Re: separate OVMF binary for TDX? [was: OvmfPkg: Reserve the Secrets and Cpuid page for the SEV-SNP guest]


Paolo Bonzini
 

On 15/04/21 01:34, Erdem Aktas wrote:
We do not want to generate different binaries for AMD, Intel, Intel
with TDX, AMD with SEV/SNP etc
My question is why the user would want a single binary for VMs with and without TDX/SNP. I know there is attestation, but why would you even want the _possibility_ that your guest starts running without TDX or SNP protection, and only find out later via attestation?

For a similar reason, OVMF already supports shipping a binary that fails to boot if SMM is not available to the firmware, because then secure boot would be trivially circumvented.

I can understand having a single binary for both TDX or SNP. That's not a problem since you can set up the SEV startup VMSA to 32-bit protected mode just like TDX wants.

therefore we were expecting the TDX
changes to be part of the upstream code.
Having 1 or more binaries should be unrelated to the changes being upstream (or more likely, I am misunderstanding you).

Thanks,

Paolo

Join devel@edk2.groups.io to automatically receive all group messages.