s390 Ultravisor and Protected VMs

Ultravisor 관리 모델

PVM은 KVM이 guest memory나 guest register 같은 VM state에 접근하지 못하는 KVM VM입니다. 대부분의 관리는 Ultravisor(UV)가 담당하며 PVM과 KVM은 UV API로 관리 작업을 요청합니다.

게스트는 non-protected mode로 시작해 protected mode 전환을 요청할 수 있습니다. KVM은 게스트와 vCPU를 UV에 등록하고 실행을 준비하며 UV는 kernel/initrd 부팅 메모리를 보호·복호화하고 vCPU 시작·정지와 interrupt injection 같은 상태 변경을 보호합니다.

PVM 실행에는 format 4 SIE state description을 사용합니다. 일부 필드 의미가 달라지고 속도 향상과 guest state 노출 축소를 위해 SIE exit를 가능한 한 줄입니다.

.. SPDX-License-Identifier: GPL-2.0

=========================================
s390 (IBM Z) Ultravisor and Protected VMs
=========================================

Summary
-------
Protected virtual machines (PVM) are KVM VMs that do not allow KVM to
access VM state like guest memory or guest registers. Instead, the
PVMs are mostly managed by a new entity called Ultravisor (UV). The UV
provides an API that can be used by PVMs and KVM to request management
actions.

Each guest starts in non-protected mode and then may make a request to
transition into protected mode. On transition, KVM registers the guest
and its VCPUs with the Ultravisor and prepares everything for running
it.

The Ultravisor will secure and decrypt the guest's boot memory
(i.e. kernel/initrd). It will safeguard state changes like VCPU
starts/stops and injected interrupts while the guest is running.

As access to the guest's state, such as the SIE state description, is
normally needed to be able to run a VM, some changes have been made in
the behavior of the SIE instruction. A new format 4 state description
has been introduced, where some fields have different meanings for a
PVM. SIE exits are minimized as much as possible to improve speed and
reduce exposed guest state.

보호된 interrupt injection

KVM은 PVM vCPU의 lowcore에 접근할 수 없으므로 UV가 format 4 state description을 통해 interrupt injection을 보호합니다. machine check, external, I/O, restart interrupt는 offset `0x54`의 interrupt injection control bit로 SIE 진입 시 주입합니다.

주입 시 guest CPU가 해당 interrupt를 허용하지 않으면 validity interception이 발생합니다. 관련 데이터는 format 4 interception data block의 필드로 전달합니다.

program exception과 Service Call exception은 KVM으로 intercept된 명령에서 유효한 에뮬레이션 결과일 때만 주입할 수 있습니다. KVM은 guest memory에 접근할 수 없고 addressing exception은 SIE가 보고하므로 이를 임의로 주입할 수 없습니다.

Interrupt injection
-------------------
Interrupt injection is safeguarded by the Ultravisor. As KVM doesn't
have access to the VCPUs' lowcores, injection is handled via the
format 4 state description.

Machine check, external, IO and restart interruptions each can be
injected on SIE entry via a bit in the interrupt injection control
field (offset 0x54). If the guest cpu is not enabled for the interrupt
at the time of injection, a validity interception is recognized. The
format 4 state description contains fields in the interception data
block where data associated with the interrupt can be transported.

Program and Service Call exceptions have another layer of
safeguarding; they can only be injected for instructions that have
been intercepted into KVM. The exceptions need to be a valid outcome
of an instruction emulation by KVM, e.g. we can never inject a
addressing exception as they are reported by SIE since KVM has no
access to the guest memory.

mask notification interception

KVM은 PVM이 interrupt class를 활성화할 때 더 이상 `lctl(g)`와 `lpsw(e)`를 intercept할 수 없습니다. 대신 CR 0·6·14 내용 변경을 알리는 코드와 PSW bit 13 변경을 알리는 두 notification interception code가 추가됐습니다.

첫 코드는 여러 interrupt subclass 변경을, 둘째 코드는 machine check intervention이 요청되어 이제 허용됨을 나타냅니다.

Mask notification interceptions
-------------------------------
KVM cannot intercept lctl(g) and lpsw(e) anymore in order to be
notified when a PVM enables a certain class of interrupt.  As a
replacement, two new interception codes have been introduced: One
indicating that the contents of CRs 0, 6, or 14 have been changed,
indicating different interruption subclasses; and one indicating that
PSW bit 13 has been changed, indicating that a machine check
intervention was requested and those are now enabled.

보호된 명령 에뮬레이션

format 4 SIE는 format 2보다 많은 명령을 직접 해석하지만 모든 명령을 처리하지는 못합니다. SIE와 UV는 KVM에 넘기는 에뮬레이션 입력과 결과를 함께 보호합니다.

IP의 명령 텍스트는 실제 register 값 대신 고정된 register 값을 사용해 guest instruction text가 새지 않게 합니다. 따라서 guest 관점의 `r<n>` 내용이 하이퍼바이저 관점에서는 `r<m>`에 있을 수 있습니다.

SIDA는 명령이 참조하는 storage data를 옮깁니다. SIE는 intercept된 명령에 필요한 data와 program interrupt만 앞의 데이터 영역을 통해 guest로 이동하게 하며 다른 데이터는 무시하거나 validity interception으로 처리합니다.

Instruction emulation
---------------------
With the format 4 state description for PVMs, the SIE instruction already
interprets more instructions than it does with format 2. It is not able
to interpret every instruction, but needs to hand some tasks to KVM;
therefore, the SIE and the ultravisor safeguard emulation inputs and outputs.

The control structures associated with SIE provide the Secure
Instruction Data Area (SIDA), the Interception Parameters (IP) and the
Secure Interception General Register Save Area.  Guest GRs and most of
the instruction data, such as I/O data structures, are filtered.
Instruction data is copied to and from the SIDA when needed.  Guest
GRs are put into / retrieved from the Secure Interception General
Register Save Area.

Only GR values needed to emulate an instruction will be copied into this
save area and the real register numbers will be hidden.

The Interception Parameters state description field still contains
the bytes of the instruction text, but with pre-set register values
instead of the actual ones. I.e. each instruction always uses the same
instruction text, in order not to leak guest instruction text.
This also implies that the register content that a guest had in r<n>
may be in r<m> from the hypervisor's point of view.

The Secure Instruction Data Area contains instruction storage
data. Instruction data, i.e. data being referenced by an instruction
like the SCCB for sclp, is moved via the SIDA. When an instruction is
intercepted, the SIE will only allow data and program interrupts for
this instruction to be moved to the guest via the two data areas
discussed before. Other data is either ignored or results in validity
interceptions.

secure instruction interception 유형

notification 예시는 store prefix 명령 뒤 새 lowcore 위치를 알리는 경우입니다. 이미 명령이 완료된 것으로 이어지므로 KVM은 notification intercept에 program interrupt를 주입할 수 없습니다.

Instruction emulation interceptions
-----------------------------------
There are two types of SIE secure instruction intercepts: the normal
and the notification type. Normal secure instruction intercepts will
make the guest pending for instruction completion of the intercepted
instruction type, i.e. on SIE entry it is attempted to complete
emulation of the instruction with the data provided by KVM. That might
be a program exception or instruction completion.

The notification type intercepts inform KVM about guest environment
changes due to guest instruction interpretation. Such an interception
is recognized, for example, for the store prefix instruction to provide
the new lowcore location. On SIE reentry, any KVM data in the data areas
is ignored and execution continues as if the guest instruction had
completed. For that reason KVM is not allowed to inject a program
interrupt.

참고 자료

Protected VM 설계의 추가 설명은 KVM Forum 2019의 IBM protected VM 발표 자료를 참조합니다.

Links
-----
`KVM Forum 2019 presentation <https://static.sched.com/hosted_files/kvmforum2019/3b/ibm_protected_vms_s390x.pdf>`_