Re: [PATCH 1/2] OvmfPkg/OvmfPkgX64: Add SEV launch secret and hashes table areas to MEMFD

["Gerd Hoffmann" <kraxel@redhat.com>]

  Hi,

> > I'm wondering whenever you actually tried to boot a sev guest
> > in microvm?
> 
> No I haven't tried.  Do you want Microvm to be able to boot SEV guests,
> or do you intentionally want to keep functionality out so it stays small?

Need to look at it on a case by case base.  It is clearly not a
priority, but if it makes sense we can discuss adding it.

microvm has no support for SMM mode, and that is unlikely to change,
so anything requiring SMM mode is not going to work, thats why I dropped
SMM + secure boot + TPM bits for the initial patch series.

Having support for tpm makes sense even without secure boot, so we might
bring that back, but it'll also require some (small) changes on the host
side so qemu allows creating a tpm, generates acpi tables for the tpm etc.

Does SEV need and/or use SMM mode?  Looking through AmdSevX64.dsc
doesn't give a clear answer, on one hand there is a
LibraryClasses.common.SMM_CORE section, but on the other hand it uses
the non-SMM variable driver stack.

take care,
  Gerd