Supported Platforms
Supported platforms
Sylica provides confidential VM firmware for AMD SEV-SNP and Intel TDX. Each platform is defined by a dedicated build configuration and produces a unified CVMF.fd firmware image.
The platform variants are available in three configurations:
Standard Sylica firmware
OSS or basic-feature firmware
ESP-support firmware (work in progress)
Platform overview
sylica-sev
AMD SEV-SNP
SylicaOss/SylicaPkgSev.dsc
CVMF.fd
Sylica firmware for AMD SEV-SNP
sylica-sev-oss
AMD SEV-SNP
SylicaOss/SylicaPkgSev.dsc
CVMF.fd
AMD SEV-SNP firmware with basic features
sylica-sev-esp
AMD SEV-SNP
SylicaOss/SylicaPkgSev.dsc
CVMF.fd
AMD SEV-SNP firmware with ESP support
sylica-tdx
Intel TDX
SylicaOss/SylicaPkgTdx.dsc
CVMF.fd
Sylica firmware for Intel TDX
sylica-tdx-oss
Intel TDX
SylicaOss/SylicaPkgTdx.dsc
CVMF.fd
Intel TDX firmware with basic features
sylica-tdx-esp
Intel TDX
SylicaOss/SylicaPkgTdx.dsc
CVMF.fd
Intel TDX firmware with ESP support
All six platform variants use CVMF.fd as their firmware output.
AMD SEV-SNP
sylica-sev
sylica-sev is the primary AMD SEV-SNP platform. It is built from SylicaPkg, Sylica’s edk2 platform package.
Compared with the upstream edk2 AmdSev implementation, it includes:
Secure Boot enabled
Dynamic stack cookies
Sylica’s platform boot manager
The platform uses:
The resulting firmware image is:
The SEV-SNP firmware is intended for AMD confidential VMs where the firmware contributes to the VM launch measurement and is subsequently verified through remote attestation.
sylica-sev-oss
sylica-sev-oss provides the AMD SEV-SNP firmware with the project’s basic feature set.
Use this variant when the deployment requires the core confidential VM firmware functionality without the additional ESP-specific configuration.
sylica-sev-esp
sylica-sev-esp provides the AMD SEV-SNP firmware with ESP support.
Use this variant when the guest boot or deployment architecture requires the ESP-related functionality provided by this platform configuration.
Intel TDX
sylica-tdx
sylica-tdx is the primary Intel TDX platform. It is based on the upstream edk2 Intel TDX configuration:
Sylica’s TDX platform is built using:
Compared with the upstream Intel TDX implementation, it includes:
GenericQemuLoadImageLibinstead ofX86QemuLoadImageLibThe
CVMF_TDXflash-device name
The output image is:
TDX launch measurements are not currently computed. The firmware hash is available, but TDX measurement verification must account for this current limitation.
sylica-tdx-oss
sylica-tdx-oss provides the Intel TDX firmware with basic features.
Use this variant when the deployment requires the core TDX firmware functionality without the additional ESP-specific configuration.
sylica-tdx-esp
sylica-tdx-esp provides the Intel TDX firmware with ESP support.
Use this variant when ESP support is required by the guest boot or deployment design.
Debug and upstream reference platforms
In addition to the Sylica platforms, the project provides upstream reference builds:
debug-sev
OvmfPkg/AmdSev/AmdSevX64.dsc
OVMF.fd
Unmodified upstream edk2 AmdSev build
debug-tdx
OvmfPkg/IntelTdx/IntelTdxX64.dsc
OVMF.fd
Unmodified upstream edk2 Intel TDX build
These builds contain no Sylica-specific code. They have two roles:
Reproducibility canary They help determine whether a build failure originates in shared infrastructure, the toolchain, the container, or the edk2 revision.
Reference firmware They provide a known upstream baseline for comparing boot behavior, firmware hashes, measurements, and platform-specific changes.
The debug platforms are intended for troubleshooting and comparison. They should not be used as substitutes for the corresponding Sylica production platform.
Choosing a platform
Choose the platform based on the confidential-computing technology provided by the host:
AMD SEV-SNP
sylica-sev
AMD SEV-SNP with basic features
sylica-sev-oss
AMD SEV-SNP with ESP support
sylica-sev-esp
Intel TDX
sylica-tdx
Intel TDX with basic features
sylica-tdx-oss
Intel TDX with ESP support
sylica-tdx-esp
Upstream AMD SEV comparison
debug-sev
Upstream Intel TDX comparison
debug-tdx
Do not select a platform based solely on the guest operating system. The firmware must match the confidential-computing technology supported by the underlying hardware and VM runtime.
Firmware image format
All Sylica platform variants produce:
CVMF.fd is a unified single-file firmware image containing the firmware code and variable store. It is passed to QEMU with -bios.
The unified image is used because a writable variable store outside the launch measurement could make the measured firmware state more difficult to verify. The upstream debug platforms retain the OVMF.fd filename.
Platform measurements
The platform firmware contributes to the confidential VM’s measured launch state.
For AMD SEV-SNP, the expected launch measurement can depend on the selected firmware and VM configuration. The verification process should therefore record the complete deployment configuration, including relevant vCPU, CPU, kernel, initrd, and command-line settings.
For Intel TDX, the project currently provides the firmware hash but does not yet compute TDX launch measurements. TDX deployments should therefore follow the platform’s documented verification status and should not assume that the SEV-SNP measurement workflow applies unchanged.
Platform status
AMD SEV-SNP
Available through standard, OSS, and ESP variants
Platform-specific launch measurements available according to the selected configuration
Intel TDX
Available through standard, OSS, and ESP variants
Firmware hash available; TDX launch measurements not currently computed
Debug/reference
Available for SEV and TDX
Used for upstream comparison and reproducibility diagnostics
Summary
Sylica supports:
AMD SEV-SNP
Intel TDX
Basic-feature variants
ESP-support variants
Upstream debug and reference builds
For production Sylica deployments, use the platform variant corresponding to the host’s confidential-computing technology. Use debug-sev and debug-tdx only for upstream comparison, troubleshooting, and reproducibility analysis.
Last updated