On Sat, Jul 04 2026, Zhuoying Cai <[email protected]> wrote:
> From: Collin Walling <[email protected]>
>
> DIAG 508 subcode 1 performs signature-verification on signed components.
> A signed component may be a Linux kernel image, or any other signed
> binary. **Verification of initrd is not supported.**
>
> The instruction call expects two item-pairs: an address of a device
> component, an address of the analogous signature file (in PKCS#7 DER format),
> and their respective lengths. All of this data should be encapsulated
> within a Diag508SigVerifBlock.
>
> The DIAG handler will read from the provided addresses
> to retrieve the necessary data, parse the signature file, then
> perform the signature-verification. Because there is no way to
> correlate a specific certificate to a component, each certificate
> in the store is tried until either verification succeeds, or all
> certs have been exhausted.
>
> A return code of 1 indicates success, and the index and length of the
> corresponding certificate will be set in the Diag508SigVerifBlock.
> The following values indicate failure:
>
> 0x0102: no certificates are available in the store
> 0x0202: component data is invalid
> 0x0302: PKCS#7 format signature is invalid
> 0x0402: signature-verification failed
> 0x0502: length of Diag508SigVerifBlock is invalid
>
> Signed-off-by: Collin Walling <[email protected]>
> Signed-off-by: Zhuoying Cai <[email protected]>
> Reviewed-by: Thomas Huth <[email protected]>
> Reviewed-by: Farhan Ali<[email protected]>
> ---
> docs/specs/s390x-secure-ipl.rst | 17 +++++
> include/hw/s390x/ipl/diag508.h | 30 +++++++++
> target/s390x/diag.c | 111 +++++++++++++++++++++++++++++++-
> 3 files changed, 157 insertions(+), 1 deletion(-)
(...)
> + if (!comp_len || !comp_addr || comp_len > DIAG_508_MAX_COMP_LEN) {
> + if (comp_len > DIAG_508_MAX_COMP_LEN) {
> + warn_report("DIAG 0x508: component length %lu exceeds current
> maximum %u",
> + comp_len, DIAG_508_MAX_COMP_LEN);
> + }
> + return DIAG_508_RC_INVAL_COMP_DATA;
> + }
> +
> + if (!sig_len || !sig_addr || sig_len > DIAG_508_MAX_SIG_LEN) {
> + if (sig_len > DIAG_508_MAX_SIG_LEN) {
> + warn_report("DIAG 0x508: signature length %lu exceeds current
> maximum %u",
> + sig_len, DIAG_508_MAX_SIG_LEN);
> + }
> + return DIAG_508_RC_INVAL_PKCS7_SIG;
> + }
Hi,
I'm afraid this breaks the build on win64 (as done by the ci):
../target/s390x/diag.c: In function 'handle_diag508_sig_verif':
../target/s390x/diag.c:683:57: error: format '%lu' expects argument of type
'long unsigned int', but argument 2 has type 'uint64_t' {aka 'long long
unsigned int'} [-Werror=format=]
683 | warn_report("DIAG 0x508: component length %lu exceeds
current maximum %u",
| ~~^
| |
| long unsigned
int
| %llu
684 | comp_len, DIAG_508_MAX_COMP_LEN);
| ~~~~~~~~
| |
| uint64_t {aka long long unsigned int}
../target/s390x/diag.c:691:57: error: format '%lu' expects argument of type
'long unsigned int', but argument 2 has type 'uint64_t' {aka 'long long
unsigned int'} [-Werror=format=]
691 | warn_report("DIAG 0x508: signature length %lu exceeds
current maximum %u",
| ~~^
| |
| long unsigned
int
| %llu
692 | sig_len, DIAG_508_MAX_SIG_LEN);
| ~~~~~~~
| |
| uint64_t {aka long long unsigned int}
Cornelia
