Re: [kata-dev] Kata with AMD Secure Encrypted Virtualization (SEV)

Jesse,

On EPYC, our IOMMU doesn't yet support SEV, so DMA to/from devices needs to be done using unencrypted pages. It was easy to implement this using the bounce buffers provided by SWIOTLB. As you guessed, a quick change to vring_use_dma_api() got virtio support working properly:

Clear Containers today supports direct device assignment via SRIOV. This requires pre-allocation and pinning of VM memory. Will this continue to work?

Also we have been working on reverse ballooning. i.e. free unused memory from the VM back to the host. Is there is a way to get this to work with encrypted memory

For more details about the patches https://gist.github.com/sboeuf/fc71f0218a81997251ee0d7668df2bd9

-manohar