x86/kvm/vmx: Add MDS protection when L1D Flush is not active (650b68a0) · Commits · 戴 / test

CPUs which are affected by L1TF and MDS mitigate MDS with the L1D Flush on VMENTER when updated microcode is installed. If a CPU is not affected by L1TF or if the L1D Flush is not in use, then MDS mitigation needs to be invoked explicitly. For these cases, follow the host mitigation state and invoke the MDS mitigation before VMENTER. Signed-off-by:

Thomas Gleixner <tglx@linutronix.de> Reviewed-by:

Greg Kroah-Hartman <gregkh@linuxfoundation.org> Reviewed-by:

Frederic Weisbecker <frederic@kernel.org> Reviewed-by:

Borislav Petkov <bp@suse.de> Reviewed-by:

Jon Masters <jcm@redhat.com> Tested-by:

Jon Masters <jcm@redhat.com>

arch/x86/kernel/cpu/bugs.c

+1 −0

Original line number	Diff line number	Diff line
		@@ -65,6 +65,7 @@ DEFINE_STATIC_KEY_FALSE(switch_mm_always_ibpb);

		/* Control MDS CPU buffer clear before returning to user space */
		DEFINE_STATIC_KEY_FALSE(mds_user_clear);
		EXPORT_SYMBOL_GPL(mds_user_clear);

		void __init check_bugs(void)
		{

arch/x86/kvm/vmx/vmx.c

+3 −0

Original line number	Diff line number	Diff line
		@@ -6369,8 +6369,11 @@ static void __vmx_vcpu_run(struct kvm_vcpu vcpu, struct vcpu_vmx vmx)
		evmcs_rsp = static_branch_unlikely(&enable_evmcs) ?
		(unsigned long)&current_evmcs->host_rsp : 0;

		/* L1D Flush includes CPU buffer clear to mitigate MDS */
		if (static_branch_unlikely(&vmx_l1d_should_flush))
		vmx_l1d_flush(vcpu);
		else if (static_branch_unlikely(&mds_user_clear))
		mds_clear_cpu_buffers();

		asm(
		/* Store host registers */

Admin message