Intel TDX and TME-MT/TDX key split

[DontKillRobots]

I am trying to build a small private cloud of TD VMs using TDX. My host machine currently has 2× Intel Xeon Gold 5515+.

In the bios, if TME-MT/TDX key split set to 1 I could run 31 guests on the host. Setting the split higher would get it all the way up to 62 TDX keys 1 TME-MT key and the number of hosts i can spawn would reflect that up to 62 keys. This led to 2 questions because after reading documentation on this I am still trying to understand it completly. 

1. What are the security implications of setting the split highly in favor of TDX and only leaving a few keys for TME-MT? From what ive gathered if the server's main purpose is to provide private TDX VMs, it seems like that could be okay. TME-MT keys would only be used in the host but the guest VMs, where the privacy matters, would be using the TDX keys. Any documentation or explanation would be helpful here.

2. Does this mean that every server has a hard cap of 63 guests? It seems the 63 key space is used on every motherboard bios i could find documentation on. So adding more/bigger processors or other server resources to a server could never allow me to scale past 63 TDs on a single server? Is something like the OS or kernal the bottleneck here?

for context im spawning up the guests using the tdvirsh tool from the canonical/tdx repo 

[MACM]

Hello Dalton,

Greetings!

Thank you for your reply. You can refer the document regarding the TDX configuration below.

RDC link : https://www.intel.com/content/www/us/en/resources-documentation/developer.html#gs.5k1ay6

Content ID: 646564

Please note that you need an NDA and an Intel® Developer Zone premier account to access this document as its a confidential document.

How to Apply for an Intel® Resource and Documentation Center (RDC) and/or Intel® Developer Zone (Intel® DevZone) Account:

https://www.intel.com/content/www/us/en/support/articles/000058073/programs/resource-and-documentation-center.html

Please don’t hesitate to contact us for any further assistance.

Thank you for using Intel products and services.

Best Regards,

Mohammed Ali CM

Intel Customer Support Technician

intel.com/vroc

[MACM]

Hello Team,

Thank you for contacting Intel.

This is the first follow-up regarding the issue you reported to us.

We wanted to inquire whether you had the opportunity to review the plan of action we provided.

Feel free to reply to this email, and we'll be more than happy to assist you further.

Regards,

Mohammed Ali CM

Intel Customer Support