AMD Preparing Linux For Enhanced SMT Protection "ESMTP" For EPYC VMs

Advanced Micro Devices (AMD) is taking steps to enhance the security of its EPYC virtual machines (VMs) by preparing Linux for an improved SMT (Simultaneous Multi-Threading) protection feature called Enhanced SMT Protection (ESMTP). ESMTP is designed to mitigate side-channel risks by ensuring that when one of a VM's virtual CPUs (vCPUs) is in guest mode, all sibling threads on the same physical core are either idle in host mode or executing a vCPU that the guest itself has authorized.

This protection mechanism, which is enforced at the hardware level rather than being a policy enforced by the host kernel, resides in the VMSA (Virtual Machine State Area) and is managed by the VCPU_SIBLING_MASK. Both the KVM (Kernel-based Virtual Machine) and the guest operating system fully set the VCPU_SIBLING_MASK, ensuring that all vCPUs within a guest are grouped together, allowing any two of them to potentially be co-resident.

While ESMTP provides enhanced security, it does come with a performance cost, as VMRUN operations must stall until the sibling runs work from a trusted vCPU or is idling in host mode. AMD has implemented this feature as opt-in to allow users to weigh the security benefits against the potential performance impact. Michael Larabel, a key contributor to Phoronix.com and the founder of the site in 2004, has extensively covered the Linux hardware landscape and has played a significant role in the development of tools like the Phoronix Test Suite, Phoromatic, and OpenBenchmarking.org.