util_sys_get_dev_addr() returns the device address for a given blockdevice.
This does not work for partitions but some tools rely on the ability to get
the device address for partitions.
Add code that first determines the base device for a partition.
Fixes: 6014d07cb1 ("dasdview/libdasd/zipl: Use util_sys_get_dev_addr() instead of u2s_getbusid()")
Signed-off-by: Stefan Haberland <sth@linux.ibm.com>
Reviewed-by: Jan Hoeppner <hoeppner@linux.ibm.com>
Reviewed-by: Philipp Rudo <prudo@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Some operations are only possible on base devices not on partitions.
Add functions to determine if a given device is a partition or a base
device and to get the base device to a given partition.
Signed-off-by: Stefan Haberland <sth@linux.ibm.com>
Reviewed-by: Jan Hoeppner <hoeppner@linux.ibm.com>
Reviewed-by: Philipp Rudo <prudo@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
When using zgetdump on a multi-volume device dump, the sysfs path to
determine the device node is incomplete, resulting in the following
error:
$ zgetdump -i /dev/dasdb1
zgetdump: Could not open "/sys/bus/ccw/devices/0.0.9300/dasdb/dev" (No
such file or directory)
A simple fix would be to add the missing "block" part in the sysfs path.
However, the logic still assumes sysfs links like "block:" that have
been deprecated a decade ago and are no longer present on modern
systems anyway.
Therefore, the logic can greatly be improved. Create a separate function
to determine whether a device is online, remove the logic for "block:"
entries, and use libutil functions to reduce the complexity even further.
Fixes: 70a79fab3c ("zgetdump: Avoid using PATH_MAX")
Reviewed-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
In the process of switching to glibc defined error functions it becomes
apparent that self-defined error functions that do special things are
not in line with the output of the glibc functions.
To address this, set the prog_name variable to the last component of the
program name (stored in argv[0]) and guarantee a uniform error output.
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
In check_track_format() the base error message is the same for all cases
but has different additional content depending on which mode dasdfmt is
running.
Currently the message is compiled by using different outputs. To make it
a little bit cleaner and for a better error message handling, construct
the message string completely before passing it to the error() function
for output.
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The ERRMSG_EXIT macro is a bit clunky in its usage and a change is
necessary in order to free memory in error cases.
Create a new function error() that takes only a format string and adds
all other relevant information by itself. This function frees memory
before terminating the program with the EXIT_FAILURE exit code.
This simplifies the error handling for pretty much all calls and makes
the code a bit cleaner.
While at it, the defines EXIT_MISUSE and EXIT_BUSY don't provide any
value. Neither are they documented nor are these standardized. Also, a
parent process is mostly interessted in success or failure only anyway.
Replace these by using only EXIT_FAILURE in the error() function.
Also, change multiline output to a combination of warnx and error to
have a uniformed output. So this:
WARNING: Device is formatted with a different blocksize (4096).
Use --mode=full to perform a clean format.
becomes this:
dasdfmt: WARNING: Device is formatted with a different blocksize (4096).
dasdfmt: Use --mode=full to perform a clean format.
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
When calling dasdfmt on device node symlinks like
/dev/disk/by-id/ccw-0X9300, dasdfmt fails with "dasdfmt: the ioctl to get
the blocksize of the device failed (Bad file descriptor)"
This is because before the actual formatting process starts, the disk
will be disabled calling the BIODASDDISABLE ioctl, resulting in the
removal of the symlink. Trying to open this file later in the process to
retrieve e.g. blocksize information results in the mentioned error, as
the file doesn't exist any longer.
This incorrect behaviour was introduced with commit 8826028bdc
("dasdfmt: Use libdasd provided ioctl functions") at which the use of a
globally available file descriptor was omitted. Instead, the ioctl
library functions require a device node to be passed as a function
parameter and will open a file descriptor themselves.
So, before that change, the global file descriptor was always valid even
when the file was removed.
In order to fix this without modifying the behaviour of libdasd,
introduce the two global variables dev_node and dev_path. dev_path is
the original device path entered by the user. dev_node on the other hand
is the reliable device node under /dev/block/ using the major and minor
numbers and is determined in get_device_name().
The dev_path is used for message output only and the dev_node variable
is used for the actual disk operations.
As these two variables are global, the device parameters for several
functions are removed to make the code a bit cleaner.
Fixes: 8826028bdc ("dasdfmt: Use libdasd provided ioctl functions")
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The global program options (and other actually globally used
information) are currently passed through via function parameter
whenever this information is needed. However, in reality, this
information is used almost everywhere across the program.
Make this information globally available and get rid of all the
unnecessary function parameters for dasdfmt_info_t. This makes the code
a little bit cleaner and more readable. Also, rename the global struct
to a more suitable name.
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
dasdfmt_format() does nothing but calling process_tracks() with the same
parameters. Get rid of it, call process_tracks() directly, and avoid
confusion.
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Since commit 75e3afb6a0 ("libdasd: Move get_host_access_count() to
libdasd") dasd_get_host_access_count() reports always 0 as the check for
unsuccessful execution of util_sys_get_dev_addr() is incorrect.
Fix the behaviour by turning the check around.
Fixes: 75e3afb6a0 ("libdasd: Move get_host_access_count() to libdasd")
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
zkey-ekmfweb.so requires libekmfweb.so. If libekmfweb.so can not be built
due to missing build requirements, then zkey-ekmfweb.so can't be built
either.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Building zkey-ekmfweb.so will also trigger to build libekmfweb.so,
which requires OpenSSL. So, skip zkey-ekmfweb.so if HAVE_OPENSSL=0.
zkey-cryptsetup also has a dependency on OpenSSL, so skip it also
if HAVE_OPENSSL=0
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
chcpumf does not print out version (option -v) or help text
(option -h) when the CPU Measurement Sampling facility is not
installed. This was different up to and including release 4.10.
Fix this and hounour option -v and option -h even when
the sampling facility is not installed.
Signed-off-by: Thomas Richter <tmricht@linux.ibm.com>
Reviewed-by: Sumanth Korikkar <sumanthk@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
lszcrypt now shows a card/queue which is in 'deconfigured' state as
'deconfig' in the STATE column (verbose and non verbose mode).
chzcrypt became two new options: --config-on and --config-off to
switch one or more card devices to 'configured' or 'deconfigured'
state.
Both applications are able to handle older kernels which do now
provide the config sysfs attribute required for this new feature.
Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
This patch adds support for the "clear" sysfs attribute for nvme re-IPL,
if available. This attribute allows to control whether the memory should
be cleared on re-IPL.
Signed-off-by: Gerald Schaefer <gerald.schaefer@de.ibm.com>
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
During using of ziorep_utilization utility for generating of CSV format output,
there is one extra comma added after Bus-ID column in virtual adapter report
for each line. This creates one extra column with empty content for each
line. As a result in CSV viewer programs 'qdio utilization max %' column has
no content, all subsequent columns have shifted content from previous
column and the last column has no header. Avoid this situation by deleting
of extra comma.
Before patch application typical line of virtual adapter report looks like:
2020-05-14 13:55:43,0,60,0.0.1906,,0.000000,0.782567,0,0,0.0,321.8,1,1251
After patch application typical line of virtual adapter report looks like:
2020-05-14 13:55:43,0,60,0.0.1906,0.000000,0.782567,0,0,0.0,321.8,1,1251
Signed-off-by: Fedor Loshakov <loshakov@linux.ibm.com>
Reviewed-by: Julian Wiedmann <jwi@linux.ibm.com>
Reviewed-by: Steffen Maier <maier@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Import existing keys that are stored in EKMF Web into the zkey repository.
The keys are imported including their associated information, such as
textual description, volumes, sector size, etc.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Add the possibility to list keys stored in EKMF Web that are eligible to
be used with zkey. The list of keys can be filtered by name, label,
associated volumes, state and export-ability.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
When a key is removed from the zkey repository, the state of the key in
EKMF web can optionally be changed. Keys are usually not removed in EKMF
Web, but the state of the keys are changed to e.g. DEACTIVATED.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Add functions to get and set key properties (i.e. custom tags) of
keys stored in EKMF Web. The key properties are set when the information
associated with a key in the zkey repository is changed, e.g. using the
'zkey change' command.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Generate and import volume encryption keys of type CCA-AESCIPHER in
EKMF Web and import them int the zkey repository. Additional information
can be associated with the keys, such as a textual description, volumes
encrypted with the key, sector size of the volumes, etc. This is
also stored in EKMF Web with the keys as custom tags.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
To register the zkey client with EKMF Web, the X.509 certificate
generated with the identity key is sent to EKMF Web, and an identity
key object is generated in EKMF Web with the public key from the
certificate. This identity key is then used to control the export of
keys stored in EKMF Web, and to verify the cryptographically signed
requests sent by the plugin.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
To identify the zkey client with EKMF Web, an X.509 certificate must be
generated using the identity key, and must be made known to EKMF Web.
Either a self signed certificate can be generated, or a certificate
signing request (CSR) that is then passed to a certificate authority
(CA) to have a certificate issued.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The identity key of the plugin is a secure key. When the APKA master key
of the associated APQNs is changed, the identity key must be re-enciphered
under the new master key.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
To identify the zkey client with EKMF Web, the plugin generates a secure
ECC or RSA identity key, and stores it in its configuration directory.
This key is then used to cryptographically sign requests sent to EKMF Web.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Retrieve several settings from EKMF Web after the connection to
EKMF Web has been configured. This includes the EKMF Web server's
public key, which is user later on to verify cryptographically signed
responses. Also the key templates used by EKMF Web to generate keys
for zkey are retrieved, and it is checked if the require feature
'Pervasive Encryption' is available.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
To perform operations in EKMF Web, the user must log in with a EKMF Web
user id and a time based one time passcode. The passcode can be obtained
by the user from the EKMF Web user interface, after logging in into EKMF
Web. That way a two factor authentication is performed. The plugin passes
the passcode to EKMF Web retrieves a bearer token from EKMF Web which it
then uses on subsequent requests to authenticate with EKMF Web. Such a
bearer token is valid for several minutes, thus no re-login is required
for zkey commands run during that time.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Allow the user to configure the connection to the EKMF Web server
using the 'zkey kms configure' command. The communication is based
on a RESTful API via HTTPS. Besides the URL of the EKMF Web server,
other TLS related settings can be configured.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The EKMF Web plugin requires APQNs of one or multiple IBM cryptographic
adapters in CCA coprocessor mode to operate. It makes use of secure
RSA and ECC keys, and thus requires the APKA master keys of the CCA APQNs
to be set.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
