On Sat, Jul 04 2026, Zhuoying Cai <[email protected]> wrote:
> DIAGNOSE 320 is introduced to support Certificate Store (CS)
> Facility, which includes operations such as query certificate
> storage information and provide certificates in the certificate
> store.
>
> Currently, only subcode 0 is supported with this patch, which is
> used to query the Installed Subcodes Mask (ISM).
>
> This subcode is only supported when the CS facility is enabled.
>
> Availability of CS facility is determined by byte 134 bit 5 of the
> SCLP Read Info block. Byte 134's facilities cannot be represented
> without the availability of the extended-length-SCCB, so add it as
> a check for consistency.
>
> Note: secure IPL is not available for Secure Execution (SE) guests,
> as their images are already integrity protected, and an additional
> protection of the kernel by secure IPL is not necessary.
>
> This feature is available starting with the gen16 CPU model.
>
> Signed-off-by: Zhuoying Cai <[email protected]>
> Reviewed-by: Collin Walling <[email protected]>
> Reviewed-by: Farhan Ali <[email protected]>
> Reviewed-by: Thomas Huth <[email protected]>
> ---
> docs/specs/s390x-secure-ipl.rst | 12 +++++++++
> include/hw/s390x/ipl/diag320.h | 20 ++++++++++++++
> target/s390x/cpu_features.c | 1 +
> target/s390x/cpu_features_def.h.inc | 1 +
> target/s390x/cpu_models.c | 2 ++
> target/s390x/diag.c | 41 +++++++++++++++++++++++++++++
> target/s390x/gen-features.c | 3 +++
> target/s390x/kvm/kvm.c | 16 +++++++++++
> target/s390x/s390x-internal.h | 2 ++
> target/s390x/tcg/misc_helper.c | 7 +++++
> 10 files changed, 105 insertions(+)
> create mode 100644 include/hw/s390x/ipl/diag320.h
(...)
> + switch (subcode) {
> + case DIAG_320_SUBC_QUERY_ISM:
> + /*
> + * The Installed Subcode Block (ISB) can be up 8 words in size,
> + * but the current set of subcodes can fit within a single word
> + * for now.
> + */
> + uint32_t ism_word0 = cpu_to_be32(DIAG_320_ISM_QUERY_SUBCODES);
Hi,
I'm afraid this breaks building with clang (as done by the ci; error
messages are from a build of the whole series, which further changed
this line):
../target/s390x/diag.c:576:9: error: label followed by a declaration is a C23
extension [-Werror,-Wc23-extensions]
576 | uint32_t ism_word0 = cpu_to_be32(DIAG_320_ISM_QUERY_SUBCODES |
| ^
Cornelia
