[PATCH] igvm: add command line parameter support

[PATCH] igvm: add command line parameter support

[Luigi Leonardi]

Add a "cmdline" property to the igvm-cfg object and a handler for the
IGVM_VHT_COMMAND_LINE directive, which copies the string into the
parameter area the directive points at.

This command line is intended for the component running at VMPL0, such
as SVSM, rather than for the guest OS, whose own command line still
comes from -append. SVSM can use it to select the serial port it logs
to, for example.

Signed-off-by: Luigi Leonardi <leonardi@redhat.com>
---
 backends/igvm-cfg.c            | 20 ++++++++++++++++++++
 backends/igvm.c                | 31 +++++++++++++++++++++++++++++++
 include/system/igvm-internal.h |  5 +++++
 qapi/qom.json                  |  6 +++++-
 4 files changed, 61 insertions(+), 1 deletion(-)

diff --git a/backends/igvm-cfg.c b/backends/igvm-cfg.c
index 935ba54f54..5b9a30e938 100644
--- a/backends/igvm-cfg.c
+++ b/backends/igvm-cfg.c
@@ -34,6 +34,19 @@ static void set_igvm(Object *obj, const char *value, Error **errp)
     igvm->filename = g_strdup(value);
 }
 
+static char *get_cmdline(Object *obj, Error **errp)
+{
+    IgvmCfg *igvm = IGVM_CFG(obj);
+    return g_strdup(igvm->cmdline);
+}
+
+static void set_cmdline(Object *obj, const char *value, Error **errp)
+{
+    IgvmCfg *igvm = IGVM_CFG(obj);
+    g_free(igvm->cmdline);
+    igvm->cmdline = g_strdup(value);
+}
+
 static ResettableState *igvm_reset_state(Object *obj)
 {
     IgvmCfg *igvm = IGVM_CFG(obj);
@@ -85,6 +98,12 @@ static void igvm_cfg_class_init(ObjectClass *oc, const void *data)
     object_class_property_set_description(oc, "file",
                                           "Set the IGVM filename to use");
 
+    object_class_property_add_str(oc, "cmdline", get_cmdline, set_cmdline);
+    object_class_property_set_description(oc, "cmdline",
+                                          "Set the command line for the "
+                                          "software loaded from the IGVM "
+                                          "file");
+
     igvmc->process = qigvm_process_file;
 
     rc->get_state = igvm_reset_state;
@@ -112,4 +131,5 @@ static void igvm_cfg_finalize(Object *obj)
         igvm_free(igvm->file);
     }
     g_free(igvm->filename);
+    g_free(igvm->cmdline);
 }
diff --git a/backends/igvm.c b/backends/igvm.c
index ec7bee428b..d059fee4d2 100644
--- a/backends/igvm.c
+++ b/backends/igvm.c
@@ -158,6 +158,8 @@ static int qigvm_directive_snp_id_block(QIgvm *ctx, const uint8_t *header_data,
 static int qigvm_initialization_guest_policy(QIgvm *ctx,
                                        const uint8_t *header_data,
                                        Error **errp);
+static int qigvm_directive_command_line(QIgvm *ctx, const uint8_t *header_data,
+                                        Error **errp);
 #ifdef CONFIG_FDT
 static int qigvm_directive_device_tree(QIgvm *ctx, const uint8_t *header_data,
                                        Error **errp);
@@ -192,6 +194,8 @@ static struct QIGVMHandler handlers[] = {
       qigvm_initialization_guest_policy },
     { IGVM_VHT_MADT, IGVM_HEADER_SECTION_DIRECTIVE,
       qigvm_directive_madt },
+    { IGVM_VHT_COMMAND_LINE, IGVM_HEADER_SECTION_DIRECTIVE,
+      qigvm_directive_command_line },
 #ifdef CONFIG_FDT
     { IGVM_VHT_DEVICE_TREE, IGVM_HEADER_SECTION_DIRECTIVE,
       qigvm_directive_device_tree },
@@ -851,6 +855,33 @@ static int qigvm_directive_snp_id_block(QIgvm *ctx, const uint8_t *header_data,
     return 0;
 }
 
+static int qigvm_directive_command_line(QIgvm *ctx, const uint8_t *header_data,
+                                        Error **errp)
+{
+    const IGVM_VHS_PARAMETER *param = (const IGVM_VHS_PARAMETER *)header_data;
+    const char *cmdline = ctx->cfg->cmdline ? ctx->cfg->cmdline : "";
+    uint8_t *param_data;
+    uint32_t param_size;
+    size_t cmdline_size = strlen(cmdline) + 1;
+
+    param_data = qigvm_get_param_data(ctx, param, &param_size, errp);
+    if (!param_data) {
+        return -1;
+    }
+
+    if (cmdline_size > param_size) {
+        error_setg(errp,
+                   "IGVM: command line size %zu exceeds the %u byte "
+                   "parameter area defined in IGVM file",
+                   cmdline_size, param_size);
+        return -1;
+    }
+
+    memcpy(param_data, cmdline, cmdline_size);
+
+    return 0;
+}
+
 #ifdef CONFIG_FDT
 static int qigvm_directive_device_tree(QIgvm *ctx, const uint8_t *header_data,
                                        Error **errp)
diff --git a/include/system/igvm-internal.h b/include/system/igvm-internal.h
index b3b64cb584..b56a2e1254 100644
--- a/include/system/igvm-internal.h
+++ b/include/system/igvm-internal.h
@@ -32,6 +32,11 @@ struct IgvmCfg {
      *           format.
      */
     char *filename;
+    /*
+     * cmdline: Command line for the software loaded from the IGVM file,
+     *          if it asks for one.
+     */
+    char *cmdline;
     IgvmHandle file;
     ResettableState reset_state;
     QTAILQ_HEAD(, IgvmMemoryRegion) memory_regions;
diff --git a/qapi/qom.json b/qapi/qom.json
index 5895c97750..d56bdef561 100644
--- a/qapi/qom.json
+++ b/qapi/qom.json
@@ -1004,11 +1004,15 @@
 #
 # @file: IGVM file to use to configure guest
 #
+# @cmdline: command line for the software loaded from the IGVM file,
+#     rather than for the guest OS.  Ignored if the IGVM file does
+#     not ask for one.  (since 11.2)
+#
 # Since: 10.1
 ##
 { 'struct': 'IgvmCfgProperties',
   'if': 'CONFIG_IGVM',
-  'data': { 'file': 'str' } }
+  'data': { 'file': 'str', '*cmdline': 'str' } }
 
 ##
 # @SevCommonProperties:

---
base-commit: 9c88811b81a935a172c5c873b2ada2d9b38a5f74
change-id: 20260930-igvm_command_line-ccb5a0bddda0

Best regards,
-- 
Luigi Leonardi <leonardi@redhat.com>

Re: [PATCH] igvm: add command line parameter support

[Markus Armbruster]

Luigi Leonardi <leonardi@redhat.com> writes:

> Add a "cmdline" property to the igvm-cfg object and a handler for the
> IGVM_VHT_COMMAND_LINE directive, which copies the string into the
> parameter area the directive points at.
>
> This command line is intended for the component running at VMPL0, such
> as SVSM, rather than for the guest OS, whose own command line still
> comes from -append. SVSM can use it to select the serial port it logs
> to, for example.
>
> Signed-off-by: Luigi Leonardi <leonardi@redhat.com>

[...]

> diff --git a/qapi/qom.json b/qapi/qom.json
> index 5895c97750..d56bdef561 100644
> --- a/qapi/qom.json
> +++ b/qapi/qom.json
> @@ -1004,11 +1004,15 @@
>  #
>  # @file: IGVM file to use to configure guest
>  #
> +# @cmdline: command line for the software loaded from the IGVM file,
> +#     rather than for the guest OS.  Ignored if the IGVM file does
> +#     not ask for one.  (since 11.2)
> +#
>  # Since: 10.1
>  ##
>  { 'struct': 'IgvmCfgProperties',
>    'if': 'CONFIG_IGVM',
> -  'data': { 'file': 'str' } }
> +  'data': { 'file': 'str', '*cmdline': 'str' } }
>  
>  ##
>  # @SevCommonProperties:

How is @cmdline going to be parsed?  By a shell?

For what it's worth, MigrationExecCommand uses ['str'].  Such values can
be passed to exec()-like functions without parsing.

Re: [PATCH] igvm: add command line parameter support

[Daniel P. Berrangé]

On Thu, Oct 01, 2026 at 10:08:34AM +0200, Markus Armbruster wrote:
> Luigi Leonardi <leonardi@redhat.com> writes:
> 
> > Add a "cmdline" property to the igvm-cfg object and a handler for the
> > IGVM_VHT_COMMAND_LINE directive, which copies the string into the
> > parameter area the directive points at.
> >
> > This command line is intended for the component running at VMPL0, such
> > as SVSM, rather than for the guest OS, whose own command line still
> > comes from -append. SVSM can use it to select the serial port it logs
> > to, for example.
> >
> > Signed-off-by: Luigi Leonardi <leonardi@redhat.com>
> 
> [...]
> 
> > diff --git a/qapi/qom.json b/qapi/qom.json
> > index 5895c97750..d56bdef561 100644
> > --- a/qapi/qom.json
> > +++ b/qapi/qom.json
> > @@ -1004,11 +1004,15 @@
> >  #
> >  # @file: IGVM file to use to configure guest
> >  #
> > +# @cmdline: command line for the software loaded from the IGVM file,
> > +#     rather than for the guest OS.  Ignored if the IGVM file does
> > +#     not ask for one.  (since 11.2)
> > +#
> >  # Since: 10.1
> >  ##
> >  { 'struct': 'IgvmCfgProperties',
> >    'if': 'CONFIG_IGVM',
> > -  'data': { 'file': 'str' } }
> > +  'data': { 'file': 'str', '*cmdline': 'str' } }
> >  
> >  ##
> >  # @SevCommonProperties:
> 
> How is @cmdline going to be parsed?  By a shell?

This is something passed to the guest workflow. ie a kernel command
line string.

> For what it's worth, MigrationExecCommand uses ['str'].  Such values can
> be passed to exec()-like functions without parsing.

In this case we should treat 'cmdline' as an opaque strnig and not
try to place any semantics on its expected syntax.

With regards,
Daniel
-- 
|: https://berrange.com       ~~        https://hachyderm.io/@berrange :|
|: https://libvirt.org          ~~          https://entangle-photo.org :|
|: https://pixelfed.art/berrange   ~~    https://fstop138.berrange.com :|

Re: [PATCH] igvm: add command line parameter support

[Markus Armbruster]

Daniel P. Berrangé <berrange@redhat.com> writes:

> On Thu, Oct 01, 2026 at 10:08:34AM +0200, Markus Armbruster wrote:
>> Luigi Leonardi <leonardi@redhat.com> writes:
>> 
>> > Add a "cmdline" property to the igvm-cfg object and a handler for the
>> > IGVM_VHT_COMMAND_LINE directive, which copies the string into the
>> > parameter area the directive points at.
>> >
>> > This command line is intended for the component running at VMPL0, such
>> > as SVSM, rather than for the guest OS, whose own command line still
>> > comes from -append. SVSM can use it to select the serial port it logs
>> > to, for example.
>> >
>> > Signed-off-by: Luigi Leonardi <leonardi@redhat.com>
>> 
>> [...]
>> 
>> > diff --git a/qapi/qom.json b/qapi/qom.json
>> > index 5895c97750..d56bdef561 100644
>> > --- a/qapi/qom.json
>> > +++ b/qapi/qom.json
>> > @@ -1004,11 +1004,15 @@
>> >  #
>> >  # @file: IGVM file to use to configure guest
>> >  #
>> > +# @cmdline: command line for the software loaded from the IGVM file,
>> > +#     rather than for the guest OS.  Ignored if the IGVM file does
>> > +#     not ask for one.  (since 11.2)
>> > +#
>> >  # Since: 10.1
>> >  ##
>> >  { 'struct': 'IgvmCfgProperties',
>> >    'if': 'CONFIG_IGVM',
>> > -  'data': { 'file': 'str' } }
>> > +  'data': { 'file': 'str', '*cmdline': 'str' } }
>> >  
>> >  ##
>> >  # @SevCommonProperties:
>> 
>> How is @cmdline going to be parsed?  By a shell?
>
> This is something passed to the guest workflow. ie a kernel command
> line string.

Not obvious from the description text.  Please make it obvious.

>> For what it's worth, MigrationExecCommand uses ['str'].  Such values can
>> be passed to exec()-like functions without parsing.
>
> In this case we should treat 'cmdline' as an opaque strnig and not
> try to place any semantics on its expected syntax.
>
> With regards,
> Daniel

Re: [PATCH] igvm: add command line parameter support

[Luigi Leonardi]

On Thu, Oct 01, 2026 at 10:27:30AM +0200, Markus Armbruster wrote:
>Daniel P. Berrangé <berrange@redhat.com> writes:
>
>> On Thu, Oct 01, 2026 at 10:08:34AM +0200, Markus Armbruster wrote:
>>> Luigi Leonardi <leonardi@redhat.com> writes:
>>>
>>> > Add a "cmdline" property to the igvm-cfg object and a handler for the
>>> > IGVM_VHT_COMMAND_LINE directive, which copies the string into the
>>> > parameter area the directive points at.
>>> >
>>> > This command line is intended for the component running at VMPL0, such
>>> > as SVSM, rather than for the guest OS, whose own command line still
>>> > comes from -append. SVSM can use it to select the serial port it logs
>>> > to, for example.
>>> >
>>> > Signed-off-by: Luigi Leonardi <leonardi@redhat.com>
>>>
>>> [...]
>>>
>>> > diff --git a/qapi/qom.json b/qapi/qom.json
>>> > index 5895c97750..d56bdef561 100644
>>> > --- a/qapi/qom.json
>>> > +++ b/qapi/qom.json
>>> > @@ -1004,11 +1004,15 @@
>>> >  #
>>> >  # @file: IGVM file to use to configure guest
>>> >  #
>>> > +# @cmdline: command line for the software loaded from the IGVM file,
>>> > +#     rather than for the guest OS.  Ignored if the IGVM file does
>>> > +#     not ask for one.  (since 11.2)
>>> > +#
>>> >  # Since: 10.1
>>> >  ##
>>> >  { 'struct': 'IgvmCfgProperties',
>>> >    'if': 'CONFIG_IGVM',
>>> > -  'data': { 'file': 'str' } }
>>> > +  'data': { 'file': 'str', '*cmdline': 'str' } }
>>> >
>>> >  ##
>>> >  # @SevCommonProperties:
>>>
>>> How is @cmdline going to be parsed?  By a shell?
>>
>> This is something passed to the guest workflow. ie a kernel command
>> line string.

yep, correct!

>
>Not obvious from the description text.  Please make it obvious.
>

will do!

Thanks,
Luigi