The cpictl utility sends control-program identification data
from protected virtualization guests to hosts by default.
This behaviour leaks the below potentially sensitive
information to untrusted hosts.
- system_type
- system_level
- sysplex_name
- system_name
To prevent this behaviour, enhance the cpictl utility to stop
setting CPI information on protected virtualization guests by
default. If the user chooses to set the CPI information, it
could be set by one of the below options
- use the command line option --permit-cpi
- set the environment variable CPI_PERMIT_ON_PVGUEST to 1 to
control the CPI service behaviour during boot
Signed-off-by: Hendrik Brueckner <brueckner@linux.ibm.com>
Signed-off-by: Shalini Chellathurai Saroja <shalini@linux.ibm.com>
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Reviewed-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Reviewed-by: Hendrik Brueckner <brueckner@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Rework command type selection and timeout trigger.
Add log entry when the timeout stopps a command or a non "zero" rc happens.
Reviewed-by: Mario Held <mario.held@de.ibm.com>
Reviewed-by: Michael Storzer <MSTORZER@de.ibm.com>
Signed-off-by: Jörn Siglen <SIGLEN@de.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
cpictl tool supports options which start with - or -- alone. Getopt
command verifies options which start with - or -- alone. When an
option that does not start with - or -- is provided, the tool commits
the changes and does not report error as shown below.
$ ./cpictl abc
Inside cpi_commit function
Report error and do not commit for invalid options.
Signed-off-by: Shalini Chellathurai Saroja <shalini@linux.ibm.com>
Reviewed-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Move the check_hostkeydoc script to scripts. This eliminates the last file
in the genprotimg directory. Additionally, add a deprecation warning to
that script. Every pv tool can verify the chain itself using the pv
library.
Acked-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Adding podman commands to dbginfo.sh, which is a successor for docker.
We reduce standard details for docker (it can be collected on demand).
Inlcuding /etc/containers for registry and container engine configuration.
Suggested-by: Hendrik Brueckner <brueckner@linux.ibm.com>
Reviewed-by: Mario Held <mario.held@de.ibm.com>
Signed-off-by: Jörn Siglen <SIGLEN@de.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Get a summary of chrony ntp info.
Add config directories for audit and selinux.
Get dmesg log from crash directories.
Reviewed-by: Michael Storzer <MSTORZER@de.ibm.com>
Signed-off-by: Joern Siglen <siglen@de.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The script scsi_logging_level was made available in sg3_utils 2007 [1]
copied from s390-tools. The last functional change in s390-tools was
made 2006.
The sg3_utils version saw at least some improvements over the years.
Providing otherwise identical tools can lead to unnecessary conflicts.
Delete the script from s390-tools and let sg3_utils provide it.
[1] 7502647d46
Fixes: https://github.com/ibm-s390-linux/s390-tools/issues/184
Acked-by: Nihar Panda <niharp@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Define the network devices as global variable with closer selection
to avoid repeated calls with undefined interfaces.
Relable the OSA part of networks.
Reviewed-by: Mario Held <mario.held@de.ibm.com>
Signed-off-by: Joern Siglen <siglen@de.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Add "zhypinfo" as an overview on Hypervisor structure in runtime.out
Get an overview of all block devices in front of the detailed outputs
using "lsblk" into runtime.out
Starting OpenSSL3.0 "openssl engine" is deprecated and needs replacement by:
"openssl list --providers" (keep "engine" for older versions)
Suggested-by: Christian Rund <Christian.Rund@de.ibm.com>
Reviewed-by: Mario Held <mario.held@de.ibm.com>
Signed-off-by: Joern Siglen <siglen@de.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
We changed lscss for more detailed output.
Adding use of dasdview for a detailed view on DASD storage.
This data will be collected in a separate file, as many DASDs might flood
the runtime.out
Also updated man pages as a new step is added
Reviewed-by: Stefan Hberland <sth@linux.ibm.com>
Signed-off-by: Joern Siglen <siglen@de.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The new parameter 'SCP_DATA' can be used to pass additional kernel cmdline
parameters to a stand-alone SCSI/NVMe/ECKD dumper for debugging purposes.
Configuration example
=====================
ON_PANIC=dump_reipl
DUMP_TYPE=fcp
DEVICE=0.0.4711
WWPN=0x5005076303004711
LUN=0x4711000000000000
BOOTPROG=0
BR_LBA=0
SCP_DATA="dump_debug=6 ignore_loglevel earlyprintk=sclp panic_print=3"
Signed-off-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Reviewed-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
- Write the following sysfs attributes for list-directed ECKD devices
introducing setup_eckd_device() function.
br_chr: location of boot record
bootprog: boot program selector
- Remove redundant parameters from setup_ccw_device() and setup_fcp_device()
functioins.
Signed-off-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Reviewed-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
step "initrd config files" was added as 19th step to our data collection
updating for newer date and distro version in the sample output
Reviewed-by: Michael Storzer <mstorzer@de.ibm.com>
Signed-off-by: Joern Siglen <siglen@de.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
For each initrd, collect verbose content listing as well as
the content of files matching the file glob patterns in $CONFIGFILES.
For dracut-squash such as RHEL kdump, this includes squashfs content.
Code is intentionally compatible with dash, so no bashisms.
Ubuntu initramfs has zdev persistent device configuration udev rules under
/lib/udev/rules.d/ (as opposed to /etc/udev/rules.d/).
Ubuntu initramfs stores configuration under /conf/.
Ubuntu kdump-tools have initrds under /var/lib/kdump/.
SLES auxiliary boot stage with grub2-s390x-emu has initrds under /boot/zipl/.
Dracut initramfs stores configuration under /etc/cmdline.d/ and /etc/conf.d/.
Dracut kdump have initrds under /boot/.
Github-ID: https://github.com/ibm-s390-linux/s390-tools/pull/158
Reviewed-by: Fedor Loshakov <loshakov@linux.ibm.com>
Acked-by: Vineeth Vijayan <vneethv@linux.ibm.com>
Acked-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Signed-off-by: Steffen Maier <maier@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
in customer situation we found lsqeth listing devices like:
Device name : (unnamed net_device)
Device name : enc2000
Device name : enc3000
- the braket around the "unnamed" device is braking the function call and
leads to stop the dbginfo.sh script.
- this patch removes brakets > the functions call works and call of osaoat
will report an unknown device instead of braking the dbginfo.sh script
Reviewed-by: Mario Held <mario.held@de.ibm.com>
Signed-off-by: Joern Siglen <siglen@de.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Linux stable kernels can reach greater than 256 sublevels [1],
which can cause the cpi tooling to generate an invalid string
that gets passed to the firmware and causes unusual responses:
$ uname -r
5.4.255
$ cat /sys/firmware/cpi/system_level
0x04260000000504ff
--reboot--
$ uname -r
5.4.256
$ cat /sys/firmware/cpi/system_level
0x4260000000504100
The first sublevel field is defined as one byte, so ensure that
a value larger than that isn't included.
[1] https://lore.kernel.org/lkml/1612534196241236@kroah.com/
Signed-off-by: Eric Farman <farman@linux.ibm.com>
Reviewed-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
With many CPUs, such as triple digit counts, the by default many empty
sysfs directories are prohibitive to collect, especially if the number
of SCSI disk devices is also large, such as 4-digit counts.
Excluding them from being collected from sysfs saves hundreds times
thousands of archive entries and inodes on expansion.
Since the number device-mapper devices (multipath and other target types
such as LVM) is smaller and can include devices not backed by zfcp, keep
collecting
/sys/devices/virtual/block/dm-[0-9]*/mq/0/cpu[0-9]*/
Definitely keep collecting
/sys/kernel/debug/block/{sd,dm-}*/hctx0/cpu[0-9]*/
as it contains actual statistics files:
completed default_rq_list dispatched merged poll_rq_list read_rq_list
Signed-off-by: Steffen Maier <maier@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Replace local ifs_orig variables in different functions by a single
global IFS_ORI variable. This will reduce the risk of missing a local
saving and restore of the original IFS.
Reviewed-by: Michael Storzer <MSTORZER@de.ibm.com>
Signed-off-by: Joern Siglen <siglen@de.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
include the version of dbginfo.sh just used for data collection into our
tar file - so we have the used version in case of data collection problems.
Reviewed-by: Michael Storzer <MSTORZER@de.ibm.com>
Signed-off-by: Joern Siglen <siglen@de.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
icastats is accounted by user and does cover root only today
adding the --all will collect stats for all users
Reported-by: Ingo Franzki <ifranzki@de.ibm.com>
Reviewed-by: Ingo Franzki <ifranzki@de.ibm.com>
Signed-off-by: Joern Siglen <siglen@de.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Add the following options to dumpconf so that LDIPL ECKD devices
can be configured for dumping:
br_chr: (optional) location of boot record
device: ccw device
bootprog: boot program selector
Signed-off-by: Sven Schnelle <svens@linux.ibm.com>
Acked-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
For a slightly easier development loop add a pseudo compilation of the
zfcpdbf Perl script. This will run the Perl interpreter in syntax-check
mode:
-c causes Perl to check the syntax of the program and then exit
without executing it. Actually, it will execute any "BEGIN",
"UNITCHECK", or "CHECK" blocks and any "use" statements: these are
considered as occurring outside the execution of your program.
"INIT" and "END" blocks, however, will be skipped.
Additionally add the `-w` switch when the Make variable `W` is `1`. This
will print additional warnings about dubious constructs (according to
Perl).
So this pseudo compilation only happens whenever the script is changed
during development create a file `.zfcpdbf.ct` as a result so we can
describe the relationship and dependency in Make. This file can be ignored
otherwise.
Signed-off-by: Benjamin Block <bblock@linux.ibm.com>
Reviewed-by: Steffen Maier <maier@linux.ibm.com>
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
changes in opencryptoki setup do require some modifications:
- "pkcsconf -mlist" does no longer work in a combined format
- config files have changed
- ep11info was not yet collected
Signed-off-by: Joern Siglen <siglen@de.ibm.com>
Reviewed-by: Ingo Franzki <ifranzki@de.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
