AMD engineers have submitted patches to the Linux kernel to enable Enhanced SMT Protection (ESMTP) for virtual machines running on EPYC server processors utilizing Secure Encrypted Virtualization – Secure Nested Paging (SEV-SNP). This hardware-based feature aims to mitigate side-channel attacks related to Simultaneous Multi Threading (SMT) by ensuring SMT sibling threads are either idle or running a vCPU declared by the guest.
ESMTP builds upon existing core scheduling mechanisms, which ensure a CPU core and its sibling thread belong to the same virtual machine. However, ESMTP goes further by leveraging hardware to enforce that SMT sibling threads are either idle in host mode or executing a vCPU of the guest. According to a kernel patch summary, “Enhanced SMT Protection (ESMTP) allows an SEV-SNP VM to require that, while one of its vCPUs is in guest mode, every SMT sibling thread on that physical core is either idle in host mode or running a vCPU the guest itself has declared a legal sibling. This mitigates the side-channel risk of sharing core resources with untrusted host threads or with another guest.”
The initial enablement work includes patches for the Linux kernel, QEMU, and OVMF. AMD published a whitepaper detailing ESMTP earlier this year. The feature is intended for deployments prioritizing security, such as public cloud environments or those handling untrusted workloads, and will incur some performance cost, therefore it will not be enabled by default.
ESMTP is presumed to be a feature of the upcoming AMD EPYC 9006 “Venice” server processors. The patches represent the first instance of Enhanced SMT Protection being introduced to the Linux kernel mailing list.
Read the original coverage
💬 Comments
📜 Comment Policy