A single paragraph opening .TP macro at the end of the man page is
causing errors found with:
$ man --warnings -E UTF-8 -l -Tutf8 -Z zconf/zcrypt/zcryptstats.8
troff: error: automatically ending diversion 'an-div' on exit
It also causes the footer of the man page not rendering correctly.
Remove the macro. While at it, remove whitespace damage as well.
Github-ID: https://github.com/ibm-s390-linux/s390-tools/issues/170
Reviewed-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
When a queue is removed from a SE guest which was in a state other
than "usable" (for example "unbound") the state displayed by lszcrypt
switches to "usable" until the queue device is finally removed by the
AP bus scan running every 30s.
This intermediate state is caused by reading 0x00000000 on the
underlying /sys/devices/cardxx/xx.yyyy/ap_functions. lszcrypt only
extracts the BS bits from this value and maps these both bits to
string output
0: "usable"
1: "bound"
2: "unbound"
3: "illicit"
totally ignoring the fact that there is no AP function at all.
Now the code checks for a valid ap_functions value first, before
actually extracting and displaying the SE state. In case the
ap_functions reads as 0x00000000 lszcrypt now displays the string
"invalid".
Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
Reviewed-by: Holger Dengler <dengler@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Ensure that all hyphens in command options and examples are escaped properly.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
The AP queue states within a SE guest may have a so called asynchronous
error pending. When that's the case, the sysfs read of some AP queue
attributes fails with EIO. lszcrypt was not really prepared for this
and instead showed some incorrect output.
This patch fixes this oddity and now lszcrypt -c shows "error" in case
of ap_bound or ap_associate read errors and lszcrypt -V shows also
"error" if the BS bits could not get fetched.
Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Reviewed-by: Holger Dengler <dengler@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
This patch adds support for Secure Execution with AP pass-through
support for chzcrypt.
chzcrypt details:
* new command: --se-associate <secret-id> <queue device>
* new command: --se-bind <queue device>
* new command: --se-unbind <queue device>
Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
Reviewed-by: Holger Dengler <dengler@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
This patch adds support for Secure Execution with AP pass-through
support for lszcrypt.
lszcrypt details:
* extension to -b: list AP bus features
* extension to -c: now also valid for queue devices, shows
bind and assoicate state in SE environment;
shows MK states (only for current MKs).
* extension to -V: new column SESTAT within an SE guest, shows text
for the BS bits within an SE environment:
"usable", "bond", "avail", "unuse".
Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
Reviewed-by: Holger Dengler <dengler@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The function show_devices_argv() iterates over all remaining
arguments. Each argument may specify a single device or a list of
sub-devices. Use a separate index for the inner sub-device loop. This
fixes a bug, that not all or wrong arguments are processed.
Also terminate the outer arguments loop based on the number of
remaining arguments.
Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
Reviewed-by: Harald Freudenberger <freude@linux.ibm.com>
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The tools lszcrypt provides filter options for card types. Use these
options not only for devices (cards), but also for sub-devices
(domains).
Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
Reviewed-by: Harald Freudenberger <freude@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The CEX8 card has in CCA mode a new capability 'stateless
hardware filtering support' which is now displayed as
'H' bit in the FUNCTIONS column and with the -c option.
Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
lszcrypt allows the explicit definition of a list of devices. Continue
the parameter processing if multiple devices are specified.
Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
Reviewed-By: Harald Freudenberger <freude@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The static analysis tool for Debian packages 'lintian', especially if called
like 'lintian -EvIL +pedantic', checks manual pages for correctness and typos.
This commit fixes typos that were identified by lintian and marked with
'typo-in-manual-page' while s390-tools version 2.20.0 was packaged.
Closes: https://github.com/ibm-s390-linux/s390-tools/pull/134
Signed-off-by: Frank Heimes <frank.heimes@canonical.com>
Acked-by: Steffen Maier maier@linux.ibm.com [ziomon]
Acked-by: Ingo Franzki ifranzki@linux.ibm.com [zkey]
[hoeppner@linux.ibm.com: fix commit message]
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The new option -s, long --serial shows the serial numbers of
CCA and EP11 cards.
Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
New options:
--cardonly
--queueonly
which filter the output to show only card or queue information.
Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
New options:
--accelonly
--ccaonly
--ep11only
which restrict the output to only cards/queues with the given mode.
Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Newer kernel show a sysfs attribute chkstop which displays
the checkstop state of a crypto card. This patch enables
support for lszcrypt to display the checkstop state.
Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
If there is a max_msg_size attribute for the card
the lszcrypt -c option will show this limit as
AP bus max message size limit xx Kb
Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
lszcrypt now evaluates and displays the 'status' in the
'STATUS' column if the vfio provides this sysfs attribute.
Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The 'STATUS' field was within the code used as 'online'
record because it showed the online state. But now it
displays some more info like 'deconfig' and maybe even
more in the future. So now the code also uses a 'status'
record for this info.
Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Slight rework of the lszcrypt code with:
- a queue or card in deconfigured mode is displayed
as 'deconfig' regardless which driver is bound to
the device.
- a queue or card in 'deconfig' mode does not show
any counters any more but displays a '-' instead.
- a queue not bound or bound to something else as
the 'default' zcrypt dd does not show any counters
but displays a '-' instead.
Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
A compile with sparse (make C=1) shows a couple of warnings:
like:
chzcrypt.c:36:3: warning: symbol 'l' was not declared.
Should it be static?
lszcrypt.c: In function 'show_device':
lszcrypt.c:556:9: warning: 'card' may be used uninitialized
[-Wmaybe-uninitialized]
Fix those warnings.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Jan Hoeppner <hoeppner@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
When many domains per card are available, then the results of the SCDMD
CHSC call may not fit into the output area, and a partial result is
returned. The further results must be retrieved with another CHSC call.
Fix the code to pass the correct next-domain to the subsequent CHSC call
of a partial response. Otherwise the same set of domains 1 to n are
retrieved again, resulting in an infinite loop, because this will always
produce a partial result.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Harald Freudenberger <freude@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
lszcrypt now shows a card/queue which is in 'deconfigured' state as
'deconfig' in the STATE column (verbose and non verbose mode).
chzcrypt became two new options: --config-on and --config-off to
switch one or more card devices to 'configured' or 'deconfigured'
state.
Both applications are able to handle older kernels which do now
provide the config sysfs attribute required for this new feature.
Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
This patch adds CEX7S exploitation support to lszcrypt and chzcrypt.
Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Dependent on kernel config option CHSC_SCH the device node /dev/chsc may
exist per default or not. In case the kernel is built with CHSC_SCH=M,
then the device driver is built as separate kernel module, and must
therefore be loaded using modprobe chsc_sch to make device node /dev/chsc
available.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The zcryptstats tool displays usage statistics of IBM Crypto Express
adapters. It obtains cryptographic performance measurement data
periodically and displays the data for each cryptographic device for
each interval. A cryptographic device can be either a card device or
a queue device (APQN).
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Added some explanations about the columns shown with the
lszcrypt verbose output.
Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Get rid of fixed buffers and avoid the following GCC8 compile warnings:
lszcrypt.c: In function ‘main’:
lszcrypt.c:642:28: warning: ‘%04x’ directive writing between 4 and 8
bytes into a region of size between 7 and 13 [-Wformat-overflow=]
sprintf(sub_dev, "%02x.%04x", id, dom);
^~~~
lszcrypt.c:642:22: note: directive argument in the range [0, 2147483647]
sprintf(sub_dev, "%02x.%04x", id, dom);
^~~~~~~~~~~
lszcrypt.c:642:5: note: ‘sprintf’ output between 8 and 18 bytes into a
destination of size 16
sprintf(sub_dev, "%02x.%04x", id, dom);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
With the latest kernel comes an extension for the zcrypt
device driver to support multiple zcrypt device nodes.
Here is the userspace part of this which adds a new
application zcryptctl for user friendly management of
this feature.
Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
With kernel 4.19 there comes an extension to the existing
AP bus which supports alternate zcrypt drivers. For details
about this see kernel patch "s390/zcrypt: AP bus support for
alternate driver(s)". So now lszcrypt displays the driver
name in verbose mode. As some of the information displayed
by lszcrypt was based on sysfs attributes, which are only
available when the default zcrypt driver is bound to the
device, this also needed some rework. If a sysfs attribute
is not available because of an alternate driver binding
(or no driver) a question mark is printed into the field.
Together with this a slight rework of the displayed information
has been done. The two columns for pending requests and pending
replies has been merged to one pending column and the column
sizes have been adjusted.
Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Fixed typo and added one sentence to explain more details
about online switching of queue devices.
Signed-off-by: Harald Freudenberger <freude@linux.vnet.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The man page date was AUG 2008. Changed to OCT 2017.
A previous commit had a wrong indentation on following
options text for lszcrypt. Fixed.
Signed-off-by: Harald Freudenberger <freude@linux.vnet.ibm.com>
Signed-off-by: Stefan Haberland <sth@linux.vnet.ibm.com>
With z14 there comes a new crypto card 'CEX6S'.
This patch introduces the s390-tools changes needed
to list the new card and show the capabilities correctly.
Signed-off-by: Harald Freudenberger <freude@linux.vnet.ibm.com>
Signed-off-by: Michael Holzheu <holzheu@linux.vnet.ibm.com>
There was a too tight buffer allocated on the stack
which was overwritten by just one byte caused to
dump the application on function exit's stack check.
Reviewed all the buffer sizes and adapted them
to the need of the functions.
Signed-off-by: Harald Freudenberger <freude@linux.vnet.ibm.com>
Signed-off-by: Michael Holzheu <holzheu@linux.vnet.ibm.com>
The -d and -e options did not show any failure message when
executed with insufficient permissions (e.g. not root user).
Now the behaviour is equal to the other options: A message
'chzcrypt: Error - can't write to xxx. Wrong permissions or
wrong tools version' is printed.
Signed-off-by: Harald Freudenberger <freude@linux.vnet.ibm.com>
Signed-off-by: Michael Holzheu <holzheu@linux.vnet.ibm.com>
The -c option was listed with <device-id> and the text
explained that device id may be a card or queue device id.
The --capability option only allows a card as argument so
the man page has been corrected to show this now correctly.
Signed-off-by: Harald Freudenberger <freude@linux.vnet.ibm.com>
Signed-off-by: Michael Holzheu <holzheu@linux.vnet.ibm.com>
The sysfs files ap_control_domain_mask and ap_usage_domain_mask
may hold just a string "not supported" if there's no crypto
configuration available. However, lszcrypt always processed
the content of these files as hex number and so produced funny
output if there's no configuration data available.
Signed-off-by: Harald Freudenberger <freude@linux.vnet.ibm.com>
Signed-off-by: Michael Holzheu <holzheu@linux.vnet.ibm.com>
This commit is based on the s390-tools-1.39.0 version.
Changes on top of s390-tools-1.39.0:
- Add MIT license to all source files
- Add LICENSE file
- Transform REAMDE to README.md (markdown)
- Add AUTHORS.md file
- Add CONTRIBUTING.md file
- Move changelog from README to CHANGELOG.md file
Reviewed-by: Stefan Haberland <sth@linux.vnet.ibm.com>
Signed-off-by: Michael Holzheu <holzheu@linux.vnet.ibm.com>
