AMD With Upstream Linux Nears "The Ultimate Goal Of Confidential Computing"
Last week all of the AMD Secure Encrypted Virtualization (SEV) updates for targeting the Linux 6.9 kernel merge window were merged. This follows much upstreaming work over the past several years by AMD for SEV and their SEV-ES (Encrypted State) and SEV-SNP (Secure Nested Paging) extensions on newer EPYC processors.
AMD Linux engineer Borislav Petkov summed up the new SEV material for Linux 6.9 as:
"Add the x86 part of the SEV-SNP host support. This will allow the kernel to be used as a KVM hypervisor capable of running SNP (Secure Nested Paging) guests. Roughly speaking, SEV-SNP is the ultimate goal of the AMD confidential computing side, providing the most comprehensive confidential computing environment up to date.
This is the x86 part and there is a KVM part which did not get ready in time for the merge window so latter will be forthcoming in the next cycle."
It's too bad the KVM portion for SEV-SNP didn't make it upstream for Linux 6.9 but at least from the sounds of it will cross the finish line then come Linux 6.10 over the summer.
AMD has long maintained the AMDESE/AMDSEV GitHub repository with their latest out-of-tree kernel code around SEV features during this long upstreaming process. Some Linux distribution vendors have also been carrying portions of these patches in their various downstream enterprise kernels, but thankfully the work has been going upstream. A look at the different AMD SEV capabilities as a reminder:
So the x86/sev pull for v6.9 has landed while for end-users / server administrators Linux 6.10 should be the special one for those interested in this "ultimate goal of the AMD confidential computing side, providing the most comprehensive confidential computing environment up to date." Over on the Intel side they too have been busy upstreaming all of their relevant bits around Trust Domain Extensions (TDX).
6 Comments
