.\" Copyright 2024, 2025 IBM Corp.
.\" s390-tools is free software; you can redistribute it and/or modify
.\" it under the terms of the MIT license. See LICENSE for details.
.\"

.TH "PVATTEST" "1" "2026-05-19" "s390-tools" "Attestation Manual"
.nh
.ad l
.SH NAME
pvattest \- create, perform, and verify attestation measurements
.SH SYNOPSIS
.nf
.fam C
pvattest [OPTIONS] <COMMAND>
.fam C
.fi
.SH DESCRIPTION
Create, perform, and verify attestation measurements for IBM Secure Execution
guest systems.
.SH "PVATTEST COMMANDS"
.PP

\fBpvattest\-create(1)\fR
.RS 4
Create an attestation measurement request
.RE

.PP

\fBpvattest\-perform(1)\fR
.RS 4
Send the attestation request to the Ultravisor (s390x only.)
.RE

.PP

\fBpvattest\-verify(1)\fR
.RS 4
Verify an attestation response
.RE

.PP

\fBpvattest\-check(1)\fR
.RS 4
Check if the attestation result matches defined policies
.RE

.SH OPTIONS

.PP
\-v, \-\-verbose
.RS 4
Provide more detailed output.
.RE
.RE
.PP
\-q, \-\-quiet
.RS 4
Provide less output.
.RE
.RE
.PP
\-\-version
.RS 4
Print version information and exit.
.RE
.RE
.PP
\-h, \-\-help
.RS 4
Print help (see a summary with \fB\-h\fR).
.RE
.RE

.SH EXAMPLES
For details refer to the man page of the command.
.PP
Create the request on a trusted system.
.PP
.nf
.fam C
	trusted:~$ pvattest create \-k hkd.crt \-\-cert CA.crt \-\-cert ibmsk.crt \-\-arpk arp.key \-o attreq.bin

.fam T
.fi
On the SE\-guest, \fIperform\fP the attestation.
.PP
.nf
.fam C
	seguest:~$ pvattest perform attreq.bin attresp.bin

.fam T
.fi
On a trusted system, \fIverify\fP that the response is correct. Here, the protection key from the creation and the SE\-guest’s header is used to \fIverify\fP the measurement.
.PP
.nf
.fam C
	trusted:~$ pvattest verify \-i attresp.bin \-\-arpk arp.key \-\-hdr se_guest.hdr
	trusted:~$ echo $?
	0

.fam T
.fi

If the measurements do not match \fBpvattest\fP exits with code 2 and emits an error message. The SE\-guest attestation failed.
.PP
.nf
.fam C
	trusted:~$ pvattest verify \-i wrongresp.bin \-\-arpk arp.key \-\-hdr se_guest.hdr
	ERROR: Attestation measurement verification failed:
	       Calculated and received attestation measurement are not the same.
	trusted:~$ echo $?
	2

.fam T
.fi
.SH "SEE ALSO"
.sp
\fBpvattest\-create\fR(1) \fBpvattest\-perform\fR(1) \fBpvattest\-verify\fR(1) \fBpvattest\-check\fR(1)