logoalt Hacker News

summa_techtoday at 3:18 PM1 replyview on HN

One hopes that a hypervisor would not expose hardware control registers directly in the first place, except ones deliberately designed for virtualization support.

Otherwise, the guest is running effectively at the same privilege level as the hypervisor (that's useful sometimes, but probably not intended in most applications).


Replies

devttyeutoday at 3:23 PM

Yeah, just started looking at this with my team (we run a cloud with VM instance offering on AMD so this very much caught our eye)

So far seems this is about right:

1. You need platform register access, so seems can't KVM-escape with just this

2. Big question is what about breaking Confidential SEV-SNP guests from the host?

show 1 reply