genprotimg: add support for add-secret requests

IBM Secure Execution guests may want to share additional secrets with
the Ultravisor in a secure manner. For this the concept of secret
requests and three new Ultravisor-calls were introduced.

Add support to genprotimg to prepare an Secure Execution image with the
requirement that add-secret requests must provide an extension secret
that matches the customer communication key (CCK) derived extension
secret.

Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>

genprotimg/src/include/pv_hdr_def.h

@@ -34,6 +34,10 @@
 #define PV_PCF_PCKMO_AES	__PV_BIT(57) /* PCKMO encrypt-AES-key functions allowed */
 #define PV_PCF_PCKM_ECC	__PV_BIT(58) /* PCKMO encrypt-ECC-key functions allowed */
 
+/* Secret control flags */
+#define PV_SCF_CCK_EXTENSION_SECRET_ENFORCMENT                                                     \
+	__PV_BIT(1) /* All add-secret requests must provide an extension secret */
+
 /* maxima for the PV version 1 */
 #define PV_V1_IPIB_MAX_SIZE	PAGE_SIZE
 #define PV_V1_PV_HDR_MAX_SIZE	(2 * PAGE_SIZE)

genprotimg/src/pv/pv_args.c

@@ -75,6 +75,13 @@ static gint pv_args_validate_options(PvArgs *args, GError **err)
 		return -1;
 	}
 
+	if (cf_args->scf && !(cf_args->enable_cck_extension_secret_enforcement == PV_NOT_SET)) {
+		g_set_error(
+			err, PV_PARSE_ERROR, PV_PARSE_ERROR_SYNTAX,
+			_("The '--x-scf' option cannot be used with the '--(enable|disable)-extension-secret-required' flags.\nUse 'genprotimg --help' for more information"));
+		return -1;
+	}
+
 	/* Check for unused arguments */
 	if (args->unused_values->len > 0) {
 		g_autofree gchar *unused = NULL;
@@ -100,6 +107,14 @@ static gint pv_args_validate_options(PvArgs *args, GError **err)
 			      "--help' for more information"));
 		return -1;
 	}
+	if (cf_args->enable_cck_extension_secret_enforcement == PV_TRUE &&
+	    !args->cust_comm_key_path) {
+		g_set_error(
+			err, PV_PARSE_ERROR, PR_PARSE_ERROR_MISSING_ARGUMENT,
+			_("Option '--enable-cck-extension-secret' requires the '--comm-key' option.\nUse 'genprotimg "
+			  "--help' for more information"));
+		return -1;
+	}
 
 	if (!args->output_path) {
 		g_set_error(err, PV_PARSE_ERROR, PR_PARSE_ERROR_MISSING_ARGUMENT,
@@ -254,11 +269,12 @@ static gboolean cb_remaining_values(const gchar *option G_GNUC_UNUSED,
 		.description = DISABLE_DESC,                                                       \
 	}
 
-#define INDENT "                                   "
+#define INDENT "                                     "
 
 /* Define the callbacks for mutually exclusive command line flags */
 DEFINE_MUT_EXCL_BOOL_FLAG_CBS(dump);
 DEFINE_MUT_EXCL_BOOL_FLAG_CBS(pckmo);
+DEFINE_MUT_EXCL_BOOL_FLAG_CBS(cck_extension_secret_enforcement);
 
 gint pv_args_parse_options(PvArgs *args, gint *argc, gchar **argv[],
 			   GError **err)
@@ -328,6 +344,14 @@ gint pv_args_parse_options(PvArgs *args, gint *argc, gchar **argv[],
 				   _("Enable PV guest dumps (optional). This option\n" INDENT
 				     "requires the '--comm-key' option."),
 				   _("Disable PV guest dumps (default).")),
+		MUT_EXCL_BOOL_FLAG(
+			cck-extension-secret, cck_extension_secret_enforcement,
+			_("Add-secret requests must provide an extension\n" INDENT
+			  "secret that matches the CCK-derived extension\n" INDENT
+			  "secret (optional). This option requires the\n" INDENT
+			  "'--comm-key' option."),
+			_("Add-secret requests don't have to provide\n" INDENT
+			  "the CCK-derived extension secret (default).")),
 		MUT_EXCL_BOOL_FLAG(pckmo, pckmo,
 				   _("Enable the support for the DEA, TDEA, AES, and\n" INDENT
 				     "ECC PCKMO key encryption functions (default)."),
@@ -445,6 +469,8 @@ gint pv_args_parse_options(PvArgs *args, gint *argc, gchar **argv[],
 		  .arg_data = cb_set_string_option,
 		  .description = _("Specify the secret control flags\n" INDENT
 				   "as a hexadecimal value.\n" INDENT
+				   "Optional; mutually exclusive with\n" INDENT
+				   "'--(enable|disable)-cck-extension-secret';\n" INDENT
 				   "Optional; default: '0x0'."),
 		  .arg_description = _("VALUE") },
 		{ 0 },

genprotimg/src/pv/pv_args.h

@@ -33,6 +33,8 @@ STATIC_ASSERT(PV_NOT_SET == 0)
 typedef struct {
 	gchar *pcf;
 	gchar *scf;
+	/* Add-secret requests do require CCK-extension secrets */
+	PvTristate enable_cck_extension_secret_enforcement;
 	PvTristate enable_dump;
 	PvTristate enable_pckmo;
 } PvControlFlagsArgs;

genprotimg/src/pv/pv_image.c

@@ -260,6 +260,8 @@ static gint pv_img_set_control_flags(PvImage *img, const PvControlFlagsArgs *cf_
 		img->scf = flags;
 	}
 
+	pv_img_set_control_flag(&img->scf, cf_args->enable_cck_extension_secret_enforcement,
+				PV_SCF_CCK_EXTENSION_SECRET_ENFORCMENT);
 	return 0;
 }