> For the complete documentation index, see [llms.txt](https://docs.enclaive.cloud/sylica/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.enclaive.cloud/sylica/documentation/supported-platforms.md).

# Supported Platforms

## Supported platforms

Sylica provides confidential VM firmware for AMD SEV-SNP and Intel TDX. Each platform is defined by a dedicated build configuration and produces a unified `CVMF.fd` firmware image.

The platform variants are available in three configurations:

* Standard Sylica firmware
* OSS or basic-feature firmware
* ESP-support firmware (work in progress)

### Platform overview

| Platform         | Technology  | Build configuration          | Output    | Description                              |
| ---------------- | ----------- | ---------------------------- | --------- | ---------------------------------------- |
| `sylica-sev`     | AMD SEV-SNP | `SylicaOss/SylicaPkgSev.dsc` | `CVMF.fd` | Sylica firmware for AMD SEV-SNP          |
| `sylica-sev-oss` | AMD SEV-SNP | `SylicaOss/SylicaPkgSev.dsc` | `CVMF.fd` | AMD SEV-SNP firmware with basic features |
| `sylica-sev-esp` | AMD SEV-SNP | `SylicaOss/SylicaPkgSev.dsc` | `CVMF.fd` | AMD SEV-SNP firmware with ESP support    |
| `sylica-tdx`     | Intel TDX   | `SylicaOss/SylicaPkgTdx.dsc` | `CVMF.fd` | Sylica firmware for Intel TDX            |
| `sylica-tdx-oss` | Intel TDX   | `SylicaOss/SylicaPkgTdx.dsc` | `CVMF.fd` | Intel TDX firmware with basic features   |
| `sylica-tdx-esp` | Intel TDX   | `SylicaOss/SylicaPkgTdx.dsc` | `CVMF.fd` | Intel TDX firmware with ESP support      |

All six platform variants use `CVMF.fd` as their firmware output.

### AMD SEV-SNP

#### `sylica-sev`

`sylica-sev` is the primary AMD SEV-SNP platform. It is built from `SylicaPkg`, Sylica’s edk2 platform package.

Compared with the upstream edk2 AmdSev implementation, it includes:

* Secure Boot enabled
* Dynamic stack cookies
* Sylica’s platform boot manager

The platform uses:

```
SylicaPkg/SylicaPkgSev.dsc
```

The resulting firmware image is:

```
CVMF.fd
```

The SEV-SNP firmware is intended for AMD confidential VMs where the firmware contributes to the VM launch measurement and is subsequently verified through remote attestation.

#### `sylica-sev-oss`

`sylica-sev-oss` provides the AMD SEV-SNP firmware with the project’s basic feature set.

Use this variant when the deployment requires the core confidential VM firmware functionality without the additional ESP-specific configuration.

#### `sylica-sev-esp`

`sylica-sev-esp` provides the AMD SEV-SNP firmware with ESP support.

Use this variant when the guest boot or deployment architecture requires the ESP-related functionality provided by this platform configuration.

### Intel TDX

#### `sylica-tdx`

`sylica-tdx` is the primary Intel TDX platform. It is based on the upstream edk2 Intel TDX configuration:

```
OvmfPkg/IntelTdx/IntelTdxX64.dsc
```

Sylica’s TDX platform is built using:

```
SylicaPkg/SylicaPkgTdx.dsc
```

Compared with the upstream Intel TDX implementation, it includes:

* `GenericQemuLoadImageLib` instead of `X86QemuLoadImageLib`
* The `CVMF_TDX` flash-device name

The output image is:

```
CVMF.fd
```

TDX launch measurements are not currently computed. The firmware hash is available, but TDX measurement verification must account for this current limitation.

#### `sylica-tdx-oss`

`sylica-tdx-oss` provides the Intel TDX firmware with basic features.

Use this variant when the deployment requires the core TDX firmware functionality without the additional ESP-specific configuration.

#### `sylica-tdx-esp`

`sylica-tdx-esp` provides the Intel TDX firmware with ESP support.

Use this variant when ESP support is required by the guest boot or deployment design.

### Debug and upstream reference platforms

In addition to the Sylica platforms, the project provides upstream reference builds:

| Platform    | Build configuration                | Output    | Purpose                                  |
| ----------- | ---------------------------------- | --------- | ---------------------------------------- |
| `debug-sev` | `OvmfPkg/AmdSev/AmdSevX64.dsc`     | `OVMF.fd` | Unmodified upstream edk2 AmdSev build    |
| `debug-tdx` | `OvmfPkg/IntelTdx/IntelTdxX64.dsc` | `OVMF.fd` | Unmodified upstream edk2 Intel TDX build |

These builds contain no Sylica-specific code. They have two roles:

1. **Reproducibility canary**\
   They help determine whether a build failure originates in shared infrastructure, the toolchain, the container, or the edk2 revision.
2. **Reference firmware**\
   They provide a known upstream baseline for comparing boot behavior, firmware hashes, measurements, and platform-specific changes.

The debug platforms are intended for troubleshooting and comparison. They should not be used as substitutes for the corresponding Sylica production platform.

### Choosing a platform

Choose the platform based on the confidential-computing technology provided by the host:

| Host technology                 | Recommended platform |
| ------------------------------- | -------------------- |
| AMD SEV-SNP                     | `sylica-sev`         |
| AMD SEV-SNP with basic features | `sylica-sev-oss`     |
| AMD SEV-SNP with ESP support    | `sylica-sev-esp`     |
| Intel TDX                       | `sylica-tdx`         |
| Intel TDX with basic features   | `sylica-tdx-oss`     |
| Intel TDX with ESP support      | `sylica-tdx-esp`     |
| Upstream AMD SEV comparison     | `debug-sev`          |
| Upstream Intel TDX comparison   | `debug-tdx`          |

Do not select a platform based solely on the guest operating system. The firmware must match the confidential-computing technology supported by the underlying hardware and VM runtime.

### Firmware image format

All Sylica platform variants produce:

```
CVMF.fd
```

`CVMF.fd` is a unified single-file firmware image containing the firmware code and variable store. It is passed to QEMU with `-bios`.

The unified image is used because a writable variable store outside the launch measurement could make the measured firmware state more difficult to verify. The upstream debug platforms retain the `OVMF.fd` filename.

### Platform measurements

The platform firmware contributes to the confidential VM’s measured launch state.

For AMD SEV-SNP, the expected launch measurement can depend on the selected firmware and VM configuration. The verification process should therefore record the complete deployment configuration, including relevant vCPU, CPU, kernel, initrd, and command-line settings.

For Intel TDX, the project currently provides the firmware hash but does not yet compute TDX launch measurements. TDX deployments should therefore follow the platform’s documented verification status and should not assume that the SEV-SNP measurement workflow applies unchanged.

### Platform status

| Platform family | Firmware availability                             | Measurement status                                                                      |
| --------------- | ------------------------------------------------- | --------------------------------------------------------------------------------------- |
| AMD SEV-SNP     | Available through standard, OSS, and ESP variants | Platform-specific launch measurements available according to the selected configuration |
| Intel TDX       | Available through standard, OSS, and ESP variants | Firmware hash available; TDX launch measurements not currently computed                 |
| Debug/reference | Available for SEV and TDX                         | Used for upstream comparison and reproducibility diagnostics                            |

### Summary

Sylica supports:

* AMD SEV-SNP
* Intel TDX
* Basic-feature variants
* ESP-support variants
* Upstream debug and reference builds

For production Sylica deployments, use the platform variant corresponding to the host’s confidential-computing technology. Use `debug-sev` and `debug-tdx` only for upstream comparison, troubleshooting, and reproducibility analysis.