<div dir="ltr">This issue only occurs if you do *not* build the runtime in $GOPATH/src/<a href="http://github.com/kata-containers/runtime">github.com/kata-containers/runtime</a>. Hence, build if there if you can :)<div><div><br></div><div>See: <a href="https://github.com/kata-containers/runtime/issues/430">https://github.com/kata-containers/runtime/issues/430</a></div><div><br></div><div>Cheers,</div><div><br></div><div>James</div></div></div><div class="gmail_extra"><br><div class="gmail_quote">2018-06-20 10:04 GMT+01:00 Whaley, Graham <span dir="ltr"><<a href="mailto:graham.whaley@intel.com" target="_blank">graham.whaley@intel.com</a>></span>:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div bgcolor="white" lang="EN-GB" link="blue" vlink="purple">
<div class="m_1337945660320346307WordSection1">
<p class="MsoNormal"><font size="2" color="#1f497d" face="Calibri"><span lang="EN-US" style="font-size:11.0pt;color:#1f497d">Hi Jesse,<u></u><u></u></span></font></p>
<p class="MsoNormal"><font size="2" color="#1f497d" face="Calibri"><span lang="EN-US" style="font-size:11.0pt;color:#1f497d">The normal workflow for submitting PRs to the kata repos is pretty much the standard github way – you fork
the report, make yourself a branch in your fork, do the work there, and push to your fork on github. The github website will then show you a ‘make pull request’ dialog box on both (iirc) your or the main repo home page, and you submit via that (well, that
is what I do ;-).<u></u><u></u></span></font></p>
<p class="MsoNormal"><font size="2" color="#1f497d" face="Calibri"><span lang="EN-US" style="font-size:11.0pt;color:#1f497d"><u></u> <u></u></span></font></p>
<p class="MsoNormal"><b><font size="2" color="#1f497d" face="Calibri"><span lang="EN-US" style="font-size:11.0pt;color:#1f497d;font-weight:bold">Apart</span></font></b><font color="#1f497d"><span lang="EN-US" style="color:#1f497d">
from…. The runtime repo. There is a golang path dependency in the virtcontainers subdir, which means you cannot build it inside your own fork
</span></font><font color="#1f497d" face="Wingdings"><span lang="EN-US" style="font-family:Wingdings;color:#1f497d">L</span></font><font color="#1f497d"><span lang="EN-US" style="color:#1f497d">. So the
workflow there is (and others please correct me if you have a better way)<u></u><u></u></span></font></p>
<p class="m_1337945660320346307MsoListParagraph"><u></u><font size="2" color="#1f497d" face="Calibri"><span lang="EN-US" style="font-size:11.0pt;color:#1f497d"><span>-<font size="1" face="Times New Roman"><span style="font:7.0pt "Times New Roman"">
</span></font></span></span></font><u></u><font color="#1f497d"><span lang="EN-US" style="color:#1f497d">Clone the main repo<u></u><u></u></span></font></p>
<p class="m_1337945660320346307MsoListParagraph"><u></u><font size="2" color="#1f497d" face="Calibri"><span lang="EN-US" style="font-size:11.0pt;color:#1f497d"><span>-<font size="1" face="Times New Roman"><span style="font:7.0pt "Times New Roman"">
</span></font></span></span></font><u></u><font color="#1f497d"><span lang="EN-US" style="color:#1f497d">Make a branch in the main repo (on your local machine)<u></u><u></u></span></font></p>
<p class="m_1337945660320346307MsoListParagraph"><u></u><font size="2" color="#1f497d" face="Calibri"><span lang="EN-US" style="font-size:11.0pt;color:#1f497d"><span>-<font size="1" face="Times New Roman"><span style="font:7.0pt "Times New Roman"">
</span></font></span></span></font><u></u><font color="#1f497d"><span lang="EN-US" style="color:#1f497d">Work within that branch<u></u><u></u></span></font></p>
<p class="m_1337945660320346307MsoListParagraph"><u></u><font size="2" color="#1f497d" face="Calibri"><span lang="EN-US" style="font-size:11.0pt;color:#1f497d"><span>-<font size="1" face="Times New Roman"><span style="font:7.0pt "Times New Roman"">
</span></font></span></span></font><u></u><font color="#1f497d"><span lang="EN-US" style="color:#1f497d">Fork the main repo<u></u><u></u></span></font></p>
<p class="m_1337945660320346307MsoListParagraph"><u></u><font size="2" color="#1f497d" face="Calibri"><span lang="EN-US" style="font-size:11.0pt;color:#1f497d"><span>-<font size="1" face="Times New Roman"><span style="font:7.0pt "Times New Roman"">
</span></font></span></span></font><u></u><font color="#1f497d"><span lang="EN-US" style="color:#1f497d">Add your fork as a remote to your main repo clone<u></u><u></u></span></font></p>
<p class="m_1337945660320346307MsoListParagraph"><u></u><font size="2" color="#1f497d" face="Calibri"><span lang="EN-US" style="font-size:11.0pt;color:#1f497d"><span>-<font size="1" face="Times New Roman"><span style="font:7.0pt "Times New Roman"">
</span></font></span></span></font><u></u><font color="#1f497d"><span lang="EN-US" style="color:#1f497d">Push your working branch to *<b><span style="font-weight:bold">your</span></b>* forked repo (and definitely not back to the
main repo ;-)<u></u><u></u></span></font></p>
<p class="m_1337945660320346307MsoListParagraph"><u></u><font size="2" color="#1f497d" face="Calibri"><span lang="EN-US" style="font-size:11.0pt;color:#1f497d"><span>-<font size="1" face="Times New Roman"><span style="font:7.0pt "Times New Roman"">
</span></font></span></span></font><u></u><font color="#1f497d"><span lang="EN-US" style="color:#1f497d">And then follow the PR submit process above.<u></u><u></u></span></font></p>
<p class="MsoNormal"><font size="2" color="#1f497d" face="Calibri"><span lang="EN-US" style="font-size:11.0pt;color:#1f497d"><u></u> <u></u></span></font></p>
<p class="MsoNormal"><font size="2" color="#1f497d" face="Calibri"><span lang="EN-US" style="font-size:11.0pt;color:#1f497d">I ran into this yesterday ;-), and thought we had documented it – but, I could not find it in either the
kata or CC repos. I somebody knows if we do have that documented, shout! Or, I’ll see if I can add it (but, tbh, it won’t be this week, and then I think it will fall off my radar! I guess I’ll go open an Issue right now at least…)<u></u><u></u></span></font></p>
<p class="MsoNormal"><font size="2" color="#1f497d" face="Calibri"><span lang="EN-US" style="font-size:11.0pt;color:#1f497d"><u></u> <u></u></span></font></p>
<p class="MsoNormal"><font size="2" color="#1f497d" face="Calibri"><span lang="EN-US" style="font-size:11.0pt;color:#1f497d">Graham<u></u><u></u></span></font></p>
<p class="MsoNormal"><a name="m_1337945660320346307__MailEndCompose"><font size="2" color="#1f497d" face="Calibri"><span lang="EN-US" style="font-size:11.0pt;color:#1f497d"><u></u> <u></u></span></font></a></p>
<div style="border:none;border-left:solid blue 1.5pt;padding:0cm 0cm 0cm 4.0pt">
<div>
<div style="border:none;border-top:solid #e1e1e1 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><a name="m_1337945660320346307______replyseparator"></a><b><font size="2" face="Calibri"><span lang="EN-US" style="font-size:11.0pt;font-weight:bold">From:</span></font></b><span lang="EN-US"> Larrew, Jesse [mailto:<a href="mailto:Jesse.Larrew@amd.com" target="_blank">Jesse.Larrew@amd.com</a>]
<br>
<b><span style="font-weight:bold">Sent:</span></b> Tuesday, June 19, 2018 6:57 PM<br>
<b><span style="font-weight:bold">To:</span></b> Ernst, Eric <<a href="mailto:eric.ernst@intel.com" target="_blank">eric.ernst@intel.com</a>><br>
<b><span style="font-weight:bold">Cc:</span></b> Singh, Brijesh <<a href="mailto:brijesh.singh@amd.com" target="_blank">brijesh.singh@amd.com</a>>; Kaplan, David <<a href="mailto:David.Kaplan@amd.com" target="_blank">David.Kaplan@amd.com</a>>; Hollingsworth, Brent <<a href="mailto:brent.hollingsworth@amd.com" target="_blank">brent.hollingsworth@amd.com</a>>; Woller, Thomas <<a href="mailto:thomas.woller@amd.com" target="_blank">thomas.woller@amd.com</a>>; <a href="mailto:kata-dev@lists.katacontainers.io" target="_blank">kata-dev@lists.katacontainers.<wbr>io</a></span></p><div><div class="h5"><br>
<b><span style="font-weight:bold">Subject:</span></b> Re: [kata-dev] Kata with AMD Secure Encrypted Virtualization (SEV)<u></u><u></u></div></div><p></p>
</div>
</div><div><div class="h5">
<p class="MsoNormal"><font size="2" face="Calibri"><span style="font-size:11.0pt"><u></u> <u></u></span></font></p>
<p class="MsoNormal"><font size="2" face="Calibri"><span lang="EN-US" style="font-size:11.0pt">Hi Eric,<u></u><u></u></span></font></p>
<p class="MsoNormal"><font size="2" face="Calibri"><span lang="EN-US" style="font-size:11.0pt"><u></u> <u></u></span></font></p>
<p class="MsoNormal"><font size="2" face="Calibri"><span lang="EN-US" style="font-size:11.0pt">We’re still working on setting up the CI server, but we’ve decided to make the SEV patches available on our github repo so folks can kick the tires, so to speak.<u></u><u></u></span></font></p>
<p class="MsoNormal"><font size="2" face="Calibri"><span lang="EN-US" style="font-size:11.0pt"><u></u> <u></u></span></font></p>
<p class="MsoNormal"><font size="2" face="Calibri"><span lang="EN-US" style="font-size:11.0pt">The SEV patches require a new dependency in the vendor tree and updates a few others:<u></u><u></u></span></font></p>
<ol style="margin-top:0cm" start="1" type="1">
<li class="MsoNormal"><font size="2" face="Calibri"><span lang="EN-US" style="font-size:11.0pt">intel-go/cpuid (new dependency),<u></u><u></u></span></font></li><li class="MsoNormal"><font size="2" face="Calibri"><span lang="EN-US" style="font-size:11.0pt">intel/govmm,<u></u><u></u></span></font></li><li class="MsoNormal"><font size="2" face="Calibri"><span lang="EN-US" style="font-size:11.0pt">virtcontainers<u></u><u></u></span></font></li></ol>
<p class="MsoNormal"><font size="2" face="Calibri"><span lang="EN-US" style="font-size:11.0pt"><u></u> <u></u></span></font></p>
<p class="MsoNormal"><font size="2" face="Calibri"><span lang="EN-US" style="font-size:11.0pt">To submit a PR to kata-runtime, should I first fork each of the above projects and submit PRs against them, then point to those PRs when I submit to kata? This is
the first Go project that I’ve contributed to, so I’m not sure what the protocol is. Any tips would be helpful. Thanks!<u></u><u></u></span></font></p>
<p class="MsoNormal"><font size="2" face="Calibri"><span lang="EN-US" style="font-size:11.0pt"><u></u> <u></u></span></font></p>
<p class="MsoNormal"><font size="2" face="Calibri"><span lang="EN-US" style="font-size:11.0pt">Sincerely,<u></u><u></u></span></font></p>
<p class="MsoNormal"><font size="2" face="Calibri"><span lang="EN-US" style="font-size:11.0pt">Jesse<u></u><u></u></span></font></p>
<p class="MsoNormal"><font size="2" face="Calibri"><span lang="EN-US" style="font-size:11.0pt"><u></u> <u></u></span></font></p>
<div style="border:none;border-left:solid blue 1.5pt;padding:0cm 0cm 0cm 4.0pt">
<div>
<div style="border:none;border-top:solid #e1e1e1 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><font size="2" face="Calibri"><span lang="EN-US" style="font-size:11.0pt;font-weight:bold">From:</span></font></b><span lang="EN-US"> Ernst, Eric [<a href="mailto:eric.ernst@intel.com" target="_blank">mailto:eric.ernst@intel.com</a>]
<br>
<b><span style="font-weight:bold">Sent:</span></b> Wednesday, May 9, 2018 3:45 PM<br>
<b><span style="font-weight:bold">To:</span></b> Larrew, Jesse <<a href="mailto:Jesse.Larrew@amd.com" target="_blank">Jesse.Larrew@amd.com</a>><br>
<b><span style="font-weight:bold">Cc:</span></b> Jon Olson <<a href="mailto:jonolson@google.com" target="_blank">jonolson@google.com</a>>; Singh, Brijesh <<a href="mailto:brijesh.singh@amd.com" target="_blank">brijesh.singh@amd.com</a>>; Kaplan, David <<a href="mailto:David.Kaplan@amd.com" target="_blank">David.Kaplan@amd.com</a>>;
Hollingsworth, Brent <<a href="mailto:brent.hollingsworth@amd.com" target="_blank">brent.hollingsworth@amd.com</a>>;
<a href="mailto:kata-dev@lists.katacontainers.io" target="_blank">kata-dev@lists.katacontainers.<wbr>io</a>; Woller, Thomas <<a href="mailto:thomas.woller@amd.com" target="_blank">thomas.woller@amd.com</a>><br>
<b><span style="font-weight:bold">Subject:</span></b> Re: [kata-dev] Kata with AMD Secure Encrypted Virtualization (SEV)<u></u><u></u></span></p>
</div>
</div>
<p class="MsoNormal"><font size="2" face="Calibri"><span lang="EN-US" style="font-size:11.0pt"><u></u> <u></u></span></font></p>
<p class="MsoNormal"><font size="2" face="Calibri"><span lang="EN-US" style="font-size:11.0pt">Hey Jesse,<u></u><u></u></span></font></p>
<p class="MsoNormal"><font size="2" face="Calibri"><span lang="EN-US" style="font-size:11.0pt"><u></u> <u></u></span></font></p>
<p class="MsoNormal"><font size="2" face="Calibri"><span lang="EN-US" style="font-size:11.0pt">I had the chance to meet Brent @ Red Hat Summit yesterday, and this was a good reminder to reach out regarding SEV support in Kata.<u></u><u></u></span></font></p>
<p class="MsoNormal"><font size="2" face="Calibri"><span lang="EN-US" style="font-size:11.0pt"><u></u> <u></u></span></font></p>
<p class="MsoNormal"><font size="2" face="Calibri"><span lang="EN-US" style="font-size:11.0pt">First, as expressed to Brent, this is a sweet use case.<u></u><u></u></span></font></p>
<p class="MsoNormal"><font size="2" face="Calibri"><span lang="EN-US" style="font-size:11.0pt"><u></u> <u></u></span></font></p>
<p class="MsoNormal"><font size="2" face="Calibri"><span lang="EN-US" style="font-size:11.0pt">Second, one of the things that has come to mind for me is how we can verify.
<u></u><u></u></span></font></p>
<p class="MsoNormal"><font size="2" face="Calibri"><span lang="EN-US" style="font-size:11.0pt"><u></u> <u></u></span></font></p>
<p class="MsoNormal"><font size="2" face="Calibri"><span lang="EN-US" style="font-size:11.0pt">Our CI is running on a mix of baremetal machines for metrics and machines in the cloud (via Azure) for functional testing. For other architectures, and including
this feature, it’d be best to have this exercised in CI. Basically, I’d want to make sure we can replicate the CI on a single AMD Epyc (or other SEV enabled system) which could help gate our CI process. We have the test setup designed to be easily reproduced,
and can work together on getting this setup, assuming we find a machine which this can run on.<u></u><u></u></span></font></p>
<p class="MsoNormal"><font size="2" face="Calibri"><span lang="EN-US" style="font-size:11.0pt"><u></u> <u></u></span></font></p>
<p class="MsoNormal"><font size="2" face="Calibri"><span lang="EN-US" style="font-size:11.0pt">With this feature enabled in our CI, we’d be able to guarantee that it continues to work (and if it fails, it should be an easy fix).<u></u><u></u></span></font></p>
<p class="MsoNormal"><font size="2" face="Calibri"><span lang="EN-US" style="font-size:11.0pt"><u></u> <u></u></span></font></p>
<p class="MsoNormal"><font size="2" face="Calibri"><span lang="EN-US" style="font-size:11.0pt">Thanks,<br>
Eric<u></u><u></u></span></font></p>
<p class="MsoNormal"><font size="2" face="Calibri"><span lang="EN-US" style="font-size:11.0pt"><u></u> <u></u></span></font></p>
<p class="MsoNormal"><font size="2" face="Calibri"><span lang="EN-US" style="font-size:11.0pt"><u></u> <u></u></span></font></p>
<div style="border:none;border-top:solid #b5c4df 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal" style="margin-left:36.0pt"><b><font size="3" color="black" face="Calibri"><span lang="EN-US" style="font-size:12.0pt;color:black;font-weight:bold">From:
</span></font></b><font size="3" color="black"><span lang="EN-US" style="font-size:12.0pt;color:black">"Larrew, Jesse" <<a href="mailto:Jesse.Larrew@amd.com" target="_blank">Jesse.Larrew@amd.com</a>><br>
<b><span style="font-weight:bold">Date: </span></b>Tuesday, May 1, 2018 at 10:28 AM<br>
<b><span style="font-weight:bold">To: </span></b>Eric Ernst <<a href="mailto:eric.ernst@intel.com" target="_blank">eric.ernst@intel.com</a>><br>
<b><span style="font-weight:bold">Cc: </span></b>Jon Olson <<a href="mailto:jonolson@google.com" target="_blank">jonolson@google.com</a>>, "Singh, Brijesh" <<a href="mailto:brijesh.singh@amd.com" target="_blank">brijesh.singh@amd.com</a>>, "Kaplan, David" <<a href="mailto:David.Kaplan@amd.com" target="_blank">David.Kaplan@amd.com</a>>,
"Hollingsworth, Brent" <<a href="mailto:brent.hollingsworth@amd.com" target="_blank">brent.hollingsworth@amd.com</a>>, "<a href="mailto:kata-dev@lists.katacontainers.io" target="_blank">kata-dev@lists.<wbr>katacontainers.io</a>" <<a href="mailto:kata-dev@lists.katacontainers.io" target="_blank">kata-dev@lists.<wbr>katacontainers.io</a>>,
"Woller, Thomas" <<a href="mailto:thomas.woller@amd.com" target="_blank">thomas.woller@amd.com</a>><br>
<b><span style="font-weight:bold">Subject: </span></b>RE: [kata-dev] Kata with AMD Secure Encrypted Virtualization (SEV)<u></u><u></u></span></font></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:36.0pt"><font size="2" face="Calibri"><span lang="EN-US" style="font-size:11.0pt"><u></u> <u></u></span></font></p>
</div>
<p class="MsoNormal" style="margin-left:36.0pt"><font size="2" face="Calibri"><span lang="EN-US" style="font-size:11.0pt">Hi Eric,<u></u><u></u></span></font></p>
<p class="MsoNormal" style="margin-left:36.0pt"><font size="2" face="Calibri"><span lang="EN-US" style="font-size:11.0pt"> <u></u><u></u></span></font></p>
<p class="MsoNormal" style="margin-left:36.0pt"><font size="2" face="Calibri"><span lang="EN-US" style="font-size:11.0pt">I got SEV working with the latest 0.0.1 kata runtime. Is there still a chance of getting this in before the 1.0 release on the 22<sup>nd</sup>?
Or are we looking at 1.1.0 at this point?<u></u><u></u></span></font></p>
<p class="MsoNormal" style="margin-left:36.0pt"><font size="2" face="Calibri"><span lang="EN-US" style="font-size:11.0pt"> <u></u><u></u></span></font></p>
<p class="MsoNormal" style="margin-left:36.0pt"><font size="2" face="Calibri"><span lang="EN-US" style="font-size:11.0pt">Sincerely,<u></u><u></u></span></font></p>
<p class="MsoNormal" style="margin-left:36.0pt"><font size="2" face="Calibri"><span lang="EN-US" style="font-size:11.0pt">Jesse<u></u><u></u></span></font></p>
<p class="MsoNormal" style="margin-left:36.0pt"><font size="2" face="Calibri"><span lang="EN-US" style="font-size:11.0pt"> <u></u><u></u></span></font></p>
<div style="border:none;border-left:solid blue 1.5pt;padding:0cm 0cm 0cm 4.0pt">
<div>
<div style="border:none;border-top:solid #e1e1e1 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal" style="margin-left:36.0pt"><b><font size="2" face="Calibri"><span lang="EN-US" style="font-size:11.0pt;font-weight:bold">From:</span></font></b><span lang="EN-US"> Ernst, Eric [<a href="mailto:eric.ernst@intel.com" target="_blank">mailto:eric.ernst@intel.com</a>]
<br>
<b><span style="font-weight:bold">Sent:</span></b> Saturday, April 7, 2018 9:18 PM<br>
<b><span style="font-weight:bold">To:</span></b> Larrew, Jesse <<a href="mailto:Jesse.Larrew@amd.com" target="_blank">Jesse.Larrew@amd.com</a>><br>
<b><span style="font-weight:bold">Cc:</span></b> Jon Olson <<a href="mailto:jonolson@google.com" target="_blank">jonolson@google.com</a>>; Singh, Brijesh <<a href="mailto:brijesh.singh@amd.com" target="_blank">brijesh.singh@amd.com</a>>; Kaplan, David <<a href="mailto:David.Kaplan@amd.com" target="_blank">David.Kaplan@amd.com</a>>;
Hollingsworth, Brent <<a href="mailto:brent.hollingsworth@amd.com" target="_blank">brent.hollingsworth@amd.com</a>>;
<a href="mailto:kata-dev@lists.katacontainers.io" target="_blank">kata-dev@lists.katacontainers.<wbr>io</a>; Woller, Thomas <<a href="mailto:thomas.woller@amd.com" target="_blank">thomas.woller@amd.com</a>><br>
<b><span style="font-weight:bold">Subject:</span></b> Re: [kata-dev] Kata with AMD Secure Encrypted Virtualization (SEV)<u></u><u></u></span></p>
</div>
</div>
<p class="MsoNormal" style="margin-left:36.0pt"><font size="2" face="Calibri"><span lang="EN-US" style="font-size:11.0pt"> <u></u><u></u></span></font></p>
<div>
<p class="MsoNormal" style="margin-left:36.0pt"><font size="2" face="Calibri"><span lang="EN-US" style="font-size:11.0pt">There isn’t really a deadline. While we are still discussing release cadence for Kata, this seems like a nice feature to get in, perhaps
after our initial 1.0 release (targeting ~June 1). <u></u><u></u></span></font></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:36.0pt"><font size="2" face="Calibri"><span lang="EN-US" style="font-size:11.0pt"> <u></u><u></u></span></font></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:36.0pt"><font size="2" face="Calibri"><span lang="EN-US" style="font-size:11.0pt">Eric<u></u><u></u></span></font></p>
</div>
<div>
<p class="MsoNormal" style="margin-right:0cm;margin-bottom:12.0pt;margin-left:36.0pt">
<font size="2" face="Calibri"><span lang="EN-US" style="font-size:11.0pt"><br>
On Apr 7, 2018, at 6:22 PM, Larrew, Jesse <<a href="mailto:Jesse.Larrew@amd.com" target="_blank">Jesse.Larrew@amd.com</a>> wrote:<u></u><u></u></span></font></p>
</div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<p class="MsoNormal" style="margin-left:36.0pt"><font size="2" face="Calibri"><span lang="EN-US" style="font-size:11.0pt">Hi Eric,<u></u><u></u></span></font></p>
<p class="MsoNormal" style="margin-left:36.0pt"><font size="2" face="Calibri"><span lang="EN-US" style="font-size:11.0pt"> <u></u><u></u></span></font></p>
<p class="MsoNormal" style="margin-left:36.0pt"><font size="2" face="Calibri"><span lang="EN-US" style="font-size:11.0pt">I’m seeking internal approval to contribute. Do you have a deadline for a decision?<u></u><u></u></span></font></p>
<p class="MsoNormal" style="margin-left:36.0pt"><font size="2" face="Calibri"><span lang="EN-US" style="font-size:11.0pt"> <u></u><u></u></span></font></p>
<p class="MsoNormal" style="margin-left:36.0pt"><font size="2" face="Calibri"><span lang="EN-US" style="font-size:11.0pt">Sincerely,<u></u><u></u></span></font></p>
<p class="MsoNormal" style="margin-left:36.0pt"><font size="2" face="Calibri"><span lang="EN-US" style="font-size:11.0pt">Jesse<u></u><u></u></span></font></p>
<p class="MsoNormal" style="margin-left:36.0pt"><font size="2" face="Calibri"><span lang="EN-US" style="font-size:11.0pt"> <u></u><u></u></span></font></p>
<div style="border:none;border-left:solid blue 1.5pt;padding:0cm 0cm 0cm 4.0pt">
<div>
<div style="border:none;border-top:solid #e1e1e1 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal" style="margin-left:36.0pt"><b><font size="2" face="Calibri"><span lang="EN-US" style="font-size:11.0pt;font-weight:bold">From:</span></font></b><span lang="EN-US"> Ernst, Eric [<a href="mailto:eric.ernst@intel.com" target="_blank">mailto:eric.ernst@intel.com</a>]
<br>
<b><span style="font-weight:bold">Sent:</span></b> Friday, April 6, 2018 2:08 PM<br>
<b><span style="font-weight:bold">To:</span></b> Larrew, Jesse <<a href="mailto:Jesse.Larrew@amd.com" target="_blank">Jesse.Larrew@amd.com</a>>; Jon Olson <<a href="mailto:jonolson@google.com" target="_blank">jonolson@google.com</a>><br>
<b><span style="font-weight:bold">Cc:</span></b> Singh, Brijesh <<a href="mailto:brijesh.singh@amd.com" target="_blank">brijesh.singh@amd.com</a>>; Kaplan, David <<a href="mailto:David.Kaplan@amd.com" target="_blank">David.Kaplan@amd.com</a>>; Hollingsworth, Brent <<a href="mailto:brent.hollingsworth@amd.com" target="_blank">brent.hollingsworth@amd.com</a>>;
<a href="mailto:kata-dev@lists.katacontainers.io" target="_blank">kata-dev@lists.katacontainers.<wbr>io</a>; Woller, Thomas <<a href="mailto:thomas.woller@amd.com" target="_blank">thomas.woller@amd.com</a>><br>
<b><span style="font-weight:bold">Subject:</span></b> Re: [kata-dev] Kata with AMD Secure Encrypted Virtualization (SEV)<u></u><u></u></span></p>
</div>
</div>
<p class="MsoNormal" style="margin-left:36.0pt"><font size="2" face="Calibri"><span lang="EN-US" style="font-size:11.0pt"> <u></u><u></u></span></font></p>
<p class="MsoNormal" style="margin-left:36.0pt"><font size="2" face="Calibri"><span lang="EN-US" style="font-size:11.0pt">Jesse,<u></u><u></u></span></font></p>
<p class="MsoNormal" style="margin-left:36.0pt"><font size="2" face="Calibri"><span lang="EN-US" style="font-size:11.0pt"> <u></u><u></u></span></font></p>
<p class="MsoNormal" style="margin-left:36.0pt"><font size="2" face="Calibri"><span lang="EN-US" style="font-size:11.0pt">I wanted to follow up here… I think this is a pretty exciting feature and I wanted to see what next steps are. Is this something that you’re
planning to or can start contributing to the Kata project?<u></u><u></u></span></font></p>
<p class="MsoNormal" style="margin-left:36.0pt"><font size="2" face="Calibri"><span lang="EN-US" style="font-size:11.0pt"> <u></u><u></u></span></font></p>
<p class="MsoNormal" style="margin-left:36.0pt"><font size="2" face="Calibri"><span lang="EN-US" style="font-size:11.0pt">Thanks<br>
Eric<u></u><u></u></span></font></p>
<p class="MsoNormal" style="margin-left:36.0pt"><font size="2" face="Calibri"><span lang="EN-US" style="font-size:11.0pt"> <u></u><u></u></span></font></p>
<div style="border:none;border-top:solid #b5c4df 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal" style="margin-left:72.0pt"><b><font size="3" color="black" face="Calibri"><span lang="EN-US" style="font-size:12.0pt;color:black;font-weight:bold">From:
</span></font></b><font size="3" color="black"><span lang="EN-US" style="font-size:12.0pt;color:black">"Larrew, Jesse" <<a href="mailto:Jesse.Larrew@amd.com" target="_blank">Jesse.Larrew@amd.com</a>><br>
<b><span style="font-weight:bold">Date: </span></b>Friday, February 23, 2018 at 7:11 PM<br>
<b><span style="font-weight:bold">To: </span></b>Jon Olson <<a href="mailto:jonolson@google.com" target="_blank">jonolson@google.com</a>><br>
<b><span style="font-weight:bold">Cc: </span></b>"Singh, Brijesh" <<a href="mailto:brijesh.singh@amd.com" target="_blank">brijesh.singh@amd.com</a>>, "Kaplan, David" <<a href="mailto:David.Kaplan@amd.com" target="_blank">David.Kaplan@amd.com</a>>, "Hollingsworth, Brent" <<a href="mailto:brent.hollingsworth@amd.com" target="_blank">brent.hollingsworth@amd.com</a>>,
"<a href="mailto:kata-dev@lists.katacontainers.io" target="_blank">kata-dev@lists.<wbr>katacontainers.io</a>" <<a href="mailto:kata-dev@lists.katacontainers.io" target="_blank">kata-dev@lists.<wbr>katacontainers.io</a>>, "Woller, Thomas" <<a href="mailto:thomas.woller@amd.com" target="_blank">thomas.woller@amd.com</a>><br>
<b><span style="font-weight:bold">Subject: </span></b>Re: [kata-dev] Kata with AMD Secure Encrypted Virtualization (SEV)</span></font><span lang="EN-US"><u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:72.0pt"><font size="2" face="Calibri"><span lang="EN-US" style="font-size:11.0pt"> <u></u><u></u></span></font></p>
</div>
<div style="border:none;border-left:solid blue 1.5pt;padding:0cm 0cm 0cm 4.0pt">
<div>
<div style="border:none;border-top:solid #e1e1e1 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal" style="margin-left:72.0pt"><b><font size="2" face="Calibri"><span lang="EN-US" style="font-size:11.0pt;font-weight:bold">From:</span></font></b><span lang="EN-US"> Jon Olson [<a href="mailto:jonolson@google.com" target="_blank">mailto:jonolson@google.com</a>]
<br>
<b><span style="font-weight:bold">Sent:</span></b> Friday, February 23, 2018 6:58 PM<br>
<b><span style="font-weight:bold">To:</span></b> Larrew, Jesse <<a href="mailto:Jesse.Larrew@amd.com" target="_blank">Jesse.Larrew@amd.com</a>><br>
<b><span style="font-weight:bold">Cc:</span></b> Castelino, Manohar R <<a href="mailto:manohar.r.castelino@intel.com" target="_blank">manohar.r.castelino@intel.com</a><wbr>>; Samuel Ortiz <<a href="mailto:sameo@linux.intel.com" target="_blank">sameo@linux.intel.com</a>>; Hollingsworth, Brent <<a href="mailto:brent.hollingsworth@amd.com" target="_blank">brent.hollingsworth@amd.com</a>>;
<a href="mailto:kata-dev@lists.katacontainers.io" target="_blank">kata-dev@lists.katacontainers.<wbr>io</a>; Singh, Brijesh <<a href="mailto:brijesh.singh@amd.com" target="_blank">brijesh.singh@amd.com</a>>; Kaplan, David <<a href="mailto:David.Kaplan@amd.com" target="_blank">David.Kaplan@amd.com</a>>; Woller,
Thomas <<a href="mailto:thomas.woller@amd.com" target="_blank">thomas.woller@amd.com</a>><br>
<b><span style="font-weight:bold">Subject:</span></b> Re: [kata-dev] Kata with AMD Secure Encrypted Virtualization (SEV)<u></u><u></u></span></p>
</div>
</div>
<p class="MsoNormal" style="margin-left:72.0pt"><font size="2" face="Calibri"><span lang="EN-US" style="font-size:11.0pt"> <u></u><u></u></span></font></p>
<div>
<p class="MsoNormal" style="margin-right:0cm;margin-bottom:12.0pt;margin-left:72.0pt">
<font size="2" face="Calibri"><span lang="EN-US" style="font-size:11.0pt"> <u></u><u></u></span></font></p>
<div>
<div>
<p class="MsoNormal" style="margin-left:72.0pt"><font size="2" face="Calibri"><span lang="EN-US" style="font-size:11.0pt">On Fri, Feb 23, 2018 at 4:42 PM Larrew, Jesse <<a href="mailto:Jesse.Larrew@amd.com" target="_blank">Jesse.Larrew@amd.com</a>> wrote:<u></u><u></u></span></font></p>
</div>
<blockquote style="border:none;border-left:solid #cccccc 1.0pt;padding:0cm 0cm 0cm 6.0pt;margin-left:4.8pt;margin-top:5.0pt;margin-right:0cm;margin-bottom:5.0pt">
<p class="MsoNormal" style="margin-left:72.0pt"><font size="2" face="Calibri"><span lang="EN-US" style="font-size:11.0pt">> From: Castelino, Manohar R [mailto:<a href="mailto:manohar.r.castelino@intel.com" target="_blank">manohar.r.castelino@<wbr>intel.com</a>]<br>
> Sent: Friday, February 23, 2018 3:53 PM<br>
> To: Larrew, Jesse <<a href="mailto:Jesse.Larrew@amd.com" target="_blank">Jesse.Larrew@amd.com</a>>; Samuel Ortiz<br>
> <<a href="mailto:sameo@linux.intel.com" target="_blank">sameo@linux.intel.com</a>><br>
> Cc: Hollingsworth, Brent <<a href="mailto:brent.hollingsworth@amd.com" target="_blank">brent.hollingsworth@amd.com</a>>; Woller, Thomas<br>
> <<a href="mailto:thomas.woller@amd.com" target="_blank">thomas.woller@amd.com</a>>; Kaplan, David <<a href="mailto:David.Kaplan@amd.com" target="_blank">David.Kaplan@amd.com</a>>; kata-<br>
> <a href="mailto:dev@lists.katacontainers.io" target="_blank">dev@lists.katacontainers.io</a><br>
> Subject: RE: [kata-dev] Kata with AMD Secure Encrypted Virtualization (SEV)<br>
><br>
> Jesse,<br>
><br>
> > On EPYC, our IOMMU doesn't yet support SEV, so DMA to/from devices<br>
> needs<br>
> > to be done using unencrypted pages. It was easy to implement this using<br>
> the<br>
> > bounce buffers provided by SWIOTLB. As you guessed, a quick change to<br>
> > vring_use_dma_api() got virtio support working properly:<br>
><br>
> Clear Containers today supports direct device assignment via SRIOV.<br>
> This requires pre-allocation and pinning of VM memory.<br>
> Will this continue to work?<br>
><br>
> Also we have been working on reverse ballooning. i.e. free unused memory<br>
> from the VM back to the host. Is there is a way to get this to work with<br>
> encrypted memory<br>
><br>
> For more details about the patches<br>
> <a href="https://gist.github.com/sboeuf/fc71f0218a81997251ee0d7668df2bd9" target="_blank">
https://gist.github.com/<wbr>sboeuf/<wbr>fc71f0218a81997251ee0d7668df2b<wbr>d9</a><br>
><br>
> -manohar<br>
><br>
><br>
<br>
Hi Manohar,<br>
<br>
SEV also requires the guest memory to be pre-allocated and pinned [1], so that's not a problem. As long as the PF drivers in the guest are using the dma apis, everything should continue to work.<u></u><u></u></span></font></p>
</blockquote>
<div>
<p class="MsoNormal" style="margin-left:72.0pt"><font size="2" face="Calibri"><span lang="EN-US" style="font-size:11.0pt"> <u></u><u></u></span></font></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:72.0pt"><font size="2" face="Calibri"><span lang="EN-US" style="font-size:11.0pt">That's surprising -- I can see where reclaim would be challenging without something like a balloon, but why must the be initially backed?
What happens if you leave a page unbacked and attempt to lazily back it on an EPT fault?<u></u><u></u></span></font></p>
<p class="MsoNormal" style="margin-left:72.0pt"><b><i><font size="2" face="Calibri"><span lang="EN-US" style="font-size:11.0pt;font-weight:bold;font-style:italic"> </span></font></i></b><span lang="EN-US"><u></u><u></u></span></p>
<p class="MsoNormal" style="margin-left:72.0pt"><b><i><font size="2" face="Calibri"><span lang="EN-US" style="font-size:11.0pt;font-weight:bold;font-style:italic">[JDL] You’re right Jon. I misspoke above. The memory only needs to be pinned; the backing pages
can be faulted in on demand. Sorry for the confusion.</span></font></i></b><span lang="EN-US"><u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:72.0pt"><font size="2" face="Calibri"><span lang="EN-US" style="font-size:11.0pt"> <u></u><u></u></span></font></p>
</div>
<blockquote style="border:none;border-left:solid #cccccc 1.0pt;padding:0cm 0cm 0cm 6.0pt;margin-left:4.8pt;margin-top:5.0pt;margin-right:0cm;margin-bottom:5.0pt">
<p class="MsoNormal" style="margin-right:0cm;margin-bottom:12.0pt;margin-left:72.0pt">
<font size="2" face="Calibri"><span lang="EN-US" style="font-size:11.0pt"><br>
Similarly, the reverse ballooning patches should also work with SEV. In fact, I would argue that SEV compliments this feature by ensuring that physical page contents aren't exposed to the host when the guest uses MADV_FREE. I've CC'ed our KVM expert, Brijesh
Singh, just in case he sees something that I missed.<br>
<br>
Sincerely,<br>
Jesse<br>
<br>
[1] In order to ensure that memory blocks with identical data will encrypt to different ciphertext, SEV mixes the physical address into the encryption algorithm. As a result, if a page of memory is moved to a different physical address, it will not decrypt
properly. This also defeats block-move attacks on the guest memory, but it also requires all guest memory to be pinned.<br>
<br>
<u></u><u></u></span></font></p>
</blockquote>
</div>
</div>
</div>
</div>
</div>
</blockquote>
</div>
</div>
</div></div></div>
</div>
<p>------------------------------<wbr>------------------------------<wbr>---------<br>
Intel Corporation (UK) Limited<br>
Registered No. 1134945 (England)<br>
Registered Office: Pipers Way, Swindon SN3 1RJ<br>
VAT No: 860 2173 47</p>
<p>This e-mail and any attachments may contain confidential material for<br>
the sole use of the intended recipient(s). Any review or distribution<br>
by others is strictly prohibited. If you are not the intended<br>
recipient, please contact the sender and delete all copies.</p></div>
<br>______________________________<wbr>_________________<br>
kata-dev mailing list<br>
<a href="mailto:kata-dev@lists.katacontainers.io">kata-dev@lists.katacontainers.<wbr>io</a><br>
<a href="http://lists.katacontainers.io/cgi-bin/mailman/listinfo/kata-dev" rel="noreferrer" target="_blank">http://lists.katacontainers.<wbr>io/cgi-bin/mailman/listinfo/<wbr>kata-dev</a><br>
<br></blockquote></div><br><br clear="all"><div><br></div>-- <br><div class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><font color="#888888"><span style="font-family:monospace,monospace"><span style="font-family:monospace,monospace">James<br>---</span></span></font></div><div dir="ltr"><a href="https://katacontainers.io/" style="color:rgb(17,85,204);font-family:monospace,monospace" target="_blank">https://katacontainers.io/</a><span style="color:rgb(136,136,136);font-family:monospace,monospace"> | <a href="https://github.com/clearcontainers" target="_blank">https://github.com/kata-containers</a></span><font color="#888888"><span style="font-family:monospace,monospace"><span style="font-family:monospace,monospace"><br></span></span></font></div><div dir="ltr"><font color="#888888"><font face="monospace, monospace">Open Source Technology Center</font><br><font face="monospace, monospace">Intel Corporation (UK) Ltd. - Co. Reg. #1134945 - Pipers Way, Swindon SN3 1RJ.</font></font><br></div></div></div></div></div></div></div></div></div></div></div>
</div>