Files
s390-tools/rust/Makefile
Finn Callies c04a0919f6 rust: Add new tool pvebc
Add pvebc tool for parsing and verifying EBC Add-Secret-Request structures

Introduce pvebc, a CLI tool that parses and verifies the integrity of
Add-Secret-Request (ASR) structures used in Early Boot Customization for
SEL guests.

The tool processes an integrity-protected ASR structure consisting of:
 - toc.asr: Meta secret that links to toc.pol via relative filepath and
   SHA512 hash, integrity-protected by its AES GCM authentication tag
 - toc.pol: Policy file containing AES GCM authentication tags (last 16
   bytes) of all user-provided ASRs
 - User ASRs: Individual Add-Secret-Requests containing encrypted secrets

This structure guarantees:
 - Prevents ASR removal: toc.pol lists all expected ASR authentication tags
 - Prevents ASR insertion: Unlisted ASRs are rejected
 - Prevents ASR modification: AES GCM authentication tags provide
   cryptographic integrity
 - Prevents toc.pol tampering: toc.asr's integrity protection secures the
   link

The tool verifies completeness by checking that all ASRs listed in toc.pol
are present and their AES GCM authentication tags match. This prevents
attackers from removing, inserting, or modifying ASRs during transport over
unsecured channels.

After verification, pvebc adds all ASRs to the Ultravisor (UV), which
decrypts them using the guest's secret key and makes them available to
the guest during early boot.

Assisted-by: IBM Bob:1.0.1
Acked-by: Holger Dengler <dengler@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Finn Callies <fcallies@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
2026-04-30 13:46:31 +02:00

174 lines
5.3 KiB
Makefile

include ../common.mak
HAVE_CARGO ?= 1
HAVE_OPENSSL ?= 1
HAVE_LIBCURL ?= 1
INSTALL_TARGETS := skip-build
BUILD_TARGETS := skip-build
PV_BUILD_TARGETS := skip-pv-build
CARGO_TARGETS :=
PV_TARGETS :=
CARGO_TEST_TARGETS :=
ifneq (${HAVE_CARGO},0)
CARGO_TARGETS := pvebc
BUILD_TARGETS = $(CARGO_TARGETS)
INSTALL_TARGETS := install-rust-tools install-man install-shell-completions
CARGO_TEST_TARGETS = $(addsuffix .test, $(CARGO_TARGETS))
ifeq ($(HOST_ARCH),s390x)
CARGO_TARGETS += cpacfinfo
else
BUILD_TARGETS += skip-cpacfinfo
endif #HOSTARCH
ifneq (${HAVE_OPENSSL},0)
ifneq (${HAVE_LIBCURL},0)
PV_TARGETS := pvsecret pvattest pvimg pvverify
ifeq ($(HOST_ARCH),s390x)
PV_TARGETS += pvapconfig pvinfo
else
BUILD_TARGETS += skip-pvapconfig skip-pvinfo
endif #HOSTARCH
PV_BUILD_TARGETS := $(PV_TARGETS)
CARGO_TEST_TARGETS += $(addsuffix .test,pv $(PV_TARGETS))
endif #LIBCURL
endif #OPENSSL
TEST_TARGETS := $(addsuffix _build,$(CARGO_TEST_TARGETS))
endif #CARGO
pvimg-bootloaders:
$(MAKE) -C pvimg/boot/
.PHONY: pvimg-bootloaders
PVIMG_PKGDATADIR := $(TOOLS_DATADIR)/pvimg
export PVIMG_PKGDATADIR
BUILD_TARGETS += $(PV_BUILD_TARGETS) pvimg-bootloaders
INSTALL_TARGETS += pvimg-bootloaders
# build release targets by default
ifeq ("${D}","0")
ALL_CARGOFLAGS += --release
endif
# the cc crate uses these variables to compile c code. It does not open a shell
# to call the compiler, so no echo etc. allowed here, just a path to a program
$(BUILD_TARGETS) $(TEST_TARGETS) rust-test: CC = $(CC_SILENT)
$(BUILD_TARGETS) $(TEST_TARGETS) rust-test: AR = $(AR_SILENT)
$(PV_TARGETS): .check-dep-pvtools
$(PV_TARGETS) $(CARGO_TARGETS): .check-cargo .no-cross-compile
$(CARGO_BUILD) --bin $@ $(ALL_CARGOFLAGS)
.PHONY: $(PV_TARGETS) $(CARGO_TARGETS)
$(TEST_TARGETS): ALL_CARGOFLAGS += --no-run
$(CARGO_TEST_TARGETS) $(TEST_TARGETS): .check-cargo .no-cross-compile
$(CARGO_TEST) --package $(basename $@) --all-features $(ALL_CARGOFLAGS)
.PHONY: $(TEST_TARGETS) $(CARGO_TEST_TARGETS)
skip-build:
echo " SKIP rust-tools due to unresolved dependencies"
skip-pv-build:
echo " SKIP rust-pv-tools due to unresolved dependencies"
skip-pvinfo:
echo " SKIP pvinfo due to unsupported architecture (s390x only)"
skip-pvapconfig:
echo " SKIP pvapconfig due to unsupported architecture (s390x only)"
skip-cpacfinfo:
echo " SKIP cpacfinfo due to unsupported architecture (s390x only)"
all: $(BUILD_TARGETS)
install: $(INSTALL_TARGETS)
$(INSTALL) -d -m 755 $(DESTDIR)$(USRBINDIR)
$(INSTALL) -g $(GROUP) -o $(OWNER) -m 755 pvattest/tools/pvextract-hdr $(DESTDIR)$(USRBINDIR)
$(INSTALL) -d -m 755 $(DESTDIR)$(PVIMG_PKGDATADIR)
$(MAKE) -C pvimg/boot install
ln -sf pvimg $(DESTDIR)$(USRBINDIR)/genprotimg
print-rust-targets:
echo $(BUILD_TARGETS)
clean:
ifneq (${HAVE_CARGO},0)
$(CARGO_CLEAN) ${ALL_CARGOFLAGS}
endif # CARGO
$(MAKE) -C pvimg/boot/ clean
$(RM) -- .check-dep-pvtools .detect-openssl.dep.c .check-cargo
rust-test: $(CARGO_TEST_TARGETS)
install-rust-tools: $(BUILD_TARGETS)
$(INSTALL) -d -m 755 $(DESTDIR)$(USRBINDIR)
$(foreach target,$(CARGO_TARGETS),\
$(INSTALL) target/release/$(target) $(DESTDIR)$(USRBINDIR);)
$(foreach target,$(PV_TARGETS),\
$(INSTALL) target/release/$(target) $(DESTDIR)$(USRBINDIR);)
install-man:
$(INSTALL) -d -m 755 $(DESTDIR)$(MANDIR)/man1
$(foreach target,$(CARGO_TARGETS) $(PV_TARGETS),\
$(foreach man,$(wildcard $(target)/man/*.1), \
$(INSTALL) -m 644 $(man) -t $(DESTDIR)$(MANDIR)/man1;))
ln -sf pvimg-create.1 $(DESTDIR)$(MANDIR)/man1/genprotimg.1
install-shell-completions: install-bash-completion install-zsh-completion
install-bash-completion: $(PV_TARGETS)
$(INSTALL) -d -m 755 $(DESTDIR)$(BASHCOMPLETIONDIR)
$(foreach target,$(PV_TARGETS),\
$(INSTALL) -m 0644 --preserve-timestamps -- $(shell find $(shell ls --sort=time --reverse --directory target/release/build/$(target)-*/out/ |tail -n1) -name '*.bash') $(DESTDIR)$(BASHCOMPLETIONDIR);)
install-zsh-completion: $(PV_TARGETS)
$(INSTALL) -d -m 755 $(DESTDIR)$(ZSHCOMPLETIONDIR)
$(foreach target,$(PV_TARGETS),\
$(INSTALL) -m 0644 --preserve-timestamps -- $(shell find $(shell ls --sort=time --reverse --directory target/release/build/$(target)-*/out/ |tail -n1) -regex '.*/_[a-zA-Z0-9]+') $(DESTDIR)$(ZSHCOMPLETIONDIR);)
.PHONY: all install clean skip-build install-rust-tools print-rust-targets install-man rust-test install-bash-completion install-zsh-completion install-shell-completions
.check-cargo:
ifeq ($(shell command -v $(CARGO)),)
$(call check_dep, \
"rust/cargo", \
"invalid-incl", \
"cargo", \
"HAVE_CARGO=0")
endif
touch $@
.no-cross-compile:
ifneq ($(HOST_ARCH), $(BUILD_ARCH))
$(error Cross compiling is not supported for rust code. Specify HAVE_CARGO=0 to disable rust compilation)
endif
.PHONY: .no-cross-compile
.detect-openssl.dep.c:
echo "#include <openssl/evp.h>" > $@
echo "#if OPENSSL_VERSION_NUMBER < 0x10101000L" >> $@
echo " #error openssl version 1.1.1 is required" >> $@
echo "#endif" >> $@
echo "static void __attribute__((unused)) test(void) {" >> $@
echo " EVP_MD_CTX *ctx = EVP_MD_CTX_new();" >> $@
echo " EVP_MD_CTX_free(ctx);" >> $@
echo "}" >> $@
.check-dep-pvtools: .detect-openssl.dep.c
$(call check_dep, \
"Rust-pv", \
$^, \
"openssl-devel / libssl-dev version >= 1.1.1", \
"HAVE_OPENSSL=0", \
"-I.")
$(call check_dep, \
"Rust-pv", \
"curl/curl.h", \
"libcurl-devel", \
"HAVE_LIBCURL=0")
touch $@