@david_chisnall@infosec.exchange
2026-09-25 16:19 UTC
@lobocode@hachyderm.io
Do you know which iteration of SEV this is?
SEV was trivially broken even before it was released.
SEV-ES fixed the obvious bugs but still required a trusted hypervisor and had some weaknesses.
SEV-SNP finally closed most of the obvious vulnerabilities (though they messed up a load of things that should have been in everyone's threat model if they'd actually understood the problem) but also requires a lot more from the hypervisor because it properly enforces exclusive ownership via the RMT.
Replies (1)
-
@lobocode@hachyderm.io 2026-09-25 16:24
@david_chisnall@infosec.exchange From what I understood during the lecture, this initial implementation in `bhyve` focuses specifically on the 1st generation of AMD SEV (basic RAM encryption). Support for SEV-ES and SEV-SNP isn't in this version yet, but moving to those newer generations is on the roadmap as the next major milestone.