On 11/2/21 8:53 AM, Dov Murik wrote:
On 02/11/2021 15:29, Gerd Hoffmann wrote:
Hi,
I'm wondering whenever you actually tried to boot a sev guest
in microvm?
No I haven't tried. Do you want Microvm to be able to boot SEV guests,
or do you intentionally want to keep functionality out so it stays small?
Need to look at it on a case by case base. It is clearly not a
priority, but if it makes sense we can discuss adding it.
microvm has no support for SMM mode, and that is unlikely to change,
so anything requiring SMM mode is not going to work, thats why I dropped
SMM + secure boot + TPM bits for the initial patch series.
Having support for tpm makes sense even without secure boot, so we might
bring that back, but it'll also require some (small) changes on the host
side so qemu allows creating a tpm, generates acpi tables for the tpm etc.
Does SEV need and/or use SMM mode? Looking through AmdSevX64.dsc
doesn't give a clear answer, on one hand there is a
LibraryClasses.common.SMM_CORE section, but on the other hand it uses
the non-SMM variable driver stack.
I think SEV doesn't work with SMM. James - can you please give a more
definitive answer here?
SEV works with SMM, but SEV-ES (and likely SEV-SNP) doesn't work with SMM
because of the fact that the hypervisor wants to change the guest register
state to enter SMM, which isn't allowed and results in a VMRUN failure.
It might be possible to get SMM to work by having separate VMSAs for the
SMM state, but it is not anything that really has been investigated too
deeply.
Thanks,
Tom
-Dov
-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.
View/Reply Online (#83136): https://edk2.groups.io/g/devel/message/83136
Mute This Topic: https://groups.io/mt/86761214/21656
Group Owner: devel+ow...@edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub [arch...@mail-archive.com]
-=-=-=-=-=-=-=-=-=-=-=-
