Getting Started

This guide shows how to install and run Sylica CVMF (Confidential Virtual Machine Firmware) with QEMU/KVM.

Platforms

Sylica supports three primary VM environments:

Environment	CVMF platform	Confidential computing
Conventional x86 VM	sylica-x86	None
AMD SEV-SNP VM	sylica-sev	AMD SEV-SNP
Intel TDX VM	sylica-tdx	Intel TDX

For a first test, start with sylica-x86. It runs on conventional x86 KVM/QEMU hosts and does not require confidential-computing hardware.

                     Sylica CVMF

                         CVMF.fd
                            │
            ┌───────────────┼───────────────┐
            │               │               │
            ▼               ▼               ▼
       sylica-x86       sylica-sev      sylica-tdx
            │               │               │
            ▼               ▼               ▼
      Standard VM        AMD SNP         Intel TDX

sylica-x86 provides the same reduced and controlled firmware computing base used by Sylica's confidential-computing firmware without requiring SEV-SNP or TDX.

See Platforms and Compatibility for details about the available CVMF variants.

Comparing the three launch modes

The differences between the QEMU configurations are small at the firmware interface but significant at the hardware security layer.

Configuration	x86	AMD SEV-SNP	Intel TDX
CVMF.fd	Yes	Yes	Yes
KVM	Yes	Yes	Yes
-cpu host	Recommended	Yes	Yes
Confidential guest object	No	sev-snp-guest	tdx-guest
Hardware CC support	No	AMD SNP	Intel TDX
Hardware attestation	No	SNP report	TDX quote
Custom CVMF firmware	Yes	Yes	Yes

Conceptually:

# Conventional

-machine q35
-bios sylica-x86/CVMF.fd

# SEV-SNP

-object sev-snp-guest,id=sev0,...
-machine q35,confidential-guest-support=sev0
-bios sylica-sev/CVMF.fd

# TDX

-object tdx-guest,id=tdx0
-machine q35,confidential-guest-support=tdx0,kernel-irqchip=split
-bios sylica-tdx/CVMF.fd