Messages in this thread | | | Date | Sun, 11 Nov 2018 20:02:30 +0100 | From | Pavel Machek <> | Subject | Re: [PATCH v5 04/27] x86/fpu/xstate: Add XSAVES system states for shadow stack |
| |
On Sun 2018-11-11 06:59:24, Andy Lutomirski wrote: > > > > On Nov 11, 2018, at 3:31 AM, Pavel Machek <pavel@ucw.cz> wrote: > > > > Hi! > > > >>> +/* > >>> + * State component 12 is Control flow Enforcement kernel states > >>> + */ > >>> +struct cet_kernel_state { > >>> + u64 kernel_ssp; /* kernel shadow stack */ > >>> + u64 pl1_ssp; /* ring-1 shadow stack */ > >>> + u64 pl2_ssp; /* ring-2 shadow stack */ > >> > >> Just write "privilege level" everywhere - not "ring". > > > > Please just use word "ring". It is well estabilished terminology. > > > > Which ring is priviledge level 1, given that we have SMM and > > virtualization support? > > To the contrary: CPL, DPL, and RPL are very well defined terms in the architecture manuals. “PL” is privilege level. PL 1 is very well defined. >
"Priviledge level" is generic term. "CPL" I may recognize as Intel-specific. "priviledge level" I would not. So I'd really use "ring" there. "CPL 1 shadow stack" would be okay, too I guess.
> SMM is SMM, full stop (unless dual mode or whatever it’s called is on, but AFAIK no one uses it). VMX non-root CPL 1 is *still* privilege level 1. > > In contrast, the security community likes to call SMM “ring -1”, which is cute, but wrong from a systems programmer view. For example, SMM’s CPL can still range from 0-3. >
Regards, Pavel -- (english) http://www.livejournal.com/~pavelmachek (cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html [unhandled content-type:application/pgp-signature] | |