Confidential Computing guest support (AMD SEV-SNP, Intel TDX, Arm CCA, pKVM)
Guest-side support for confidential virtual machines, where the VM's memory is encrypted and attested by the CPU so the host hypervisor cannot read or tamper with it. It covers AMD SEV-SNP on EPYC, Intel TDX on 4th Gen Xeon and later, Arm's Confidential Compute Architecture, and pKVM, and is used today by cloud providers offering confidential-VM instances.
recommendation
It should stay because this is the active in-tree home for Linux guests running inside hardware-encrypted, attestation-capable VMs on current Intel Xeon (4th Gen and newer, via TDX) and AMD EPYC (via SEV-SNP) server CPUs, plus emerging Arm CCA and pKVM equivalents. Upstream commits continue into 2026 and the documentation for both SEV and TDX guest ABIs is maintained, with no removal discussion visible on the mailing lists.
repository signals
sources
- git.kernel.org
The directory is under active upstream development; local git history shows substantive commits through 2026-01-23, not a dormant legacy driver.
- docs.kernel.org
Upstream kernel documentation covers a current SEV-SNP guest ABI under drivers/virt/coco, indicating maintained in-tree functionality for AMD confidential VMs.
- docs.kernel.org
Upstream kernel documentation covers a current Intel TDX guest ABI under drivers/virt/coco, indicating maintained in-tree functionality for Intel confidential VMs.
- intel.com
Intel states TDX is present from 4th Gen Xeon onward and on newer generations, showing the hardware class is current rather than obsolete.
- amd.com
AMD documents SEV/SEV-SNP across multiple EPYC generations including 8004/9004/9005, showing ongoing new-platform relevance.
codex reasoning notes (technical)
Not an early-exit case: this is an active confidential-computing guest-driver family directory, even though it also contains umbrella Kconfig/Makefile glue. Local shell inspection showed multiple real driver subdirs plus tsm-core, and local `git log` showed recent substantive activity through 2026-01-23; the kernel.org log URL is a canonical-recall companion for that shell-derived history. `web.search_query` obtained the docs.kernel.org SEV and TDX pages and official Intel/AMD pages. A direct `web.search_query` against lore.kernel.org for this area returned no results for removal/deprecation terms, so there is no visible removal signal in the evidence gathered. Deployment is best rated medium: confidential VMs are still niche versus generic virt, but they are actively deployed in cloud/server environments and tied to currently sold Xeon and EPYC generations.