On 2/1/21 3:05 PM, Yu, Yu-cheng wrote: >>> >> >> Wait a sec... What about *THIS* series? Will *THIS* series give us >> oopses when userspace blasts a new XSAVE buffer in with NT_X86_XSTATE? >> > > Fortunately, CET states are supervisor states. NT_x86_XSTATE has only > user states. Ahhh, good point. You did mention this in the changelog: > Control-flow Enforcement Technology (CET) introduces these MSRs: > > MSR_IA32_U_CET (user-mode CET settings), > MSR_IA32_PL3_SSP (user-mode shadow stack pointer), > > MSR_IA32_PL0_SSP (kernel-mode shadow stack pointer), > MSR_IA32_PL1_SSP (Privilege Level 1 shadow stack pointer), > MSR_IA32_PL2_SSP (Privilege Level 2 shadow stack pointer), > MSR_IA32_S_CET (kernel-mode CET settings), > MSR_IA32_INT_SSP_TAB (exception shadow stack table). > > The two user-mode MSRs belong to XFEATURE_CET_USER. The first three of > kernel-mode MSRs belong to XFEATURE_CET_KERNEL. Both XSAVES states are > supervisor states. This is another great place to add some information about the feature. "Both XSAVES states are supervisor states." ... This means that there is no direct, unprivileged access to this state, making it harder for an attacker to subvert CET. You could also allude to the future ptrace() support here.
