The two attack vectors are page table integrity and unencrypted VM state. Modifying the page tables to establish a cryptographic merkle tree would fix the firs

The two attack vectors are page table integrity and unencrypted VM state. Modifying the page tables to establish a cryptographic merkle tree would fix the first attack, and SEV-ES fixes the secrecy attack from the second paper. Unfortunately a change to page table structure may make it impossible to run unmodified kernels in the VM. I think it as impossible to prevent a hypervisor from fingerprinting what's running on a child VM; there are too many timing and power attacks to ever mitigate that, which was the attack vector on SEV-ES