On 18/09/2025 01.21, Zhuoying Cai wrote:
DIAGNOSE 320 is introduced to support Certificate Store (CS)
Facility, which includes operations such as query certificate
storage information and provide certificates in the certificate
store.
Currently, only subcode 0 is supported with this patch, which is
used to query the Installed Subcodes Mask (ISM).
This subcode is only supported when the CS facility is enabled.
Availability of CS facility is determined by byte 134 bit 5 of the
SCLP Read Info block. Byte 134's facilities cannot be represented
without the availability of the extended-length-SCCB, so add it as
a check for consistency.
Note: secure IPL is not available for Secure Execution (SE) guests,
as their images are already integrity protected, and an additional
protection of the kernel by secure IPL is not necessary.
This feature is available starting with the gen16 CPU model.
Signed-off-by: Zhuoying Cai <[email protected]>
Reviewed-by: Collin Walling <[email protected]>
---
docs/specs/s390x-secure-ipl.rst | 12 ++++++++
include/hw/s390x/ipl/diag320.h | 20 +++++++++++++
target/s390x/cpu_features.c | 1 +
target/s390x/cpu_features_def.h.inc | 1 +
target/s390x/cpu_models.c | 2 ++
target/s390x/diag.c | 44 +++++++++++++++++++++++++++++
target/s390x/gen-features.c | 3 ++
target/s390x/kvm/kvm.c | 16 +++++++++++
target/s390x/s390x-internal.h | 2 ++
target/s390x/tcg/misc_helper.c | 7 +++++
10 files changed, 108 insertions(+)
create mode 100644 include/hw/s390x/ipl/diag320.h
diff --git a/docs/specs/s390x-secure-ipl.rst b/docs/specs/s390x-secure-ipl.rst
index 9b1de5c604..30ddc81c2b 100644
--- a/docs/specs/s390x-secure-ipl.rst
+++ b/docs/specs/s390x-secure-ipl.rst
@@ -13,3 +13,15 @@ will keep track of the number of certificates, their
respective size,
and a summation of the sizes.
Note: A maximum of 64 certificates are allowed to be stored in the certificate store.
+
+DIAGNOSE function code 'X'320' - Certificate Store Facility
+-----------------------------------------------------------
+
+DIAGNOSE 'X'320' is used to provide support for userspace to directly
+query the s390 certificate store. Userspace may be the s390-ccw BIOS or
+the guest kernel.
+
+Subcode 0 - query installed subcodes
+ Returns a 256-bit installed subcodes mask (ISM) stored in the installed
+ subcodes block (ISB). This mask indicates which sucodes are currently
s/sucodes/subcodes/
Apart from that, the patch looks fine to me.
Thomas
