Re: [PATCH v6 01/28] Add boot-certs to s390-ccw-virtio machine type option

[Thomas Huth <thuth@redhat.com>]

On 18/09/2025 01.21, Zhuoying Cai wrote:
> Introduce a new `boot-certs` machine type option for the s390-ccw-virtio
> machine. This allows users to specify one or more certificate file paths
> or directories to be used during secure boot.
> 
> Each entry is specified using the syntax:
> 	boot-certs.<index>.path=/path/to/cert.pem
> 
> Multiple paths can be specify using array properties:
> 	boot-certs.0.path=/path/to/cert.pem,
> 	boot-certs.1.path=/path/to/cert-dir,
> 	boot-certs.2.path=/path/to/another-dir...
> 
> Signed-off-by: Zhuoying Cai <zycai@linux.ibm.com>
> ---
>   docs/system/s390x/secure-ipl.rst   | 21 +++++++++++++++++++++
>   hw/s390x/s390-virtio-ccw.c         | 30 ++++++++++++++++++++++++++++++
>   include/hw/s390x/s390-virtio-ccw.h |  2 ++
>   qapi/machine-s390x.json            | 22 ++++++++++++++++++++++
>   qapi/pragma.json                   |  1 +
>   qemu-options.hx                    |  6 +++++-
>   6 files changed, 81 insertions(+), 1 deletion(-)
>   create mode 100644 docs/system/s390x/secure-ipl.rst
> 
> diff --git a/docs/system/s390x/secure-ipl.rst b/docs/system/s390x/secure-ipl.rst
> new file mode 100644
> index 0000000000..92c1bb2153
> --- /dev/null
> +++ b/docs/system/s390x/secure-ipl.rst
> @@ -0,0 +1,21 @@
> +.. SPDX-License-Identifier: GPL-2.0-or-later
> +
> +Secure IPL Command Line Options
> +===============================
> +
> +The s390-ccw-virtio machine type supports secure IPL. These parameters allow users
> +to provide certificates and enable secure IPL directly via the command line.
> +
> +Providing Certificates
> +----------------------
> +
> +The certificate store can be populated by supplying a list of X.509 certificate file
> +paths or directories containing certificate files on the command-line:
> +
> +Note: certificate files must have a .pem extension.
> +
> +.. code-block:: shell
> +
> +    qemu-system-s390x -machine s390-ccw-virtio, \
> +                               boot-certs.0.path=/.../qemu/certs, \
> +                               boot-certs.1.path=/another/path/cert.pem ...

Using newlines/spaces between parameters does not work, so people cannot 
copy-n-paste this example to the shell.

So I think you either have to merge it into one line, or use multiple 
"-machine" statements, e.g.:

     qemu-system-s390x -M s390-ccw-virtio \
                       -M boot-certs.0.path=/.../qemu/certs \
                       -M boot-certs.1.path=/another/path/cert.pem ...

  Thomas