요약·해설과 원문, 전문 번역을 서로 분리했습니다. API 이름, symbol, source path는 원문 표기를 사용합니다.
1. 요약·해설
원문의 핵심 논리와 kernel programming 관점의 보충 설명입니다. 아래의 전문 번역과는 별도로 작성했습니다.
2. 영어 원문 전체
번역 기준이 된 Linux v6.18.37 원문입니다. 줄 번호는 이 버전의 파일 좌표입니다.
원문 전체 펼치기
1
.. SPDX-License-Identifier: GPL-2.0
3
======================================
4
s390 (IBM Z) Boot/IPL of Protected VMs
5
======================================
7
Summary
8
-------
9
The memory of Protected Virtual Machines (PVMs) is not accessible to
10
I/O or the hypervisor. In those cases where the hypervisor needs to
11
access the memory of a PVM, that memory must be made accessible.
12
Memory made accessible to the hypervisor will be encrypted. See
13
Documentation/virt/kvm/s390/s390-pv.rst for details."
15
On IPL (boot) a small plaintext bootloader is started, which provides
16
information about the encrypted components and necessary metadata to
17
KVM to decrypt the protected virtual machine.
19
Based on this data, KVM will make the protected virtual machine known
20
to the Ultravisor (UV) and instruct it to secure the memory of the
21
PVM, decrypt the components and verify the data and address list
22
hashes, to ensure integrity. Afterwards KVM can run the PVM via the
23
SIE instruction which the UV will intercept and execute on KVM's
24
behalf.
26
As the guest image is just like an opaque kernel image that does the
27
switch into PV mode itself, the user can load encrypted guest
28
executables and data via every available method (network, dasd, scsi,
29
direct kernel, ...) without the need to change the boot process.
32
Diag308
33
-------
34
This diagnose instruction is the basic mechanism to handle IPL and
35
related operations for virtual machines. The VM can set and retrieve
36
IPL information blocks, that specify the IPL method/devices and
37
request VM memory and subsystem resets, as well as IPLs.
39
For PVMs this concept has been extended with new subcodes:
41
Subcode 8: Set an IPL Information Block of type 5 (information block
42
for PVMs)
43
Subcode 9: Store the saved block in guest memory
44
Subcode 10: Move into Protected Virtualization mode
46
The new PV load-device-specific-parameters field specifies all data
47
that is necessary to move into PV mode.
49
* PV Header origin
50
* PV Header length
51
* List of Components composed of
52
* AES-XTS Tweak prefix
53
* Origin
54
* Size
56
The PV header contains the keys and hashes, which the UV will use to
57
decrypt and verify the PV, as well as control flags and a start PSW.
59
The components are for instance an encrypted kernel, kernel parameters
60
and initrd. The components are decrypted by the UV.
62
After the initial import of the encrypted data, all defined pages will
63
contain the guest content. All non-specified pages will start out as
64
zero pages on first access.
67
When running in protected virtualization mode, some subcodes will result in
68
exceptions or return error codes.
70
Subcodes 4 and 7, which specify operations that do not clear the guest
71
memory, will result in specification exceptions. This is because the
72
UV will clear all memory when a secure VM is removed, and therefore
73
non-clearing IPL subcodes are not allowed.
75
Subcodes 8, 9, 10 will result in specification exceptions.
76
Re-IPL into a protected mode is only possible via a detour into non
77
protected mode.
79
Keys
80
----
81
Every CEC will have a unique public key to enable tooling to build
82
encrypted images.
83
See `s390-tools <https://github.com/ibm-s390-linux/s390-tools/>`_
84
for the tooling.
3. 한국어 전문 번역
영어 원문의 문단 순서와 의미를 유지한 전체 번역입니다. 코드, 함수명, symbol과 URL은 원문 표기를 유지합니다.
보호 부팅 개요
1-31Protected VM(PVM) 메모리는 I/O와 하이퍼바이저가 접근할 수 없습니다. 하이퍼바이저 접근이 필요한 메모리는 명시적으로 접근 가능하게 만들어야 하며, 이때도 암호화 상태를 유지합니다.
IPL 때 작은 평문 bootloader가 암호화 구성요소와 메타데이터를 KVM에 제공합니다. KVM은 PVM을 Ultravisor(UV)에 등록하고 메모리 보호, 구성요소 복호화, 데이터와 주소 목록 hash 검증을 요청합니다. 이후 `SIE`는 UV가 가로채 KVM 대신 PVM을 실행합니다.
게스트 이미지는 스스로 PV 모드로 전환하는 불투명한 커널 이미지처럼 취급되므로 network, DASD, SCSI, direct kernel 등 기존 방식으로 암호화 실행 파일과 데이터를 적재할 수 있으며 부팅 절차를 바꿀 필요가 없습니다.
.. SPDX-License-Identifier: GPL-2.0
======================================
s390 (IBM Z) Boot/IPL of Protected VMs
======================================
Summary
-------
The memory of Protected Virtual Machines (PVMs) is not accessible to
I/O or the hypervisor. In those cases where the hypervisor needs to
access the memory of a PVM, that memory must be made accessible.
Memory made accessible to the hypervisor will be encrypted. See
Documentation/virt/kvm/s390/s390-pv.rst for details."
On IPL (boot) a small plaintext bootloader is started, which provides
information about the encrypted components and necessary metadata to
KVM to decrypt the protected virtual machine.
Based on this data, KVM will make the protected virtual machine known
to the Ultravisor (UV) and instruct it to secure the memory of the
PVM, decrypt the components and verify the data and address list
hashes, to ensure integrity. Afterwards KVM can run the PVM via the
SIE instruction which the UV will intercept and execute on KVM's
behalf.
As the guest image is just like an opaque kernel image that does the
switch into PV mode itself, the user can load encrypted guest
executables and data via every available method (network, dasd, scsi,
direct kernel, ...) without the need to change the boot process.
Diag308과 PV 구성요소
32-78Diag308은 VM의 IPL 정보 블록 설정·조회, 메모리와 subsystem reset, IPL 요청을 처리하는 기본 명령입니다. PVM은 type 5 IPL 정보 블록 설정(subcode 8), 저장 블록을 guest memory에 기록(subcode 9), Protected Virtualization 모드 전환(subcode 10)을 추가합니다.
필드내용
PV Header originPV header 시작 주소
PV Header lengthheader 길이
Components각 구성요소의 AES-XTS tweak prefix, origin, size
PV 모드 전환에 필요한 암호화 이미지 설명입니다.
PV header에는 UV가 PVM을 복호화·검증할 key와 hash, control flag, 시작 PSW가 들어 있습니다. 구성요소는 암호화된 kernel, kernel parameter, initrd 등이 될 수 있고 UV가 복호화합니다. import 뒤 정의된 페이지에는 guest content가, 나머지 페이지에는 첫 접근 시 zero page가 생깁니다.
PV 모드에서 메모리를 지우지 않는 subcode 4와 7은 specification exception을 냅니다. secure VM 제거 시 UV가 모든 메모리를 지우므로 non-clearing IPL은 허용되지 않습니다. subcode 8, 9, 10도 PV 모드 안에서는 exception이며 재-IPL은 먼저 non-protected mode로 돌아간 뒤 수행해야 합니다.
Diag308
-------
This diagnose instruction is the basic mechanism to handle IPL and
related operations for virtual machines. The VM can set and retrieve
IPL information blocks, that specify the IPL method/devices and
request VM memory and subsystem resets, as well as IPLs.
For PVMs this concept has been extended with new subcodes:
Subcode 8: Set an IPL Information Block of type 5 (information block
for PVMs)
Subcode 9: Store the saved block in guest memory
Subcode 10: Move into Protected Virtualization mode
The new PV load-device-specific-parameters field specifies all data
that is necessary to move into PV mode.
* PV Header origin
* PV Header length
* List of Components composed of
* AES-XTS Tweak prefix
* Origin
* Size
The PV header contains the keys and hashes, which the UV will use to
decrypt and verify the PV, as well as control flags and a start PSW.
The components are for instance an encrypted kernel, kernel parameters
and initrd. The components are decrypted by the UV.
After the initial import of the encrypted data, all defined pages will
contain the guest content. All non-specified pages will start out as
zero pages on first access.
When running in protected virtualization mode, some subcodes will result in
exceptions or return error codes.
Subcodes 4 and 7, which specify operations that do not clear the guest
memory, will result in specification exceptions. This is because the
UV will clear all memory when a secure VM is removed, and therefore
non-clearing IPL subcodes are not allowed.
Subcodes 8, 9, 10 will result in specification exceptions.
Re-IPL into a protected mode is only possible via a detour into non
protected mode.
CEC 공개 키
79-84각 CEC는 도구가 암호화 이미지를 만들 수 있도록 고유한 공개 키를 가집니다. 관련 도구는 `s390-tools` 프로젝트에서 제공합니다.
Keys
----
Every CEC will have a unique public key to enable tooling to build
encrypted images.
See `s390-tools <https://github.com/ibm-s390-linux/s390-tools/>`_
for the tooling.
요약·해설
s390-pv-boot.rst:1-84Ultravisor가 암호화 구성요소를 검증·복호화하는 PVM IPL과 Diag308 절차입니다.
ABI 필드, 명령·레지스터 이름, 소스 경로와 줄 좌표를 보존하고 보안 경계와 실행 순서를 구조화했습니다.