Re: [PATCH v16 24/33] pc-bios/s390-ccw: Add signed component address overlap checks

2026-07-10 Thread Collin Walling 
On 7/7/26 19:40, Zhuoying Cai wrote:
> Add address range tracking and overlap checks to ensure that no
> component overlaps with a signed component during secure IPL.
> 
> Signed-off-by: Zhuoying Cai 
> Reviewed-by: Jared Rossi 
> Reviewed-by: Matthew Rosato 
> ---
>  pc-bios/s390-ccw/secure-ipl.c | 19 +++
>  pc-bios/s390-ccw/secure-ipl.h | 10 ++
>  2 files changed, 29 insertions(+)
> 
> diff --git a/pc-bios/s390-ccw/secure-ipl.c b/pc-bios/s390-ccw/secure-ipl.c
> index 1ab41e5543..cd2d18bfa0 100644
> --- a/pc-bios/s390-ccw/secure-ipl.c
> +++ b/pc-bios/s390-ccw/secure-ipl.c
> @@ -193,6 +193,23 @@ static void init_lists(IplDeviceComponentList *comp_list,
>  cert_list->ipl_info_header.len = sizeof(IplInfoBlockHeader);
>  }
>  
Reviewed-by: Collin Walling 

-- 
Regards,
  Collin

[PATCH v16 24/33] pc-bios/s390-ccw: Add signed component address overlap checks

2026-07-07 Thread Zhuoying Cai 
Add address range tracking and overlap checks to ensure that no
component overlaps with a signed component during secure IPL.

Signed-off-by: Zhuoying Cai 
Reviewed-by: Jared Rossi 
Reviewed-by: Matthew Rosato 
---
 pc-bios/s390-ccw/secure-ipl.c | 19 +++
 pc-bios/s390-ccw/secure-ipl.h | 10 ++
 2 files changed, 29 insertions(+)

diff --git a/pc-bios/s390-ccw/secure-ipl.c b/pc-bios/s390-ccw/secure-ipl.c
index 1ab41e5543..cd2d18bfa0 100644
--- a/pc-bios/s390-ccw/secure-ipl.c
+++ b/pc-bios/s390-ccw/secure-ipl.c
@@ -193,6 +193,23 @@ static void init_lists(IplDeviceComponentList *comp_list,
 cert_list->ipl_info_header.len = sizeof(IplInfoBlockHeader);
 }
 
+static void check_comp_overlap(IplDeviceComponentList *comp_list,
+   IplDeviceComponentEntry comp_entry)
+{
+IplDeviceComponentEntry *comp;
+
+/*
+ * Check component's address range does not overlap with any
+ * signed component's address range.
+ */
+for_each_rb_entry(comp, comp_list) {
+if (comp->flags & S390_IPL_DEV_COMP_FLAG_SC &&
+intersects(comp->addr, comp->len, comp_entry.addr, 
comp_entry.len)) {
+zipl_secure_error("Component addresses overlap");
+}
+}
+}
+
 static int zipl_load_signature(ComponentEntry *entry, uint64_t sig)
 {
 if (entry->compdat.sig_info.format != DER_SIGNATURE_FORMAT) {
@@ -288,6 +305,8 @@ int zipl_run_secure(ComponentEntry **entry_ptr, const 
uint8_t *tmp_sec,
 comp_entry.addr = comp_addr;
 comp_entry.len = (uint64_t)comp_len;
 
+check_comp_overlap(comp_list, comp_entry);
+
 /* no signature present (unsigned component) */
 if (!sig_entry.len) {
 comp_list_add(comp_list, comp_entry);
diff --git a/pc-bios/s390-ccw/secure-ipl.h b/pc-bios/s390-ccw/secure-ipl.h
index e192f8b61d..f014ae4b1a 100644
--- a/pc-bios/s390-ccw/secure-ipl.h
+++ b/pc-bios/s390-ccw/secure-ipl.h
@@ -112,4 +112,14 @@ static inline bool 
verify_signature(IplDeviceComponentEntry comp_entry,
 return false;
 }
 
+static inline bool intersects(uint64_t addr0, uint64_t size0,
+  uint64_t addr1, uint64_t size1)
+{
+if (addr1 > addr0) {
+return addr1 - addr0 < size0;
+}
+
+return addr0 - addr1 < size1;
+}
+
 #endif /* _PC_BIOS_S390_CCW_SECURE_IPL_H */
-- 
2.54.0

[PATCH v16 24/33] pc-bios/s390-ccw: Add signed component address overlap checks

2026-07-07 Thread Zhuoying Cai 
Add address range tracking and overlap checks to ensure that no
component overlaps with a signed component during secure IPL.

Signed-off-by: Zhuoying Cai 
Reviewed-by: Jared Rossi 
Reviewed-by: Matthew Rosato 
---
 pc-bios/s390-ccw/secure-ipl.c | 19 +++
 pc-bios/s390-ccw/secure-ipl.h | 10 ++
 2 files changed, 29 insertions(+)

diff --git a/pc-bios/s390-ccw/secure-ipl.c b/pc-bios/s390-ccw/secure-ipl.c
index 1ab41e5543..cd2d18bfa0 100644
--- a/pc-bios/s390-ccw/secure-ipl.c
+++ b/pc-bios/s390-ccw/secure-ipl.c
@@ -193,6 +193,23 @@ static void init_lists(IplDeviceComponentList *comp_list,
 cert_list->ipl_info_header.len = sizeof(IplInfoBlockHeader);
 }
 
+static void check_comp_overlap(IplDeviceComponentList *comp_list,
+   IplDeviceComponentEntry comp_entry)
+{
+IplDeviceComponentEntry *comp;
+
+/*
+ * Check component's address range does not overlap with any
+ * signed component's address range.
+ */
+for_each_rb_entry(comp, comp_list) {
+if (comp->flags & S390_IPL_DEV_COMP_FLAG_SC &&
+intersects(comp->addr, comp->len, comp_entry.addr, 
comp_entry.len)) {
+zipl_secure_error("Component addresses overlap");
+}
+}
+}
+
 static int zipl_load_signature(ComponentEntry *entry, uint64_t sig)
 {
 if (entry->compdat.sig_info.format != DER_SIGNATURE_FORMAT) {
@@ -288,6 +305,8 @@ int zipl_run_secure(ComponentEntry **entry_ptr, const 
uint8_t *tmp_sec,
 comp_entry.addr = comp_addr;
 comp_entry.len = (uint64_t)comp_len;
 
+check_comp_overlap(comp_list, comp_entry);
+
 /* no signature present (unsigned component) */
 if (!sig_entry.len) {
 comp_list_add(comp_list, comp_entry);
diff --git a/pc-bios/s390-ccw/secure-ipl.h b/pc-bios/s390-ccw/secure-ipl.h
index e192f8b61d..f014ae4b1a 100644
--- a/pc-bios/s390-ccw/secure-ipl.h
+++ b/pc-bios/s390-ccw/secure-ipl.h
@@ -112,4 +112,14 @@ static inline bool 
verify_signature(IplDeviceComponentEntry comp_entry,
 return false;
 }
 
+static inline bool intersects(uint64_t addr0, uint64_t size0,
+  uint64_t addr1, uint64_t size1)
+{
+if (addr1 > addr0) {
+return addr1 - addr0 < size0;
+}
+
+return addr0 - addr1 < size1;
+}
+
 #endif /* _PC_BIOS_S390_CCW_SECURE_IPL_H */
-- 
2.54.0