Documentation/admin-guide/hw-vuln/vmscape.rst

Source file repositories/reference/linux-study-clean/Documentation/admin-guide/hw-vuln/vmscape.rst

File Facts

System
Linux kernel
Corpus path
Documentation/admin-guide/hw-vuln/vmscape.rst
Extension
.rst
Size
3386 bytes
Lines
111
Domain
Support Tooling And Documentation
Bucket
Documentation
Inferred role
Support Tooling And Documentation: documentation
Status
atlas-only

Why This File Exists

Repository support layer: documentation, build tooling, samples, user-space helper tools, generated initramfs support, licenses, and validation utilities.

Dependency Surface

Detected Declarations

Annotated Snippet

.. SPDX-License-Identifier: GPL-2.0

VMSCAPE
=======

VMSCAPE is a vulnerability that may allow a guest to influence the branch
prediction in host userspace. It particularly affects hypervisors like QEMU.

Even if a hypervisor may not have any sensitive data like disk encryption keys,
guest-userspace may be able to attack the guest-kernel using the hypervisor as
a confused deputy.

Affected processors
-------------------

The following CPU families are affected by VMSCAPE:

**Intel processors:**
  - Skylake generation (Parts without Enhanced-IBRS)
  - Cascade Lake generation - (Parts affected by ITS guest/host separation)
  - Alder Lake and newer (Parts affected by BHI)

Note that, BHI affected parts that use BHB clearing software mitigation e.g.
Icelake are not vulnerable to VMSCAPE.

**AMD processors:**
  - Zen series (families 0x17, 0x19, 0x1a)

** Hygon processors:**
 - Family 0x18

Mitigation
----------

Conditional IBPB
----------------

Kernel tracks when a CPU has run a potentially malicious guest and issues an
IBPB before the first exit to userspace after VM-exit. If userspace did not run
between VM-exit and the next VM-entry, no IBPB is issued.

Note that the existing userspace mitigation against Spectre-v2 is effective in
protecting the userspace. They are insufficient to protect the userspace VMMs
from a malicious guest. This is because Spectre-v2 mitigations are applied at
context switch time, while the userspace VMM can run after a VM-exit without a
context switch.

Vulnerability enumeration and mitigation is not applied inside a guest. This is
because nested hypervisors should already be deploying IBPB to isolate
themselves from nested guests.

SMT considerations
------------------

When Simultaneous Multi-Threading (SMT) is enabled, hypervisors can be
vulnerable to cross-thread attacks. For complete protection against VMSCAPE
attacks in SMT environments, STIBP should be enabled.

The kernel will issue a warning if SMT is enabled without adequate STIBP
protection. Warning is not issued when:

- SMT is disabled
- STIBP is enabled system-wide
- Intel eIBRS is enabled (which implies STIBP protection)

System information and options
------------------------------

The sysfs file showing VMSCAPE mitigation status is:

Annotation

Implementation Notes