linux-kernel - [PATCH v2 0/3] KVM: SEV: Add support for IBPB-on-Entry

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20260203222405.4065706-1-kim.phillips@amd.com>
Date: Tue, 3 Feb 2026 16:24:02 -0600
From: Kim Phillips <kim.phillips@....com>
To: <linux-kernel@...r.kernel.org>, <kvm@...r.kernel.org>,
	<linux-coco@...ts.linux.dev>, <x86@...nel.org>
CC: Sean Christopherson <seanjc@...gle.com>, Paolo Bonzini
	<pbonzini@...hat.com>, K Prateek Nayak <kprateek.nayak@....com>, "Nikunj A
 Dadhania" <nikunj@....com>, Tom Lendacky <thomas.lendacky@....com>, "Michael
 Roth" <michael.roth@....com>, Borislav Petkov <borislav.petkov@....com>,
	Borislav Petkov <bp@...en8.de>, Naveen Rao <naveen.rao@....com>, David Kaplan
	<david.kaplan@....com>, Kim Phillips <kim.phillips@....com>
Subject: [PATCH v2 0/3] KVM: SEV: Add support for IBPB-on-Entry

AMD EPYC 5th generation and above processors support IBPB-on-Entry
for SNP guests.  By invoking an Indirect Branch Prediction Barrier
(IBPB) on VMRUN, old indirect branch predictions are prevented
from influencing indirect branches within the guest.

The first patch is guest-side support which unmasks the Zen5+ feature
bit to allow kernel guests to set the feature.

The second patch is host-side support that checks the CPUID and
then sets the feature bit in the VMSA supported features mask.

The third patch is a trivial #define rename that was a result of
the review discussion from v1's 2/2, to clarify SEV features
that are implemented in the guest.

Based on https://github.com/kvm-x86/linux kvm-x86/next
(currently v6.19-rc6-182-ge944fe2c09f4).

This v2 series now also available here:

https://github.com/AMDESE/linux/tree/ibpb-on-entry-latest

Advance qemu bits (to add ibpb-on-entry=on/off switch) available here:

https://github.com/AMDESE/qemu/tree/ibpb-on-entry-latest

Qemu bits will be posted upstream once kernel bits are merged.
They depend on Naveen Rao's "target/i386: SEV: Add support for
enabling VMSA SEV features":

https://lore.kernel.org/qemu-devel/cover.1761648149.git.naveen@kernel.org/
---
v2:
     - Change first patch's title (Nikunj)
     - Add reviews-by (Nikunj, Tom)
     - Change second patch's description to more generally explain what the patch does (Boris)
     - Add new, third patch renaming SNP_FEATURES_PRESENT->SNP_FEATURES_IMPL

v1: https://lore.kernel.org/kvm/20260126224205.1442196-1-kim.phillips@amd.com/

Kim Phillips (3):
  x86/sev: Allow IBPB-on-Entry feature for SNP guests
  KVM: SEV: Add support for IBPB-on-Entry
  x86/sev: Rename SNP_FEATURES_PRESENT->SNP_FEATURES_IMPL

 arch/x86/boot/compressed/sev.c     | 7 ++++---
 arch/x86/coco/sev/core.c           | 1 +
 arch/x86/include/asm/cpufeatures.h | 1 +
 arch/x86/include/asm/msr-index.h   | 5 ++++-
 arch/x86/include/asm/svm.h         | 1 +
 arch/x86/kvm/svm/sev.c             | 9 ++++++++-
 6 files changed, 19 insertions(+), 5 deletions(-)

base-commit: e944fe2c09f405a2e2d147145c9b470084bc4c9a
-- 
2.43.0