Hi!
On 09/05/2025 00.50, Zhuoying Cai wrote:
Add -boot-certificates as a parameter of s390-ccw-virtio machine type option.
The `-boot-certificates /path/dir:/path/file` option is implemented
to provide path to either a directory or a single certificate.
Nit: Remove the "-" before "boot-certificates" now in the patch description
and in the patch subject since this is not a stand-alone option anymore.
Multiple paths can be delineated using a colon.
Signed-off-by: Zhuoying Cai <zy...@linux.ibm.com>
---
hw/s390x/s390-virtio-ccw.c | 22 ++++++++++++++++++++++
include/hw/s390x/s390-virtio-ccw.h | 1 +
qemu-options.hx | 7 ++++++-
3 files changed, 29 insertions(+), 1 deletion(-)
diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c
index 192feb128b..f82f78255a 100644
--- a/hw/s390x/s390-virtio-ccw.c
+++ b/hw/s390x/s390-virtio-ccw.c
@@ -824,6 +824,22 @@ static void machine_set_loadparm(Object *obj, Visitor *v,
s390_ipl_fmt_loadparm(ms->loadparm, val, errp);
}
+static inline char *machine_get_boot_certificates(Object *obj, Error **errp)
+{
+ S390CcwMachineState *ms = S390_CCW_MACHINE(obj);
+
+ return g_strdup(ms->boot_certificates);
+}
+
+static void machine_set_boot_certificates(Object *obj, const char *str,
+ Error **errp)
+{
+ S390CcwMachineState *ms = S390_CCW_MACHINE(obj);
+
+ g_free(ms->boot_certificates);
+ ms->boot_certificates = g_strdup(str);
+}
+
static void ccw_machine_class_init(ObjectClass *oc, const void *data)
{
MachineClass *mc = MACHINE_CLASS(oc);
@@ -878,6 +894,12 @@ static void ccw_machine_class_init(ObjectClass *oc, const
void *data)
"Up to 8 chars in set of [A-Za-z0-9. ] (lower case chars
converted"
" to upper case) to pass to machine loader, boot manager,"
" and guest kernel");
+
+ object_class_property_add_str(oc, "boot-certificates",
+ machine_get_boot_certificates,
+ machine_set_boot_certificates);
+ object_class_property_set_description(oc, "boot-certificates",
+ "provide path to a direcotry or a single certificate for secure
boot");
s/direcotry/directory/
}
static inline void s390_machine_initfn(Object *obj)
diff --git a/include/hw/s390x/s390-virtio-ccw.h
b/include/hw/s390x/s390-virtio-ccw.h
index fc4112fbf5..ed25939243 100644
--- a/include/hw/s390x/s390-virtio-ccw.h
+++ b/include/hw/s390x/s390-virtio-ccw.h
@@ -31,6 +31,7 @@ struct S390CcwMachineState {
uint8_t loadparm[8];
uint64_t memory_limit;
uint64_t max_pagesize;
+ char *boot_certificates;
SCLPDevice *sclp;
};
diff --git a/qemu-options.hx b/qemu-options.hx
index dc694a99a3..e592f6a757 100644
--- a/qemu-options.hx
+++ b/qemu-options.hx
@@ -43,7 +43,8 @@ DEF("machine", HAS_ARG, QEMU_OPTION_machine, \
#endif
" memory-backend='backend-id' specifies explicitly provided
backend for main RAM (default=none)\n"
"
cxl-fmw.0.targets.0=firsttarget,cxl-fmw.0.targets.1=secondtarget,cxl-fmw.0.size=size[,cxl-fmw.0.interleave-granularity=granularity]\n"
- "
smp-cache.0.cache=cachename,smp-cache.0.topology=topologylevel\n",
+ "
smp-cache.0.cache=cachename,smp-cache.0.topology=topologylevel\n"
+ " boot-certificates='/path/directory:/path/file' provide a path
to a directory or a boot certificate\n",
QEMU_ARCH_ALL)
SRST
``-machine [type=]name[,prop=value[,...]]``
@@ -200,6 +201,10 @@ SRST
::
-machine smp-cache.0.cache=l1d,smp-cache.0.topology=core,smp-cache.1.cache=l1i,smp-cache.1.topology=core
+
+ ``boot-certificates='/path/directory:/path/file'``
+ Provide a path to a directory or a boot certificate on s390-ccw host.
"s390-ccw" does not make too much sense when talking about the host. I'd
maybe rather say "on the host [s390x only]" instead?
Thomas
