This patch adds support for Secure Execution with AP pass-through
support for chzcrypt.
chzcrypt details:
* new command: --se-associate <secret-id> <queue device>
* new command: --se-bind <queue device>
* new command: --se-unbind <queue device>
Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
Reviewed-by: Holger Dengler <dengler@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
This patch adds support for Secure Execution with AP pass-through
support for lszcrypt.
lszcrypt details:
* extension to -b: list AP bus features
* extension to -c: now also valid for queue devices, shows
bind and assoicate state in SE environment;
shows MK states (only for current MKs).
* extension to -V: new column SESTAT within an SE guest, shows text
for the BS bits within an SE environment:
"usable", "bond", "avail", "unuse".
Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
Reviewed-by: Holger Dengler <dengler@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Autoquiesce is a mechanism that tells Linux to stop issuing I/Os to a
specific DASD after certain events.
Add support for configuring related DASD device attributes
that govern the following aspects of autoquiesce:
aq_mask - Configure which events lead to autoquiesce.
aq_requeue - Configure if autoquiesce will requeue all I/O to blocklayer.
aq_timeouts - Configure the number of timeouts before autoquiesce.
Signed-off-by: Stefan Haberland <sth@linux.ibm.com>
Reviewed-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
The 'clean' build targets can be specified alongside other targets,
which causes an immediate removal of build artifacts. Make 'clean'
targets mutually exclusive to avoid this issue and display an error if
'clean' is used in combination with other targets.
Reviewed-by: Benjamin Block <bblock@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
A subset of s390 tools can be useful on non-s390x architectures such as
x86 or arm. Limit the build targets for these architectures with
'pvattest' and 'libpv' as the first candidates.
A cross compilation on x86 for s390x will still build the entire package
provided that the HOST_ARCH variable is set properly:
$ make HOST_ARCH=s390x CROSS_COMPILE=s390x-linux-gnu-
Cross compilation on s390x for x86 will limit the build targets as
described:
$ make HOST_ARCH=x86_64 CROSS_COMPILE=x86_64-linux-gnu-
Co-developed-by: Jan Höppner <hoeppner@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Introduce `BUILD_ARCH` and `(CC|LINK|...|OBJDUMP)_FOR_BUILD` variables
in order to properly support the build of tools that generate code or
data during the build process. Replace existing variables `HOSTCC` with
`CC_FOR_BUILD` and `HOSTCFLAGS` `CFLAGS_FOR_BUILD`. The Makefile
variables for the `HOST_ARCH` are unchanged.
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
In addition, add the ability that a Makefile that includes `common.mak`
can specify the `HOST_ARCH`. Usage example:
$S390_TOOLS/mytool/Makefile:
``` Makefile
HOST_ARCH := s390x
include ../common.mak
```
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
`pkg-config` is a well established tool and all of our required
libraries do provide .pc files. Therefore let's declare `pkg-config` as
required and use it. In addition, remove now useless code.
Reviewed-by: Benjamin Block <bblock@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Since GCC12 several warnings like the following are produced in
zipl/boot compile targets:
CC zipl/boot/stage2.o
stage2.c: In function ‘start’:
stage2.c:99:24: warning: array subscript 0 is outside array bounds of ‘struct stage2_descr[0]’ [-Warray-bounds]
99 | stage2_descr = *(struct stage2_descr*)STAGE2_DESC;
This is the same issue as reported for the Kernel [1][2]. There is
currently no sane fix available, therefore simply disable the warning
for the zipl/boot/ targets.
[1] https://lore.kernel.org/lkml/yt9dzgkelelc.fsf@linux.ibm.com/
[2] https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99578
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
In certain storage setups the Release Allocated Space (RAS) command to
free up space on the storage server previously allocated for an ESE DASD
might not work. At the moment dasdfmt will error out if RAS is failing.
This however is not ideal for the default case when a user is expecting
dasdfmt to simply format the disk.
One workaround would be to specify --no-discard to disable RAS
completely. However, a sane default handling that tries to work every
time is more reasonable.
Change the default handling as follows: If an ESE is detected default to
QUICK mode and try RAS. If RAS fails, fall back to the FULL format mode
and display a warning accordingly.
If -M (--mode) QUICK is specified explicitly dasdfmt will still error
out on a failing RAS. A combination with --no-discard will still allow
for a QUICK format on an ESE DASD in that case, if desired.
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
`od` in contrast to `xxd` uses the system endianness for displying the
hexdump by default which leads to invalid results on little endian
systems.
Use the `--endian=big` option to fix the endianness problem.
Fixes: 3cc0b4cd ("pvattest/tools: remove xxd dependency from scripts")
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
The script uses bashisms (e.g. `local` keyword) therefore make sure that
bash is used by setting the shebang line to `#!/bin/bash`.
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
icastats is accounted by user and does cover root only today
adding the --all will collect stats for all users
Reported-by: Ingo Franzki <ifranzki@de.ibm.com>
Reviewed-by: Ingo Franzki <ifranzki@de.ibm.com>
Signed-off-by: Joern Siglen <siglen@de.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
For dasd devices, we need to enable the device before we can use it.
Add the required dasd device to the kernel commandline when installing
ngdump to a dasd device.
Signed-off-by: Sven Schnelle <svens@linux.ibm.com>
Acked-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
The current code first assembles the ngdump init ramdisk, and creates
the filesystem on the dump disk afterwards. ngdump uses uuids to mount
the dump device. Because the filesystem uuid is changing with the final
mkfs, ngdump has to use the partuuid of the device. This does work for
nvme, but not for dasds. Another problem is that dryrun likely wouldn't
work if there's no partition table on the dump device. To fix these
issues, move the mkfs to the ngdump helper script so we can use the
filesystem uuid. When --dryrun is specified the script passes /dev/null
as ngdump device to make mkinitramfs happy. As the initramdisk is never
used in this case, this shouldn't be a problem.
Signed-off-by: Sven Schnelle <svens@linux.ibm.com>
Acked-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
CCW and LD-IPL records cannot be used at the same time for dumps because
CCW dump uses the standalone dumper, while LD-IPL uses ngdump. The first
one writes data to the raw disk without any filesystem, while the second
one uses an ext filesystem. Therefore we need a way to tell zipl which
kind of dumper it should install, as both cannot be installed at the
same time. The device given is the same for both types, so we cannot use
this to decide which type to install. Therefore add a '--ldipl-dump' option
so the user can decide which type of dump to use.
Signed-off-by: Sven Schnelle <svens@linux.ibm.com>
Acked-by: Eduard Shishkin <edward6@linux.ibm.com>
Acked-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Add the following options to dumpconf so that LDIPL ECKD devices
can be configured for dumping:
br_chr: (optional) location of boot record
device: ccw device
bootprog: boot program selector
Signed-off-by: Sven Schnelle <svens@linux.ibm.com>
Acked-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
In order to allow installing only a list-directed ipl entry, remove
the last-table/number-of-tables logic which always required a legacy
program table. With the new code there's no longer a loop in
prepare_bootloader() which requires a certain start index or order
of tables.
Signed-off-by: Eduard Shishkin <edward6@linux.ibm.com>
Acked-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Instead of depending on array index to decide whether we
did already the preparation work for installing the bootloader,
add an explicit skip_prepare flag to struct install_set.
Signed-off-by: Sven Schnelle <svens@linux.ibm.com>
Acked-by: Eduard Shishkin <edward6@linux.ibm.com>
Acked-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
In preparation of decoupling the program table position from
the block pointer format, rename:
PROGRAM_TABLE_0 to LEGACY_BLKPTR_FORMAT_ID
PRAGRAM_TABLE_1 to BLKPTR_FORMAT_ID
Signed-off-by: Sven Schnelle <svens@linux.ibm.com>
Acked-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
To make the code easier to maintain and prepare for ECKD LD-IPL,
split up install_bootloader() into two functions: One which is used
for IPL, and one for dump partitions.
Signed-off-by: Sven Schnelle <svens@linux.ibm.com>
Acked-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
The relative subdirectory path of a build target is determined via a
separate shell command that issues 'cd' and 'pwd'. Spawning a separate
shell is very costly and can lead to extremely slow builds in some
circumstances.
Replace the shell command with the make built-in command 'realpath' to
accomplish the same result more efficiently.
Tested-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Related Valgrind output:
==1073934== 241,722,000 bytes in 30 blocks are definitely lost in loss record 2 of 2
==1073934== at 0x484417C: malloc (in /usr/libexec/valgrind/vgpreload_memcheck-s390x-linux.so)
==1073934== by 0x1006B8D: misc_malloc (misc.c:33)
==1073934== by 0x1006B8D: misc_read_file (misc.c:150)
==1073934== by 0x100DACD: check_common_ipl_data (job.c:774)
==1073934== by 0x100FE2F: check_job_ipl_data (job.c:827)
==1073934== by 0x100FE2F: check_job_menu_data (job.c:999)
==1073934== by 0x100FE2F: check_job_data (job.c:1139)
==1073934== by 0x100FE2F: job_get (job.c:2011)
==1073934== by 0x1006335: main (zipl.c:141)
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Acked-by: Eduard Shishkin <edward6@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Since SMT is being used by default on z systems, hyptop should show
thread utilization by default on both system and system list window.
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Mete Durlu <meted@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Valgrind finding:
==1083976== 19 bytes in 1 blocks are definitely lost in loss record 1 of 1
==1083976== at 0x484417C: malloc (in /usr/libexec/valgrind/vgpreload_memcheck-s390x-linux.so)
==1083976== by 0x48F3C97: __vasprintf_internal (vasprintf.c:71)
==1083976== by 0x1006861: vasprintf (stdio2.h:218)
==1083976== by 0x1006861: misc_asprintf (misc.c:49)
==1083976== by 0x100C7E1: scan_update_bls_path (scan.c:1874)
==1083976== by 0x100FF4B: get_job_from_config_file (job.c:1901)
==1083976== by 0x100FF4B: job_get (job.c:1997)
==1083976== by 0x1006335: main (zipl.c:141)
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Before commit 5fb6434548 ("zipl: add get_common_components() and
finalize_common_address_data()") the default kernel parmline was only
overwritten if a parmline was specified. After the commit it was always
overwritten, even if no parmline was specified. Let's change this
behavior back by adding a NULL-pointer check. For dump types this change
changes the behavior before commit 5fb6434548 ("zipl: add
get_common_components() and finalize_common_address_data()").
Fixes: 5fb6434548 ("zipl: add get_common_components() and finalize_common_address_data()")
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Linux kernel commits
a029a4eab39 ("s390/cpumf: Allow concurrent access for CPU Measurement Counter Facility")
453380318ed ("s390/cpumf: Allow multiple processes to access /dev/hwc")
removed this restriction. Both commits are included in linux 5.16.
Therefore remove the restriction in the man page.
Signed-off-by: Thomas Richter <tmricht@linux.ibm.com>
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
OpenSSL function i2d_ECDSA_SIG() returns a negative value in case of
an error, so check the returned length for <= zero to detect an error.
Reported-by: Holger Dengler <dengler@linux.ibm.com>
Reviewed-by: Holger Dengler <dengler@linux.ibm.com>
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The provider functions OSSL_FUNC_keymgmt_import_types() and
OSSL_FUNC_keymgmt_export_types() do not get the provider context passed.
However, the implementation of these functions in the secure key provider
need the provider context to pass the call to the default provider
and append some of its own types to the result.
Up to now, the provider context was obtained using a global variable
holding the secure key provider handle. This may not be save if multiple
instances of the provider exist.
Just recently OpenSSL added support for an extended form of these
functions, namely OSSL_FUNC_keymgmt_import_types_ex() and
OSSL_FUNC_keymgmt_export_types_ex(), that get the provider context passed
as argument. Make use of these new functions, if compiled against an
OpenSSL version that supports them. For older OpenSSL versions still use
the global variable as before.
See OpenSSL commit 5e3b84505e
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
If system configuration contains zfcp-attached SCSI devices of Peripheral
Device Type disk, but without block device, e.g. because the storage reports
Peripheral Qualifier 1 in INQUIRY, ziorep_config tool issue the
following type of errors during generation of .config file from .cfg
file:
$ ziorep_config -I -i test.cfg
Unpacking configuration ...Done.
Use of uninitialized value in subroutine entry at /usr/sbin/ziorep_config line 36.
Use of uninitialized value in subroutine entry at /usr/sbin/ziorep_config line 36.
Use of uninitialized value in subroutine entry at /usr/sbin/ziorep_config line 54.
Use of uninitialized value in subroutine entry at /usr/sbin/ziorep_config line 135.
...
Such errors can also be seen during printing of adapter, device and map
reports:
$ ziorep_config -ADM -i test.cfg
Unpacking configuration ...Done.
Use of uninitialized value in subroutine entry at /usr/sbin/ziorep_config line 36.
Use of uninitialized value in subroutine entry at /usr/sbin/ziorep_config line 36.
Use of uninitialized value in subroutine entry at /usr/sbin/ziorep_config line 54.
Use of uninitialized value in subroutine entry at /usr/sbin/ziorep_config line 135.
...
This is because ziorep_config reads block device parameters from
non-existent block device subdirectory. And therefore ziorep_config
leaves block device major:minor number column empty in .config file
instead of filling it with 0:0 preset value afterwards.
As a consequence, ziorep_traffic tool, which is using .config file to
get information about devices, reports the following error:
$ ziorep_traffic test
Extracting config data...done
ziorep_traffic: Could not parse line 1 - configuration file broken?
To fix this, skip reading the block device parameters for such
devices, and use the preset values that have been set before
instead.
Signed-off-by: Fedor Loshakov <loshakov@linux.ibm.com>
Suggested-by: Steffen Maier <maier@linux.ibm.com>
Reviewed-by: Benjamin Block <bblock@linux.ibm.com>
Reviewed-by: Steffen Maier <maier@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The value of "generic/dev" exists and can be retrieved directly under
the SCSI device directory, not under the disk block device subdirectory,
where the global variable $c_src points to after
$c_src = $devices{$hctl}{dev}; command.
So move the sg_mm retrieval before the block device parameters
retrieval.
Signed-off-by: Fedor Loshakov <loshakov@linux.ibm.com>
Suggested-by: Steffen Maier <maier@linux.ibm.com>
Reviewed-by: Benjamin Block <bblock@linux.ibm.com>
Reviewed-by: Steffen Maier <maier@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
