From: Andra Paraschiv <andraprs@amazon.com>
To: linux-kernel <linux-kernel@vger.kernel.org>
Cc: Alexandru Ciobotaru <alcioa@amazon.com>,
Greg KH <gregkh@linuxfoundation.org>,
Kamal Mostafa <kamal@canonical.com>,
"Alexandru Vasile" <lexnv@amazon.com>,
Paolo Bonzini <pbonzini@redhat.com>,
"Stefano Garzarella" <sgarzare@redhat.com>,
Stefan Hajnoczi <stefanha@redhat.com>,
Vitaly Kuznetsov <vkuznets@redhat.com>, kvm <kvm@vger.kernel.org>,
ne-devel-upstream <ne-devel-upstream@amazon.com>,
Andra Paraschiv <andraprs@amazon.com>
Subject: [PATCH v3 2/7] nitro_enclaves: Update documentation for Arm64 support
Date: Fri, 27 Aug 2021 18:49:25 +0300 [thread overview]
Message-ID: <20210827154930.40608-3-andraprs@amazon.com> (raw)
In-Reply-To: <20210827154930.40608-1-andraprs@amazon.com>
Add references for hugepages and booting steps for Arm64.
Include info about the current supported architectures for the
NE kernel driver.
Signed-off-by: Andra Paraschiv <andraprs@amazon.com>
---
Changelog
v1 -> v2
* Add information about supported architectures for the NE kernel
driver.
v2 -> v3
* Move changelog after the "---" line.
---
Documentation/virt/ne_overview.rst | 21 +++++++++++++--------
1 file changed, 13 insertions(+), 8 deletions(-)
diff --git a/Documentation/virt/ne_overview.rst b/Documentation/virt/ne_overview.rst
index 39b0c8fe2654a..74c2f5919c886 100644
--- a/Documentation/virt/ne_overview.rst
+++ b/Documentation/virt/ne_overview.rst
@@ -14,12 +14,15 @@ instances [1].
For example, an application that processes sensitive data and runs in a VM,
can be separated from other applications running in the same VM. This
application then runs in a separate VM than the primary VM, namely an enclave.
+It runs alongside the VM that spawned it. This setup matches low latency
+applications needs.
-An enclave runs alongside the VM that spawned it. This setup matches low latency
-applications needs. The resources that are allocated for the enclave, such as
-memory and CPUs, are carved out of the primary VM. Each enclave is mapped to a
-process running in the primary VM, that communicates with the NE driver via an
-ioctl interface.
+The current supported architectures for the NE kernel driver, available in the
+upstream Linux kernel, are x86 and ARM64.
+
+The resources that are allocated for the enclave, such as memory and CPUs, are
+carved out of the primary VM. Each enclave is mapped to a process running in the
+primary VM, that communicates with the NE kernel driver via an ioctl interface.
In this sense, there are two components:
@@ -43,8 +46,8 @@ for the enclave VM. An enclave does not have persistent storage attached.
The memory regions carved out of the primary VM and given to an enclave need to
be aligned 2 MiB / 1 GiB physically contiguous memory regions (or multiple of
this size e.g. 8 MiB). The memory can be allocated e.g. by using hugetlbfs from
-user space [2][3]. The memory size for an enclave needs to be at least 64 MiB.
-The enclave memory and CPUs need to be from the same NUMA node.
+user space [2][3][7]. The memory size for an enclave needs to be at least
+64 MiB. The enclave memory and CPUs need to be from the same NUMA node.
An enclave runs on dedicated cores. CPU 0 and its CPU siblings need to remain
available for the primary VM. A CPU pool has to be set for NE purposes by an
@@ -61,7 +64,7 @@ device is placed in memory below the typical 4 GiB.
The application that runs in the enclave needs to be packaged in an enclave
image together with the OS ( e.g. kernel, ramdisk, init ) that will run in the
enclave VM. The enclave VM has its own kernel and follows the standard Linux
-boot protocol [6].
+boot protocol [6][8].
The kernel bzImage, the kernel command line, the ramdisk(s) are part of the
Enclave Image Format (EIF); plus an EIF header including metadata such as magic
@@ -93,3 +96,5 @@ enclave process can exit.
[4] https://www.kernel.org/doc/html/latest/admin-guide/kernel-parameters.html
[5] https://man7.org/linux/man-pages/man7/vsock.7.html
[6] https://www.kernel.org/doc/html/latest/x86/boot.html
+[7] https://www.kernel.org/doc/html/latest/arm64/hugetlbpage.html
+[8] https://www.kernel.org/doc/html/latest/arm64/booting.html
--
2.20.1 (Apple Git-117)
Amazon Development Center (Romania) S.R.L. registered office: 27A Sf. Lazar Street, UBC5, floor 2, Iasi, Iasi County, 700045, Romania. Registered in Romania. Registration number J22/2621/2005.
next prev parent reply other threads:[~2021-08-27 15:50 UTC|newest]
Thread overview: 21+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-08-27 15:49 [PATCH v3 0/7] nitro_enclaves: Add support for Arm64 Andra Paraschiv
2021-08-27 15:49 ` [PATCH v3 1/7] nitro_enclaves: Enable Arm64 support Andra Paraschiv
2021-08-30 15:59 ` George-Aurelian Popescu
2021-08-30 18:30 ` Paraschiv, Andra-Irina
2021-08-31 6:43 ` Greg KH
2021-08-31 7:51 ` Paraschiv, Andra-Irina
2021-11-04 19:03 ` Paraschiv, Andra-Irina
2021-08-27 15:49 ` Andra Paraschiv [this message]
2021-08-30 15:56 ` [PATCH v3 2/7] nitro_enclaves: Update documentation for " George-Aurelian Popescu
2021-08-31 7:43 ` Stefano Garzarella
2021-08-31 11:28 ` Paraschiv, Andra-Irina
2021-08-27 15:49 ` [PATCH v3 3/7] nitro_enclaves: Add fix for the kernel-doc report Andra Paraschiv
2021-08-30 15:53 ` George-Aurelian Popescu
2021-08-27 15:49 ` [PATCH v3 4/7] nitro_enclaves: Update copyright statement to include 2021 Andra Paraschiv
2021-08-30 15:49 ` George-Aurelian Popescu
2021-08-27 15:49 ` [PATCH v3 5/7] nitro_enclaves: Add fixes for checkpatch match open parenthesis reports Andra Paraschiv
2021-08-30 15:48 ` George-Aurelian Popescu
2021-08-27 15:49 ` [PATCH v3 6/7] nitro_enclaves: Add fixes for checkpatch spell check reports Andra Paraschiv
2021-08-30 15:46 ` George-Aurelian Popescu
2021-08-27 15:49 ` [PATCH v3 7/7] nitro_enclaves: Add fixes for checkpatch blank line reports Andra Paraschiv
2021-08-30 15:45 ` George-Aurelian Popescu
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210827154930.40608-3-andraprs@amazon.com \
--to=andraprs@amazon.com \
--cc=alcioa@amazon.com \
--cc=gregkh@linuxfoundation.org \
--cc=kamal@canonical.com \
--cc=kvm@vger.kernel.org \
--cc=lexnv@amazon.com \
--cc=linux-kernel@vger.kernel.org \
--cc=ne-devel-upstream@amazon.com \
--cc=pbonzini@redhat.com \
--cc=sgarzare@redhat.com \
--cc=stefanha@redhat.com \
--cc=vkuznets@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.