Ignore the removal of nonexistent $image file. This removes the
following error message:
$ mk-s390image /var/lib/libvirt/images/hades/vmlinux-s390x out.img
...
rm: cannot remove 'out.img': No such file or directory
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
If an input file is not readable return a proper error message indicating
this.
Before:
$ mk-s390image /var/lib/libvirt/images/hades/vmlinux-s390x out.img
mk-s390image: Unrecognized file format for /var/lib/libvirt/images/hades/vmlinux-s390x
After:
$ mk-s390image /var/lib/libvirt/images/hades/vmlinux-s390x out.img
mk-s390image: File /var/lib/libvirt/images/hades/vmlinux-s390x cannot be read, no read permission
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Since Linux commit 5ecb2da660ab ("s390: support command lines longer
than 896 bytes") the s390x kernel supports longer command lines than 896
bytes. The indication of the maximum size is stored in a new field at
address 0x10430, older kernels without the support store a value of 0
there so in that case fallback to the old maximum length of 896.
In addition, use the checked size as limit to copy in the 'dd' call.
This prevents Linux kernel corruption in case the parmline has changed
in between.
Fixes: https://github.com/ibm-s390-linux/s390-tools/issues/194
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Most of the fixes were auto-generated using the following command:
$ shellcheck --format=diff mk-s390image | git apply -
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Using the base dir only, will ensure to get all needed info independent of
configuration and future changes.
├── dasd
│ ├── devices
│ └── statistics
├── net
│ ├── anycast6
│ ├── arp
│ ├── bonding
│ ├── dev
│ ├── dev_mcast
│ ├── dev_snmp6
│ │ ├── encbdf0
│ │ └── lo
│ ├── sockstat
│ ├── sockstat6
│ ├── softnet_stat
│ ├── stat
│ │ ├── arp_cache
│ │ ├── ndisc_cache
│ │ ├── nf_conntrack
│ │ └── rt_cache
│ ├── vlan
The change in size and collection speed can be ignored.
Reviewed-by: Michael Storzer <MSTORZER@de.ibm.com>
Signed-off-by: Jörn Siglen <siglen@de.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Use 'none' as default io scheduler for virtio-blk devices. Performance
improvements for multi-queue setups and to reduce CPU consumption.
Signed-off-by: Peter Jin <pjin@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Performance measurements turned out that in certain situations the
paging/swap logic turns on the rotational feature for block devices. In the
past, this feature has been disabled for DASD devices. FCP and NVMe devices
are considered non-rotational by default (or exposed by the storage server).
Because those are the backing devices on Linux on Z/LinuxONE instances,
ensure that virtio-blk devices are always non-rotational.
Signed-off-by: Peter Jin <pjin@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Output all text input sections into one text section and map all input
sections .bss.* .text.*, .rodata.*, and .data.* as it's done by the
default linker script [1]. In addition, make the linker script easier to
read by replacing the magic value of 32 with 'SIZEOF(.sb.trailer)'.
[1] Check the output of 'ld --verbose'.
Reviewed-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Although stage2.head is not directly used in stage2, it is required by
other stages. To ensure it is retained during link-time
optimization (LTO), explicitly mark it as used. This improves code
readability and prevents LTO from mistakenly removing it.
Reviewed-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Rename .exec into .elf because they are ELF files, no reason to use a
different file extension.
This change improves the shell's autocompletion of tools such as
'readelf'.
Acked-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Function kmip_connection_tls_verify_server() erroneously always returns
zero, even if an error is detected inside the function. Fix this by
returning the return code value at the end of the function.
Found by clang static code analyzer.
Fixes: 56fecf1832 ("libkmipclient: Add KMIP client shared library")
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
No functional changes to the file content.
Signed-off-by: Ajaykumar Rajappa <ajaykr@linux.ibm.com>
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
[hoeppner@linux.ibm.com: Adapt commit message]
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Collect Control-Program Identification (CPI) data of the KVM
guests. The CPI data contains system name, system type,
system level and sysplex name of the guests. It also provides
the timestamp in which these data were colleceted from the
guests.
Note:
CPI information for SEL guests require explicit enablement.
Signed-off-by: Shalini Chellathurai Saroja <shalini@linux.ibm.com>
Suggested-by: Hendrik Brueckner <brueckner@linux.ibm.com>
Reviewed-by: Hendrik Brueckner <brueckner@linux.ibm.com>
Reviewed-by: Jörn Siglen <siglen@de.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The key check value (KCV) is the first 3 bytes of the ENC-ZERO key
verification pattern of a key. ENC-ZERO encrypts an all zero block with
the key using AES-ECB and returns the result truncated to 3 bytes as
key check value.
Report the KCV of a KMS generated key as part of its label. This is
especially useful for AES-XTS keys, where the KCV is reported on each
of the 2 individual AES keys that an AES-XTS key is built of. It allows
users to compare the KCV displayed by zkey with the KCV displayed by
the key management system where the key was generated on. If the KCV
value is the same, then the key values are the same, too.
The key verification pattern reported by zkey is also an ENC-ZERO
key check value, but for AES-XTS keys it is built by encrypting
the all zero block with AES-XTS, which produces a KCV for the complete
AES-XTS key, but does not allow to check the individual key parts.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Finn Callies <fcallies@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
When registering a zkey client at the EKMFWeb server, validate the
certificate if it's public key matches with the identity key of
the zkey client.
Only allow registration when the certificate matches. This helps to
prevent users from erroneously registering a wrong or outdated
certificate for a zkey client.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Finn Callies <fcallies@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Function ekmf_validate_cert() checks if the public key contained in a x509
certificate matches the public key of the identity key.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Finn Callies <fcallies@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
A KMS login may prompt the user for its credentials. Users may abort that
prompt by Cntl-C. Do not make any permanent changes to a key before the
KMS login, because those changes can not be undone when the user has
aborted during KMS login, leaving the key in a potentially inconsistent
state.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Finn Callies <fcallies@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
lscss.c: In function 'is_sch_vfio':
lscss.c:392:20: error: implicit declaration of function 'basename' [-Wimplicit-function-declaration]
392 | if (strcmp(basename(driver_path), "vfio_ccw") == 0)
device.c: In function 'device_read_active_attrib':
device.c:426:45: error: implicit declaration of function 'basename'; did you mean 'rename'? [-Wimplicit-function-declaration]
426 | value = misc_strdup(basename(link));
| ^~~~~~~~
| rename
Closes: https://github.com/ibm-s390-linux/s390-tools/pull/192
[hoeppner@linux.ibm.com: Sort includes]
Signed-off-by: L. E. Segovia <amy@amyspark.me>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
NetworkManager stores new network profiles in keyfile format in the
/etc/NetworkManager/system-connections/ directory.
/etc/network/interfaces might be replaced by /etc/netplan on some systems
Reviewed-by: Mario Held <mario.held@de.ibm.com>
Reviewed-by: Michael Storzer <MSTORZER@de.ibm.com>
Signed-off-by: Jörn Siglen <siglen@de.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The definition NO_PIE_CFLAGS has only two users and specifies only a
single compiler flag. There is no point having this definition anymore.
Remove the definition and specify -fno-pie directly for the two users.
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Commit c5a91199e3 ("zipl: Always build and link without PIE.")
introduced -fno-pie (for compilation) and -no-pie (for linking) for
zipl. At the time the linker was still used directly before commit
5e46632767 ("zipl: Use the compiler for linking instead of ld")
eventually switched to calling the compiler for the linking step.
During that adaption -static was introduced to the linker flags. -no-pie
was carried over as well. However -static implies -no-pie and it is
therefore not required. For GCC see also man 1 gcc (-static) [1]. Whilst
not explicitly documented, Clang shows the same behaviour. Clang also
complains when -static and -no-pie are specified in the linker step at
the same time with the following warning:
clang: warning: argument unused during compilation: '-no-pie' [-Wunused-command-line-argument]
Since -no-pie is not required, remove it and get rid of the warning.
[1] https://gcc.gnu.org/onlinedocs/gcc/Link-Options.html#index-static
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The command line options -fno-pie/-no-pie are required by boot loaders
as they have strict layout requirements. A check was implemented using
-dumpspecs to evaluate the compiler support as older compilers didn't
support the no-pie command line options.
However, -dumpspecs is a GCC specific option and the check will
therefore always fail for Clang. The objective is to enable Clang
compilation support for s390-tools in the long-run.
Since support for -fno-pie/-no-pie in GCC was introduced 2015 with
version 6.1.0 and in Clang 2010 with version 3.0.0, general support can
be assumed.
Simply remove the support check and get rid of another obstacle that's
in the way for full Clang support.
Suggested-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The 'clang' compiler generates a section with the name '".loader_parms"'
and gcc '.loader_parms' if the double quotes are used. Fix this by
removing the superfluous double quotes, this results in a section with
the name '.loader_parms' for both clang and gcc.
Reported-by: Richie Buturla <richie@linux.ibm.com>
Reviewed-by: Euan Bourke <euan@linux.ibm.com>
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
zdev provides dracut logic for configuring devices early during boot via
kernel command line parameters rd.dasd and rd.zfcp. A copy of resulting
configuration directives is made available to the booted Linux using
chzdev's export function.
The use of command line option --all in this export step results in
chzdev loading all kernel modules required by supported types, even if
no device of that type exists on the booted system, or if no zdev kernel
parameter was specified.
Loading unused kernel modules during boot increases memory usage,
prolongs boot time, and expands the kernel's attack surface
unnecessarily.
Fix this by replacing command line option --all with --configured to
instruct chzdev to export only data for devices with a persistent
configuration, while not loading any kernel modules.
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Reviewed-by: Vineeth Vijayan <vneethv@linux.ibm.com>
Signed-off-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
On SEL guests, the default configuration does not permit the
Control-Program Identifiation (CPI) data to be sent by the cpi
service, resulting in a failure message in systemctl/log output
on start of the cpi service.
This is not a failure because it is expected behavior and the
cpi service is a one-shot service whose function is already
performed when the exit code is returned. Prevent the error log
by filtering the associated exit code in systemd.
Signed-off-by: Shalini Chellathurai Saroja <shalini@linux.ibm.com>
Acked-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Reviewed-by: Hendrik Brueckner <brueckner@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Modify the symbolic name of the exit code 6 to
EXIT_NOTCONFIGURED, which is according to the Linux Standard Base
(LSB) specification.
Signed-off-by: Shalini Chellathurai Saroja <shalini@linux.ibm.com>
Suggested-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Reviewed-by: Hendrik Brueckner <brueckner@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
cargo update -p openssl -p curl -p usafe-libyaml
By default users of the libs will use the version tagged in the
lockfile. Let make things easier for them and update the lock entries
with versins that have some CVEs fixed.
Note that this does not affect code shipped by distros as they ignore the
lockfile.
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Add command-line option --counters "AAA,BBB,...,ZZZ" to specify a
comma-separated list of counter names to display. Counter names must
match exactly, ignoring case. All counters not listed are excluded
from output.
Reviewed-by: Thomas Richter <tmricht@linux.ibm.com>
Signed-off-by: Jan Polensky <japo@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Move ctr_in_list() from cpumf/lspai.c to a shared location to enable
reuse in other binaries that require counter list filtering.
Reviewed-by: Thomas Richter <tmricht@linux.ibm.com>
Signed-off-by: Jan Polensky <japo@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The code within 'menu_param()' previously assumed that a read from sclp
will never fail.
If 'sclp_param()' fails then 'endptr' is never initialised and
'loadparm' is compared with 'endptr' which is undefined behvaiour.
If a sclp read fails, an undefined 'endptr' is never accessed, and upon
a failed read, will return a new error code 'SCLP_ERROR' instead of
returning 'NUMBER_FOUND' which is incorrect logic wise.
Remove compare conditions and assignments of 0 in 'value', as 'value'
is initialised with 0 ('DEFAULT_MENU_ENTRY') and cannot be non zero,
only in the case where a number is found and we go to boot.
Logic:
Check if we got a number and boot from it.
If 'PRINT_PROMPT', break out to menu print logic.
If an 'SCLP_ERROR' occurs, print an error message and boot the default
since 'value' is initialised with 'DEFAULT_MENU_ENTRY'.
If 'NOTHING_FOUND', check if the menu is disabled. If disabled, go to
default boot. Otherwise break out to print logic.
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Richie Buturla <richie@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Use snprintf() instead of sprintf() to avoid buffer overflow.
Also change the integer type from signed to unsigned.
Error:
dasdinfo.c: In function 'dinfo_create_devnode':
dasdinfo.c:297:52: warning: '%04d' directive writing between 4 and 11
bytes into a region of size 5 [-Wformat-overflow=]
297 | sprintf(filename, "dasdinfo%04d", retry);
| ^~~~
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Jan Polensky <japo@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
