linux-kernel - Re: [PATCH v4 1/8] x86/bugs: Use VM_CLEAR_CPU

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20251103181840.kx3egw5fwgzpksu4@desk>
Date: Mon, 3 Nov 2025 10:18:40 -0800
From: Pawan Gupta <pawan.kumar.gupta@...ux.intel.com>
To: Sean Christopherson <seanjc@...gle.com>
Cc: Paolo Bonzini <pbonzini@...hat.com>,
	Thomas Gleixner <tglx@...utronix.de>,
	Borislav Petkov <bp@...en8.de>,
	Peter Zijlstra <peterz@...radead.org>,
	Josh Poimboeuf <jpoimboe@...nel.org>, kvm@...r.kernel.org,
	linux-kernel@...r.kernel.org, Brendan Jackman <jackmanb@...gle.com>
Subject: Re: [PATCH v4 1/8] x86/bugs: Use VM_CLEAR_CPU_BUFFERS in VMX as well

On Thu, Oct 30, 2025 at 05:30:33PM -0700, Sean Christopherson wrote:
> From: Pawan Gupta <pawan.kumar.gupta@...ux.intel.com>
> 
> TSA mitigation:
> 
>   d8010d4ba43e ("x86/bugs: Add a Transient Scheduler Attacks mitigation")
> 
> introduced VM_CLEAR_CPU_BUFFERS for guests on AMD CPUs. Currently on Intel
> CLEAR_CPU_BUFFERS is being used for guests which has a much broader scope
> (kernel->user also).
> 
> Make mitigations on Intel consistent with TSA. This would help handling the
> guest-only mitigations better in future.
> 
> Signed-off-by: Pawan Gupta <pawan.kumar.gupta@...ux.intel.com>
> [sean: make CLEAR_CPU_BUF_VM mutually exclusive with the MMIO mitigation]
> Signed-off-by: Sean Christopherson <seanjc@...gle.com>
> ---
>  arch/x86/kernel/cpu/bugs.c | 9 +++++++--
>  arch/x86/kvm/vmx/vmenter.S | 2 +-
>  2 files changed, 8 insertions(+), 3 deletions(-)
> 
> diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
> index 6a526ae1fe99..723666a1357e 100644
> --- a/arch/x86/kernel/cpu/bugs.c
> +++ b/arch/x86/kernel/cpu/bugs.c
> @@ -194,7 +194,7 @@ DEFINE_STATIC_KEY_FALSE(switch_mm_cond_l1d_flush);
>  
>  /*
>   * Controls CPU Fill buffer clear before VMenter. This is a subset of
> - * X86_FEATURE_CLEAR_CPU_BUF, and should only be enabled when KVM-only
> + * X86_FEATURE_CLEAR_CPU_BUF_VM, and should only be enabled when KVM-only
>   * mitigation is required.
>   */
>  DEFINE_STATIC_KEY_FALSE(cpu_buf_vm_clear);
> @@ -536,6 +536,7 @@ static void __init mds_apply_mitigation(void)
>  	if (mds_mitigation == MDS_MITIGATION_FULL ||
>  	    mds_mitigation == MDS_MITIGATION_VMWERV) {
>  		setup_force_cpu_cap(X86_FEATURE_CLEAR_CPU_BUF);
> +		setup_force_cpu_cap(X86_FEATURE_CLEAR_CPU_BUF_VM);
>  		if (!boot_cpu_has(X86_BUG_MSBDS_ONLY) &&
>  		    (mds_nosmt || smt_mitigations == SMT_MITIGATIONS_ON))
>  			cpu_smt_disable(false);
> @@ -647,6 +648,7 @@ static void __init taa_apply_mitigation(void)
>  		 * present on host, enable the mitigation for UCODE_NEEDED as well.
>  		 */
>  		setup_force_cpu_cap(X86_FEATURE_CLEAR_CPU_BUF);
> +		setup_force_cpu_cap(X86_FEATURE_CLEAR_CPU_BUF_VM);
>  
>  		if (taa_nosmt || smt_mitigations == SMT_MITIGATIONS_ON)
>  			cpu_smt_disable(false);
> @@ -748,6 +750,7 @@ static void __init mmio_apply_mitigation(void)
>  	 */
>  	if (verw_clear_cpu_buf_mitigation_selected) {
>  		setup_force_cpu_cap(X86_FEATURE_CLEAR_CPU_BUF);
> +		setup_force_cpu_cap(X86_FEATURE_CLEAR_CPU_BUF_VM);
>  		static_branch_disable(&cpu_buf_vm_clear);
>  	} else {
>  		static_branch_enable(&cpu_buf_vm_clear);
> @@ -839,8 +842,10 @@ static void __init rfds_update_mitigation(void)
>  
>  static void __init rfds_apply_mitigation(void)
>  {
> -	if (rfds_mitigation == RFDS_MITIGATION_VERW)
> +	if (rfds_mitigation == RFDS_MITIGATION_VERW) {
>  		setup_force_cpu_cap(X86_FEATURE_CLEAR_CPU_BUF);
> +		setup_force_cpu_cap(X86_FEATURE_CLEAR_CPU_BUF_VM);
> +	}
>  }
>  
>  static __init int rfds_parse_cmdline(char *str)
> diff --git a/arch/x86/kvm/vmx/vmenter.S b/arch/x86/kvm/vmx/vmenter.S
> index bc255d709d8a..1f99a98a16a2 100644
> --- a/arch/x86/kvm/vmx/vmenter.S
> +++ b/arch/x86/kvm/vmx/vmenter.S
> @@ -161,7 +161,7 @@ SYM_FUNC_START(__vmx_vcpu_run)
>  	mov VCPU_RAX(%_ASM_AX), %_ASM_AX
>  
>  	/* Clobbers EFLAGS.ZF */
> -	CLEAR_CPU_BUFFERS
> +	VM_CLEAR_CPU_BUFFERS
>  
>  	/* Check EFLAGS.CF from the VMX_RUN_VMRESUME bit test above. */
>  	jnc .Lvmlaunch
> -- 

Sean, based on Brendan's feedback, below are the fixes to the comments on
top of this patch:

---
diff --git a/arch/x86/include/asm/nospec-branch.h b/arch/x86/include/asm/nospec-branch.h
index 08ed5a2e46a5..2be9be782013 100644
--- a/arch/x86/include/asm/nospec-branch.h
+++ b/arch/x86/include/asm/nospec-branch.h
@@ -321,9 +321,11 @@
 #endif
 .endm
 
+/* Primarily used in exit-to-userspace path */
 #define CLEAR_CPU_BUFFERS \
 	__CLEAR_CPU_BUFFERS X86_FEATURE_CLEAR_CPU_BUF
 
+/* For use in KVM */
 #define VM_CLEAR_CPU_BUFFERS \
 	__CLEAR_CPU_BUFFERS X86_FEATURE_CLEAR_CPU_BUF_VM
 
diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
index 723666a1357e..49d5797a2a42 100644
--- a/arch/x86/kernel/cpu/bugs.c
+++ b/arch/x86/kernel/cpu/bugs.c
@@ -490,7 +490,7 @@ static enum rfds_mitigations rfds_mitigation __ro_after_init =
 
 /*
  * Set if any of MDS/TAA/MMIO/RFDS are going to enable VERW clearing
- * through X86_FEATURE_CLEAR_CPU_BUF on kernel and guest entry.
+ * at userspace *and* guest entry.
  */
 static bool verw_clear_cpu_buf_mitigation_selected __ro_after_init;