@@ -95,6 +95,9 @@ The kernel provides a function to invoke the buffer clearing:
9595
9696 mds_clear_cpu_buffers()
9797
98+ Also macro CLEAR_CPU_BUFFERS can be used in ASM late in exit-to-user path.
99+ Other than CFLAGS.ZF, this macro doesn't clobber any registers.
100+
98101The mitigation is invoked on kernel/userspace, hypervisor/guest and C-state
99102(idle) transitions.
100103
@@ -138,17 +141,30 @@ Mitigation points
138141
139142 When transitioning from kernel to user space the CPU buffers are flushed
140143 on affected CPUs when the mitigation is not disabled on the kernel
141- command line. The migitation is enabled through the static key
142- mds_user_clear.
143-
144- The mitigation is invoked in prepare_exit_to_usermode() which covers
145- all but one of the kernel to user space transitions. The exception
146- is when we return from a Non Maskable Interrupt (NMI), which is
147- handled directly in do_nmi().
148-
149- (The reason that NMI is special is that prepare_exit_to_usermode() can
150- enable IRQs. In NMI context, NMIs are blocked, and we don't want to
151- enable IRQs with NMIs blocked.)
144+ command line. The mitigation is enabled through the feature flag
145+ X86_FEATURE_CLEAR_CPU_BUF.
146+
147+ The mitigation is invoked just before transitioning to userspace after
148+ user registers are restored. This is done to minimize the window in
149+ which kernel data could be accessed after VERW e.g. via an NMI after
150+ VERW.
151+
152+ **Corner case not handled **
153+ Interrupts returning to kernel don't clear CPUs buffers since the
154+ exit-to-user path is expected to do that anyways. But, there could be
155+ a case when an NMI is generated in kernel after the exit-to-user path
156+ has cleared the buffers. This case is not handled and NMI returning to
157+ kernel don't clear CPU buffers because:
158+
159+ 1. It is rare to get an NMI after VERW, but before returning to userspace.
160+ 2. For an unprivileged user, there is no known way to make that NMI
161+ less rare or target it.
162+ 3. It would take a large number of these precisely-timed NMIs to mount
163+ an actual attack. There's presumably not enough bandwidth.
164+ 4. The NMI in question occurs after a VERW, i.e. when user state is
165+ restored and most interesting data is already scrubbed. Whats left
166+ is only the data that NMI touches, and that may or may not be of
167+ any interest.
152168
153169
1541702. C-State transition
0 commit comments