On 9/24/26 7:09 AM, Janosch Frank wrote:
People doing VM management requested a way to query if a VM is in PV or not. So this patch exposes the runtime PV atrribute which is true once the VM sucessfully made the switch into PV mode (according to KVM) and did not yet reboot to drop out of it. This of course does never replace attestation, it's merely QEMU's view of the situation. Signed-off-by: Janosch Frank <[email protected]> CC: Hendrik Brueckner <[email protected]> Reviewed-by: Christian Borntraeger <[email protected]> Reviewed-by: Eric Farman <[email protected]> --- docs/system/s390x/protvirt.rst | 11 +++++++++++ hw/s390x/s390-virtio-ccw.c | 13 +++++++++++++ 2 files changed, 24 insertions(+) diff --git a/docs/system/s390x/protvirt.rst b/docs/system/s390x/protvirt.rst index aee63ed7ec..f4d25b5ae3 100644 --- a/docs/system/s390x/protvirt.rst +++ b/docs/system/s390x/protvirt.rst @@ -65,3 +65,14 @@ metadata. In case this boot method is used, the command line options -initrd and -cmdline are ineffective. The preparation of a PVM image is done via the ``genprotimg`` tool from the s390-tools collection. + + +PV property +----------- + +The s390x-ccw machine exposes the read-only runtime "pv" +property. This property is true if a guest sucessfully made the
Nit: s/sucessfully/successfully/
+transition into PV mode as reported by KVM and hasn't yet exited PV +mode via a reboot. This does not replace PV attestation which is the +only authoritative way to get a definitive answer if a guest is truly +protected. diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c index 7fb78d8fa1..9e2db872fb 100644 --- a/hw/s390x/s390-virtio-ccw.c +++ b/hw/s390x/s390-virtio-ccw.c @@ -838,6 +838,13 @@ static inline void machine_set_secure_boot(Object *obj, bool value, ms->secure_boot = value; }+static inline bool machine_get_pv(Object *obj, Error **errp)+{ + S390CcwMachineState *ms = S390_CCW_MACHINE(obj); + + return ms->pv; +} + /* * S390x-specific global compatibility properties. * @@ -919,6 +926,12 @@ static void ccw_machine_class_init(ObjectClass *oc, const void *data) machine_set_secure_boot); object_class_property_set_description(oc, "secure-boot", "enable/disable secure boot"); + + object_class_property_add_bool(oc, "pv", + machine_get_pv, + NULL); + object_class_property_set_description(oc, "pv", + "true while the guest runs in protected virtualization mode (read-only)"); }static inline void s390_machine_initfn(Object *obj)
