KVM With Linux 5.11 Brings AMD SEV-ES Host Support
Exciting of these KVM changes for what will be the first major Linux release of 2021 is supporting AMD SEV-ES on the host side. Linux has already seen bring-up work for AMD SEV-ES, the Secure Encrypted Virtualization Encrypted State functionality.
SEV-ES builds off the base AMD SEV to also encrypt CPU register contents when exiting a virtual machine to ensure there is no register information leakage to the hypervisor. SEV-ES can also detect malicious modifications to the CPU register state. AMD and others have been working on the SEV-ES support for a while and with Linux 5.11 there is the host-side support with KVM for this more advanced SEV functionality found with EPYC processors.
In addition to the KVM SEV-ES support, other x86 (x86_64) changes include a feature flag for AVX-512 FP16, reporting dirty pages to user-space via a ring buffer, a new ioctl to report Microsoft Hyper-V compatible para-virtualization features, and more.
KVM on the ARM side also is seeing a number of improvements including new exception injection code, simplifying the AArch32 system register state handling, exposing CSV3 on non-Meltdown hosts, and more. The list of KVM changes for Linux 5.11 via this pull.
Add A Comment
