Re: [PATCH -v2] x86/msr: Filter MSR writes

[Borislav Petkov]

On Mon, Jun 22, 2020 at 07:52:28PM +0530, Gyan Gupta wrote:
> I am also working on a similar functionality where we allow specific
> MSRs(whitelisted MSRs) to be allowed to read & write. Additionally,
> writes are subjected to checks where only certain bits can be allowed
> to be modified. This is to increase security & safety of system.
>
> For example, MCi_CTL can be used to enable/disable error reporting
> of hw unit. So in our use case once error reporting is enabled, it
> must not be disabled. Also we want to have restrictions on rdmsr for
> security purposes.

IInstead of defining whitelists, you should design proper interfaces
through sysfs or so which control the functionality you want.

If you want to do some internal testing, you don't need the whitelists
either - you simply enable writing to all MSRs like it is the case now.

-- 
Regards/Gruss,
    Boris.

https://people.kernel.org/tglx/notes-about-netiquette