News: 0001540152

  ARM Give a man a fire and he's warm for a day, but set fire to him and he's warm for the rest of his life (Terry Pratchett, Jingo)

Linux 6.16 Could See AMD SEV-SNP SVSM vTPM Driver Merged For EPYC CPUs

([Virtualization] 3 Hours Ago SNP SVSM vTPM Driver)


The Linux 6.16 kernel this summer will likely see the new SNP SVSM vTPM driver introduced for further enhancing the AMD EPYC confidential computing capabilities atop the mainline Linux kernel.

Queued this week via the [1]tip/tip.git x86/sev Git branch is this SNP SVSM vTPM driver for recent EPYC CPUs boasting Secure Encrypted Virtualization Secure Nested Paging (SEV-SNP) capabilities. With the driver making it now to a tip/tip.git branch, it will likely be submitted for the next merge window (Linux 6.16 in June) barring any new problems from arising with the code or other objections being raised.

Stefano Garzarella of Red Hat spearheaded the effort on this new Linux driver for helping the AMD virtualization confidential computing effort. Stefano explains of this new driver in [2]the patch series now queued in the TIP branch:

"AMD SEV-SNP defined a new mechanism for adding privileged levels (VMPLs) in the context of a Confidential VM. These levels can be used to run the guest OS at a lower privilege level than a Secure VM Service Module (SVSM). In this way SVSM can be used to emulate those devices (such as TPM) that cannot be delegated to an untrusted host.

The guest OS can talk to SVSM using a specific calling convention and instructions (a kind of system call/hyper call) and request services such as TPM emulation.

The main goal of this series is to add a driver for the vTPM defined by the AMD SVSM spec. The specification defines a protocol that a

SEV-SNP guest OS (running on VMPL >= 1) can use to discover and talk to a vTPM emulated by the SVSM in the guest context, but at a more

privileged level (VMPL0).

This series is based on the RFC sent by James last year. In the meantime, the patches have been maintained and tested in the Coconut Linux fork along with the work to support the vTPM emulation in Coconut SVSM."

This new driver is gated by the TCG_SVSM Kconfig switch.

Nice to see more of the AMD SEV-SNP / Trusted Computing / Confidential Computing work nearing the mainline kernel. Like with Intel and their Trust Domain Extensions (TDX) enablement, some elements of the upstreaming have dragged on for quite some time and multiple rounds of code review.



[1] https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git/log/?h=x86/sev

[2] https://lore.kernel.org/all/20250410135118.133240-1-sgarzare@redhat.com/


phoronix

On a morning from a Bogart movie, in a country where they turned back time,
You go strolling through the crowd like Peter Lorre contemplating a crime.
She comes out of the sun in a silk dress running like a watercolor in the rain.
Don't bother asking for explanations, she'll just tell you that she came
In the Year of the Cat.

She doesn't give you time for questions, as she locks up your arm in hers,
And you follow 'till your sense of which direction completely disappears.
By the blue-tiled walls near the market stall there's a hidden door she
leads you to.
These days, she say, I feel my life just like a river running through
The Year of the Cat.

Well, she looks at you so coolly,
And her eyes shine like the moon in the sea.
She comes in incense and patchouli,
So you take her to find what's waiting inside
The Year of the Cat.

Well, morning comes and you're still with her, but the bus and the tourists
are gone,
And you've thrown away your choice and lost your ticket, so you have to stay on.
But the drum-beat strains of the night remain in the rhythm of the new-born day.
You know some time you're bound to leave her, but for now you're going to stay
In the Year of the Cat.
-- Al Stewart, "Year of the Cat"