1*9969779dSPawan Gupta.. SPDX-License-Identifier: GPL-2.0 2*9969779dSPawan Gupta 3*9969779dSPawan GuptaVMSCAPE 4*9969779dSPawan Gupta======= 5*9969779dSPawan Gupta 6*9969779dSPawan GuptaVMSCAPE is a vulnerability that may allow a guest to influence the branch 7*9969779dSPawan Guptaprediction in host userspace. It particularly affects hypervisors like QEMU. 8*9969779dSPawan Gupta 9*9969779dSPawan GuptaEven if a hypervisor may not have any sensitive data like disk encryption keys, 10*9969779dSPawan Guptaguest-userspace may be able to attack the guest-kernel using the hypervisor as 11*9969779dSPawan Guptaa confused deputy. 12*9969779dSPawan Gupta 13*9969779dSPawan GuptaAffected processors 14*9969779dSPawan Gupta------------------- 15*9969779dSPawan Gupta 16*9969779dSPawan GuptaThe following CPU families are affected by VMSCAPE: 17*9969779dSPawan Gupta 18*9969779dSPawan Gupta**Intel processors:** 19*9969779dSPawan Gupta - Skylake generation (Parts without Enhanced-IBRS) 20*9969779dSPawan Gupta - Cascade Lake generation - (Parts affected by ITS guest/host separation) 21*9969779dSPawan Gupta - Alder Lake and newer (Parts affected by BHI) 22*9969779dSPawan Gupta 23*9969779dSPawan GuptaNote that, BHI affected parts that use BHB clearing software mitigation e.g. 24*9969779dSPawan GuptaIcelake are not vulnerable to VMSCAPE. 25*9969779dSPawan Gupta 26*9969779dSPawan Gupta**AMD processors:** 27*9969779dSPawan Gupta - Zen series (families 0x17, 0x19, 0x1a) 28*9969779dSPawan Gupta 29*9969779dSPawan Gupta** Hygon processors:** 30*9969779dSPawan Gupta - Family 0x18 31*9969779dSPawan Gupta 32*9969779dSPawan GuptaMitigation 33*9969779dSPawan Gupta---------- 34*9969779dSPawan Gupta 35*9969779dSPawan GuptaConditional IBPB 36*9969779dSPawan Gupta---------------- 37*9969779dSPawan Gupta 38*9969779dSPawan GuptaKernel tracks when a CPU has run a potentially malicious guest and issues an 39*9969779dSPawan GuptaIBPB before the first exit to userspace after VM-exit. If userspace did not run 40*9969779dSPawan Guptabetween VM-exit and the next VM-entry, no IBPB is issued. 41*9969779dSPawan Gupta 42*9969779dSPawan GuptaNote that the existing userspace mitigation against Spectre-v2 is effective in 43*9969779dSPawan Guptaprotecting the userspace. They are insufficient to protect the userspace VMMs 44*9969779dSPawan Guptafrom a malicious guest. This is because Spectre-v2 mitigations are applied at 45*9969779dSPawan Guptacontext switch time, while the userspace VMM can run after a VM-exit without a 46*9969779dSPawan Guptacontext switch. 47*9969779dSPawan Gupta 48*9969779dSPawan GuptaVulnerability enumeration and mitigation is not applied inside a guest. This is 49*9969779dSPawan Guptabecause nested hypervisors should already be deploying IBPB to isolate 50*9969779dSPawan Guptathemselves from nested guests. 51*9969779dSPawan Gupta 52*9969779dSPawan GuptaSMT considerations 53*9969779dSPawan Gupta------------------ 54*9969779dSPawan Gupta 55*9969779dSPawan GuptaWhen Simultaneous Multi-Threading (SMT) is enabled, hypervisors can be 56*9969779dSPawan Guptavulnerable to cross-thread attacks. For complete protection against VMSCAPE 57*9969779dSPawan Guptaattacks in SMT environments, STIBP should be enabled. 58*9969779dSPawan Gupta 59*9969779dSPawan GuptaThe kernel will issue a warning if SMT is enabled without adequate STIBP 60*9969779dSPawan Guptaprotection. Warning is not issued when: 61*9969779dSPawan Gupta 62*9969779dSPawan Gupta- SMT is disabled 63*9969779dSPawan Gupta- STIBP is enabled system-wide 64*9969779dSPawan Gupta- Intel eIBRS is enabled (which implies STIBP protection) 65*9969779dSPawan Gupta 66*9969779dSPawan GuptaSystem information and options 67*9969779dSPawan Gupta------------------------------ 68*9969779dSPawan Gupta 69*9969779dSPawan GuptaThe sysfs file showing VMSCAPE mitigation status is: 70*9969779dSPawan Gupta 71*9969779dSPawan Gupta /sys/devices/system/cpu/vulnerabilities/vmscape 72*9969779dSPawan Gupta 73*9969779dSPawan GuptaThe possible values in this file are: 74*9969779dSPawan Gupta 75*9969779dSPawan Gupta * 'Not affected': 76*9969779dSPawan Gupta 77*9969779dSPawan Gupta The processor is not vulnerable to VMSCAPE attacks. 78*9969779dSPawan Gupta 79*9969779dSPawan Gupta * 'Vulnerable': 80*9969779dSPawan Gupta 81*9969779dSPawan Gupta The processor is vulnerable and no mitigation has been applied. 82*9969779dSPawan Gupta 83*9969779dSPawan Gupta * 'Mitigation: IBPB before exit to userspace': 84*9969779dSPawan Gupta 85*9969779dSPawan Gupta Conditional IBPB mitigation is enabled. The kernel tracks when a CPU has 86*9969779dSPawan Gupta run a potentially malicious guest and issues an IBPB before the first 87*9969779dSPawan Gupta exit to userspace after VM-exit. 88*9969779dSPawan Gupta 89*9969779dSPawan Gupta * 'Mitigation: IBPB on VMEXIT': 90*9969779dSPawan Gupta 91*9969779dSPawan Gupta IBPB is issued on every VM-exit. This occurs when other mitigations like 92*9969779dSPawan Gupta RETBLEED or SRSO are already issuing IBPB on VM-exit. 93*9969779dSPawan Gupta 94*9969779dSPawan GuptaMitigation control on the kernel command line 95*9969779dSPawan Gupta---------------------------------------------- 96*9969779dSPawan Gupta 97*9969779dSPawan GuptaThe mitigation can be controlled via the ``vmscape=`` command line parameter: 98*9969779dSPawan Gupta 99*9969779dSPawan Gupta * ``vmscape=off``: 100*9969779dSPawan Gupta 101*9969779dSPawan Gupta Disable the VMSCAPE mitigation. 102*9969779dSPawan Gupta 103*9969779dSPawan Gupta * ``vmscape=ibpb``: 104*9969779dSPawan Gupta 105*9969779dSPawan Gupta Enable conditional IBPB mitigation (default when CONFIG_MITIGATION_VMSCAPE=y). 106*9969779dSPawan Gupta 107*9969779dSPawan Gupta * ``vmscape=force``: 108*9969779dSPawan Gupta 109*9969779dSPawan Gupta Force vulnerability detection and mitigation even on processors that are 110*9969779dSPawan Gupta not known to be affected. 111