On Tue, 2023-04-11 at 14:57 -0500, Tom Lendacky wrote: > On 3/21/23 04:29, Jörg Rödel wrote: > > Hi, > > > > We are happy to announce that last week our secure VM service > > module (SVSM) went public on GitHub for everyone to try it out and > > participate in its further development. It is dual-licensed under > > the MIT and APACHE-2.0 licenses. > > > > The project is written in Rust and can be cloned from: > > > > https://github.com/coconut-svsm/svsm > > > > There are also repositories in the github project with the Linux > > host and guest, EDK2 and QEMU changes needed to run the SVSM and > > boot up a full Linux guest. > > > > The SVSM repository contains an installation guide in the > > INSTALL.md file and contributor hints in CONTRIBUTING.md. > > > > A blog entry with more details is here: > > > > https://www.suse.com/c/suse-open-sources-secure-vm-service- > > module-for-confidential-computing/ > > > > We also thank AMD for implementing and providing the necessary > > changes to Linux and EDK2 to make an SVSM possible. > > Just wanted to let everyone know that I'm looking into what we can do > to move towards a single SVSM project so that resources aren't split > between the two. > > I was hoping to have a comparison, questions and observations between > the two available by now, however, I'm behind on that... but, I am > working on it. We (IBM) did look at what it might take to add a vTPM to Coconut, but we ran into the problem that if we do it at CPL3 (which looks desirable), then we have to wait until pretty much every one of the twelve(!) tasks in this list is complete: https://github.com/coconut-svsm/svsm/issues/16 At a conservative estimate, it looks like completion of all twelve would take a team of people over a year to achieve. Some of these tasks, like task switching and a syscall interface, really don't look like they belong in a simple service module, like we were imagining an SVSM would operate, is there some rationale behind this (or ideally some architecture document that gives the justifications)? I think what I'm really asking is can we get to CPL3 separation way sooner than completion of all these tasks? Regards, James
