85 lines · plain
1.. SPDX-License-Identifier: GPL-2.02 3======================================4s390 (IBM Z) Boot/IPL of Protected VMs5======================================6 7Summary8-------9The memory of Protected Virtual Machines (PVMs) is not accessible to10I/O or the hypervisor. In those cases where the hypervisor needs to11access the memory of a PVM, that memory must be made accessible.12Memory made accessible to the hypervisor will be encrypted. See13Documentation/virt/kvm/s390/s390-pv.rst for details."14 15On IPL (boot) a small plaintext bootloader is started, which provides16information about the encrypted components and necessary metadata to17KVM to decrypt the protected virtual machine.18 19Based on this data, KVM will make the protected virtual machine known20to the Ultravisor (UV) and instruct it to secure the memory of the21PVM, decrypt the components and verify the data and address list22hashes, to ensure integrity. Afterwards KVM can run the PVM via the23SIE instruction which the UV will intercept and execute on KVM's24behalf.25 26As the guest image is just like an opaque kernel image that does the27switch into PV mode itself, the user can load encrypted guest28executables and data via every available method (network, dasd, scsi,29direct kernel, ...) without the need to change the boot process.30 31 32Diag30833-------34This diagnose instruction is the basic mechanism to handle IPL and35related operations for virtual machines. The VM can set and retrieve36IPL information blocks, that specify the IPL method/devices and37request VM memory and subsystem resets, as well as IPLs.38 39For PVMs this concept has been extended with new subcodes:40 41Subcode 8: Set an IPL Information Block of type 5 (information block42for PVMs)43Subcode 9: Store the saved block in guest memory44Subcode 10: Move into Protected Virtualization mode45 46The new PV load-device-specific-parameters field specifies all data47that is necessary to move into PV mode.48 49* PV Header origin50* PV Header length51* List of Components composed of52 * AES-XTS Tweak prefix53 * Origin54 * Size55 56The PV header contains the keys and hashes, which the UV will use to57decrypt and verify the PV, as well as control flags and a start PSW.58 59The components are for instance an encrypted kernel, kernel parameters60and initrd. The components are decrypted by the UV.61 62After the initial import of the encrypted data, all defined pages will63contain the guest content. All non-specified pages will start out as64zero pages on first access.65 66 67When running in protected virtualization mode, some subcodes will result in68exceptions or return error codes.69 70Subcodes 4 and 7, which specify operations that do not clear the guest71memory, will result in specification exceptions. This is because the72UV will clear all memory when a secure VM is removed, and therefore73non-clearing IPL subcodes are not allowed.74 75Subcodes 8, 9, 10 will result in specification exceptions.76Re-IPL into a protected mode is only possible via a detour into non77protected mode.78 79Keys80----81Every CEC will have a unique public key to enable tooling to build82encrypted images.83See `s390-tools <https://github.com/ibm-s390-linux/s390-tools/>`_84for the tooling.85