Re: [PATCH] Kernel Lockdown: Add an option to allow raw MSR access even, in confidentiality mode.
From: Matthew Garrett <hidden>
Date: 2019-12-02 19:43:59
On Fri, Nov 29, 2019 at 10:50 PM Matt Parnell [off-list ref] wrote:
For Intel CPUs, some of the MDS mitigations utilize the new "flush" MSR, and while this isn't something normally used in userspace, it does cause false positives for the "Forshadow" vulnerability.
The msr interface is pretty terrible - it exposes a consistent interface over very inconsistent CPUs. Where there's CPU functionality that's implemented via MSRs it makes sense to expose that over a separate kernel interface.