Re:AMD's Hidden Strategy
by paulmd on Saturday February 03, 2018 @03:12PM
(#16299350)
> SEV allows encryption of a VM’s memory, further mitigating read attacks
This is incorrect. Spectre works at a cache level, memory is decrypted by that point - if it were encrypted you couldn't use it for the good kind of speculation either. This means SEV doesn't do anything in particular here, effectively the victim is decrypting its RAM for you.
The point of SEV is to make memory inaccessible after shutdown, whether that's physical (cold boot attacks) or virtual (VM instances reusing host memory). Not for Spectre.
This is incorrect. Spectre works at a cache level, memory is decrypted by that point - if it were encrypted you couldn't use it for the good kind of speculation either. This means SEV doesn't do anything in particular here, effectively the victim is decrypting its RAM for you.
The point of SEV is to make memory inaccessible after shutdown, whether that's physical (cold boot attacks) or virtual (VM instances reusing host memory). Not for Spectre.