[edk2-devel] separate OVMF binary for TDX? [was: OvmfPkg: Reserve the Secrets and Cpuid page for the SEV-SNP guest]

[Paolo Bonzini]

On 15/04/21 01:34, Erdem Aktas wrote:
> We do not want to generate different binaries for AMD, Intel, Intel
> with TDX, AMD with SEV/SNP etc

My question is why the user would want a single binary for VMs with and 
without TDX/SNP.  I know there is attestation, but why would you even 
want the _possibility_ that your guest starts running without TDX or SNP 
protection, and only find out later via attestation?

For a similar reason, OVMF already supports shipping a binary that fails 
to boot if SMM is not available to the firmware, because then secure 
boot would be trivially circumvented.

I can understand having a single binary for both TDX or SNP.  That's not 
a problem since you can set up the SEV startup VMSA to 32-bit protected 
mode just like TDX wants.

> therefore we were expecting the TDX
> changes to be part of the upstream code.

Having 1 or more binaries should be unrelated to the changes being 
upstream (or more likely, I am misunderstanding you).

Thanks,

Paolo



-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.
View/Reply Online (#74118): https://edk2.groups.io/g/devel/message/74118
Mute This Topic: https://groups.io/mt/81969494/1813853
Group Owner: devel+owner at edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub [edk2-devel-archive at redhat.com]
-=-=-=-=-=-=-=-=-=-=-=-