On 6/6/25 10:00 AM, Daniel P. Berrangé wrote:
> On Wed, Jun 04, 2025 at 05:56:29PM -0400, Zhuoying Cai wrote:
>> Add boot-certificates as a parameter of s390-ccw-virtio machine type option.
>>
>> The `boot-certificates=/path/dir:/path/file` parameter is implemented
>> to provide path to either a directory or a single certificate.
>>
>> Multiple paths can be delineated using a colon.
>
> How do users specify paths which contain a colon as a valid
> character ?
>
It was suggested to separate lists of directories and files with a
colon, following the convention used by the shell PATH variable. As the
colon serves as a delimiter, it’s expected that individual paths do not
contain any colon characters.
> Ideally we should be using array properties when we need
> a list of parameters.
>
Could you provide an example of specifying the boot-certificate
parameter with the -machine option using array properties?
>>
>> Signed-off-by: Zhuoying Cai <zy...@linux.ibm.com>
>> ---
>> hw/s390x/s390-virtio-ccw.c | 22 ++++++++++++++++++++++
>> include/hw/s390x/s390-virtio-ccw.h | 1 +
>> qemu-options.hx | 7 ++++++-
>> 3 files changed, 29 insertions(+), 1 deletion(-)
>>
>> diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c
>> index f20e02de9f..144ef52f34 100644
>> --- a/hw/s390x/s390-virtio-ccw.c
>> +++ b/hw/s390x/s390-virtio-ccw.c
>> @@ -798,6 +798,22 @@ static void machine_set_loadparm(Object *obj, Visitor
>> *v,
>> g_free(val);
>> }
>>
>> +static inline char *machine_get_boot_certificates(Object *obj, Error **errp)
>> +{
>> + S390CcwMachineState *ms = S390_CCW_MACHINE(obj);
>> +
>> + return g_strdup(ms->boot_certificates);
>> +}
>> +
>> +static void machine_set_boot_certificates(Object *obj, const char *str,
>> + Error **errp)
>> +{
>> + S390CcwMachineState *ms = S390_CCW_MACHINE(obj);
>> +
>> + g_free(ms->boot_certificates);
>> + ms->boot_certificates = g_strdup(str);
>> +}
>> +
>> static void ccw_machine_class_init(ObjectClass *oc, const void *data)
>> {
>> MachineClass *mc = MACHINE_CLASS(oc);
>> @@ -851,6 +867,12 @@ static void ccw_machine_class_init(ObjectClass *oc,
>> const void *data)
>> "Up to 8 chars in set of [A-Za-z0-9. ] (lower case chars
>> converted"
>> " to upper case) to pass to machine loader, boot manager,"
>> " and guest kernel");
>> +
>> + object_class_property_add_str(oc, "boot-certificates",
>> + machine_get_boot_certificates,
>> + machine_set_boot_certificates);
>> + object_class_property_set_description(oc, "boot-certificates",
>> + "provide path to a directory or a single certificate for secure
>> boot");
>> }
>>
>> static inline void s390_machine_initfn(Object *obj)
>> diff --git a/include/hw/s390x/s390-virtio-ccw.h
>> b/include/hw/s390x/s390-virtio-ccw.h
>> index 526078a4e2..45adc8bce6 100644
>> --- a/include/hw/s390x/s390-virtio-ccw.h
>> +++ b/include/hw/s390x/s390-virtio-ccw.h
>> @@ -31,6 +31,7 @@ struct S390CcwMachineState {
>> uint8_t loadparm[8];
>> uint64_t memory_limit;
>> uint64_t max_pagesize;
>> + char *boot_certificates;
>>
>> SCLPDevice *sclp;
>> };
>> diff --git a/qemu-options.hx b/qemu-options.hx
>> index 7eb8e02b4b..6d01f8c4b2 100644
>> --- a/qemu-options.hx
>> +++ b/qemu-options.hx
>> @@ -43,7 +43,8 @@ DEF("machine", HAS_ARG, QEMU_OPTION_machine, \
>> #endif
>> " memory-backend='backend-id' specifies explicitly
>> provided backend for main RAM (default=none)\n"
>> "
>> cxl-fmw.0.targets.0=firsttarget,cxl-fmw.0.targets.1=secondtarget,cxl-fmw.0.size=size[,cxl-fmw.0.interleave-granularity=granularity]\n"
>> - "
>> smp-cache.0.cache=cachename,smp-cache.0.topology=topologylevel\n",
>> + "
>> smp-cache.0.cache=cachename,smp-cache.0.topology=topologylevel\n"
>> + " boot-certificates='/path/directory:/path/file' provide
>> a path to a directory or a boot certificate\n",
>> QEMU_ARCH_ALL)
>> SRST
>> ``-machine [type=]name[,prop=value[,...]]``
>> @@ -200,6 +201,10 @@ SRST
>> ::
>>
>> -machine
>> smp-cache.0.cache=l1d,smp-cache.0.topology=core,smp-cache.1.cache=l1i,smp-cache.1.topology=core
>> +
>> + ``boot-certificates='/path/directory:/path/file'``
>> + Provide a path to a directory or a boot certificate on the host
>> [s390x only].
>> + A colon may be used to delineate multiple paths.
>> ERST
>>
>> DEF("M", HAS_ARG, QEMU_OPTION_M,
>> --
>> 2.49.0
>>
>
> With regards,
> Daniel
