On 2/1/2021 3:12 PM, Dave Hansen wrote:
On 2/1/21 3:05 PM, Yu, Yu-cheng wrote:
Wait a sec... What about *THIS* series? Will *THIS* series give us
oopses when userspace blasts a new XSAVE buffer in with NT_X86_XSTATE?
Fortunately, CET states are supervisor states. NT_x86_XSTATE has only
user states.
Ahhh, good point. You did mention this in the changelog:
Control-flow Enforcement Technology (CET) introduces these MSRs:
MSR_IA32_U_CET (user-mode CET settings),
MSR_IA32_PL3_SSP (user-mode shadow stack pointer),
MSR_IA32_PL0_SSP (kernel-mode shadow stack pointer),
MSR_IA32_PL1_SSP (Privilege Level 1 shadow stack pointer),
MSR_IA32_PL2_SSP (Privilege Level 2 shadow stack pointer),
MSR_IA32_S_CET (kernel-mode CET settings),
MSR_IA32_INT_SSP_TAB (exception shadow stack table).
The two user-mode MSRs belong to XFEATURE_CET_USER. The first three of
kernel-mode MSRs belong to XFEATURE_CET_KERNEL. Both XSAVES states are
supervisor states.
This is another great place to add some information about the feature.
"Both XSAVES states are supervisor states." ... This means that there
is no direct, unprivileged access to this state, making it harder for an
attacker to subvert CET.
You could also allude to the future ptrace() support here.
I will add that.
