Description of problem:

TSA Mitigation backport for the Anolis 5.10 kernel 

•	x86/bugs: Add asm helpers for executing VERW
•	x86/entry_64: Add VERW just before userspace transition
•	x86/entry_32: Add VERW just before userspace transition
•	x86/bugs: Use ALTERNATIVE() instead of mds_user_clear static key
•	KVM/VMX: Move VERW closer to VMentry for MDS mitigation
•	x86/bugs: Fix the SRSO mitigation on Zen3/4
•	x86/bugs: Use code segment selector for VERW operand
•	x86/bugs: Rename MDS machinery to something more generic
•	x86/bugs: Add a Transient Scheduler Attacks mitigation
•	KVM: x86: add support for CPUID leaf 0x80000021
•	KVM: SVM: Advertise TSA CPUID bits to guests
•	x86/process: Move the buffer clearing before MONITOR


Config verification
# zcat /proc/config.gz | grep -i MITIGATION_TSA
CONFIG_MITIGATION_TSA=y
# grep -i MITIGATION_TSA /boot/config-$(uname -r) || true
CONFIG_MITIGATION_TSA=y

 

Unit test process
* Add tsa=on | off | user | vm to the kernel command line in /etc/default/grub
* Run the following command to check TSA support:
Unit tests
1.	TSA = OFF

# cat /sys/devices/system/cpu/vulnerabilities/tsa
Vulnerable

# dmesg | grep -i "transient scheduler"

# cat /proc/cmdline
BOOT_IMAGE=(hd6,gpt2)/vmlinuz-5.10.134_TSA_patches_+ root=/dev/mapper/ao-root ro crashkernel=auto resume=/dev/mapper/ao-swap rd.lvm.lv=ao/root rd.lvm.lv=ao/swap tsa=off
	 

2.	 TSA = ON
# cat /sys/devices/system/cpu/vulnerabilities/tsa
Mitigation: Clear CPU buffers

# dmesg | grep -i "transient scheduler"
[    2.532451] Transient Scheduler Attacks: Mitigation: Clear CPU buffers: user/kernel boundary

# cat /proc/cmdline
BOOT_IMAGE=(hd6,gpt2)/vmlinuz-5.10.134_TSA_patches_+ root=/dev/mapper/ao-root ro crashkernel=auto resume=/dev/mapper/ao-swap rd.lvm.lv=ao/root rd.lvm.lv=ao/swap tsa=on
 
3.	TSA = USER
# cat /sys/devices/system/cpu/vulnerabilities/tsa
Mitigation: Clear CPU buffers: user/kernel boundary

# dmesg | grep -i "transient scheduler"
[    2.532451] Transient Scheduler Attacks: Mitigation: Clear CPU buffers: user/kernel boundary

# cat /proc/cmdline
BOOT_IMAGE=(hd6,gpt2)/vmlinuz-5.10.134_TSA_patches_+ root=/dev/mapper/ao-root ro crashkernel=auto resume=/dev/mapper/ao-swap rd.lvm.lv=ao/root rd.lvm.lv=ao/swap tsa=user

 

4.	TSA = VM
# cat /sys/devices/system/cpu/vulnerabilities/tsa
Mitigation: Clear CPU buffers: VM

# dmesg | grep -i "transient scheduler"
[    2.535111] Transient Scheduler Attacks: Mitigation: Clear CPU buffers: VM

# cat /proc/cmdline
BOOT_IMAGE=(hd6,gpt2)/vmlinuz-5.10.134_TSA_patches_+ root=/dev/mapper/ao-root ro crashkernel=auto resume=/dev/mapper/ao-swap rd.lvm.lv=ao/root rd.lvm.lv=ao/swap tsa=vm