Add support to integrate the external key management systems based
on the KMIP protocol (KMIP: OASIS Key Management Interoperability
Protocol) into zkey by providing a zkey KMS plugin for KMIP. The
plugin communicates with KMIP servers using libkmipclient over a
TLS or HTTPS connection.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
libkmipclient is a shared library that provides an KMIP client to
communicate with an KMIP server. KMIP stands for Key Management
Interoperability Protocol, and is an extensible communication protocol
that defines message formats for the manipulation of cryptographic
keys on a key management server.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The libseckey is a secure key library to perform secure key operations
with OpenSSL. It provides a framework to create OpenSSL PKEYs with a
secure key attached. Such a PKEY contains the public key parts in clear,
but the private key as secure key blob. Only the private key operations
are actually performed with the secure key, public key operations are
performed in software by OpenSSL. It supports CCA and EP11 secure
keys for RSA and ECC crypto operations.
Because many PKEY method related functions are deprecated since OpenSSL
3.0, two versions of the OpenSSL secure key support are needed. One (using
a PKEY method override) for OpenSSL 1.1.1, and another one (using an own
OpenSSL provider) for OpenSSL 3.0 and later. The desired implementation is
selected automatically at compile time, using OpenSSL version defines. The
interface of both implementations is the same, so a user does not need to
care which one is used.
Reviewed-by: Juergen Christ <jchrist@linux.ibm.com>
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
hsavmcore is designed to make the dump process with kdump more efficient.
With hsavmcore, the HSA memory that contains a part of the production
kernel's memory can be released early in the process. Depending on the size
of the production kernel's memory, writing the dump to persistent storage
can be time consuming and prevent the HSA memory from being reused
by other LPARs.
Signed-off-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Reviewed-by: Philipp Rudo <prudo@linux.ibm.com>
Acked-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
zpcictl is used to manage PCI devices on z Systems. In this first
version it is mainly used to handle erroneous PCI devices by changing
their state and make those changes known to the SE. Log data, such as
S.M.A.R.T. data for NVMe devices, is sent alongside those state changes.
The state change is issued by sending data via the PCI 'report_error'
sysfs attribute. It's a binary attribute which will cause the host to
send an Adapter Notification Event.
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Since version 198 (Feb 2013) systemd contains kernel-install, a script
managing kernel installs. This script allows execution of drop-in scripts
for customization. Add such a drop-in script to s390-tools to handle the
installation of zfcpdump kernels.
It's main purpose is to manage a link to the latest installed zfcpudump
kernel at ZFCPDUMP_IMAGE, where zipl expects to find the image to install
for a SCSI dumper.
The script supports two installation modes. One recommended by the
BootLoaderSpecs [1] to /boot/<machine-id>/<kernel-version> directories and
one directly to /boot. In the second case files are renamed during
installation to <original-name>-<kernel-version> to guarantee unique names.
Because the zfcpdump kernel is so special make the script stand-alone and
prevent any other script from being executed (exit 77) when a zfcpdump is
installed. Especially avoid functionality like creating an initrd (already
provided by s390-tools) or creating a boot entry (the zfcpdump kernel
should not be used for any other purpose than dumping).
The script requires systemd >= 203.
[1] https://www.freedesktop.org/wiki/Specifications/BootLoaderSpec/
Signed-off-by: Philipp Rudo <prudo@linux.ibm.com>
Reviewed-by: Hendrik Brueckner <brueckner@linux.ibm.com>
Reviewed-by: Javier Martinez Canillas <javierm@redhat.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The file system dumper no longer exists. So there is no need in keeping
'PART' to distinguish between the file system and the partition dumper.
Adjust the macro name to the usage in zipl by removing 'PART'.
While at it also adjust the file names the macros stand for.
Signed-off-by: Philipp Rudo <prudo@linux.ibm.com>
Reviewed-by: Hendrik Brueckner <brueckner@linux.ibm.com>
Reviewed-by: Javier Martinez Canillas <javierm@redhat.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
This patch prevents code duplication in vmcp related programs.
Some applications such as vmur, vmcp, and lsqeth
use z/VM CP commands to query information. Each program
uses its own defines and code.
Supply a library and common header file to use common code.
Signed-off-by: Thomas Richter <tmricht@linux.vnet.ibm.com>
Reviewed-by: Hendrik Brueckner <brueckner@linux.vnet.ibm.com>
Reviewed-by: Jan Höppner <hoeppner@linux.vnet.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
This commit is based on the s390-tools-1.39.0 version.
Changes on top of s390-tools-1.39.0:
- Add MIT license to all source files
- Add LICENSE file
- Transform REAMDE to README.md (markdown)
- Add AUTHORS.md file
- Add CONTRIBUTING.md file
- Move changelog from README to CHANGELOG.md file
Reviewed-by: Stefan Haberland <sth@linux.vnet.ibm.com>
Signed-off-by: Michael Holzheu <holzheu@linux.vnet.ibm.com>
Jan Höppner