From 95fb1e2b0306c1f79d7f159eb34b5406ed7a602d Mon Sep 17 00:00:00 2001
From: Marc Hartmayer <marc@linux.ibm.com>
Date: Mon, 9 Feb 2026 16:20:28 +0100
Subject: [PATCH] pvimg: Improve error messages
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Improve error messages for errors when reading the SE header protection
key or when the decryption/verification of the SE header has failed.

Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Marc Hartmayer <marc@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
---
 rust/pvimg/src/cmd/info.rs       | 17 ++++++++++++-----
 rust/pvimg/src/pv_utils/error.rs |  3 +++
 2 files changed, 15 insertions(+), 5 deletions(-)

diff --git a/rust/pvimg/src/cmd/info.rs b/rust/pvimg/src/cmd/info.rs
index 29cfacd7..09f98648 100644
--- a/rust/pvimg/src/cmd/info.rs
+++ b/rust/pvimg/src/cmd/info.rs
@@ -4,14 +4,14 @@
 
 use std::io::Write;
 
-use anyhow::Result;
+use anyhow::{Context, Result};
 use log::{info, warn};
 use pv::{
     misc::{open_file, read_file},
     request::SymKey,
 };
 use pvimg::{
-    error::OwnExitCode,
+    error::{Error, OwnExitCode},
     uvdata::{KeyExchangeTrait, SeH, SeHdr, UvDataTrait},
 };
 
@@ -28,9 +28,16 @@ pub fn info(opt: &InfoArgs) -> Result<OwnExitCode> {
     SeHdr::seek_sehdr(&mut img, None)?;
     let hdr = SeHdr::try_from_io(&mut img)?;
     let se_hdr = if let Some(key_path) = &opt.hdr_key {
-        let key =
-            SymKey::try_from_data(hdr.key_type(), read_file(key_path, "Reading key")?.into())?;
-        let decrypted_hdr = hdr.decrypt(&key)?;
+        let key = SymKey::try_from_data(
+            hdr.key_type(),
+            read_file(key_path, "Reading header protection key")?.into(),
+        )
+        .map_err(|err| Error::InvalidSeHdrProtectionKey {
+            source: Box::new(Error::Pv(err)),
+        })?;
+        let decrypted_hdr = hdr
+            .decrypt(&key)
+            .context("Failed to authenticate and decrypt the Secure Execution header")?;
         SeH::DecryptedSeHdr {
             se_hdr: decrypted_hdr,
             verified: true,
diff --git a/rust/pvimg/src/pv_utils/error.rs b/rust/pvimg/src/pv_utils/error.rs
index a12c4a22..5e54a61e 100644
--- a/rust/pvimg/src/pv_utils/error.rs
+++ b/rust/pvimg/src/pv_utils/error.rs
@@ -33,6 +33,9 @@ pub enum Error {
     #[error("Secure Execution header size {given} is larger than the maximum of {maximum} bytes")]
     InvalidSeHdrTooLarge { given: usize, maximum: usize },
 
+    #[error("Invalid Secure Execution header protection key")]
+    InvalidSeHdrProtectionKey { source: Box<Error> },
+
     #[error("Invalid component metadata.")]
     InvalidComponentMetadata,