Re: [PATCH 1/2] OvmfPkg/OvmfPkgX64: Add SEV launch secret and hashes table areas to MEMFD

["Dov Murik" <dovmurik@linux.ibm.com>]

On 02/11/2021 15:29, Gerd Hoffmann wrote:
>   Hi,
> 
>>> I'm wondering whenever you actually tried to boot a sev guest
>>> in microvm?
>>
>> No I haven't tried.  Do you want Microvm to be able to boot SEV guests,
>> or do you intentionally want to keep functionality out so it stays small?
> 
> Need to look at it on a case by case base.  It is clearly not a
> priority, but if it makes sense we can discuss adding it.
> 
> microvm has no support for SMM mode, and that is unlikely to change,
> so anything requiring SMM mode is not going to work, thats why I dropped
> SMM + secure boot + TPM bits for the initial patch series.
> 
> Having support for tpm makes sense even without secure boot, so we might
> bring that back, but it'll also require some (small) changes on the host
> side so qemu allows creating a tpm, generates acpi tables for the tpm etc.
> 
> Does SEV need and/or use SMM mode?  Looking through AmdSevX64.dsc
> doesn't give a clear answer, on one hand there is a
> LibraryClasses.common.SMM_CORE section, but on the other hand it uses
> the non-SMM variable driver stack.

I think SEV doesn't work with SMM.  James - can you please give a more
definitive answer here?

-Dov