Remove pvattest-C and switch to pvattest-Rust implementation

Removes the C implementation of pvattest. Use the Rust implementation instead. Closes: https://github.com/ibm-s390-linux/s390-tools/issues/164 Acked-by: Marc Hartmayer <mhartmay@linux.ibm.com> Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
2026-08-05 02:14:52 +00:00 · 2024-02-26 13:43:56 +01:00
parent 16610a211f
commit c382e7ef44
32 changed files with 18 additions and 3990 deletions
--- a/rust/Makefile
+++ b/rust/Makefile
@@ -19,7 +19,7 @@ ifneq (${HAVE_CARGO},0)

 ifneq (${HAVE_OPENSSL},0)
 ifneq (${HAVE_LIBCURL},0)
-	PV_TARGETS := pvsecret pvapconfig
+	PV_TARGETS := pvsecret pvapconfig pvattest

 	PV_BUILD_TARGETS := $(PV_TARGETS)
 	CARGO_TEST_TARGETS += $(addsuffix .test,pv $(PV_TARGETS))
@@ -58,6 +58,8 @@ skip-pv-build:

 all: $(BUILD_TARGETS)
 install: $(INSTALL_TARGETS)
+	$(INSTALL) -d -m 755 $(DESTDIR)$(USRBINDIR)
+	$(INSTALL) -g $(GROUP) -o $(OWNER) -m 755 pvattest/tools/pvextract-hdr "$(DESTDIR)$(USRBINDIR)"

 print-rust-targets:
 	echo $(BUILD_TARGETS)
@@ -76,6 +78,7 @@ install-rust-tools: $(BUILD_TARGETS)
 		$(INSTALL) target/release/$(target) $(DESTDIR)$(USRBINDIR);)

 install-man:
+	$(INSTALL) -d -m 755 $(DESTDIR)$(MANDIR)/man1
 	$(foreach target,$(CARGO_TARGETS),\
 		$(INSTALL) -m 644 $(target)/man/*.1 -t $(DESTDIR)$(MANDIR)/man1;)
 	$(foreach target,$(PV_TARGETS),\
--- a/rust/pvattest/tools/Makefile
+++ b/rust/pvattest/tools/Makefile
@@ -0,0 +1,5 @@
+include ../../common.mak
+
+install:
+	$(INSTALL) -d -m 755 $(DESTDIR)$(USRBINDIR)
+	$(INSTALL) -g $(GROUP) -o $(OWNER) -m 755 pvextract-hdr "$(DESTDIR)$(USRBINDIR)"
--- a/rust/pvattest/tools/pvattest-info
+++ b/rust/pvattest/tools/pvattest-info
@@ -0,0 +1,94 @@
+#!/bin/bash
+#
+# pvattest-info - get additional information from an attestation measurement
+#
+# Sample:
+# ./pvattest-info attestresp.bin
+#
+# Copyright IBM Corp. 2022
+#
+# s390-tools is free software; you can redistribute it and/or modify
+# it under the terms of the MIT license. See LICENSE for details.
+
+set -o pipefail
+set -o nounset
+set -e
+
+XDUMP='od -A x -t x2z -v --endian=big'
+
+usage() {
+	cat <<-EOF
+		Usage: $(basename "$0") FILE
+
+		Prints config UID and additional data if available.
+	EOF
+}
+
+function check_is_pvattest_binary() {
+	local input="$1"
+	local size
+	local version
+
+	size=$(wc -c <"$input")
+	if [ "$size" -lt 64 ]; then
+		echo "ERROR: Input file is too small." >&2
+		exit 1
+	fi
+
+	${XDUMP} --read-bytes 16 -- "${input}" 2>/dev/null | grep -q pvattest ||
+		{ echo "ERROR: ${input} does not contain a pvattest binary output." >&2 && exit 1; }
+
+	size=$(${XDUMP} --skip-bytes 12 --read-bytes 4 -- "${input}" 2>/dev/null | awk 'NR==1 {print "0x" $2 $3}')
+	if [ $((size)) -lt 64 ]; then
+		echo "ERROR: ${input} does not contain a pvattest binary output." >&2
+		exit 1
+	fi
+
+	version=$(${XDUMP} --skip-bytes 8 --read-bytes 4 -- "$input" 2>/dev/null)
+	echo "$version" | grep -q "0000 0100" ||
+		{ echo -n "WARNING: unknown hdr version " >&2  &&
+		echo "$version" | awk '{print "0x" $2 $3}'>&2 ; }
+}
+
+function print_entry() {
+	local file_off="$1"
+	local text="$2"
+	local input="$3"
+	local size
+	local off
+
+	size=$(${XDUMP} --skip-bytes $((file_off)) --read-bytes 4 -- "${input}" 2>/dev/null |
+	       	awk 'NR==1 {print "0x" $2 $3}')
+	off=$(${XDUMP} --skip-bytes $((file_off + 4)) --read-bytes 4 -- "${input}" 2>/dev/null |
+	       	awk 'NR==1 {print "0x" $2 $3}')
+
+	if [[ $size != "0x00000000" ]] || [[ $off != "0x00000000" ]]; then
+		echo "${text}:"
+		od -A n -w$((size)) -t x8 --skip-bytes $((off)) --read-bytes $((size)) -- "${input}" 2>/dev/null |\
+			sed -e 's/\s//g'
+	fi
+}
+
+function require_command() {
+	local cmd="$1"
+
+	command -v "$cmd" >/dev/null 2>&1 || \
+		{ echo >&2 "ERROR: $cmd required but not installed."; exit 1;  }
+}
+
+require_command awk
+require_command wc
+require_command od
+
+if [ $# -eq 0 ]; then
+	echo "ERROR: Input not set. Use '$(basename "$0") [FILE]' to specify the Input file" >&2
+	exit 1
+fi
+
+input="$1"
+
+[ -e "$input" ] || { echo "ERROR: File '$1' not found" >&2 && exit 1; }
+check_is_pvattest_binary "$input"
+
+print_entry 0x38 "Config UID" "$input"
+print_entry 0x28 "Additional Data" "$input"
--- a/rust/pvattest/tools/pvextract-hdr
+++ b/rust/pvattest/tools/pvextract-hdr
@@ -0,0 +1,104 @@
+#!/bin/bash
+#
+# pvextract_hdr - extract an IBM Secure Execution header from the Image
+#
+# Sample:
+# ./pvextract-hdr -o sehdr.bin se-image.bin
+#
+# Copyright IBM Corp. 2022
+#
+# s390-tools is free software; you can redistribute it and/or modify
+# it under the terms of the MIT license. See LICENSE for details.
+
+set -o pipefail
+set -o nounset
+set -e
+
+XDUMP='od -A x -t x2z -v --endian=big'
+
+def_output='sehdr.bin'
+def_skip=0x14
+def_len=0x4
+
+usage() {
+	cat <<-EOF
+		Usage: $(basename "$0") [-o ${def_output}] [-s ${def_skip}] [-l ${def_len}] FILE
+
+		Extract the header of the SE-image located in FILE.
+		By default ${def_skip} pages will be skipped until starting to search
+		for the header. By default the search will be stopped after ${def_len} pages.
+		'${def_output}' is the default output file name.
+	EOF
+}
+
+function check_file() {
+	[ -e "$1" ] ||
+		{ echo "ERROR: File '$1' not found" >&2 && exit 1; }
+}
+
+function check_hdr_ver() {
+	local hdr_start="$1"
+	local input="$2"
+	${XDUMP} --skip-bytes $((hdr_start + 8)) --read-bytes 4 -- "$input" 2>/dev/null | grep -q "000 0100" ||
+		{ echo -n "WARNING: unknown hdr version " &&
+			${XDUMP} --skip-bytes $((hdr_start + 8)) --read_bytes 4 -- "$input" 2>/dev/null | awk '{print "0x" $2 $3}'; }
+}
+
+function require_command() {
+	local cmd="$1"
+
+	command -v "$cmd" >/dev/null 2>&1 || \
+		{ echo >&2 "ERROR: $cmd required but not installed."; exit 1;  }
+}
+
+require_command od
+require_command awk
+require_command grep
+
+output=${def_output}
+parsed_skip=${def_skip}
+parsed_len=${def_len}
+# the last argument must be the input file
+input="${*: -1}"
+while getopts 'o:s:l:h' OPTION; do
+	case "$OPTION" in
+	o) output="$OPTARG" ;;
+	s) parsed_skip="$OPTARG" ;;
+	l) parsed_len="$OPTARG" ;;
+	h)
+		usage
+		exit 0
+		;;
+	:)
+		echo "ERROR: Must supply an argument to -$OPTARG." >&2
+		exit 1
+		;;
+	*)
+		usage
+		exit 1
+		;;
+	esac
+done
+
+#argument specify pages; convert to bytes
+skip=$((parsed_skip * 0x1000))
+len=$((parsed_len * 0x1000))
+
+if [ $# -eq 0 ]; then
+	echo "ERROR: Input not set. Use '$(basename "$0") [FILE]' to specify the Input file" >&2
+	exit 1
+fi
+
+check_file "$input"
+hdr_start=$(${XDUMP} --skip-bytes $((skip)) --read-bytes $((len)) -- "${input}" 2>/dev/null | grep IBMSecEx ||
+       	{ echo ERROR: "${input} does not contain an SE header." >&2 && exit 1; })
+hdr_start=$(echo "${hdr_start}" | awk '{print "0x" $1}' | cut -c 1-10)
+echo "SE header found at offset ${hdr_start}"
+
+check_hdr_ver "$hdr_start" "$input"
+
+size=$(${XDUMP} --skip-bytes $((hdr_start + 12)) --read-bytes 4 -- "${input}" 2>/dev/null |
+       	awk 'NR==1 {print "0x" $2 $3}')
+
+dd if="${input}" of="${output}" bs=1 count=$((size)) skip=$((hdr_start)) status=none
+echo "SE header written to '${output}' ($((size)) bytes)"