From 29ff9408e00e32064d109a57bf055a4f035a1f88 Mon Sep 17 00:00:00 2001
From: Marc Hartmayer <mhartmay@linux.ibm.com>
Date: Fri, 25 Jul 2025 10:15:41 +0200
Subject: [PATCH] rust/pvimg: Add support for '--image-key'

Add support for '--image-key'. This new option can be used to select the
components encryption key (e.g. kernel, initrd, and kernel command
line). Previously, this was only available as an experimental
option ('--x-comp-key').

Reviewed-by: Hendrik Brueckner <brueckner@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
---
 rust/pvimg/src/cli.rs        | 26 +++++++++++++++++++++-----
 rust/pvimg/src/cmd/common.rs |  9 +++------
 rust/pvimg/src/cmd/create.rs |  2 +-
 3 files changed, 25 insertions(+), 12 deletions(-)

diff --git a/rust/pvimg/src/cli.rs b/rust/pvimg/src/cli.rs
index 366dd005..de6ce6ed 100644
--- a/rust/pvimg/src/cli.rs
+++ b/rust/pvimg/src/cli.rs
@@ -116,6 +116,17 @@ pub struct UserKeys {
     /// generated key.
     #[arg(long, value_name = "FILE", alias = "x-header-key")]
     pub hdr_key: Option<PathBuf>,
+
+    /// Use the content of FILE as the image encryption key.
+    ///
+    /// The file must contain exactly 64 bytes of data.
+    #[arg(
+        long,
+        value_name = "FILE",
+        conflicts_with = "disable_image_encryption",
+        alias = "x-comp-key"
+    )]
+    pub image_key: Option<PathBuf>,
 }
 
 #[derive(Args, Debug)]
@@ -387,11 +398,6 @@ pub struct CreateBootImageExperimentalArgs {
     #[arg(long, value_name = "DIR", hide(true))]
     pub x_bootloader_directory: Option<PathBuf>,
 
-    /// Manually set the image components encryption key (experimental option).
-    // Hidden in user documentation.
-    #[arg(long, value_name = "FILE", hide(true))]
-    pub x_comp_key: Option<PathBuf>,
-
     /// Manually set the PSW address used for the Secure Execution header (experimental option).
     // Hidden in user documentation.
     #[arg(long, value_name = "ADDRESS", hide(true))]
@@ -536,6 +542,9 @@ mod test {
             flat_map_collect(insert(mvca.clone(), vec![CliOption::new("disable-cck-update", ["--disable-cck-update"])])),
             flat_map_collect(insert(mvca.clone(), vec![CliOption::new("multiple-cck", ["--disable-cck-update", "--cck", "/dev/null"])])),
             flat_map_collect(insert(mvca.clone(), vec![CliOption::new("x-comp-key", ["--x-comp-key", "/dev/null"])])),
+            flat_map_collect(insert(mvca.clone(), vec![CliOption::new("image-key", ["--image-key", "/dev/null"])])),
+            flat_map_collect(insert(mvca.clone(), vec![CliOption::new("enable-image-encryption", ["--enable-image-encryption"]),
+                                                       CliOption::new("image-key", ["--image-key", "/dev/null"])])),
         ];
         let invalid_create_args = [
             flat_map_collect(remove(mvcanv.clone(), "no-verify")),
@@ -570,6 +579,13 @@ mod test {
             // Image component key cannot be provided multiple times
             flat_map_collect(insert(mvca.clone(), vec![CliOption::new("x-comp-key", ["--x-comp-key", "/dev/null"]),
                                                        CliOption::new("x-comp-key2", ["--x-comp-key", "/dev/null"])])),
+            flat_map_collect(insert(mvca.clone(), vec![CliOption::new("x-comp-key", ["--x-comp-key", "/dev/null"]),
+                                                       CliOption::new("image-key", ["--image-key", "/dev/null"])])),
+
+            // Disable image encryption and providing an image-key is mutually
+            // exclusive.
+            flat_map_collect(insert(mvca.clone(), vec![CliOption::new("disable-image-encryption", ["--disable-image-encryption"]),
+                                                       CliOption::new("image-key", ["--image-key", "/dev/null"])])),
         ];
 
         let mut genprotimg_valid_args = vec![
diff --git a/rust/pvimg/src/cmd/common.rs b/rust/pvimg/src/cmd/common.rs
index d1cb25c7..8c473db7 100644
--- a/rust/pvimg/src/cmd/common.rs
+++ b/rust/pvimg/src/cmd/common.rs
@@ -8,7 +8,7 @@ use anyhow::Result;
 use log::info;
 use pv::{misc::read_file, request::Confidential};
 
-use crate::cli::{CreateBootImageExperimentalArgs, UserKeys};
+use crate::cli::UserKeys;
 
 #[macro_export]
 /// Makes it easier to
@@ -23,12 +23,9 @@ pub struct UserProvidedKeys {
 }
 
 /// Reads all user provided keys.
-pub fn read_user_provided_keys(
-    keys: &UserKeys,
-    experimental_args: &CreateBootImageExperimentalArgs,
-) -> Result<UserProvidedKeys> {
+pub fn read_user_provided_keys(keys: &UserKeys) -> Result<UserProvidedKeys> {
     let components_key = {
-        match &experimental_args.x_comp_key {
+        match &keys.image_key {
             Some(key_path) => {
                 info!(
                     "Use file '{}' as the image components protection key",
diff --git a/rust/pvimg/src/cmd/create.rs b/rust/pvimg/src/cmd/create.rs
index 43871c37..17640804 100644
--- a/rust/pvimg/src/cmd/create.rs
+++ b/rust/pvimg/src/cmd/create.rs
@@ -126,7 +126,7 @@ pub fn create(opt: &CreateBootImageArgs) -> Result<OwnExitCode> {
     let verified_host_keys = opt
         .certificate_args
         .get_verified_hkds("Secure Execution image")?;
-    let user_provided_keys = read_user_provided_keys(&opt.keys, &opt.experimental_args)?;
+    let user_provided_keys = read_user_provided_keys(&opt.keys)?;
     let (plaintext_flags, secret_flags) = parse_flags(opt)?;
 
     if plaintext_flags.is_set(PcfV1::NoComponentEncryption) {