Re: [PATCH v12 09/35] s390x/diag: Implement DIAG 320 subcode 2

[Eric Farman <farman@linux.ibm.com>]

On Wed, 2026-07-01 at 16:48 -0400, Zhuoying Cai wrote:
> DIAG 320 subcode 2 provides verification-certificates (VCs) that are in the
> certificate store. Only X509 certificates in DER format and SHA-256 hash
> type are recognized.
> 
> The subcode value is denoted by setting the second-left-most bit
> of an 8-byte field.
> 
> The Verification Certificate Block (VCB) contains the output data
> when the operation completes successfully. It includes a common
> header followed by zero or more Verification Certificate Entries (VCEs),
> depending on the VCB input length and the VC range (from the first VC
> index to the last VC index) in the certificate store.
> 
> Each VCE contains information about a certificate retrieved from
> the S390IPLCertificateStore, such as the certificate name, key type,
> key ID length, hash length, and the raw certificate data.
> The key ID and hash are extracted from the raw certificate by the crypto API.
> 
> Note: SHA2-256 VC hash type is required for retrieving the hash
> (fingerprint) of the certificate.
> 
> Signed-off-by: Zhuoying Cai <zycai@linux.ibm.com>
> ---
>  docs/specs/s390x-secure-ipl.rst |  24 +++
>  include/hw/s390x/ipl/diag320.h  |  38 ++++
>  target/s390x/diag.c             | 317 +++++++++++++++++++++++++++++++-
>  3 files changed, 378 insertions(+), 1 deletion(-)

Besides the g_free() that Matt mentioned, the comments I would have for this are purely style-
related. So,

Reviewed-by: Eric Farman <farman@linux.ibm.com>