In reality, StandaloneMm manages secure IO resources such as Flash memory, secure RAS IP. Their use-cases are:

StandaloneMm implements secure NV-variable that stores confidential information such as platform private key.
RAS drivers in StandaloneMm to monitor HW IPs that contains sensitive information.

Those information can not be read or known to EDK2 (Host), they may be HW-protected by SOC. Currently there are no ways in CoVE Spec to allow defining such IO resources. The following are changes that needed in CoVE Spec:

Via CoVG Extension, adding API to add/remove confidential IO range for a TVM.
- When TSM receives request, it forward to EDK2(Host) to get permission of this request.
- If Host accepts the request, TVM should maps the resource for that TVM and TVM can access resource directly. The resource can be treated as confidential memory that no other TVMs or EDK2(Host) can access it. To protect the resource from being attached, end-to-end encryption, IOPMP, IOMMU can be used by TSM depending on capacities support of the running HW.
- Guest can request to remove the resource when not need it anymore.

Browser not supported