From 651615d92d244a6dfd7c81ab97bd3369fbe41d06 Mon Sep 17 00:00:00 2001 From: David Gibson Date: Thu, 23 Jul 2020 14:36:45 +1000 Subject: s390: Recognize confidential-guest-support option At least some s390 cpu models support "Protected Virtualization" (PV), a mechanism to protect guests from eavesdropping by a compromised hypervisor. This is similar in function to other mechanisms like AMD's SEV and POWER's PEF, which are controlled by the "confidential-guest-support" machine option. s390 is a slightly special case, because we already supported PV, simply by using a CPU model with the required feature (S390_FEAT_UNPACK). To integrate this with the option used by other platforms, we implement the following compromise: - When the confidential-guest-support option is set, s390 will recognize it, verify that the CPU can support PV (failing if not) and set virtio default options necessary for encrypted or protected guests, as on other platforms. i.e. if confidential-guest-support is set, we will either create a guest capable of entering PV mode, or fail outright. - If confidential-guest-support is not set, guests might still be able to enter PV mode, if the CPU has the right model. This may be a little surprising, but shouldn't actually be harmful. To start a guest supporting Protected Virtualization using the new option use the command line arguments: -object s390-pv-guest,id=pv0 -machine confidential-guest-support=pv0 Signed-off-by: David Gibson Tested-by: Christian Borntraeger Reviewed-by: Christian Borntraeger --- docs/confidential-guest-support.txt | 3 +++ 1 file changed, 3 insertions(+) (limited to 'docs/confidential-guest-support.txt') diff --git a/docs/confidential-guest-support.txt b/docs/confidential-guest-support.txt index 4da4c91..71d07ba 100644 --- a/docs/confidential-guest-support.txt +++ b/docs/confidential-guest-support.txt @@ -43,4 +43,7 @@ AMD Secure Encrypted Virtualization (SEV) POWER Protected Execution Facility (PEF) docs/papr-pef.txt +s390x Protected Virtualization (PV) + docs/system/s390x/protvirt.rst + Other mechanisms may be supported in future. -- cgit v1.1