On 7/1/26 8:47 PM, Matthew Rosato wrote: > On 7/1/26 7:30 PM, Jared Rossi wrote: >> >> >> On 7/1/26 4:48 PM, Zhuoying Cai wrote: >>> Introduce a new `boot-certs` machine type option for the s390-ccw-virtio >>> machine. This allows users to specify one or more certificate file paths >>> or directories to be used during secure boot. >> The new boot-certs option is able to handle complex certificate >> organization across multiple directories, but it seems to reject the >> most basic case of passing a single directory path. >> >> E.g. using: -machine s390-ccw-virtio,accel=kvm,boot-certs=/root/certs >> >> produces the error: "Invalid parameter type for 'boot-certs', expected: >> array" >> >> I understand that this can be fixed by expanding "boot-certs" to "boot- >> certs.0.path" however this does not seem intuitive to me. Is this the >> expected behavior by design? > > smp-cache exhibits the same behavior e.g. > > 'smp-cache.cache=l1d,smp-cache.topology=cluster' does not work > > 'smp-cache.0.cache=l1d,smp-cache.0.topology=cluster' does > > So I believe it is a common shortcoming. If you only want a single > certificate directory, it will be boot-certs.0.path. > > The rationale for wanting to be able to specify multiple paths was > provided by Daniel here: > > https://lore.kernel.org/qemu-devel/[email protected]/ > >> >> Regards, >> Jared Rossi >> >>> Each entry is specified using the syntax: >>> boot-certs.<index>.path=/path/to/cert.pem >>> >>> Multiple paths can be specify using array properties: > > Nit: s/specify/specified/ > > Reviewed-by: Matthew Rosato <[email protected]> > >
Hrm, actually... Shouldn't this be fenced for older machines? qemu-system-s390x -machine s390-ccw-virtio-10.0,accel=kvm,boot-certs.0.path=/root/certs Appears to accept the path (I did not try to actually boot), which clearly would not work if I migrated this guest to an older QEMU release that has the 10.0 machine but does not include your code. There, you would see an error like: qemu-system-s390x: Property 's390-ccw-virtio-10.0-machine.boot-certs' not found You can use the compat machine properties to disable it for older machine versions.
