Extract the minor version and modification level separately.
Previously only the modification level has been extracted, and was
reported as minor version.
Currently no one is checking the minor version or modification level,
so it does not hurt. But maybe in the future one will check, so report
it correctly.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
During plugin initialization, the external libraries such as the
EP11 or CCA host libraries are set up, if the configuration is
appropriate.
A secure identity key may be generated once the APQNs are configured,
but before the server connection is configured. Trying to re-encipher
the plugin's secure keys to a new HSM master key at that stage fails
with 'ERROR: Invalid ext lib type: 0' because the external libraries
have not been setup yet.
Change the code to setup the libraries once the APQNs have been
configured, and not only after the server connection has been
configured.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Increase initial update interval from 200ms to 1 seconds to avoid
fluctuations on the initial data output.
Signed-off-by: Mete Durlu <meted@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
pvattest is a tool to attest an IBM Secure Execution guest.
In a trusted environment, one can create a request using
`pvattest create`. To get a measurement of an untrusted
IBM Secure Execution guest call 'pvattest perform'.
Again in a trusted environment, call 'pvattest verify'
to verify that the measurement is the expected one.
The tool runs on s390 and x86.
It has the same requirements like libpv and therefore
requires openssl v1.1.1+, glib2.56+, and libcurl.
Additionally, to measure, the linux kernel must provide
the Ultravisor userspace interface `uvdevice` at /dev/uv
and must be executed on an IBM Secure Execution guest on
hardware with Ultravisor attestation support, like IBM z16 or later.
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
libpv is a collection of definitions and functions related to
Protected Virtualization (PV).
The functions cover mainly encryption (e.g. AES-GCM)
and certificates (X509). There are also helping functions for glib2.
Most of the code is extracted+refactored from `genprotimg`, which
will use this library in future.
Requires openssl v1.1.1+, glib2.56+, and libcurl.
libpv is not designed or intended to be dynamically linked or used
outside of this project. Its purpose is to avoid code duplication
as PV tools do very similar things regarding cryptography.
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Acked-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
This commit introduces a new module containing various helpers for
NGDump stand-alone dump. The purpose of these helpers is to facilitate
the implementation of DT and DFI interfaces for NGDump, share code
between both, reduce duplication and enable unit testing later on.
Signed-off-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Reviewed-by: Alexander Gordeev <agordeev@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Return the partition number which contains the given block range,
before it was tested for exact match between a partition block range
and the one provided by user. The old behavior with exact match
should still work, this change just relaxes the partition matching
algorithm and allows one to find a partition which contains the given
block range.
Signed-off-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Reviewed-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
This commit finalizes the implementation of the new stand-alone dump -
Next Gen Dump (NGDump).
NGDump stand-alone dump is a universal stand-alone dump which works for both
SCSI and NVMe disks. But currently can be used only with NVMe disks
and SCSI stand-alone dump remains the default for SCSI disks.
Currently, this stand-alone dump can be used only on IBM z15 or newer
machine generations because it requires larger amount of HSA memory offered
by firmware only on IBM z15 machines. Whereas SCSI stand-alone dump is able
to work with HSA memory of 32M, the new stand-alone dump requires 512M HSA
memory at the moment.
NGDump stand-alone dump installation is initiated by passing a path to
a NVMe disk partition to zipl via the command-line -d, similar to SCSI
stand-alone dump. zipl will then:
- build a dumper initramfs with either dracut (Fedora/RHEL/SLES) or
initramfs-tools (Ubuntu/Debian)
- format the given NVMe partition with ext4 file system
- create a bootmap file on the newly created file system using the built
initramfs and the currently active kernel image
- install a boot loader on the disk the given dump partition belongs to
The operations described above are destructive for the given NVMe dump
partition and the boot record(s) of its disk.
After the installation step, users can configure the dumpconf to IPL
the dumper automatically on panic or trigger a dump manually via HMC
interface.
When activated, the dumper will create a dump ELF file named "dump.elf"
on the given NVMe dump partition by using the makedumpfile tool. The kdump
compressed file format is not supported yet due to zgetdump not being able
to read such a file format. Therefore, the dumper is restricted to write
the dump only in ELF format but only kernel pages which are in use.
This will usually make the dump smaller than the original size of
/proc/vmcore and the whole dump process faster as well.
Example configuration for dumpconf:
ON_PANIC=dump # or dump_reipl
DUMP_TYPE=nvme
FID=0x00000001
NSID=0x00000001
BOOTPROG=0
BR_LBA=0
$ systemctl enable --now dumpconf
To install the dracut support on Fedora/RHEL/SUSE:
$ make -C zipl/dracut HAVE_DRACUT=1 install
To install the initramfs-tools support on Ubuntu/Debian:
$ make -C zipl/initramfs-tools HAVE_INITRAMFS=1 install
Example of NGDump console output on SLES during dump
----------------------------------------------------
Starting NGDump...
[ 8.932343] ngdump.sh[327]: NGDump started
[ 8.934739] ngdump.sh[336]: Checking for memory holes : [ 0.0 %] /
[ 8.967536] ngdump.sh[336]: Checking for memory holes : [100.0 %] |
[ 9.076976] ngdump.sh[336]: Excluding unnecessary pages : [100.0 %] \
[ 11.721157] ngdump.sh[336]: Copying data : [ 0.0 %] -
[ 12.317319] ngdump.sh[336]: Copying data : [ 22.5 %] / eta: 2s
[ 13.273000] ngdump.sh[336]: Copying data : [100.0 %] | eta: 0s
[ 13.273244] ngdump.sh[336]: The kernel version is not supported.
[ 13.273263] ngdump.sh[336]: The makedumpfile operation may be incomplete.
[ 13.273281] ngdump.sh[336]: The dumpfile is saved to /ngdump/dump.elf.
[ 13.273299] ngdump.sh[336]: makedumpfile Completed.
Example of NGDump console output on Ubuntu during dump
-------------------------------------------------------
[ 3.240078] zdump: The dump process started for a 64-bit operating system
Loading, please wait...
Starting version 245.4-4ubuntu3.17
Begin: Starting firmware auto-configuration ... done.
Begin: Loading essential drivers ... done.
Begin: Running /scripts/init-premount ...
Begin: NGDump ...
Checking for memory holes : [ 0.0 %] /
Checking for memory holes : [100.0 %] |
Excluding unnecessary pages : [100.0 %] \
Copying data : [ 0.0 %] -
Copying data : [ 40.7 %] / eta: 1s
Copying data : [100.0 %] | eta: 0s
The kernel version is not supported.
The makedumpfile operation may be incomplete.
The dumpfile is saved to /ngdump/dump.elf.
makedumpfile Completed.
Signed-off-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Acked-by: Alexander Gordeev <agordeev@linux.ibm.com>
Tested-by: Alexander Gordeev <agordeev@linux.ibm.com>
Reviewed-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Tested-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The purpose of the new zipl helper script is to build a dumper initramfs
for NGDump stand-alone dump. zipl executes the helper script when
preparing a NVMe dump partition for stand-alone dump.
The zipl helper script expects a single parameter - a path to the dump
partition to store a dump on. The helper script terminates with 0 on
success and a positive value otherwise.
The zipl helper script performs the following steps:
- It builds an initramfs image suitable for dumping. To perform this step,
the script employs the dracut tool on Fedora/RHEL/SLES and
the initramfs-tools on Ubuntu/Debian.
- It outputs the path to the newly built initramfs image and the currently
active kernel bzImage on the standard output.
- It prints the kernel command-line to be used by the dumper on
the standard output.
On success, zipl expects the helper script to return at least three lines
containing:
- initrd=<path to an initramfs image>
- kernel=<path to a kernel bzImage>
- cmdline=<kernel command-line parameters>
Signed-off-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Acked-by: Alexander Gordeev <agordeev@linux.ibm.com>
Tested-by: Alexander Gordeev <agordeev@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The NGDump initramfs-tools module is required to build an initramfs image
to be used with NGDump stand-alone dump. NGDump stand-alone dump does not
use a pre-built initramfs image in contrast to SCSI stand-alone dump.
Instead, an initramfs image is built with initramfs-tools if NGDump
stand-alone dump is installed on a NVMe partition.
The NGDump initramfs-tools module ensures that all necessary tools are
present within the built initramfs and a dump of /proc/vmcore is initiated
to the chosen NVMe partition when the installed dumper is IPLed.
The NGDump intramfs-tools module installs a configuration file and
a dump script into dumper initramfs. This dump script starts at boot
shortly after the initialization of the dump target device. It reads
the aforementioned configuration file that contains the name of a dump
partition to store a dump on. The dump script reads the configuration file,
mounts then the dump target device, creates a copy of /proc/vmcore with
the makedumpfile tool on it, and then shuts down the system.
Ubuntu and Debian are the main Linux distributions targeted by this
initramfs-tools module.
Signed-off-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Acked-by: Alexander Gordeev <agordeev@linux.ibm.com>
Tested-by: Alexander Gordeev <agordeev@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The NGDump dracut module is required to build an initramfs image to be used
with NGDump stand-alone dump. NGDump stand-alone dump does not
use a pre-built initramfs image in contrast to SCSI stand-alone dump.
Instead, an initramfs image is built with dracut if NGDump stand-alone dump
is installed on a NVMe partition.
The NGDump dracut module ensures that all necessary tools are present
within the built initramfs and a dump of /proc/vmcore is initiated
to the chosen NVMe partition when the installed dumper is IPLed.
The NGDump dracut module installs a new systemd service and a dump script
into dumper initramfs. The systemd init process starts the NGDump service
at boot shortly after the initialization of the dump target device.
The NGDump systemd service, in its turn, starts the dump script provided
by the new dracut module. The dump script mounts then the dump target
device, creates a copy of /proc/vmcore with the makedumpfile tool on it,
and then shuts down the system.
The NGDump dracut module can be used on any Linux distribution which
supports dracut. But the primary targets are:
- Fedora
- RHEL
- SLES
Signed-off-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Acked-by: Alexander Gordeev <agordeev@linux.ibm.com>
Tested-by: Alexander Gordeev <agordeev@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
This change adds a new parameter to the function bootmap_create_file()
that requires the caller to specify a path to the directory where
a bootmap file will be created. The primary motivation for this change is
to support NVMe stand-alone dump, in that case the job's bootmap directory
is not set.
Signed-off-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Acked-by: Alexander Gordeev <agordeev@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The purpose of this change is to simplify the function
bootmap_create_device() and make it more readable. Furthermore,
the dump partition check can be reused for NVMe dump partitions later on.
Signed-off-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Acked-by: Alexander Gordeev <agordeev@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The purpose of this change is to simplify the function
bootmap_create_device() and make it more readable.
Furthermore, make bootmap_create_device() more robust by checking the return
value of disk_write_block_aligned().
Signed-off-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Acked-by: Alexander Gordeev <agordeev@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The purpose of this change is to simplify the function bootmap_create(),
make it more readable and prepare for new changes that will follow.
The original function bootmap_create() tried to handle two different cases
and, therefore, contained many conditional statements which had a negative
effect on readability.
Signed-off-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Acked-by: Alexander Gordeev <agordeev@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The purpose of this change is to simplify the function bootmap_create(),
make it more readable and prepare for new changes that will follow.
Signed-off-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Acked-by: Alexander Gordeev <agordeev@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Until now, NVMe disks were handled by zipl as SCSI disks. To support
NVMe stand-alone dump, it became necessary to further differentiate between
both types of disks.
There are two cases that must be handled:
1. A non-device-mapper device is a NVMe disk if it is assigned to the blkext
device driver.
2. A device-mapper disk is a NVMe disk if the ioctl NVME_IOCTL_ID succeeds.
This case is necessary to properly recognize NVMe disks which are
DM devices and, therefore, not directly handled by the blkext device
driver.
Signed-off-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Acked-by: Stefan Haberland <sth@linux.ibm.com>
Acked-by: Alexander Gordeev <agordeev@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Use util_file_read_va() function to read out the event number
given the event file. Also use util_strdup() function to save
the event name. This function terminates on Out Of Memory condition.
Signed-off-by: Thomas Richter <tmricht@linux.ibm.com>
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
genprotimg is a user command and as such installed into /usr/bin. Adapt
the man page accordingly and move it from section 8 (system commnds) to
section 1 (user commands).
Reported-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The static analysis tool for Debian packages 'lintian', especially if called
like 'lintian -EvIL +pedantic', checks manual pages for correctness and typos.
This commit fixes typos that were identified by lintian and marked with
'typo-in-manual-page' while s390-tools version 2.20.0 was packaged.
Closes: https://github.com/ibm-s390-linux/s390-tools/pull/134
Signed-off-by: Frank Heimes <frank.heimes@canonical.com>
Acked-by: Steffen Maier maier@linux.ibm.com [ziomon]
Acked-by: Ingo Franzki ifranzki@linux.ibm.com [zkey]
[hoeppner@linux.ibm.com: fix commit message]
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The provider functions are passed to OpenSSL in the dispatch array
casted to 'void (*)(void)', so they can not be type checked by the
compiler. Add function prototypes using the OpenSSL provided
function typedefs to allow the compiler to check the function
signatures.
No functional change.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Gcc 12 produces a -Wmaybe-uninitialized warning that the content
of the tmp buffer may be uninitialized. This is a false positive.
Silence the warning by using calloc instead of malloc to ensure
that the allocated buffer is initialized.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Create an empty environment file /etc/ziplenv at make install
time if that file doesn't exist
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Eduard Shishkin <edward6@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
