From 26148740dfe14a33a01f1f75008c81fbafc8ed13 Mon Sep 17 00:00:00 2001
From: Steffen Eiden <seiden@linux.ibm.com>
Date: Wed, 1 Jun 2022 08:00:24 +0000
Subject: [PATCH] pvattest/tools: Add tool for attestation
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Adds:
  * extract_hdr_from_image
    a bash script to extract the SE header from an SE image.

Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Acked-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
---
 .gitignore                   |  1 +
 pvattest/Makefile            |  2 +-
 pvattest/tools/Makefile      |  5 ++
 pvattest/tools/pvextract-hdr | 89 ++++++++++++++++++++++++++++++++++++
 4 files changed, 96 insertions(+), 1 deletion(-)
 create mode 100644 pvattest/tools/Makefile
 create mode 100755 pvattest/tools/pvextract-hdr

diff --git a/.gitignore b/.gitignore
index 3846a4f4..3a9a3552 100644
--- a/.gitignore
+++ b/.gitignore
@@ -69,6 +69,7 @@ mon_tools/mon_fsstatd
 mon_tools/mon_procd
 osasnmpd/osasnmpd
 pvattest/src/pvattest
+pvattest/tools/exchange_info
 qetharp/qetharp
 qethqoat/qethqoat
 systemd/cpacfstatsd.service
diff --git a/pvattest/Makefile b/pvattest/Makefile
index 897a5bf8..b61a8052 100644
--- a/pvattest/Makefile
+++ b/pvattest/Makefile
@@ -4,7 +4,7 @@ include ../common.mak
 .DEFAULT_GOAL := all
 
 PKGDATADIR := "$(DESTDIR)$(TOOLS_DATADIR)/pvattest"
-SUBDIRS := src man
+SUBDIRS := src man tools
 RECURSIVE_TARGETS := all-recursive clean-recursive install-recursive
 
 all: all-recursive
diff --git a/pvattest/tools/Makefile b/pvattest/tools/Makefile
new file mode 100644
index 00000000..d9247127
--- /dev/null
+++ b/pvattest/tools/Makefile
@@ -0,0 +1,5 @@
+include ../../common.mak
+
+install:
+	$(INSTALL) -d -m 755 $(DESTDIR)$(USRBINDIR)
+	$(INSTALL) -g $(GROUP) -o $(OWNER) -m 755 pvextract-hdr "$(DESTDIR)$(USRBINDIR)"
diff --git a/pvattest/tools/pvextract-hdr b/pvattest/tools/pvextract-hdr
new file mode 100755
index 00000000..d8116dd9
--- /dev/null
+++ b/pvattest/tools/pvextract-hdr
@@ -0,0 +1,89 @@
+#!/bin/bash
+#
+# pvextract_hdr - extract an IBM Secure Execution header from the Image
+#
+# Sample:
+# ./pvextract-hdr -o sehdr.bin se-image.bin
+#
+# Copyright IBM Corp. 2022
+#
+# s390-tools is free software; you can redistribute it and/or modify
+# it under the terms of the MIT license. See LICENSE for details.
+
+set -o pipefail
+set -o nounset
+set -e
+
+def_output="sehdr.bin"
+def_skip=0x14
+def_len=0x4
+
+usage() {
+	cat <<-EOF
+		Usage: $(basename "$0") [-o ${def_output}] [-s ${def_skip}] [-l ${def_len}] FILE
+
+		Extract the header of the SE-image located in FILE.
+		By default ${def_skip} pages will be skipped until starting to search
+		for the header. By default the search will be stopped after ${def_len} pages.
+		'${def_output}' is the default output file name.
+	EOF
+}
+
+function check_file() {
+	[ -e "$1" ] ||
+		{ echo "ERROR: File '$1' not found" >&2 && exit 1; }
+}
+
+function check_hdr_ver() {
+	local hdr_start="$1"
+	local input="$2"
+	xxd -s $((hdr_start + 8)) -l 4 "$input" | grep -q "000 0100" ||
+		{ echo -n "WARNING: unknown hdr version " &&
+			xxd -s $((hdr_start + 8)) -l 4 "$input" | awk '{print "0x" $2 $3}'; }
+}
+
+output=${def_output}
+parsed_skip=${def_skip}
+parsed_len=${def_len}
+# the last argument must be the input file
+input="${*: -1}"
+while getopts 'o:s:l:h' OPTION; do
+	case "$OPTION" in
+	o) output="$OPTARG" ;;
+	s) parsed_skip="$OPTARG" ;;
+	l) parsed_len="$OPTARG" ;;
+	h)
+		usage
+		exit 0
+		;;
+	:)
+		echo "ERROR: Must supply an argument to -$OPTARG." >&2
+		exit 1
+		;;
+	*)
+		usage
+		exit 1
+		;;
+	esac
+done
+
+#argument specify pages; convert to bytes
+skip=$((parsed_skip * 0x1000))
+len=$((parsed_len * 0x1000))
+
+if [ $# -eq 0 ]; then
+	echo "ERROR: Input not set. Use '$(basename "$0") [FILE]' to specify the Input file" >&2
+	exit 1
+fi
+
+check_file "$input"
+hdr_start=$(xxd -s $((skip)) -l $((len)) "${input}" | grep IBMSecEx || { echo ERROR: "${input} does not contain an SE header." >&2 && exit 1; })
+hdr_start=$(echo "${hdr_start}" | awk '{print "0x" $1}' | cut -c 1-10)
+echo "SE header found at offset ${hdr_start}"
+
+check_hdr_ver "$hdr_start" "$input"
+
+size=$(xxd -s $((hdr_start + 12)) -l 4 "${input}" | awk 'NR==1 {print "0x" $2 $3}')
+
+dd if="${input}" of="${output}" bs=1 count=$((size)) skip=$((hdr_start)) status=none
+echo "SE header written to '${output}' ($((size)) bytes)"