Re: [PATCH v12 01/35] Add boot-certs to s390-ccw-virtio machine type option

[Matthew Rosato <mjrosato@linux.ibm.com>]

On 7/1/26 8:47 PM, Matthew Rosato wrote:
> On 7/1/26 7:30 PM, Jared Rossi wrote:
>>
>>
>> On 7/1/26 4:48 PM, Zhuoying Cai wrote:
>>> Introduce a new `boot-certs` machine type option for the s390-ccw-virtio
>>> machine. This allows users to specify one or more certificate file paths
>>> or directories to be used during secure boot.
>> The new boot-certs option is able to handle complex certificate
>> organization across multiple directories, but it seems to reject the
>> most basic case of passing a single directory path.
>>
>> E.g. using: -machine s390-ccw-virtio,accel=kvm,boot-certs=/root/certs
>>
>> produces the error: "Invalid parameter type for 'boot-certs', expected:
>> array"
>>
>> I understand that this can be fixed by expanding "boot-certs" to "boot-
>> certs.0.path" however this does not seem intuitive to me. Is this the
>> expected behavior by design?
> 
> smp-cache exhibits the same behavior e.g.
> 
> 'smp-cache.cache=l1d,smp-cache.topology=cluster' does not work
> 
> 'smp-cache.0.cache=l1d,smp-cache.0.topology=cluster' does
> 
> So I believe it is a common shortcoming.  If you only want a single
> certificate directory, it will be boot-certs.0.path.
> 
> The rationale for wanting to be able to specify multiple paths was
> provided by Daniel here:
> 
> https://lore.kernel.org/qemu-devel/aMvE7Phd7sLvgj-J@redhat.com/
> 
>>
>> Regards,
>> Jared Rossi
>>
>>> Each entry is specified using the syntax:
>>>     boot-certs.<index>.path=/path/to/cert.pem
>>>
>>> Multiple paths can be specify using array properties:
> 
> Nit: s/specify/specified/
> 
> Reviewed-by: Matthew Rosato <mjrosato@linux.ibm.com>
> 
> 

Hrm, actually...   Shouldn't this be fenced for older machines?

qemu-system-s390x -machine s390-ccw-virtio-10.0,accel=kvm,boot-certs.0.path=/root/certs

Appears to accept the path (I did not try to actually boot),
which clearly would not work if I migrated this guest to an
older QEMU release that has the 10.0 machine but does not
include your code.  There, you would see an error like:

qemu-system-s390x: Property 's390-ccw-virtio-10.0-machine.boot-certs' not found

You can use the compat machine properties to disable it for
older machine versions.