Unify VERW mitigation for guests

[PATCH 0/3] Unify VERW mitigation for guests

Posted by Pawan Gupta 1 month, 2 weeks ago

This series unifies the VERW execution sites in KVM, specifically
addressing inconsistencies in how MMIO Stale Data mitigation is handled
compared to other data sampling attacks (MDS/TAA/RFDS).

Problem
=======
Currently, MMIO Stale Data mitigation is handled differently from other
VERW-based mitigations. While MDS/TAA/RFDS perform VERW clearing in
assembly code, MMIO Stale Data mitigation uses a separate code path with
x86_clear_cpu_buffer() calls. This inconsistency exists because MMIO Stale
Data mitigation only needs to be applied when guests can access host MMIO,
which was previously difficult to check in assembly. The other
inconsistency is VERW execution MMIO Stale Data dependency on L1TF
mitigation.

Solution
========
Remove the VERW mitigation for MMIO in C, and use the asm VERW callsite for
all VERW mitigations in KVM. Also decoupling MMIO mitigation from L1TF
mitigation.

Roadmap:

Patch 1: Switch to VM_CLEAR_CPU_BUFFERS usage in VMX to align Intel
	 mitigations with AMD's TSA mitigation.

Patch 2: Renames cpu_buf_vm_clear to cpu_buf_vm_clear_mmio_only to
	 avoid confusion with the broader X86_FEATURE_CLEAR_CPU_BUF_VM.

Patch 3: Unifies MMIO Stale Data mitigation with other VERW-based
         mitigations.

---
Pawan Gupta (3):
      x86/bugs: Use VM_CLEAR_CPU_BUFFERS in VMX as well
      x86/mmio: Rename cpu_buf_vm_clear to cpu_buf_vm_clear_mmio_only
      x86/mmio: Unify VERW mitigation for guests

 arch/x86/include/asm/nospec-branch.h |  2 +-
 arch/x86/kernel/cpu/bugs.c           | 17 +++++++++++------
 arch/x86/kvm/mmu/spte.c              |  2 +-
 arch/x86/kvm/vmx/run_flags.h         | 12 ++++++------
 arch/x86/kvm/vmx/vmenter.S           |  8 +++++++-
 arch/x86/kvm/vmx/vmx.c               | 26 ++++++++++----------------
 6 files changed, 36 insertions(+), 31 deletions(-)
---
base-commit: dcb6fa37fd7bc9c3d2b066329b0d27dedf8becaa
change-id: 20251028-verw-vm-6b922910a2b3

Best regards,
-- 
Pawan

Re: [PATCH 0/3] Unify VERW mitigation for guests

Posted by Sean Christopherson 1 month, 2 weeks ago

On Wed, Oct 29, 2025, Pawan Gupta wrote:
> ---
> Pawan Gupta (3):
>       x86/bugs: Use VM_CLEAR_CPU_BUFFERS in VMX as well
>       x86/mmio: Rename cpu_buf_vm_clear to cpu_buf_vm_clear_mmio_only
>       x86/mmio: Unify VERW mitigation for guests
> 
>  arch/x86/include/asm/nospec-branch.h |  2 +-
>  arch/x86/kernel/cpu/bugs.c           | 17 +++++++++++------
>  arch/x86/kvm/mmu/spte.c              |  2 +-
>  arch/x86/kvm/vmx/run_flags.h         | 12 ++++++------
>  arch/x86/kvm/vmx/vmenter.S           |  8 +++++++-
>  arch/x86/kvm/vmx/vmx.c               | 26 ++++++++++----------------
>  6 files changed, 36 insertions(+), 31 deletions(-)
> ---

Any objection to taking these through the KVM tree when they're ready?  There
will be a conflict in vmx.c with an L1TF related cleanup, and that conflict is
actually helpful in that the two series feed off each other a little bit.

Re: [PATCH 0/3] Unify VERW mitigation for guests

Posted by Borislav Petkov 1 month, 2 weeks ago

On Wed, Oct 29, 2025 at 05:29:08PM -0700, Sean Christopherson wrote:
> Any objection to taking these through the KVM tree when they're ready?  There
> will be a conflict in vmx.c with an L1TF related cleanup, and that conflict is
> actually helpful in that the two series feed off each other a little bit.

I don't see why not.

At the moment, we don't have a whole lot in tip touching that area and if it
ends up appearing, I'd ping you for an immutable branch I could use.

Thx.

-- 
Regards/Gruss,
    Boris.

https://people.kernel.org/tglx/notes-about-netiquette