lkml.org 
[lkml]   [2023]   [Oct]   [25]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: [PATCH v2 6/6] KVM: VMX: Move VERW closer to VMentry for MDS mitigation
    On Tue, Oct 24, 2023 at 01:08:53AM -0700, Pawan Gupta wrote:
    >During VMentry VERW is executed to mitigate MDS. After VERW, any memory
    >access like register push onto stack may put host data in MDS affected
    >CPU buffers. A guest can then use MDS to sample host data.
    >
    >Although likelihood of secrets surviving in registers at current VERW
    >callsite is less, but it can't be ruled out. Harden the MDS mitigation
    >by moving the VERW mitigation late in VMentry path.
    >
    >Note that VERW for MMIO Stale Data mitigation is unchanged because of
    >the complexity of per-guest conditional VERW which is not easy to handle
    >that late in asm with no GPRs available. If the CPU is also affected by
    >MDS, VERW is unconditionally executed late in asm regardless of guest
    >having MMIO access.
    >
    >Signed-off-by: Pawan Gupta <pawan.kumar.gupta@linux.intel.com>
    >---
    > arch/x86/kvm/vmx/vmenter.S | 4 ++++
    > arch/x86/kvm/vmx/vmx.c | 10 +++++++---
    > 2 files changed, 11 insertions(+), 3 deletions(-)
    >
    >diff --git a/arch/x86/kvm/vmx/vmenter.S b/arch/x86/kvm/vmx/vmenter.S
    >index b3b13ec04bac..c566035938cc 100644
    >--- a/arch/x86/kvm/vmx/vmenter.S
    >+++ b/arch/x86/kvm/vmx/vmenter.S
    >@@ -1,6 +1,7 @@
    > /* SPDX-License-Identifier: GPL-2.0 */
    > #include <linux/linkage.h>
    > #include <asm/asm.h>
    >+#include <asm/segment.h>

    This header is already included a few lines below:

    #include <asm/nospec-branch.h>
    #include <asm/percpu.h>
    #include <asm/segment.h> <---

    > #include <asm/bitsperlong.h>
    > #include <asm/kvm_vcpu_regs.h>
    > #include <asm/nospec-branch.h>

    \
     
     \ /
      Last update: 2023-10-25 10:10    [W:4.279 / U:0.344 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site