alone prevent accidental public access to user memory?

MMU ↔ PAN Integration

In AArch64, the MMU enforces address‑space separation via page tables, while the Privileged Access Never (PAN) bit in the PSTATE_EL1 register aims to block kernel accidental reads of user‑space memory. PAN is only present on ARMv8.1‑A and newer cores, and its effectiveness depends on correct configuration of the PXN bits in each page table entry.

Unresolved Behavior

Although PAN is intended to be a hardware guardrail, the interaction between PAN, PXN, and the Memory Tagging Extension (MTE) is not fully documented across silicon variants. In some implementations, a PAN‑enabled kernel can still trigger a data abort if a PXN bit is mis‑set, while MTE may introduce additional aborts or performance penalties that could mask PAN’s effect.

Given this ambiguity, system designers are unsure whether PAN alone is sufficient or whether explicit PXN enforcement or MTE configuration is required to guarantee isolation.

Questions:

• Can PAN alone guarantee that a kernel cannot read user‑space memory, or must PXN bits be set on every page table entry?
• How does MTE affect the reliability of PAN in preventing accidental public access?