alioth/docs/coco.md

Confidential Compute (coco)

Alioth supports booting confidential guests on the following platforms:

• AMD-SEV ¹

AMD-SEV guest with Oak/Stage0 firmware

WARNING: the current implementation takes QEMU ² as a reference and should be used in testing environments only.

To launch an SEV guest,

1. build the stage0 firmware from the Oak project³,
2. prepare the guest Linux kernel of ELF format, the initramfs, and the kernel command line in a text file,
3. for SEV guests, POLICY=0x1, for SEV-ES guests, POLICY=0x5,
4. launch the guest by

   ./alioth run -f /path/to/oak_stage0.bin \
       --mem-size 1G \
       --num-cpu 2 \
       --fw-cfg name=opt/stage0/elf_kernel,file=/path/to/elf_kernel \
       --fw-cfg name=opt/stage0/initramfs,file=/path/to/initramfs \
       --fw-cfg name=opt/stage0/cmdline,file=/path/to/cmdline.txt \
       --coco sev,policy=$POLICY
   

---

1. AMD Secure Encrypted Virtualization (SEV) ↩︎

2. QEMU's doc on SEV ↩︎

3. Oak/stage0 firmware ↩︎