Intel Optimizing Its MDS Mitigation Handling To Avoid Possible Kernel Data Leaking

An Intel engineer on Friday posted a set of Linux kernel patches that are working to refine the Microarchitectural Data Sampling (MDS) mitigation handling for the Linux kernel to better protect some kernel data and also some very subtle performance benefits.

The MDS mitigation requires clearing of CPU buffers before returning to user-space. This is being done with the VERW instruction, which after the MDS vulnerability came to light was updated via Intel CPU microcode to overload the VERW instruction to also clear the CPU buffers. But with how the Linux kernel has been mitigated since 2021, it leaves the possibility of kernel data still ending up in the CPU buffers. So the newly proposed patches are moving the VERW instructions to later on in the return-to-user code path.

The new patches address the situation by moving the VERW call to later in the exit-to-user path for mitigating these transient data sampling attacks.

"Mitigation for MDS is to use VERW instruction to clear any secrets in CPU Buffers. Any memory accesses after VERW execution can still remain in CPU buffers. It is safer to execute VERW late in return to user path to minimize the window in which kernel data can end up in CPU buffers. There are not many kernel secrets to be had after SWITCH_TO_USER_CR3.

Add support for deploying VERW mitigation after user register state is restored. This helps minimize the chances of kernel data ending up into CPU buffers after executing VERW."

The patch series also moves the VERW closer to VMentry within the KVM virtualization code.

With this patch series undergoing review it's also been said to help some workloads like Nginx and Hackbench with up to 1~2% better performance.