AMD EPYC 9006 Venice Gets Linux Patches for Secure PCIe VM Access

Cloud providers running virtual machines face a persistent risk: host drivers can accidentally or maliciously see sensitive guest data. AMD addresses this gap by submitting 17 Linux kernel patches that enable secure direct access to PCIe devices for its EPYC 9006 "Venice" processors. This update matters to enterprise buyers because it allows virtual machines to bypass the host operating system when accessing hardware, significantly reducing the attack surface for data leaks.

New kernel patches let virtual machines bypass host drivers for direct hardware access

The core technology behind this change is SEV-TIO TDISP, which stands for Secure Encrypted Virtualization – Trusted I/O with Trusted Device I/O Security Protocol. This feature extends the Trusted Execution Environment, which traditionally protects only CPU and memory, to include PCIe peripherals. By using this protocol, a virtual machine can communicate directly with a network card or storage controller without the host driver ever seeing the raw data.

Implementing this security model requires hardware that supports the latest interface standards. The TDISP feature relies on the PCI Express 6.0 specification or newer revisions to function correctly. AMD submitted these 17 patches to the Linux kernel mailing list to integrate the necessary driver support into the mainline kernel. The patches are currently under public review by kernel maintainers and the broader open-source community.

This initiative is part of a broader industry effort to standardize secure hardware access across different processor architectures. AMD is collaborating with Intel, Arm, and RISC-V to develop a common Trusted Security Manager infrastructure. This cross-platform approach aims to ensure that software written for one architecture can run securely on others without major rewrites. The patches provide the first concrete implementation of this vision for AMD server chips.

This update builds upon AMD's ongoing efforts in confidential computing for its EPYC processors. The current patch set focuses strictly on the software integration required to activate the hardware capabilities. Once merged into the Linux kernel, these changes will allow cloud operators to deploy more secure virtualization environments. The technology is now in the public review phase, with no specific release date confirmed.