COCONUT Secure VM Service Module Discussion
summary
COCONUT‑SVSM currently boots Linux guest at VMPL2 on AMD SEV‑SNP hardware, implements core protocol pieces and is around 12,000 lines of Rust with enforced rustfmt and clippy checks and Miri safety runs; next priorities are getting CPL3 and a VTPM running in CPL3, adding a persistence layer (encrypted, integrity‑protected, key provisioned and with per‑component access controls), removing the current direct map and replacing fallible allocations with fallible smart pointers until Rust exposes stable APIs.
AI-written summary · about
chapters (8)
- 0:00Introduction and welcome
- 0:22Current state of SVSM
- 1:27Roadmap and priorities
- 2:30IGM format benefits
- 4:13Open problems and discussion
- 7:27Governance and maintainership
- 8:11Future use cases
- 9:18Q&A and discussion
related talks
45mSecuring Confidential VMs with COCONUT-SVSM
28mProviding Confidential Guest Services with a Secure VM Service Module on AMD
23mDemystifying Confidential Computing: An update for enthusiasts & professionals
17mVeriSMo: A Verified Security Module for Confidential VMs
32mLVBS and Advanced Kernel Integrity
11mTrusted in-guest hypervisor services with secure VM service module
16mNesting Secure VM Hosts
21mOak stage0: a minimal firmware for (confidential) virtual machines