On Fri, 4 Dec 2020 16:44:15 +1100 David Gibson <david@xxxxxxxxxxxxxxxxxxxxx> wrote: > At least some s390 cpu models support "Protected Virtualization" (PV), > a mechanism to protect guests from eavesdropping by a compromised > hypervisor. > > This is similar in function to other mechanisms like AMD's SEV and > POWER's PEF, which are controlled bythe "securable-guest-memory" machine s/bythe/by the/ > option. s390 is a slightly special case, because we already supported > PV, simply by using a CPU model with the required feature > (S390_FEAT_UNPACK). > > To integrate this with the option used by other platforms, we > implement the following compromise: > > - When the securable-guest-memory option is set, s390 will recognize it, > verify that the CPU can support PV (failing if not) and set virtio > default options necessary for encrypted or protected guests, as on > other platforms. i.e. if securable-guest-memory is set, we will > either create a guest capable of entering PV mode, or fail outright s/outright/outright./ > > - If securable-guest-memory is not set, guest's might still be able to s/guest's/guests/ > enter PV mode, if the CPU has the right model. This may be a > little surprising, but shouldn't actually be harmful. > > To start a guest supporting Protected Virtualization using the new > option use the command line arguments: > -object s390-pv-guest,id=pv0 -machine securable-guest-memory=pv0 > > Signed-off-by: David Gibson <david@xxxxxxxxxxxxxxxxxxxxx> > --- > hw/s390x/pv.c | 58 +++++++++++++++++++++++++++++++++++++++++++ > include/hw/s390x/pv.h | 1 + > target/s390x/kvm.c | 3 +++ > 3 files changed, 62 insertions(+) > Modulo any naming changes etc., I think this should work for s390. I don't have the hardware to test this, however, and would appreciate someone with a PV setup giving this a go.
