On Fri, Jul 11, 2025 at 05:10:37PM -0400, Zhuoying Cai wrote:
> Add boot-certificates as a parameter of s390-ccw-virtio machine type option.
>
> The `boot-certificates=/path/dir:/path/file` parameter is implemented
> to provide path to either a directory or a single certificate.
>
> Multiple paths can be delineated using a colon.
>
> Signed-off-by: Zhuoying Cai <zy...@linux.ibm.com>
> ---
> hw/s390x/s390-virtio-ccw.c | 22 ++++++++++++++++++++++
> include/hw/s390x/s390-virtio-ccw.h | 1 +
> qemu-options.hx | 7 ++++++-
> 3 files changed, 29 insertions(+), 1 deletion(-)
>
> diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c
> index c294106a74..167876295e 100644
> --- a/hw/s390x/s390-virtio-ccw.c
> +++ b/hw/s390x/s390-virtio-ccw.c
> @@ -798,6 +798,22 @@ static void machine_set_loadparm(Object *obj, Visitor *v,
> g_free(val);
> }
>
> +static inline char *machine_get_boot_certificates(Object *obj, Error **errp)
> +{
> + S390CcwMachineState *ms = S390_CCW_MACHINE(obj);
> +
> + return g_strdup(ms->boot_certificates);
> +}
> +
> +static void machine_set_boot_certificates(Object *obj, const char *str,
> + Error **errp)
> +{
> + S390CcwMachineState *ms = S390_CCW_MACHINE(obj);
> +
> + g_free(ms->boot_certificates);
> + ms->boot_certificates = g_strdup(str);
> +}
> +
> static void ccw_machine_class_init(ObjectClass *oc, const void *data)
> {
> MachineClass *mc = MACHINE_CLASS(oc);
> @@ -851,6 +867,12 @@ static void ccw_machine_class_init(ObjectClass *oc,
> const void *data)
> "Up to 8 chars in set of [A-Za-z0-9. ] (lower case chars
> converted"
> " to upper case) to pass to machine loader, boot manager,"
> " and guest kernel");
> +
> + object_class_property_add_str(oc, "boot-certificates",
> + machine_get_boot_certificates,
> + machine_set_boot_certificates);
> + object_class_property_set_description(oc, "boot-certificates",
> + "provide path to a directory or a single certificate for secure
> boot");
> }
>
> static inline void s390_machine_initfn(Object *obj)
> diff --git a/include/hw/s390x/s390-virtio-ccw.h
> b/include/hw/s390x/s390-virtio-ccw.h
> index 526078a4e2..45adc8bce6 100644
> --- a/include/hw/s390x/s390-virtio-ccw.h
> +++ b/include/hw/s390x/s390-virtio-ccw.h
> @@ -31,6 +31,7 @@ struct S390CcwMachineState {
> uint8_t loadparm[8];
> uint64_t memory_limit;
> uint64_t max_pagesize;
> + char *boot_certificates;
>
> SCLPDevice *sclp;
> };
> diff --git a/qemu-options.hx b/qemu-options.hx
> index 1f862b19a6..d42e6f502c 100644
> --- a/qemu-options.hx
> +++ b/qemu-options.hx
> @@ -43,7 +43,8 @@ DEF("machine", HAS_ARG, QEMU_OPTION_machine, \
> #endif
> " memory-backend='backend-id' specifies explicitly
> provided backend for main RAM (default=none)\n"
> "
> cxl-fmw.0.targets.0=firsttarget,cxl-fmw.0.targets.1=secondtarget,cxl-fmw.0.size=size[,cxl-fmw.0.interleave-granularity=granularity]\n"
> - "
> smp-cache.0.cache=cachename,smp-cache.0.topology=topologylevel\n",
> + "
> smp-cache.0.cache=cachename,smp-cache.0.topology=topologylevel\n"
> + " boot-certificates='/path/directory:/path/file' provide
> a path to a directory or a boot certificate\n",
I forgot to respond to your previous question about how to do
arrays for this. The command line exmaples here for cxl-fmw
and smp-cache conveniently illustrate the syntax.
It would be something like this on the CLI:
boot-certs.0.path=/path/to/dir,boot-certs.1.path=/to/other/dir,boot-certs.2.path=/some/...
With regards,
Daniel
--
|: https://berrange.com -o- https://www.flickr.com/photos/dberrange :|
|: https://libvirt.org -o- https://fstop138.berrange.com :|
|: https://entangle-photo.org -o- https://www.instagram.com/dberrange :|
