Re: [PATCH 6.7.y 1/6] x86/bugs: Add asm helpers for executing VERW

[Greg KH <gregkh@linuxfoundation.org>]

On Tue, Feb 27, 2024 at 08:40:26AM +0100, Jiri Slaby wrote:
> On 27. 02. 24, 6:00, Pawan Gupta wrote:
> > commit baf8361e54550a48a7087b603313ad013cc13386 upstream.
> > 
> > MDS mitigation requires clearing the CPU buffers before returning to
> > user. This needs to be done late in the exit-to-user path. Current
> > location of VERW leaves a possibility of kernel data ending up in CPU
> > buffers for memory accesses done after VERW such as:
> > 
> >    1. Kernel data accessed by an NMI between VERW and return-to-user can
> >       remain in CPU buffers since NMI returning to kernel does not
> >       execute VERW to clear CPU buffers.
> >    2. Alyssa reported that after VERW is executed,
> >       CONFIG_GCC_PLUGIN_STACKLEAK=y scrubs the stack used by a system
> >       call. Memory accesses during stack scrubbing can move kernel stack
> >       contents into CPU buffers.
> >    3. When caller saved registers are restored after a return from
> >       function executing VERW, the kernel stack accesses can remain in
> >       CPU buffers(since they occur after VERW).
> > 
> > To fix this VERW needs to be moved very late in exit-to-user path.
> > 
> > In preparation for moving VERW to entry/exit asm code, create macros
> > that can be used in asm. Also make VERW patching depend on a new feature
> > flag X86_FEATURE_CLEAR_CPU_BUF.
> ...
> > --- a/arch/x86/include/asm/nospec-branch.h
> > +++ b/arch/x86/include/asm/nospec-branch.h
> > @@ -315,6 +315,17 @@
> >   #endif
> >   .endm
> > +/*
> > + * Macro to execute VERW instruction that mitigate transient data sampling
> > + * attacks such as MDS. On affected systems a microcode update overloaded VERW
> > + * instruction to also clear the CPU buffers. VERW clobbers CFLAGS.ZF.
> > + *
> > + * Note: Only the memory operand variant of VERW clears the CPU buffers.
> > + */
> > +.macro CLEAR_CPU_BUFFERS
> > +	ALTERNATIVE "", __stringify(verw mds_verw_sel), X86_FEATURE_CLEAR_CPU_BUF
> 
> Why is not rip-relative preserved here? Will this work at all (it looks like
> verw would now touch random memory)?
> 
> In any way, should you do any changes during the backport, you shall
> document that.

s/shall/MUST/

thanks,

greg k-h