1*4cea713aSMuminul Islam# Microsoft Hypervisor 2*4cea713aSMuminul Islam 3*4cea713aSMuminul IslamThe Microsoft Hypervisor is a Type 1 hypervisor which runs on x64 and ARM64 architectures. As the foundation of the Hyper-V virtualization stack, it runs millions of Linux and Windows guests in Azure and on-premises deployments. It supports nested virtualization, and security features like AMD's SEV-SNP. It also supports various features in Windows such as [Device guard and confidential guard](https://techcommunity.microsoft.com/t5/iis-support-blog/windows-10-device-guard-and-credential-guard-demystified/ba-p/376419), and [WSL2](https://docs.microsoft.com/en-us/windows/wsl/wsl2-faq) 4*4cea713aSMuminul Islam 5*4cea713aSMuminul IslamSince 2020, Microsoft has been releasing open-source components to support Linux running as root partition on the Microsoft Hypervisor. 6*4cea713aSMuminul Islam 7*4cea713aSMuminul Islam 1. Kernel patches to support Linux booting as root partition 8*4cea713aSMuminul Islam 2. A Linux kernel driver exposing an IOCTL interface for managing guest partitions, via a device node - /dev/mshv 9*4cea713aSMuminul Islam 3. Rust bindings and IOCTL wrappers 10*4cea713aSMuminul Islam 4. IGVM related crates 11*4cea713aSMuminul Islam 12*4cea713aSMuminul Islam## Components 13*4cea713aSMuminul Islam 14*4cea713aSMuminul IslamThe following components are related to MSHV support with Cloud-Hypervisor: 15*4cea713aSMuminul Islam 16*4cea713aSMuminul Islam* [igvm-crates](https://github.com/microsoft/igvm) : Parsing IGVM file 17*4cea713aSMuminul Islam 18*4cea713aSMuminul Islam* [mshv-crates](https://github.com/rust-vmm/mshv) : Rust crates to interact with kernel module (/dev/mshv) 19*4cea713aSMuminul Islam 20*4cea713aSMuminul Islam* [igvm-tooling](https://github.com/microsoft/igvm-tooling) : Tool to generate IGVM file 21*4cea713aSMuminul Islam 22*4cea713aSMuminul Islam## IGVM 23*4cea713aSMuminul Islam 24*4cea713aSMuminul IslamIndependent Guest Virtual Machine (IGVM) file format.The format specification can be found in the igvm_defs crate, with a Rust implementation of the binary format in the igvm crate. 25*4cea713aSMuminul Islam 26*4cea713aSMuminul IslamThe IGVM file format is designed to encapsulate all information required to launch a virtual machine on any given virtualization stack, with support for different isolation technologies such as AMD SEV-SNP and Intel TDX. 27*4cea713aSMuminul Islam 28*4cea713aSMuminul IslamAt a conceptual level, this file format is a set of commands created by the tool that generated the file, used by the loader to construct the initial guest state. The file format also contains measurement information that the underlying platform will use to confirm that the file was loaded correctly and signed by the appropriate authorities. 29*4cea713aSMuminul Islam 30*4cea713aSMuminul IslamCloud Hypervisor can be built using igvm feature flag along with mshv and/or sev-snp. IGVM only works with MSHV. 31*4cea713aSMuminul Islam 32*4cea713aSMuminul Islam## SEV-SNP 33*4cea713aSMuminul Islam 34*4cea713aSMuminul IslamAMD's [Secure Encrypted Virtualization (SEV)](https://www.amd.com/en/developer/sev.html) and extensions such as Secure Nested Paging (SEV-SNP) encrypt memory and restrict access to a guest VM's memory and registers, securing it against a compromised hypervisor or VMM. They utilize the Platform Security Processor (PSP) to store keys and encrypt/decrypt the data. Microsoft has been continuously adding/improving support for SEV-SNP on Microsoft Hyper-V. Cloud-Hypervisor can be built with the sev_snp feature including mshv and igvm feature. 35*4cea713aSMuminul Islam 36*4cea713aSMuminul Islam## Use Cases 37*4cea713aSMuminul Islam 38*4cea713aSMuminul IslamCloud Hypervisor can be built to run on an MSHV root partition by enabling the mshv feature, e.g.: 39*4cea713aSMuminul Islam 40*4cea713aSMuminul Islam```cargo build --locked --all --all-targets --no-default-features --tests --examples --features mshv``` 41*4cea713aSMuminul Islam 42*4cea713aSMuminul IslamCloud Hypervisor on MSHV can boot Linux guests using an IGVM file. IGVM feature depends on mshv for running legacy VMs.e.g.: 43*4cea713aSMuminul Islam 44*4cea713aSMuminul Islam```cargo build --locked --all --all-targets --no-default-features --tests --examples --features igvm``` 45*4cea713aSMuminul Islam 46*4cea713aSMuminul IslamFor running confidential VMs on mshv, you will only need to enable sev_snp, it requires and enables mshv and igvm automatically, eg.: 47*4cea713aSMuminul Islam 48*4cea713aSMuminul Islam```cargo build --locked --all --all-targets --no-default-features --tests --examples --features sev_snp``` 49