qOsphinx.addnodesdocument)}( rawsourcechildren]( translations LanguagesNode)}(hhh](h pending_xref)}(hhh]docutils.nodesTextChinese (Simplified)}parenthsba attributes}(ids]classes]names]dupnames]backrefs] refdomainstdreftypedoc reftarget//translations/zh_CN/admin-guide/hw-vuln/vmscapemodnameN classnameN refexplicitutagnamehhh ubh)}(hhh]hChinese (Traditional)}hh2sbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget//translations/zh_TW/admin-guide/hw-vuln/vmscapemodnameN classnameN refexplicituh1hhh ubh)}(hhh]hItalian}hhFsbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget//translations/it_IT/admin-guide/hw-vuln/vmscapemodnameN classnameN refexplicituh1hhh ubh)}(hhh]hJapanese}hhZsbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget//translations/ja_JP/admin-guide/hw-vuln/vmscapemodnameN classnameN refexplicituh1hhh ubh)}(hhh]hKorean}hhnsbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget//translations/ko_KR/admin-guide/hw-vuln/vmscapemodnameN classnameN refexplicituh1hhh ubh)}(hhh]hSpanish}hhsbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget//translations/sp_SP/admin-guide/hw-vuln/vmscapemodnameN classnameN refexplicituh1hhh ubeh}(h]h ]h"]h$]h&]current_languageEnglishuh1h hh _documenthsourceNlineNubhcomment)}(h SPDX-License-Identifier: GPL-2.0h]h SPDX-License-Identifier: GPL-2.0}hhsbah}(h]h ]h"]h$]h&] xml:spacepreserveuh1hhhhhhI/var/lib/git/docbuild/linux/Documentation/admin-guide/hw-vuln/vmscape.rsthKubhsection)}(hhh](htitle)}(hVMSCAPEh]hVMSCAPE}(hhhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhhhhhKubh paragraph)}(hVMSCAPE is a vulnerability that may allow a guest to influence the branch prediction in host userspace. It particularly affects hypervisors like QEMU.h]hVMSCAPE is a vulnerability that may allow a guest to influence the branch prediction in host userspace. It particularly affects hypervisors like QEMU.}(hhhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhhhhubh)}(hEven if a hypervisor may not have any sensitive data like disk encryption keys, guest-userspace may be able to attack the guest-kernel using the hypervisor as a confused deputy.h]hEven if a hypervisor may not have any sensitive data like disk encryption keys, guest-userspace may be able to attack the guest-kernel using the hypervisor as a confused deputy.}(hhhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhK hhhhubh)}(hhh](h)}(hAffected processorsh]hAffected processors}(hhhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhhhhhKubh)}(h3The following CPU families are affected by VMSCAPE:h]h3The following CPU families are affected by VMSCAPE:}(hhhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhhhhubhdefinition_list)}(hhh]hdefinition_list_item)}(h**Intel processors:** - Skylake generation (Parts without Enhanced-IBRS) - Cascade Lake generation - (Parts affected by ITS guest/host separation) - Alder Lake and newer (Parts affected by BHI) h](hterm)}(h**Intel processors:**h]hstrong)}(hjh]hIntel processors:}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubah}(h]h ]h"]h$]h&]uh1jhhhKhj ubh definition)}(hhh]h bullet_list)}(hhh](h list_item)}(h0Skylake generation (Parts without Enhanced-IBRS)h]h)}(hj:h]h0Skylake generation (Parts without Enhanced-IBRS)}(hj<hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhj8ubah}(h]h ]h"]h$]h&]uh1j6hj3ubj7)}(hGCascade Lake generation - (Parts affected by ITS guest/host separation)h]h)}(hjQh]hGCascade Lake generation - (Parts affected by ITS guest/host separation)}(hjShhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhjOubah}(h]h ]h"]h$]h&]uh1j6hj3ubj7)}(h-Alder Lake and newer (Parts affected by BHI) h]h)}(h,Alder Lake and newer (Parts affected by BHI)h]h,Alder Lake and newer (Parts affected by BHI)}(hjjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhjfubah}(h]h ]h"]h$]h&]uh1j6hj3ubeh}(h]h ]h"]h$]h&]bullet-uh1j1hhhKhj.ubah}(h]h ]h"]h$]h&]uh1j,hj ubeh}(h]h ]h"]h$]h&]uh1j hhhKhjubah}(h]h ]h"]h$]h&]uh1jhhhhhNhNubh)}(hsNote that, BHI affected parts that use BHB clearing software mitigation e.g. Icelake are not vulnerable to VMSCAPE.h]hsNote that, BHI affected parts that use BHB clearing software mitigation e.g. Icelake are not vulnerable to VMSCAPE.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhhhhubj)}(hhh](j )}(h=**AMD processors:** - Zen series (families 0x17, 0x19, 0x1a) h](j)}(h**AMD processors:**h]j)}(hjh]hAMD processors:}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubah}(h]h ]h"]h$]h&]uh1jhhhKhjubj-)}(hhh]j2)}(hhh]j7)}(h'Zen series (families 0x17, 0x19, 0x1a) h]h)}(h&Zen series (families 0x17, 0x19, 0x1a)h]h&Zen series (families 0x17, 0x19, 0x1a)}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhjubah}(h]h ]h"]h$]h&]uh1j6hjubah}(h]h ]h"]h$]h&]jjuh1j1hhhKhjubah}(h]h ]h"]h$]h&]uh1j,hjubeh}(h]h ]h"]h$]h&]uh1j hhhKhjubj )}(h%** Hygon processors:** - Family 0x18 h](j)}(h** Hygon processors:**h]h** Hygon processors:**}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhhhKhjubj-)}(hhh]j2)}(hhh]j7)}(h Family 0x18 h]h)}(h Family 0x18h]h Family 0x18}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhj ubah}(h]h ]h"]h$]h&]uh1j6hj ubah}(h]h ]h"]h$]h&]jjuh1j1hhhKhjubah}(h]h ]h"]h$]h&]uh1j,hjubeh}(h]h ]h"]h$]h&]uh1j hhhKhjhhubeh}(h]h ]h"]h$]h&]uh1jhhhhhNhNubeh}(h]affected-processorsah ]h"]affected processorsah$]h&]uh1hhhhhhhhKubh)}(hhh]h)}(h Mitigationh]h Mitigation}(hjGhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjDhhhhhK!ubah}(h] mitigationah ]h"] mitigationah$]h&]uh1hhhhhhhhK!ubh)}(hhh](h)}(hConditional IBPBh]hConditional IBPB}(hj`hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj]hhhhhK$ubh)}(hKernel tracks when a CPU has run a potentially malicious guest and issues an IBPB before the first exit to userspace after VM-exit. If userspace did not run between VM-exit and the next VM-entry, no IBPB is issued.h]hKernel tracks when a CPU has run a potentially malicious guest and issues an IBPB before the first exit to userspace after VM-exit. If userspace did not run between VM-exit and the next VM-entry, no IBPB is issued.}(hjnhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhK&hj]hhubh)}(hXINote that the existing userspace mitigation against Spectre-v2 is effective in protecting the userspace. They are insufficient to protect the userspace VMMs from a malicious guest. This is because Spectre-v2 mitigations are applied at context switch time, while the userspace VMM can run after a VM-exit without a context switch.h]hXINote that the existing userspace mitigation against Spectre-v2 is effective in protecting the userspace. They are insufficient to protect the userspace VMMs from a malicious guest. This is because Spectre-v2 mitigations are applied at context switch time, while the userspace VMM can run after a VM-exit without a context switch.}(hj|hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhK*hj]hhubh)}(hVulnerability enumeration and mitigation is not applied inside a guest. This is because nested hypervisors should already be deploying IBPB to isolate themselves from nested guests.h]hVulnerability enumeration and mitigation is not applied inside a guest. This is because nested hypervisors should already be deploying IBPB to isolate themselves from nested guests.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhK0hj]hhubeh}(h]conditional-ibpbah ]h"]conditional ibpbah$]h&]uh1hhhhhhhhK$ubh)}(hhh](h)}(hSMT considerationsh]hSMT considerations}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjhhhhhK5ubh)}(hWhen Simultaneous Multi-Threading (SMT) is enabled, hypervisors can be vulnerable to cross-thread attacks. For complete protection against VMSCAPE attacks in SMT environments, STIBP should be enabled.h]hWhen Simultaneous Multi-Threading (SMT) is enabled, hypervisors can be vulnerable to cross-thread attacks. For complete protection against VMSCAPE attacks in SMT environments, STIBP should be enabled.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhK7hjhhubh)}(hpThe kernel will issue a warning if SMT is enabled without adequate STIBP protection. Warning is not issued when:h]hpThe kernel will issue a warning if SMT is enabled without adequate STIBP protection. Warning is not issued when:}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhK;hjhhubj2)}(hhh](j7)}(hSMT is disabledh]h)}(hjh]hSMT is disabled}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhK>hjubah}(h]h ]h"]h$]h&]uh1j6hjhhhhhNubj7)}(hSTIBP is enabled system-wideh]h)}(hjh]hSTIBP is enabled system-wide}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhK?hjubah}(h]h ]h"]h$]h&]uh1j6hjhhhhhNubj7)}(h8Intel eIBRS is enabled (which implies STIBP protection) h]h)}(h7Intel eIBRS is enabled (which implies STIBP protection)h]h7Intel eIBRS is enabled (which implies STIBP protection)}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhK@hjubah}(h]h ]h"]h$]h&]uh1j6hjhhhhhNubeh}(h]h ]h"]h$]h&]jjuh1j1hhhK>hjhhubeh}(h]smt-considerationsah ]h"]smt considerationsah$]h&]uh1hhhhhhhhK5ubh)}(hhh](h)}(hSystem information and optionsh]hSystem information and options}(hj'hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj$hhhhhKCubh)}(h4The sysfs file showing VMSCAPE mitigation status is:h]h4The sysfs file showing VMSCAPE mitigation status is:}(hj5hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKEhj$hhubh block_quote)}(h0/sys/devices/system/cpu/vulnerabilities/vmscape h]h)}(h//sys/devices/system/cpu/vulnerabilities/vmscapeh]h//sys/devices/system/cpu/vulnerabilities/vmscape}(hjIhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKGhjEubah}(h]h ]h"]h$]h&]uh1jChhhKGhj$hhubh)}(h%The possible values in this file are:h]h%The possible values in this file are:}(hj]hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKIhj$hhubjD)}(hX)* 'Not affected': The processor is not vulnerable to VMSCAPE attacks. * 'Vulnerable': The processor is vulnerable and no mitigation has been applied. * 'Mitigation: IBPB before exit to userspace': Conditional IBPB mitigation is enabled. The kernel tracks when a CPU has run a potentially malicious guest and issues an IBPB before the first exit to userspace after VM-exit. * 'Mitigation: IBPB on VMEXIT': IBPB is issued on every VM-exit. This occurs when other mitigations like RETBLEED or SRSO are already issuing IBPB on VM-exit. h]j2)}(hhh](j7)}(hE'Not affected': The processor is not vulnerable to VMSCAPE attacks. h](h)}(h'Not affected':h]h‘Not affected’:}(hjvhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKKhjrubh)}(h3The processor is not vulnerable to VMSCAPE attacks.h]h3The processor is not vulnerable to VMSCAPE attacks.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKMhjrubeh}(h]h ]h"]h$]h&]uh1j6hjoubj7)}(hO'Vulnerable': The processor is vulnerable and no mitigation has been applied. h](h)}(h 'Vulnerable':h]h‘Vulnerable’:}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKOhjubh)}(h?The processor is vulnerable and no mitigation has been applied.h]h?The processor is vulnerable and no mitigation has been applied.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKQhjubeh}(h]h ]h"]h$]h&]uh1j6hjoubj7)}(h'Mitigation: IBPB before exit to userspace': Conditional IBPB mitigation is enabled. The kernel tracks when a CPU has run a potentially malicious guest and issues an IBPB before the first exit to userspace after VM-exit. h](h)}(h,'Mitigation: IBPB before exit to userspace':h]h0‘Mitigation: IBPB before exit to userspace’:}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKShjubh)}(hConditional IBPB mitigation is enabled. The kernel tracks when a CPU has run a potentially malicious guest and issues an IBPB before the first exit to userspace after VM-exit.h]hConditional IBPB mitigation is enabled. The kernel tracks when a CPU has run a potentially malicious guest and issues an IBPB before the first exit to userspace after VM-exit.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKUhjubeh}(h]h ]h"]h$]h&]uh1j6hjoubj7)}(h'Mitigation: IBPB on VMEXIT': IBPB is issued on every VM-exit. This occurs when other mitigations like RETBLEED or SRSO are already issuing IBPB on VM-exit. h](h)}(h'Mitigation: IBPB on VMEXIT':h]h!‘Mitigation: IBPB on VMEXIT’:}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKYhjubh)}(h~IBPB is issued on every VM-exit. This occurs when other mitigations like RETBLEED or SRSO are already issuing IBPB on VM-exit.h]h~IBPB is issued on every VM-exit. This occurs when other mitigations like RETBLEED or SRSO are already issuing IBPB on VM-exit.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhK[hjubeh}(h]h ]h"]h$]h&]uh1j6hjoubeh}(h]h ]h"]h$]h&]j*uh1j1hhhKKhjkubah}(h]h ]h"]h$]h&]uh1jChhhKKhj$hhubeh}(h]system-information-and-optionsah ]h"]system information and optionsah$]h&]uh1hhhhhhhhKCubh)}(hhh](h)}(h-Mitigation control on the kernel command lineh]h-Mitigation control on the kernel command line}(hj"hhhNhNubah}(h]h ]h"]h$]h&]uh1hhjhhhhhK_ubh)}(hMThe mitigation can be controlled via the ``vmscape=`` command line parameter:h](h)The mitigation can be controlled via the }(hj0hhhNhNubhliteral)}(h ``vmscape=``h]hvmscape=}(hj:hhhNhNubah}(h]h ]h"]h$]h&]uh1j8hj0ubh command line parameter:}(hj0hhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhKahjhhubjD)}(hX* ``vmscape=off``: Disable the VMSCAPE mitigation. * ``vmscape=ibpb``: Enable conditional IBPB mitigation (default when CONFIG_MITIGATION_VMSCAPE=y). * ``vmscape=force``: Force vulnerability detection and mitigation even on processors that are not known to be affected.h]j2)}(hhh](j7)}(h2``vmscape=off``: Disable the VMSCAPE mitigation. h](h)}(h``vmscape=off``:h](j9)}(h``vmscape=off``h]h vmscape=off}(hjahhhNhNubah}(h]h ]h"]h$]h&]uh1j8hj]ubh:}(hj]hhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhKchjYubh)}(hDisable the VMSCAPE mitigation.h]hDisable the VMSCAPE mitigation.}(hjyhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKehjYubeh}(h]h ]h"]h$]h&]uh1j6hjVubj7)}(hb``vmscape=ibpb``: Enable conditional IBPB mitigation (default when CONFIG_MITIGATION_VMSCAPE=y). h](h)}(h``vmscape=ibpb``:h](j9)}(h``vmscape=ibpb``h]h vmscape=ibpb}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j8hjubh:}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhKghjubh)}(hNEnable conditional IBPB mitigation (default when CONFIG_MITIGATION_VMSCAPE=y).h]hNEnable conditional IBPB mitigation (default when CONFIG_MITIGATION_VMSCAPE=y).}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKihjubeh}(h]h ]h"]h$]h&]uh1j6hjVubj7)}(hv``vmscape=force``: Force vulnerability detection and mitigation even on processors that are not known to be affected.h](h)}(h``vmscape=force``:h](j9)}(h``vmscape=force``h]h vmscape=force}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j8hjubh:}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhKkhjubh)}(hbForce vulnerability detection and mitigation even on processors that are not known to be affected.h]hbForce vulnerability detection and mitigation even on processors that are not known to be affected.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKmhjubeh}(h]h ]h"]h$]h&]uh1j6hjVubeh}(h]h ]h"]h$]h&]jjuh1j1hhhKchjRubah}(h]h ]h"]h$]h&]uh1jChhhKchjhhubeh}(h]-mitigation-control-on-the-kernel-command-lineah ]h"]-mitigation control on the kernel command lineah$]h&]uh1hhhhhhhhK_ubeh}(h]vmscapeah ]h"]vmscapeah$]h&]uh1hhhhhhhhKubeh}(h]h ]h"]h$]h&]sourcehuh1hcurrent_sourceN current_lineNsettingsdocutils.frontendValues)}(hN generatorN datestampN source_linkN source_urlN toc_backlinksentryfootnote_backlinksK sectnum_xformKstrip_commentsNstrip_elements_with_classesN strip_classesN report_levelK halt_levelKexit_status_levelKdebugNwarning_streamN tracebackinput_encoding utf-8-siginput_encoding_error_handlerstrictoutput_encodingutf-8output_encoding_error_handlerj4error_encodingutf-8error_encoding_error_handlerbackslashreplace language_codeenrecord_dependenciesNconfigN id_prefixhauto_id_prefixid dump_settingsNdump_internalsNdump_transformsNdump_pseudo_xmlNexpose_internalsNstrict_visitorN_disable_configN_sourceh _destinationN _config_files]7/var/lib/git/docbuild/linux/Documentation/docutils.confafile_insertion_enabled raw_enabledKline_length_limitM'pep_referencesN pep_base_urlhttps://peps.python.org/pep_file_url_templatepep-%04drfc_referencesN rfc_base_url&https://datatracker.ietf.org/doc/html/ tab_widthKtrim_footnote_reference_spacesyntax_highlightlong smart_quotessmartquotes_locales]character_level_inline_markupdoctitle_xform docinfo_xformKsectsubtitle_xform image_loadinglinkembed_stylesheetcloak_email_addressessection_self_linkenvNubreporterNindirect_targets]substitution_defs}substitution_names}refnames}refids}nameids}(jj jAj>jZjWjjj!jjjjju nametypes}(jjAjZjj!jjuh}(j hj>hjWjDjj]jjjj$jju footnote_refs} citation_refs} autofootnotes]autofootnote_refs]symbol_footnotes]symbol_footnote_refs] footnotes] citations]autofootnote_startKsymbol_footnote_startK id_counter collectionsCounter}Rparse_messages]transform_messages] transformerN include_log] decorationNhhub.