<div dir="ltr">Hi Jesse,<div><br></div><div><br></div><div class="gmail_extra"><div class="gmail_quote">2018-06-19 18:57 GMT+01:00 Larrew, Jesse <span dir="ltr"><<a href="mailto:Jesse.Larrew@amd.com" target="_blank">Jesse.Larrew@amd.com</a>></span>:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div bgcolor="white" lang="EN-US">
<div class="gmail-m_-6225172054044253063WordSection1">
<p class="MsoNormal">Hi Eric,<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">We’re still working on setting up the CI server, but we’ve decided to make the SEV patches available on our github repo so folks can kick the tires, so to speak.</p></div></div></blockquote><div>\o/ - great!</div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div bgcolor="white" lang="EN-US"><div class="gmail-m_-6225172054044253063WordSection1"><p class="MsoNormal"><u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">The SEV patches require a new dependency in the vendor tree and updates a few others:<u></u><u></u></p>
<ol style="margin-top:0in" start="1" type="1">
<li class="gmail-m_-6225172054044253063MsoListParagraph" style="margin-left:0in">intel-go/cpuid (new dependency),<u></u><u></u></li><li class="gmail-m_-6225172054044253063MsoListParagraph" style="margin-left:0in">intel/govmm,<u></u><u></u></li><li class="gmail-m_-6225172054044253063MsoListParagraph" style="margin-left:0in">virtcontainers<u></u><u></u></li></ol>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">To submit a PR to kata-runtime, should I first fork each of the above projects and submit PRs against them, then point to those PRs when I submit to kata? This is the first Go project that I’ve contributed to, so I’m not sure what the protocol
is. Any tips would be helpful. Thanks!</p></div></div></blockquote><div>For (1) and (2), yes, you'll need to click "fork" on <a href="https://github.com/intel-go/cpuid">https://github.com/intel-go/cpuid</a> and <a href="https://github.com/intel/govmm">https://github.com/intel/govmm</a>, and then raise PRs on those two projects.</div><div><br></div><div>Once both those PRs have landed, since virtcontainers <span style="font-size:small;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial;float:none;display:inline">is now part of the Kata runtime </span>you can then raise a PR on <a href="https://github.com/kata-containers/runtime">https://github.com/kata-containers/runtime</a> for the changes you need to make to <a href="https://github.com/kata-containers/runtime/tree/master/virtcontainers">https://github.com/kata-containers/runtime/tree/master/virtcontainers</a>.</div><div><br></div><div>As part of that change, you'll need to update the runtime vendoring to pull in (1) and (2):</div><div><br></div><div>- Add "<span style="font-size:small;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial;float:none;display:inline"><a href="http://github.com/intel-go/cpuid">github.com/intel-go/cpuid</a>" to Gopkg.toml to pull in your upstream changes.</span></div><div><span style="font-size:small;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial;float:none;display:inline"><br></span></div><div><span style="font-size:small;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial;float:none;display:inline"> See <a href="https://github.com/kata-containers/community/blob/master/VENDORING.md#vendor-a-newly-imported-package">https://github.com/kata-containers/community/blob/master/VENDORING.md#vendor-a-newly-imported-package</a></span></div><div><span style="font-size:small;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial;float:none;display:inline"><br></span></div><div><span style="font-size:small;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial;float:none;display:inline">- Update the commit for "<span style="text-decoration-style:initial;text-decoration-color:initial;float:none;display:inline"><a href="http://github.com/intel/govmm">github.com/intel/govmm</a>" in Gopkg.toml to pull in your upstream changes.</span></span></div><div><span style="font-size:small;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial;float:none;display:inline"><span style="text-decoration-style:initial;text-decoration-color:initial;float:none;display:inline"><br></span></span></div><div><span style="font-size:small;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial;float:none;display:inline"><span style="text-decoration-style:initial;text-decoration-color:initial;float:none;display:inline"> See <a href="https://github.com/kata-containers/community/blob/master/VENDORING.md#update-a-vendored-package">https://github.com/kata-containers/community/blob/master/VENDORING.md#update-a-vendored-package</a></span></span></div><div><span style="font-size:small;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial;float:none;display:inline"><span style="text-decoration-style:initial;text-decoration-color:initial;float:none;display:inline"><br></span></span></div><div><span style="font-size:small;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial;float:none;display:inline"><span style="text-decoration-style:initial;text-decoration-color:initial;float:none;display:inline">Note that you can *probably* get away with updating the Gopkg.toml file once for both changes (meaning you only need to run "dep ensure" once) and having all the changes on a single commit.</span></span></div><div><span style="font-size:small;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial;float:none;display:inline"><span style="text-decoration-style:initial;text-decoration-color:initial;float:none;display:inline"><br></span></span></div><div><span style="font-size:small;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial;float:none;display:inline"><span style="text-decoration-style:initial;text-decoration-color:initial;float:none;display:inline">HTH.</span></span></div><div><span style="font-size:small;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial;float:none;display:inline"><span style="text-decoration-style:initial;text-decoration-color:initial;float:none;display:inline"><br></span></span></div><div><span style="font-size:small;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial;float:none;display:inline"><span style="text-decoration-style:initial;text-decoration-color:initial;float:none;display:inline">Cheers,</span></span></div><div><span style="font-size:small;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial;float:none;display:inline"><span style="text-decoration-style:initial;text-decoration-color:initial;float:none;display:inline"><br></span></span></div><div><span style="font-size:small;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial;float:none;display:inline"><span style="text-decoration-style:initial;text-decoration-color:initial;float:none;display:inline">James</span></span></div><div><br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div bgcolor="white" lang="EN-US"><div class="gmail-m_-6225172054044253063WordSection1"><p class="MsoNormal"><u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Sincerely,<u></u><u></u></p>
<p class="MsoNormal">Jesse<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<div style="border-top:none;border-right:none;border-bottom:none;border-left:1.5pt solid blue;padding:0in 0in 0in 4pt">
<div>
<div style="border-right:none;border-bottom:none;border-left:none;border-top:1pt solid rgb(225,225,225);padding:3pt 0in 0in">
<p class="MsoNormal"><span class="gmail-"><b>From:</b> Ernst, Eric [mailto:<a href="mailto:eric.ernst@intel.com" target="_blank">eric.ernst@intel.com</a>] <br>
</span><b>Sent:</b> Wednesday, May 9, 2018 3:45 PM</p><div><div class="gmail-h5"><br>
<b>To:</b> Larrew, Jesse <<a href="mailto:Jesse.Larrew@amd.com" target="_blank">Jesse.Larrew@amd.com</a>><br>
<b>Cc:</b> Jon Olson <<a href="mailto:jonolson@google.com" target="_blank">jonolson@google.com</a>>; Singh, Brijesh <<a href="mailto:brijesh.singh@amd.com" target="_blank">brijesh.singh@amd.com</a>>; Kaplan, David <<a href="mailto:David.Kaplan@amd.com" target="_blank">David.Kaplan@amd.com</a>>; Hollingsworth, Brent <<a href="mailto:brent.hollingsworth@amd.com" target="_blank">brent.hollingsworth@amd.com</a>>; <a href="mailto:kata-dev@lists.katacontainers.io" target="_blank">kata-dev@lists.katacontainers.<wbr>io</a>; Woller, Thomas <<a href="mailto:thomas.woller@amd.com" target="_blank">thomas.woller@amd.com</a>><br>
<b>Subject:</b> Re: [kata-dev] Kata with AMD Secure Encrypted Virtualization (SEV)<u></u><u></u></div></div><p></p>
</div>
</div><div><div class="gmail-h5">
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Hey Jesse,<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">I had the chance to meet Brent @ Red Hat Summit yesterday, and this was a good reminder to reach out regarding SEV support in Kata.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">First, as expressed to Brent, this is a sweet use case.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Second, one of the things that has come to mind for me is how we can verify.
<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Our CI is running on a mix of baremetal machines for metrics and machines in the cloud (via Azure) for functional testing. For other architectures, and including this feature, it’d be best to have this exercised in CI. Basically, I’d
want to make sure we can replicate the CI on a single AMD Epyc (or other SEV enabled system) which could help gate our CI process. We have the test setup designed to be easily reproduced, and can work together on getting this setup, assuming we find a machine
which this can run on.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">With this feature enabled in our CI, we’d be able to guarantee that it continues to work (and if it fails, it should be an easy fix).<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Thanks,<br>
Eric<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<div style="border-right:none;border-bottom:none;border-left:none;border-top:1pt solid rgb(181,196,223);padding:3pt 0in 0in">
<p class="MsoNormal" style="margin-left:0.5in"><b><span style="font-size:12pt;color:black">From:
</span></b><span style="font-size:12pt;color:black">"Larrew, Jesse" <<a href="mailto:Jesse.Larrew@amd.com" target="_blank">Jesse.Larrew@amd.com</a>><br>
<b>Date: </b>Tuesday, May 1, 2018 at 10:28 AM<br>
<b>To: </b>Eric Ernst <<a href="mailto:eric.ernst@intel.com" target="_blank">eric.ernst@intel.com</a>><br>
<b>Cc: </b>Jon Olson <<a href="mailto:jonolson@google.com" target="_blank">jonolson@google.com</a>>, "Singh, Brijesh" <<a href="mailto:brijesh.singh@amd.com" target="_blank">brijesh.singh@amd.com</a>>, "Kaplan, David" <<a href="mailto:David.Kaplan@amd.com" target="_blank">David.Kaplan@amd.com</a>>, "Hollingsworth,
Brent" <<a href="mailto:brent.hollingsworth@amd.com" target="_blank">brent.hollingsworth@amd.com</a>>, "<a href="mailto:kata-dev@lists.katacontainers.io" target="_blank">kata-dev@lists.<wbr>katacontainers.io</a>" <<a href="mailto:kata-dev@lists.katacontainers.io" target="_blank">kata-dev@lists.<wbr>katacontainers.io</a>>,
"Woller, Thomas" <<a href="mailto:thomas.woller@amd.com" target="_blank">thomas.woller@amd.com</a>><br>
<b>Subject: </b>RE: [kata-dev] Kata with AMD Secure Encrypted Virtualization (SEV)<u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:0.5in"><u></u> <u></u></p>
</div>
<p class="MsoNormal" style="margin-left:0.5in">Hi Eric,<u></u><u></u></p>
<p class="MsoNormal" style="margin-left:0.5in"> <u></u><u></u></p>
<p class="MsoNormal" style="margin-left:0.5in">I got SEV working with the latest 0.0.1 kata runtime. Is there still a chance of getting this in before the 1.0 release on the 22<sup>nd</sup>? Or are we looking at 1.1.0 at this point?<u></u><u></u></p>
<p class="MsoNormal" style="margin-left:0.5in"> <u></u><u></u></p>
<p class="MsoNormal" style="margin-left:0.5in">Sincerely,<u></u><u></u></p>
<p class="MsoNormal" style="margin-left:0.5in">Jesse<u></u><u></u></p>
<p class="MsoNormal" style="margin-left:0.5in"> <u></u><u></u></p>
<div style="border-top:none;border-right:none;border-bottom:none;border-left:1.5pt solid blue;padding:0in 0in 0in 4pt">
<div>
<div style="border-right:none;border-bottom:none;border-left:none;border-top:1pt solid rgb(225,225,225);padding:3pt 0in 0in">
<p class="MsoNormal" style="margin-left:0.5in"><b>From:</b> Ernst, Eric [<a href="mailto:eric.ernst@intel.com" target="_blank">mailto:eric.ernst@intel.com</a>]
<br>
<b>Sent:</b> Saturday, April 7, 2018 9:18 PM<br>
<b>To:</b> Larrew, Jesse <<a href="mailto:Jesse.Larrew@amd.com" target="_blank">Jesse.Larrew@amd.com</a>><br>
<b>Cc:</b> Jon Olson <<a href="mailto:jonolson@google.com" target="_blank">jonolson@google.com</a>>; Singh, Brijesh <<a href="mailto:brijesh.singh@amd.com" target="_blank">brijesh.singh@amd.com</a>>; Kaplan, David <<a href="mailto:David.Kaplan@amd.com" target="_blank">David.Kaplan@amd.com</a>>; Hollingsworth,
Brent <<a href="mailto:brent.hollingsworth@amd.com" target="_blank">brent.hollingsworth@amd.com</a>>;
<a href="mailto:kata-dev@lists.katacontainers.io" target="_blank">kata-dev@lists.katacontainers.<wbr>io</a>; Woller, Thomas <<a href="mailto:thomas.woller@amd.com" target="_blank">thomas.woller@amd.com</a>><br>
<b>Subject:</b> Re: [kata-dev] Kata with AMD Secure Encrypted Virtualization (SEV)<u></u><u></u></p>
</div>
</div>
<p class="MsoNormal" style="margin-left:0.5in"> <u></u><u></u></p>
<div>
<p class="MsoNormal" style="margin-left:0.5in">There isn’t really a deadline. While we are still discussing release cadence for Kata, this seems like a nice feature to get in, perhaps after our initial 1.0 release (targeting ~June 1). <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:0.5in"> <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:0.5in">Eric<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-right:0in;margin-bottom:12pt;margin-left:0.5in">
<br>
On Apr 7, 2018, at 6:22 PM, Larrew, Jesse <<a href="mailto:Jesse.Larrew@amd.com" target="_blank">Jesse.Larrew@amd.com</a>> wrote:<u></u><u></u></p>
</div>
<blockquote style="margin-top:5pt;margin-bottom:5pt">
<div>
<p class="MsoNormal" style="margin-left:0.5in">Hi Eric,<u></u><u></u></p>
<p class="MsoNormal" style="margin-left:0.5in"> <u></u><u></u></p>
<p class="MsoNormal" style="margin-left:0.5in">I’m seeking internal approval to contribute. Do you have a deadline for a decision?<u></u><u></u></p>
<p class="MsoNormal" style="margin-left:0.5in"> <u></u><u></u></p>
<p class="MsoNormal" style="margin-left:0.5in">Sincerely,<u></u><u></u></p>
<p class="MsoNormal" style="margin-left:0.5in">Jesse<u></u><u></u></p>
<p class="MsoNormal" style="margin-left:0.5in"> <u></u><u></u></p>
<div style="border-top:none;border-right:none;border-bottom:none;border-left:1.5pt solid blue;padding:0in 0in 0in 4pt">
<div>
<div style="border-right:none;border-bottom:none;border-left:none;border-top:1pt solid rgb(225,225,225);padding:3pt 0in 0in">
<p class="MsoNormal" style="margin-left:0.5in"><b>From:</b> Ernst, Eric [<a href="mailto:eric.ernst@intel.com" target="_blank">mailto:eric.ernst@intel.com</a>]
<br>
<b>Sent:</b> Friday, April 6, 2018 2:08 PM<br>
<b>To:</b> Larrew, Jesse <<a href="mailto:Jesse.Larrew@amd.com" target="_blank">Jesse.Larrew@amd.com</a>>; Jon Olson <<a href="mailto:jonolson@google.com" target="_blank">jonolson@google.com</a>><br>
<b>Cc:</b> Singh, Brijesh <<a href="mailto:brijesh.singh@amd.com" target="_blank">brijesh.singh@amd.com</a>>; Kaplan, David <<a href="mailto:David.Kaplan@amd.com" target="_blank">David.Kaplan@amd.com</a>>; Hollingsworth, Brent <<a href="mailto:brent.hollingsworth@amd.com" target="_blank">brent.hollingsworth@amd.com</a>>;
<a href="mailto:kata-dev@lists.katacontainers.io" target="_blank">kata-dev@lists.katacontainers.<wbr>io</a>; Woller, Thomas <<a href="mailto:thomas.woller@amd.com" target="_blank">thomas.woller@amd.com</a>><br>
<b>Subject:</b> Re: [kata-dev] Kata with AMD Secure Encrypted Virtualization (SEV)<u></u><u></u></p>
</div>
</div>
<p class="MsoNormal" style="margin-left:0.5in"> <u></u><u></u></p>
<p class="MsoNormal" style="margin-left:0.5in">Jesse,<u></u><u></u></p>
<p class="MsoNormal" style="margin-left:0.5in"> <u></u><u></u></p>
<p class="MsoNormal" style="margin-left:0.5in">I wanted to follow up here… I think this is a pretty exciting feature and I wanted to see what next steps are. Is this something that you’re planning to or can start contributing to the Kata project?<u></u><u></u></p>
<p class="MsoNormal" style="margin-left:0.5in"> <u></u><u></u></p>
<p class="MsoNormal" style="margin-left:0.5in">Thanks<br>
Eric<u></u><u></u></p>
<p class="MsoNormal" style="margin-left:0.5in"> <u></u><u></u></p>
<div style="border-right:none;border-bottom:none;border-left:none;border-top:1pt solid rgb(181,196,223);padding:3pt 0in 0in">
<p class="MsoNormal" style="margin-left:1in"><b><span style="font-size:12pt;color:black">From:
</span></b><span style="font-size:12pt;color:black">"Larrew, Jesse" <<a href="mailto:Jesse.Larrew@amd.com" target="_blank">Jesse.Larrew@amd.com</a>><br>
<b>Date: </b>Friday, February 23, 2018 at 7:11 PM<br>
<b>To: </b>Jon Olson <<a href="mailto:jonolson@google.com" target="_blank">jonolson@google.com</a>><br>
<b>Cc: </b>"Singh, Brijesh" <<a href="mailto:brijesh.singh@amd.com" target="_blank">brijesh.singh@amd.com</a>>, "Kaplan, David" <<a href="mailto:David.Kaplan@amd.com" target="_blank">David.Kaplan@amd.com</a>>, "Hollingsworth, Brent" <<a href="mailto:brent.hollingsworth@amd.com" target="_blank">brent.hollingsworth@amd.com</a>>,
"<a href="mailto:kata-dev@lists.katacontainers.io" target="_blank">kata-dev@lists.<wbr>katacontainers.io</a>" <<a href="mailto:kata-dev@lists.katacontainers.io" target="_blank">kata-dev@lists.<wbr>katacontainers.io</a>>, "Woller, Thomas" <<a href="mailto:thomas.woller@amd.com" target="_blank">thomas.woller@amd.com</a>><br>
<b>Subject: </b>Re: [kata-dev] Kata with AMD Secure Encrypted Virtualization (SEV)</span><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1in"> <u></u><u></u></p>
</div>
<div style="border-top:none;border-right:none;border-bottom:none;border-left:1.5pt solid blue;padding:0in 0in 0in 4pt">
<div>
<div style="border-right:none;border-bottom:none;border-left:none;border-top:1pt solid rgb(225,225,225);padding:3pt 0in 0in">
<p class="MsoNormal" style="margin-left:1in"><b>From:</b> Jon Olson [<a href="mailto:jonolson@google.com" target="_blank">mailto:jonolson@google.com</a>]
<br>
<b>Sent:</b> Friday, February 23, 2018 6:58 PM<br>
<b>To:</b> Larrew, Jesse <<a href="mailto:Jesse.Larrew@amd.com" target="_blank">Jesse.Larrew@amd.com</a>><br>
<b>Cc:</b> Castelino, Manohar R <<a href="mailto:manohar.r.castelino@intel.com" target="_blank">manohar.r.castelino@intel.com</a><wbr>>; Samuel Ortiz <<a href="mailto:sameo@linux.intel.com" target="_blank">sameo@linux.intel.com</a>>; Hollingsworth, Brent <<a href="mailto:brent.hollingsworth@amd.com" target="_blank">brent.hollingsworth@amd.com</a>>;
<a href="mailto:kata-dev@lists.katacontainers.io" target="_blank">kata-dev@lists.katacontainers.<wbr>io</a>; Singh, Brijesh <<a href="mailto:brijesh.singh@amd.com" target="_blank">brijesh.singh@amd.com</a>>; Kaplan, David <<a href="mailto:David.Kaplan@amd.com" target="_blank">David.Kaplan@amd.com</a>>; Woller,
Thomas <<a href="mailto:thomas.woller@amd.com" target="_blank">thomas.woller@amd.com</a>><br>
<b>Subject:</b> Re: [kata-dev] Kata with AMD Secure Encrypted Virtualization (SEV)<u></u><u></u></p>
</div>
</div>
<p class="MsoNormal" style="margin-left:1in"> <u></u><u></u></p>
<div>
<p class="MsoNormal" style="margin-right:0in;margin-bottom:12pt;margin-left:1in">
<u></u><u></u></p>
<div>
<div>
<p class="MsoNormal" style="margin-left:1in">On Fri, Feb 23, 2018 at 4:42 PM Larrew, Jesse <<a href="mailto:Jesse.Larrew@amd.com" target="_blank">Jesse.Larrew@amd.com</a>> wrote:<u></u><u></u></p>
</div>
<blockquote style="border-top:none;border-right:none;border-bottom:none;border-left:1pt solid rgb(204,204,204);padding:0in 0in 0in 6pt;margin:5pt 0in 5pt 4.8pt">
<p class="MsoNormal" style="margin-left:1in">> From: Castelino, Manohar R [mailto:<a href="mailto:manohar.r.castelino@intel.com" target="_blank">manohar.r.castelino@<wbr>intel.com</a>]<br>
> Sent: Friday, February 23, 2018 3:53 PM<br>
> To: Larrew, Jesse <<a href="mailto:Jesse.Larrew@amd.com" target="_blank">Jesse.Larrew@amd.com</a>>; Samuel Ortiz<br>
> <<a href="mailto:sameo@linux.intel.com" target="_blank">sameo@linux.intel.com</a>><br>
> Cc: Hollingsworth, Brent <<a href="mailto:brent.hollingsworth@amd.com" target="_blank">brent.hollingsworth@amd.com</a>>; Woller, Thomas<br>
> <<a href="mailto:thomas.woller@amd.com" target="_blank">thomas.woller@amd.com</a>>; Kaplan, David <<a href="mailto:David.Kaplan@amd.com" target="_blank">David.Kaplan@amd.com</a>>; kata-<br>
> <a href="mailto:dev@lists.katacontainers.io" target="_blank">dev@lists.katacontainers.io</a><br>
> Subject: RE: [kata-dev] Kata with AMD Secure Encrypted Virtualization (SEV)<br>
><br>
> Jesse,<br>
><br>
> > On EPYC, our IOMMU doesn't yet support SEV, so DMA to/from devices<br>
> needs<br>
> > to be done using unencrypted pages. It was easy to implement this using<br>
> the<br>
> > bounce buffers provided by SWIOTLB. As you guessed, a quick change to<br>
> > vring_use_dma_api() got virtio support working properly:<br>
><br>
> Clear Containers today supports direct device assignment via SRIOV.<br>
> This requires pre-allocation and pinning of VM memory.<br>
> Will this continue to work?<br>
><br>
> Also we have been working on reverse ballooning. i.e. free unused memory<br>
> from the VM back to the host. Is there is a way to get this to work with<br>
> encrypted memory<br>
><br>
> For more details about the patches<br>
> <a href="https://gist.github.com/sboeuf/fc71f0218a81997251ee0d7668df2bd9" target="_blank">
https://gist.github.com/<wbr>sboeuf/<wbr>fc71f0218a81997251ee0d7668df2b<wbr>d9</a><br>
><br>
> -manohar<br>
><br>
><br>
<br>
Hi Manohar,<br>
<br>
SEV also requires the guest memory to be pre-allocated and pinned [1], so that's not a problem. As long as the PF drivers in the guest are using the dma apis, everything should continue to work.<u></u><u></u></p>
</blockquote>
<div>
<p class="MsoNormal" style="margin-left:1in"> <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1in">That's surprising -- I can see where reclaim would be challenging without something like a balloon, but why must the be initially backed? What happens if you leave a page unbacked and attempt to lazily back it
on an EPT fault?<u></u><u></u></p>
<p class="MsoNormal" style="margin-left:1in"><b><i> </i></b><u></u><u></u></p>
<p class="MsoNormal" style="margin-left:1in"><b><i>[JDL] You’re right Jon. I misspoke above. The memory only needs to be pinned; the backing pages can be faulted in on demand. Sorry for the confusion.</i></b><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1in"> <u></u><u></u></p>
</div>
<blockquote style="border-top:none;border-right:none;border-bottom:none;border-left:1pt solid rgb(204,204,204);padding:0in 0in 0in 6pt;margin:5pt 0in 5pt 4.8pt">
<p class="MsoNormal" style="margin-right:0in;margin-bottom:12pt;margin-left:1in">
<br>
Similarly, the reverse ballooning patches should also work with SEV. In fact, I would argue that SEV compliments this feature by ensuring that physical page contents aren't exposed to the host when the guest uses MADV_FREE. I've CC'ed our KVM expert, Brijesh
Singh, just in case he sees something that I missed.<br>
<br>
Sincerely,<br>
Jesse<br>
<br>
[1] In order to ensure that memory blocks with identical data will encrypt to different ciphertext, SEV mixes the physical address into the encryption algorithm. As a result, if a page of memory is moved to a different physical address, it will not decrypt
properly. This also defeats block-move attacks on the guest memory, but it also requires all guest memory to be pinned.<br>
<br>
<br>
<u></u><u></u></p>
</blockquote>
</div>
</div>
</div>
</div>
</div>
</blockquote>
</div>
</div></div></div>
</div>
</div>
<br>______________________________<wbr>_________________<br>
kata-dev mailing list<br>
<a href="mailto:kata-dev@lists.katacontainers.io">kata-dev@lists.katacontainers.<wbr>io</a><br>
<a href="http://lists.katacontainers.io/cgi-bin/mailman/listinfo/kata-dev" rel="noreferrer" target="_blank">http://lists.katacontainers.<wbr>io/cgi-bin/mailman/listinfo/<wbr>kata-dev</a><br>
<br></blockquote></div><br><br clear="all"><div><br></div>-- <br><div class="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><font color="#888888"><span style="font-family:monospace,monospace"><span style="font-family:monospace,monospace">James<br>---</span></span></font></div><div dir="ltr"><a href="https://katacontainers.io/" style="color:rgb(17,85,204);font-family:monospace,monospace" target="_blank">https://katacontainers.io/</a><span style="color:rgb(136,136,136);font-family:monospace,monospace"> | <a href="https://github.com/clearcontainers" target="_blank">https://github.com/kata-containers</a></span><font color="#888888"><span style="font-family:monospace,monospace"><span style="font-family:monospace,monospace"><br></span></span></font></div><div dir="ltr"><font color="#888888"><font face="monospace, monospace">Open Source Technology Center</font><br><font face="monospace, monospace">Intel Corporation (UK) Ltd. - Co. Reg. #1134945 - Pipers Way, Swindon SN3 1RJ.</font></font><br></div></div></div></div></div></div></div></div></div></div></div>
</div></div>