1Protected Virtualization on s390x 2================================= 3 4The memory and most of the registers of Protected Virtual Machines 5(PVMs) are encrypted or inaccessible to the hypervisor, effectively 6prohibiting VM introspection when the VM is running. At rest, PVMs are 7encrypted and can only be decrypted by the firmware, represented by an 8entity called Ultravisor, of specific IBM Z machines. 9 10 11Prerequisites 12------------- 13 14To run PVMs, a machine with the Protected Virtualization feature, as 15indicated by the Ultravisor Call facility (stfle bit 158), is 16required. The Ultravisor needs to be initialized at boot by setting 17`prot_virt=1` on the host's kernel command line. 18 19Running PVMs requires using the KVM hypervisor. 20 21If those requirements are met, the capability `KVM_CAP_S390_PROTECTED` 22will indicate that KVM can support PVMs on that LPAR. 23 24 25QEMU Settings 26------------- 27 28To indicate to the VM that it can transition into protected mode, the 29`Unpack facility` (stfle bit 161 represented by the feature 30`unpack`/`S390_FEAT_UNPACK`) needs to be part of the cpu model of 31the VM. 32 33All I/O devices need to use the IOMMU. 34Passthrough (vfio) devices are currently not supported. 35 36Host huge page backings are not supported. However guests can use huge 37pages as indicated by its facilities. 38 39 40Boot Process 41------------ 42 43A secure guest image can either be loaded from disk or supplied on the 44QEMU command line. Booting from disk is done by the unmodified 45s390-ccw BIOS. I.e., the bootmap is interpreted, multiple components 46are read into memory and control is transferred to one of the 47components (zipl stage3). Stage3 does some fixups and then transfers 48control to some program residing in guest memory, which is normally 49the OS kernel. The secure image has another component prepended 50(stage3a) that uses the new diag308 subcodes 8 and 10 to trigger the 51transition into secure mode. 52 53Booting from the image supplied on the QEMU command line requires that 54the file passed via -kernel has the same memory layout as would result 55from the disk boot. This memory layout includes the encrypted 56components (kernel, initrd, cmdline), the stage3a loader and 57metadata. In case this boot method is used, the command line 58options -initrd and -cmdline are ineffective. The preparation of a PVM 59image is done via the `genprotimg` tool from the s390-tools 60collection. 61