Replace individual UV key hash fields with an indexed array and
introduce dedicated types for hash indices and key hash kinds. This
simplifies hash handling.
Co-developed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Marc Hartmayer <marc@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Report host-key document type mismatches before hash verification.
For example, when testing a v2 Secure Execution header with a classical
host-key document, report that a hybrid host-key document is required
instead of failing with a generic header validation error.
Before:
$ pvimg -- test --host-key-document v1.hkd se.v2.img
error: Invalid Secure Execution header
After:
$ pvimg -- test --host-key-document v1.hkd se.v2.img
Host-key document 'v1.hkd' is not a hybrid host-key document.
error: The provided host key document in v1.hkd contains the wrong number of keys!
Signed-off-by: Marc Hartmayer <marc@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Get rid of 'read_hkd' by refactoring the 'get_verified_hkds' function.
For this a new HkdLoader::load_and_verify is introduced that is a
reworked version of the original code.
In addition, add test cases for testing all the edge cases.
Assisted-by: IBM Bob:1.0.6
Signed-off-by: Marc Hartmayer <marc@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Ensure both sides of the hash comparison use the same slice length
by explicitly slicing both the keyslot hash and the input hash to
UV_KEY_HASH_SIZE. Previously, only the keyslot hash was sliced while
comparing against the full input hash reference, which could lead to
incorrect comparisons if the input hash length differs.
This makes the comparison more explicit and ensures we're always
comparing equal-length hashes. This is useful if one hash is a subset of
another, e.g. a sha512 hash truncated to 32 bytes.
Fixes: 89577c2f8c ("pvimg: Use hybrid keys")
Reviewed-by: Marc Hartmayer <marc@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Now as no users of get_verified_hkds exists, replace it with
get_verified_hkds_new.
Signed-off-by: Marc Hartmayer <marc@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Allow the creation of SE images using headers with hybrid (=quantum safe) keys.
This results in using the headers in version 2 (0x200).
Co-developed-by: Marc Hartmayer <marc@linux.ibm.com>
Signed-off-by: Marc Hartmayer <marc@linux.ibm.com>
Signed-off-by: Timo Keller <tkeller@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Refactor test code and increase coverage. The new test code tests for
the correct error kind instead of simply for an error.
Assisted-by: IBM Bob:1.0.6
Signed-off-by: Marc Hartmayer <marc@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Replace version-specific flag enums (PcfV1, ScfV1) with a unified
SeHdrFlag enum and generic ControlFlagsModel. This refactoring provides:
- Single SeHdrFlag enum for all control flags across SE header versions
- Generic SeHdrControlFlagsModel with version-specific configurations
- EffectiveControlFlags type replacing PlaintextControlFlagsV1/SecretControlFlagsV1
- FlagsOverride mechanism for customizing flag configurations
- Enhanced FromStr implementation for flag parsing
- Comprehensive test coverage for flag operations and conversions
The new design improves maintainability by eliminating code duplication
and provides a more flexible API for working with SE header control
flags.
Assisted-by: IBM Bob:1.0.4
Signed-off-by: Marc Hartmayer <marc@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Add a generic flags framework for managing (Secure Execution) header
control flags. This implementation provides:
- Clap compatibility for auto-completion and proper help messages
- ControlFlagTrait for defining flag types with bit positions and version support
- ControlFlagsModel for managing default flags and validation rules
- FlagsOverride for customizing individual flag states
- EffectiveControlFlags representing the final flag configuration
- UnknownFlags handling for forward compatibility
- Comprehensive error handling via FlagValidationError
- Display implementations for both human-readable and binary formats
- Type-safe conversions between flag representations
The framework supports version-aware flag validation, allowing flags to
be marked as supported only in specific Secure Execution header
versions. It enables flexible flag configuration through overrides while
maintaining type safety and validation.
Assisted-by: IBM Bob:1.0.4
Signed-off-by: Marc Hartmayer <marc@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Add a HostKey enum (currently V1(PKey<Public>)) and introduce a
versioned Keyslot enum (V1(KeyslotV1)). Rename the existing Keyslot type
to KeyslotV1 to prepare for future format extensions.
Update pv, pvattest, pvimg, and pvsecret to use the new enums.
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Timo Keller <tkeller@linux.ibm.com>
Signed-off-by: Marc Hartmayer <marc@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Add more CCK tests to make sure that new changes do not introduce a
regression.
Assisted-by: IBM Bob:1.0.4
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Marc Hartmayer <marc@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
- Remove useless type conversion in uvdevice.rs
- Replace useless comparison in hostname.rs
- Replace unnecessary unwrap patterns in pvapconfig
- Use sort_by_key instead of sort_by in pvimg example
Command line used to get the findings:
$ clippy --all-features -- --cap-lints=warn
warning: useless conversion to the same type: `u64`
--> pv_core/src/uvdevice.rs:56:28
|
56 | rc = ioctl(raw_fd, cmd.try_into().unwrap(), cb.as_ptr_mut());
| ^^^^^^^^^^^^^^
|
= help: consider removing `.try_into()`
= help: for further information visit https://rust-lang.github.io/rust-clippy/master/index.html#useless_conversion
= note: `#[warn(clippy::useless_conversion)]` on by default
warning: this comparison involving the minimum or maximum element for this type contains a case that is always true or always false
--> utils/src/hostname.rs:60:13
|
60 | assert!(isize::try_from(buf_len).unwrap() <= isize::MAX);
| ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
|
= help: because `isize::MAX` is the maximum value for this type, this comparison is always true
= help: for further information visit https://rust-lang.github.io/rust-clippy/master/index.html#absurd_extreme_comparisons
= note: `#[warn(clippy::absurd_extreme_comparisons)]` on by default
warning: `utils` (lib) generated 1 warning
Checking pvebc v0.12.0 (/home/mhartmay/git/s390-tools/rust/pvebc)
warning: consider using `sort_unstable_by_key`
--> pvapconfig/src/ap.rs:177:9
|
177 | self.0.sort_unstable_by(|a, b| b.gen.cmp(&a.gen));
| ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
|
= help: for further information visit https://rust-lang.github.io/rust-clippy/master/index.html#unnecessary_sort_by
= note: `#[warn(clippy::unnecessary_sort_by)]` on by default
help: try
|
177 - self.0.sort_unstable_by(|a, b| b.gen.cmp(&a.gen));
177 + self.0.sort_unstable_by_key(|b| std::cmp::Reverse(b.gen));
warning: called `unwrap_err` on `r` after checking its variant with `is_err`
--> pvapconfig/src/main.rs:55:29
|
54 | if $r.is_err() {
| -------------- help: try: `if let Err(<item>) = r`
55 | eprintln!("{}", $r.unwrap_err());
| ^^^^^^^^^^^^^^^
...
87 | on_error_print_and_exit!(r);
| --------------------------- in this macro invocation
|
= help: for further information visit https://rust-lang.github.io/rust-clippy/master/index.html#unnecessary_unwrap
= note: this warning originates in the macro `on_error_print_and_exit` (in Nightly builds, run with -Z macro-backtrace for more info)
warning: this `repeat().take()` can be written more concisely
--> pvimg/src/se_img_comps/bootloader/ipl.rs:95:21
|
95 | let comps = iter::repeat(ipl_pb0_pv_comp::default())
| _____________________^
96 | | .take(num_comp)
| |___________________________^ help: consider using `repeat_n()` instead: `std::iter::repeat_n(ipl_pb0_pv_comp::default(), num_comp)`
|
= help: for further information visit https://rust-lang.github.io/rust-clippy/master/index.html#manual_repeat_n
= note: `#[warn(clippy::manual_repeat_n)]` on by default
warning: this `repeat().take()` can be written more concisely
--> pvimg/src/se_img_comps/bootloader/ipl.rs:113:21
|
113 | let comps = iter::repeat(comp).take(num_comp).collect();
| ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ help: consider using `repeat_n()` instead: `std::iter::repeat_n(comp, num_comp)`
|
= help: for further information visit https://rust-lang.github.io/rust-clippy/master/index.html#manual_repeat_n
Reviewed-by: Timo Keller <tkeller@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Reviewed-by: Harald Freudenberger <freude@linux.ibm.com>
Signed-off-by: Marc Hartmayer <marc@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Bump MSRV to 1.85.0 and upgrade all dependencies using 'cargo upgrade'
from cargo-edit. The bump to 1.85.0 is requiered to get at least openssl
version 0.10.79 including fixes for a couple security issues.
Link: https://crates.io/crates/cargo-edit
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
+ Sort and group the imports
+ Normalize and format comments (100 characters width)
Command used:
$ cargo +nightly fmt --
Acked-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Marc Hartmayer <marc@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The associated type bound for Iterator::Item was unsatisfied for Self.
Fix this by requiring Sized for IntoEnumIterator.
Fixes: 1d2a89b387 ("pvimg: Improve the readability of Display output for control flags")
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Add documentation for the JSON structure outputted by 'pvimg info
--format=json ...'.
Created with assistance from IBM Bob AI.
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Marc Hartmayer <marc@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Add a new '--print-schema <FORMAT>' option to the 'pvimg info' command
that prints the schema, if available, describing the given output
format. For example, 'pvimg info --print-schema json' prints the JSON
schema for the 'pvimg info' command output.
Acked-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Marc Hartmayer <marc@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Add '--show-secrets' flag to 'pvimg info' to make secret output explicit
and avoid accidental disclosure.
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Marc Hartmayer <marc@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Auto-detect default format for 'pvimg info' command. If stdout is a
terminal, use 'text', otherwise 'json'.
Adapt the tests accordingly.
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Marc Hartmayer <marc@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Add human-readable output format to 'pvimg info' command. The format
'text:normal' shows only basic information about the Secure Execution
header, but skips the keys and other binary data; the format 'text:full'
shows everything.
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Marc Hartmayer <marc@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The Display implementation should produce human-readable output. Convert
the flags into a descriptive flag list to improve readability.
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Marc Hartmayer <marc@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Use the s390-tools JSON meta data for the JSON output of 'pvimg info' to
make the JSON output more stable and to provide an stable API.
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Marc Hartmayer <marc@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Improve error messages for errors when reading the SE header protection
key or when the decryption/verification of the SE header has failed.
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Marc Hartmayer <marc@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Add two JSON output variants: pretty and minify. The desired variant can
be selected via '--format json:pretty' and '--format json:minify'. Using
'--format json' without a variant defaults to pretty.
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Marc Hartmayer <marc@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Add a warning to notify the user when the Secure Execution (SE) header
is present but its integrity and authenticity has not been verified.
This makes the lack of validation explicit and helps avoid unintended
use of untrusted data.
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Marc Hartmayer <marc@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Improve the documentation of flags and secured components.
Created with assistance from IBM Bob AI.
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Marc Hartmayer <marc@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The definition NO_PIE_CFLAGS has only two users and specifies only a
single compiler flag. There is no point having this definition anymore.
Remove the definition and specify -fno-pie directly for the two users.
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Commit c5a91199e3 ("zipl: Always build and link without PIE.")
introduced -fno-pie (for compilation) and -no-pie (for linking) for
zipl. At the time the linker was still used directly before commit
5e46632767 ("zipl: Use the compiler for linking instead of ld")
eventually switched to calling the compiler for the linking step.
During that adaption -static was introduced to the linker flags. -no-pie
was carried over as well. However -static implies -no-pie and it is
therefore not required. For GCC see also man 1 gcc (-static) [1]. Whilst
not explicitly documented, Clang shows the same behaviour. Clang also
complains when -static and -no-pie are specified in the linker step at
the same time with the following warning:
clang: warning: argument unused during compilation: '-no-pie' [-Wunused-command-line-argument]
Since -no-pie is not required, remove it and get rid of the warning.
[1] https://gcc.gnu.org/onlinedocs/gcc/Link-Options.html#index-static
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The 'clang' compiler generates a section with the name '".loader_parms"'
and gcc '.loader_parms' if the double quotes are used. Fix this by
removing the superfluous double quotes, this results in a section with
the name '.loader_parms' for both clang and gcc.
Reported-by: Richie Buturla <richie@linux.ibm.com>
Reviewed-by: Euan Bourke <euan@linux.ibm.com>
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Add support for '--image-key'. This new option can be used to select the
components encryption key (e.g. kernel, initrd, and kernel command
line). Previously, this was only available as an experimental
option ('--x-comp-key').
Reviewed-by: Hendrik Brueckner <brueckner@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Use 'PVIMG_PKGDATADIR' as it is used by the 'pvimg_pkg_data' macro rule.
The problem only shows up if someone changes 'PVIMG_PKGDATADIR' to
something different than the default.
Fixes: f4cf4ae6eb ("rust: Add a new tool called 'pvimg'")
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Move the check_hostkeydoc script to scripts. This eliminates the last file
in the genprotimg directory. Additionally, add a deprecation warning to
that script. Every pv tool can verify the chain itself using the pv
library.
Acked-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
