Linux To Begin Tightening Up Ability To Write To CPU MSRs From User-Space
Written by Michael Larabel in Linux Kernel on 25 June 2020 at 08:35 AM EDT. 17 Comments
LINUX KERNEL --
The Linux 5.9 kernel is slated to begin introducing new restrictions on allowing writes to CPU model specific registers (MSRs) from user-space.

Via the Linux kernel x86 MSR driver, writes to arbitrary model specific registers from user-space is allowed -- assuming you have root permissions. But even with requiring root access, there are security implications and other issues in allowing any CPU MSRs to be written to from user-space without the intervention of the kernel via /dev/cpu/[CPU-number]/msr.

SUSE's Borislav Petkov has added support to the x86 MSR driver to begin filtering of MSR writes. Petkov reinforced with the commit, "Having unfettered access to all MSRs on a system is and has always been a disaster waiting to happen. Think performance counter MSRs, MSRs with sticky or locked bits, MSRs making major system changes like loading microcode, MTRRs, PAT configuration, TSC counter, security mitigations MSRs, you name it. This also destroys all the kernel's caching of MSR values for performance, as the recent case with MSR_AMD64_LS_CFG showed. Another example is writing MSRs by mistake by simply typing the wrong MSR address. System freezes have been experienced that way. In general, poking at MSRs under the kernel's feet is a bad bad idea."

The new default behavior starting with Linux 5.9 will be to log messages to dmesg whenever a MSR write from user-space happens with a "write to unrecognized MSR" notification.

But this MSR filtering infrastructure also adds the ability to block MSR writes from user-space. Ultimately they will likely transition to that as the default at a later time to ensure MSR writes from user-space do not happen. This behavior right now can be toggled via the msr.allow_writes= kernel module paramrter with on/off/default. Should legitimate use-cases come up where writes to MSRs from user-space are still desired, they may add the infrastructure to selectively grant/deny access to specific MSRs and ensure they are sanitized by the kernel.
Related News
About The Author
Author picture

Michael Larabel is the principal author of Phoronix.com and founded the site in 2004 with a focus on enriching the Linux hardware experience. Michael has written more than 20,000 articles covering the state of Linux hardware support, Linux performance, graphics drivers, and other topics. Michael is also the lead developer of the Phoronix Test Suite, Phoromatic, and OpenBenchmarking.org automated benchmarking software. He can be followed via Twitter or contacted via MichaelLarabel.com.

Popular News This Week

çeviri malatya oto kiralama parça eşya taşıma şehirler arası nakliyat şehirlerarası evden eve nakliyat istanbul bursa şehirler arası nakliyat malatya oto kiralama istanbul evden eve nakliyat ofis taşıma ofis taşımacılığı evden eve nakliyat evden eve nakliyat büyü aşk büyüsü ayırma büyüsü medyum medyum şikayetleri medyum yorumları büyü aşk büyüsü bağlama büyüsü dua aşk duası aşk büyüsü büyü aşk büyüsü bağlama büyüsü medyum dolunay medyum aşk büyüsü medyum medyum şikayetleri medyum yorumları metal galvanizli sac paslanmaz sac metal hrp sac paslanmaz çelik mekjoy.com seo seo kursu sex shop istanbul sex shop ataşehir sex shop İstanbul evden eve nakliyat eşya depolama eşya depolama viagra fiyatı cialis fiyat b374k shell