docs,dev-docs: document firmware upgrades and change of PIID - #2590
Open
sespiros wants to merge 2 commits into
Open
docs,dev-docs: document firmware upgrades and change of PIID#2590sespiros wants to merge 2 commits into
sespiros wants to merge 2 commits into
Conversation
The values in dev-docs/e2e/<host>/manifest.json read as one-time setup, but a firmware update invalidates them. It regenerates the platform's SGX keys, which changes the PIID and leaves the host unable to produce quotes until it's registered with Intel again, and swapping the TDX module changes MrSeam. Signed-off-by: Spyros Seimenis <sse@edgeless.systems>
Updating platform firmware can regenerate a TDX host's SGX provisioning keys. The platform then has a new PPID, QE ID and PIID, Intel won't issue PCK certificates for it until it's registered again, and the host can't produce quotes at all until then. MrSeam and AllowedPIIDs both go stale. Nothing in the docs said so, and it isn't obvious from the failure: the host boots normally, TDX initialises, and only quote generation breaks.
sespiros
added
no changelog
Do the documentation changes need to be backported?Changes to
|
charludo
approved these changes
Aug 18, 2026
charludo
left a comment
charludo
left a comment
Collaborator
There was a problem hiding this comment.
(approved, pending the discussions with Thomas in the wiki)
| :::warning | ||
|
|
||
| The `PIID` is derived from the platform's SGX provisioning keys. | ||
| Updating the platform firmware can regenerate those keys, which changes the `PIID` and requires the platform to be registered with Intel again. |
Collaborator
There was a problem hiding this comment.
Suggested change
| Updating the platform firmware can regenerate those keys, which changes the `PIID` and requires the platform to be registered with Intel again. | |
| Updating the platform firmware can regenerate those keys, which changes the `PIID` and requires the platform to be re-registered with Intel. |
|
|
||
| The `PIID` is derived from the platform's SGX provisioning keys. | ||
| Updating the platform firmware can regenerate those keys, which changes the `PIID` and requires the platform to be registered with Intel again. | ||
| Until it's registered, Intel doesn't issue PCK certificates for the platform, so it can't produce quotes at all. |
Collaborator
There was a problem hiding this comment.
Suggested change
| Until it's registered, Intel doesn't issue PCK certificates for the platform, so it can't produce quotes at all. | |
| Until the re-registration is completed, Intel doesn't issue PCK certificates for the platform, which therefore can't produce quotes at all. |
Nit: too many it's :D
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.