Re: [RFC] Circumventing FineIBT Via Entrypoints

2025-03-02 Thread Andrew Cooper
On 02/03/2025 7:16 pm, Rudolf Marek wrote: > Dne 01. 03. 25 v 23:48 Rudolf Marek napsal(a): >> I don't know how slow is to do the jump back via far jump. > > I did some micro benchmark on Raptorlake platform using other > operating system I'm very familiar with. > > I added following sequence to th

Re: [RFC] Circumventing FineIBT Via Entrypoints

2025-02-26 Thread Andrew Cooper
On 26/02/2025 10:48 pm, Rudolf Marek wrote: > Hi Andrew, > > Dne 25. 02. 25 v 22:14 Andrew Cooper napsal(a): >> As stand-in for "the reader", I'll point out that you need to add #DB to >> that list or you're in for a rude surprise when running the x86 >&

Re: [RFC] Circumventing FineIBT Via Entrypoints

2025-02-25 Thread Andrew Cooper
On 25/02/2025 8:06 pm, Rudolf Marek wrote: > Hi Andrew, > > Dne 25. 02. 25 v 19:10 Andrew Cooper napsal(a): >> Very cunning.  Yes it does, but the state needs to be safe to IRET back >> to, and ... > > ... And intellectually very pleasing! > >>> Would it work

Re: [RFC] Circumventing FineIBT Via Entrypoints

2025-02-25 Thread Andrew Cooper
On 22/02/2025 8:43 pm, Rudolf Marek wrote: > Hi, > > Dne 13. 02. 25 v 3:42 Andrew Cooper napsal(a): >> The SYSCALL behaviour TLDR is: >> >> %rcx = %rip >> %r11 = %eflags >> %cs = fixed attr >> %ss = fixed attr >> %rip =

Re: [RFC] Circumventing FineIBT Via Entrypoints

2025-02-14 Thread Andrew Cooper
On 15/02/2025 12:07 am, Jennifer Miller wrote: > On Fri, Feb 14, 2025 at 11:06:50PM +0000, Andrew Cooper wrote: >> On 13/02/2025 11:24 pm, Jennifer Miller wrote: >>> On Thu, Feb 13, 2025 at 09:24:18PM +0000, Andrew Cooper wrote: >>> Still, I hadn't considered mis

Re: [RFC] Circumventing FineIBT Via Entrypoints

2025-02-14 Thread Andrew Cooper
On 13/02/2025 11:24 pm, Jennifer Miller wrote: > On Thu, Feb 13, 2025 at 09:24:18PM +0000, Andrew Cooper wrote: >>>> ; swap stacks as normal >>>> movQWORD PTR gs:[rip+0x7f005f85],rsp # 0x6014 >>>> movrsp,QWORD PTR gs:[rip+0x7f02c56d]

Re: [PATCH] x86/kcfi: Require FRED for FineIBT

2025-02-14 Thread Andrew Cooper
On 14/02/2025 9:54 pm, Kees Cook wrote: > On Fri, Feb 14, 2025 at 07:39:20PM +0000, Andrew Cooper wrote: >> On 14/02/2025 7:22 pm, Kees Cook wrote: >>> diff --git a/arch/x86/include/asm/cfi.h b/arch/x86/include/asm/cfi.h >>> index ef5e0a698253..dfa2ba4cceca 100644 >

Re: [PATCH] x86/kcfi: Require FRED for FineIBT

2025-02-14 Thread Andrew Cooper
On 14/02/2025 7:22 pm, Kees Cook wrote: > diff --git a/arch/x86/include/asm/cfi.h b/arch/x86/include/asm/cfi.h > index ef5e0a698253..dfa2ba4cceca 100644 > --- a/arch/x86/include/asm/cfi.h > +++ b/arch/x86/include/asm/cfi.h > @@ -93,7 +93,7 @@ > * > */ > enum cfi_mode { > - CFI_AUTO,

Re: [RFC] Circumventing FineIBT Via Entrypoints

2025-02-13 Thread Andrew Cooper
On 13/02/2025 7:23 pm, Jann Horn wrote: > On Thu, Feb 13, 2025 at 7:15 AM Jennifer Miller wrote: >> Here is some napkin asm for this I wrote for the 64-bit syscall entrypoint, >> I think more or less the same could be done for the other entrypoints. >> >> ``` >> endbr64 >> test rsp, rsp >>

Re: [RFC] Circumventing FineIBT Via Entrypoints

2025-02-13 Thread Andrew Cooper
On 13/02/2025 8:28 pm, Kees Cook wrote: > On Thu, Feb 13, 2025 at 01:31:30AM +0000, Andrew Cooper wrote: >>>> Assuming this is an issue you all feel is worth addressing, I will >>>> continue working on providing a patch. I'm concerned though that the >>&

Re: [RFC] Circumventing FineIBT Via Entrypoints

2025-02-12 Thread Andrew Cooper
On 13/02/2025 2:09 am, Jann Horn wrote: > On Thu, Feb 13, 2025 at 2:31 AM Andrew Cooper > wrote: >>>> Assuming this is an issue you all feel is worth addressing, I will >>>> continue working on providing a patch. I'm concerned though that the >>>&g

Re: [RFC] Circumventing FineIBT Via Entrypoints

2025-02-12 Thread Andrew Cooper
>> Assuming this is an issue you all feel is worth addressing, I will >> continue working on providing a patch. I'm concerned though that the >> overhead from adding a wrmsr on both syscall entry and exit to >> overwrite and restore the KERNEL_GS_BASE MSR may be quite high, so >> any feedback in re

Re: [PATCH] x86/traps: Enable UBSAN traps on x86

2024-05-29 Thread Andrew Cooper
On 29/05/2024 3:20 am, Gatlin Newhouse wrote: > diff --git a/arch/x86/include/asm/bug.h b/arch/x86/include/asm/bug.h > index a3ec87d198ac..e3fbed9073f8 100644 > --- a/arch/x86/include/asm/bug.h > +++ b/arch/x86/include/asm/bug.h > @@ -13,6 +13,14 @@ > #define INSN_UD2 0x0b0f > #define LEN_UD2