From 28c4c044e6987b8eb40c1c3fd01400219c2db8fb Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fabiano=20Fid=C3=AAncio?= Date: Thu, 24 Feb 2022 20:39:15 +0100 Subject: [PATCH] hypervisors: Confidential Guests do not support VCPUs hotplug MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit As confidential guests do not support VCPUs hotplug, let's set the "DefaultMaxVCPUs" value to "NumVCPUs". The reason to do this is to ensure that guests will be started with the correct amount of VCPUs, without giving to the guest with all the possible VCPUs the host could provide. One clear side effect of this limitation is that workloads that would require more VCPUs on their yaml definition will not run on this scenario. Signed-off-by: Fabiano Fidêncio --- src/runtime/config/configuration-clh.toml.in | 5 +++++ src/runtime/config/configuration-qemu.toml.in | 5 +++++ src/runtime/virtcontainers/hypervisor.go | 5 +++++ 3 files changed, 15 insertions(+) diff --git a/src/runtime/config/configuration-clh.toml.in b/src/runtime/config/configuration-clh.toml.in index cfd63c488b..0971c6c4b9 100644 --- a/src/runtime/config/configuration-clh.toml.in +++ b/src/runtime/config/configuration-clh.toml.in @@ -20,6 +20,11 @@ image = "@IMAGEPATH@" # from memory encryption to both memory and CPU-state encryption and integrity. # The Kata Containers runtime dynamically detects the available feature set and # aims at enabling the largest possible one. +# +# Known limitations: +# * Does not work by design: +# - CPU Hotplug +# # Default false # confidential_guest = true diff --git a/src/runtime/config/configuration-qemu.toml.in b/src/runtime/config/configuration-qemu.toml.in index 59753db5d6..a603d7607a 100644 --- a/src/runtime/config/configuration-qemu.toml.in +++ b/src/runtime/config/configuration-qemu.toml.in @@ -21,6 +21,11 @@ machine_type = "@MACHINETYPE@" # from memory encryption to both memory and CPU-state encryption and integrity. # The Kata Containers runtime dynamically detects the available feature set and # aims at enabling the largest possible one. +# +# Known limitations: +# * Does not work by design: +# - CPU Hotplug +# # Default false # confidential_guest = true diff --git a/src/runtime/virtcontainers/hypervisor.go b/src/runtime/virtcontainers/hypervisor.go index 713280be72..26f33f5d6b 100644 --- a/src/runtime/virtcontainers/hypervisor.go +++ b/src/runtime/virtcontainers/hypervisor.go @@ -564,6 +564,11 @@ func (conf *HypervisorConfig) Valid() error { conf.DefaultMaxVCPUs = defaultMaxVCPUs } + if conf.ConfidentialGuest && conf.NumVCPUs != conf.DefaultMaxVCPUs { + hvLogger.Warnf("Confidential guests do not support hotplugging of vCPUs. Setting DefaultMaxVCPUs to NumVCPUs (%d)", conf.NumVCPUs) + conf.DefaultMaxVCPUs = conf.NumVCPUs + } + if conf.Msize9p == 0 && conf.SharedFS != config.VirtioFS { conf.Msize9p = defaultMsize9p }