AMD EPYC 5th generation and above processors support IBPB-on-Entry
for SNP guests. By invoking an Indirect Branch Prediction Barrier
(IBPB) on VMRUN, old indirect branch predictions are prevented
from influencing indirect branches within the guest.
The first patch is guest-side support which unmasks the Zen5+ feature
bit to allow kernel guests to set the feature.
The second patch is host-side support that checks the CPUID and
then sets the feature bit in the VMSA supported features mask.
The third patch is a trivial #define rename that was a result of
the review discussion from v1's 2/2, to clarify SEV features
that are implemented in the guest.
Based on https://github.com/kvm-x86/linux kvm-x86/next
(currently v6.19-rc6-182-ge944fe2c09f4).
This v2 series now also available here:
https://github.com/AMDESE/linux/tree/ibpb-on-entry-latest
Advance qemu bits (to add ibpb-on-entry=on/off switch) available here:
https://github.com/AMDESE/qemu/tree/ibpb-on-entry-latest
Qemu bits will be posted upstream once kernel bits are merged.
They depend on Naveen Rao's "target/i386: SEV: Add support for
enabling VMSA SEV features":
https://lore.kernel.org/qemu-devel/cover.1761648149.git.naveen@kernel.org/
---
v2:
- Change first patch's title (Nikunj)
- Add reviews-by (Nikunj, Tom)
- Change second patch's description to more generally explain what the patch does (Boris)
- Add new, third patch renaming SNP_FEATURES_PRESENT->SNP_FEATURES_IMPL
v1: https://lore.kernel.org/kvm/20260126224205.1442196-1-kim.phillips@amd.com/
Kim Phillips (3):
x86/sev: Allow IBPB-on-Entry feature for SNP guests
KVM: SEV: Add support for IBPB-on-Entry
x86/sev: Rename SNP_FEATURES_PRESENT->SNP_FEATURES_IMPL
arch/x86/boot/compressed/sev.c | 7 ++++---
arch/x86/coco/sev/core.c | 1 +
arch/x86/include/asm/cpufeatures.h | 1 +
arch/x86/include/asm/msr-index.h | 5 ++++-
arch/x86/include/asm/svm.h | 1 +
arch/x86/kvm/svm/sev.c | 9 ++++++++-
6 files changed, 19 insertions(+), 5 deletions(-)
base-commit: e944fe2c09f405a2e2d147145c9b470084bc4c9a
--
2.43.0