Advertise support for BTB Isolation via SEV_VMSA_FEATURES when SNP is enabled, as all hardware that supports SNP also support BTB Isolation. BTB Isolation is an optional feature that can be enabled by the guest to ensure its guest Branch Target Buffers (BTBs) are not affected by any context outside that guest. SNP-active guests may choose to enable the Branch Target Buffer Isolation mode through SEV_FEATURES bit 7 (BTBIsolation). For more info, refer to page 615, Section 15.36.17 "Side-Channel Protection", AMD64 Architecture Programmer's Manual Volume 2: System Programming Part 2, Pub. 24593 Rev. 3.42 - March 2024 (see Link). Link: https://bugzilla.kernel.org/attachment.cgi?id=306250 Cc: Sean Christopherson Cc: Borislav Petkov (AMD) Signed-off-by: Kim Phillips --- v3: Reworded, Rebased on top of new SNP_ONLY_MASK etc. changes v2: https://lore.kernel.org/kvm/20260203222405.4065706-3-kim.phillips@amd.com/ - Added Tom's Reviewed-by. v1: https://lore.kernel.org/kvm/20260126224205.1442196-3-kim.phillips@amd.com/ arch/x86/include/asm/svm.h | 2 ++ arch/x86/kvm/svm/sev.c | 7 ++++++- 2 files changed, 8 insertions(+), 1 deletion(-) diff --git a/arch/x86/include/asm/svm.h b/arch/x86/include/asm/svm.h index 2a2b8705b2c0..d3a15a40a09b 100644 --- a/arch/x86/include/asm/svm.h +++ b/arch/x86/include/asm/svm.h @@ -305,10 +305,12 @@ static_assert((X2AVIC_4K_MAX_PHYSICAL_ID & AVIC_PHYSICAL_MAX_INDEX_MASK) == X2AV #define SVM_SEV_FEAT_RESTRICTED_INJECTION BIT(3) #define SVM_SEV_FEAT_ALTERNATE_INJECTION BIT(4) #define SVM_SEV_FEAT_DEBUG_SWAP BIT(5) +#define SVM_SEV_FEAT_BTB_ISOLATION BIT(7) #define SVM_SEV_FEAT_SECURE_TSC BIT(9) #define SVM_SEV_FEAT_IBPB_ON_ENTRY BIT(21) #define SVM_SEV_FEAT_SNP_ONLY_MASK (SVM_SEV_FEAT_SNP_ACTIVE | \ + SVM_SEV_FEAT_BTB_ISOLATION | \ SVM_SEV_FEAT_SECURE_TSC | \ SVM_SEV_FEAT_IBPB_ON_ENTRY) diff --git a/arch/x86/kvm/svm/sev.c b/arch/x86/kvm/svm/sev.c index 561023486253..733423000bc8 100644 --- a/arch/x86/kvm/svm/sev.c +++ b/arch/x86/kvm/svm/sev.c @@ -3166,7 +3166,12 @@ void __init sev_hardware_setup(void) sev_supported_vmsa_features |= SVM_SEV_FEAT_DEBUG_SWAP; if (sev_snp_enabled) { - sev_supported_vmsa_features |= SVM_SEV_FEAT_SNP_ACTIVE; + /* + * Some SNP-only features such as BTB Isolation are + * available on all systems that support SNP. + */ + sev_supported_vmsa_features |= SVM_SEV_FEAT_SNP_ACTIVE | + SVM_SEV_FEAT_BTB_ISOLATION; if (tsc_khz && cpu_feature_enabled(X86_FEATURE_SNP_SECURE_TSC)) sev_supported_vmsa_features |= SVM_SEV_FEAT_SECURE_TSC; -- 2.43.0