Avoid code duplication and inconsistent error handling by replacing
readlink() with util_readlink(), which is used project-wide to
standardize readlink() usage.
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Jan Polensky <japo@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Replace the readlink() branch with readlinkat() and normalize
parameters: use AT_FDCWD with filename when relname is NULL. This
removes duplicate code paths while preserving behavior, including the
growth loop and size limits. readlinkat() is a superset of readlink().
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Jan Polensky <japo@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Introduce util_readlinkat() to read symbolic links relative to a
directory file descriptor, and util_readlink() as a convenience wrapper
using AT_FDCWD.
util_readlink() delegates to util_readlinkat() instead of duplicating
logic, ensuring a single implementation for both interfaces.
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Jan Polensky <japo@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Convert comment encoding from ISO-8859-1 to UTF-8 to avoid encoding
mismatches and simplify future maintenance.
Align the libvtoc comments with the change introduced in the kernel
by commit 8f2bc80c6ef8 ("s390: ebcdic: convert comments to UTF-8").
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Jan Polensky <japo@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Add util_startswith to util_str to check if a string starts with the
given prefix and returns a pointer to the rest of the string,
or NULL if it does not.
Signed-off-by: Wisdom Erhimwionsobo <werh29@linux.ibm.com>
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
chreipl passes additional boot parameters via the firmware scp_data
sysfs attribute. This mechanism is shared by multiple re-IPL types (FCP,
NVMe, and ECKD) and they all have the same scp_data size limit. The
BOOTPARMS_FCP_MAX name is therefore misleading.
Rename BOOTPARMS_FCP_MAX to BOOTPARMS_SCPDATA_MAX and update all callers
to make the intent clear and avoid implying this limit is FCP-only.
Reviewed-by: Jan Polensky <japo@linux.ibm.com>
Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
chreipl accepts --bootparms for list-directed IPL, but for ECKD re-IPL the
value was never committed to sysfs, so the requested boot parameters did
not take effect.
Write the boot parameters to the firmware scp_data attribute when
configuring an ECKD re-IPL target. Also validate that the ECKD re-IPL
sysfs interface exists and enforce the maximum supported boot parameter
length up front.
Fixes: 7c24855ba1 ("ipl_tools: add support for list-directed IPL from ECKD DASD")
Reviewed-by: Jan Polensky <japo@linux.ibm.com>
Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Some environments do not expose the /sys/firmware/reipl/*/clear attribute
(e.g. z/VM guests without "Load Normal" support). lsreipl currently tries to
read the attribute unconditionally for ECKD re-IPL and emits a confusing
"Could not read file .../clear" error when it is missing.
Re-IPL type: eckd
Device: 0.0.6d74
bootprog: 0
br_chr: auto
Bootparm: ""
Loadparm: ""
Could not read file /sys/firmware/reipl/eckd/clear: No such file or directory
clear: (null)
Secure boot: 0
Only print the "clear" field when the corresponding sysfs attribute is
present, avoiding the spurious error output.
Fixes: 7c24855ba1 ("ipl_tools: add support for list-directed IPL from ECKD DASD")
Reviewed-by: Jan Polensky <japo@linux.ibm.com>
Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
stage3 still contains a legacy fallback path that transfers control to
the new kernel via LPSW 0 when diag 0x308 is not available.
The current start_kernel() inline asm issues "diag %[code],%[code],0x308"
without enforcing the required even/odd register pairing for the first
operand. With recent distro toolchains (e.g. GCC 15.x as shipped by Fedora
43 and Ubuntu 25.10), register allocation picks an odd register for the
first diag operand in start_kernel(), which triggers a specification
exception. That exception is then caught by the program-check handler
and stage3 silently takes the fallback, booting the kernel via LPSW 0
instead of performing diag308 LOAD_NORMAL_RESET.
All supported environments are expected to provide diag308, and the rest
of the code already relies on it. Drop start_kernel() and the obsolete
LPSW fallback and always reset into the new kernel via the properly
coded diag308() helper. Mark start() as __noreturn.
Reviewed-by: Eduard Shishkin <edward6@linux.ibm.com>
Tested-by: Eduard Shishkin <edward6@linux.ibm.com>
Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
warning: unresolved link to `GuestSecret::retrievable`
--> pv/src/uvsecret/guest_secret.rs:56:37
|
56 | /// Create Retrievables using [`GuestSecret::retrievable`]
| ^^^^^^^^^^^^^^^^^^^^^^^^ the enum `GuestSecret` has no variant or associated item named `retrievable`
|
= note: `#[warn(rustdoc::broken_intra_doc_links)]` on by default
warning: unresolved link to `GuestSecret::RetrievableKey::name`
--> pv/src/uvsecret/guest_secret.rs:63:30
|
63 | /// SHA256 hash of [`GuestSecret::RetrievableKey::name`]
| ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ the enum `GuestSecret` has no variant or associated item named `RetrievableKey`
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Marc Hartmayer <marc@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
CoreOS uses VARIANT_ID instead of a unique ID in /etc/os-release.
Extend distro detection to identify RHCOS, other CoreOS variants
may be added later if needed.
RHCOS is showing in HMC as RHEL, because `system_level' is:
```
[core@cosa-devsh ~]$ cat /sys/firmware/cpi/system_level
0x010906023a050e00
```
But should be:
```
[core@cosa-devsh ~]$ cat /sys/firmware/cpi/system_level
0x070906023a050e00
```
Issue: https://jsw.ibm.com/browse/OCPVIP-1471
Closes: https://github.com/ibm-s390-linux/s390-tools/pull/199
Signed-off-by: Nikita Dubrovskii <nikita@linux.ibm.com>
Reviewed-by: Marc Hartmayer <marc@linux.ibm.com>
Reviewed-by: Hendrik Brueckner <brueckner@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Fix incorrect handling of tape devices leading to inability of
creating dumps on them.
Make the check for tape device go first, to not miss it on irrelevant
errors
Reported-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Reviewed-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Signed-off-by: Eduard Shishkin <edward6@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
When the subchannel type read from sysfs does not match the requested
type, the allocated path is not freed before continuing to the next
loop iteration. This causes a memory leak as reported by valgrind.
Free the path before continuing.
Signed-off-by: Volkan Unal <vunal@linux.ibm.com>
Reviewed-by: Vineeth Vijayan <vneethv@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
At present, the hsci tool creates HiperSockets Converged Interface
(HSCI) with MTU of 1500 bytes regardless of the values of MTU for the
external and HiperSockets interface from which it is formed. This can
degrade performance or worse, affect network connectivity through the
converged interface.
Update the tool to automatically set MTU of HSCI as the lower of the
MTU values of external and HiperSockets interface.
Reviewed-by: Alexandra Winter <wintera@linux.ibm.com>
Signed-off-by: Aswin Karuvally <aswin@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Introduce the new state 'unauthorized' to the three already existing
states disabled, enabled, and unsupported to CPU-MF counters.
CPU-MF counters are only available on LPARs.
The intent is to differentiate whether a system simply does not support
the CPU-MF counters like a z/VM guest or if they are supported like on
LPAR but have to be authorized via HMC/SE.
Signed-off-by: Finn Callies <fcallies@linux.ibm.com>
Reviewed-by: Harald Freudenberger <freude@linux.ibm.com>
[hoeppner@linux.ibm.com: Adapt commit message]
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Introduce a new command line flag ("--format") to specify the output
format. Valid options are "pairs" for shell-compatible key
value pairs, "csv" for CSV, "json" for a formatted JSON document, and
"json-seq" for a stream of JSON text sequences as per RFC7464[1].
[1]: https://datatracker.ietf.org/doc/html/rfc7464
Signed-off-by: Volkan Unal <vunal@linux.ibm.com>
Reviewed-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Change the default firmware hash verification to its final location.
For the old one, there is a redirection in place for the foreseeable
future.
Reviewed-by: Marc Hartmayer <marc@linux.ibm.com>
Acked-by: Brendon Drew <bdrew@us.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The sysfs field 'depth' for AP queues now shows the real depth
and not the depth -1 as it is reported by the TAPQ instruction.
lszcrypt did under the hood already this +1 but now this increment
is done by the kernel and thus not needed in lszcrypt any more.
Suggested-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
Reviewed-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The structure perf_event_attr sometimes gets new members appended
at the end of the structure. Then the size of the structure increases.
This may lead to the situation where sizeof(struct perf_event_attr)
calculated at the pai program compile time during s390-tools build
differs from the one used to build application programs on the target
system.
The report files written by various tools write the contents of the
perf_event_attr structure followed by indivual samples to a binary file.
The second member perf_event_attr::size contains the size of that
structure in bytes.
Use that perf_event_attr::size from the target system to scan the
report files given as command line argument. This ensure the correct
size of structure perf_event_attr is used.
Output before:
Current situation: The pai program uses a perf_event_attr structure
which contains 8 bytes less than the one used on the target system.
The first sample header (8 bytes) then actually refers to the last
eight bytes of structure perf_event_attr, which are all zeroes. This
is an invalid sample entry and the program terminates with error.
# pai -r -V painnpa.0004043; echo $?
painnpa.0004043 size:1344
[0x000088] type 0 misc 0 size 0
1
Output after:
Use the correct size of structure perf_event_attr, which was read
from be binary file, written by the tools compiled on the target system:
# pai -r -V painnpa.0004043; echo $?
painnpa.0004043 size:1344
size perf_event_attr mismatch 136/144
[0x000090] type 9 misc 1 size 58 0x13537f71715 18 event 6144 \
sample pid 4043/4043 15:0x8a,16:0x88,22:0x112,25:0xc0
...
0
Also show an debug message when verbose mode is turned on.
Signed-off-by: Thomas Richter <tmricht@linux.ibm.com>
Reviewed-by: Jan Polensky <japo@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
According to the valgrind man-page, "the behaviour of realloc() with a
size of zero is implementation defined in C17 and undefined in C23."
The current glibc implementation frees the specified buffer, returns
NULL and doesn't set errno. While this behavior is unlikely to change
in the near future, code relying on it may not be compatible with other
libc implementations. Also this realloc() use is flagged as an error in
valgrind runs, making valgrind output less usable.
Fix this by explicitly adding code to cover the realloc(buffer, 0) case
in util_realloc(). Also change libutil users of realloc() to use
util_realloc() instead.
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Add mkfs.ext4 to zipl dependency list. It is required to prepare
a NGDump dump partition.
Signed-off-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Reviewed-by: Marc Hartmayer <marc@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Add kernel module phmac_s390 to the initramfs hook and dracut config file
to ensure that the PHMAC cipher is available during early boot, in case
the root disk is integrity protected via PHMAC.
Also load phmac_s390 via modules-load.d to ensure that the PHMAC ciphers
are available.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Finn Callies <fcallies@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
In case the volume is integrity protected, and the integrity algorithm is
PHMAC, then the convert command also checks the integrity key part of the
volume key, and then uses the secure integrity key, and sets the
verification pattern to the verification-pattern token.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Finn Callies <fcallies@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
In case the volume is integrity protected, and the integrity algorithm is
PHMAC, then the reencipher command also reenciphers the integrity key part
of the volume key.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Finn Callies <fcallies@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
In case the volume is integrity protected, and the integrity algorithm is
PHMAC, then the setkey command also checks the integrity key part of the
volume key, and then sets the key into a new key slot, and sets the
verification pattern to the verification-pattern token.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Finn Callies <fcallies@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
In case the volume is integrity protected, and the integrity algorithm is
PHMAC, then the setvp command also adds the verification pattern of the
integrity key into the token.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Finn Callies <fcallies@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
In case the volume is integrity protected, and the integrity algorithm is
PHMAC, then also validate the integrity key and print its validation
status.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Finn Callies <fcallies@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
In case the volume is integrity protected, and the integrity algorithm is
PHMAC, then the verification-pattern token as well as the reencipher-token
contain the verification pattern of the integrity key as well.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Finn Callies <fcallies@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Use 'u8 *' instead of 'char *' for pointers to key blobs everywhere.
This saves a lot of casts.
The libcryptsetup API still uses 'char *' as pointer type for volume keys,
so a few casts are required when passing those pointers to libcryptsetup
API functions.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Finn Callies <fcallies@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The commands 'zkey cryptsetup' generates commands for formatting and
opening volumes of type PLAIN and LUKS2.
For LUKS2, if there exists an HMAC key that is associated to the same
volume as the AES key, generate a 'cryptsetup luksFormat' command for
combined encryption and integrity protection. This uses the '--integrity'
and '--integrity-key-size' options of the 'cryptsetup luksFormat'
command to specify the integrity settings.
The volume key specified with '--master-key-file' must contain the
encryption key and the integrity key concatenated to each other. The
size of the volume key specified with '--key-size' however must be the
size of the encryption key only, in bits. The 'cryptsetup luksFormat'
command will internally read the whole file, use the first part as
encryption key, and the second part as integrity key. The size of the
second part must be specified with the '--integrity-key-size'.
Note: This requires 'wrapped integrity key' support in the cryptsetup
package, as well as in the dm-crypt kernel module.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Finn Callies <fcallies@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The commands 'zkey integritytab' generates /etc/integritytab entries for
volumes of type INTEGRITY.
The 'zkey integritysetup' generates integritysetup commands for formatting
and opening volumes of type INTEGRITY.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Finn Callies <fcallies@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The commands 'zkey crypttab' and 'zkey cryptsetup' should only operate on
AES-type keys, but not on HMAC keys.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Finn Callies <fcallies@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
You can only set a sector size for an HMAC key of a volume of type
INTEGTRITY. For combined integrity protection with encryption, the
sector size of a LUKS2 volume must be set on the AES key, but can
not be set on the HMAC key.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Finn Callies <fcallies@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
For combined integrity protected with encryption, a LUKS2 volume can be
associated to exactly one AES type key and also to exactly one HMAC type
key.
For other volume types, a volume can only be associated to exactly one
key, either an AES type key, or an HMAC type key.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Finn Callies <fcallies@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Although HMAC keys can be associated to volumes of type 'LUKS2', the dummy
passphrase can only be set to AES-type keys, i.e. to keys that encrypt the
volume.
Reject trying to set a dummy passphrase for an HMAC key with a volume type
of 'LUKS2'.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Finn Callies <fcallies@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Keys of type PVSECRET-HMAC can be associated to volumes of volume type
'INTEGTRITY' or 'LUKS2'.
Volumes of type 'INTEGTRITY' are set up for standalone dm-integrity via
the 'integritysetup' tool. Volumes of type 'LUKS2' are setup for combined
encryption and integrity using the 'cryptsetup' tool using the integrity
option.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Finn Callies <fcallies@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Similar as for AES keys, a verification pattern is calculated from an HMAC
key by MACing an all zero message of 64 bytes. The first 32 bytes of the
result is the verification pattern.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Finn Callies <fcallies@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Add the definitions and utility functions for the PVSECRET-HMAC key type.
A PVSECRET-HMAC key token contains the secret id of a protected
virtualization secret. It does not contain the key material, just a
reference to the key in the ultravisor.
When such a key token is used to perform HMAC operations later on, the
PHMAC kernel cipher will obtain the protected key belonging to this secret
id with the help of the pkey kernel module.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Finn Callies <fcallies@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
For supporting integrity protected volumes with dm-integrity,
cryptsetup of version 2.8.2 or later is required.
Make cryptsetup of version 2.8.2 a build requirement for zkey, not
only for zkey-cryptsetup. Although zkey could be built with an older
cryptsetup version, the commands that it generates might not work
with older cryptsetup versions.
This makes the compile switch HAVE_LUKS2_SUPPORT superfluous, since
cryptsetup v2.8.2 always includes LUKS2 support. Remove the ifdefs
from the code and update the man pages to not mention LUKS2 support.
Also, starting with cryptsetup version 2.5.0 the luksFormat command
accepts option '--volume-key-file' to specify the volume key file
instead of --master-key-file'. Thus, use '--volume-key-file' in
cryptsetup commands generated by zkey.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Finn Callies <fcallies@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
