From: Pawan Gupta <pawan.kumar.gupta@linux.intel.com>
To: Thomas Gleixner <tglx@linutronix.de>,
Ingo Molnar <mingo@redhat.com>, Borislav Petkov <bp@alien8.de>,
Dave Hansen <dave.hansen@linux.intel.com>,
x86@kernel.org, "H. Peter Anvin" <hpa@zytor.com>,
Peter Zijlstra <peterz@infradead.org>,
Josh Poimboeuf <jpoimboe@kernel.org>,
Andy Lutomirski <luto@kernel.org>,
Jonathan Corbet <corbet@lwn.net>,
Sean Christopherson <seanjc@google.com>,
Paolo Bonzini <pbonzini@redhat.com>,
tony.luck@intel.com, ak@linux.intel.com,
tim.c.chen@linux.intel.com
Cc: linux-kernel@vger.kernel.org, linux-doc@vger.kernel.org,
kvm@vger.kernel.org,
Alyssa Milburn <alyssa.milburn@linux.intel.com>,
Daniel Sneddon <daniel.sneddon@linux.intel.com>,
antonio.gomez.iglesias@linux.intel.com,
Pawan Gupta <pawan.kumar.gupta@linux.intel.com>,
Alyssa Milburn <alyssa.milburn@intel.com>,
Dave Hansen <dave.hansen@intel.com>
Subject: [PATCH 0/6] Delay VERW
Date: Fri, 20 Oct 2023 13:44:51 -0700 [thread overview]
Message-ID: <20231020-delay-verw-v1-0-cff54096326d@linux.intel.com> (raw)
Hi,
Legacy instruction VERW was overloaded by some processors to clear
micro-architectural CPU buffers as a mitigation of CPU bugs. This series
moves VERW execution to a later point in exit-to-user path. This is
needed because in some cases it may be possible for kernel data to be
accessed after VERW in arch_exit_to_user_mode(). Such accesses may put
data into MDS affected CPU buffers, for example:
1. Kernel data accessed by an NMI between VERW and return-to-user can
remain in CPU buffers (since NMI returning to kernel does not
execute VERW to clear CPU buffers).
2. Alyssa reported that after VERW is executed,
CONFIG_GCC_PLUGIN_STACKLEAK=y scrubs the stack used by a system
call. Memory accesses during stack scrubbing can move kernel stack
contents into CPU buffers.
3. When caller saved registers are restored after a return from
function executing VERW, the kernel stack accesses can remain in
CPU buffers(since they occur after VERW).
Although these cases are less practical to exploit, moving VERW closer
to ring transition reduces the attack surface.
Overview of the series:
Patch 1: Prepares VERW macros for use in asm.
Patch 2: Adds macros to 64-bit entry/exit points.
Patch 3: Adds macros to 32-bit entry/exit points.
Patch 4: Enables the new macros.
Patch 5: Cleans up C implementation.
Patch 6: Adds macro to VMenter.
Below is some performance data collected on a Skylake client compared
with previous implementation:
Baseline: v6.6-rc5
| Test | Configuration | Relative |
| ------------------ | ---------------------- | -------- |
| build-linux-kernel | defconfig | 1.00 |
| hackbench | 32 - Process | 1.02 |
| nginx | Short Connection - 500 | 1.01 |
Signed-off-by: Pawan Gupta <pawan.kumar.gupta@linux.intel.com>
---
Pawan Gupta (6):
x86/bugs: Add asm helpers for executing VERW
x86/entry_64: Add VERW just before userspace transition
x86/entry_32: Add VERW just before userspace transition
x86/bugs: Use ALTERNATIVE() instead of mds_user_clear static key
x86/bugs: Cleanup mds_user_clear
KVM: VMX: Move VERW closer to VMentry for MDS mitigation
Documentation/arch/x86/mds.rst | 20 +++++++++----------
arch/x86/entry/entry_32.S | 8 ++++++++
arch/x86/entry/entry_64.S | 14 ++++++++++++++
arch/x86/entry/entry_64_compat.S | 2 ++
arch/x86/include/asm/cpufeatures.h | 2 +-
arch/x86/include/asm/entry-common.h | 1 -
arch/x86/include/asm/nospec-branch.h | 37 ++++++++++++++++++++++++------------
arch/x86/kernel/cpu/bugs.c | 13 +++++--------
arch/x86/kernel/nmi.c | 2 --
arch/x86/kvm/vmx/vmenter.S | 9 +++++++++
arch/x86/kvm/vmx/vmx.c | 10 +++++++---
11 files changed, 80 insertions(+), 38 deletions(-)
---
base-commit: 58720809f52779dc0f08e53e54b014209d13eebb
change-id: 20231011-delay-verw-d0474986b2c3
Best regards,
--
Thanks,
Pawan
next reply other threads:[~2023-10-20 20:44 UTC|newest]
Thread overview: 42+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-10-20 20:44 Pawan Gupta [this message]
2023-10-20 20:44 ` [PATCH 1/6] x86/bugs: Add asm helpers for executing VERW Pawan Gupta
2023-10-20 23:13 ` Sean Christopherson
2023-10-21 1:00 ` Pawan Gupta
2023-10-20 23:55 ` [RESEND][PATCH " Andrew Cooper
2023-10-21 1:18 ` Pawan Gupta
2023-10-21 1:33 ` Andrew Cooper
2023-10-21 2:21 ` Pawan Gupta
2023-10-23 18:08 ` Josh Poimboeuf
2023-10-23 19:09 ` Pawan Gupta
2023-10-25 6:28 ` Pawan Gupta
2023-10-25 7:22 ` Peter Zijlstra
2023-10-25 7:52 ` Andrew Cooper
2023-10-25 8:02 ` Peter Zijlstra
2023-10-25 15:27 ` Pawan Gupta
[not found] ` <6439a094-23a6-4de3-aa41-bd033163e044@citrix.com>
2023-10-22 16:16 ` [PATCH " Peter Zijlstra
2023-10-20 20:45 ` [PATCH 2/6] x86/entry_64: Add VERW just before userspace transition Pawan Gupta
2023-10-23 18:22 ` Josh Poimboeuf
2023-10-23 19:13 ` Pawan Gupta
2023-10-23 19:17 ` Dave Hansen
2023-10-23 18:35 ` Josh Poimboeuf
2023-10-23 21:04 ` Pawan Gupta
2023-10-23 21:47 ` Josh Poimboeuf
2023-10-23 22:30 ` Pawan Gupta
2023-10-23 22:45 ` Dave Hansen
2023-10-24 0:00 ` Pawan Gupta
2023-10-20 20:45 ` [PATCH 3/6] x86/entry_32: " Pawan Gupta
2023-10-20 23:49 ` Andi Kleen
2023-10-21 1:28 ` Pawan Gupta
2023-10-20 20:45 ` [PATCH 4/6] x86/bugs: Use ALTERNATIVE() instead of mds_user_clear static key Pawan Gupta
2023-10-23 18:48 ` Josh Poimboeuf
2023-10-23 21:09 ` Pawan Gupta
2023-10-20 20:45 ` [PATCH 5/6] x86/bugs: Cleanup mds_user_clear Pawan Gupta
2023-10-23 8:51 ` Nikolay Borisov
2023-10-23 16:06 ` Pawan Gupta
2023-10-20 20:45 ` [PATCH 6/6] KVM: VMX: Move VERW closer to VMentry for MDS mitigation Pawan Gupta
2023-10-20 22:55 ` Sean Christopherson
2023-10-21 0:46 ` Pawan Gupta
2023-10-23 14:58 ` Sean Christopherson
2023-10-23 17:05 ` Pawan Gupta
2023-10-23 18:56 ` Josh Poimboeuf
2023-10-23 21:17 ` Pawan Gupta
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20231020-delay-verw-v1-0-cff54096326d@linux.intel.com \
--to=pawan.kumar.gupta@linux.intel.com \
--cc=ak@linux.intel.com \
--cc=alyssa.milburn@intel.com \
--cc=alyssa.milburn@linux.intel.com \
--cc=antonio.gomez.iglesias@linux.intel.com \
--cc=bp@alien8.de \
--cc=corbet@lwn.net \
--cc=daniel.sneddon@linux.intel.com \
--cc=dave.hansen@intel.com \
--cc=dave.hansen@linux.intel.com \
--cc=hpa@zytor.com \
--cc=jpoimboe@kernel.org \
--cc=kvm@vger.kernel.org \
--cc=linux-doc@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=luto@kernel.org \
--cc=mingo@redhat.com \
--cc=pbonzini@redhat.com \
--cc=peterz@infradead.org \
--cc=seanjc@google.com \
--cc=tglx@linutronix.de \
--cc=tim.c.chen@linux.intel.com \
--cc=tony.luck@intel.com \
--cc=x86@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.