On Fri, Feb 14, 2025 at 12:24 AM Jennifer Miller <jm...@asu.edu> wrote: > On Thu, Feb 13, 2025 at 09:24:18PM +0000, Andrew Cooper wrote: > > On 13/02/2025 7:23 pm, Jann Horn wrote: > > > How would we actually do that overwriting and restoring of > > > KERNEL_GS_BASE? Would we need a scratch register for that? > > > > I think we can do the overwrite at any point before actually calling into > the individual syscall handlers, really anywhere before potentially > hijacked indirect control flow can occur and then restore it just after > those return e.g., for the 64-bit path I am currently overwriting it at the > start of do_syscall_64 and then restoring it just before > syscall_exit_to_user_mode. I'm not sure if there is any reason to do it > sooner while we'd still be register constrained.
Right, makes sense - sorry, I misremembered the details of the KERNEL_GS_BASE overwrite proposal, I had to re-read your first mail.
