Rename .exec into .elf because they are ELF files, no reason to use a
different file extension.
This change improves the shell's autocompletion of tools such as
'readelf'.
Acked-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Function kmip_connection_tls_verify_server() erroneously always returns
zero, even if an error is detected inside the function. Fix this by
returning the return code value at the end of the function.
Found by clang static code analyzer.
Fixes: 56fecf1832 ("libkmipclient: Add KMIP client shared library")
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
No functional changes to the file content.
Signed-off-by: Ajaykumar Rajappa <ajaykr@linux.ibm.com>
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
[hoeppner@linux.ibm.com: Adapt commit message]
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Collect Control-Program Identification (CPI) data of the KVM
guests. The CPI data contains system name, system type,
system level and sysplex name of the guests. It also provides
the timestamp in which these data were colleceted from the
guests.
Note:
CPI information for SEL guests require explicit enablement.
Signed-off-by: Shalini Chellathurai Saroja <shalini@linux.ibm.com>
Suggested-by: Hendrik Brueckner <brueckner@linux.ibm.com>
Reviewed-by: Hendrik Brueckner <brueckner@linux.ibm.com>
Reviewed-by: Jörn Siglen <siglen@de.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The key check value (KCV) is the first 3 bytes of the ENC-ZERO key
verification pattern of a key. ENC-ZERO encrypts an all zero block with
the key using AES-ECB and returns the result truncated to 3 bytes as
key check value.
Report the KCV of a KMS generated key as part of its label. This is
especially useful for AES-XTS keys, where the KCV is reported on each
of the 2 individual AES keys that an AES-XTS key is built of. It allows
users to compare the KCV displayed by zkey with the KCV displayed by
the key management system where the key was generated on. If the KCV
value is the same, then the key values are the same, too.
The key verification pattern reported by zkey is also an ENC-ZERO
key check value, but for AES-XTS keys it is built by encrypting
the all zero block with AES-XTS, which produces a KCV for the complete
AES-XTS key, but does not allow to check the individual key parts.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Finn Callies <fcallies@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
When registering a zkey client at the EKMFWeb server, validate the
certificate if it's public key matches with the identity key of
the zkey client.
Only allow registration when the certificate matches. This helps to
prevent users from erroneously registering a wrong or outdated
certificate for a zkey client.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Finn Callies <fcallies@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Function ekmf_validate_cert() checks if the public key contained in a x509
certificate matches the public key of the identity key.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Finn Callies <fcallies@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
A KMS login may prompt the user for its credentials. Users may abort that
prompt by Cntl-C. Do not make any permanent changes to a key before the
KMS login, because those changes can not be undone when the user has
aborted during KMS login, leaving the key in a potentially inconsistent
state.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Finn Callies <fcallies@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
lscss.c: In function 'is_sch_vfio':
lscss.c:392:20: error: implicit declaration of function 'basename' [-Wimplicit-function-declaration]
392 | if (strcmp(basename(driver_path), "vfio_ccw") == 0)
device.c: In function 'device_read_active_attrib':
device.c:426:45: error: implicit declaration of function 'basename'; did you mean 'rename'? [-Wimplicit-function-declaration]
426 | value = misc_strdup(basename(link));
| ^~~~~~~~
| rename
Closes: https://github.com/ibm-s390-linux/s390-tools/pull/192
[hoeppner@linux.ibm.com: Sort includes]
Signed-off-by: L. E. Segovia <amy@amyspark.me>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
NetworkManager stores new network profiles in keyfile format in the
/etc/NetworkManager/system-connections/ directory.
/etc/network/interfaces might be replaced by /etc/netplan on some systems
Reviewed-by: Mario Held <mario.held@de.ibm.com>
Reviewed-by: Michael Storzer <MSTORZER@de.ibm.com>
Signed-off-by: Jörn Siglen <siglen@de.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The definition NO_PIE_CFLAGS has only two users and specifies only a
single compiler flag. There is no point having this definition anymore.
Remove the definition and specify -fno-pie directly for the two users.
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Commit c5a91199e3 ("zipl: Always build and link without PIE.")
introduced -fno-pie (for compilation) and -no-pie (for linking) for
zipl. At the time the linker was still used directly before commit
5e46632767 ("zipl: Use the compiler for linking instead of ld")
eventually switched to calling the compiler for the linking step.
During that adaption -static was introduced to the linker flags. -no-pie
was carried over as well. However -static implies -no-pie and it is
therefore not required. For GCC see also man 1 gcc (-static) [1]. Whilst
not explicitly documented, Clang shows the same behaviour. Clang also
complains when -static and -no-pie are specified in the linker step at
the same time with the following warning:
clang: warning: argument unused during compilation: '-no-pie' [-Wunused-command-line-argument]
Since -no-pie is not required, remove it and get rid of the warning.
[1] https://gcc.gnu.org/onlinedocs/gcc/Link-Options.html#index-static
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The command line options -fno-pie/-no-pie are required by boot loaders
as they have strict layout requirements. A check was implemented using
-dumpspecs to evaluate the compiler support as older compilers didn't
support the no-pie command line options.
However, -dumpspecs is a GCC specific option and the check will
therefore always fail for Clang. The objective is to enable Clang
compilation support for s390-tools in the long-run.
Since support for -fno-pie/-no-pie in GCC was introduced 2015 with
version 6.1.0 and in Clang 2010 with version 3.0.0, general support can
be assumed.
Simply remove the support check and get rid of another obstacle that's
in the way for full Clang support.
Suggested-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The 'clang' compiler generates a section with the name '".loader_parms"'
and gcc '.loader_parms' if the double quotes are used. Fix this by
removing the superfluous double quotes, this results in a section with
the name '.loader_parms' for both clang and gcc.
Reported-by: Richie Buturla <richie@linux.ibm.com>
Reviewed-by: Euan Bourke <euan@linux.ibm.com>
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
zdev provides dracut logic for configuring devices early during boot via
kernel command line parameters rd.dasd and rd.zfcp. A copy of resulting
configuration directives is made available to the booted Linux using
chzdev's export function.
The use of command line option --all in this export step results in
chzdev loading all kernel modules required by supported types, even if
no device of that type exists on the booted system, or if no zdev kernel
parameter was specified.
Loading unused kernel modules during boot increases memory usage,
prolongs boot time, and expands the kernel's attack surface
unnecessarily.
Fix this by replacing command line option --all with --configured to
instruct chzdev to export only data for devices with a persistent
configuration, while not loading any kernel modules.
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Reviewed-by: Vineeth Vijayan <vneethv@linux.ibm.com>
Signed-off-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
On SEL guests, the default configuration does not permit the
Control-Program Identifiation (CPI) data to be sent by the cpi
service, resulting in a failure message in systemctl/log output
on start of the cpi service.
This is not a failure because it is expected behavior and the
cpi service is a one-shot service whose function is already
performed when the exit code is returned. Prevent the error log
by filtering the associated exit code in systemd.
Signed-off-by: Shalini Chellathurai Saroja <shalini@linux.ibm.com>
Acked-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Reviewed-by: Hendrik Brueckner <brueckner@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Modify the symbolic name of the exit code 6 to
EXIT_NOTCONFIGURED, which is according to the Linux Standard Base
(LSB) specification.
Signed-off-by: Shalini Chellathurai Saroja <shalini@linux.ibm.com>
Suggested-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Reviewed-by: Hendrik Brueckner <brueckner@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
cargo update -p openssl -p curl -p usafe-libyaml
By default users of the libs will use the version tagged in the
lockfile. Let make things easier for them and update the lock entries
with versins that have some CVEs fixed.
Note that this does not affect code shipped by distros as they ignore the
lockfile.
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Add command-line option --counters "AAA,BBB,...,ZZZ" to specify a
comma-separated list of counter names to display. Counter names must
match exactly, ignoring case. All counters not listed are excluded
from output.
Reviewed-by: Thomas Richter <tmricht@linux.ibm.com>
Signed-off-by: Jan Polensky <japo@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Move ctr_in_list() from cpumf/lspai.c to a shared location to enable
reuse in other binaries that require counter list filtering.
Reviewed-by: Thomas Richter <tmricht@linux.ibm.com>
Signed-off-by: Jan Polensky <japo@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The code within 'menu_param()' previously assumed that a read from sclp
will never fail.
If 'sclp_param()' fails then 'endptr' is never initialised and
'loadparm' is compared with 'endptr' which is undefined behvaiour.
If a sclp read fails, an undefined 'endptr' is never accessed, and upon
a failed read, will return a new error code 'SCLP_ERROR' instead of
returning 'NUMBER_FOUND' which is incorrect logic wise.
Remove compare conditions and assignments of 0 in 'value', as 'value'
is initialised with 0 ('DEFAULT_MENU_ENTRY') and cannot be non zero,
only in the case where a number is found and we go to boot.
Logic:
Check if we got a number and boot from it.
If 'PRINT_PROMPT', break out to menu print logic.
If an 'SCLP_ERROR' occurs, print an error message and boot the default
since 'value' is initialised with 'DEFAULT_MENU_ENTRY'.
If 'NOTHING_FOUND', check if the menu is disabled. If disabled, go to
default boot. Otherwise break out to print logic.
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Richie Buturla <richie@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Use snprintf() instead of sprintf() to avoid buffer overflow.
Also change the integer type from signed to unsigned.
Error:
dasdinfo.c: In function 'dinfo_create_devnode':
dasdinfo.c:297:52: warning: '%04d' directive writing between 4 and 11
bytes into a region of size 5 [-Wformat-overflow=]
297 | sprintf(filename, "dasdinfo%04d", retry);
| ^~~~
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Jan Polensky <japo@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The util_base.h header is no longer required in dasdinfo.c and can be
safely removed to reduce unnecessary dependencies.
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Jan Polensky <japo@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The sysfs path is now constructed dynamically in an allocated buffer to
avoid potential buffer overflows. The default is '/sys', until the
SYSFS_ROOT environment variable is defined.
These modifications significantly improve testability by allowing sysfs
read and write operations to be redirected to an alternative file path,
which enables testing without affecting the active system state.
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Jan Polensky <japo@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Including string.h is incorrect as it doesn't provide the required
function prototype for strncasecmp() used in this file. Note that
the missing function prototype doesn't cause a compilation error
at the moment as the declaration is provided indirectly.
Use strings.h to provide the declaration for strncasecmp() directly,
avoiding unnecessary include dependencies and improving clarity.
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Jan Polensky <japo@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The variable filename was freed inside the loop and then incorrectly
used in the subsequent warnx() call. Replacing it with directory
reflects the indented context and avoids use after free.
Fixes: f25aaf32b8 ("zkey: Add support for key management system plugins")
Reviewed-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Polensky <japo@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Add command line option --counters XXX,YYY to specify a comma
separated list of counter names to be displayed. The counter names
have to match exactly beside case sensitivity.
All counters not listed in the list specified by the --counters option
are not shown.
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Co-developed-by: Jan Polensky <japo@linux.ibm.com>
Signed-off-by: Thomas Richter <tmricht@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Add a command line flag '-a' to include the counter set values
from each individual CPU. Up to now only the total sum from
all CPUs was printed.
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Thomas Richter <tmricht@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Add command line flag -d to display the counter value in form of
a delta value. This format shows the increase of that counter value
compared to the previous value.
The first line is the base for the delta calculation and always
shows 'Total'. The remaining lines show 'Delta' in the third
column.
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Thomas Richter <tmricht@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Add command line flag -s to display the counter name in an
abbreviated form. The abbreviated form is a character for the
PAI counter set followed by a number.
PAI crypto counter set is abbreviated to 'C'.
PAI NNPA counter set is abbreviated to 'N'.
The number refers to the defined counter number ranging from
1 to X.
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Thomas Richter <tmricht@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Add command line flags -x and -X to print counter values in
hexadecimal format with leading 0x prefix (-X) and without (-x).
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Thomas Richter <tmricht@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Add command line flags -i (read interval) and -l (loops) to
show the counter values for the specified number of iterations.
The CPUs to read the counter values from can be specified
on the command line. If none are specified, all online CPUs
are used.
For example the command '# lspai -l 2 -i 10 -t nnpa'
displays all PAI NNPA counter values two times with 10 second
interval.
Acked-by: Thomas Richter <tmricht@linux.ibm.com>
Reviewed-by: Thomas Richter <tmricht@linux.ibm.com>
Co-developed-by: Jan Polensky <japo@linux.ibm.com>
Signed-off-by: Thomas Richter <tmricht@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Relocate remove_whitespace() from zdsfs to libutil/util_str.c, renaming
it to util_str_rm_whitespace() to make the helper available
project-wide.
Acked-by: Thomas Richter <tmricht@linux.ibm.com>
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Jan Polensky <japo@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
