Allow the creation of SE images using headers with hybrid (=quantum safe) keys.
This results in using the headers in version 2 (0x200).
Co-developed-by: Marc Hartmayer <marc@linux.ibm.com>
Signed-off-by: Marc Hartmayer <marc@linux.ibm.com>
Signed-off-by: Timo Keller <tkeller@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
* Add `HkdVersion` (classic or hybrid) and `HkdVersionSelection`.
* Add `get_verified_hkds_new` that returns a list of verified HKDs
read according to the given `HkdVersionSelection`.
Co-Developed-by: Timo Keller <tkeller@linux.ibm.com>
Signed-off-by: Timo Keller <tkeller@linux.ibm.com>
Signed-off-by: Marc Hartmayer <marc@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
* Add `AutoOrExplicit` that dispatches between `Auto` and `Explicit`.
* Add `AutoOrExplicitParser` for it.
In a later commit, this will be used for auto detection of HKD version
or explicitly specifying the version.
Signed-off-by: Marc Hartmayer <marc@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Refactor test code and increase coverage. The new test code tests for
the correct error kind instead of simply for an error.
Assisted-by: IBM Bob:1.0.6
Signed-off-by: Marc Hartmayer <marc@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Replace version-specific flag enums (PcfV1, ScfV1) with a unified
SeHdrFlag enum and generic ControlFlagsModel. This refactoring provides:
- Single SeHdrFlag enum for all control flags across SE header versions
- Generic SeHdrControlFlagsModel with version-specific configurations
- EffectiveControlFlags type replacing PlaintextControlFlagsV1/SecretControlFlagsV1
- FlagsOverride mechanism for customizing flag configurations
- Enhanced FromStr implementation for flag parsing
- Comprehensive test coverage for flag operations and conversions
The new design improves maintainability by eliminating code duplication
and provides a more flexible API for working with SE header control
flags.
Assisted-by: IBM Bob:1.0.4
Signed-off-by: Marc Hartmayer <marc@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Add a generic flags framework for managing (Secure Execution) header
control flags. This implementation provides:
- Clap compatibility for auto-completion and proper help messages
- ControlFlagTrait for defining flag types with bit positions and version support
- ControlFlagsModel for managing default flags and validation rules
- FlagsOverride for customizing individual flag states
- EffectiveControlFlags representing the final flag configuration
- UnknownFlags handling for forward compatibility
- Comprehensive error handling via FlagValidationError
- Display implementations for both human-readable and binary formats
- Type-safe conversions between flag representations
The framework supports version-aware flag validation, allowing flags to
be marked as supported only in specific Secure Execution header
versions. It enables flexible flag configuration through overrides while
maintaining type safety and validation.
Assisted-by: IBM Bob:1.0.4
Signed-off-by: Marc Hartmayer <marc@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Add a new derive macro 'derive_control_flag' that is used in the next
commit to reimplement how the code deals with Secure Execution control
flags.
It implements Display, IntoEnumIterator and the ControlFlagTrait for
enums using unit variants only.
/// Trait for control flags that provide bit position information.
pub trait ControlFlagTrait {
/// Returns the bit position for this flag.
fn bit_position(self) -> u8;
}
Assisted-by: IBM Bob:1.0.4
Signed-off-by: Marc Hartmayer <marc@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Add new derive macros ValueEnumDisplay and ValueEnumFromStr which can be
used to derive 'Display' and 'FromStr' for enums implementing
'clap::ValueEnum'. It helps in reducing boilerplate code and keep things
in sync.
Assisted-by: IBM Bob:1.0.4
Signed-off-by: Marc Hartmayer <marc@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Introduce HybridPublicKey combining ECDH and ML-KEM public keys. Use it
for HostKey::V2 and add Keyslot::V2 for hybrid keyslots.
Add tests for the new functionality.
Assisted-by: IBM Bob:1.0.5
Signed-off-by: Timo Keller <tkeller@linux.ibm.com>
Reviewed-by: Marc Hartmayer <marc@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Add derive_aes256_gcm_key_hybrid() function that derives an Aes256GcmKey
and ML-KEM1024 ciphertext from a private ECDH customer key, a public
ECDH target key, and a public ML-KEM target key. This enables hybrid
post-quantum cryptography support.
Assisted-by: IBM Bob:1.0.5
Co-developed-by: Marc Hartmayer <marc@linux.ibm.com>
Signed-off-by: Marc Hartmayer <marc@linux.ibm.com>
Signed-off-by: Timo Keller <tkeller@linux.ibm.com>
Acked-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Prepare the API for future host keys that might not have an EC key by
returning Option instead of a direct reference. Additionally, use
&PKeyRef<Public> as the borrowed view on PKey for better API
consistency.
Signed-off-by: Marc Hartmayer <marc@linux.ibm.com>
Reviewed-by: Timo Keller <tkeller@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
When using sparse on zpcimon several warnings like the one below are
generated:
warning: incorrect type in argument 1 (different base types)
expected unsigned int [usertype] __bsx
got restricted __le32 [usertype] warning_temp_time
This is because several members in struct nvme_smart_log are marked as
__le32. These members are correctly converted to host endianness before
use via le32toh() respectively le16toh(). Since these functions take
their parameters as plain uint32_t or uint16_t however the implicit
conversion triggers the above warning. Fix this by adding the __force
attribute and using it to mark type conversions in the leXXtoh() calls.
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Niklas Schnelle <schnelle@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The __packed attribute is used without including the necessary
zt_common.h header, add it. Note that luckily the struct as it currently
exists doesn't actually required __packed as the natural alignment
leaves no holes. Still if in the future the reserved field is split up
it would need it and this keeps it consistent with the kernel
declaration.
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Niklas Schnelle <schnelle@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Add zpcimon data collection with both SMART log and optical module data.
Do so in the Z device subsystem commands section to account for the fact
that zpcimon is no longer network specific. At the same time keep the
existing opticsmon invocation for compatibility when executed on systems
without zpcimon.
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Reviewed-by: Jörn Siglen <siglen@de.ibm.com>
Signed-off-by: Niklas Schnelle <schnelle@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The SCLP Write Event Data Action Qualifier 4 is only available for
NVMes with subsystem vendor ID matching IBM. Add both IDs to struct
zpci_dev in libzpci. Also add them to the libzpci_example output
and adjust its output to multiline to handle more data.
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Niklas Schnelle <schnelle@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Use libudev to monitor for "change" events in the "nvme" subsystem that
use the "pcie" transport to trigger NVMe SMART data collection. Only
collect data from the NVMe referenced by the udev event.
Assisted-by: IBM Bob:1.0.1
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Niklas Schnelle <schnelle@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
This uses the same format as:
nvme smart-log --output-format=json /dev/nvmeX
One complication being that several values in the SMART data use
unsigned 128 bit integers. Both GCC and Clang support __uint128_t as
a C extension but don't offer printf() support for it. Just like
nvme-cli add a custom uint128_t to string function..
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Niklas Schnelle <schnelle@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Add a new monitor which uses libnvme to collect SMART data from NVMes.
This monitor only implements the .collect_adapter_data operation since
it carries no state across data collections. Nevertheless for future
symmetry and possible future expansion also add an empty struct
nvmemon_ctx.
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Niklas Schnelle <schnelle@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Some of the attributes printed as JSON by opticsmon are common to all
PCI adapters factor these out into reusable helper functions
zpci_adapter_json_print_start() and zpci_adapter_json_print_end().
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Niklas Schnelle <schnelle@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The get_device_node() function for getting the name of an NVMe's
controller device e.g. "nvme0" as implemented in zpcictl is generally
useful and will be needed for NVMe SMART data collection in zpcimon as
well. Move it to libzpci and rename it to zpci_get_nvme_device_node() to
account for the change in namespace.
It would be tempting to pass a struct zpci_dev* instead of a const char*
but as zpcictl uses an incompatible struct zpci_device* this will
require a larger rework. Prioritize minimizing code duplication for now.
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Niklas Schnelle <schnelle@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Introduce the concept of a generic zPCI device monitor by creating the
zpcimon_ops operations struct turning all optics specific calls into
abstract monitor calls. Handle monitors as a static array of zpcimon_ops
based monitors of which the now split out optics monitor is currently
the only one. All operations are in principle optional though a monitor
which provides an init operation must also provide the corresponding
destroy operation.
Keep the base64 based JSON pair as non optics specific for later re-use
and make it just skip the output in the very unlikely case that encoding
fails. In follow on commits a monitor for NVMe devices collecting SMART
data will be added.
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Niklas Schnelle <schnelle@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Introduce separate '--format' option to set output format. Use the new
JSON Lines format explicitly in the systemd unit. Since JSON Lines
format only uses printable characters this removes the need for passing
'-a' to systemctl status. At the same time JSON-SEQ is more easily
parsable using 'jq --seq' so keep it the default for easier scripting.
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Niklas Schnelle <schnelle@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Add a function to get the textual name of an enum util_fmt_t value. To
make this robust to changes in the order of elements in the format array
initialize this using named indices.
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Niklas Schnelle <schnelle@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The opticsmon tool started out as a tool for monitoring the health of
optical modules in directly attached PCI NICs. In the future however it
will also monitor the health of other PCI devices. In particular in
a first step it will monitor the health of directly attached NVMe
devices.
To reflect this broadening of its scope rename opticsmon to zpcimon. Add
zpcimon.service and install it both under the new name and symlinked as
opticsmon.service for backwards compatibility. Since users are expected
to mostly just enable the service this keeps old instructions just
working.
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Niklas Schnelle <schnelle@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
So far it was possible for the user to specify an interval of 0 which
would result in not re-arming the timer at all thus disabling interval
based data collection. While this would still do optics data collection
on startup and link changes the intention is to collect data at least
every 24 hours. If interval is given as 0 treat this as minimum update
interval of 1 second.
Fixes: c34adb9cab ("opticsmon: Introduce opticsmon tool")
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Niklas Schnelle <schnelle@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The code accesses OPTICS_QSFP28_LOS_IMPLEMENTED_OFFSET so the size needs
to be one larger for the LOS to be accessible.
Fixes: c34adb9cab ("opticsmon: Introduce opticsmon tool")
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Niklas Schnelle <schnelle@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Don't just ignore the return of ethtool_nl_connect(). This would also
otherwise lead to invalid socket accesses later. Also make
ethtool_nl_connect() return negative error values instead of
EXIT_FAILURE.
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Niklas Schnelle <schnelle@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
When ethtool_nl_get_optics() fails after ethtool_nl_cb() has allocated
oi->raw this memory would leak because only the struct optics* itself
was freed. Fix this by using optics_free() and relying on free(oi->raw)
being a no-op for NULL pointers in combination with using util_zalloc()
to handle errors both before and after oi->raw was allocated.
Fixes: c34adb9cab ("opticsmon: Introduce opticsmon tool")
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Niklas Schnelle <schnelle@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Don't ignore the return value of monitor_wait_loop() but instead forward
it to the caller.
Fixes: c34adb9cab ("opticsmon: Introduce opticsmon tool")
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Niklas Schnelle <schnelle@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The epoll fd (epfd) in monitor_wait_loop() is never closed. Close it in
all return paths. Also there is no explicit check for an error return of
epoll_create1() add that too.
Fixes: c34adb9cab ("opticsmon: Introduce opticsmon tool")
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Niklas Schnelle <schnelle@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The "tx_fault" field in the JSON output accidentally contained the
rx_los value instead of the tx_fault one. Change it to the correct
value. Note that this does not impact the data relayed to firmware as
that uses the raw module data.
Fixes: c34adb9cab ("opticsmon: Introduce opticsmon tool")
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Niklas Schnelle <schnelle@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The audit directory ts-shell configuration and also the output of
getpwuid() are considered tainted when running in Perl taint (-T) mode.
Provide untaint checks with validating the content.
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Hendrik Brueckner <brueckner@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The updateConfiguration() function updates and checks the ts-shell
configuration for each line in the ts-shell configuration file.
Run the checks just once after the configuration is completely read.
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Hendrik Brueckner <brueckner@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Introduce a configuration setting to allow administrators to specify
path to the iucvconn binary as part of the ts-shell configuration.
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Hendrik Brueckner <brueckner@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Perl provides a Taint (-T) mode which tracks data that is obtained
by external means (e.g. arguments, reading file contents, environment
variables, ...)
Introduce a first set of corrections to clear and validate data
obtained from external sources.
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Hendrik Brueckner <brueckner@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Do not obtain the pager program through the PAGER environment
variable. Instead, introduce a configuration setting to specify
the pager program as part of the ts-shell configuration.
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Hendrik Brueckner <brueckner@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
When ts-shell creates the authorization for current user, the
user name and group names are interpreted as regex. This might
create additional authorizations which are not permitted for
current user.
Correct this behavior by quoting the user name in the regex.
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Hendrik Brueckner <brueckner@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Check the return code of fcntl() calls to ensure the close-on-exec
setting succeeded. Otherwise, the PTY and server file descriptors
would become available to the forked client process.
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Hendrik Brueckner <brueckner@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
iucvtty expects to receive the TERM environment information right
after a connection has been established. Reading this information
can lead to a connection stall (DoS). Introduce a temporary timeout
and fall back to the default TERM environment.
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Hendrik Brueckner <brueckner@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The iucvtty_read_msg() now receives the entire message header.
Perform message header checks for specific message types where the
payload length is clearly defined. Also this needs to be done prior
starting the message chunk processing because the message datalen
field will be adjusted based on the read chunks.
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Hendrik Brueckner <brueckner@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The inclusion of termio.h leads to the following compilation error:
CC iucvterm/tests/test_functions.o
test_functions.c:16:10: fatal error: termio.h: No such file or directory
16 | #include <termio.h>
| ^~~~~~~~~~
The termio ioctl interface has been obsolete for a very long time and
was replaced by termios. termio.h was still present for compatibility
but was removed with glibc 2.42.
iucvterm uses termios.h correctly in the tool. The test however not only
includes termio.h erroneously, it doesn't even require it. Remove the
inclusion of termio.h.
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
