On Wed, 2026-07-01 at 16:48 -0400, Zhuoying Cai wrote: > DIAG 320 subcode 2 provides verification-certificates (VCs) that are in the > certificate store. Only X509 certificates in DER format and SHA-256 hash > type are recognized. > > The subcode value is denoted by setting the second-left-most bit > of an 8-byte field. > > The Verification Certificate Block (VCB) contains the output data > when the operation completes successfully. It includes a common > header followed by zero or more Verification Certificate Entries (VCEs), > depending on the VCB input length and the VC range (from the first VC > index to the last VC index) in the certificate store. > > Each VCE contains information about a certificate retrieved from > the S390IPLCertificateStore, such as the certificate name, key type, > key ID length, hash length, and the raw certificate data. > The key ID and hash are extracted from the raw certificate by the crypto API. > > Note: SHA2-256 VC hash type is required for retrieving the hash > (fingerprint) of the certificate. > > Signed-off-by: Zhuoying Cai <[email protected]> > --- > docs/specs/s390x-secure-ipl.rst | 24 +++ > include/hw/s390x/ipl/diag320.h | 38 ++++ > target/s390x/diag.c | 317 +++++++++++++++++++++++++++++++- > 3 files changed, 378 insertions(+), 1 deletion(-)
Besides the g_free() that Matt mentioned, the comments I would have for this are purely style- related. So, Reviewed-by: Eric Farman <[email protected]>
