[devel-5.10] Transient Scheduler Attacks (TSA) backport for OpenAnolis 8.10 · Pull Request !6002 · anolis/cloud-kernel

bugzilla:https://bugzilla.openanolis.cn/show_bug.cgi?id=27027

Transient schedular Attack (TSA) backported patches for openAnolis 5.10 kernel:

**Patch list**
•	x86/bugs: Add asm helpers for executing VERW
•	x86/entry_64: Add VERW just before userspace transition
•	x86/entry_32: Add VERW just before userspace transition
•	x86/bugs: Use ALTERNATIVE() instead of mds_user_clear static key
•	KVM/VMX: Move VERW closer to VMentry for MDS mitigation
•	x86/bugs: Fix the SRSO mitigation on Zen3/4
•	x86/bugs: Use code segment selector for VERW operand
•	x86/bugs: Rename MDS machinery to something more generic
•	x86/bugs: Add a Transient Scheduler Attacks mitigation
•	KVM: x86: add support for CPUID leaf 0x80000021
•	KVM: SVM: Advertise TSA CPUID bits to guests
•	x86/process: Move the buffer clearing before MONITOR

```bash
# zcat /proc/config.gz | grep -i MITIGATION_TSA
CONFIG_MITIGATION_TSA=y

# grep -i MITIGATION_TSA /boot/config-$(uname -r) || true
CONFIG_MITIGATION_TSA=y
```
 **Unit test process**
* Add tsa=on | off | user | vm to the kernel command line in /etc/default/grub
* Run the following command to check TSA support:
**Unit tests**
1.	TSA = OFF
```bash
# cat /sys/devices/system/cpu/vulnerabilities/tsa
Vulnerable

# dmesg | grep -i "transient scheduler"

# cat /proc/cmdline
BOOT_IMAGE=(hd6,gpt2)/vmlinuz-5.10.134_TSA_patches_+ root=/dev/mapper/ao-root ro crashkernel=auto resume=/dev/mapper/ao-swap rd.lvm.lv=ao/root rd.lvm.lv=ao/swap tsa=off
```

2.	 TSA = ON
```bash
# cat /sys/devices/system/cpu/vulnerabilities/tsa
Mitigation: Clear CPU buffers

# dmesg | grep -i "transient scheduler"
[    2.532451] Transient Scheduler Attacks: Mitigation: Clear CPU buffers: user/kernel boundary

# cat /proc/cmdline
BOOT_IMAGE=(hd6,gpt2)/vmlinuz-5.10.134_TSA_patches_+ root=/dev/mapper/ao-root ro crashkernel=auto resume=/dev/mapper/ao-swap rd.lvm.lv=ao/root rd.lvm.lv=ao/swap tsa=on
 ```
3.	TSA = USER
```bash
# cat /sys/devices/system/cpu/vulnerabilities/tsa
Mitigation: Clear CPU buffers: user/kernel boundary

# dmesg | grep -i "transient scheduler"
[    2.532451] Transient Scheduler Attacks: Mitigation: Clear CPU buffers: user/kernel boundary

# cat /proc/cmdline
BOOT_IMAGE=(hd6,gpt2)/vmlinuz-5.10.134_TSA_patches_+ root=/dev/mapper/ao-root ro crashkernel=auto resume=/dev/mapper/ao-swap rd.lvm.lv=ao/root rd.lvm.lv=ao/swap tsa=user
```
 
4.	TSA = VM
```bash
# cat /sys/devices/system/cpu/vulnerabilities/tsa
Mitigation: Clear CPU buffers: VM

# dmesg | grep -i "transient scheduler"
[    2.535111] Transient Scheduler Attacks: Mitigation: Clear CPU buffers: VM

# cat /proc/cmdline
BOOT_IMAGE=(hd6,gpt2)/vmlinuz-5.10.134_TSA_patches_+ root=/dev/mapper/ao-root ro crashkernel=auto resume=/dev/mapper/ao-swap rd.lvm.lv=ao/root rd.lvm.lv=ao/swap tsa=vm
```

类型	指派人员	状态
审查	xunlei 半叶枫尘 Artie Ding winterddd xueshuai guobin 冯光辉 Guixin Liu kun-llfl Xuchun Shang	已完成 (0/0人)
测试	小龙	进行中 (0/1人)

GVPanolis/cloud-kernel

搜索帮助

GVP anolis/cloud-kernel