Re: [PATCH v15 14/33] s390x/diag: Implement DIAG 508 subcode 1 for signature verification

[Cornelia Huck <cohuck@redhat.com>]

On Sat, Jul 04 2026, Zhuoying Cai <zycai@linux.ibm.com> wrote:

> From: Collin Walling <walling@linux.ibm.com>
>
> DIAG 508 subcode 1 performs signature-verification on signed components.
> A signed component may be a Linux kernel image, or any other signed
> binary. **Verification of initrd is not supported.**
>
> The instruction call expects two item-pairs: an address of a device
> component, an address of the analogous signature file (in PKCS#7 DER format),
> and their respective lengths. All of this data should be encapsulated
> within a Diag508SigVerifBlock.
>
> The DIAG handler will read from the provided addresses
> to retrieve the necessary data, parse the signature file, then
> perform the signature-verification. Because there is no way to
> correlate a specific certificate to a component, each certificate
> in the store is tried until either verification succeeds, or all
> certs have been exhausted.
>
> A return code of 1 indicates success, and the index and length of the
> corresponding certificate will be set in the Diag508SigVerifBlock.
> The following values indicate failure:
>
> 	0x0102: no certificates are available in the store
> 	0x0202: component data is invalid
> 	0x0302: PKCS#7 format signature is invalid
> 	0x0402: signature-verification failed
> 	0x0502: length of Diag508SigVerifBlock is invalid
>
> Signed-off-by: Collin Walling <walling@linux.ibm.com>
> Signed-off-by: Zhuoying Cai <zycai@linux.ibm.com>
> Reviewed-by: Thomas Huth <thuth@redhat.com>
> Reviewed-by: Farhan Ali<alifm@linux.ibm.com>
> ---
>  docs/specs/s390x-secure-ipl.rst |  17 +++++
>  include/hw/s390x/ipl/diag508.h  |  30 +++++++++
>  target/s390x/diag.c             | 111 +++++++++++++++++++++++++++++++-
>  3 files changed, 157 insertions(+), 1 deletion(-)

(...)

> +    if (!comp_len || !comp_addr || comp_len > DIAG_508_MAX_COMP_LEN) {
> +        if (comp_len > DIAG_508_MAX_COMP_LEN) {
> +            warn_report("DIAG 0x508: component length %lu exceeds current maximum %u",
> +                        comp_len, DIAG_508_MAX_COMP_LEN);
> +        }
> +        return DIAG_508_RC_INVAL_COMP_DATA;
> +    }
> +
> +    if (!sig_len || !sig_addr || sig_len > DIAG_508_MAX_SIG_LEN) {
> +        if (sig_len > DIAG_508_MAX_SIG_LEN) {
> +            warn_report("DIAG 0x508: signature length %lu exceeds current maximum %u",
> +                        sig_len, DIAG_508_MAX_SIG_LEN);
> +        }
> +        return DIAG_508_RC_INVAL_PKCS7_SIG;
> +    }

Hi,

I'm afraid this breaks the build on win64 (as done by the ci):

../target/s390x/diag.c: In function 'handle_diag508_sig_verif':
../target/s390x/diag.c:683:57: error: format '%lu' expects argument of type 'long unsigned int', but argument 2 has type 'uint64_t' {aka 'long long unsigned int'} [-Werror=format=]
  683 |             warn_report("DIAG 0x508: component length %lu exceeds current maximum %u",
      |                                                       ~~^
      |                                                         |
      |                                                         long unsigned int
      |                                                       %llu
  684 |                         comp_len, DIAG_508_MAX_COMP_LEN);
      |                         ~~~~~~~~
      |                         |
      |                         uint64_t {aka long long unsigned int}
../target/s390x/diag.c:691:57: error: format '%lu' expects argument of type 'long unsigned int', but argument 2 has type 'uint64_t' {aka 'long long unsigned int'} [-Werror=format=]
  691 |             warn_report("DIAG 0x508: signature length %lu exceeds current maximum %u",
      |                                                       ~~^
      |                                                         |
      |                                                         long unsigned int
      |                                                       %llu
  692 |                         sig_len, DIAG_508_MAX_SIG_LEN);
      |                         ~~~~~~~
      |                         |
      |                         uint64_t {aka long long unsigned int}

Cornelia