Re: [RFC] Circumventing FineIBT Via Entrypoints

2025-03-02 Thread Rudolf Marek
Dne 01. 03. 25 v 23:48 Rudolf Marek napsal(a): I don't know how slow is to do the jump back via far jump. I did some micro benchmark on Raptorlake platform using other operating system I'm very familiar with. I added following sequence to the SYSCALL64 entrypoint: .balign 16 sysc

Re: [RFC] Circumventing FineIBT Via Entrypoints

2025-03-01 Thread Rudolf Marek
Hi Andrew, Dne 27. 02. 25 v 1:41 Andrew Cooper napsal(a): For SYSCALL/SYSENTER it's a little more complicated.  I think you want to move the selectors so they don't alias __KERN_CS directly, so you can then move back to __KERN_CS in a similar way Yes I thought the CHECK_CS could be right befor

Re: [RFC] Circumventing FineIBT Via Entrypoints

2025-02-26 Thread Rudolf Marek
Hi Andrew, Dne 25. 02. 25 v 22:14 Andrew Cooper napsal(a): As stand-in for "the reader", I'll point out that you need to add #DB to that list or you're in for a rude surprise when running the x86 selftests. Thanks for pointing this out. I forgot about the interrupt shadow on SYSCALL and possib

Re: [RFC] Circumventing FineIBT Via Entrypoints

2025-02-25 Thread Rudolf Marek
Hi Andrew, Dne 25. 02. 25 v 19:10 Andrew Cooper napsal(a): Very cunning.  Yes it does, but the state needs to be safe to IRET back to, and ... ... And intellectually very pleasing! Would it work to have KERNEL_CS as last entry in the GDT table? Therefore executing SYSCALL would set the CS as

Re: [RFC] Circumventing FineIBT Via Entrypoints

2025-02-22 Thread Rudolf Marek
Hi, Dne 13. 02. 25 v 3:42 Andrew Cooper napsal(a): The SYSCALL behaviour TLDR is:     %rcx = %rip     %r11 = %eflags     %cs = fixed attr     %ss = fixed attr     %rip = MSR_LSTAR which means that %rcx (old rip) is the only piece of state which userspace can't feasibly forge (and therefor