Re: [PATCH v18 05/25] x86/fpu/xstate: Introduce CET MSR and XSAVES supervisor states

Yu, Yu-cheng
2021-02-01T23:15:31Z

On 2/1/2021 3:12 PM, Dave Hansen wrote:
> On 2/1/21 3:05 PM, Yu, Yu-cheng wrote:
>>>>
>>>
>>> Wait a sec...  What about *THIS* series?  Will *THIS* series give us
>>> oopses when userspace blasts a new XSAVE buffer in with NT_X86_XSTATE?
>>>
>>
>> Fortunately, CET states are supervisor states.  NT_x86_XSTATE has only
>> user states.
>
> Ahhh, good point. You did mention this in the changelog:
>
>> Control-flow Enforcement Technology (CET) introduces these MSRs:
>>
>> MSR_IA32_U_CET (user-mode CET settings),
>> MSR_IA32_PL3_SSP (user-mode shadow stack pointer),
>>
>> MSR_IA32_PL0_SSP (kernel-mode shadow stack pointer),
>> MSR_IA32_PL1_SSP (Privilege Level 1 shadow stack pointer),
>> MSR_IA32_PL2_SSP (Privilege Level 2 shadow stack pointer),
>> MSR_IA32_S_CET (kernel-mode CET settings),
>> MSR_IA32_INT_SSP_TAB (exception shadow stack table).
>>
>> The two user-mode MSRs belong to XFEATURE_CET_USER. The first three of
>> kernel-mode MSRs belong to XFEATURE_CET_KERNEL. Both XSAVES states are
>> supervisor states.
>
> This is another great place to add some information about the feature.
>
> "Both XSAVES states are supervisor states." ... This means that there
> is no direct, unprivileged access to this state, making it harder for an
> attacker to subvert CET.
>
> You could also allude to the future ptrace() support here.
>

I will add that.