sugar/linux
1
0
Fork 0
Code Activity

x86/bugs: Add attack vector controls for VMSCAPE

Browse Source 
Use attack vector controls to select whether VMSCAPE requires mitigation,
similar to other bugs.

Signed-off-by: David Kaplan <david.kaplan@amd.com>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
This commit is contained in:
David Kaplan
2025-09-12 10:24:28 -05:00
committed by Borislav Petkov (AMD)
parent 41bab90bbf
commit 5799d5d8a6
2 changed files with 11 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
Documentation/admin-guide/hw-vuln/attack_vector_controls.rst
View File

@@ -218,6 +218,7 @@ SRSO X X X X
SSB X
TAA X X X X * (Note 2)
TSA X X X X
VMSCAPE X
=============== ============== ============ ============= ============== ============ ========
Notes:

14
arch/x86/kernel/cpu/bugs.c
View File

@@ -434,6 +434,9 @@ static bool __init should_mitigate_vuln(unsigned int bug)
case X86_BUG_SPEC_STORE_BYPASS:
return cpu_attack_vector_mitigated(CPU_MITIGATE_USER_USER);
case X86_BUG_VMSCAPE:
return cpu_attack_vector_mitigated(CPU_MITIGATE_GUEST_HOST);
default:
WARN(1, "Unknown bug %x\n", bug);
return false;
@@ -3304,15 +3307,18 @@ early_param("vmscape", vmscape_parse_cmdline);
static void __init vmscape_select_mitigation(void)
{
if (cpu_mitigations_off() ||
!boot_cpu_has_bug(X86_BUG_VMSCAPE) ||
if (!boot_cpu_has_bug(X86_BUG_VMSCAPE) ||
!boot_cpu_has(X86_FEATURE_IBPB)) {
vmscape_mitigation = VMSCAPE_MITIGATION_NONE;
return;
}
if (vmscape_mitigation == VMSCAPE_MITIGATION_AUTO)
vmscape_mitigation = VMSCAPE_MITIGATION_IBPB_EXIT_TO_USER;
if (vmscape_mitigation == VMSCAPE_MITIGATION_AUTO) {
if (should_mitigate_vuln(X86_BUG_VMSCAPE))
vmscape_mitigation = VMSCAPE_MITIGATION_IBPB_EXIT_TO_USER;
else
vmscape_mitigation = VMSCAPE_MITIGATION_NONE;
}
}
static void __init vmscape_update_mitigation(void)