> On Apr 10, 2021, at 5:11 AM, Borislav Petkov <b...@alien8.de> wrote:
>
> From: Borislav Petkov <b...@suse.de>
> Date: Sat, 10 Apr 2021 14:08:13 +0200
>
> There are a bunch of MSRs which luserspace has no business poking at,
> whatsoever. Add a ban list and put the TSC-related MSRs in there. Issue
> a big juicy splat to catch offenders.
Ack!
Can you add STAR, CSTAR, LSTAR, SYSENTER*, SYSCALL*, and EFER please?
>
> Signed-off-by: Borislav Petkov <b...@suse.de>
> ---
> arch/x86/kernel/msr.c | 17 +++++++++++++++++
> 1 file changed, 17 insertions(+)
>
> diff --git a/arch/x86/kernel/msr.c b/arch/x86/kernel/msr.c
> index ed8ac6bcbafb..574bd2c6d4f8 100644
> --- a/arch/x86/kernel/msr.c
> +++ b/arch/x86/kernel/msr.c
> @@ -78,6 +78,13 @@ static ssize_t msr_read(struct file *file, char __user
> *buf,
> return bytes ? bytes : err;
> }
>
> +static const u32 msr_ban_list[] = {
> + MSR_IA32_TSC,
> + MSR_TSC_AUX,
> + MSR_IA32_TSC_ADJUST,
> + MSR_IA32_TSC_DEADLINE,
> +};
> +
> static int filter_write(u32 reg)
> {
> /*
> @@ -89,6 +96,16 @@ static int filter_write(u32 reg)
> * avoid saturating the ring buffer.
> */
> static DEFINE_RATELIMIT_STATE(fw_rs, 30 * HZ, 1);
> + int i;
> +
> + for (i = 0; i < ARRAY_SIZE(msr_ban_list); i++) {
> + if (msr_ban_list[i] != reg)
> + continue;
> +
> + WARN_ONCE(1, "Blocked write to MSR 0x%x\n", reg);
> +
> + return -EINVAL;
> + }
>
> switch (allow_writes) {
> case MSR_WRITES_ON: return 0;
> --
> 2.29.2
>
>
> --
> Regards/Gruss,
> Boris.
>
> https://people.kernel.org/tglx/notes-about-netiquette
