Announcing the open sourcing of OpenHCL
From the beginning of the cloud computing era, virtualization technology has enabled compute workloads to run as virtual machines (VMs) in a server environment. As hardware has evolved, and new functionality has become available, the software stack has kept VMs running seamlessly, thanks to sophisticated advances in the hypervisor and virtualization software. Confidential Computing is a powerful technology for significantly improving the security of VMs running in the cloud. However, the trust boundary of a Confidential VM imposes a barrier that prevents the hypervisor from offering the rich virtualization services that VMs normally expect. Customers desiring the benefits of Confidential VMs are therefore forced to update the operating systems of their VMs to newer versions, which must be continually revised as Confidential VM technology maintains its path of rapid evolution. Microsoft has embraced a different approach that offers much more flexibility to customers through the use of a “paravisor”. A paravisor executes within the confidential trust boundary and provides the virtualization and device services needed by a general-purpose operating system (OS), enabling existing VM workloads to execute securely without requiring continual update of the OS to take advantage of innovative advances in Confidential Computing. As Confidential Computing evolves, the software stack can keep VMs running seamlessly thanks to the paravisor, in much the same way other advances in virtualization software kept VMs running seamlessly on ever evolving hardware. Introducing OpenHCL Microsoft developed the first paravisor in the industry, and for years, we have been enhancing the paravisor offered to Azure customers. This effort now culminates in the release of a new, open source paravisor, called OpenHCL. We plan to develop OpenHCL in the open here: microsoft/openvmm: Home of OpenVMM and OpenHCL (github.com). Today, OpenHCL can run on both x86-64 and ARM64 platforms, it has support for Intel TDX and AMD SEV-SNP, and it offers a rich set of powerful services to VMs including device emulation via standard device interfaces, device translation via standard device interfaces, diagnostics and support for guests that are not fully enlightened - such as Windows and older versions of Linux - to run via standard architectural interfaces. OpenHCL is used in Azure in new Azure Boost SKUs, and it will be used in future Confidential VM SKUs. In the past month alone, over 1.5 Million VMs were running with OpenHCL in Azure. Open for collaboration We have much more we plan to do with OpenHCL, and as we develop new functionality in the open, we would love to collaborate with you. You can learn more about OpenHCL in our extended blog OpenHCL: the new, open source paravisor - Microsoft Community Hub as well as in https://openvmm.dev. - Core OS team.
