[Patch v4 2/2] cgroup: svm: Encryption IDs cgroup documentation.

From: Vipin Sharma
Date: Thu Jan 07 2021 - 20:30:36 EST

Documentation for both cgroup versions, v1 and v2, of Encryption IDs
controller. This new controller is used to track and limit usage of
hardware memory encryption capabilities on the CPUs.

Signed-off-by: Vipin Sharma <vipinsh@xxxxxxxxxx>
Reviewed-by: David Rientjes <rientjes@xxxxxxxxxx>
Reviewed-by: Dionna Glaze <dionnaglaze@xxxxxxxxxx>
---
.../admin-guide/cgroup-v1/encryption_ids.rst | 108 ++++++++++++++++++
Documentation/admin-guide/cgroup-v2.rst | 78 ++++++++++++-
2 files changed, 184 insertions(+), 2 deletions(-)
create mode 100644 Documentation/admin-guide/cgroup-v1/encryption_ids.rst

diff --git a/Documentation/admin-guide/cgroup-v1/encryption_ids.rst b/Documentation/admin-guide/cgroup-v1/encryption_ids.rst
new file mode 100644
index 000000000000..891143b4e229
--- /dev/null
+++ b/Documentation/admin-guide/cgroup-v1/encryption_ids.rst
@@ -0,0 +1,108 @@
+=========================
+Encryption IDs Controller
+=========================
+
+Overview
+========
+There are multiple hardware memory encryption capabilities provided by the
+hardware vendors, like Secure Encrypted Virtualization (SEV) and SEV Encrypted
+State (SEV-ES) from AMD.
+
+These features are being used in encrypting virtual machines (VMs) and user
+space programs. However, only a small number of keys/IDs can be used
+simultaneously.
+
+This limited availability of these IDs requires system admin to optimize
+allocation, control, and track the usage of the resources in the cloud
+infrastructure. This resource also needs to be protected from getting exhausted
+by some malicious program and causing starvation for other programs.
+
+Encryption IDs controller provides capability to register the resource for
+controlling and tracking through the cgroups.
+
+How to Enable Controller
+========================
+
+- Enable Encryption controller::
+
+ CONFIG_CGROUP_ENCRYPTION_IDS=y
+
+- Above options will build Encryption controller support in the kernel.
+ To mount the Encryption controller::
+
+ mount -t cgroup -o encryption none /sys/fs/cgroup/encryption
+
+
+Interface Files
+===============
+Each encryption ID type have their own interface files,
+encryption_id.[ID TYPE].{max, current, stat}, where "ID TYPE" can be sev and
+sev-es.
+
+ encryption_ids.[ID TYPE].stat
+ A read-only flat-keyed single value file. This file exists only in the
+ root cgroup.
+
+ It shows the total number of encryption IDs available and currently in
+ use on the platform::
+ # cat encryption.sev.stat
+ total 509
+ used 0
+
+ encryption_ids.[ID TYPE].max
+ A read-write file which exists on the non-root cgroups. File is used to
+ set maximum count of "[ID TYPE]" which can be used in the cgroup.
+
+ Limit can be set to max by::
+ # echo max > encryption.sev.max
+
+ Limit can be set by::
+ # echo 100 > encryption.sev.max
+
+ This file shows the max limit of the encryption ID in the cgroup::
+ # cat encryption.sev.max
+ max
+
+ OR::
+ # cat encryption.sev.max
+ 100
+
+ Limits can be set more than the "total" capacity value in the
+ encryption_ids.[ID TYPE].stat file, however, the controller ensures
+ that the usage never exceeds the "total" and the max limit.
+
+ encryption_ids.[ID TYPE].current
+ A read-only single value file which exists on non-root cgroups.
+
+ Shows the total number of encrypted IDs being used in the cgroup.
+
+Hierarchy
+=========
+
+Encryption IDs controller supports hierarchical accounting. It supports
+following features:
+
+1. Current usage in the cgroup shows IDs used in the cgroup and its descendent cgroups.
+2. Current usage can never exceed the corresponding max limit set in the cgroup
+ and its ancestor's chain up to the root.
+
+Suppose the following example hierarchy::
+
+ root
+ / \
+ A B
+ |
+ C
+
+1. A will show the count of IDs used in A and C.
+2. C's current IDs usage may not exceed any of the max limits set in C, A, or
+ root.
+
+Migration and ownership
+=======================
+
+An encryption ID is charged to the cgroup in which it is used first, and
+stays charged to that cgroup until that ID is freed. Migrating a process
+to a different cgroup do not move the charge to the destination cgroup
+where the process has moved.
+
diff --git a/Documentation/admin-guide/cgroup-v2.rst b/Documentation/admin-guide/cgroup-v2.rst
index 63521cd36ce5..b6ea47b9e882 100644
--- a/Documentation/admin-guide/cgroup-v2.rst
+++ b/Documentation/admin-guide/cgroup-v2.rst
@@ -63,8 +63,11 @@ v1 is available under :ref:`Documentation/admin-guide/cgroup-v1/index.rst <cgrou
5-7-1. RDMA Interface Files
5-8. HugeTLB
5.8-1. HugeTLB Interface Files
- 5-8. Misc
- 5-8-1. perf_event
+ 5-9. Encryption IDs
+ 5.9-1 Encryption IDs Interface Files
+ 5.9-2 Migration and Ownership
+ 5-10. Misc
+ 5-10-1. perf_event
5-N. Non-normative information
5-N-1. CPU controller root cgroup process behaviour
5-N-2. IO controller root cgroup process behaviour
@@ -2160,6 +2163,77 @@ HugeTLB Interface Files
are local to the cgroup i.e. not hierarchical. The file modified event
generated on this file reflects only the local events.

+Encryption IDs
+--------------
+
+There are multiple hardware memory encryption capabilities provided by the
+hardware vendors, like Secure Encrypted Virtualization (SEV) and SEV Encrypted
+State (SEV-ES) from AMD.
+
+These features are being used in encrypting virtual machines (VMs) and user
+space programs. However, only a small number of keys/IDs can be used
+simultaneously.
+
+This limited availability of these IDs requires system admin to optimize
+allocation, control, and track the usage of the resources in the cloud
+infrastructure. This resource also needs to be protected from getting exhausted
+by some malicious program and causing starvation for other programs.
+
+Encryption IDs controller provides capability to register the resource for
+controlling and tracking through the cgroups.
+
+Encryption IDs Interface Files
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Each encryption ID type have their own interface files,
+encryption_id.[ID TYPE].{max, current, stat}, where "ID TYPE" can be sev and
+sev-es.
+
+ encryption_ids.[ID TYPE].stat
+ A read-only flat-keyed single value file. This file exists only in the
+ root cgroup.
+
+ It shows the total number of encryption IDs available and currently in
+ use on the platform::
+ # cat encryption.sev.stat
+ total 509
+ used 0
+
+ encryption_ids.[ID TYPE].max
+ A read-write file which exists on the non-root cgroups. File is used to
+ set maximum count of "[ID TYPE]" which can be used in the cgroup.
+
+ Limit can be set to max by::
+ # echo max > encryption.sev.max
+
+ Limit can be set by::
+ # echo 100 > encryption.sev.max
+
+ This file shows the max limit of the encryption ID in the cgroup::
+ # cat encryption.sev.max
+ max
+
+ OR::
+ # cat encryption.sev.max
+ 100
+
+ Limits can be set more than the "total" capacity value in the
+ encryption_ids.[ID TYPE].stat file, however, the controller ensures
+ that the usage never exceeds the "total" and the max limit.
+
+ encryption_ids.[ID TYPE].current
+ A read-only single value file which exists on non-root cgroups.
+
+ Shows the total number of encrypted IDs being used in the cgroup.
+
+Migration and Ownership
+~~~~~~~~~~~~~~~~~~~~~~~
+
+An encryption ID is charged to the cgroup in which it is used first, and
+stays charged to that cgroup until that ID is freed. Migrating a process
+to a different cgroup do not move the charge to the destination cgroup
+where the process has moved.
+
Misc
----

--
2.29.2.729.g45daf8777d-goog