AMD Preparing Linux For Enhanced SMT Protection "ESMTP" For EPYC VMs

AMD engineers today sent out patches on the Linux kernel mailing list for beginning to enable Enhanced SMT Protection "ESMTP" for better security with virtual machines running atop EPYC server processors with SEV-SNP. This is the first time seeing Enhanced SMT Protections on the Linux kernel mailing list. Searching around an ESMTP whitepaper was published on AMD.com earlier this year without attracting much attention. Given the timing of this enablement work, Enhanced SMT Protection is presumably a feature of the AMD EPYC 9006 "Venice" server processors. While there are already mechanisms on Linux like core scheduling for ensuring a CPU core and its sibling thread belong to the same virtual machine, ESMTP amounts to a hardware-based for ensuring SMT sibling threads are either idle in host mode or running a vCPU of the guest itself. The intent is on mitigating possible side channel attacks that have come about in past years around Simultaneous Multi Threading / Intel Hyper Threading. Today's kernel patch series summarizes the Enhanced SMT Protection as: "Enhanced SMT Protection (ESMTP) allows an SEV-SNP VM to require that, while one of its vCPUs is in guest mode, every SMT sibling thread on that physical core is either idle in host mode or running a vCPU the guest itself has declared a legal sibling. This mitigates the side-channel risk of sharing core resources with untrusted host threads or with another guest. Unlike core scheduling, where co-residency is a host kernel policy expressed with cookies, ESMTP is enforced by hardware. The sibling mask lives in the VMSA. The host is not trusted to run arbitrary kernel, userspace, or interrupt-handling work on a sibling thread while an ESMTP vCPU is active on that core. Both KVM and the guest fully set the VCPU_SIBLING_MASK, which places every vCPU of the guest in one group so that any two of them may be co-resident. Combined with the ASID check, the sibling of a vCPU in guest mode is then always either another vCPU of that same guest or a thread idle in host mode." Beyond the Linux kernel patches, there are also patches needed for upstreaming against QEMU and OVMF too. This ESMTP feature will only be available when engaging the Secure Encrypted Viirtualization (SEV-SNP) functionality. Also worth noting is that ESMTP will come with some performance cost so is not being enabled by default, but just for those that want to ensure better SMT sibling thread security such as for public cloud deployments or running untrusted workloads: "ESMTP is opt-in because it carries a performance cost as VMRUN stalls until the sibling runs work from a trusted vCPU or is in host idle." The AMD whitepaper amounts to just two patches. Again, this will presumably be part of the AMD EPYC 9006 series line-up.