Linux to Begin Tightening Up Ability to Write to CPU MSRs from User-Space

栏目: IT技术 · 发布时间: 4年前

Linux To Begin Tightening Up Ability To Write To CPU MSRs From User-Space

Written byMichael Larabel inLinux Kernel on 25 June 2020 at 08:35 AM EDT.1 Comment

Linux to Begin Tightening Up Ability to Write to CPU MSRs from User-Space

The Linux 5.9 kernel is slated to begin introducing new restrictions on allowing writes to CPU model specific registers (MSRs) from user-space.

Via the Linux kernel x86 MSR driver, writes to arbitrary model specific registers from user-space is allowed -- assuming you have root permissions. But even with requiring root access, there are security implications and other issues in allowing any CPU MSRs to be written to from user-space without the intervention of the kernel via /dev/cpu/[CPU-number]/msr .

SUSE's Borislav Petkov has added support to the x86 MSR driver to begin filtering of MSR writes. Petkov reinforced, " Having unfettered access to all MSRs on a system is and has always been a disaster waiting to happen. Think performance counter MSRs, MSRs with sticky or locked bits, MSRs making major system changes like loading microcode, MTRRs, PAT configuration, TSC counter, security mitigations MSRs, you name it. This also destroys all the kernel's caching of MSR values for performance, as the recent case with MSR_AMD64_LS_CFG showed. Another example is writing MSRs by mistake by simply typing the wrong MSR address. System freezes have been experienced that way. In general, poking at MSRs under the kernel's feet is a bad bad idea. "

The new default behavior starting with Linux 5.9 will be to log messages to dmesg whenever a MSR write from user-space happens with a "write to unrecognized MSR" notification.

But this MSR filtering infrastructure also adds the ability to block MSR writes from user-space. Ultimately they will likely transition to that as the default at a later time to ensure MSR writes from user-space do not happen. This behavior right now can be toggled via the msr.allow_writes= kernel module paramrter with on/off/default. Should legitimate use-cases come up where writes to MSRs from user-space are still desired, they may add the infrastructure to selectively grant/deny access to specific MSRs and ensure they are sanitized by the kernel.

1 Comment


以上就是本文的全部内容,希望对大家的学习有所帮助,也希望大家多多支持 码农网

查看所有标签

猜你喜欢:

本站部分资源来源于网络,本站转载出于传递更多信息之目的,版权归原作者或者来源机构所有,如转载稿涉及版权问题,请联系我们

计算机程序设计艺术:第4卷 第4册(双语版)

计算机程序设计艺术:第4卷 第4册(双语版)

Donald E.Knuth / 苏运霖 / 机械工业出版社 / 2007-4 / 42.00元

关于算法分析的这多卷论著已经长期被公认为经典计算机科学的定义性描述。迄今已出版的完整的三卷组成了程序设计理论和实践的惟一的珍贵源泉,无数读者都赞扬Knuth的著作对个人的深远影响。科学家们为他的分析的美丽和优雅所惊叹,而从事实践的程序员们已经成功地应用他的“菜谱式”的解到日常问题上,所有人都由于Knuth在书中所表现出的博学、清晰、精确和高度幽默而对他无比敬仰。   为开始后续各卷的写作并更......一起来看看 《计算机程序设计艺术:第4卷 第4册(双语版)》 这本书的介绍吧!

在线进制转换器
在线进制转换器

各进制数互转换器

Base64 编码/解码
Base64 编码/解码

Base64 编码/解码

HEX HSV 转换工具
HEX HSV 转换工具

HEX HSV 互换工具