Re: Verifying Execution Integrity in Untrusted hypervisors

Paolo Bonzini
2014-07-28T20:27:50Z

Il 28/07/2014 20:31, Jan Kiszka ha scritto:
> The hypervisor has full control of and insight into the guest vCPU
> state. Only protecting some portions of guest memory seems insufficient.
>
> We rather need encryption of every data that leaves the CPU or moves
> from guest to host mode (and decryption the other way around). I guess
> that would have quite some performance impact and is far from being easy
> to integrate into modern processors. But, who knows...

Intel SGX sounds somewhat like what you describe, but I'm not sure how
it's going to be virtualized.

Paolo