Re: [PATCH v15 05/33] s390x/diag: Introduce DIAG 320 for Certificate Store Facility

[Cornelia Huck <cohuck@redhat.com>]

On Sat, Jul 04 2026, Zhuoying Cai <zycai@linux.ibm.com> wrote:

> DIAGNOSE 320 is introduced to support Certificate Store (CS)
> Facility, which includes operations such as query certificate
> storage information and provide certificates in the certificate
> store.
>
> Currently, only subcode 0 is supported with this patch, which is
> used to query the Installed Subcodes Mask (ISM).
>
> This subcode is only supported when the CS facility is enabled.
>
> Availability of CS facility is determined by byte 134 bit 5 of the
> SCLP Read Info block. Byte 134's facilities cannot be represented
> without the availability of the extended-length-SCCB, so add it as
> a check for consistency.
>
> Note: secure IPL is not available for Secure Execution (SE) guests,
> as their images are already integrity protected, and an additional
> protection of the kernel by secure IPL is not necessary.
>
> This feature is available starting with the gen16 CPU model.
>
> Signed-off-by: Zhuoying Cai <zycai@linux.ibm.com>
> Reviewed-by: Collin Walling <walling@linux.ibm.com>
> Reviewed-by: Farhan Ali <alifm@linux.ibm.com>
> Reviewed-by: Thomas Huth <thuth@redhat.com>
> ---
>  docs/specs/s390x-secure-ipl.rst     | 12 +++++++++
>  include/hw/s390x/ipl/diag320.h      | 20 ++++++++++++++
>  target/s390x/cpu_features.c         |  1 +
>  target/s390x/cpu_features_def.h.inc |  1 +
>  target/s390x/cpu_models.c           |  2 ++
>  target/s390x/diag.c                 | 41 +++++++++++++++++++++++++++++
>  target/s390x/gen-features.c         |  3 +++
>  target/s390x/kvm/kvm.c              | 16 +++++++++++
>  target/s390x/s390x-internal.h       |  2 ++
>  target/s390x/tcg/misc_helper.c      |  7 +++++
>  10 files changed, 105 insertions(+)
>  create mode 100644 include/hw/s390x/ipl/diag320.h

(...)

> +    switch (subcode) {
> +    case DIAG_320_SUBC_QUERY_ISM:
> +        /*
> +         * The Installed Subcode Block (ISB) can be up 8 words in size,
> +         * but the current set of subcodes can fit within a single word
> +         * for now.
> +         */
> +        uint32_t ism_word0 = cpu_to_be32(DIAG_320_ISM_QUERY_SUBCODES);

Hi,

I'm afraid this breaks building with clang (as done by the ci; error
messages are from a build of the whole series, which further changed
this line):

../target/s390x/diag.c:576:9: error: label followed by a declaration is a C23 extension [-Werror,-Wc23-extensions]
  576 |         uint32_t ism_word0 = cpu_to_be32(DIAG_320_ISM_QUERY_SUBCODES |
      |         ^

Cornelia