Although the previous patch enables pvattest to display the
config UID this script enables the user to extract the config UID of
the SE-guest and the additional data if specified. This allows users of
pvattest v2.22.0 to view the config UID without examining binary blobs.
$ ./pvattest-info attresult.bin
Config UID:
1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a
Additional Data:
1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b
1b1b
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
In verbose mode (-v) `pvattest verify´ now also prints
"Attestation measurement verified", if the verification was successful and the
Config UID of the SE-guest and any additional data if available.
$ pvattest -V verify [...]
Attestation measurement verified
Config UID:
1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a
Additional Data:
1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b
1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Change the name of `hexdump´ to `pvattest_log_bytes´. Additionally, allow
that function to dump the bytes as a single hexadecimal number.
Change the name of `printf_hexdump´ to `pvattest_hexdump´.
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Map the Ultravisor return code 0x2 to "Invalid UV command" string. This
results in better error messages.
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Fixes a bug that make still tried to build pvattest even when the
compilation of pvattest was turned off.
This lead to a build bug when one of the dependencies was not met.
Also fixes the check of the OpenSSL version at build time.
Fixes: 3ab06d77 ("pvattest: Create, perform, and verify attestation measurements")
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
pvattest is a tool to attest an IBM Secure Execution guest.
In a trusted environment, one can create a request using
`pvattest create`. To get a measurement of an untrusted
IBM Secure Execution guest call 'pvattest perform'.
Again in a trusted environment, call 'pvattest verify'
to verify that the measurement is the expected one.
The tool runs on s390 and x86.
It has the same requirements like libpv and therefore
requires openssl v1.1.1+, glib2.56+, and libcurl.
Additionally, to measure, the linux kernel must provide
the Ultravisor userspace interface `uvdevice` at /dev/uv
and must be executed on an IBM Secure Execution guest on
hardware with Ultravisor attestation support, like IBM z16 or later.
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Steffen Eiden