With f6c6f0cc71 ("rust/pv/test: Code + Certificate refactoring")
no code uses mockito anymore, but it's dependency was not removed.
Remove the mockito dependency from the rust workspace.
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
OpenSSL 1.1 seems to use a non-const parameter to X509_name_dup(), but
x509_armonk_locality_fixup() is passing a const there. The compile then
fails on "discards 'const' qualifier", when -Werror is used. Thus
resolve with a type-cast like in c2b_name().
Fixes: https://github.com/ibm-s390-linux/s390-tools/pull/167
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Dan Horák <dan@danny.cz>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
OpenSSL 1.1 seems to use a non-const parameter to X509_name_dup(), but
x509_armonk_locality_fixup() is passing a const there. The compile then
fails on "discards 'const' qualifier", when -Werror is used. Thus
resolve with a type-cast like in pv_c2b_name().
GitHub-ID: https://github.com/ibm-s390-linux/s390-tools/pull/167
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Dan Horák <dan@danny.cz>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Fix leak of temporary files: if prepare_build_program_table_file()
is called in no dry-run mode and there was an error then the file
@filename will not be deleted in free_bootloader()).
Fix leak of renamed files as well as corruption of previously
created bootmap files with the same name in case of unsuccessful
IPL installation.
Add a special flag to keep a track of file's "temporary" state;
Base the cleanup decision on this flag instead of checking dry-run;
Release resources captured by prepare_bootloader() in the error path;
Move the final rename to be called only after successful installation.
Original logic:
prepare_bootloader_ipl():
prepare_bootloader_ngdump():
always create temporary @filename
if (!dry-run) rename @filename;
install;
cleanup: if (dry_run) drop @filename (*** LEAK ***)
prepare_bootloader_device():
if (dry_run) create temporary @filename
install, don't rename;
cleanup: if (dry_run) drop @filename
New logic:
prepare_bootloader_ipl():
prepare_bootloader_ngdump():
always create temporary @filename and set @tmp_filename_created;
install;
if (!dry_run) rename @filename and clear @tmp_filename_created;
cleanup: if (@tmp_filename_created is set), drop @filename
prepare_bootloader_device():
if (dry_run) create @filename and set @tmp_filename_created;
install, don't rename;
cleanup: if (@tmp_filename_created is set) drop @filename.
Fixes: https://github.com/ibm-s390-tools/s390-tools/issues/165
Signed-off-by: Eduard Shishkin <edward6@linux.ibm.com>
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Acked-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Convert the assertion to a GError since an out-of-disk-space situation
is a valid situation that should be handled.
ERROR:utils/crypto.c:1843:__encrypt_decrypt_bio: assertion failed: (num_bytes_written == out_len)
Bail out! ERROR:utils/crypto.c:1843:__encrypt_decrypt_bio: assertion failed: (num_bytes_written == out_len)
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
The parser setup falsely set the argument type as filename array, but
code expected a single filename. Fixed by setting up the parser
correctly to expect a single file name.
Fixes: 3ab06d77fb ("pvattest: Create, perform, and verify attestation measurements")
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
New IBM signing keys will have Armonk as locality in the subject.
Ensure that CRLs with Poughkeepsie as issuer locality are still
discovered if they are signed with the signing keys private key.
Also, drop the check for issuer/subject comparison and only rely on
validity period and cryptographic signatures.
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Reviewed-by: Christoph Schlameuss <schlameuss@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
New IBM signing certificates will have 'Armonk' as locality in the
subject. Make sure that certificate revocations lists (CRL) with
'Poughkeepsie' as issuer locality are still considered as valid as long
as they are signed with the IBM signing keys private key. In addition,
drop the check for 'issuer(HKD) == subject(HKSK)' as it doesn't improve
security. While at it, remove now unused functions and fix a memory leak
of @akid in `check_crl_issuer`.
Reviewed-by: Christoph Schlameuss <schlameuss@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
New IBM signing keys will have Armonk as locality in the subject.
Ensure that CRLs with Poughkeepsie as issuer locality are still
discovered if they are signed with the signing keys private key.
Also, drop the check for issuer/subject comparison and only rely on
validity period and cryptographic signatures.
Reviewed-by: Christoph Schlameuss <schlameuss@linux.ibm.com>
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
* Get rid of Mockito
* create certs with AKID
* simplify things in the `create_certs.py` script
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
For LUKS2 volumes, zkey generates 'cryptsetup luksFormat' commands with
options '--pbkdf argon2i --pbkdf-memory 32 --pbkdf-force-iterations 4'
for low memory and time requirements. Using the default Argon2i options
might cause out-of-memory errors when multiple encrypted volumes are
unlocked automatically at boot through /etc/crypttab.
When the system runs in FIPS mode, which is indicated by file
/proc/sys/crypto/fips_enabled containing '1', the Argon2i password based
key derivation function might be disabled by a policy, and such
'cryptsetup luksFormat' commands might fail.
Generate '--pbkdf pbkdf2' instead if the system runs in FIPS mode.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Fix the support for staged installs. The Makefile variable `PKGDATADIR`
uses `DESTDIR` for all Makefile target, but actually it should only be
used for the `install*` and `uninstall*` targets. [1] Fix this by using
`DESTDIR` only for `install*` targets - uninstall* targets are not
supported by s390-tools.
Before this change, if `DESTDIR` was set for staged installs,
`genprotimg` has tried to find the bootloader binaries at the temporary
installation path `$DESTDIR$(TOOLS_DATADIR)/genprotimg/` instead of
`$(TOOLS_DATADIR)/genprotimg`.
[1] https://www.gnu.org/prep/standards/html_node/DESTDIR.html
Fixes: 65b9fc442c ("genprotimg: introduce new tool for the creation of PV images")
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Make ngdump_get_part_path() public in order for unit-tests to access it.
Signed-off-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Clear CCW-type DASD standalone dumper (if installed on the DASD) upon
successful installation of the List-Directed ECKD dump tool on the same
device. This helps to avoid 'zgetdump -d' confusion and have only one
'active' dump tool per disk.
Signed-off-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Acked-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Add DF_S390_DUMPER_MAGIC_SIZE constant to s390_dump.h.
Use it instead of hardcoded length when processing dumper magics
in zgetdump code.
Signed-off-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Acked-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Move DUMPER_MAGIC constants from df_s390.h to the global header
include/dump/s390_dump.h in order to reuse it in zipl code.
Signed-off-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Reviewed-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Update dumpconf man page with list-directed ECKD dump information (new
attributes and configuration example for ECKD LDIPL dump).
Update etc/sysconfig/dumpconf with list-directed ECKD dump configuration
example.
Signed-off-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Reviewed-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
- Write the following sysfs attributes for list-directed ECKD devices
introducing setup_eckd_device() function.
br_chr: location of boot record
bootprog: boot program selector
- Remove redundant parameters from setup_ccw_device() and setup_fcp_device()
functioins.
Signed-off-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Reviewed-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Reject conversion of other key types with a proper error message.
Also fix a typo in another error message of the convert command.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Use similar `install` mode option in Makefile as in commit
9b2fb1d4d2 ("zdev: add helper to convert from dasd_mod.dasd to zdev
config").
Fixes: 73c46a3056 ("zdev/dracut: fix kdump by only activating required devices")
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Steffen Maier <maier@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
s390-tools doesn't define a common C/C++ standard at the moment.
Set the standard to gnu11/gnu++11, which is also used by the Kernel, and
establish a common baseline for all tools.
The -std flag is added to ALL_CFLAGS and ALL_CXXFLAGS to avoid losing it
in case CFLAGS are set by an outside entity.
It is also added to CLAGS_FOR_BUILD for this one special cross build
case.
The -std flag is removed from all tools that set it manually until now.
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Reviewed-by: Benjamin Block <bblock@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Introduces the ability to `pvsecret` to add a signature (ecdsa or rsa)
to the program-reserved space (user-data) of an add-secret request
during the request creation. Additionally, some arbitrary data may be
inserted.
The new command `verify` checks if add-secret requests are sane (e.g.
start with the correct magic value). If the request contains a
user-signature `verify` will also verify this signature.
Acked-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Makes the source for the manfiles&README more readable. Fixes some nits
like double spaces, unnessecary indentations, line breaks, ...
Removes pvsecret-version.1 as this command maps to the --version
option.
Acked-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Add a function to read a private key in PEM or DER format.
While at it, fix some documentation issues in read_{certs, crls}.
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
User-data can be added to add-secret requests. User-data can be unsigned
or containing a signature of the request using a custom private key.
The user-data is placed at offset 0x218 and 0x200 bytes long.
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Add four new user-data types an add-secret request could have:
Unsigned, Signed(EcSECP521R1, Rsa(2048, 3072))
As the user-data enum was not marked as non-exaustive this might be a
breaking change for users. (Not for any crate in this repo though).
The addition of such user-data is provided by following patches.
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Improve the warning for the case where a host key document contains
multiple certificates (only possible for a PEM file). In case there are
multiple host key document only the first certificate is used.
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Fix a panic in `pvsecret` when a empty file is used as a host key
document.
$ touch hkd
$ pvsecret create --no-verify -k hkd --output req.bin --hdr sehdr
...
The host key document in 'bla' contains more than one certificate!
thread 'main' panicked at pvsecret/src/cmd/create.rs:192:31:
Fixes: dd82c26f87 ("rust: Add tool to manage UV-secrets")
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Use the `TemporaryDirectory` type to create a temporary directory. This
type has the advantage that the directory is automatically removed once
it goes out of scope. The old implementation in test_sysfs_write_i32
leaks a directory if a previous subtest failed. Also, using a temporary
directory for the LockFile test fixes the following error:
$ RUST_BACKTRACE=1 cargo test -- helper::tests::test_lockfile
...
running 1 test
test helper::tests::test_lockfile ... FAILED
failures:
---- helper::tests::test_lockfile stdout ----
thread 'helper::tests::test_lockfile' panicked at pvapconfig/src/helper.rs:265:9:
assertion failed: r1.is_ok()
stack backtrace:
0: rust_begin_unwind
at /rustc/79e9716c980570bfd1f666e3b16ac583f0168962/library/std/src/panicking.rs:597:5
1: core::panicking::panic_fmt
at /rustc/79e9716c980570bfd1f666e3b16ac583f0168962/library/core/src/panicking.rs:72:14
2: core::panicking::panic
at /rustc/79e9716c980570bfd1f666e3b16ac583f0168962/library/core/src/panicking.rs:127:5
3: pvapconfig::helper::tests::test_lockfile
at ./src/helper.rs:265:9
4: pvapconfig::helper::tests::test_lockfile::{{closure}}
at ./src/helper.rs:263:24
5: core::ops::function::FnOnce::call_once
at /rustc/79e9716c980570bfd1f666e3b16ac583f0168962/library/core/src/ops/function.rs:250:5
6: core::ops::function::FnOnce::call_once
at /rustc/79e9716c980570bfd1f666e3b16ac583f0168962/library/core/src/ops/function.rs:250:5
note: Some details are omitted, run with `RUST_BACKTRACE=full` for a verbose backtrace.
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Reviewed-By: Harald Freudenberger <freude@de.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Add the type `TemporaryDirectory` that creates a temporary directory
that is automatically removed when it goes out of scope.
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Reviewed-By: Harald Freudenberger <freude@de.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Recent changes makes it reasonable to update the version string of pv
and pv_base to 1.0.0. Recent changes introduced some non-backwards
compatible changes, like move some Error definition from pv to the new
pv_core crate. Also, the pv crates seem to be in a good shape to be
considered released.
Therefore, move up the Semver to 1.0.0.
See also:
https://doc.rust-lang.org/cargo/reference/specifying-dependencies.html
NOTE: As these crates are not published to `crates.io` as of now, the
version number is meaningless, as cargo will not pull them from
anywhere and just use the files provided by this repository.
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Update the zerocopy dependency from v0.6.* to the non forward compatible
v0.7.*. Incompatible changes are the requirment of the FromZeroes trait
for FromBytes trait and the non-default derive feature which this
patches handles as well.
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Use a static Mockito server instead of creating multiple on-the-fly
during testing. Add the `mockito_server_available` test to quickly
verify that the mockito server could be constructed. Relocate the
verifier API test to the test folder as it tests the public API. Also,
make the Debug impl for CertVerifier public. The test relocation
requires this. Before, there could be a test local implementation of the
Debug impl as it was in the same crate.
While at it, get rid of the lazy_static crate in favor of the once_cell
crate. As the new std lib implementation is very near to the one from
once cell. The project will switch to the std impl when v1.70 is
available in all supported distros. See:
https://doc.rust-lang.org/std/sync/struct.OnceLock.html
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Replace all libc references to rust-std references if available.
This eliminates the need to include libc in the pv crate.
However, pv_base still refers to libc::ioctl and libc::ENOTTY.
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The rust std lib already provides functionality to compare two slies.
Replace all `memeq` invocations with == and remove the `memeq` function.
As a side effect this eliminates some unsafe code in this crate.
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Big refactoring patch of the pv crate. The main reason behind this
refactoring is to simplify testing and maintaining the pv crate while
keeping OpenSSL/libcurl dependencies optional. Using crate features
increases the number of targets that have to be tested. This refactoring
eliminates the use of features by splitting the functionality of pv into
a use OpenSSL and no-use-OpenSSL crate.
Split off some code from the pv crate into a pv_core crate. pv requires
pv_core and reexports all symbols. pv_base contains all code from former
pv that does not use OpenSSL or libcurl functionalities. The refactored
pv crate contains functionalities to generate requests and validate host
key documents. All features from pv are dropped as they are not needed
anymore and to streamline the codebase for easier use and testing. While
at it fix some documentation issues.
Users (pvsecret & pvapconfig) have next to no code change, besides the
different import of the crate.
Acked-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
A function does the job as well. This improves code readability and
useability. While at it remove the implicit Buffer wrapper. Users are
currently not use the benefits of a buffered write. Also, streamline the
write_out helper function.
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
With kernel commit 496bb034f4ff ("s390/smp: disallow CPU hotplug
of CPU 0") it is no longer possible to hotplug CPU 0.
As a side effect, the sysfs handle /sys/devices/system/cpu/cpu0/online
does no longer exist. Since cpuplugd relies on checking all online
handles of all CPUs, this change causes cpuplugd to fail as it
interprets a non existing online file as an indicator that no other CPUs
with higher IDs exist as well. This leads to cpuplugd assuming that
there are no CPUs available.
Instead of checking for the online file, it is preferable to check for
the existence of the parent folder to verify the existence of a CPU.
As a consequence, all other checks for non-existing online files must
now imply that the CPU is online, but not hotpluggable.
Signed-off-by: Tobias Huschle <huschle@linux.ibm.com>
Tested-by: Mete Durlu <meted@linux.ibm.com>
Reviewed-by: Gerald Schaefer <gerald.schaefer@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
When pai records data it may fail in select() system call.
This error is not reported and the pai program exits with success.
Change this and exit with proper exit code.
Fixes: d7b1cbad8b ("cpumf/pai: Add Processor Activity Instrumentation tool")
Signed-off-by: Thomas Richter <tmricht@linux.ibm.com>
Acked-by: Sumanth Korikkar <sumanthk@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Running command pai -r <file> might encounter entries of type
PERF_RECORD_SWITCH. Entries of that type are currently not handled
and cause an error message:
# pai -r ~/paicrypto.000
unknown header-type 14 unknown header-type 14 \
unknown header-type 14 ...
The error message is not terminated by a newline.
Handle entries of this type PERF_RECORD_SWITCH. These records
do not carry any payload at all, just a bit is set in the
header::misc member. This bit set determines context switch out.
Output after:
# ./pai -r ~/paicrypto.000
0x4b814018f4f3 6 cs-out
0x4b817bc3c936 6 cs-in
0x4b817bc5246c 6 cs-out
0x4b817bd90e9a 6 cs-in
....
#
Signed-off-by: Thomas Richter <tmricht@linux.ibm.com>
Acked-by: Sumanth Korikkar <sumanthk@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Add pre-commit (https://pre-commit.com/) configuration to allow
developers to run certain checks on their commits automatically.
Currently enabled checks and hooks are:
- Generic checks (e.g. merge-conflicts, trailing whitespace, etc.)
- git clang-format
- Codespell
- Shellcheck (https://www.shellcheck.net/)
Note: For some hooks Rust is excluded as a lot of false positives are
produced at the moment.
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
step "initrd config files" was added as 19th step to our data collection
updating for newer date and distro version in the sample output
Reviewed-by: Michael Storzer <mstorzer@de.ibm.com>
Signed-off-by: Joern Siglen <siglen@de.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
pvapconfig is a new tool for automatically configuring the APQNs
within an Secure Execution KVM guest with AP pass-through support.
Based on a given AP configuration it tries to find a matching
APQN and bind and associate it with the correct secret.
Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
Reviewed-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Holger Dengler <dengler@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Adds getter for SecretList and SecretEntry.
Adds enum to represent secret types.
Add Iterator functionality for SecretList.
While at it, make the datatype of the capacity of the list transparent
for users.
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
For each initrd, collect verbose content listing as well as
the content of files matching the file glob patterns in $CONFIGFILES.
For dracut-squash such as RHEL kdump, this includes squashfs content.
Code is intentionally compatible with dash, so no bashisms.
Ubuntu initramfs has zdev persistent device configuration udev rules under
/lib/udev/rules.d/ (as opposed to /etc/udev/rules.d/).
Ubuntu initramfs stores configuration under /conf/.
Ubuntu kdump-tools have initrds under /var/lib/kdump/.
SLES auxiliary boot stage with grub2-s390x-emu has initrds under /boot/zipl/.
Dracut initramfs stores configuration under /etc/cmdline.d/ and /etc/conf.d/.
Dracut kdump have initrds under /boot/.
Github-ID: https://github.com/ibm-s390-linux/s390-tools/pull/158
Reviewed-by: Fedor Loshakov <loshakov@linux.ibm.com>
Acked-by: Vineeth Vijayan <vneethv@linux.ibm.com>
Acked-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Signed-off-by: Steffen Maier <maier@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Converts zdev configuration into the syntax of the dracut cmdline option
rd.znet. Only znet options with non-default values are emitted. The result
string occurs on stdout. It represents one device-specification for the
given network interface name.
Example:
/lib/s390-tools/zdev-to-rd.znet persistent encbdf0
qeth,0.0.bdf0,0.0.bdf1,0.0.bdf2,layer2=1
User:
https://github.com/rhinstaller/anaconda/pull/5250
to generate dracut cmdline entries such as
rd.znet=qeth,0.0.bdf0,0.0.bdf1,0.0.bdf2,layer2=1
Github-ID: https://github.com/ibm-s390-linux/s390-tools/pull/158
Acked-by: Vineeth Vijayan <vneethv@linux.ibm.com>
Acked-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Signed-off-by: Steffen Maier <maier@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Useful for debugging (what happened during early boot).
Also useful for distro installers, which can import the early config into
their own environment early after starting:
chzdev --import /run/zdev.initrd.config --persistent --yes \
--no-root-update --force --verbose
After that, distro installers can modify/add the device config based
on interactive or unattended installation choices using
chzdev --enable --active --persistent ...
Finally, distro installers can likewise transfer the entire device config
to the installed system mounted under $SYSROOT:
chzdev --export /tmp/zdev.config --all --type --persistent --verbose
Github-ID: https://github.com/ibm-s390-linux/s390-tools/pull/158
Acked-by: Vineeth Vijayan <vneethv@linux.ibm.com>
Acked-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Signed-off-by: Steffen Maier <maier@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Add parsing of dracut cmdline option "rd.zfcp=..." at initrd runtime.
It delegates configuration to chzdev.
Implement `dracut --print-cmdline` and `dracut --hostonly-cmdline` for
initrd build time. Emit an rd.zfcp option for each zfcp-attached SCSI disk
in dracut's device dependency graph (to mount the root-fs, or to access the
kdump target).
This allows a distribution independent device configuration.
Configuration is consistent by using chzdev as backend.
It also prevents duplicate activations of the same device.
Along with the existing functionality of zdev/dracut, it makes the
following dracut modules superfluous:
https://github.com/dracutdevs/dracut/tree/master/modules.d/95zfcp
[rd.zfcp.conf is no longer needed and thus ignored here; the preceding
("zdev/dracut: fix marking hostonly files so delete option works")
makes rd.hostonly=0 work as a generic replacement]
https://github.com/dracutdevs/dracut/tree/master/modules.d/95zfcp_rules
Github-ID: https://github.com/ibm-s390-linux/s390-tools/pull/158
Acked-by: Vineeth Vijayan <vneethv@linux.ibm.com>
Acked-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Signed-off-by: Steffen Maier <maier@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The existing code can already determine the required devices for the
actively running system, but this does not work for execution environments
in different (disaster recovery) sites.
Kdump likely does not notice when running in a different site and does not
re-generate the kdump initrd (because the kdump config itself does not
change).
The new code allows users to explicitly specify devices required for early
boot in initrd on different sites. Assuming this is a small number of
devices and could even overlap between the root-fs and the kdump case, do
not further distinguish those two sets of devices, but simply use the same
marker attribute "zdev:early=1" for both cases. With all this site
information available at the (initial) kdump initrd generation, the
resulting kdump initrd can work on any site without having to re-generate.
Complements commit 3c7adcc3c81d ("zdev: dracut: modifiy the
module-setup.sh").
Github-ID: https://github.com/ibm-s390-linux/s390-tools/pull/158
Reviewed-by: Vineeth Vijayan <vneethv@linux.ibm.com>
Acked-by: Vineeth Vijayan <vneethv@linux.ibm.com>
Acked-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Signed-off-by: Steffen Maier <maier@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The existing code can already determine the required devices for the
actively running system. In case users would have a need to configure
additional devices for early boot in kdump initrd, import those devices
marked with "zdev:early=1" for completeness. Assuming this is a small
number of devices and could even overlap between the root-fs and the kdump
case, do not further distinguish those two sets of devices.
Github-ID: https://github.com/ibm-s390-linux/s390-tools/pull/158
Reviewed-by: Vineeth Vijayan <vneethv@linux.ibm.com>
Acked-by: Vineeth Vijayan <vneethv@linux.ibm.com>
Acked-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Signed-off-by: Steffen Maier <maier@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Additional debugging output can be generated with e.g. dracut option
"--stdlog 5" (or short -L5). It shows the chzdev export result, the output
of chzdev imports, and an overview of the resulting persistent config
within the initrd.
On systems, which default to using dracut option "--quiet", you might need
an additional "--verbose" to counter "--quiet" so -L5 has effect.
Typically combined with "--debug" to get a shell trace from building an
initrd (Note: --debug does not increase the log levels).
Github-ID: https://github.com/ibm-s390-linux/s390-tools/pull/158
Reviewed-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Reviewed-by: Vineeth Vijayan <vneethv@linux.ibm.com>
Acked-by: Vineeth Vijayan <vneethv@linux.ibm.com>
Acked-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Signed-off-by: Steffen Maier <maier@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Otherwise, dracut skips modules that are "not hostonly", i.e. not used /
loaded on the system when running dracut to build an initrd.
Without the fix, zdev device auto configuration only works for device
types for which a device driver happened to be loaded when building an
initrd. Likewise for specifying rd.* boot options.
Hostonly mode is often the default in Linux distributions.
Make zdev device auto configuration work nonetheless without users
having to know about and tweak dracut modes for initrd generation.
On the typical sloppy hostonly mode, the code disables hostonly for
installing kernel modules. This covers building regular initrds, where zdev
device auto configuration should even work for device types, for which
device drivers were not loaded when an initrd was generated. This can
happen when new devices of new types are configured for a DPM logical
partition. Also, users could want to start using dracut cmdline options
rd.{dasd,zfcp,znet} for a device type that was not used when the initrd was
built.
The special strict hostonly mode is used by some kdump implementations. In
that case, hostonly remains in effect intentionally because only support
for the really required devices as determined by dracut module 95zdev-kdump
should be included in a kdump initrd due to the memory-constrained kdump
environment. Cf. commit 73c46a3056 ("zdev/dracut: fix kdump by only
activating required devices"), which also provides more references on
strict hostonly mode. Even for non-kdump cases, let strict hostonly mode be
effective here in 95zdev in case some future use case appears for this
special mode beyond kdump.
Github-ID: https://github.com/ibm-s390-linux/s390-tools/pull/158
Reviewed-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Acked-by: Vineeth Vijayan <vneethv@linux.ibm.com>
Acked-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Signed-off-by: Steffen Maier <maier@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The sscanf() format specifiers for signed and unsigned int mistakenly
used "%d"/"%u" prefix analogous to "%l" for long but those do not exist.
Fixes: 37348ef662 ("libutil: add util_file_read_i()/util_file_read_ui()")
Acked-by: Sven Schnelle <svens@linux.ibm.com>
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Niklas Schnelle <schnelle@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
The crate dependencies were a bit to slack. Due to the rust dependency
resolver's strategy of always selecting the latest version this never
lead to any issues.
This has no impact on the workspaces Cargo.lock
Reviewed-by: Marc Hartmayer <marc@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
With the last patch introducing the rust workspace the location of
Cargo.lock has changed. Therefore, remove all crate level lock-files and
add rust/Cargo.lock as the only lock-file.
Steps to reproduce:
```
cd rust
mv pvsecret/Cargo.lock .
cargo build
cargo update -p openssl
cargo update -p curl-sys
cargo update -p rustix
```
While at it update some dependencies to get fixes for security issues.
Reviewed-by: Marc Hartmayer <marc@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
A workspaces simplifies the build and packaging process significantly.
All build artifacts and binaries are now built in a single location
(e.g., rust/target/release/*), and a unified dependency resolution is
used. Hence one Cargo.lock for all crates at rust/Cargo.lock.
Closes: https://github.com/ibm-s390-linux/s390-tools/issues/156
Reviewed-by: Marc Hartmayer <marc@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Since mdevctl commit acf78c1ff6c9 it is now possible for the
get-attributes event to occur between a pre-define and post-define.
This is done in order to obtain the active attributes for the device
before writing them to the config file, and implies that the
get-attributes cannot re-obtain the file lock. For other cases
where mdevctl calls get-attributes, the file lock is not already
held and must be obtained by ap-check before reading attributes from
active devices.
To solve this, let's use the knowledge that mdevctl is a single-threaded
tool and add a test to detect this scenario. If the file lock is
already held by the parent during a get-attributes, don't attempt to
re-acquire it.
Reported-by: Boris Fiuczynski <fiuczy@linux.ibm.com>
Reviewed-by: Boris Fiuczynski <fiuczy@linux.ibm.com>
Signed-off-by: Matthew Rosato <mjrosato@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Add a check to the stage3b that the kernel cmdline is always
null-terminated. While at it, ensure the coding style is consistent.
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Make sure that the kernel command line used for the Secure Execution
boot image is always null-terminated. Before this change, users had to
ensure that the provided kernel cmdline was null-terminated, which was
error-prone. But since the default s390x Linux kernel command line is
set to `root=/dev/ram0 ro` the remaining reserved memory for the kernel
command line is zeroed out. Therefore, the problem only shows up if the
used kernel command line is shorter than the default kernel command
line.
Fixes: 65b9fc442c ("genprotimg: introduce new tool for the creation of PV images")
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Fix a valgrind finding. Fix an invalid read/write of one byte after the
actual struct to clear. Not fixing this may result in a illegal write or
memory corruption of the program. Fortunately, for the actual only user,
pvsecret this is not the case.
Fixes: c6f621d0 ("rust: Add library for pv tools")
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Pai collects data from per CPU ring buffers and stores them in the
memory mapped output file. When data is collected from many CPUs at
the same time, writing data to output file can be slow.
Improve this and allow the pai recording to run with higher
real time priority. This is the same approach as done by the perf tool.
Signed-off-by: Thomas Richter <tmricht@linux.ibm.com>
Acked-by: Sumanth Korikkar <sumanthk@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
in customer situation we found lsqeth listing devices like:
Device name : (unnamed net_device)
Device name : enc2000
Device name : enc3000
- the braket around the "unnamed" device is braking the function call and
leads to stop the dbginfo.sh script.
- this patch removes brakets > the functions call works and call of osaoat
will report an unknown device instead of braking the dbginfo.sh script
Reviewed-by: Mario Held <mario.held@de.ibm.com>
Signed-off-by: Joern Siglen <siglen@de.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Make the description of the --keep_volser option more generic and avoid
mentioning specific tooling.
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The zipl bootloaders are s390x specific, so only build them if the
`HOST_ARCH' is set to s390x.
While at it, rename `INC_FILES` to `EMBEDDED_BOOTLOADERS`. Also
introduce `EXTERNAL_BOOTLOADERS` variable and use it in the `install`
Makefile target.
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
When checking if a card or an APQN is online, not only check the 'online'
sysfs attribute, but also check the 'config' and 'chkstop' attribute.
Cards and APQNs in check-stopped or deconfigured state can still be reported
as online via the sysfs attribute, although they are not available to be
used for zkey.
In case the 2 additional sysfs attributes are not available in sysfs, then
don't fail, but rely on the 'online' attribute only.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Harald Freudenberger <freude@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Move the code responsible for installing stage3.bin to the
boot/Makefile. In addition, remove the stage3.bin from the Makefile
`all` target prerequisites in src/Makefile, as zipl can be built without
it. While at it, use $(INSTALL) instead of $(CP) for the bootloader
installation.
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Linux stable kernels can reach greater than 256 sublevels [1],
which can cause the cpi tooling to generate an invalid string
that gets passed to the firmware and causes unusual responses:
$ uname -r
5.4.255
$ cat /sys/firmware/cpi/system_level
0x04260000000504ff
--reboot--
$ uname -r
5.4.256
$ cat /sys/firmware/cpi/system_level
0x4260000000504100
The first sublevel field is defined as one byte, so ensure that
a value larger than that isn't included.
[1] https://lore.kernel.org/lkml/1612534196241236@kroah.com/
Signed-off-by: Eric Farman <farman@linux.ibm.com>
Reviewed-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Currently ZDEV_SITE_ID is derived with the help of an additional
udev-rule, 40-zdev-id.rules. The sole purpose of this rule is to
determine the ZDEV_SITE_ID environment value with the help of zdev_id
binary. This solution is minimal, but this has some unwanted side-
effects. The zdev_id logic get executed for all the events, even
those completely unrelated to zdev/or site, and imports the unneeded
envionment values to the udev-db.
Instead of having an additional rule file, add this logic as part of
the udev-rule of those devices which are configured with site-support.
The logic will then be available on all those rules with the
site-supported devices only.
Signed-off-by: Vineeth Vijayan <vneethv@linux.ibm.com>
Reviewed-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Introduce dev_site_configured macro,which can be used to find the
availability of site configurations for the device during udev rule
creation.
Signed-off-by: Vineeth Vijayan <vneethv@linux.ibm.com>
Reviewed-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Previously SITE_FALLBACK and other site-specific configuration support
macros were defined in device.h. Instead, move them to a relatively
smaller header file which is exclusive for site-related definitions.
This way, light-weight zdev_id also can use the same header file.
Reported-by: Steffen Maier<maier@linux.ibm.com>
Signed-off-by: Vineeth Vijayan <vneethv@linux.ibm.com>
Reviewed-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Behaviour of the qeth performance_stats sysfs attribute has changed
with kernel commit
b0abc4f5df76 ("s390/qeth: overhaul ethtool statistics")
that went into kernel v5.1.
Before the kernel commit
- collection of statistics was turned on and off by writing 1 or 0
- default after device activation was 0
- statistics were reset by writing 0
After the kernel commit:
- collection is always on
- attribute always reads 1
- statistics is reset by writing 1; writing 0 is a no-op
Problems of chzdev on new kernels:
chzdev cannot reset statistics ('performance_stats=1' does nothing).
'chzdev --export' always lists performance_stats.
'chzdev qeth --help-attribute performance_stats' reflects old behaviour.
This patch will do the following:
'chzdev qeth --help-attribute performance_stats' reflects new behaviour.
'chzdev --export' does not list performance_stats on new kernels.
'chzdev performance_stats=1' resets statistics on new kernels.
'chzdev performance_stats=0' still resets statistics on old kernels,
does nothing on new kernels.
Suggested-by: Steffen Maier <maier@linux.ibm.com>
Signed-off-by: Alexandra Winter <wintera@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
With many CPUs, such as triple digit counts, the by default many empty
sysfs directories are prohibitive to collect, especially if the number
of SCSI disk devices is also large, such as 4-digit counts.
Excluding them from being collected from sysfs saves hundreds times
thousands of archive entries and inodes on expansion.
Since the number device-mapper devices (multipath and other target types
such as LVM) is smaller and can include devices not backed by zfcp, keep
collecting
/sys/devices/virtual/block/dm-[0-9]*/mq/0/cpu[0-9]*/
Definitely keep collecting
/sys/kernel/debug/block/{sd,dm-}*/hctx0/cpu[0-9]*/
as it contains actual statistics files:
completed default_rq_list dispatched merged poll_rq_list read_rq_list
Signed-off-by: Steffen Maier <maier@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Replace static_assert() with STATIC_ASSERT macro from zt_common.h in order
to get rid of glibc dependencies in zipl/boot and comply with older
C standards.
Signed-off-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Suggested-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Set the maximum line length for branch description messages (`git branch
--edit-description`) to 72 characters.
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Update zgetdump man page with the information of compressed DASD dumps
support as well as new verbose 'zgetdump -i' output entries.
Signed-off-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Move DF_S390_DUMPER_SIZE_* constants from zdump/df_s390.h to
boot/loaders_layout.h since ccw dumper size depends on the zipl boot
loader layout (to keep it all in one place).
Rename DF_S390_DUMPER_SIZE_* constants to STAGE2_DUMPER_SIZE_*
Signed-off-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Reviewed-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Update verbose 'zgetdump -i' output with zlib info (internal zlib version
and zlib compression unit size).
The following new entriees are to be dispalyed:
Zlib version.......: 1
Zlib compression unit: 1 MB
Signed-off-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Reviewed-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Increase the auxiliary buffer size from 8 pages to 1 megabyte in order to
significantly increase compressed dump processing speed.
For uncompressed dumps, the effect is minor.
Signed-off-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Reviewed-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Update dfi_s390.c to support reading of compressed dump segments.
For this, introduce a callback function for reading memory chunks
associated with compressed dump segments. Apart from the segment location
on disk this function requires the entry_offset array from the dump segment
header in order to process each compressed entry separately, thus allowing
fast seek processing for zgetdump (no need to decompress a big dump segment
to extract a single piece of data).
In addition, split mem_chunks_add_ext() in several functions.
Signed-off-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Reviewed-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Since we are using the existing s390 extended dump format for compressed
dumps as well, set the version of the s390_ext dumper with compression
support and also dump header of the compressed dump to '2' (in order for
zgetdump to distinguish).
Signed-off-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Acked-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
- Adjust progress_print() calls to pass updated address after the set of
blocks has been written to disk.
- Currently total_dump_size value is updated only after the entire dump
segment is written to disk what leads to ambiguos Dump file size values
displayed by progress_print(). Change write_addr_range() to re-calculate
total_dump_size after each set of blocks has been written to disk thus
printing the correct value at the end of each log entry.
- Avoid final log entry duplication.
Signed-off-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Acked-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
With current implementation, printing progress while writing a compressed
data chunk might be very inaccurate. Thus, for compressed dump segments
skip progress_print() in write_addr_range() and call it after each
compressed memory chunk is written to disk. For that change
write_addr_range() to call progress_print() conditionally based on the new
print_progress parameter.
For non-compressed dump segments, call progress_print() from
write_addr_range() just as before.
Signed-off-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Acked-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Add --no-compress option to explicitly omit compression for single-volume
DASD dumper. Used primarily for test purposes.
Since only the lowest byte of mvdump_force field (struct
stage2dump_parm_tail) has been used, split it in two byte fields and use
one for the new no_compress attribute.
Update zipl help and zipl man page with the new parameter info.
Signed-off-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Reviewed-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Move struct stage2dump_parm_tail from stage2dump.h in to
include/dump/s390_dump.h
Pass the entire stage2dump_parm_tail structure to install_dump_* functions
instead of individual parameters.
Signed-off-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Reviewed-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Use a separate linker script eckd2dump_sv.lds for single volume dumper with
compression support.
The new dump tool with zlib compression support now has a size of 8 pages.
Since DASD stand alone dump requires a block size of 4K, we are not
affected by the stage 2 size limitations and can load the dumper to
stage 2 as before. We just need to move the HEAP section for ECKD dumper
in the layout definitions up to 0xb000 address. Also expand the stack by
unused 0x400 bytes.
Signed-off-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Reviewed-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Integrate zlib DFLTCC deflate compression to single volume dasd dumper
using the existing s390 extended dump format. Compression takes place
only if DFLTCC facility is available, otherwise dump is written
uncompressed as before.
First megabyte of memory is always written uncompressed and afterwards
this area is used for zlib workspace and for the compression output buffer.
The compression takes place in chunks of data of equal size (currently 1MB)
and the offset of each compressed chunk is stored in the dump segment
header. Since existing dump segment headers of 1 page size are used, we
need to limit the maximum size of compressed dump segments.
Chunk is written uncompressed in case of compression error or if
deflate compression only makes it bigger.
Thus every chunk of data is compressed separately and can be decompressed
independently. The main reason for that is to enable zgetdump to make fast
read seeks. Otherwise, zgetdump would need to decompress a big dump segment
in the worst case to extract a single piece of data.
Put compression related functions and structures to eckd2dump_zlib.c
and eckd2dump_zlib.h
Update zipl man page with the general information of zlib compression
support.
Signed-off-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Reviewed-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Move code from write_dump_segment() to write_addr_range() function to use
it later for writing compressed dump segments as well.
Verify that passed address range is a multiple of dasd block size.
Signed-off-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Reviewed-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Instead of using its own DF_S390_ constants and df_s390_ structs
in df_s390.h, include those from "dump/s390_dump.h" in order to minimize
duplicates. Adjust the code, where required, to use <stdint> types
instead of those defined in zt_common.h (e.g. use uint64_t instead of u64).
Adjust zdump include statements.
Signed-off-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Reviewed-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Move common dump related structures and constants to the global header
"dump/s390_dump.h" in order to get rid of many duplicates in zgetdump code.
Adjust zipl include statements and update Copyright statements.
Signed-off-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Reviewed-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Mainly zlib code remains unchanged for the sake of further maintenance.
Only minor adjustments of zlib deflate parts for build purposes:
- Make is_dfltcc_enabled() always return true
- Define CONFIG_ZLIB_DFLTCC in zlib.h to build zlib code with DFLTCC support
- Remove inflate related prototypes from zlib.h
- Adjust oesc_msg() to use snprintf from libc.h
- Remove BUG_ON from zlib_deflate_workspacesize()
- Replace bitrev32() with bi_reverse() from defutil.h
- Include <assert.h> to dfltcc.h header because of static_assert() calls
- Fix other include statements
- Adjust the text in zipl.h following Zlib License requirements
Signed-off-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Reviewed-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Add required zlib_deflate parts based on kernel zlib code in preparation
to DASD dumper DFLTCC deflate exploitation. Omit inflate modules in
order to minimize the dumper size (no decompression is required for the
dumping).
Adjust include statements leaving other code as is.
Signed-off-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Reviewed-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The AP queue states within a SE guest may have a so called asynchronous
error pending. When that's the case, the sysfs read of some AP queue
attributes fails with EIO. lszcrypt was not really prepared for this
and instead showed some incorrect output.
This patch fixes this oddity and now lszcrypt -c shows "error" in case
of ap_bound or ap_associate read errors and lszcrypt -V shows also
"error" if the BS bits could not get fetched.
Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Reviewed-by: Holger Dengler <dengler@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
`pkg-config` is mandatory for compiling s390-tools anyway therefore
let's replace `curl-config` and `xml2-config` calls whenever possible.
In addition, `pkg-config` has the advantage that cross-compilation is
supported. While at it, use `pkg-config` for libcrypto, json-c, and
libssl as well.
Reviewed-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The pkey kernel module supports two key blob formats for EP11 AES keys.
The first one (PKEY_TYPE_EP11) contains a 16 bytes header that overlays
the first 32 bytes of the key blob which usually contain the ID of the
EP11 session to which the key is bound. For zkey/dm-crypt that session
ID used to be all zeros. The second blob format (PKEY_TYPE_EP11_AES)
prepends the 16 bytes header to the blob, an thus does not overlay the
blob. This format can be used for key blobs that are session-bound, i.e.
have a non-zero session ID in the first 32 bytes.
Change zkey to generate EP11 keys using the new format (i.e. pkey type
PKEY_TYPE_EP11_AES), but existing key blobs using the old format can
still be used.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Joerg Schmidbauer <jschmidb@de.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Add lspai program and man page to display Processor Activity
Information (PAI) facility counter sets in the same way as
lscpumf for the CPU Measurement Facility counter sets.
Signed-off-by: Thomas Richter <tmricht@linux.ibm.com>
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
When calculating smt utiliziation field, subresults are capped to a
minimum value of zero to prevent wrap around while converting values
from signed to unsigned integers. The capping of subresults cause slight
inaccuracies therefore capping has been moved from intermediate steps
and done at the end.
Fixes: 0209c11bc1 ("hyptop: Add real SMT utilization field")
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Mete Durlu <meted@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
This complements v2.27.0 commit 73c46a3056 ("zdev/dracut: fix kdump by
only activating required devices"). On older distributions, the absence of
zdev_id can cause the following harmless error messages for each udev
event:
(spawn)[387]: failed to execute '/lib/s390-tools/zdev_id' \
'/lib/s390-tools/zdev_id': No such file or directory
Kdump is still functional nonetheless.
As of v2.24.0 commit 2e89722ef0 ("zdev: make site specific udev-rule for
ccw"), the invocations of chzdev within
zdev/dracut/95zdev-kdump/module-setup.sh generate
/etc/udev/rules.d/40-zdev-id.rules. And so even though zdev-kdump
intentionally does not install zdev_id and its previous singular user
zdev/udev/81-dpm.rules into the kdump initrd, because DPM device auto
configuration is not desired in the kdump environment, zdev_id meanwhile
has an additional functionality for site-support and the generated
40-zdev-id.rules calls /lib/s390-tools/zdev_id. By installing zdev_id into
the kdump initrd, 40-zdev-id.rules can work without error.
Fixes: 73c46a3056 ("zdev/dracut: fix kdump by only activating required devices")
Reviewed-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Reviewed-by: Vineeth Vijayan <vneethv@linux.ibm.com>
Signed-off-by: Steffen Maier <maier@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Other tools may need to process the configuration-unique id. Provide a
machine readable format by writing to a YAML file containing a `cuid`
entry and optionally an `add` entry. New CLI options `--format` and
`--output` are introduced for this. Currently, only the output format
`yaml` is supported.
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Refactor the code responsible for printing the verification result into
a new function named `fprint_verify_result`. This function will be
reused in the future and a new output format will be added. While at it,
increase the dump data width for the addition data. In addition, add a
prefix `0x` to the values in order to indicate that these are
hexadecimal values.
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Add `beautify` parameter to `pvattest_hexdump`. If the parameter is set
to true, a offset and whitespaces will be added for better readability.
With beautify set to FALSE:
14141414141414141414141414141414
With beautify set to TRUE:
0x0000 1414 1414 1414 1414 1414 1414 1414 1414
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The only user of `pvattest_hexdump` uses GBytes anyway, therefore let's
use GBytes as parameter type for `pvattest_hexdump`.
While at it, change the order of the parameters, constify `@width` and
handle the `@width == 0` case, which results in an hex-string without
any line breaks.
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
This fixes the following error (using GNU Make 4.3.0):
make[2]: command: Command not found
The reason for this is that `command` is a bash builtin. `command` is
used in `common.mak` for the `combdb` Makefile target.
While at it, remove the now useless `SHELL := /bin/bash` definitions in
the sub-Makefiles.
Fixes: 3d098416c6 ("common.mak: add `compdb` Makefile target")
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Replace local ifs_orig variables in different functions by a single
global IFS_ORI variable. This will reduce the risk of missing a local
saving and restore of the original IFS.
Reviewed-by: Michael Storzer <MSTORZER@de.ibm.com>
Signed-off-by: Joern Siglen <siglen@de.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Add a README.md to the rust subdirectory as a guideline for writing
s390-tools tools in Rust. This includes build integration, dependency
handling, and a few coding style hints. Rust related information
is also added to the main README.md.
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
[hoeppner@linux.ibm.com: Adapt details in README.md]
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Add `pvsecret` a tool to create, add, list, and delete Ultravisor
secrets. `pvsecret` uses the functionality from the pv-crate
to provide an command line tool to manage the secrets.
Add a new target group PV_TARGETS in rust/Makefile that additionally
requires openssl and libcurl as pv with the feature "request" uses
openssl and libcurl fearures.
Acked-by: Jan Höppner <hoeppner@linux.ibm.com>
Acked-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
[hoeppner@linux.ibm.com: Adapt man pages and help output]
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Add a `pv` crate that bundles useful functions and structs for creating
requests like `Attestation`, `Add Secret`, or even `Boot` a.k.a.
Secure Execution Image.
Note pv includes a subcrate `openssl_extensions` that (temporarily)
bundles some needed `openssl-rust` functionalities that are not
upstream yet. The plan is to remove these, when they become
upstream.
The pv crate has multiple features:
* request - code to generate requests
* uvsecret - code to access the UV-secret api
with request enabled also generating requests is
possible
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Acked-by: Jan Höppner <hoeppner@linux.ibm.com>
Acked-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The rust integration into the s390-tools build system consists of the
following steps:
- Add a subdirectory for the rust code.
- Add a Makefile that forwards rust builds to `cargo`.
- Add a `utils` crate for rust code in s390-tools.
- Add rust stuff for dotfiles:
- gitignore
- editorconfig
- codespellrc (while at it, add an ignore file)
With cargo the rust ecosystem has its own build system which also is
responsible to resolve rust dependencies via downloading the dependencies
from (default) crates.io and discover the source files. Therefore, the
Makefile just calls `cargo build` to forward the build to cargo.
If a rust crate does not require external dependencies, users might call
rustc directly.
A simple `make` will build all the rust targets as well (with --release
specified). Also `make install` will work as usual.
A few Makefile configuration variables are introduced for rust/Cargo:
- HAVE_CARGO (default 1) to toggle the build of rust code using cargo
- CARGOFLAGS to add custom cargo flags, e.g. --offline
- CARGO Cargo binary location defaults to
$(where cargo)
A new global make target is defined to get the current s390-tools
version:
$ make version
2.28.0
rust/Makefile also has the `print-rust-targets` target to print all rust
directories/crates that should be shipped/installed.
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Acked-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Command vmur issues a warning and aborts receiving a file from
the reader when either option -t or option -b is specified.
Example:
./vmur re -t 0x25,0x40 22 -H /tmp/xxx.txt
vmur: Conflicting options: -b and -t are mutually exclusive.
This is wrong as there is only one option specified.
The command should be aborted only when both flags are specified.
Fix this wrong behavior.
Fixes: d5f853c460 ("vmur: Remove option -c for dump file conversion")
Signed-off-by: Thomas Richter <tmricht@linux.ibm.com>
Reported-by: Benjamin Block <bblock@linux.ibm.com>
Reviewed-by: Benjamin Block <bblock@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
IBM Secure Execution guests may want to share additional secrets with
the Ultravisor in a secure manner. For this the concept of secret
requests and three new Ultravisor-calls were introduced.
Add support to genprotimg to prepare an Secure Execution image with the
requirement that add-secret requests must provide an extension secret
that matches the customer communication key (CCK) derived extension
secret.
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
In preparation for the next patch, add the parameter `NAME` to the
`MUT_EXCL_BOOL_FLAG` macro. This is useful for the case when the command
line flag has a different naming than the struct field.
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Refactor arguments related to the SE header control flags into own
struct with the name `PvControlFlagsArgs`. This change makes it easier
to extend the control flags arguments further, without touching the
signature of `pv_img_set_control_flags`. While at it, rename the struct
members `allow_...` to `enable_...`. This matches with the command line
option names.
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Introduce a function for setting the control flags. This makes it easier
to add more control flags in the future.
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Simplify the clean target since there are several redundant
things (*.bin) and files that aren't built at all (.xxx and .yyy).
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Only the bootloaders cannot be built as PIE and for that there are
already the -no-pie linker and compiler flags set by the boot/Makefile.
In addition, remove the `noexecstack` linker flag as it has no use
anymore (see commit 518bf7d7357 ("zipl/boot: use
`--no-warn-rwx-segments` linker flag")). It was originally introduced to
declare the ELF segment of the bootloader stack as non-executable. But
this ELF attribute had no effect for multiple reasons:
1. ALL_LDFLAGS is not used for the bootloaders
2. no ELF loader is used for the bootloaders that would take this ELF
attribute into account
This fixes the problem of overriding `-fPIE` set by the distributor.
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Set the maximum line length for commit messages to 72 characters, and
the indentation style for Makefiles to TAB.
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Currently, the debug information of the bootloader is discarded during
the raw binary creation. Change this by creating separate
<loader>.bin.debug files containing the debug information. The packager
will then be able to package these files as desired and the developer
can use them to debug the code.
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
When creating a tar archive, dump2tar incorrectly truncates the last
character of file paths that are exactly 100 characters long.
Paths up to 100 characters can be represented in the 100-byte name field
of a tar header entry, while longer paths are handled via an additional
tar data block. For 100-character paths, dump2tar determines that a
single header is sufficient, but then uses util_strlcpy() to store the
path into the name field. Since util_strlcpy() ensures nul-terminated
strings, the final character of the path is overwritten.
Fix this by using strncpy() instead of util_strlcpy(). Also mark the
affected name fields as "nonstring" to prevent associated compiler
warnings.
Reported-by: Steffen Maier <maier@linux.ibm.com>
Fixes: d85cf20981 ("dump2tar: Change SET_STR_FIELD to copy strings correctly")
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Commit 62ec87680a61 ("common.mak: improve cross compilation support")
added one extra whitespace during the changes of the toolchain command
definitions. The rest of the commands did not receive that change.
Since then the pretty print output looks like this:
...
CC zipl/boot/eckd1b.o
CXX ziomon/ziorep_collapser.o
SED zdev/src/lszdev_usage.c
CC hyptop/sd_cpu_items.o
MV zfcpdump/zfcpdump-initrd
LINK dasdfmt/dasdfmt
...
Add the additional whitespace to all other tools definitions used during
the build process.
Note: This doesn't fix the misaligned indentation for commands like
$(CC_FOR_BUILD) as those inherit the whitespace from the original
command, here $(CC).
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Fix the following warnings:
troff: zkey-ekmfweb.1:455: warning: macro 'APP=LINUX'' not defined
troff: zkey-ekmfweb.1:457: warning: macro 'encvol'.' not defined
A single quote (') at the beginning of ta line is interpreted as macro.
Fix this by starting the line with a dummy character (\&).
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
include the version of dbginfo.sh just used for data collection into our
tar file - so we have the used version in case of data collection problems.
Reviewed-by: Michael Storzer <MSTORZER@de.ibm.com>
Signed-off-by: Joern Siglen <siglen@de.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The `install` Makefile target of the top Makefile has `all` and
`install-recursive` as prerequisites. This leads to the two recursive
Makefile calls `make -C <SUBDIR> all` and `make -C <SUBDIR> install`.
The problem is these two targets try to build the same object files and
this leads to a race condition between these two targets in case of a
parallel build.
Fix this problem by removing the `all` prerequisite from the `install`
target, as it is not needed since all the `install` targets in the
sub-Makefiles already have proper prerequisites.
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
- Instead of always clearing the memory on reipl after the ccw dump has
been taken, check for the special OS_INFO_FLAG_REIPL_CLEAR flag in
os_info flags entry (indicates if sysfs 'clear' attribute has been set
on the panicked system) and trigger diag308 with a proper subcode.
- Get rid of superfluous ipib_info structure in stage2dump.c.
- Collect ipl_pbt constants in boot/ipl.h header.
Signed-off-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Acked-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Add DIAG308_LOAD_NORMAL diag308 subcode (used by FCP/NVMe normal ipl).
Rename other diag308_subcode and diag308_rc constants to be in sync with
kernel naming.
Signed-off-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Reviewed-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Introduce new os_info flags entry pointing to the field with bit flags.
The flag OS_INFO_FLAG_REIPL_CLEAR indicates that 'clear' sysfs attribute
has been set on a panicked system.
Signed-off-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
- Add os_info_check() function to verify os_info address, magic and
checksum.
- Add os_info_entry_is_valid() function to check whether requested entry
is present and valid.
Signed-off-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Acked-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
- Move zipl/boot/error.h to include/boot
- Adjust include statements in zipb/boot and genprotimg/boot
- Remove error.h from tunedasd/src/tunedasd.c as not needed
- Fix tunedasd/src/Makefile
Signed-off-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Make 'struct os_info *os_info' a const to ensure/indicate that no changes
are made to the given structure.
Signed-off-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
- Move struct os_info from kdump.h to the new header os_info.h.
- Place os_info.h to include/boot in order to use it in zgetdump
code as well.
- Replace hardcoded value of OS_INFO_CSUM_SIZE with a properly
calculated one.
- Rename os_info_check() of kdump.h to kdump_os_info_check().
Signed-off-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
While calculating real CPU SMT utilization, the SMT speedup factor needs
to be taken into account. Speedup factor depends on machine generations
and variations on workload the machine has. The users should be able to
determine the value according to their needs.
Signed-off-by: Mete Durlu <meted@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
By using core utilization, thread utilization, and management
utilization, it is possible to determine how much capacity is left or
how much the real CPU SMT utilization is on lpars. Extending hyptop
with this new field provides useful information.
For more info about real CPU SMT utilization:
https://linux.mainframe.blog/smt_utilization/
Briefly:
ur = real SMT util
uc = core util
ut = thread util
um = *management util
s = **speedup factor
ur = ((uc * per_core_thr_count) - ut) / s + (ut - uc) + um
* management utilization:
logical core time spent on hypervisor instead of logical partition.
** speedup factor:
metric used to calculate the SMT utilization on that logical core. This
value varies depending on the workload and the machine generation due
to hardware optimization level.
Signed-off-by: Mete Durlu <meted@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The compiler doesn't fully understand the code block that precedes the
usage of `site` in the condition and thus it thinks it could be
uninitialized. Silence the warning with an explicit initialization.
In function 'get_site_from_pers',
inlined from 'dev_table_get_value' at lszdev.c:1079:10:
lszdev.c:258:20: warning: 'site' may be used uninitialized [-Wmaybe-uninitialized]
258 | if (site == SITE_FALLBACK)
| ^
lszdev.c: In function 'dev_table_get_value':
lszdev.c:234:13: note: 'site' was declared here
234 | int site, i, num = 0;
| ^~~~
Closes: https://github.com/ibm-s390-linux/s390-tools/pull/152
Signed-off-by: Dan Horák <dan@danny.cz>
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The compiler doesn't fully understand the code block that precedes the
usage of title_off in the condition and thus it thinks it could be
uninitialized. Silence the warning with an explicit initialization.
CC zipl/src/scan.o
In function ‘sort_bls_fields’,
inlined from ‘scan_bls’ at scan.c:1502:8:
scan.c:874:12: warning: ‘title_off’ may be used uninitialized [-Wmaybe-uninitialized]
874 | if (title_off == 0)
| ^
scan.c: In function ‘scan_bls’:
scan.c:842:16: note: ‘title_off’ was declared here
842 | size_t title_off;
| ^~~~~~~~~
GitHub-ID: https://github.com/ibm-s390-linux/s390-tools/pull/152
Signed-off-by: Dan Horák <dan@danny.cz>
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The last commit accidentally deleted the TOOLS_DIR for non-s390x
architectures.
Fixes: de013d2f ("Makefile: add genprotimg to non-s390x architectures target list")
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
`genprotimg` can be useful on non-s390x architectures such as x86 or
arm. Therefore add `genprotimg` to the non-s390x target list.
How to build genprotimg on a non-s390x system (s390x cross-compiler
required)
$ # Build and install /usr/bin/genprotimg
$ make -C genprotimg
$ make install -C genprotimg
$ # Build and install the genprotimg bootloaders
$ make -C genprotimg/boot HOST_ARCH=s390x CROSS_COMPILE=s390x-linux-gnu-
$ make install -C genprotimg/boot HOST_ARCH=s390x CROSS_COMPILE=s390x-linux-gnu-
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
The genprotimg bootloaders are s390x specific, so only build them if the
`HOST_ARCH' is set to s390x.
On x86 one can cross-compile and install the bootloaders as follows:
$ make -C genprotimg/boot HOST_ARCH=s390x CROSS_COMPILE=s390x-linux-gnu-
$ make -C genprotimg/boot install HOST_ARCH=s390x CROSS_COMPILE=s390x-linux-gnu-
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
It's cleaner if the bootloader installation code is located in the
boot/Makefile, rather than the top Makefile.
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Under typical circumstances these sysfs attributes should be available
however if the device happens to be in the process of being removed
without the protection of the ap config file lock, this scenario can
be encountered. In this case, ignore the device and assume it is in
the process of being removed.
Reviewed-by: Tony Krowiak <akrowiak@linux.ibm.com>
Reviewed-by: Boris Fiuczynski <fiuczy@linux.ibm.com>
Signed-off-by: Matthew Rosato <mjrosato@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Since this callout reads sysfs values for the specified mdev, the
ap config file lock should be held to prevent other tools from
making changes to the ap configuration at the same time.
Reviewed-by: Jason J. Herne <jjherne@linux.ibm.com>
Reviewed-by: Tony Krowiak <akrowiak@linux.ibm.com>
Reviewed-by: Boris Fiuczynski <fiuczy@linux.ibm.com>
Signed-off-by: Matthew Rosato <mjrosato@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
`load_wait_psw` is defined in include/boot/s390.h but is implemented in
zipl/boot/libc.c. This results in a dangling definition for s390.h users
other than zipl, due to the missing implementation. Since the function
is only relevant for zipl, move the definition to the corresponding
header file zipl/boot/libc.h
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
include/boot/s390.h relies on s390 specific kernel headers. However,
some tools used this header for non-s390 code (outside of boot-loaders).
To solve this the PSW and PAGE_SIZE definitions are now in separate
header files. All includes for s390.h which are not in boot-loader code
are replaced with one of psw.h or page.h.
This fixes the compilation failure on ppc64le due to conflicting types
for `__vector128`.
Fixes: https://github.com/ibm-s390-linux/s390-tools/issues/151
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Use a minimal assembly snippet to check for linker flags. This has the
advantage that it will work even if only the cross-toolchain is
installed, but not, for example, stdlib.
Using the C snippet, the check runs in a similar error like this:
/usr/bin/s390x-linux-gnu-ld: cannot find crt1.o: No such file or directory
/usr/bin/s390x-linux-gnu-ld: cannot find crti.o: No such file or directory
/usr/bin/s390x-linux-gnu-ld: cannot find -lc: No such file or directory
/usr/bin/s390x-linux-gnu-ld: cannot find crtn.o: No such file or directory
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Using option --by-interface with a non-existent network interface name
results in an unexpected duplicate warning message:
$ lszdev --by-interface xx
Could not open directory /sys/class/net/xx: No such file or directory
Could not open directory /sys/class/net/xx: No such file or directory
lszdev: Could not determine device that provides xx (xx)
Fix this by checking for the existence of the associated /sys/class/net
directory before initiating the associated directory traversal.
Reviewed-by: Vineeth Vijayan <vneethv@linux.ibm.com>
Signed-off-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
zdev's --by-node option returns exit code 15 (EXIT_RUNTIME_ERROR) when
the specified device node cannot be found. This is inconsistent with
other selection options --by-path and --by-interface which both return
the more appropriate exit code 3 (EXIT_DEVICE_NOT_FOUND).
Fix this by changing --by-node to also return exit code 3 in case the
specified device node does not exist.
Reviewed-by: Vineeth Vijayan <vneethv@linux.ibm.com>
Signed-off-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
While changing the helper script to create the ngdump filesystem,
some lines were left in the script which now cause the zipl
installation to fail:
Run /lib/s390-tools/zipl_helper.prepare-ngdump /dev/disk/by-path/ccw-0.0.6a56-part1 0
Couldn't find disk by PARTUUID.
Error: Script could not determine dump parameters
Remove the superfluous lines to fix this.
Fixes: 41108c98aa ("zipl: move mkfs to ngdump prepare script")
Signed-off-by: Sven Schnelle <svens@linux.ibm.com>
Acked-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Do not fail to start the daemon if no crypto counters are supported, as
there is still a use case for the daemon to run, as the user can then
use the 'cpacfstats' tool to evaluate that no counter stats are
available. Previously, the user had to check the syslogs for the reason
why the daemon was not running and the cpacfstats command failed.
Before this change:
$ cpacfstats
cpacfstats: Can't access domain socket file '/run/cpacfstatsd_socket', errno=2 [No such file or directory]
cpacfstats: Maybe cpacfstatsd daemon is not running ???
cpacfstats: Can't connect to daemon
After this change:
$ cpacfstats
des counter: unsupported
aes counter: unsupported
sha counter: unsupported
rng counter: unsupported
ecc counter: unsupported
pai_user : unsupported
pai_kernel : unsupported
Also, it's no good practice to let systemd services fail, because
otherwise the system state will be shown as 'degraded':
$ systemctl status
* a46lp59
State: degraded
Jobs: 0 queued
Failed: 1 units
$ systemctl list-units --failed
UNIT LOAD ACTIVE SUB DESCRIPTION
* cpacfstatsd.service loaded failed failed CPACF statistics collection daemon process for Linux on System z
Reviewed-by: Holger Dengler <dengler@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Print the name of the section which specifes non-existing image
and/or ramdisk files.
It allows to quickly identify problems after using non-atomic tools
manipulating with bootloader settings.
Signed-off-by: Eduard Shishkin <edward6@linux.ibm.com>
Reviewed-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The udev-rules generated with the current version of chzdev command
is missing the configuration label, incase of auto configuration,
resulting in an ineffective configuration logic.
Add the missing configuration start label for autoconfig.
Fixes: 2e89722ef0 ("zdev: make site specific udev-rule for ccw")
Signed-off-by: Vineeth Vijayan <vneethv@linux.ibm.com>
Reviewed-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
During the boot, the ZDEV_SITE_ID is derived with the help
of loadparm and will be saved in ZDEV_SITE_ID_FILE, which
will be the used by the udev-rules.
ZDEV_SITE_ID_FILE creation can have a surface of symlink attack
as we are directly using the fopen and fprintf on it. To avoid
this, make sure that we are writing the ZDEV_SITE_ID to a temporary
file, which will then be renamed to ZDEV_SITE_ID_FILE, which will
remove all the existing symlinks associated with the target file.
Reported-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Vineeth Vijayan <vneethv@linux.ibm.com>
Reviewed-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
udev does not allow an empty value for keys when importing output
from an external program. Providing an empty value for any key
invokes a warning during the parsing. Currently, ZDEV_SITE_ID for
fallback sites are not assigned any value. Add an empty double
quotes as the value in case of failover sites.
This modification is tested on udevadm version 253 on fedora38.
Also verify that the ZDEV_SITE_ID is properly written, if not log
the error.
Fixes: c8ad5f57d0 ("zdev: modify zdev_id to read the site_id from loadparm")
Reported-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Vineeth Vijayan <vneethv@linux.ibm.com>
Reviewed-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Replace memory allocation functions malloc() and calloc()
by counterparts provided in libutil.a library. Also remove error
handling when no memory could be allocated as those functions do
not return.
Signed-off-by: Thomas Richter <tmricht@linux.ibm.com>
Acked-by: Sumanth Korikkar <sumanthk@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Make the listed changes which are needed to re-use some definitions
by the new zipl-debug(8) tool introduced by the next patch in the
series:
. Add definitions to boot_defs.h:
. a named union disk_bloclkptr (instead of the anonymous one);
. a named structure disk_program_table;
. Remove a 'typedef union disk_blockptr_t' from boot/stage2.h
(cleanup), use the named union in boot_defs.h instead;
. Move the definition of scsi_layout types and the function
get_scsi_layout() from install.c to install.h;
. Move definition of PROGRAM_TABLE_BLOCK_SIZE from bootmap.c to
bootmap.h
Signed-off-by: Eduard Shishkin <edward6@linux.ibm.com>
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
There are only two users of the `cleanup` label, so let's replace the
goto statements with the label code. This makes the code easier to read.
Especially since another label will be introduced in the next commit.
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Reviewed-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
This patch adds support for Secure Execution with AP pass-through
support for chzcrypt.
chzcrypt details:
* new command: --se-associate <secret-id> <queue device>
* new command: --se-bind <queue device>
* new command: --se-unbind <queue device>
Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
Reviewed-by: Holger Dengler <dengler@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
This patch adds support for Secure Execution with AP pass-through
support for lszcrypt.
lszcrypt details:
* extension to -b: list AP bus features
* extension to -c: now also valid for queue devices, shows
bind and assoicate state in SE environment;
shows MK states (only for current MKs).
* extension to -V: new column SESTAT within an SE guest, shows text
for the BS bits within an SE environment:
"usable", "bond", "avail", "unuse".
Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
Reviewed-by: Holger Dengler <dengler@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Autoquiesce is a mechanism that tells Linux to stop issuing I/Os to a
specific DASD after certain events.
Add support for configuring related DASD device attributes
that govern the following aspects of autoquiesce:
aq_mask - Configure which events lead to autoquiesce.
aq_requeue - Configure if autoquiesce will requeue all I/O to blocklayer.
aq_timeouts - Configure the number of timeouts before autoquiesce.
Signed-off-by: Stefan Haberland <sth@linux.ibm.com>
Reviewed-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
The 'clean' build targets can be specified alongside other targets,
which causes an immediate removal of build artifacts. Make 'clean'
targets mutually exclusive to avoid this issue and display an error if
'clean' is used in combination with other targets.
Reviewed-by: Benjamin Block <bblock@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
A subset of s390 tools can be useful on non-s390x architectures such as
x86 or arm. Limit the build targets for these architectures with
'pvattest' and 'libpv' as the first candidates.
A cross compilation on x86 for s390x will still build the entire package
provided that the HOST_ARCH variable is set properly:
$ make HOST_ARCH=s390x CROSS_COMPILE=s390x-linux-gnu-
Cross compilation on s390x for x86 will limit the build targets as
described:
$ make HOST_ARCH=x86_64 CROSS_COMPILE=x86_64-linux-gnu-
Co-developed-by: Jan Höppner <hoeppner@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Introduce `BUILD_ARCH` and `(CC|LINK|...|OBJDUMP)_FOR_BUILD` variables
in order to properly support the build of tools that generate code or
data during the build process. Replace existing variables `HOSTCC` with
`CC_FOR_BUILD` and `HOSTCFLAGS` `CFLAGS_FOR_BUILD`. The Makefile
variables for the `HOST_ARCH` are unchanged.
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
In addition, add the ability that a Makefile that includes `common.mak`
can specify the `HOST_ARCH`. Usage example:
$S390_TOOLS/mytool/Makefile:
``` Makefile
HOST_ARCH := s390x
include ../common.mak
```
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
`pkg-config` is a well established tool and all of our required
libraries do provide .pc files. Therefore let's declare `pkg-config` as
required and use it. In addition, remove now useless code.
Reviewed-by: Benjamin Block <bblock@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Since GCC12 several warnings like the following are produced in
zipl/boot compile targets:
CC zipl/boot/stage2.o
stage2.c: In function ‘start’:
stage2.c:99:24: warning: array subscript 0 is outside array bounds of ‘struct stage2_descr[0]’ [-Warray-bounds]
99 | stage2_descr = *(struct stage2_descr*)STAGE2_DESC;
This is the same issue as reported for the Kernel [1][2]. There is
currently no sane fix available, therefore simply disable the warning
for the zipl/boot/ targets.
[1] https://lore.kernel.org/lkml/yt9dzgkelelc.fsf@linux.ibm.com/
[2] https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99578
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
In certain storage setups the Release Allocated Space (RAS) command to
free up space on the storage server previously allocated for an ESE DASD
might not work. At the moment dasdfmt will error out if RAS is failing.
This however is not ideal for the default case when a user is expecting
dasdfmt to simply format the disk.
One workaround would be to specify --no-discard to disable RAS
completely. However, a sane default handling that tries to work every
time is more reasonable.
Change the default handling as follows: If an ESE is detected default to
QUICK mode and try RAS. If RAS fails, fall back to the FULL format mode
and display a warning accordingly.
If -M (--mode) QUICK is specified explicitly dasdfmt will still error
out on a failing RAS. A combination with --no-discard will still allow
for a QUICK format on an ESE DASD in that case, if desired.
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
`od` in contrast to `xxd` uses the system endianness for displying the
hexdump by default which leads to invalid results on little endian
systems.
Use the `--endian=big` option to fix the endianness problem.
Fixes: 3cc0b4cd ("pvattest/tools: remove xxd dependency from scripts")
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
The script uses bashisms (e.g. `local` keyword) therefore make sure that
bash is used by setting the shebang line to `#!/bin/bash`.
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
icastats is accounted by user and does cover root only today
adding the --all will collect stats for all users
Reported-by: Ingo Franzki <ifranzki@de.ibm.com>
Reviewed-by: Ingo Franzki <ifranzki@de.ibm.com>
Signed-off-by: Joern Siglen <siglen@de.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
For dasd devices, we need to enable the device before we can use it.
Add the required dasd device to the kernel commandline when installing
ngdump to a dasd device.
Signed-off-by: Sven Schnelle <svens@linux.ibm.com>
Acked-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
The current code first assembles the ngdump init ramdisk, and creates
the filesystem on the dump disk afterwards. ngdump uses uuids to mount
the dump device. Because the filesystem uuid is changing with the final
mkfs, ngdump has to use the partuuid of the device. This does work for
nvme, but not for dasds. Another problem is that dryrun likely wouldn't
work if there's no partition table on the dump device. To fix these
issues, move the mkfs to the ngdump helper script so we can use the
filesystem uuid. When --dryrun is specified the script passes /dev/null
as ngdump device to make mkinitramfs happy. As the initramdisk is never
used in this case, this shouldn't be a problem.
Signed-off-by: Sven Schnelle <svens@linux.ibm.com>
Acked-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
CCW and LD-IPL records cannot be used at the same time for dumps because
CCW dump uses the standalone dumper, while LD-IPL uses ngdump. The first
one writes data to the raw disk without any filesystem, while the second
one uses an ext filesystem. Therefore we need a way to tell zipl which
kind of dumper it should install, as both cannot be installed at the
same time. The device given is the same for both types, so we cannot use
this to decide which type to install. Therefore add a '--ldipl-dump' option
so the user can decide which type of dump to use.
Signed-off-by: Sven Schnelle <svens@linux.ibm.com>
Acked-by: Eduard Shishkin <edward6@linux.ibm.com>
Acked-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Add the following options to dumpconf so that LDIPL ECKD devices
can be configured for dumping:
br_chr: (optional) location of boot record
device: ccw device
bootprog: boot program selector
Signed-off-by: Sven Schnelle <svens@linux.ibm.com>
Acked-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
In order to allow installing only a list-directed ipl entry, remove
the last-table/number-of-tables logic which always required a legacy
program table. With the new code there's no longer a loop in
prepare_bootloader() which requires a certain start index or order
of tables.
Signed-off-by: Eduard Shishkin <edward6@linux.ibm.com>
Acked-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Instead of depending on array index to decide whether we
did already the preparation work for installing the bootloader,
add an explicit skip_prepare flag to struct install_set.
Signed-off-by: Sven Schnelle <svens@linux.ibm.com>
Acked-by: Eduard Shishkin <edward6@linux.ibm.com>
Acked-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
In preparation of decoupling the program table position from
the block pointer format, rename:
PROGRAM_TABLE_0 to LEGACY_BLKPTR_FORMAT_ID
PRAGRAM_TABLE_1 to BLKPTR_FORMAT_ID
Signed-off-by: Sven Schnelle <svens@linux.ibm.com>
Acked-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
To make the code easier to maintain and prepare for ECKD LD-IPL,
split up install_bootloader() into two functions: One which is used
for IPL, and one for dump partitions.
Signed-off-by: Sven Schnelle <svens@linux.ibm.com>
Acked-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
The relative subdirectory path of a build target is determined via a
separate shell command that issues 'cd' and 'pwd'. Spawning a separate
shell is very costly and can lead to extremely slow builds in some
circumstances.
Replace the shell command with the make built-in command 'realpath' to
accomplish the same result more efficiently.
Tested-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Related Valgrind output:
==1073934== 241,722,000 bytes in 30 blocks are definitely lost in loss record 2 of 2
==1073934== at 0x484417C: malloc (in /usr/libexec/valgrind/vgpreload_memcheck-s390x-linux.so)
==1073934== by 0x1006B8D: misc_malloc (misc.c:33)
==1073934== by 0x1006B8D: misc_read_file (misc.c:150)
==1073934== by 0x100DACD: check_common_ipl_data (job.c:774)
==1073934== by 0x100FE2F: check_job_ipl_data (job.c:827)
==1073934== by 0x100FE2F: check_job_menu_data (job.c:999)
==1073934== by 0x100FE2F: check_job_data (job.c:1139)
==1073934== by 0x100FE2F: job_get (job.c:2011)
==1073934== by 0x1006335: main (zipl.c:141)
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Acked-by: Eduard Shishkin <edward6@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Since SMT is being used by default on z systems, hyptop should show
thread utilization by default on both system and system list window.
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Mete Durlu <meted@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Valgrind finding:
==1083976== 19 bytes in 1 blocks are definitely lost in loss record 1 of 1
==1083976== at 0x484417C: malloc (in /usr/libexec/valgrind/vgpreload_memcheck-s390x-linux.so)
==1083976== by 0x48F3C97: __vasprintf_internal (vasprintf.c:71)
==1083976== by 0x1006861: vasprintf (stdio2.h:218)
==1083976== by 0x1006861: misc_asprintf (misc.c:49)
==1083976== by 0x100C7E1: scan_update_bls_path (scan.c:1874)
==1083976== by 0x100FF4B: get_job_from_config_file (job.c:1901)
==1083976== by 0x100FF4B: job_get (job.c:1997)
==1083976== by 0x1006335: main (zipl.c:141)
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Before commit 5fb6434548 ("zipl: add get_common_components() and
finalize_common_address_data()") the default kernel parmline was only
overwritten if a parmline was specified. After the commit it was always
overwritten, even if no parmline was specified. Let's change this
behavior back by adding a NULL-pointer check. For dump types this change
changes the behavior before commit 5fb6434548 ("zipl: add
get_common_components() and finalize_common_address_data()").
Fixes: 5fb6434548 ("zipl: add get_common_components() and finalize_common_address_data()")
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Linux kernel commits
a029a4eab39 ("s390/cpumf: Allow concurrent access for CPU Measurement Counter Facility")
453380318ed ("s390/cpumf: Allow multiple processes to access /dev/hwc")
removed this restriction. Both commits are included in linux 5.16.
Therefore remove the restriction in the man page.
Signed-off-by: Thomas Richter <tmricht@linux.ibm.com>
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
OpenSSL function i2d_ECDSA_SIG() returns a negative value in case of
an error, so check the returned length for <= zero to detect an error.
Reported-by: Holger Dengler <dengler@linux.ibm.com>
Reviewed-by: Holger Dengler <dengler@linux.ibm.com>
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The provider functions OSSL_FUNC_keymgmt_import_types() and
OSSL_FUNC_keymgmt_export_types() do not get the provider context passed.
However, the implementation of these functions in the secure key provider
need the provider context to pass the call to the default provider
and append some of its own types to the result.
Up to now, the provider context was obtained using a global variable
holding the secure key provider handle. This may not be save if multiple
instances of the provider exist.
Just recently OpenSSL added support for an extended form of these
functions, namely OSSL_FUNC_keymgmt_import_types_ex() and
OSSL_FUNC_keymgmt_export_types_ex(), that get the provider context passed
as argument. Make use of these new functions, if compiled against an
OpenSSL version that supports them. For older OpenSSL versions still use
the global variable as before.
See OpenSSL commit 5e3b84505e
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
If system configuration contains zfcp-attached SCSI devices of Peripheral
Device Type disk, but without block device, e.g. because the storage reports
Peripheral Qualifier 1 in INQUIRY, ziorep_config tool issue the
following type of errors during generation of .config file from .cfg
file:
$ ziorep_config -I -i test.cfg
Unpacking configuration ...Done.
Use of uninitialized value in subroutine entry at /usr/sbin/ziorep_config line 36.
Use of uninitialized value in subroutine entry at /usr/sbin/ziorep_config line 36.
Use of uninitialized value in subroutine entry at /usr/sbin/ziorep_config line 54.
Use of uninitialized value in subroutine entry at /usr/sbin/ziorep_config line 135.
...
Such errors can also be seen during printing of adapter, device and map
reports:
$ ziorep_config -ADM -i test.cfg
Unpacking configuration ...Done.
Use of uninitialized value in subroutine entry at /usr/sbin/ziorep_config line 36.
Use of uninitialized value in subroutine entry at /usr/sbin/ziorep_config line 36.
Use of uninitialized value in subroutine entry at /usr/sbin/ziorep_config line 54.
Use of uninitialized value in subroutine entry at /usr/sbin/ziorep_config line 135.
...
This is because ziorep_config reads block device parameters from
non-existent block device subdirectory. And therefore ziorep_config
leaves block device major:minor number column empty in .config file
instead of filling it with 0:0 preset value afterwards.
As a consequence, ziorep_traffic tool, which is using .config file to
get information about devices, reports the following error:
$ ziorep_traffic test
Extracting config data...done
ziorep_traffic: Could not parse line 1 - configuration file broken?
To fix this, skip reading the block device parameters for such
devices, and use the preset values that have been set before
instead.
Signed-off-by: Fedor Loshakov <loshakov@linux.ibm.com>
Suggested-by: Steffen Maier <maier@linux.ibm.com>
Reviewed-by: Benjamin Block <bblock@linux.ibm.com>
Reviewed-by: Steffen Maier <maier@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The value of "generic/dev" exists and can be retrieved directly under
the SCSI device directory, not under the disk block device subdirectory,
where the global variable $c_src points to after
$c_src = $devices{$hctl}{dev}; command.
So move the sg_mm retrieval before the block device parameters
retrieval.
Signed-off-by: Fedor Loshakov <loshakov@linux.ibm.com>
Suggested-by: Steffen Maier <maier@linux.ibm.com>
Reviewed-by: Benjamin Block <bblock@linux.ibm.com>
Reviewed-by: Steffen Maier <maier@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
For a slightly easier development loop add a pseudo compilation of the
zfcpdbf Perl script. This will run the Perl interpreter in syntax-check
mode:
-c causes Perl to check the syntax of the program and then exit
without executing it. Actually, it will execute any "BEGIN",
"UNITCHECK", or "CHECK" blocks and any "use" statements: these are
considered as occurring outside the execution of your program.
"INIT" and "END" blocks, however, will be skipped.
Additionally add the `-w` switch when the Make variable `W` is `1`. This
will print additional warnings about dubious constructs (according to
Perl).
So this pseudo compilation only happens whenever the script is changed
during development create a file `.zfcpdbf.ct` as a result so we can
describe the relationship and dependency in Make. This file can be ignored
otherwise.
Signed-off-by: Benjamin Block <bblock@linux.ibm.com>
Reviewed-by: Steffen Maier <maier@linux.ibm.com>
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
changes in opencryptoki setup do require some modifications:
- "pkcsconf -mlist" does no longer work in a combined format
- config files have changed
- ep11info was not yet collected
Signed-off-by: Joern Siglen <siglen@de.ibm.com>
Reviewed-by: Ingo Franzki <ifranzki@de.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
With the introduction of zdev for device configuration in v1.33.0,
it used a hardcoded "/" to refer to the root-fs.
Dracut has its own mechanism to find the root file system and to walk its
device dependencies.
Mkdumprd also has its own mechanism to interpret the kdump target
and invokes dracut so that dracut only considers arguments from mkdumprd
without any root-fs dracut would default to [--no-hostonly-default-device].
Use the dracut mechanism to walk device dependencies and individually
have chzdev treat each leaf-node in the dependency tree.
See also https://github.com/dracutdevs/dracut commit
83e0dc7a3dca ("Add for_each_host_dev_and_slaves for device only checking").
This enables the use of dracut options such as --add-device or
--mount used in turn by mkdumprd.
Reviewed-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Signed-off-by: Steffen Maier <maier@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The function show_devices_argv() iterates over all remaining
arguments. Each argument may specify a single device or a list of
sub-devices. Use a separate index for the inner sub-device loop. This
fixes a bug, that not all or wrong arguments are processed.
Also terminate the outer arguments loop based on the number of
remaining arguments.
Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
Reviewed-by: Harald Freudenberger <freude@linux.ibm.com>
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The tools lszcrypt provides filter options for card types. Use these
options not only for devices (cards), but also for sub-devices
(domains).
Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
Reviewed-by: Harald Freudenberger <freude@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The CEX8 card has in CCA mode a new capability 'stateless
hardware filtering support' which is now displayed as
'H' bit in the FUNCTIONS column and with the -c option.
Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The current code has different paths to construct the kernel parameters
depending on whether it's a dump kernel or a normal kernel. This would
require adding special handling to get_common_component(), because for
normal kernels the parmline is already set, contrary to dump kernels,
where the command line is constructed later.
To make the code simpler and fix a bug where the default command line no
longer works, move the dump command line processing to an earlier stage.
Also rename the old function to make the function name match what it is
actually doing.
Fixes: 5fb6434548 ("zipl: add get_common_components() and finalize_common_address_data()")
Signed-off-by: Sven Schnelle <svens@linux.ibm.com>
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
This avoids exporting explicit settings if it's the default anyway.
I.e. avoid the last line in the example below:
$ chzdev --export - --active --type --all
[active zfcp-lun 0.0.1941:0x500507630904d...:0x4055408f00000000]
scsi_dev/queue_depth=32
Suggested-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Reviewed-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Signed-off-by: Steffen Maier <maier@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Currently, each generated loader binary is linked into one data.o object
file which is then linked against boot.o. The data.o file is also used
to generate the data.h header file using nm, which will contain all
symbols required by zipl.
The linking process is somewhat depended on the directory, as the symbol
names are derived from the file names of the input files, which is the
default behavior of the linker. The file name in this case being the
entire path.
Examples for the current situation (starting from root dir in each case):
$ cd zipl/boot && make eckd0_cdl.bin
$ cc -no-pie -static -nostdlib -Wl,--relocatable -Wl,--format,binary -o data.o eckd0_cdl.bin
$ nm data.o
0000000000000018 D _binary_eckd0_cdl_bin_end
0000000000000018 A _binary_eckd0_cdl_bin_size
0000000000000000 D _binary_eckd0_cdl_bin_start
$ make -C zipl/boot eckd0_cdl.bin
$ cc -no-pie -static -nostdlib -Wl,--relocatable -Wl,--format,binary -o data.o zipl/boot/eckd0_cdl.bin
$ nm data.o
000000000000018 D _binary_zipl_boot_eckd0_cdl_bin_end
000000000000018 A _binary_zipl_boot_eckd0_cdl_bin_size
000000000000000 D _binary_zipl_boot_eckd0_cdl_bin_start
The example above shows that the entire path would end up in the symbol
name if specified that way.
To make this more robust, future proof, and get more control of the
resulting symbol names, use '.incbin' and some macros for embedding the
loader binary files. This also reduces the linker step and the
generation of the data.h header file.
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Co-developed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Use a linker script instead of a linker flags for the layout. While at
it, use common naming `_start` for entry. This change allows us to
simplify the Makefile by using the linker option `-T` for all
bootloaders.
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The stage3b loader memory layout must not be larger than 0x10000 bytes.
Let's check this in the linker script.
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
+ the input section names `.text.init` and `.text.start` aren't
ambiguous, therefore there is no reason so specify a file name
+ discard `.interp` section since no loader is used
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Instead of maintaining an include list, use an exclude list (if
neccessary). This simplifies the `objcopy` calls a lot, and it's
possible because `objcopy -O binary` only includes the memory dump of
the contents of the input object file. [1] This means that sections like
for debug information that do not occupy memory during the process
execution are discarded by design. [2]
In addition, if we do not want a particular ELF section, we can list it
in the discard section of the linker script.
[1] https://man7.org/linux/man-pages/man1/objcopy.1.html
[2] https://man7.org/linux/man-pages/man5/elf.5.html
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
This disables the following warning `ld: warning: stag3a.elf has a LOAD
segment with RWX permissions` for newer linker. This changes nothing in
functionality for the bootloaders, since only the binaries and not the
ELF files are actually used.
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Normally, `gcc` takes care of adding the `GNU_STACK` marking except for
assembly code. Therefore, let's add the marking manually. Discard the
`.note.GNU-stack` section in the linker script since it's just a
"message" from the compiler to the linker. This fixes the linker
warning:
ld: warning: entry.o: missing .note.GNU-stack section implies executable stack
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Use linker script for all bootloaders instead of having the load
addresses of the bootloaders hard-coded in the Makefile. This allows us
to simplify the Makefile and it fixes the dependency tracking for the
bootloaders *0.bin, *1.bin, and *1b.bin.
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
This allows the reuse of the macro in the next patch. In order to match
the naming scheme rename `STAGE1B_LOAD_ADDR` to `STAGE1B_LOAD_ADDRESS`.
Acked-by: Eduard Shishkin <edward6@linux.ibm.com>
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Instead of maintaining an include list, use an exclude list (if
neccessary). This simplifies the `objcopy` calls a lot, and it's
possible because `objcopy -O binary` only includes the memory dump of
the contents of the input object file. [1] This means that sections like
for debug information that do not occupy memory during the process
execution are discarded by design. [2]
In addition, if we do not want a particular ELF section, we can list it
in the discard section of the linker script.
[1] https://man7.org/linux/man-pages/man1/objcopy.1.html
[2] https://man7.org/linux/man-pages/man5/elf.5.html
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
This disables the following warning `ld: warning: stage3.exec has a LOAD
segment with RWX permissions` for newer linker. This changes nothing in
functionality for the zipl bootloaders, since only the binaries and not
the ELF files are actually used.
Acked-by: Eduard Shishkin <edward6@linux.ibm.com>
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Normally, `gcc` takes care of adding the `GNU_STACK` marking except for
assembly code. Therefore, let's add the marking manually. Discard the
`.note.GNU-stack` section in the linker script since it's just a
"message" from the compiler to the linker. This fixes the linker
warning:
ld: warning: entry.o: missing .note.GNU-stack section implies executable stack
Acked-by: Eduard Shishkin <edward6@linux.ibm.com>
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The ELF section `.eh_frame` is used for frame unwinding during, for
example, exception handling and the section `.interp` is used by the
program interpreter. [1] Since no frame unwinding nor a program
interpreter is used for the bootloaders we can discard these input
section.
The content of the (exec|bin) files don't change after this change.
[1] https://refspecs.linuxfoundation.org/LSB_1.2.0/gLSB/specialsections.html
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Add support to chreipl/lsreipl to show and reconfigure ipl parameters
for list-directed IPL from ECKD DASD.
Parameters accepted:
device - ccw device id
bootprog - Boot Prog Selector
loadparm - Load parameters
brchr - location of bootrecord in cylinder/head/record format.
clear - clear memory before loading
Signed-off-by: Sven Schnelle <svens@linux.ibm.com>
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
With parameter OSSL_ASYM_CIPHER_PARAM_IMPLICIT_REJECTION one can enable or
disable the implicit rejection mechanism for RSA PKCS#1 v1.5 decryption.
For the default provider, this is enabled by default.
We do not support implicit rejection so far, so disable it for the
default provider operation context when the key contains an RSA secure key,
and reject to set it to anything else then 0 (disabled).
See OpenSSL commit 5ab3ec1bb1
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Since OpenSSL 3.1 a new RSA-PSS salt length constant exists to select
the maximum possible salt length based on the RSA-PSS parameters and the
digest used: OSSL_PKEY_RSA_PSS_SALT_LEN_AUTO_DIGEST_MAX
This is the default salt length when no other salt length is set by
the caller.
In contrast to OSSL_PKEY_RSA_PSS_SALT_LEN_MAX, OSSL_PKEY_RSA_PSS_SALT_LEN_AUTO_DIGEST_MAX
also ensures that the resulting salt length is not larger than the used
digest size. The salt length calculated with OSSL_PKEY_RSA_PSS_SALT_LEN_MAX
may be larger than the digest size, dependent on the RSA-PSS parameters.
FIPS 186-4 section 5 "The RSA Digital Signature Algorithm", subsection
5.5 "PKCS #1" says: "For RSASSA-PSS […] the length (in bytes) of the
salt (sLen) shall satisfy 0 <= sLen <= hLen, where hLen is the length of
the hash function output block (in bytes)."
See OpenSSL commit 6c73ca4a2f
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
With parameter OSSL_SIGNATURE_PARAM_NONCE_TYPE one can choose to generate
a deterministic signature, i.e. using a deterministic nonce K.
We do not support that so far, so reject to set the nonce type to
anything other than 0 (random nonce K).
See OpenSSL commit f3090fc710
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Fix the improper order of resource releasing resulted in failed umount
Do umount after closing (not before)
Fixes: f7d2339 (zipl: List-Directed IPL from ECKD DASD)
Reported-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Tested-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Eduard Shishkin <edward6@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
The library libvmdump is written in C++ and uses exception handling
and class inheritance. The tools vmur and vmconnect are compiled using
the C++ compiler for linking with the libvmdump library.
With integration of vmdump file support into the zgetdump tool and
the removal of vmur vmdump file conversion support there is no need
anymore the vmconvert tool.
With removal of the tool vmconvert, the libvmdump library written in C++
has no more user and can be deleted.
Remove the vmconvert command from the zgetdump man page.
Remove the directories libvmdump and vmconvert and adjust the Makefile.
Signed-off-by: Thomas Richter <tmricht@linux.ibm.com>
Suggested-by: Jan Hoeppner <hoeppner@linux.ibm.com>
Reviewed-by: Jan Hoeppner <hoeppner@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Remove option -c for implicit dump file conversion from vmdump format
to lkcd format. If option -c is specified, an error message
is printed and the program terminates. A hint to the new conversion
tool zgetdump is shown. Option -c is not listed in the help text.
The man page is also updated to reflect this change.
With zgetdump tool now supporting vmdump file format there is no need to
convert a vmdump file while extracting it from the reader device.
Use commands
1. vmur rec <spool-id> VMDUMP_FILE
2. zgetdump VMDUMP_FILE ELF_FILE
to extract a vmdump file from the reader and convert it to elf format.
Note to Maintainer:
The rename of file vmur.cpp to vmur.c triggers the pre-commit
checking of git-format-clang. This checking fails. This is intended.
The patch shows the changes for this line item.
The pre-commit checking fails on many, many changes not touched
for changed by this patch.
The pre-commit failure should be fixed with a follow-on patch.
Suggested-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Thomas Richter <tmricht@linux.ibm.com>
Acked-by: Jan Hoeppner <hoeppner@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Add support for vmdump 64big format to the zgetdump utility.
The result is an elf file suitable for tool crash.
This patch adds file dfi_vmdump.c to handle conversion from
z/VM vmdump format to the internal memory representation of this tool.
Therefore both output formats elf and s390 are supported as target
of the conversion.
The vmdump file formats 32bit and 64bit are not supported anymore.
They have been obsolete since CP version 5.1 (end of service since
30-Sep-2009).
Vector register set is not part of a vmdump file and can not be
displayed.
Output before:
# zgetdump ~/vmdump-0383
zgetdump: No valid dump found on "/root/vmdump-0383"
#
Output after:
# ./zgetdump ~/vmdump-0383 ~/vmdump-0383.elf
Format Info:
Source: vmdump
Target: elf
Copying dump:
00000000 / 00000379 MB
00000379 / 00000379 MB
Success: Dump has been copied
# file ~/vmdump-0383.elf
/root/vmdump-0383.elf: ELF 64-bit MSB core file, IBM S/390, version 1 \
.... (SYSV), SVR4-style, from 'vmlinux'
#
# ./zgetdump -i ~/vmdump-0383
General dump info:
Dump format........: vmdump
Version............: 2
UTS node name......: s8360046.lnxne.boe
UTS kernel release.: 6.1.0-rc2-d-perf+
UTS kernel version.: #1 SMP Fri Oct 28 09:42:13 CEST 2022
System arch........: s390x (64 bit)
CPU count (online).: 2
CPU count (real)...: 2
Dump memory range..: 2048 MB
Memory map:
0000000000000000 - 000000007fffffff (2048 MB)
#
Signed-off-by: Thomas Richter <tmricht@linux.ibm.com>
Reviewed-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
The `.check_dep_zgetdump` file is used to cache the result of the
dependency checks and should not be used as input for linking or
anything else. Let's add it as dependency for the objects file. This
shouldn't cause any problems since the Makefile rule for object files is
defined in `common.mak` as follows:
%.o: %.c
$(CC) $(ALL_CPPFLAGS) $(ALL_CFLAGS) -c $< -o $@
Fixes: https://github.com/ibm-s390-linux/s390-tools/issues/147
Fixes: 8d8d5e9746 ("zdump: Fix Makefile dependencies")
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Reviewed-by: Jan Hoeppner <hoeppner@linux.ibm.com>
Signed-off-by: Jan Hoeppner <hoeppner@linux.ibm.com>
Enforce that the first glib.h include is done via glib-helper.h for libpv
so that glib version checks are in place.
Change zdump and pvattest such that they never include glibstuff before
libpv/glib-helper.h
Reviewed-by: Jan Hoeppner <hoeppner@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Since coreutils v9.1 commit 8f31074cb ("chown: warn about USER.GROUP")
chown utility now warns about using of wrong separator for USER and
GROUP options. This leads to warnings during intall step in ziomon:
$ make install
INSTALL ziomon
SED ziomon/install
chown: warning: '.' should be ':': ‘root.root’
SED ziomon/install
chown: warning: '.' should be ':': ‘root.root’
SED ziomon/install
chown: warning: '.' should be ':': ‘root.root’
To fix those warnings use ':' as separator instead of '.'. With this
patch applied those warnings are no longer present.
Signed-off-by: Fedor Loshakov <loshakov@linux.ibm.com>
Reviewed-by: Steffen Maier <maier@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
As on space problems the packing may fail, incomplete tgz are send.
Today no evidence for this is in dbginfo.log, packed upfront into the tgz.
This update helps to identify space related corruption of tgz files.
Reviewed-by: Mario Held <mario.held@de.ibm.com>
Signed-off-by: Joern Siglen <siglen@de.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
When the kernel is build with CONFIG_NVME_MULTIPATH enabled and an NVMe
where the driver exposes its controller separately is used, chreipl node
on a mount point of the NVMe fails. The failure occurs because chreipl
tries to get the function_id from the NVMe's nvmeXnY block device via
the path '/sys/block/nvmeXnY/device/device/function_id' which does not
exist.
The underlying problem is that with NVMe multipath support the PCI
function is not associated directly with a particular NVMe namespace but
instead with the entire NVMe device which may host multiple NVMe
namespaces. The correct way to get from the block device to the
underlying PCI device and its function ID is then to extract the device
name i.e. the 'nvmeX' part from 'nvmeXnY' and use that to get the
function ID via '/sys/class/nvme/nvme<X>/device/function_id'.
Fixes: 0472b5ea5c ("ipl-tools: Add nvme device support to lsreipl/chreipl")
Reviewed-by: Gerald Schaefer <gerald.schaefer@linux.ibm.com>
Signed-off-by: Niklas Schnelle <schnelle@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
xxd has vim-common as a dependency. We can avoid that by using od
instead which is from coreutils.
While at it, add the require_command function from the
pvattest-info script to the pvextract-hdr script and use it.
Suggested-by: Christian Borntraeger <borntraeger@linux.ibm.com>
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Fix issue in the lszdev command where column names if using the --pairs
command line switch can contain characters that are not allowed to be
used as variable names in a shell environment.
Replace bad characters in column names by an underscore if the --shell
command line switch is specified along with the --pairs switch.
The additional --shell switch mimics what is already available in the
lsblk command and thus it shall be used along with the --pairs switch.
Signed-off-by: Daniel S. Haischt <modean@linux.ibm.com>
Reviewed-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
The proc_sum_t struct is defined with the packed attribute and
produces the following compile warning:
mon_procd.c: In function ‘read_cpu’:
mon_procd.c:351:27: warning: taking address of packed member of ‘struct proc_sum_t’ may result in an unaligned pointer value [-Waddress-of-packed-member]
351 | cal_cpu(&cpudata, &proc_sum.cpu);
| ^~~~~~~~~~~~~
Silence the warning with -Wno-address-of-packed-member compile flag
since the struct is required to be as is.
Reviewed-by: Gerald Schaefer <gerald.schaefer@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
The struct scsi_dump_sb is defined with the __packed attribute and
produces the following compile warning in zfcpdump:
zfcpdump_part.c: In function ‘csum_update’:
zfcpdump_part.c:125:41: warning: taking address of packed member of ‘struct scsi_dump_sb’ may result in an unaligned pointer value [-Waddress-of-packed-member]
125 | dump_sb.csum_size, &dump_sb.csum)) {
| ^~~~~~~~~~~~~
However, all members are of the same size and the __packed attribute is
unnecessary. Remove the attribute to get rid of the warning.
Add assertion to ensure correct size of the struct during compile time.
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
The 'unistd.h' header was missing. Under some circumstances the
-D_GNU_SOURCE gcc flag does not trigger including that file.
Therefore, explicitly include this file here.
Fixes: e1aec24e84 ("libutil: introduce util_lockfile")
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Reviewed-by: Jan Hoeppner <hoeppner@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
mdevctl has been updated to use /usr/lib/mdevctl/scripts.d/callouts/
instead of /etc/mdevctl.d/scripts.d/callouts/. The /etc location
is considered deprecated, meaning mdevctl will also look at that
location for now but might eventually stop looking in /etc for
callout scripts.
Based on that, update the installation location for the ap-check
callout. However, because older versions of mdevctl will still
only look in /etc, let's also put a wrapper script in /etc for now
to provide backward compatibility, and plan to remove it at a
later time.
Link: df6bb57429
Fixes: https://github.com/ibm-s390-linux/s390-tools/issues/139
Signed-off-by: Matthew Rosato <mjrosato@linux.ibm.com>
Reviewed-by: Jan Hoeppner <hoeppner@linux.ibm.com>
Reviewed-by: Boris Fiuczynski <fiuczy@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Commit ae7217806b ("common.mak: remove `LINK` and `LINKXX`") changed
the LINK and LINKXX definition to ensure that the same compiler is used
for compilation and linking when specified with CC= (or CXX=
respectively) on the commandline.
However, the commit also removed the pretty print for both commands. Add
the pretty print back in and use the already defined $(CC) and $(CXX)
variables to preserve the original change.
Fixes: ae7217806b ("common.mak: remove `LINK` and `LINKXX`")
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Check the dump provided sizes for reasonableness. This avoids that a
corrupted dump leads to allocation of large buffers on the heap.
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Verify that the size is large enough before doing the mmap. Otherwise
this can result in a SIGBUS signal if there is an attempt to access a
page that lies beyond the end of the mapped file (see `man 2 mmap`).
Fixes: 8fa1b5a00b ("zdump: dfi: add support to read Protected Virtualization dumps")
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Corrupted dumps might have invalid page states. Therefore, let's convert
the assertions into errors.
Fixes: 8fa1b5a00b ("zdump: dfi: add support to read Protected Virtualization dumps")
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Make zipl tool prepare ECKD DASD for booting by different IPL
programs (with the same boot record installed).
Besides standard CCW-type IPL, user gets an ability to trigger
(with the same boot record installed!) List-Directed IPL. This
allows to use the feature of secure boot from ECKD DASD (which
is not available for CCW-type IPL).
When using the old boot interfaces, the usual CCW-type IPL is
triggered for DASD. Also for compatibility reasons zipl(8) tool
is modified to create and install one, or two "similar" program
tables per boot partition, depending on job and disk type. The
"similar" program tables differ only in block pointers format.
The old IPL programs (CCW-type IPL) use program table based on the
old format.
All program tables are packed to the same bootmap file. Their
order and logical offsets in the file are not significant (not
used by anyone).
The picture below shows which program table is used for IPL of
specified type from disk of specified type. Here "0" and "1" are
identifiers of program tables based on the old and new block
pointers format respectively. E.g. program table "0" is used for
CCW-type IPL from ECKD DASD. LD-IPL from DASD FBA is unsupported
(respectively, only one program table "0" is used), etc.
CCW-IPL LD-IPL
SCSI X 0
DASD FBA 0 X
ECKD DASD LDL 0 X
ECKD DASD CDL 0 1
Signed-off-by: Eduard Shishkin <edward6@linux.ibm.com>
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Add an option to tunedasd to trigger a copy pair swap using the appropriate
ioctl for DASD devices.
-s, --copy-pair-swap COPY_PAIR
This command requires a comma separated pair of primary,secondary to be
specified. In case of success the old secondary will become the new primary
device and the old primary will become a secondary device.
Example:
tunedasd /dev/dasda -s 0.0.9700,0.0.9740
This will set the old secondary device 0.0.9740 as the new primary.
The old primary device 0.0.9700 will automatically become a secondary
device.
Signed-off-by: Stefan Haberland <sth@linux.ibm.com>
Reviewed-by: Jan Hoeppner <hoeppner@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
In case of an error the ioctl macro only returns errno to the calling
function.
This misses positive returncodes from ioctls.
Change the macro to also return positive return codes.
Signed-off-by: Stefan Haberland <sth@linux.ibm.com>
Reviewed-by: Jan Hoeppner <hoeppner@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The DASD device driver has a new attribute copy_pair to make storage
server copy pairs known to the driver.
Add this attribute to zdev.
Usage example:
Add two copy pairs 1000,2000 and 1000,3000 to a DASD device 1000
$ chzdev dasd 1000 copy_pairs=1000,2000 copy_pairs=1000,3000
or
$ chzdev dasd 1000 copy_pairs="1000,2000 1000,3000"
To add a third copy pair later on:
$ chzdev dasd 1000 copy_pairs=1000,4000
To remove all copy pairs from the device 1000:
$ chzdev dasd 1000 -r copy_pairs
Signed-off-by: Stefan Haberland <sth@linux.ibm.com>
Reviewed-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Add an option -P|--copy-pairs to show all DASD devices with copy
relations set up in the system and their roles.
The output looks like:
# ./s390-tools/zconf/lsdasd -h
[...]
-P|--copy-pairs
Print information about copy pairs.
# ./s390-tools/zconf/lsdasd -P
Bus-ID Role Name Paired devices
================================================================================
0.0.9700 primary dasdd 0.0.9740,0.0.9743,0.0.9744,0.0.9745
0.0.9740 secondary 0.0.9700
0.0.9701 primary dasdf 0.0.9741
0.0.9741 secondary 0.0.9701
0.0.9702 primary dasdh 0.0.9742
0.0.9742 secondary 0.0.9702
Signed-off-by: Stefan Haberland <sth@linux.ibm.com>
Reviewed-by: Jan Hoeppner <hoeppner@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Adds util_lockfile_example.c, which can be used to sample
util_lockfile support.
To acquire a lock using a parent PID (e.g. your shell instance):
util_lockfile_exmample -f <path> -l <retries>
To release the lock using the parent PID:
util_lockfile_example -f <path> -r
To acquire the lock, sleep briefly, and then release the lock
using the PID of the util_lockfile_example process:
util_lockfile_example -f <path> -L <retries>
In each example, the <path> is the location of the desired lockfile
and <retries> is the number of times to retry acquiring the lock
if it fails.
GitHub-ID: https://github.com/ibm-s390-linux/s390-tools/issues/142
Signed-off-by: Matthew Rosato <mjrosato@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Implement simple file-locking routines that use process PIDs for stale
lock detection. The implementation is meant to be a simplified subset of
what liblockfile was previously being used for by libap, allowing the
external dependency to be removed.
This initial implementation provides a series of functions that allow for
creating/release file locks using either the current process PID or the
PID of the current process parent. When creating a file lock, first a
temporary file is created and the appropriate PID (either this process
PID or the parent process PID) is placed in the file to specify the owner
of the lock. Then an attempt is made to link that file to the desired
file location; if this succeeds, the lock is now held on behalf of the
specified PID. If it fails, this implies the file already exists
(meaning the lock is already held). In this case, stale lock detection
is performed by reading the PID from the file and ensuring that the
associated process still exists -- if it does not, then the lock is
presumed stale and destroyed. If the process still exists, then either
the lock request fails or the caller will sleep and retry, depending on
an optional retry setting.
A lock remains valid until either 1) it is released via the corresponding
util_lockfile function, which will delete the corresponding file 2) the
associated PID no longer exists, which leaves the file in-place but will
cause it to be destroyed the next time a different process attempts to
lock that file or 3) the file is directly removed (e.g. rm).
A typical usecase for such support would be to provide a means for
multiple invocations of the same (or different) tools to ensure that they
do not access the same shared resource simultaneously. For example,
ap-check, chzdev and lszdev all have a need to view and/or modify the AP
and vfio-ap configuration files; util_lockfile can be used to ensure that
only one instance of any of these utilities do that at a time by ensuring
they all use the same lockfile.
Additionally, providing the ability to specify the parent PID rather than
the current PID allows for a general purpose tool (like mdevctl) to
invoke a sub-program (ap-check) to acquire and release a lockfile as
necssary while allowing stale lock detection to be controlled by that
parent PID, allowing the lock to remain held over multiple sub-program
invocations.
Note that this implementation is sufficient for our current usage (e.g.
lockfiles placed in tmpfs) but does not take into consideration things
like NFS, which a more complete lockfile solution like liblockfile does.
GitHub-ID: https://github.com/ibm-s390-linux/s390-tools/issues/142
Suggested-by: Luca BRUNO <luca.bruno@coreos.com>
Signed-off-by: Matthew Rosato <mjrosato@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Set up the secure_boot_supported global variable at the
function bootmap_create() instead of bootmap_create_device()
to make sure that the secure boot status is checked for all
relevant jobs.
Fixes: 7b369318dd ("zipl: check for secure boot once")
Signed-off-by: Eduard Shishkin <edward6@linux.ibm.com>
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Sometimes dumping a virtual machine from the outside is the only way to
get the data that is needed. This can be the case if a dumping mechanism
like kdump hasn't been configured or data needs to be fetched at a
specific point. Dumping a protected guest from the outside without help
from FW/HW doesn't yield sufficient data to be useful. Hence we have
introduced Protected Virtualization (PV) dump support - also named
confidential dump support.
The confidential dump support works by integrating the firmware into the
dump process. New Ultravisor calls (UVC) are used to initiate the dump
process, dump CPU data, dump memory state and lastly complete the dump
process. The guest's data is fully encrypted and can only be decrypted
by the entity that owns the customer communication key (CCK) for the
dumped guest. The output format is very similar the normal s390 vmcore
ELF format, it's only enriched by new sections where the returned data
from the UVC "Complete Configuration Dump" and the UVC "Dump
Configuration Storage State" is stored. The encrypted CPU data is stored
in a new note type `NT_S390_PV_CPU_DATA`. The old note types do still
exists but without any confidential data stored. The memory data is
stored in the LOAD segment as usual but for PV dumps it's fully AES-XTS
encrypted.
This commit adds support for reading/decrypting PV guest dumps to
zgetdump by introducing a new DFI input module (`dfi_pv_elf.c`). For
specifying the customer communication key a new command line option
`--key` is added.
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The functionalities of libpv are used in the next patch. Libpv itself
requires glib2 and libcrypto.
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Consolidate error reporting to make sure that error messages are used
consistently. In addition, don't call `zg_exit()` directly, but instead
return the value 1 in `main()`.
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Acked-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Prevent double free/close that happens in get_multipath_status()
when the output of "dmsetup status XXX" is empty
Fixes: 599b141 ("zipl: Rewrite helper script in C")
Signed-off-by: Eduard Shishkin <edward6@linux.ibm.com>
Reviewed-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Adapt the wrappers `zg_alloc`, `zg_realloc` and `zg_ioctl` to match the
signatures used by `calloc`, `realloc` and `ioctl`.
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
lshwc displays counter values extracted from the /dev/hwctr device.
The counter values are retrieved using a loop and incremented instead
of just displayed on output.
This leads to the situation where a counter is incremented in large
numbers while the counter triggering program is active. When this
program terminates, the counter should not increase but remain steady.
This is not the case as this example shows:
# lshwc -i 2 -l90 -a :a | fgrep Total | \
awk -F ',' '{print $2 "," $152 "," $157}'
Report time and values of DFLT_ACCESS and DFLT_CC counters
sleep 10
# DFLTCC=1 python3 -c "import zlib; zlib.compress(b'A'*6000000000);
Increment counter DFLT_ACCESS and DFLT_CC, runs about 45 seconds
Output before:
15:24:20,0,0
15:24:22,0,0
15:24:24,0,0
15:24:26,0,0
15:24:28,0,0
15:24:30,0,0
15:24:32,2067027,592996481 <--- python3 program start
15:24:34,6953101,2039012580
15:24:36,14494585,4264340060
15:24:38,24759568,7346128396
....
15:24:56,232929262,70526362509
15:24:58,269037963,81464038124
15:25:00,307757248,93171809261
15:25:02,348900718,105620730492
15:25:04,392646075,118841031269 <--- python3 program stop
15:25:06,438956016,132853968029 <-- Value column two increased by 49148217
15:25:08,488104233,147709011658 <-- Similar high increase
The reason is that lshwc takes the last read counter value and keeps
adding it to the total count, even if there zero delta to the previous
read value. Fix this by clearing the total count value between ioctl()
read operations.
Output after:
15:39:26,0,0
15:39:28,0,0
15:39:30,0,0
15:39:32,0,0
15:39:34,0,0
15:39:36,1367250,380721127 <--- python3 program start
15:39:38,4104791,1108181711
15:39:40,6740994,1858843730
15:39:42,9277545,2646351211
15:39:44,11895180,3444375804
....
15:40:16,54060774,16315924126
15:40:18,57830349,17513712210
15:40:20,61628170,18690791102
15:40:22,65410470,19864086006
15:40:24,69070765,21028646754 <--- python3 program stop
15:40:26,70429758,21472772340 <-- No increase of value in column two
15:40:28,70429758,21472772340
15:40:30,70429758,21472772340
15:40:32,70429758,21472772340
15:40:34,70429758,21472772340
15:40:36,70429758,21472772340
15:40:38,70429758,21472772340
Fixes: 27a562da0a ("cpumf/lshwc: Program to extract complete counter sets")
Reported-by: Axel Busch <Axel.Busch@ibm.com>
Signed-off-by: Thomas Richter <tmricht@linux.ibm.com>
Acked-by: Sumanth Korikkar <sumanthk@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
pai dumps core when invoked with summary flag -S and
certain painnpa.XXXXX data files:
# ~/s390-tools/cpumf/pai -r -S
Segmentation fault (core dumped)
#
Fix this and check the existence of event raw data before
reading it. This avoid accessing NULL pointer trying to read raw
data when no counter values have been appended as raw data by the
kernel.
Fixes: dc73c77d73 ("cpumf/pai: Omit detailed event information when summary flag selected")
Signed-off-by: Thomas Richter <tmricht@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Export and import the configurations with zdev:early on the
site-specific configurations as well. Filter the site-specific
configurations by attribute "zdev:early" and import the output
to the corresponding sites.
Note that --site parameter does not work with the device type.
Reviewed-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Signed-off-by: Vineeth Vijayan <vneethv@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Add export and import support for site-specific settings. For each
site-specific configuration, a new site-block will be generated as
below. The same format can be interpreted by the import function and use
the values on the device's site-specific configuration.
Typical example of a site-block in the export file:
[site3 dasd-fba 0.0.f001]
online=1
cmb_enable=0
Reviewed-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Signed-off-by: Vineeth Vijayan <vneethv@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Introduce --deconfigure-all feature, which will remove all available
settings from the mentioned device. A typical device can have 10
different site-specific settings, active settings, persistent
settings and sometimes auto-configured settings configured in it.
--deconfigure-all can be used to remove all of them with a single
command.
usage: chzdev -D <device-id>
chzdev --deconfigure-all <device-id>
Reviewed-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Signed-off-by: Vineeth Vijayan <vneethv@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
lszdev must be modified to share the site-specific configuration
information from the persistent settings. The persistent configuration
array will be read and tabularized based on the site-id input from the
user.
This patch also accommodates the site specific information in the
lszdev --info command. New information about the site-ids are integrated
with the command. For example,
DEVICE dasd-eckd 0.0.f001
Names : -
Modules : dasd_eckd_mod dasd_mod
Online : no
Exists : yes
Persistent : yes
Sites : 1,2
ATTRIBUTE ACTIVE PERSISTENT SITE1 SITE2
cmb_enable "0" "0" "1" -
eer_enabled "0" - - -
erplog "0" - - -
failfast "0" - - -
last_known_reservation_state "none" - - -
online "0" "1" "1" "1"
raw_track_access "0" - - -
readonly "0" - - -
reservation_policy "ignore" - - -
use_diag "0" - - -
Each available site specific configuration will be shown as column. The
"Sites" parameter in the above output indicates the available site
configurations and the SITE1 and SITE2 colums indicates the detailed
configuration for the respective sites.
Reviewed-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Signed-off-by: Vineeth Vijayan <vneethv@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Modify the dev_get_setting_list function to get the site-specific
attributes of the device. The new site_id parameter for this function
must be less than SITE_FALLBACK to read the site-specific attributes.
As SITE_FALLBACK setting is same as persistent setting, we do not need
a separate read function for it.
Reviewed-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Signed-off-by: Vineeth Vijayan <vneethv@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The udev-rules must be modified to make it site-specific. The site
specific part of the rule should be executed only on the sites where the
devices belong. Change the generic udev rule to support the site-specific
udev-rule.
During boot, the current site-id is read from the LOADPARM which is
located at /sys/firmware/ipl. The zdev_id command reads this LOADPARM
and prints the SITE_ID based on the value. This SITE_ID is the
current site where the udev-rule is executing. Based on this assumption,
the rule is divided in to multiple blocks where each site block is executed
only for the corresponding sites.
The rule executes based on the value read from the LOADPARM.
1. When the LOADPARM specifies a site-id and if the current device has
an associated configuration settings, it will be used.
2. When the LOADPARM specifies a site, and the current device does not
have any associated configuration set, the udev rule uses the
fallback configuration settings.
3. If the device does not have a fallback-configuration settings or any
site-specific settings, no configurations will be used.
Reviewed-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Signed-off-by: Vineeth Vijayan <vneethv@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The currently active site can be found from the loadparm attribute which
is located at /sys/firmware/ipl/loadparm. Read the value of loadparm and
extract the site_id.
The loadparm is an 8 byte alphanumerical IPL parameter. The content of
loadparm can be of different forms to indicate different boot menu
options, which are used by Linux for selecting the respective boot menu
entries. To indicate the site-id, loadparm adds a 'S' character. Where,
the following character after 'S' indicates either the site-id or
indivcation to derive the site-id from SSID.
For example,
If the loadparm value is Sn,'n' is the integer which could be one of the
valid site_ids from 0 to 9; i.e when booted on site-1, loadparm value will
be S1.
If loadparm value is "SS", zdev_id extracts the site_id from the SSID of
the current ipl device. For ccw and zfcp devices, the current ipl device-id
can be found at /sys/firmware/ipl/device.
In any case, if the loadparm contains invalid value, or empty, the
site_id will be default to the common-site.
After the first invocation of the zdev_id from udev-rule, the site-id
information is stored in /run/zdev_id.env file. This will reduce the
number of further invocation of zdev_id from within udev-rules.
Reviewed-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Signed-off-by: Vineeth Vijayan <vneethv@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Currently zdev supports the configuration and maintenance of one single
persistent device state. With the introduction of sites, zdev should be
able to store, configure and maintaine NUM_SITES number of states in
the persistent configuration. This patch modifies the struct device and
adds a new site_specific device_state array, which stores the
persistent configuration for all the available sites.
Total number of available sites are configured with NUM_SITES. Where,
10 site-specific configurations and 1 common configuration.
1. during read, all site data is always read and update the
site_specific[] array.
2. dev->persistent is a copy of dev->site_specific[global_site_id]
3. modifications are only done on dev->persistent, and during write
dev->persistent overlays dev->site_specific[global_site_id]
Reviewed-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Signed-off-by: Vineeth Vijayan <vneethv@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
In some high-availability setups, root and boot disks of a Linux
installation are copied to remote sites that can take over execution
of a Linux workload in case of an outage of the original site.
A site in this context is an execution environment such as an LPAR
or z/VM guest.
Each site may provide a different set of devices, or require different
parameters to be applied per device. chzdev supports site-specific
device configuration for up to 10 sites. Each site is identified by
a number in the range 0 to 9. You can provide a separate set of persistent
device configuration for each site. The IPL Load parameter value specified
during boot determines the currently active site. Only the device
configuration of the active site is applied during boot and when new
devices become available. A common configuration can be provided that is
applied when no site-specific configuration is available for a device in
the active site.
User can use the --site parameter to configure devices for a specific
site only. Configuration actions without a site parameter apply to the
common configuration.
During the boot, the active site configuration is chosed based on the
IPL LOADPARM variable. If the LOADPARM contains no valid site-id (0 to 9),
the fallback-site id will be used. The fallback-site-id can also be
configured with the zdev tools by not specifying the --site parameter.
Some of the new chzdev/lszdev commands with site-parameter can be as
follows
1. chzdev -ep f001 --site 3
This command is used to configure the device f001 for the site 3. During
boot, if the LOADPARM value is S3, this device configuration will be
used.
2. lszdev --site 3
This command lists all the devices which are configured for site 3.
3. chzdev -ep f001
Above command does not have a --site parameter. This device settings
will be used for the following conditions
1. When the loadparm specifies a site, (e.g S3), and the device does not
have an associated config-set, zdev uses fallback config set.
2. When the loadparm does not specify any site information, then the
fallback config set will be used.
When the loadparm specifies a site, and the device does not have an
associated config set, nor a fallback site, nothing is configured for this
device.
Reviewed-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Signed-off-by: Vineeth Vijayan <vneethv@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
While at it, add a list with words to ignore. This suppresses the following codespell finding:
$ codespell libcpumf/libcpumf_cpuset.c
libcpumf/libcpumf_cpuset.c:15: parm ==> param, pram, parma
libcpumf/libcpumf_cpuset.c:17: parm ==> param, pram, parma
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Provie a CheckPatch configuration file and mention it in the coding style
guidelines (this feature was introduced with CheckPatch version 0.32 ~11 years
ago).
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Add a .clang-format configuration and mention it in the coding guidelines.
Usage example:
$ clang-format -i **/*.[ch]
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
When configuring a vfio-ap device, specifying only control domains
without any usage domains results in a useless configuration in that
both adapters and usage domains are required to make cryptographic
resources available to the guest. Without that, the control domains
are useless. While the kernel allows this, let's reject this
combination with a message.
Suggested-by: Boris Fiuczynski <fiuczy@linux.ibm.com>
Reviewed-by: Boris Fiuczynski <fiuczy@linux.ibm.com>
Reviewed-by: Tony Krowiak <akrowiak@linux.ibm.com>
Signed-off-by: Matthew Rosato <mjrosato@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
This patch enhances the zipl stage3 loader image adding a trailer as
required for secure boot by future firmware versions.
Note: with the change in this patch the padding via objcopy command line
options is replaced by padding via linker script directives with the
same effect.
Signed-off-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
lszcrypt allows the explicit definition of a list of devices. Continue
the parameter processing if multiple devices are specified.
Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
Reviewed-By: Harald Freudenberger <freude@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
In an upcoming patch the refactored function `pt_load_add` is reused. While at
it, add a wrap-around check to `pt_load_add`, replace `g.opts.device` access
with `fh->path` (this makes this function easier testable) and improve the
documentation.
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Remove `static` attribute from `print_usage_exit` and declare it in the header
file `opts.h`. The function will be reused in a later patch.
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Caller of `dfi_vmcoreinfo_get` must not modify the returned value, therefore
return a `const char *` value for `dfi_vmcoreinfo_get`.
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Add guarded storage registers support for the ELF input and the ELF output
format. See `man 2 s390_guarded_storage` for details about guarded storage.
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The maximum size of all supported ELF note entries for a CPU can be 0x4a4 bytes
and not 0x4a0. Use a function for the calculation so it's easier to maintain.
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Reviewed-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Currently, only the ELF version `1` is defined by the ELF specification. See
`man 5 elf` for details. Therefore of course, we do only support this version.
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Reviewed-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The functions are refactored so the `struct zg_fh` value is now passed as
argument to the `nt_*` functions instead of accessing the global variable `g.fh`
from within of the functions. This makes the functions reusable and easier to
test. While at it, improve the documentation of `nt_read`.
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Introduce variable `phdrs` and shrink the scope of `phdr`. This removes
duplicated code `&phdr[i]` and makes the code easier to read. While at it,
constify the parameter of `pt_notes_add`.
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Reviewed-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
`ehdr->e_phoff` has the type `Elf64_Off` and this maps to `uint64_t`, but `off_t` is signed. Let's
add a check for this.
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
generalize the collection step name from "docker" to "container host"
initial version of adding data collection for OCP.
all log file content might be too much for most installations
Reviewed-by: Alexander Klein <alkl@de.ibm.com>
Reviewed-by: Mario Held <mario.held@de.ibm.com>
Reviewed-by: Mike Storzer <mstorzer@de.ibm.com>
Signed-off-by: Joern Siglen <siglen@de.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
GUINT32_TO_BE and GUINT32_FROM_BE do exactly the same in case of glib2, just the
naming differs. However, at this point the conversion is from be to system
endianness therefore `GUINT32_FROM_BE` is the proper macro.
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
It's often useful to know how much data was actually copied, therefore let's
introduce an nullable parameter `@copied` to `pv_gbytes_memcpy`.
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
...by adding a compile time assertion about the buffer size. While at it, report
the actual user data size in case of an error.
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The endianness handling was only partially implemented for uvio.c. Let's remove
it since doesn't make much sense here, because the IOCTL must be build on the
same system where they're actually executed.
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
the buffer sizing did not work any longer
add explaining comments and rework the variable names for claritiy
refering commit f7cc14753cc9d930af804e2ac3ce108a12145db6
Reported-by: Mike Storzer <MSTORZER@de.ibm.com>
Reviewed-by: Mario Held <mario.held@de.ibm.com>
Signed-off-by: Joern Siglen <siglen@de.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Use `PV_CERT_ERROR` error domain whenever useful. Currently, it's only used
internally in libpv and therefore there is no problem in changing it.
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
There should be no problem with this change since the changed value was never
used. Therefore, let's remove the assignment and declare the parameter as const
to prevent such a behavior in the future.
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Reviewed-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The machine types are not strictly increasing anymore since Z16, therefore,
we cannot use numerical comparison to find out the correct HSA size
of a machine.
Fixes: 2515832469 ("util_arch: Add IBM z16 as known machine")
Signed-off-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
`afl-clang` requires a white space between a option name and the option value.
Therefore let's fix this for `-xc` by adding a white space.
How to reproduce:
$ make -C zdump CC=afl-clang-fast LINK=afl-clang-fast
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Reviewed-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
some versions of /bin/dash do interpreted our commands different, which
causes a variable failure and termination of the script.
e.g. a new line char "\n" will split the cmd_type to a multiple line variable
not working with the followup commands. adding the head command does avoid
multiline variables now.
Problem found in Ubuntu 20.4 and some older Ubuntu versions
Reviewed-by: Mario Held <mario.held@de.ibm.com>
Signed-off-by: Joern Siglen <siglen@de.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
move tool checking to the top of the script and add the output to
the check function (-c) for easy verifivation and testing
Reviewed-by: Mario Held <mario.held@de.ibm.com>
Signed-off-by: Joern Siglen <siglen@de.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
All debian distors use the dash shell as default, where type is not supprting "-t" parameter
Remove of "-t" where not important and change type check not using -t
Reviewed-by: Mario Held <mario.held@de.ibm.com>
Signed-off-by: Joern Siglen <siglen@de.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Easier to read for a first glimpse than the (still required) full config.
$ man multipathd
list|show config local
Show the currently used configuration like show config, but lim‐
iting the devices section to those devices that are actually
present in the system.
Works as of multipath-tools 0.7.8 commit
c23924dc74ee ("multipathd: implement "show config local"")
Signed-off-by: Steffen Maier <maier@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
==660622== 385 bytes in 7 blocks are definitely lost in loss record 30 of 37
==660622== at 0x484417C: malloc (in /usr/libexec/valgrind/vgpreload_memcheck-s390x-linux.so)
==660622== by 0x4E93BD7: strdup (strdup.c:42)
==660622== by 0x11249F: zg_strdup (zg.c:115)
==660622== by 0x11249F: zg_open (zg.c:164)
==660622== by 0x114FBF: dfi_dump_open (dfi.c:750)
==660622== by 0x114FBF: dfi_init (dfi.c:772)
==660622== by 0x111465: do_copy (zgetdump.c:192)
==660622== by 0x111465: main (zgetdump.c:216)
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Reviewed-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
we do miss a simple way to see the dbginfo.sh version used by the
customer for the debug generation. saving the version now to dbginfo.log
Reported-by: Mike Storzer <MSTORZER@de.ibm.com>
Reviewed-by: Mario Held <mario.held@de.ibm.com>
Signed-off-by: Joern Siglen <siglen@de.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Although the previous patch enables pvattest to display the
config UID this script enables the user to extract the config UID of
the SE-guest and the additional data if specified. This allows users of
pvattest v2.22.0 to view the config UID without examining binary blobs.
$ ./pvattest-info attresult.bin
Config UID:
1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a
Additional Data:
1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b
1b1b
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
In verbose mode (-v) `pvattest verify´ now also prints
"Attestation measurement verified", if the verification was successful and the
Config UID of the SE-guest and any additional data if available.
$ pvattest -V verify [...]
Attestation measurement verified
Config UID:
1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a
Additional Data:
1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b
1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Change the name of `hexdump´ to `pvattest_log_bytes´. Additionally, allow
that function to dump the bytes as a single hexadecimal number.
Change the name of `printf_hexdump´ to `pvattest_hexdump´.
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Map the Ultravisor return code 0x2 to "Invalid UV command" string. This
results in better error messages.
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The dracut installation directory is referenced from `chreipl-fcp-mpath`,
`zdev`, and `zipl`; in each with its own individual definition and
variable name. This makes it unnecessarily hard to change it when
installing from the top level directory of s390-tools and passing
variable overwrites via the command line.
Fix this by defining a common `DRACUTDIR` variable in the shared
`common.mak` file, and referencing this in each tool as base directory.
With this a user can simply pass `DRACUTDIR=/foo/bar/baz` on the
commandline and change the installation for all three tools.
Further, also derive common `DRACUTCONFDIR` and `DRACUTMODDIR` variables
from `DRACUTDIR` in `common.mak`, so that `zdev` and `zipl` don't use
different variable names for the same directory anymore, and all these
are defined together in a common place.
Semantically nothing changes for a default build/installation.
Signed-off-by: Benjamin Block <bblock@linux.ibm.com>
Reviewed-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
UDEVDIR is used in both `chreipl-fcp-mpath` and `zdev`, but with a
different meaning. In the former it points to the base udev directory,
not the rules directory; in the later it points to the rules directory.
If someone was to call `make` from the top level directory, and set
UDEVDIR for the whole build/installation, it would either break `zdev`
or `chreipl-fcp-mpath` (depending on what it was set to).
Fix this by pulling the definition of it in the shared `common.mak`
file, and giving it a common meaning. Point UDEVDIR to the base udev
directory, and UDEVRULESDIR to the rules directory below it.
Semantically nothing changes for a default build/installation.
Signed-off-by: Benjamin Block <bblock@linux.ibm.com>
Reviewed-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Fixes a bug that leads to a segmentation fault when no parmline is
provided.
Fixes: 11b401b5 ("zipl: move and make check for maximum command line length dynamic")
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Fixes a bug that make still tried to build pvattest even when the
compilation of pvattest was turned off.
This lead to a build bug when one of the dependencies was not met.
Also fixes the check of the OpenSSL version at build time.
Fixes: 3ab06d77 ("pvattest: Create, perform, and verify attestation measurements")
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Fixes a bug that make still tried to build libpv even when the
compilation of libpv was turned off.
This lead to a build bug when one of the dependencies was not met.
Also fixes the check of the OpenSSL version at build time.i
Fixes: 38639269 ("libpv: New library for PV tools")
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
pv_BIO_reset() wrongfully handled the BIO_reset() rc for non-file-backed BIOs.
This is currently not an issue as the only non-file BIO used cannot fail
at BIO_reset()
Fixes: 3ab06d77fb ("pvattest: Create, perform, and verify attestation measurements")
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The returncode handling for BIO_reset() was wrong when handling with
file based BIOs.
This resulted in a bug that DER formated certificates cannot be read
by genprotimg which is now fixed.
Fixes: d90344a2 (genprotimg: check return value of BIO_reset)
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
dasdfmt.c: In function ‘dasdfmt_write_labels’:
dasdfmt.c:1110:22: warning: ‘write’ reading 88 bytes from a region of size 4 [-Wstringop-overread]
1110 | rc = write(fd, &vlabel->vollbl, (sizeof(*vlabel)
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
1111 | - sizeof(vlabel->volkey)));
| ~~~~~~~~~~~~~~~~~~~~~~~~~~
In file included from dasdfmt.c:23:
../include/lib/vtoc.h:84:14: note: source object ‘vollbl’ of size 4
84 | char vollbl[4]; /* volume label */
| ^~~~~~
In file included from ../include/lib/util_opt.h:16,
from dasdfmt.c:20:
/usr/include/unistd.h:378:16: note: in a call to function ‘write’ declared with attribute ‘access (read_only, 2, 3)’
378 | extern ssize_t write (int __fd, const void *__buf, size_t __n) __wur
| ^~~~~
GitHub-ID: https://github.com/ibm-s390-linux/s390-tools/pull/137
Signed-off-by: Dan Horák <dan@danny.cz>
Acked-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Replace strncpy() with util_strlcpy() which provides the required
semantic.
In function ‘dasdview_print_format1’,
inlined from ‘dasdview_view_standard’ at dasdview.c:1952:4,
inlined from ‘dasdview_view’ at dasdview.c:2165:3,
inlined from ‘main’ at dasdview.c:2364:3:
dasdview.c:1791:25: warning: ‘strncpy’ output may be truncated copying 16 bytes from a string of length 1023 [-Wstringop-truncation]
1791 | strncpy(asc, (char *)dumpstr + i, 16);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
dasdview.c:1792:25: warning: ‘strncpy’ output may be truncated copying 16 bytes from a string of length 1023 [-Wstringop-truncation]
1792 | strncpy(ebc, (char *)dumpstr + i, 16);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
In function ‘dasdview_print_format2’,
inlined from ‘dasdview_view_standard’ at dasdview.c:1935:4,
inlined from ‘dasdview_view’ at dasdview.c:2165:3,
inlined from ‘main’ at dasdview.c:2364:3:
dasdview.c:1825:25: warning: ‘strncpy’ output may be truncated copying 8 bytes from a string of length 1023 [-Wstringop-truncation]
1825 | strncpy(asc, (char *)dumpstr + i, 8);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
dasdview.c:1826:25: warning: ‘strncpy’ output may be truncated copying 8 bytes from a string of length 1023 [-Wstringop-truncation]
1826 | strncpy(ebc, (char *)dumpstr + i, 8);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
GitHub-ID: https://github.com/ibm-s390-linux/s390-tools/pull/137
Signed-off-by: Dan Horák <dan@danny.cz>
[hoeppner@linux.ibm.com: sort include]
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The build produces a number of warnings like the ones below. The
unaligned pointers are expected, thus silence the warnings by disabling
the compiler diagnostics.
ziomon_dacc.c: In function ‘read_message’:
ziomon_dacc.c:189:44: warning: taking address of packed member of ‘struct message’ may result in an unaligned pointer value [-Waddress-of-packed-member]
189 | if ( (rc = read_message_header(fp, &msg->length, &msg->type)) )
| ^~~~~~~~~~~~
or
In file included from ziomon_mgr.c:36:
blkiomon.h: In function ‘blkiomon_stat_init’:
blkiomon.h:70:21: warning: taking address of packed member of ‘struct blkiomon_stat’ may result in an unaligned pointer value [-Waddress-of-packed-member]
70 | minmax_init(&bstat->size_r);
| ^~~~~~~~~~~~~~
GitHub-ID: https://github.com/ibm-s390-linux/s390-tools/pull/137
Signed-off-by: Dan Horák <dan@danny.cz>
Reviewed-by: Benjamin Block <bblock@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The kernel already provides the same macro as does the zt_common.h file,
thus check for its availability first.
CC zconf/qeth/lsqeth.o
In file included from ../../include/lib/util_base.h:17,
from lsqeth.c:30:
../../include/lib/zt_common.h:27: warning: "_AC" redefined
27 | #define _AC(X, TYPE) X##TYPE
|
In file included from /usr/include/linux/ethtool.h:17,
from lsqeth.c:12:
/usr/include/linux/const.h:21: note: this is the location of the previous definition
21 | #define _AC(X,Y) __AC(X,Y)
|
GitHub-ID: https://github.com/ibm-s390-linux/s390-tools/pull/137
Signed-off-by: Dan Horák <dan@danny.cz>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
This instruction is not present on older machines, therefore
use ltr.
Signed-off-by: Sven Schnelle <svens@linux.ibm.com>
Fixes: 1627c6a39f ("zipl: Support command lines longer than 896 bytes in bootloader")
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The new version of lspci does support an extended verbose mode "-vvv"
Using the the tripple v parameter does also work for the old version
having the same result as the double v called before.
Reported-by: Eberhard Pasch <epasch@de.ibm.com>
Reviewed-by: Mario Held <mario.held@de.ibm.com>
Signed-off-by: Joern Siglen <siglen@de.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
https://www.kernel.org/doc/html/latest/trace/ftrace.html?highlight=free_buffer
free_buffer:
If a process is performing tracing, and the ring buffer should be
shrunk "freed" when the process is finished, even if it were to be
killed by a signal, this file can be used for that purpose. On close
of this file, the ring buffer will be resized to its minimum size.
Having a process that is tracing also open this file, when the process
exits its file descriptor for this file will be closed, and in doing so,
the ring buffer will be "freed".
It may also stop tracing if disable_on_free option is set.
$ cat /sys/kernel/debug/tracing/buffer_size_kb
7 (expanded: 1408)
$ cat /sys/kernel/debug/tracing/free_buffer
cat: /sys/kernel/debug/tracing/free_buffer: Invalid argument
$ cat /sys/kernel/debug/tracing/buffer_size_kb
0
Reported-by: Thomas Lambart <Thomas.Lambart2@ibm.com>
Signed-off-by: Steffen Maier <maier@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The current implementation drops the reason why a download of a CRL
failed. This is changed to the reporting of the error triggered by the
last CRL download attempt.
This mainly helps to check for the download error during CI testing
and prevent connectivity issues to be the reason of a test failure.
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Use PMU named pai_ext to extract the PMU type number required
for the installation of PAI NNPA counters using perf_event_open()
system call.
Signed-off-by: Thomas Richter <tmricht@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Add a check to detect Processor Activity Instrumentation (PAI)
Extension 1 facility unit.
Signed-off-by: Thomas Richter <tmricht@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
When the summary flag is selected do not print detailed information
on every single event. Just print the summary information on each
non-zero counter value.
Suggested-by: Christian Borntraeger <borntraeger@linux.ibm.com>
Signed-off-by: Thomas Richter <tmricht@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
During recording, progress information is displayed on the screen
on how many event have been processed and at which offset these
events have been extracted from the ring buffer.
This information is usually of no interest to the user. Omit this
data and only print them when requested via verbose flag.
Suggested-by: Christian Borntraeger <borntraeger@linux.ibm.com>
Signed-off-by: Thomas Richter <tmricht@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Add virtual counters pai_user and pai_kernel to detail all Processor Activity
Instrumentation (PAI) counters in user resp. kernel space. Once activated,
they will show all counters for the corresponding set. Add option -n to limit
the display to only non-zero counter values.
Add support for cpu hotplug events based on libudev. CPU hotplug events are
used to either detach from a vanishing CPU or (re-)attach to a (re-)appearing
CPU. In that case, a "hotplug detected" virtual counter is set to a non-zero
value to indicate possible loss of counters which happens when CPACF is used
on the CPU before cpacfstatsd could attach to it. The hotplug indication is
cleared once all counters are deactivated.
Add support for JSON output. The JSON document is an array of JSON objects
representing the counters and their values. Every object has a name (property
"counter") and a value (property "value"). For PAI counters, the counters
also have a space (property "space") determining the counter set pai_user or
pai_kernel, and a numeric id (property "counterid") that can be used to filter
the JSON document.
Signed-off-by: Juergen Christ <jchrist@linux.ibm.com>
Reviewed-By: Harald Freudenberger <freude@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
cpacfstatsd now correctly handles offline cpus and dynamically attaches to
cpus once they get online. If events are enabled when a hotplug event
occurs, cpacfstatsd uses a pseudo-counter to notify user applications about
the occurence of this event and a potential data inaccuracy.
cpacfstats shows if a hotplug event has been detected since at least one
counter was activated. As soon as all counters are deactivated, the
hotplug detection state is reset.
Signed-off-by: Juergen Christ <jchrist@linux.ibm.com>
Reviewed-By: Harald Freudenberger <freude@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The cpacfstats daemon is susceptible to dos attacks from malicious clients
that connect but either do not send a query or receive an answer fast
enough. The latter currently is impossible but might occur once we
introduce further counters.
Solve both problems by exploiting a timed read/write operation in the
daemon and close the connection on timeout.
Signed-off-by: Juergen Christ <jchrist@linux.ibm.com>
Reviewed-By: Harald Freudenberger <freude@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Remove `-rdynamic` since it's a linker flag. This should not cause any problems
because we differentiate between compilation and linking by default. While at
it, adapt the `print_backtrace` documentation accordingly.
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Reviewed-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Reviewed-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Acked-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Use util_file_read_va() function to read out the event number
given the event file. Also use util_strdup() function to save
the event name. This function terminates on Out Of Memory condition.
Signed-off-by: Thomas Richter <tmricht@linux.ibm.com>
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
cryptsetup 2.1.0 requires excessive amount of RAM (1GB) to luksOpen encrypted
drives (LP: #1820049).
LUKS2 introduced support for Argon2i and Argon2id as a Password-Based Key
Derivation Function (PBKDF).
Argon2 is the winner of Password Hashing Competition and is now officially
recommended by RFC 9106.
PBKDF2 is currently used in zkey to mitigate out-of-memory errors when
multiple LUKS2 volumes are opened automatically via /etc/crypttab.
This patch is to use Argon2i (the deflaut algorithm) as key derivation function
for LUKS2 volumes, but with options for low memory and time requirements.
Using the default Argon2i options might still cause out-of-memory errors.
Link: https://bugs.launchpad.net/ubuntu/+source/cryptsetup/+bug/1820049
Closes: https://github.com/ibm-s390-linux/s390-tools/pull/138
Signed-off-by: Frank Heimes <frank.heimes@canonical.com>
Acked-by: Ingo Franzki ifranzki@linux.ibm.com
[hoeppner@linux.ibm.com: fix whitespace, line break, and commit message]
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Extract the minor version and modification level separately.
Previously only the modification level has been extracted, and was
reported as minor version.
Currently no one is checking the minor version or modification level,
so it does not hurt. But maybe in the future one will check, so report
it correctly.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
During plugin initialization, the external libraries such as the
EP11 or CCA host libraries are set up, if the configuration is
appropriate.
A secure identity key may be generated once the APQNs are configured,
but before the server connection is configured. Trying to re-encipher
the plugin's secure keys to a new HSM master key at that stage fails
with 'ERROR: Invalid ext lib type: 0' because the external libraries
have not been setup yet.
Change the code to setup the libraries once the APQNs have been
configured, and not only after the server connection has been
configured.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Increase initial update interval from 200ms to 1 seconds to avoid
fluctuations on the initial data output.
Signed-off-by: Mete Durlu <meted@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
pvattest is a tool to attest an IBM Secure Execution guest.
In a trusted environment, one can create a request using
`pvattest create`. To get a measurement of an untrusted
IBM Secure Execution guest call 'pvattest perform'.
Again in a trusted environment, call 'pvattest verify'
to verify that the measurement is the expected one.
The tool runs on s390 and x86.
It has the same requirements like libpv and therefore
requires openssl v1.1.1+, glib2.56+, and libcurl.
Additionally, to measure, the linux kernel must provide
the Ultravisor userspace interface `uvdevice` at /dev/uv
and must be executed on an IBM Secure Execution guest on
hardware with Ultravisor attestation support, like IBM z16 or later.
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
libpv is a collection of definitions and functions related to
Protected Virtualization (PV).
The functions cover mainly encryption (e.g. AES-GCM)
and certificates (X509). There are also helping functions for glib2.
Most of the code is extracted+refactored from `genprotimg`, which
will use this library in future.
Requires openssl v1.1.1+, glib2.56+, and libcurl.
libpv is not designed or intended to be dynamically linked or used
outside of this project. Its purpose is to avoid code duplication
as PV tools do very similar things regarding cryptography.
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Acked-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
This commit introduces a new module containing various helpers for
NGDump stand-alone dump. The purpose of these helpers is to facilitate
the implementation of DT and DFI interfaces for NGDump, share code
between both, reduce duplication and enable unit testing later on.
Signed-off-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Reviewed-by: Alexander Gordeev <agordeev@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Return the partition number which contains the given block range,
before it was tested for exact match between a partition block range
and the one provided by user. The old behavior with exact match
should still work, this change just relaxes the partition matching
algorithm and allows one to find a partition which contains the given
block range.
Signed-off-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Reviewed-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
This commit finalizes the implementation of the new stand-alone dump -
Next Gen Dump (NGDump).
NGDump stand-alone dump is a universal stand-alone dump which works for both
SCSI and NVMe disks. But currently can be used only with NVMe disks
and SCSI stand-alone dump remains the default for SCSI disks.
Currently, this stand-alone dump can be used only on IBM z15 or newer
machine generations because it requires larger amount of HSA memory offered
by firmware only on IBM z15 machines. Whereas SCSI stand-alone dump is able
to work with HSA memory of 32M, the new stand-alone dump requires 512M HSA
memory at the moment.
NGDump stand-alone dump installation is initiated by passing a path to
a NVMe disk partition to zipl via the command-line -d, similar to SCSI
stand-alone dump. zipl will then:
- build a dumper initramfs with either dracut (Fedora/RHEL/SLES) or
initramfs-tools (Ubuntu/Debian)
- format the given NVMe partition with ext4 file system
- create a bootmap file on the newly created file system using the built
initramfs and the currently active kernel image
- install a boot loader on the disk the given dump partition belongs to
The operations described above are destructive for the given NVMe dump
partition and the boot record(s) of its disk.
After the installation step, users can configure the dumpconf to IPL
the dumper automatically on panic or trigger a dump manually via HMC
interface.
When activated, the dumper will create a dump ELF file named "dump.elf"
on the given NVMe dump partition by using the makedumpfile tool. The kdump
compressed file format is not supported yet due to zgetdump not being able
to read such a file format. Therefore, the dumper is restricted to write
the dump only in ELF format but only kernel pages which are in use.
This will usually make the dump smaller than the original size of
/proc/vmcore and the whole dump process faster as well.
Example configuration for dumpconf:
ON_PANIC=dump # or dump_reipl
DUMP_TYPE=nvme
FID=0x00000001
NSID=0x00000001
BOOTPROG=0
BR_LBA=0
$ systemctl enable --now dumpconf
To install the dracut support on Fedora/RHEL/SUSE:
$ make -C zipl/dracut HAVE_DRACUT=1 install
To install the initramfs-tools support on Ubuntu/Debian:
$ make -C zipl/initramfs-tools HAVE_INITRAMFS=1 install
Example of NGDump console output on SLES during dump
----------------------------------------------------
Starting NGDump...
[ 8.932343] ngdump.sh[327]: NGDump started
[ 8.934739] ngdump.sh[336]: Checking for memory holes : [ 0.0 %] /
[ 8.967536] ngdump.sh[336]: Checking for memory holes : [100.0 %] |
[ 9.076976] ngdump.sh[336]: Excluding unnecessary pages : [100.0 %] \
[ 11.721157] ngdump.sh[336]: Copying data : [ 0.0 %] -
[ 12.317319] ngdump.sh[336]: Copying data : [ 22.5 %] / eta: 2s
[ 13.273000] ngdump.sh[336]: Copying data : [100.0 %] | eta: 0s
[ 13.273244] ngdump.sh[336]: The kernel version is not supported.
[ 13.273263] ngdump.sh[336]: The makedumpfile operation may be incomplete.
[ 13.273281] ngdump.sh[336]: The dumpfile is saved to /ngdump/dump.elf.
[ 13.273299] ngdump.sh[336]: makedumpfile Completed.
Example of NGDump console output on Ubuntu during dump
-------------------------------------------------------
[ 3.240078] zdump: The dump process started for a 64-bit operating system
Loading, please wait...
Starting version 245.4-4ubuntu3.17
Begin: Starting firmware auto-configuration ... done.
Begin: Loading essential drivers ... done.
Begin: Running /scripts/init-premount ...
Begin: NGDump ...
Checking for memory holes : [ 0.0 %] /
Checking for memory holes : [100.0 %] |
Excluding unnecessary pages : [100.0 %] \
Copying data : [ 0.0 %] -
Copying data : [ 40.7 %] / eta: 1s
Copying data : [100.0 %] | eta: 0s
The kernel version is not supported.
The makedumpfile operation may be incomplete.
The dumpfile is saved to /ngdump/dump.elf.
makedumpfile Completed.
Signed-off-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Acked-by: Alexander Gordeev <agordeev@linux.ibm.com>
Tested-by: Alexander Gordeev <agordeev@linux.ibm.com>
Reviewed-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Tested-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The purpose of the new zipl helper script is to build a dumper initramfs
for NGDump stand-alone dump. zipl executes the helper script when
preparing a NVMe dump partition for stand-alone dump.
The zipl helper script expects a single parameter - a path to the dump
partition to store a dump on. The helper script terminates with 0 on
success and a positive value otherwise.
The zipl helper script performs the following steps:
- It builds an initramfs image suitable for dumping. To perform this step,
the script employs the dracut tool on Fedora/RHEL/SLES and
the initramfs-tools on Ubuntu/Debian.
- It outputs the path to the newly built initramfs image and the currently
active kernel bzImage on the standard output.
- It prints the kernel command-line to be used by the dumper on
the standard output.
On success, zipl expects the helper script to return at least three lines
containing:
- initrd=<path to an initramfs image>
- kernel=<path to a kernel bzImage>
- cmdline=<kernel command-line parameters>
Signed-off-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Acked-by: Alexander Gordeev <agordeev@linux.ibm.com>
Tested-by: Alexander Gordeev <agordeev@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The NGDump initramfs-tools module is required to build an initramfs image
to be used with NGDump stand-alone dump. NGDump stand-alone dump does not
use a pre-built initramfs image in contrast to SCSI stand-alone dump.
Instead, an initramfs image is built with initramfs-tools if NGDump
stand-alone dump is installed on a NVMe partition.
The NGDump initramfs-tools module ensures that all necessary tools are
present within the built initramfs and a dump of /proc/vmcore is initiated
to the chosen NVMe partition when the installed dumper is IPLed.
The NGDump intramfs-tools module installs a configuration file and
a dump script into dumper initramfs. This dump script starts at boot
shortly after the initialization of the dump target device. It reads
the aforementioned configuration file that contains the name of a dump
partition to store a dump on. The dump script reads the configuration file,
mounts then the dump target device, creates a copy of /proc/vmcore with
the makedumpfile tool on it, and then shuts down the system.
Ubuntu and Debian are the main Linux distributions targeted by this
initramfs-tools module.
Signed-off-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Acked-by: Alexander Gordeev <agordeev@linux.ibm.com>
Tested-by: Alexander Gordeev <agordeev@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The NGDump dracut module is required to build an initramfs image to be used
with NGDump stand-alone dump. NGDump stand-alone dump does not
use a pre-built initramfs image in contrast to SCSI stand-alone dump.
Instead, an initramfs image is built with dracut if NGDump stand-alone dump
is installed on a NVMe partition.
The NGDump dracut module ensures that all necessary tools are present
within the built initramfs and a dump of /proc/vmcore is initiated
to the chosen NVMe partition when the installed dumper is IPLed.
The NGDump dracut module installs a new systemd service and a dump script
into dumper initramfs. The systemd init process starts the NGDump service
at boot shortly after the initialization of the dump target device.
The NGDump systemd service, in its turn, starts the dump script provided
by the new dracut module. The dump script mounts then the dump target
device, creates a copy of /proc/vmcore with the makedumpfile tool on it,
and then shuts down the system.
The NGDump dracut module can be used on any Linux distribution which
supports dracut. But the primary targets are:
- Fedora
- RHEL
- SLES
Signed-off-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Acked-by: Alexander Gordeev <agordeev@linux.ibm.com>
Tested-by: Alexander Gordeev <agordeev@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
This change adds a new parameter to the function bootmap_create_file()
that requires the caller to specify a path to the directory where
a bootmap file will be created. The primary motivation for this change is
to support NVMe stand-alone dump, in that case the job's bootmap directory
is not set.
Signed-off-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Acked-by: Alexander Gordeev <agordeev@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The purpose of this change is to simplify the function
bootmap_create_device() and make it more readable. Furthermore,
the dump partition check can be reused for NVMe dump partitions later on.
Signed-off-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Acked-by: Alexander Gordeev <agordeev@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The purpose of this change is to simplify the function
bootmap_create_device() and make it more readable.
Furthermore, make bootmap_create_device() more robust by checking the return
value of disk_write_block_aligned().
Signed-off-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Acked-by: Alexander Gordeev <agordeev@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The purpose of this change is to simplify the function bootmap_create(),
make it more readable and prepare for new changes that will follow.
The original function bootmap_create() tried to handle two different cases
and, therefore, contained many conditional statements which had a negative
effect on readability.
Signed-off-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Acked-by: Alexander Gordeev <agordeev@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The purpose of this change is to simplify the function bootmap_create(),
make it more readable and prepare for new changes that will follow.
Signed-off-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Acked-by: Alexander Gordeev <agordeev@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Until now, NVMe disks were handled by zipl as SCSI disks. To support
NVMe stand-alone dump, it became necessary to further differentiate between
both types of disks.
There are two cases that must be handled:
1. A non-device-mapper device is a NVMe disk if it is assigned to the blkext
device driver.
2. A device-mapper disk is a NVMe disk if the ioctl NVME_IOCTL_ID succeeds.
This case is necessary to properly recognize NVMe disks which are
DM devices and, therefore, not directly handled by the blkext device
driver.
Signed-off-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Acked-by: Stefan Haberland <sth@linux.ibm.com>
Acked-by: Alexander Gordeev <agordeev@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Use util_file_read_va() function to read out the event number
given the event file. Also use util_strdup() function to save
the event name. This function terminates on Out Of Memory condition.
Signed-off-by: Thomas Richter <tmricht@linux.ibm.com>
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
genprotimg is a user command and as such installed into /usr/bin. Adapt
the man page accordingly and move it from section 8 (system commnds) to
section 1 (user commands).
Reported-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The static analysis tool for Debian packages 'lintian', especially if called
like 'lintian -EvIL +pedantic', checks manual pages for correctness and typos.
This commit fixes typos that were identified by lintian and marked with
'typo-in-manual-page' while s390-tools version 2.20.0 was packaged.
Closes: https://github.com/ibm-s390-linux/s390-tools/pull/134
Signed-off-by: Frank Heimes <frank.heimes@canonical.com>
Acked-by: Steffen Maier maier@linux.ibm.com [ziomon]
Acked-by: Ingo Franzki ifranzki@linux.ibm.com [zkey]
[hoeppner@linux.ibm.com: fix commit message]
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The provider functions are passed to OpenSSL in the dispatch array
casted to 'void (*)(void)', so they can not be type checked by the
compiler. Add function prototypes using the OpenSSL provided
function typedefs to allow the compiler to check the function
signatures.
No functional change.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Gcc 12 produces a -Wmaybe-uninitialized warning that the content
of the tmp buffer may be uninitialized. This is a false positive.
Silence the warning by using calloc instead of malloc to ensure
that the allocated buffer is initialized.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Create an empty environment file /etc/ziplenv at make install
time if that file doesn't exist
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Eduard Shishkin <edward6@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Add definitions of sites, namespaces and sections.
Document the new options --site (-S) and --effective-site (-E)
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Eduard Shishkin <edward6@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
. Support multiple namespaces in the installed environment block;
. Add option --site (-S) to specify a particular namespace
when operating on the installed environment block;
. Add option --effective-site (-E) to specify a particular
namespace. When using in a combination with the option -l
(--list), it displays zIPL environment that would take place if
the specified namespace was activated at boot time;
. Modify set/unset/reset/list operations over the installed
environment block in the case when the option --site is specified
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Eduard Shishkin <edward6@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
. Parse LOADPARM specified by user to find out site-ID;
. Support multiple namespaces in the environment block. Use hash
function on "extended" strings (i.e. strings with logical
prefixes) for the key-value store implementation;
. Added logic to activate a particular namespace by site-ID passed
by user via LOADPARM;
. Modify the logic of evaluation of zIPL environment variables in
the kernel command line. Use the activated namespace for the
evaluation
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Eduard Shishkin <edward6@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Support multiple namespaces in environment block. Use hash
function on "extended" strings for key-value store.
Support multiple sections in environment file.
Modify the import environment precedure to be "section-aware"
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Eduard Shishkin <edward6@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Consolidate type definitions in order to avoid duplicated code, getting
better compiler support, and to avoid confusing namings for the same
thing - e.g. `blk_end` vs. `blockcnt` field name used in the old `struct
fba_dump_param` definitions. It also allows us to get rid of two
`uint64_t` casts.
While at it, fix the documentation of `struct eckd_blockptr`.
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
...otherwise `.note.gnu.build-id` will be put at 0x0 (location for s390x
lowcore) if the linker option `--build-id` is used (which is the default
if gcc is used for linking).
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Use the `tpi_info` struct definition, similar to the Linux kernel, in
the lowcore struct. This change allows us to use simple assignments
instead of using casts. Additionally, there is the advantage that the
lowcore definition from the s390-tools now looks more similar to the
lowcore definition used by the Linux kernel.
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Until recently dumpconf might have been installed in two different
locations, /etc/init.d/ and /lib/s390-tools/. As dumpconf is now part of
the helper scripts in the scripts directory, extend the installation
rule and add the %S390_TOOLS_VERSION% wildcard to the script along the
way for correct version output.
The installation rule in the systemd/Makefile is removed, bringing it in
line with cpictl.
Acked-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Modern distributions use systemd and a corresponding systemd unit file
is provided that handles the dumpconf tool. The tool is also the last
script left in etc/init.d. Move it to scripts and get rid of the init.d
directory altogether.
Acked-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
For cpacfstatsd, cpuplugd, and mon_statd there are still SysV daemon
scripts available. However, modern distributions use systemd and
corresponding systemd unit files are provided and in use for a long time
already.
Remove the daemon scripts for the obsolete SysV init system as they're
not used by modern systems anymore.
Acked-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The ap_tools utilities are intended to be used in conjunction with
the mdevctl utility for safely managing and inspecting vfio-ap
mediated devices. For now, this will consist of the ap-check tool
which will be driven via a call-out from mdevctl to validate a
proposed vfio-ap mediated device change.
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Reviewed-by: Tony Krowiak <akrowiak@linux.ibm.com>
Reviewed-by: Jason J. Herne <jjherne@linux.ibm.com>
Signed-off-by: Matthew Rosato <mjrosato@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
zdev uses a particular set of exit codes -- In preparation for sharing
some zdev udev code with other libraries, let's also create a libutil
include to specify reusable exit codes. For now, let's just initialize
it with the codes from zdev we care about.
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Reviewed-by: Jason J. Herne <jjherne@linux.ibm.com>
Reviewed-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Signed-off-by: Matthew Rosato <mjrosato@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Add IBM z16 extended counter set. For each counter in this set
add the counter number, the short and long description and the
counter number.
Signed-off-by: Thomas Richter <tmricht@linux.ibm.com>
Acked-by: Sumanth Korikkar <sumanthk@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
OpenSSL commit ee22a3741e3fc27c981e7f7e9bcb8d3342b0c65a changed the
OpenSSL provider's keymgmt_match() function to be not so strict with
the selector bits in regards to matching different key parts.
Adapt the secure key provider's match function accordingly.
This means, that if the public key is selected to be matched, and
the public key matches (together with any also selected parameters),
then the private key is no longer checked, although it may also be
selected to be matched. This is according to how the OpenSSL function
EVP_PKEY_eq() is supposed to behave.
OpenSSL function SSL_CTX_use_PrivateKey() calls the providers match
function to check if the private key specified matches the public key
of the certificate using EVP_PKEY_eq(). EVP_PKEY_eq() includes the
private key into the selector bits here, although the certificate
only contains the public key part.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The Processor Activity Instrumentation facility (PAI) Extension 1
adds support for the counter set for Neural Network Processing Assist
(NNPA) counters.
NNPA counter values are appended as raw data to the data report.
Signed-off-by: Thomas Richter <tmricht@linux.ibm.com>
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Add a check to detect Processor Activity Instrumentation (PAI)
Extension 1 facility unit. This covers the counter set for
Neural Network Processing Assist (NNPA) counters.
Signed-off-by: Thomas Richter <tmricht@linux.ibm.com>
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The Processor Activity Instrumentation facility (PAI) uses the
perf_event_open system call to report data and the crypto counter
values. The data can be inspected with the perf tool in a very
generic way using raw data report and a hex dump utility.
The pai tool also uses the perf_event_open system call to record the
data, but uses specialized event attributes for recording detailed
information such as the recording of fork, exit, exec system call
events and context switch events.
Cryptography counter values are appended as raw data attachments.
The pai command can be used for recording and reporting.
Also a list of CPUs can be specified.
The recording ring buffers are created per CPU
and are named paicrypto.XXX where XXX stands for the CPU number.
The numbering scheme has leading zeros, such as 007 for CPU number 7.
For invocation and possible command line options see the man page.
Signed-off-by: Thomas Richter <tmricht@linux.ibm.com>
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Since the switch to fuse3 setting the hard_remove option with the
FUSE_LIB_OPT() macro is no longer supported. See libfuse commit
8ee553dac029 ("fuse_new(): don't accept options that don't make sense
for end-users") for details. To fix this, add an appropriate init
function which sets this option.
Fixes: https://github.com/ibm-s390-linux/s390-tools/issues/131
Fixes: e679a88d88 ("Switch from fuse2 to fuse3")
Signed-off-by: Sven Schnelle <svens@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Fix the doxygen comments and add a description on the return values.
Signed-off-by: Thomas Richter <tmricht@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
By default, the Bash file globbing pattern '*' doesn't list files prefixed by a
dot (see https://linux.die.net/man/1/bash). Let's fix this by using the pattern
`.*` instead. While at it, add `--` option to remove possible problems with
leading dashes in filenames.
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
This work around fixes the gcc-12 false positive by disabling `Warray-bounds`:
CC genprotimg/boot/stage3a.o
In file included from stage3a.c:14:
In function ‘__test_facility’,
inlined from ‘test_facility’ at ../../include/boot/s390.h:428:9,
inlined from ‘start’ at stage3a.c:42:7:
../../include/boot/s390.h:418:17: error: array subscript 0 is outside array bounds of ‘void[0]’ [-Werror=array-bounds]
418 | return (*ptr & (0x80 >> (nr & 7))) != 0;
| ^~~~
Unfortunately, there is currently no better fix available that doesn't result
in larger boot loader code sizes. Given the importancy of the boot loader file
sizes the other fixes aren't acceptable. The Linux kernel shares the
problem (but for performance reasons), take a look at the discussion
https://lore.kernel.org/lkml/yt9dzgkelelc.fsf@linux.ibm.com/ for details.
Fixes: https://github.com/ibm-s390-linux/s390-tools/issues/130
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
This patch implements an additional method of sorting bls entries
by version field and uses it as default one. If sorting by version
fails, then it falls back to the most robust method of sorting by
file names
Signed-off-by: Eduard Shishkin <edward6@linux.ibm.com>
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
It is used by the next patch.
Specifically, ->filter() and ->sort() callbacks of the scandir(3)
accept only short names of directory entries to be filtered/sorted,
while we need to know absolute names to perform filtering/sorting.
Signed-off-by: Eduard Shishkin <edward6@linux.ibm.com>
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The problem can happen when dfi_s390mv_init_gen() returns with an error
code to dfi_init() in dfi.c.
Double free condition occurs on zg_close() call at the end of the
while loop in dfi_init() if zg_close() has already been called for the
same file handle at the end of open_dump() function in scope of
dfi_s390mv_init_gen() processing.
This global file handle is not closed during init() call for any
other dump formats. Since it is not reopened/reused after open_dump() call
during multi-volume dump initialization, we should not close it at all.
The problem can be reproduced in the following steps:
1) Install multi-volume dump tool
# zipl -M mvdump.conf
Dump target: 2 partitions with a total size of 4732 MB.
Warning: All information on the following partitions will be lost!
/dev/dasdb2
/dev/dasdb3
Do you want to continue creating multi-volume dump partitions (y/n)?y
Done.
2) Run zgetdump -i using device (not partition) as a parameter without
taking actual dump.
# zgetdump -i /dev/dasdb
free(): double free detected in tcache 2
Aborted (core dumped)
Signed-off-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Reviewed-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
With "zpcictl --reset DDDD:BB:FF.F" now causing a fully Linux driven
reset where the Linux kernel does an explicit device driver unbind,
disable and re-enable, let's also expose a way to instead have firmware
perform a device reset by issuing an SCLP with SCLP_ERRNOTIFY_RESET.
When firmware is done resetting the device it will then issue an error
notification with PCI Error Code 0x3a indicating successful reset, which
will subsequently cause the new kernel based automatic recovery
mechanism to perform recovery in coordination with the device driver.
This allows resetting devices without unbinding them from their device
driver and thus without losing related block devices or network
interfaces. This may also be used to test the automatic recovery
mechanism.
Reviewed-by: Matthew Rosato <mjrosato@linux.ibm.com>
Signed-off-by: Niklas Schnelle <schnelle@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Currently "zpcictl --reset DDDD:BB:FF.F" issues an SCLP call with
SCLP_ERRNOTIFY_AQ_RESET followed by a Linux driven device reset via the
recover sysfs attribute. The latter was introduced with commit
bc0d40c580 ("zpcictl: Initiate recover after reset") because the
firmware driven reset leaves the device in the error state. Now with the
addition of transparent PCI recovery however the situation has changed
as Linux will not leave the device in the error state after the reset
but will instead initiate its automatic recovery flow. With that however
the two mechanisms, automatic PCI recovery and the zpcictl triggered
recovery attribute handler will race against each other.
In practice this is harmless as the automatic recovery is serialized
with the recover attribute and whichever wins the race will do the reset.
The losing side will detect that the original device was removed and
will refrain from causing a double reset.
Letting both mechanisms race against each other is not predictable
behavior though so instead of SCLP_ERRNOTIFY_AQ_RESET issue
a SCLP_ERRNOTIFY_AQ_REPORT_ERROR that will report a device error to the
Support Element but not cause a reset and then predictably reset via the
recover sysfs attribute. If instead a firmware driven reset followed by
the automatic recovery flow is desired the new "--reset-fw" option may
be used.
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Niklas Schnelle <schnelle@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The default issuer check may fail if the to-be-verified host key
document was issued and signed by an entity not known at the point
in time check_hostkeydoc was released.
In order to allow verification of the chain of trust for an unknown
but otherwise valid issuer, check_hostkeydoc can be called with
the -d command line option.
This commit also enhances the help text by briefly describing the
command line options and fixes a typo.
Signed-off-by: Viktor Mihajlovski <mihajlov@linux.ibm.com>
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
While the original default issuer's organizationalUnitName (OU)
was defined as "IBM Z Host Key Signing Service", any OU ending
with "Key Signing Service" is considered legal.
Let's relax the default issuer check by stripping off characters
preceding "Key Signing Service".
Signed-off-by: Viktor Mihajlovski <mihajlov@linux.ibm.com>
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The re-enciphering of EP11 asymmetric secure keys does not work.
First, the result of the re-encipher operation of the private key
part must be copied back into the user supplied key token buffer.
Second, the public key part, i.e. the MACed SubjectPublicKeyInfo
(SPKI) structure must also be re-enciphered (i.e. re-MACed), since
the MAC is calculated with the EP11 master key.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Remove the DigiCert root CA pinning. The root CA used for the chain of trust can
change in the future therefore let's remove this check. If someone wants to
enforce the usage of a specific root CA it can be selected by the genprotimg
command line option `--root-ca $CA`. Make it transparent to the user which root
CA is actually being used by printing the subject name of the root CA to stdout
in verbose mode.
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Acked-by: Viktor Mihajlovski <mihajlov@linux.ibm.com>
Reviewed-and-tested-by: Nico Boehr <nrb@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Some development kernel versions provide an 8-digit date number like
"20220325" in place of the second kernel sublevel, while the data
format used to send this information to the HMC only supports 16 Bit
numbers. As a result, the HMC displays a seemingly random sublevel
number.
Fix this by replacing excessive sublevel numbers with 0 to ensure that
these numbers are handled consistently.
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Hitting CTRL-D anywhere will cause fdasd to go into an endless loop
displaying the main menu over and over again. Killing fdasd (e.g.
via CTR-C) is the only way out.
The issue is that read_line() is just ignoring the resulting EOF
condition on stdin. Subsequent invocations of read_line() will return
immediately and thus cause the loop. A simple fix is to reset stdin
after EOF. A caller of read_line() will see the same behavior as for
EOL with no input.
Signed-off-by: Viktor Mihajlovski <mihajlov@linux.ibm.com>
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
This can now include /lib/modprobe.d/10-unsupported-modules.conf
Strictly speaking, modprobe would only consider *.conf files inside
those directories, but for consistency with the already existing
collection of /etc/modprobe.d instead of /etc/modprobe.d/*.conf,
do the same for the added missing locations.
Signed-off-by: Steffen Maier <maier@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Recent multipath-tools can depend on this.
a1eabea75e
("multipathd.service: drop ExecStartPre for loading dm-multipath")
92f0893ac1
("multipath-tools: install modules-load.d/multipath.conf")
This can now also include /usr/lib/modules-load.d/s390-pkey.conf
Complements v2.8.0 commit
dffd41943e ("pkey: Support autoloading kernel pkey module").
Signed-off-by: Steffen Maier <maier@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The target field is required for IPL sections, but the ones populated from
BLS snippets did not have this field. This was only working when using BLS
snippets because IPL sections inherit the target field with "defaultauto".
But that's not the case when using a menu, for example the following zipl
configuration will fail if it's used along with BLS defined IPL sections:
fail when running the zipl tool:
[defaultboot]
defaultmenu = menu1
:menu1
target = /boot
1 = linux
2 = test
default = 1
prompt = 1
timeout = 0
Because "linux" and "test" will be defined using BLS snippets and these
don't have an option to define target fields. Let's make these to always
inherit a target field, either from the [defaultboot] section or a menu
section if there's a defaultmenu defined.
Fixes: https://github.com/ibm-s390-linux/s390-tools/issues/111
Closes: https://github.com/ibm-s390-linux/s390-tools/pull/113
[hoeppner@linux.ibm.com: Fixed a couple of style issues]
Reported-by: Renaud Métrich <rmetrich@redhat.com>
Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Tested-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Now that we've concluded that the compiler is used for calling the actual
linker, it doesn't make much sense to select a different compiler for linking.
Even worse, it's prone to error. A naive user might try to compile s390-tools
using clang as follows:
$ make -C genprotimg CC=clang
...
CC genprotimg/src/utils/curl.o
LINK genprotimg/src/genprotimg
/usr/bin/ld: genprotimg.o: `stderr@@GLIBC_2.2' non-PLT reloc for symbol defined in shared library and accessed from executable (rebuild file with -fPIC ?)
/usr/bin/ld: final link failed: bad value
collect2: error: ld returned 1 exit status
Therefore it makes sense to use the same compiler for linking as well.
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Acked-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Remove NO_PIE_LINKFLAGS and follow the naming convention by using
LDFLAGS for linker flags. Replace all occurrences accordingly.
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The "detour" with NUL terminated records ensures that sorting
works as expected for environment variables with values containing
one or more lines and thus '\n' as regular record separator.
Reviewed-by: Joern Siglen <siglen@de.ibm.com>
Signed-off-by: Steffen Maier <maier@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Make use of multipath-tools 0.8.9 commit
("libmultipath: add %L path wildcard for 64-bit hex LUN")
260d7cb411 .
Multipath-tools versions that do not know the format wildcard simply
ignore it and expand to an empty string, so it's backwards compatible.
Signed-off-by: Steffen Maier <maier@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Eases mapping of multipath paths and FCP by-path information
without having to use different tool output and correlate,
such as "multipathd -k'show topo'" and "lszfcp -D".
Possibly the HBA is reported as "[undef]" for zfcp
[without multipath-tools 0.8.9 commit
("libmultipath: support host adapter name lookup for s390x ccw bus")
852a1dfd94 ]
and the FCP LUN needs to be manually converted from the SCSI LUN in h:c:i:l.
While at it, append correlation information for block device name and
major:minor, as well as all information from a standard 'show paths',
which is the path state 3-tuple and next_check,
plus the number of path failures.
Example output:
$ multipathd -k'show paths format "%w|%a|%r|%p|%i|%d|%D|%t|%T|%o|%0|%C"'
uuid |host adapter|target WWPN |pri|hcil |dev|dev_t|dm_st |chk_st|dev_st |failures|next_check
3600507640081818ab00000000000025e|[undef] |0x500507680b2581fa|10 |0:0:0:606|sdb|8:16 |active|ready |running|0 |XXXXXX.... 13/20
3600507640081818ab00000000000025e|[undef] |0x500507680b2581fb|50 |0:0:1:606|sdc|8:32 |active|ready |running|0 |XX........ 4/20
3600507640081818ab00000000000025e|[undef] |0x500507680b2681fa|10 |1:0:0:606|sdd|8:48 |active|ready |running|0 |XXXX...... 8/20
3600507640081818ab00000000000025e|[undef] |0x500507680b2681fb|50 |1:0:1:606|sde|8:64 |active|ready |running|0 |XXXXXXX... 15/20
Signed-off-by: Steffen Maier <maier@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The new option -s, long --serial shows the serial numbers of
CCA and EP11 cards.
Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
New options:
--cardonly
--queueonly
which filter the output to show only card or queue information.
Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
New options:
--accelonly
--ccaonly
--ep11only
which restrict the output to only cards/queues with the given mode.
Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Newer kernel show a sysfs attribute chkstop which displays
the checkstop state of a crypto card. This patch enables
support for lszcrypt to display the checkstop state.
Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
If there is a max_msg_size attribute for the card
the lszcrypt -c option will show this limit as
AP bus max message size limit xx Kb
Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
On several distributions `pandoc` is not available via the default
repositories, and thus not available in the build environments for the
distribution packages. That means, the man page can't be bundled along
with the packages generated for those distributions.
But since this is a valuable asset for some users, instead of requiring
`pandoc` in order to have a man page be generated during the build, so it
can be installed, bundle a pre-cooked version that corresponds to the
current version of the `README.md` file. This way, the man page can always
be packaged, and is now always installed, even if `ENABLE_DOC` is set to
`0` (the default).
This also means, whenever the `README.md` file is changed, the bundled
man page needs to be regenerated, so it stays in sync. As a safeguard
we also add a checksum of the `README.md` file that is regenerated along
with the man page. This checksum is tested even when `pandoc` is not
available, and the user is notified whenever it runs out of sync (with a
hint as to how to remedy it).
Nothing changes for the compile/installation workflow, if `ENABLE_DOC` is
set to `1`.
Suggested-by: Jens Remus <jremus@linux.ibm.com>
Reviewed-by: Steffen Maier <maier@linux.ibm.com>
Signed-off-by: Benjamin Block <bblock@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Sometimes dumping a virtual machine from the outside is the only way to
get the data that is needed. This can be the case if a dumping mechanism
like kdump hasn't been configured or data needs to be fetched at a
specific point. Dumping a protected guest from the outside without help
from FW/HW doesn't yield sufficient data to be useful. Hence we now
introduce Protected Virtualization (PV) dump support.
The PV dump support works by integrating the firmware into the dump
process. New Ultravisor calls are used to initiate the dump process,
dump cpu data, dump memory state and lastly complete the dump process.
The guest's data is fully encrypted and can only be decrypted by the
entity that owns the customer communication key for the dumped guest.
Also dumping needs to be allowed via a flag in the SE header.
This patch adds support for PV guest dumps to genprotimg. To prepare a
PV image in order that the PV guest can later be dumped from the
outside, the user has to provide a customer communication key used for
the dump process and he has to set the corresponding control flag. For
specifying the customer communication key a new command line option
`--comm-key` is added and for enabling/disabling the control flag the
command line options `--enable-dump` and `--disable-dump` are added.
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Acked-by: Viktor Mihajlovski <mihajlov@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Declare `--enable-pckmo` and `--disable-pckmo` as mutually exclusive.
Let's define a helper macro for this which allows an easier definition
of mutually exclusive command line flags.
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Introduce a private macro for the calculation of the control flags and
sort the flags by bit value.
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Debian carried a patch forever that allowed zipl to run even if not all
menu items had files attached. If a required file is missing for an
entry (e.g. vmlinuz.old or initrd.img.old) and it is marked as
"optional" in the config, the section will be skipped. This allows
zipl to install after bootstrapping, as booting on s390 still relies
on the kernel/initrd symlinks in the root directory.
Closes: https://github.com/ibm-s390-linux/s390-tools/pull/2
Signed-off-by: Philipp Kern <pkern@debian.org>
Reviewed-by: Peter Oberparleiter <oberpar@linux.ibm.com>
[sth@linux.ibm.com: adapted patches to latest changes, merged patches]
Signed-off-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
This commit makes zgetdump work with /dev/mem again.
zg_seek() should not attempt to verify the given offset for devices before
issuing lseek() because special devices like /dev/mem report 0 in
stat.sb_size.
$ zgetdump -i /dev/mem
zgetdump: Trying to seek past file end "/dev/mem"
Fixes: 11e78cada5 ("zdump: catch attempts to seek past end of file in zg_seek()")
Signed-off-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
This change will group the commands executed for block and scsi devices
into a section with a comment.
By grouping, we intend to enhance the handling in our runtime.out file
and help to understand the purpose of command groups.
In addition we did get feedback for promoting some commands to the top.
Signed-off-by: Joern Siglen <siglen@de.ibm.com>
Reviewed-by: Sa Liu <saliu@de.ibm.com>
Reviewed-by: Mario Held <mario.held@de.ibm.com>
Reviewed-by: Steffen Maier <maier@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
This change will group the commands executed for Z device subsystem
into a section with a comment.
By grouping, we try to enhance the handling in our runtime.out file and
help to understand the purpose of command groups.
In addition we did get feedback for promoting some commands to the top.
lspci -t was added on request of SMEs during the discussions
Signed-off-by: Joern Siglen <siglen@de.ibm.com>
Reviewed-by: Sa Liu <saliu@de.ibm.com>
Reviewed-by: Mario Held <mario.held@de.ibm.com>
Acked-by: Nicklas Schnelle <Niklas.Schnelle@ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
This change will group the commands executed for overall state into a
first section with a comment.
By grouping, we intend to enhance the handling in our runtime.out file
and help to understand the purpose of command groups.
In addition we did get feedback for promoting some commands to the top.
Signed-off-by: Joern Siglen <siglen@de.ibm.com>
Reviewed-by: Sa Liu <saliu@de.ibm.com>
Reviewed-by: Mario Held <mario.held@de.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
This change will group the commands executed for crypto, special SW or
specific for a distro into sections with a comment.
By grouping, we intend to enhance the handling in our runtime.out file
and help to understand the purpose of command groups.
Signed-off-by: Joern Siglen <siglen@de.ibm.com>
Reviewed-by: Sa Liu <saliu@de.ibm.com>
Reviewed-by: Mario Held <mario.held@de.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
This change will group the commands with long output into two
sections with a comment.
By grouping, we intend to enhance the handling in our runtime.out file
and help to understand the purpose of command groups.
We did get feedback for moveing some independent long output files to
the end for speed up the scrolling in the upper parts.
Files which already have a separate output file are bundled in a
separate group at the end.
Signed-off-by: Joern Siglen <siglen@de.ibm.com>
Reviewed-by: Sa Liu <saliu@de.ibm.com>
Reviewed-by: Mario Held <mario.held@de.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
This change will regroup & reorder the commands executed for network.
By grouping, we intend to enhance the handling in our runtime.out file
and help to understand the purpose of command groups.
In addition we did get feedback for promoting some commands to the top.
"ip -br a" was added on request of SMEs during the discussions
Signed-off-by: Joern Siglen <siglen@de.ibm.com>
Reviewed-by: Sa Liu <saliu@de.ibm.com>
Reviewed-by: Mario Held <mario.held@de.ibm.com>
Acked-by: Sandy Winter <WINTERA@de.ibm.com>
Acked-by: Stefan Raspl <stefan.raspl@de.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
When lshwc is invoked with
# ./lshwc -a :P
lshwc: ioctl S390_HWCTR_START: Invalid argument
#
it returns an error instead of listing all problem state counters
of all online CPUs. The reason is an empty CPU list when it is
omitted and only a counter set is specified. Fix this.
Signed-off-by: Thomas Richter <tmricht@linux.ibm.com>
Acked-by: Sumanth Korikkar <sumanthk@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
With the introduction of libcpumf/libcpumf.a library there is no need
for this file anymore. Its defines have been moved to
include/lib/libcpumf.h are obsolete.
Signed-off-by: Thomas Richter <tmricht@linux.ibm.com>
Acked-by: Sumanth Korikkar <sumanthk@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Add a function to detect the existence of the CPU Measurement Sampling
Facility on a system.
Add a function which extracts the CPU Measurement Sampling Facility
characteristics on a system, such as
- minimum sample speed
- maximum sample speed
- current CPU speed
- basic sample size in bytes
- diagnostic sample size in bytes
Add a function to detect the existence of the CPU Measurement Sampling
Facility on a system and return the current sampling buffer management
characteristics, such as:
- minimum supported sampling buffer size
- maximum supported sampling buffer size
Add a function to detect the existence of the CPU Measurement Counting
Facility on a system.
Add a function which extracts the CPU Measurement Counting Facility
characteristics on a system, such as
- counter first version number
- counter second version number
- counter set authorization level
Add a function the returm the PMU type number of a CPU Measurement
Facility device driver. These numbers may vary between boots.
Signed-off-by: Thomas Richter <tmricht@linux.ibm.com>
Acked-by: Sumanth Korikkar <sumanthk@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
'which' tool is packaged separately from other core tools and there will
likely be scenarios where this check will fail because 'which' is
unavailable.
The "type" is builtin itself and should solve this problem.
For a built in command, we will not suppress error out -> removing 2>&1.
On this replace - in call_run_command - get cmd_type as variable only once
Reported by: Peter Oberparleiter <oberpar@linux.ibm.com>
Signed-off-by: Joern Siglen <siglen@de.ibm.com>
Reviewed-by: Mario Held <mario.held@de.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
a missing dump2tar command did show misleading error messages
now check it and give clear messages
Signed-off-by: Joern Siglen <siglen@de.ibm.com>
Reviewed-by: Mario Held <mario.held@de.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
as order itself does not matter for collection of log and config files,
we decided to use alphabetic order for better maintenance
Signed-off-by: Joern Siglen <siglen@de.ibm.com>
Reviewed-by: Mario Held <mario.held@de.ibm.com>
Reviewed-by: Steffen Maier <maier@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
critical paths in dump2tar data collection have been already excluded -
this update will sync the excludes in the fall back, running in case
dump2tar is missing or failing on a system
By this we also sync the filtering to match exact the same pattern.
Reported by: Steffen Maier <maier@linux.ibm.com>
Signed-off-by: Joern Siglen <siglen@de.ibm.com>
Reviewed-by: Sa Liu <saliu@de.ibm.com>
Fixes: 12c84469fd ("dbginfo.sh: exclude reading page_idle/bitmap sysfs
attribute")
Fixes: b627b8d8e1 ("Initial s390-tools-2.0.0 import")
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
adopt all indents to have the same setting overall - NO logic changes !
tooling: vim used with setting "shiftwidth=8",expandtab,autoindent
commands "gg=G",":retab"
some additional line brakes to stay below 100 chars
and one line added manual before "collect_procfs"
Signed-off-by: Joern Siglen <siglen@de.ibm.com>
Reviewed-by: Mario Held <mario.held@de.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
chzdev fails to generate correct cio_ignore udev-rules for a CCW device
with device number 0xffff. Also chzdev aborts due to a segmentation
fault when a CCW device with CSSID 0xff is configured. Both issues are
caused by off-by-one errors while interpreting CCW device ID limits
CSSID_MAX, SSID_MAX and DEVNO_MAX.
Fix these errors by correctly interpreting CCW device ID limits.
Signed-off-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Reviewed-by: Vineeth Vijayan <vneethv@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The endianness handling is already done before, so there is no need for
this function. Let's remove the useless `uint64_to_uint8_buf` function.
Suggested-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Currently, a device type setting being --removed from both the active and
persistent configuration via 'chzdev -t' can result in a scenario where
the setting is not removed from the active configuration (and an error
message is presented) but chzdev still proceeds to remove the setting from
the persistent configuration.
Update this logic so that devtype_remove_settings behaves the same way as
device_remove_settings and only perform the removal when no errors are
encountered.
Reported-by: Boris Fiuczynski <fiuczy@linux.ibm.com>
Reviewed-by: Jason J. Herne <jjherne@linux.ibm.com>
Reviewed-by: Boris Fiuczynski <fiuczy@linux.ibm.com>
Reviewed-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Signed-off-by: Matthew Rosato <mjrosato@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Extend cpictl to report Linux distribution type and version information,
and another sublevel of Linux kernel version data via the system level
field of the SCLP CPI firmware interface. This data is intended to be
decoded by the IBM Z HMC web-UI to provide users a more detailed view of
Linux software levels installed in LPARs.
For this purpose, the format of the 64-bit system level word is extended
in a compatible way, that is, the meaning of existing fields remains
unchanged while additional data is added to previously unused fields.
The new format is defined as 0xabccddeeeeffgghh, where:
- a=statistics flags
- b=distro id
- c=distro major version
- d=distro minor version(s)
- e=kernel sublevel 2
- f=kernel version
- g=kernel patchlevel
- h=kernel sublevel 1
This format will be automatically reported for supported distributions
based on data from /etc/os-release. As before, users can override the
data by specifying a custom system level word in /etc/sysconfig/cpi.
To support manual specification of new data fields, the format of
cpictl's -L command line option and the CPI_SYSTEM_LEVEL environment
variable are extended as follows:
- 0x<level>
Specifies the system level as 64 bit hex value
- [[[flags:]distro_id:distro_version:]kernel_version]
Specifies the system level as list of optional fields. Any field that
is omitted is initialized with automatically determined values.
Signed-off-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Acked-by: Viktor Mihajlovski <mihajlov@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
In the past s390 used a fixed command line length of 896 bytes. This has
changed with newer Linux kernels. There is now a parm area indicating
the maximum command line size. This parm area has always been
initialized to zero, so with old kernels this field would read zero and
we must then assume that only 896 bytes are available.
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
EditorConfig (https://editorconfig.org/) defines a file format for
defining coding styles. The most common editor do either provide native
support or via plugin support for EditorConfig.
This patch adds an EditorConfig configuration for s390-tools.
Acked-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
zdev provides path resolution logic to determine which z-specific
devices contribute to the file system mounted at a specific mount point.
This logic is used by command-line option --by-path, but also to
determine the list of devices needed to enable the root file system.
Path resolution fails when a device provides multiple mount points such
as, for example, when using btrfs subvolumes, or when mounting the same
file system at multiple mount points. The failure is caused by zdev
relying on the MOUNTPOINT attribute of lsblk's output which only
contains a single mount point.
Fix this by making use of lsblk's MOUNTPOINTS attribute that contains
the full list of mount points. Note that MOUNTPOINTS was only introduced
with util-linux v2.37, therefore a fall-back to the old format is
needed.
Fixes: https://github.com/ibm-s390-linux/s390-tools/issues/129
Signed-off-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Reviewed-by: Vineeth Vijayan <vneethv@linux.ibm.com>
Reviewed-by: Eduard Shishkin <edward6@linux.ibm.com>
Reported-by: Dan Horák <dan@danny.cz>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
lshwc allows to specify a list of CPUs, for example
# ./lshwc -a 2-3,66-68:b
Date,Time,CPU,CPU_CYCLES(0),INSTRUCTIONS(1),L1I_DIR_WRITES(2),....
2022-01-21,12:51:54,CPU2,68762,20999,283,14157,601,87255
2022-01-21,12:51:54,CPU3,70514,21179,288,10654,586,90188
2022-01-21,12:51:54,CPU4,48504,21018,141,7831,438,78494
2022-01-21,12:51:54,Total,187780,63196,712,32642,1625,255937
#
However, as seen on the output, the CPU list is incorrect. It shows
CPUs 2, 3 and 4 even when only CPU 2 and 3 was requested. CPUs 66, 67
and 68 have not been online and can not be displayed.
What happens is a wrong parameter conversion for the device driver.
CPUs 66, 67 and 68 are passed to the device driver as CPUs 2 3 and 4
and that data is returned.
Fix this and submit a CPU list with correct bit ordering:
# ./lshwc -a 2-3,66-68:b
Date,Time,CPU,CPU_CYCLES(0),INSTRUCTIONS(1),L1I_DIR_WRITES(2),...
2022-01-21,12:59:18,CPU2,50753,18042,246,10972,494,60345
2022-01-21,12:59:18,CPU3,54002,20390,232,9219,511,66033
2022-01-21,12:59:18,Total,104755,38432,478,20191,1005,126378
#
Reported-by: Sumanth Korikkar <sumanthk@linux.ibm.com>
Signed-off-by: Thomas Richter <tmricht@linux.ibm.com>
Acked-by: Sumanth Korikkar <sumanthk@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Fix Sparse findings like:
warning: symbol 'hash_table_find' was not declared. Should it be static?
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Since version 2.37.x, with the commit 58b510e58 ("libsmartcols: sanitize
variable names on export output"), util-linux changes the output
characters of lsblk, where the ":" is replaced with an "_". Align the
lsblk output parser function in lszdev as per this change.
Signed-off-by: Vineeth Vijayan <vneethv@linux.ibm.com>
Suggested-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Reported-by: Boris Fiuczynski <fiuczy@linux.ibm.com>
Reviewed-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Reviewed-by: Boris Fiuczynski <fiuczy@linux.ibm.com>
Tested-by: Boris Fiuczynski <fiuczy@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Add a prophylactic check that @filename is not NULL before its
dereference.
This addresses the following warning (which is a false positive,
since stat(2) is never called with NULL file name):
job.c:514:13: warning: argument 1 null where non-null expected
[-Wnonnull]
514 | if (stat(filename, &stats)) {
| ^~~~~~~~~~~~~~~~~~~~~~
In file included from /usr/include/features.h:488,
from /usr/include/errno.h:25,
from job.c:13:
job.c: In function 'check_job_ipl_data':
/usr/include/sys/stat.h:227:12: note: in a call to function
'stat' declared 'nonnull'
227 | extern int __REDIRECT_NTH (stat, (const char *__restrict __file,
Fixes: https://github.com/ibm-s390-linux/s390-tools/issues/127
Reported-by: Mario Held <mario.held@de.ibm.com>
Signed-off-by: Eduard Shishkin <edward6@linux.ibm.com>
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Under certain conditions, e.g. in a KVM guest, a write operation
to /sys/firmware/cpi/set can result in an error message to
stderr while the script returns with a zero exit code, indicating
success.
This can cause confusion if cpictl is called by systemd due to
the existence of a writable /sys/firmware/cpi/. Let's silence
cpictl when writing to the /sys/firmware/cpi/set. This is OK, as
nothing can be inferred from failure or success from the perspective
of the invoking Linux instance.
Fixes: https://github.com/ibm-s390-linux/s390-tools/issues/120
Signed-off-by: Viktor Mihajlovski <mihajlov@linux.ibm.com>
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The maximum command line length is now dependent on the kernel image
that is loaded. Therefore move the check to check_common_ipl_data().
This function now reads the new kernel image, and check whether the
command line length is in the allowed range.
The command line size limit in zipl is now set to 64k, which is hopefully
enough.
Signed-off-by: Sven Schnelle <svens@linux.ibm.com>
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
There are two places where we check whether the initrd and kernel image
is readably. Add one helper function that checks this. This is also a
preparation for the extended command line handling, so that we have to
add that code in only one location.
Signed-off-by: Sven Schnelle <svens@linux.ibm.com>
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
There are quite a few places that do:
if (section == NULL) {
error_text("file '%s'", file);
} else {
error_text("file '%s' in section '%s'", file, section);
}
Add a helper function to deduplicate that.
Signed-off-by: Sven Schnelle <svens@linux.ibm.com>
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Most of get_*_components() and finalize_*_address_data() is the same
for normal ip, tape and dump types, so we can unify that.
Signed-off-by: Sven Schnelle <svens@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Add a small helper function to free the common ipl data to avoid
having the same code duplicated multiple times. Also remove the if()
check before the free as it is allowed to pass NULL pointers to free().
Signed-off-by: Sven Schnelle <svens@linux.ibm.com>
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Each ipl type takes at least a kernel image, parameter line and initrd
parameter. This is duplicated all over the place in the current
implementation. To simplify this, add struct job_common_ipl_data which
will hold this data.
Signed-off-by: Sven Schnelle <svens@linux.ibm.com>
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
This adds support for long command lines. The boot loader stages
will no longer use a fixed limit when copying the command line, but
will use the maximum length from the kernel image that is being loaded.
Signed-off-by: Sven Schnelle <svens@linux.ibm.com>
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The assembly code in tape0.S loads the kernel from tape to offset 0x4000.
After loading the kernel it loads the parm file and stores it to the
address provided by zipl. zipl doesn't know about the 0x4000 load offset,
so this address is inside of the kernel image and will silently corrupt
the loaded image in memory.
Fix this by copying the kernel to the final destination before loading
the parm files and initrd. We can do this because we can strip the first
0x10000 bytes like the zipl C code does for non-tape IPL.
Signed-off-by: Sven Schnelle <svens@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
No need to use memcpy() and carry the length around all the time.
Switch to using strlcpy() to simplify the code.
Signed-off-by: Sven Schnelle <svens@linux.ibm.com>
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Compiling against fuse3 shows 'incompatible pointer type' warnings due
to the additional function arguments in the new API.
Therefore, adjust the declarations of zdsfs_getattr() and
zdsfs_readdir() to match.
GitHub-ID: https://github.com/ibm-s390-linux/s390-tools/pull/117
Signed-off-by: Graham Inggs <ginggs@debian.org>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Compiling against fuse3 shows 'incompatible pointer type' warnings due
to the additional function arguments in the new API.
Therefore, adjust the declarations of hmcdrv_fuse_getattr(),
hmcdrv_fuse_readdir() and hmcdrv_fuse_init() to match.
GitHub-ID: https://github.com/ibm-s390-linux/s390-tools/pull/117
Signed-off-by: Graham Inggs <ginggs@debian.org>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Compiling against fuse3 shows 'incompatible pointer type' warnings due
to the additional function arguments in the new API.
Therefore, adjust the declarations of cmsfs_getattr(), cmsfs_readdir(),
cmsfs_utimens(), cmsfs_rename() and cmsfs_truncate() to match.
GitHub-ID: https://github.com/ibm-s390-linux/s390-tools/pull/117
Signed-off-by: Graham Inggs <ginggs@debian.org>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
When `make install` is called with parallel execution enabled (e.g.:
`-j2`), the dependencies for the necessary directories are not correct.
The `install` target depends on `install_dirs`, which creates the
necessary directories, and needs to run before any of the
`chreipl-fcp-mpath-install*` targets that have prerequisites on these
directories; but the `chreipl-fcp-mpath-install*` targets have
indirectly the same "hierarchy level" as `install_dirs`, and no direct
dependency on it.
Simplified it looks like this:
install: install_dirs chreipl-fcp-mpath-install
chreipl-fcp-mpath-install: chreipl-fcp-mpath-install-udev-rules ...
This works fine with only one job, as `install_dirs` will be satisfied
first, before recursing into any other branch of the dependency tree.
But if we have more than one job, there is nothing in the rules that
prevents Make from working on both branches - `install_dirs` and
`chreipl-fcp-mpath-install` - at the same time, and so
`chreipl-fcp-mpath-install-udev-rules` might run before `install_dirs`,
and end up with a unsatisfied dependency:
make[2]: *** No rule to make target '/usr/lib/udev/rules.d', needed by 'chreipl-fcp-mpath-install-udev-rules'. Stop.
Fix this by adding direct dependencies on `install_dirs` for all the
directory prerequisites of `chreipl-fcp-mpath-install*` targets. This
way Make will need to satisfy `install_dirs` before it can work on any
of the other targets, and so the necessary directories will be created
in the correct order.
Reported-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Reviewed-by: Steffen Maier <maier@linux.ibm.com>
Tested-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Benjamin Block <bblock@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
This fixes the sparse warning:
utils/crypto.c:443:68: warning: Using plain integer as NULL pointer
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
This change allows mocking of print macros in unit tests.
Being able to do this in unit tests, enables us to catch output from
zgetdump functions and test it.
Signed-off-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
_zg_err_errno() should save the current errno value before calling any
libc functions because they could change it. Failing to do so, may result
in _zg_err_errno() displaying an incorrect error message.
Signed-off-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
This change allows mocking of error/abort macros in unit tests.
Being able to do this in unit tests, enables us to test error conditions w/o
terminating the unit test runner.
The new error functions do not have "noreturn" attribute because
this would make mocking of them in unit tests impossible. We must not
compile these functions as noreturn because we need to return from them
in unit tests and returning from a noreturn function is an undefined
behavior in the C++ standard!
For more details:
- ISO/IEC 14882:2017, Chapter 10.6.8 "Noreturn attribute""
- https://en.cppreference.com/w/cpp/language/attributes/noreturn.
Signed-off-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
It is unusual to write the file output from a tool to stdout. Therefore
add a positional argument to the zgetdump convert action where the
output file can be specified. If no positional argument is given the
output is written to stdout as before and therefore there is no change
in the default behavior.
If the file output already exists an error is returned. The reason for
this is to avoid the situation where an existing dump is accidentally
overwritten by the user.
Reviewed-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The keyword extern before a function declaration is not required with
modern C compilers.
Signed-off-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The primary goal of this change is to split DFO ELF module into
multiple smaller ones for better unit testability.
The change doesn't introduce any functionality changes, just shuffling code
around.
Signed-off-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The primary goal is to separate DFO code into multiple smaller modules
and make it unit testable.
This refactoring only moved the code around w/o changing any functionality.
Signed-off-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Without the fix, readers of syslog / systemd-journal can erroneously
think that dbginfo.sh was incomplete because the last logged step is
"17 of 18".
The fix also makes the missing line appear in dbginfo.log inside the
generated DBGINFO....tgz.
s390-tools v2.17.0 commit b7807d0195 ("dbginfo.sh: Add KVM commands
and rework data collection") turned create_package into a numbered
step.
Snippet of terminal output:
...
17 of 18: Postprocessing
18 of 18: Finalizing: Creating archive with collected data
Collected data was saved to:
>> /tmp/DBGINFO-....tgz <<
Please review all collected data before sending to your service organization.
Syslog before:
...
dbginfo.sh[...]: 17 of 18: Postprocessing
dbginfo.sh[...]: Data collection completed
Syslog after:
...
dbginfo.sh[...]: 17 of 18: Postprocessing
dbginfo.sh[...]: 18 of 18: Finalizing: Creating archive with collected data
dbginfo.sh[...]: Data collection completed
Fixes: b7807d0195 ("dbginfo.sh: Add KVM commands and rework data collection")
Signed-off-by: Steffen Maier <maier@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Remove the call to `gzip` before installing the manpage during the
`make install` call. What and if compression is done should be handled by
the distribution tooling.
This also removes a dependency for the build process.
Reviewed-by: Steffen Maier <maier@linux.ibm.com>
Signed-off-by: Benjamin Block <bblock@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
`chreipl-fcp-mpath-common.sh.in` is never executed, only used as argument
for `source` in the udev helper scripts, so the shebang is unnecessary, and
might be confusing.
Also, tools like `rpmlint` from the rpm software management will complain
about this; e.g.:
s390-tools-chreipl-fcp-mpath.s390x: W: non-executable-script /usr/lib/chreipl-fcp-mpath/chreipl-fcp-mpath-common.sh 644 /bin/bash
Reviewed-by: Steffen Maier <maier@linux.ibm.com>
Signed-off-by: Benjamin Block <bblock@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
...to make clear why `off` is initialized to 0 and that all calls to
`dfo_chunk_add` occur for the same reason. For consistency reasons adapt
the `off` value calculation as well.
Reviewed-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Rename the parameter `ptr` of `notes_init` to something meaningful. Since
it points to the start of the notes segment rename it to `segment_start`.
In addition, improve the documentation for the function.
Reviewed-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Use `mem_chunk->size` instead of recalculate it. In addition, assign
`p_vaddr` to `p_paddr` to make clear that they must be equal and rename the
parameter `load_offset` to `elf_offset` to make clear that the offset in
the ELF vmcore file is meant. Finally rename `loads_init` to
`load_phdrs_init`.
Reviewed-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
This cast makes the macros easier to use without getting compiler warnings.
e.g.
dfo_elf.c: In function 'dfo_elf_init':
dfo_elf.c:343:20: warning: assignment to 'Elf64_Phdr *' from incompatible pointer type 'char *' [-Wincompatible-pointer-types]
343 | phdrs_load = PTR_ADD(phdr_notes, sizeof(Elf64_Phdr) * phdrs_notes_count);
Reviewed-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
With gcc < 8.1 the following compile error occurs:
lshwc.c:52:37: error: initializer element is not constant
static unsigned int read_interval = ioctlsleep, cfvn, csvn, authorization;
^~~~~~~~~~
Even though this gcc bug was fixed in gcc 8.1+, change the constant
definition to a #define to make the tool compile with older compilers as
well.
Link: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=69960
Link: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=66618
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Add a README.md for chreipl-fcp-mpath and infrastructure to build and
install a man page generated from the README.md. Building and installing
of the man page is only done when supplying the make option `ENABLE_DOC=1`
(per default disabled). The `pandoc` utility is used to build the man page.
The README.md is reused since there is no other tool or command as part of
chreipl-fcp-mpath that needs to be documented in a separate man page.
Also add information about chreipl-fcp-mpath to the main README.md and
CHANGELOG.md.
Reviewed-by: Steffen Maier <maier@linux.ibm.com>
Signed-off-by: Benjamin Block <bblock@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Add a dracut configuration file that might optionally be installed along
with the toolset (per default to: $(USRLIBDIR)/dracut/dracut.conf.d). It
causes the udev rules and helper scripts to be included into an initial
ramdisk, when (re-)built with dracut; along with any dependency.
This is only done when passing `HAVE_DRACUT` set to 1 during the
installation (default is 0), e.g.: make install HAVE_DRACUT=1.
Enabling the toolset during the initial ramdisk phase has the advantage
that paths can be audited earlier in the life cycle of this Linux
runtime, e.g. to record the WWID in the ID-file.
Reviewed-by: Steffen Maier <maier@linux.ibm.com>
Signed-off-by: Benjamin Block <bblock@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
In the final step of the udev rules toolset, we either know that the
current event subject is the re-IPL target, a dm-multipath device with
the re-IPL target, or represents the same volume based on its WWID. As
such it is a candidate to replace the current re-IPL target.
The new helper `chreipl-fcp-mpath-try-change-ipl-path` will use the
subject itself - in case it is a single scsi disk -, or the dm-multipath
device, to test whether there is a path in a good state.
"Good state" is based on the zfcp device driver state
(<SDEV>/zfcp_failed, <SDEV>/zfcp_in_recovery), the scsi_transport_fc
port state (<SDEV>/../../fc_remote_ports/rport-*/port_state), and the
scsi device state (<SDEV>/state). A path is only considered if they all
indicate a device in good conditions.
If such a path is found, the helper will try to set it as new re-IPL
target regardless of whether the current re-IPL is still in good shape
or not. This is by design, and done to reduce complexity in further
state checking, and prevention of races with overlapping events in udev
(when executing in parallel workers).
Whenever a new re-IPL target is selected and set in
/sys/firmware/reipl/fcp/{device,wwpn,lun}, the helper will also update
the records in the ID-file - otherwise they might appear as stale, when
they aren't.
This step in the udev rule processing might also result in log messages
written to the syslog (using the utility `logger` from util-linux;
writing to /dev/log).
In case the re-IPL target is changed, a message with level notice is
logged, informing about the new target.
In case no good path is found as part of a dm-multipath device, a
message with level critical is logged, as it might result in a failed
re-IPL if no path is available.
Lastly, when changing the information in /sys/firmware/reipl/fcp/ fails
for whatever reason, a message with level alert is logged, as the
written information might be inconsistent and must be audited/corrected
manually by an operator.
Reviewed-by: Steffen Maier <maier@linux.ibm.com>
Signed-off-by: Benjamin Block <bblock@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
When the first test, whether the current event subject represents the
re-IPL target failed, we attempt a second test, using the recorded WWID
of a previously successful attempt.
The new helper `chreipl-fcp-mpath-is-ipl-vol` utilizes the information
previously stored in the ID-file (read under lock via `flock`).
The recorded WWID is compared with the one of the event subject; if it
matches we know that it addresses the same volume, and might be used as
alternative re-IPL target.
Additionally we also compare the current re-IPL triplet with the one
recorded in the ID-file. If it doesn't match anymore, we assume the
recorded WWID is stale - e.g., because the operator changed the re-IPL
target manually - and the previous check invalid.
If both the WWID match, and the re-IPL triplet is still the same as
previously recorded, the toolset may continue with the subject, and use
it as replacement for the current re-IPL target.
Reviewed-by: Steffen Maier <maier@linux.ibm.com>
Signed-off-by: Benjamin Block <bblock@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
When built with `D=1` chreipl-fcp-mpath automatically creates debug data
for the helpers that run during udev event processing. This is the only
way to effectively debug what is happening during event processing in
chreipl-fcp-mpath.
Collect this data under its default path in /run/udev/.
Also collect the chreipl-fcp-mpath statefile which contains WWID, Device
Bus-ID and LUN of the last path that was detected to represent a FCP
re-IPL device.
Suggested-by: Steffen Maier <maier@linux.ibm.com>
Reviewed-by: Steffen Maier <maier@linux.ibm.com>
Signed-off-by: Benjamin Block <bblock@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
When we have identified the current event subject to represent the
re-IPL target, we record its WWID for future identification in a
stateful ID-file (per default: /run/udev/chreiplzfcpmp-ipl-volume-id). In
addition to the WWID, we also record the current re-IPL triplet
(<Dev-Bus-ID>:<WWPN>:<LUN>), so that when that changes - e.g. due to an
operator manually changing the re-IPL target -, we know that the
recorded WWID is stale.
This record may be used in cases when the current re-IPL target is
completely gone from the system, so we can't used it as comparison
object for when events arrive for paths that go to the same volume, but
don't have the same I_T_L nexus. They however have the same WWID. We
may use these (new) paths as replacement for the one that is completely
gone.
The new helper `chreipl-fcp-mpath-record-volume-identifier` uses the
kernel scsi-device attribute `wwid` as source for the WWID (verbatim).
As with reading the re-IPL firmware information, when writing to the
ID-file, a lock is taken via `flock`, to prevent overlapping
writes/reads to the file.
Reviewed-by: Steffen Maier <maier@linux.ibm.com>
Signed-off-by: Benjamin Block <bblock@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Now that we know that the system uses s390x IPL and the current re-IPL
target is from FCP, whenever we get a udev event that indicates a path
state changed, we have to figure out whether it affects the path that is
currently set as re-IPL target, or goes to the same volume (so we might
use it as alternative re-IPL path).
Add a new helper `chreipl-fcp-mpath-is-ipl-tgt` for this task.
Based on the information provided in
/sys/firmware/reipl/fcp/{device,wwpn,lun} it figures out whether the
current event subject has the same triplet <Dev-Bus-ID>:<WWPN>:<LUN> (in
T10 SCSI: I_T_L nexus), or whether one of its parts (in case of
dm-multipath) has.
If true, we know for sure, that we deal with an event affecting the
current re-IPL setting, and continue.
When accessing the re-IPL firmware information a lock is taken via the
`flock` utility (from util-linux). This is done so concurrent changes
from the toolset, that are added in a later commit, don't result in
inconsistent reads.
Reviewed-by: Steffen Maier <maier@linux.ibm.com>
Signed-off-by: Benjamin Block <bblock@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Add second filter stage to the udev rules: only continue with the
toolset, if the system uses s390x IPL and if the current re-IPL target
is from FCP.
For the test, whether the next re-IPL target is planned to be done from
FCP, a helper `chreipl-fcp-mpath-is-reipl-zfcp` is added, and the
information in /sys/firmware/reipl/reipl_type is used.
If either one or both of the tests are not true, the udev rules will
exit.
For debugging, the toolset can be built with the Make variable `D` set
to 1 (e.g.: make D=1; make install D=1). This causes the toolset to
write shell traces of the helper to $(DEBUGOUTDIR) (per default:
/run/udev); otherwise no output is generated. `dbginfo.sh` will be
changed to collect this data automatically.
Reviewed-by: Steffen Maier <maier@linux.ibm.com>
Signed-off-by: Benjamin Block <bblock@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Add a new tool to s390-tools: chreipl-fcp-mpath. A toolset based on udev
to change the active re-IPL target if the current target goes into an
error-state, due to for example a pulled cable.
Add the base infrastructure consisting of a Makefile and a base set of
udev rules. Integrate the Makefile into s390-tools Make machinery.
The rules filter events base on the event subject type (dm-multipath,
scsi disk), udev action (change, or add), and device mapper action
(path failure, or path reinstated). No further processing is done right
now in case of a match; if neither of these criteria matches, the
rules exit, and the toolset won't be invoked.
Reviewed-by: Steffen Maier <maier@linux.ibm.com>
Signed-off-by: Benjamin Block <bblock@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
running mpio data disks with offline paths might cause dbginfo
to hang up on the command "blockdev --report" -> we remove
it to ensure a non blocking data collection.
In addition we add a second kill step with the same timeout
value to retry stopping a command
Signed-off-by: Joern Siglen <siglen@de.ibm.com>
Reviewed-by: Mario Held <mario.held@de.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Always clear the COMMAND_LINE_EXTRA region, also in case sclp_setup()
fails. If the region is not cleared properly, there might be junk
in there after a reboot, causing confusion for the kernel later.
While we're at it, also switch to COMMAND_LINE_EXTRA_SIZE instead
of COMMAND_LINE_SIZE, since that constant is more appropriate here.
Closes: https://github.com/ibm-s390-linux/s390-tools/pull/122
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
With an upcoming patch the output target can be different to `stdout`.
Therefore, the term `ZG_ACTION_STDOUT` is no longer generic enough. In addition,
rename `do_write` to `do_copy` to match the enum name.
Reviewed-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Currently, for some commands (e.g. `zgetdump unmount`) unused positional
arguments are silently ignored, for some commands (`zgetdump mount`) they're
not. Therefore let's fix this by always returning an error message and exit code
if too many positional arguments are given.
Reviewed-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
In case the hsci tool was upgraded on a running system, it can happen
that an hsci interface exists, that was created by an older version of
the tool (and thus has no veth pair). Add support to show and delete
such an hsci interface.
Signed-off-by: Alexandra Winter <wintera@linux.ibm.com>
Reviewed-by: Wenjia Zhang <wenjia@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Without kernel commits
f7936b7b2663 s390/qeth: Update MACs of LEARNING_SYNC device
4e20e73e631a s390/qeth: Switchdev event handler
60bb1089467d s390/qeth: Register switchdev event handler
HSCI cannot be used with multiple MACs, but the single MAC usecase needs
to be supported even with old kernel. So manually setting the same single
MAC on hsci, HiperSockets and the external interface is still required.
The hsci itself is not a bridgeport, so a static forwarding rule in the
bridge is also required. It seems cleaner to use the initial MAC of the
veth hsci as single static MAC, than the initial MAC of the HiperSockets
interface.
Even with an updated kernel a single static MAC interface, that is not
subject to ageing and re-learning, is beneficial when hsci is used as
a single MAC interface.
Signed-off-by: Alexandra Winter <wintera@linux.ibm.com>
Reviewed-by: Wenjia Zhang <wenjia@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The first implementation of HSCI (HiperSockets Converged Interface)
supports only a single static MAC address per HSCI and thus constructs
like MACVTAP or OpenVSwitch cannot be used on top of it.
Kernel commits
f7936b7b2663 s390/qeth: Update MACs of LEARNING_SYNC device
4e20e73e631a s390/qeth: Switchdev event handler
60bb1089467d s390/qeth: Register switchdev event handler
changed the behaviour of a LEARNING_SYNC HiperSockets (HS) device
such that any MAC address that is added or learned on a non-isolated
bridgeport of the HSCI bridge is set on the LEARNING_SYNC HS device and
its isolated siblings.
So no new trigger is required for a HS device with the bridge attribute
LEARNING_SYNC to support multiple MACs on a northbound HSCI interface.
However the first implementation of the hsci tool uses the bridge itself
as northbound HSCI interface. This is not treated as a real bridgeport.
So we add a veth bridgeport as northern link for HSCI.
Signed-off-by: Alexandra Winter <wintera@linux.ibm.com>
Reviewed-by: Wenjia Zhang <wenjia@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Instead of checking for ideal starting conditions, try to achieve
the desired outcome and accept conditions that do not prevent it.
This allows the user to get to a defined state, even if the
hsci interface was manipulated by other means than the hsci tool,
e.g. by ip commands or bridge commands
Minor cleanup:
hsci show:
- display PNET_ID, even if only one hsci port has one
(e.g. if External is a bond)
- only 1 header for mulitple hscis
hsci add:
- sanitize error messages
- allow nonsense HSCI of 2 HiperSockets
Signed-off-by: Alexandra Winter <wintera@linux.ibm.com>
Reviewed-by: Wenjia Zhang <wenjia@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Don't include dfi_mem_chunk.h in dfi.h because not every module including
dfi.h needs it.
Signed-off-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Separate the definition of a struct from the declaration of a global
variable of the type. To improve readability.
Signed-off-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Create a separate C header for STDOUT to separate independent things and
make it more readable.
Signed-off-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Set DFO format after the parsing of command-line arguments is done.
The command-line argument parsing should be independent of DFO.
This improves testability of the command-line argument parsing and
separates independent things from each other.
Signed-off-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Make the C module responsible for the parsing of command-line arguments
independent of other global variables. This improves its testability.
Signed-off-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Get rid of C headers which include everything. This is bad for testing and
maintainability. C files should include only what they need and no more.
Signed-off-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Create a separate C header for FUSE to separate independent things and
make it more readable.
Signed-off-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Create a separate C header for DFI VMCOREINFO to separate
independent things and make it more readable.
Signed-off-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Replace magic values with descriptive names to improve readability.
Signed-off-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
To prevent segmentation faults when the function dfi_mem_phys_read() is
given invalid parameters, check that the given memory range falls within
a known physical memory chunk, just like it is done for dfi_mem_virt_read().
Signed-off-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The new name describes the purpose of the function better and
emphasizes its difference with the function dfi_mem_phys_read().
Signed-off-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Always use the function dfi_mem_read_rc() which verifies that the given
address and size fall within a valid memory chunk. We cannot trust
user's input.
Signed-off-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The function dfi_mem_chunk_virt_add() is used only internally and should
not be exported to prevent misuse.
Signed-off-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The keyword extern is redundant for function declarations in C headers.
Signed-off-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Set stage3_parms.envblk_len to 0, if add_envblk is false.
This fixes segmentation fault when performing job with
not defined zIPL environment (e.g. installing SCSI dump)
Signed-off-by: Eduard Shishkin <edward6@linux.ibm.com>
Tested-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
PCI and crypto devices defined using the IBM Z Dynamic Partition Manager
(DPM) will start in an offline/unconfigured state that requires manual
intervention before the associated Linux function can be used. This
results for example in PCI networking interfaces being unavailable in a
distribution installer system.
Fix this by providing a udev rule and initial RAM-disk logic that
automatically enables PCI and crypto devices either during boot, or when
they are defined at run-time. This processing can be suppressed by
specifying the "rd.zdev=no-auto" parameter on the kernel command line.
Auto-configuration is limited to Linux running in DPM LPARs because
PCI-functions and crypto devices defined by DPM are always intended for
use by a single LPAR only.
For Linux running in classic-mode LPARs or virtual machines, leaving PCI
and crypto devices in an offline state may be useful to allow defining a
device as available to multiple systems, where only the system that
intends to make use of the device should enable it.
Signed-off-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Add an internal tool intended to be used by udev rules to determine
zdev and hypervisor related system information in key=value format.
Supported keys are:
ZDEV_NEST_LEVEL=n
Virtualization nesting level of running system
ZDEV_HYPERVISOR_<n>=LPAR|z/VM|KVM/Linux
Type of hypervisor that provides virtualization at nesting level <n>
ZDEV_IS_DPM=0|1
Indicator if top-level LPAR is managed by Dynamic Partition Manager
ZDEV_NO_AUTO=0|1
Indicator if auto-configuration is requested
Signed-off-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
zgetdump is for analyzing VM coredumps and not user space coredumps therefore
return an error in case of a user space coredump.
Reviewed-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Add new tool named 'sclpdbf'. This script displays the contents of
s390dbf sclp debug logs in human-readable format.
Signed-off-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Added a tool to operate with zIPL environment, currently
installed in the boot record. All modifying operations result
in atomic update of the installed environment block, bypassing
the file system driver.
Operations currently supported by zIPL environment editor:
. set/unset environment variables,
. print/reset environment
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Reviewed-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Signed-off-by: Eduard Shishkin <edward6@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
from disk.c to a dedicated source file fs-map.c, so that the new
zipl-editenv tool will be also able to use it.
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Reviewed-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Signed-off-by: Eduard Shishkin <edward6@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Before starting the kernel:
1. parse environment block (if any) and create a hash table
of all found pairs (NAME, VALUE);
2. scan the command line, which already contains extra-parameters
(if any), and for each found ${NAME} replace it with VALUE, as
found in the hash table by NAME.
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Reviewed-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Signed-off-by: Eduard Shishkin <edward6@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
When installing a boot record for "ipl" and "menu" job, always add
an environment block as a boot component located in bootmap file
at offset alinged on file system block size boundary. When adding,
first try to import environment from a file at location specified
by newly introduced "--environment" zipl option, or by default at
"/etc/ziplenv". If nothing was imported, then add a blank environment
block. Optionally print the content of the environment block.
Store environment block size and address (as of boot component) in
stage3_parms.
Change interface of add_ipl_program(): add 2 additional arguments:
a pointer to bootmap file name and a predicate indicating if we
need to add environment block as a boot component.
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Reviewed-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Signed-off-by: Eduard Shishkin <edward6@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Provide helper functions disk_write_block_buffer_align()
and add_component_buffer_align() to align offset of the record
on specified block size boundary and to save the offset, where
the record was made at.
This will be used by a later patch.
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Reviewed-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Signed-off-by: Eduard Shishkin <edward6@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
. expand interface of disk_get_blocklist_from_file() to get
block pointers for a specific range of data within a file.
. provide a helper function add_component_file_range() to add a
specific range of data within a file as a boot component.
This will be used by a later patch.
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Reviewed-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Signed-off-by: Eduard Shishkin <edward6@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
This fixes the following Valgrind finding:
==28040== Syscall param rt_sigaction(act->sa_flags) points to uninitialised byte(s)
==28040== at 0x48C98B0: __libc_sigaction (sigaction.c:58)
==28040== by 0x10D507: sig_handler_init (zgetdump.c:58)
==28040== by 0x10D507: main (zgetdump.c:179)
==28040== Address 0x1ffefffc84 is on thread 1's stack
==28040== in frame #0, created by __libc_sigaction (sigaction.c:43)
Reviewed-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Fix the following incorrect help text line:
-T, --file-timeout (null) Stop reading file after SEC seconds
Signed-off-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Sanity check ELF notes descriptor size before reading it. This prevents
stack buffer overflows in case a dump contains invalid ELF notes.
Instead of reading a note's descriptor into a temporary buffer on stack,
read it directly into the buffer given to nt_read() but also provide
a maximum length of the given buffer to nt_read() in order to prevent
overflows.
This problem was found with valgrind and AFL fuzzing + ASAN.
AFL + ASAN findings:
[root@t83lp49 s390-tools]# ./zdump/zgetdump -iVVVVV ~/zgetdump-fuzzing/findings/crashes/id\:000008\,sig\:06\,src\:000007\,op\:arith8\,pos\:67\,val\:+3
TRACE: DFI initialization
DEBUG: DFI trying s390tape
DEBUG: DFI s390tape returned with rc -19
DEBUG: DFI trying devmem
DEBUG: DFI devmem returned with rc -19
DEBUG: DFI trying s390mv_ext
DEBUG: DFI s390mv_ext returned with rc -19
DEBUG: DFI trying s390mv
DEBUG: DFI s390mv returned with rc -19
DEBUG: DFI trying s390_ext
DEBUG: DFI S390 extended initialization
DEBUG: DFI s390_ext returned with rc -19
DEBUG: DFI trying s390
DEBUG: DFI S390 initialization
DEBUG: DFI s390 returned with rc -19
DEBUG: DFI trying lkcd
DEBUG: DFI lkcd returned with rc -19
DEBUG: DFI trying elf
DEBUG: DFI ELF initialization
DEBUG: DFI ELF e_phnum 11
DEBUG: DFI ELF p_type[0] 0x4
DEBUG: DFI ELF n_type 0x0
AddressSanitizer:DEADLYSIGNAL
=================================================================
==208548==ERROR: AddressSanitizer: stack-overflow on address 0x03ffef05d000 (pc 0x0000010051b0 bp 0x03fff107dc40 sp 0x03ffef05dac8 T0)
#0 0x10051b0 (/root/s390-tools/zdump/zgetdump+0x10051b0)
SUMMARY: AddressSanitizer: stack-overflow (/root/s390-tools/zdump/zgetdump+0x10051b0)
==208548==ABORTING
valgrind findings:
==56423== Source and destination overlap in memcpy(0x4a86d38, 0x4a875e0, 4096)
==56423== at 0x4839F86: memcpy (in /usr/lib/s390x-linux-gnu/valgrind/vgpreload_memcheck-s390x-linux.so)
==56423== by 0x114253: memcpy (string_fortified.h:34)
==56423== by 0x114253: nt_read (dfi_elf.c:95)
==56423== by 0x1145FF: nt_s390_prefix_read (dfi_elf.c:195)
==56423== by 0x1145FF: pt_notes_add (dfi_elf.c:259)
==56423== by 0x1145FF: dfi_elf_init (dfi_elf.c:326)
==56423== by 0x112A57: dfi_init (dfi.c:1212)
==56423== by 0x10D663: do_dump_info (zgetdump.c:127)
==56423== by 0x10D663: main (zgetdump.c:182)
==56423==
==56423== Invalid write of size 8
==56423== at 0x4839E28: memcpy (in /usr/lib/s390x-linux-gnu/valgrind/vgpreload_memcheck-s390x-linux.so)
==56423== by 0x114253: memcpy (string_fortified.h:34)
==56423== by 0x114253: nt_read (dfi_elf.c:95)
==56423== by 0x1145FF: nt_s390_prefix_read (dfi_elf.c:195)
==56423== by 0x1145FF: pt_notes_add (dfi_elf.c:259)
==56423== by 0x1145FF: dfi_elf_init (dfi_elf.c:326)
==56423== by 0x112A57: dfi_init (dfi.c:1212)
==56423== by 0x10D663: do_dump_info (zgetdump.c:127)
==56423== by 0x10D663: main (zgetdump.c:182)
==56423== Address 0x4a86ee0 is 0 bytes after a block of size 912 alloc'd
==56423== at 0x483675E: calloc (in /usr/lib/s390x-linux-gnu/valgrind/vgpreload_memcheck-s390x-linux.so)
==56423== by 0x10E71D: zg_alloc (zg.c:93)
==56423== by 0x114793: nt_prstatus_read (dfi_elf.c:123)
==56423== by 0x114793: pt_notes_add (dfi_elf.c:234)
==56423== by 0x114793: dfi_elf_init (dfi_elf.c:326)
==56423== by 0x112A57: dfi_init (dfi.c:1212)
==56423== by 0x10D663: do_dump_info (zgetdump.c:127)
==56423== by 0x10D663: main (zgetdump.c:182)
Signed-off-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Suggested-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Reported-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Had a confusing decoded trace record:
Timestamp : ...
Area : SCSI
...
Tag : rsl_err
...
SCSI result : 0x00000002
SCSI opcode : 1a...
FCP rsp inf cod: 0x00
FCP rsp IU : 00000000 00000000 00000a02 000000ff
00000012 00000000
^^
and was wondering where that sense data would be or if the
corresponding PAY record "fcp_riu" was lost due to trace area wrapping.
So the fix here adds the following two lines to the same trace record:
FCP rsp IU len : 42
FCP rsp IU all : record not available anymore.
Similarly, the following LUN reset Task Management Function response
was missing the last two lines regarding the full FCP response IU
and its optional part with the FCP response info:
Timestamp : ...
Area : SCSI
...
Tag : lr_okay
...
FCP rsp inf cod: 0x00
FCP rsp IU : 00000000 00000000 00000100 00000000
00000000 00000008
^^
FCP rsp IU len : 32
FCP rsp IU all : record not available anymore.
As of today, depending on the kernel version we have
either fcp_sns or fcp_riu PAY trace records. See Linux kernel v4.14 commit
12c3e5754c80 ("scsi: zfcp: fix payload with full FCP_RSP IU in SCSI trace
records").
Always print non-zero payload length independent of payload type.
Actually this also fixes a regression for wrapped away fcp_sns.
If there is no fcp_sns it either wrapped away or it's a kernel with fcp_riu.
Only print fcp_riu if it contains more content than the preceding
unconditional fixed-size field "FCP rsp IU".
Signed-off-by: Steffen Maier <maier@linux.ibm.com>
Reviewed-by: Fedor Loshakov <loshakov@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
If the while loop in mem_chunks_add_ext() is never executed, then
the stack variable containing the dump segment header will never be
initialized.
clang's static code analyzer reports the following problem:
$ make CC="clang --analyze" -C zdump
dfi_s390.c:157:6: warning: Branch condition evaluates to a garbage value [core.uninitialized.Branch]
if (!dump_segm.stop_marker)
^~~~~~~~~~~~~~~~~~~~~~
Signed-off-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Reported-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Use util_log from libutil to output various log messages that can be helpful
during problem analysis.
Signed-off-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Replace the incorrect %d format specifier with %u one for unsigned integer
types.
This issue was found with AFL fuzzing.
$ ./zdump/zgetdump -i ~/input.bin
General dump info:
Dump format........: s390
Version............: -2147483647
System arch........: s390x (64 bit)
CPU count (online).: 32768
Dump memory range..: 1 MB
Memory map:
0000000000000000 - 00000000000f423f (1 MB)
Signed-off-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
We found situations, where the debug commands from dbginfo.sh
did overwrite some debug files (e.g. OSA s390dbf) - so we change
the collection order
Signed-off-by: Joern Siglen <siglen@de.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Before reading data in dfi_vmcoreinfo_init(), check the validity
of the memory range. Otherwise this can result in a segmentation fault when
zgetdump is given a very small dump, e.g. S390 DASD single-volume dump of
size 0x10 bytes.
Signed-off-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Before reading data in os_info_get(), check the validity of the memory
range. Otherwise this can result in a segmentation fault when zgetdump is
given a very small dump, e.g. S390 DASD single-volume dump of size 0x10
bytes.
Signed-off-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Before reading data at addresses 0x10418 and 0x10420 in kdump_init(),
validate the validity of the memory range. Otherwise this can result in
a segmentation fault when zgetdump is given a very small dump, e.g.
S390 DASD single-volume dump of size 0x1000 bytes.
Signed-off-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The dfi_vmcoreinfo_init() function might be called on a dump of a non-ELF
format because the DFI goes through all supported dump formats when first
trying to identify of what dump format the given input is. Therefore,
we must be very careful in interpreting read data and ensure that it
makes sense before accessing or using it.
This commit prevents a potential overflow of a stack buffer in
dfi_vmcoreinfo_init() if note.n_namesz is bigger than the stack buffer.
Signed-off-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
- adding new print function for simpler output customizing
- consolidate some output files
- sync structures and use of checks
- some formatting updates
Signed-off-by: Joern Siglen <siglen@de.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The function mem_chunks_add_ext() allocates but does not release memory
if it encounters unexpected errors during dump segment reading.
Allocate memory passed to dfi_mem_chunk_add() right before calling
the function. This way there is no need for a cleanup anymore.
Signed-off-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Reported-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
- clenaup outdated kernel - we no longer have 2.x kenrel in support
- add timeout on command excution - ensure to not miss all data for a
single command to hang
Signed-off-by: Joern Siglen <siglen@de.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
When integrity support is enabled for a LUKS2 volume, then the LUKS2
volume key may include the integrity key concatenated to the secure key
(dependent on the integrity type).
Get the integrity key size from the LUKS2 header (if integrity support
is enabled) and calculate the size of the secure key when performing
operations with the secure key only.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
According to the ELF specification, the file size of a PT_LOAD
memory segment might be less than its memory size. In that case,
the remaining bytes must be filled with zeros. The ELF DFI implementation
didn't handle this case correctly. Such ELF core files might be produced
by the makedumpfile tool.
From elf.5 man page:
------------------------------------------------------
PT_LOAD
The array element specifies a loadable segment,
described by p_filesz and p_memsz. The bytes
from the file are mapped to the beginning of the
memory segment. If the segment's memory size
p_memsz is larger than the file size p_filesz,
the "extra" bytes are defined to hold the value
0 and to follow the segment's initialized area.
The file size may not be larger than the memory
size. Loadable segment entries in the program
header table appear in ascending order, sorted
on the p_vaddr member.
Signed-off-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Before attempting to read ELF program headers, the file must be positioned
at the offset of the first program header as specified in the ELF header.
Furthermore, read all ELF program headers with one call to zg_read(). This
has the advantage of not having to restore the file offset every time
after it is changed in pt_notes_add() and other functions which need to
read the same file as well.
Signed-off-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
This is a false positive because IBM Z architecture supports unaligned
memory accesses.
dfo_s390.c: In function ‘df_s390_dump_init’:
dfo_s390.c:218:29: warning: taking address of packed member of ‘struct df_s390_hdr’ may result in an unaligned pointer value [-Waddress-of-packed-member]
218 | timeval2tod(&dh->tod, dfi_attr_time());
| ^~~~~~~~
dfo_s390.c:219:29: warning: taking address of packed member of ‘struct df_s390_em’ may result in an unaligned pointer value [-Waddress-of-packed-member]
219 | timeval2tod(&em->tod, dfi_attr_time());
| ^~~~~~~~
dfo_s390.c:222:29: warning: taking address of packed member of ‘struct df_s390_em’ may result in an unaligned pointer value [-Waddress-of-packed-member]
222 | timeval2tod(&em->tod, dfi_attr_time_end());
| ^~~~~~~~
Signed-off-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
When creating a bootmap, look for zipl components (stage3.bin and
zipl helpers) in a directory specified by S390TOOLS_LIBDIR shell
environment variable. If that variable is not set, then look for
them at the default location.
In verbose mode print the name of s390-tools library directory,
where the search was implemented.
Signed-off-by: Eduard Shishkin <edward6@linux.ibm.com>
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Add generic functions
util_sysdir();
util_sysdir_path()
and their special cases supplied for users:
util_libdir();
util_libdir_path();
util_datadir();
util_datadir_path()
The function util_sysdir() determines the absolute name of a
s390-tools system directory. It could be data, or library directory.
The function util_sysdir_path() determines the absolute name of a
file installed in the s390-tools system directory.
The function util_libdir() determines the absolute name of a
s390-tools library directory. By default that name is defined
by the compile-time macro TOOLS_LIBDIR (/lib/s390-tools).
Users can specify an override by setting environment variable
S390TOOLS_LIBDIR.
The function util_libdir_path() determines the absolute name of a
file installed in the s390-tools library directory.
The function util_datadir() determines the absolute name of a
s390-tools system data directory. By default the name is defined
by the compile-time macro TOOLS_DATADIR (/usr/share/s390-tools/).
Users can specify an override by setting environment variable
S390TOOLS_DATADIR.
The function util_datadir_path() determines the absolute name of a
file installed in the s390-tools data directory.
The ability to override the setting for TOOLS_LIBDIR and
TOOLS_DATADIR is required for implementing tests on tools that are
not installed in their default system path locations.
Signed-off-by: Eduard Shishkin <edward6@linux.ibm.com>
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
lscss shows device number as 'None' if the corresponding device in the
subchannel is non-operational or not connected. Instead, show the
device-no derived from the new dev_busid attribute which provides the
value of device_id irrespective of the device availability.
i.e the current lscss shows
Device Subchan. DevType CU Type Use PIM PAM POM CHPIDs
----------------------------------------------------------------------
0.0.0000 0.0.0000 3390/0c 3990/e9 f0 a0 ff 32333435 00000000
none 0.0.00c7 f0 a0 5f 32333435 00000000
none 0.0.00c8 f0 a0 5f 32333435 00000000
here the subchannels 0.0.00c7 and 0.0.00c8 do not have an operational
device on them. Hence the device is shown as none.
With this patch,
Device Subchan. DevType CU Type Use PIM PAM POM CHPIDs
----------------------------------------------------------------------
0.0.0000 0.0.0000 3390/0c 3990/e9 f0 a0 ff 32333435 00000000
0.0.74c8 0.0.00c7 f0 a0 5f 32333435 00000000
0.0.74c9 0.0.00c8 f0 a0 5f 32333435 00000000
The device-no is shown as 0.0.74c8; Where the DevType field still
indicates that the device is not present.
Signed-off-by: Vineeth Vijayan <vneethv@linux.ibm.com>
Reviewed-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
lszcrypt now evaluates and displays the 'status' in the
'STATUS' column if the vfio provides this sysfs attribute.
Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The 'STATUS' field was within the code used as 'online'
record because it showed the online state. But now it
displays some more info like 'deconfig' and maybe even
more in the future. So now the code also uses a 'status'
record for this info.
Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Slight rework of the lszcrypt code with:
- a queue or card in deconfigured mode is displayed
as 'deconfig' regardless which driver is bound to
the device.
- a queue or card in 'deconfig' mode does not show
any counters any more but displays a '-' instead.
- a queue not bound or bound to something else as
the 'default' zcrypt dd does not show any counters
but displays a '-' instead.
Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The command
# vmur punch -r rhcos-live-kernel-s390x -u etpgxku -N kernel.img
Reader file with spoolid E YO created and transferred to ETPGXKU.
#
did not indicate an error when executed. However the file was not
transferred and this error message went unnoticed:
RPIMGR032E YOU ARE NOT AUTHORIZED TO CLOSE TO TATAC05.ETPGXKU
HCPCSL007E Invalid userid - ETPGXKU
Fix this by checking the CP return code and print the error message
returned by CP. This is the behavior now:
# vmur punch -r rhcos-live-kernel-s390x -u etpgxku -N kernel.img
vmur: CP command failed with rc=7
RPIMGR032E YOU ARE NOT AUTHORIZED TO CLOSE TO TATAC05.ETPGXKU
HCPCSL007E Invalid userid - ETPGXKU
#
Fixes: https://github.com/ibm-s390-linux/s390-tools/issues/119
Reported-by: Vance Morris <vmorris@us.ibm.com>
Signed-off-by: Thomas Richter <tmricht@linux.ibm.com>
Tested-by: Vance Morris <vmorris@us.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Complements v2.9.0 commit 4036e80b26 ("lszfcp: add new output marker
for non-good FCP devices (hosts)").
Otherwise "linkdown" shows as "failed" because linkdown happens to be
the one special case that also sets the failed status flag of the
FCP device (host). Linkdown is kind of benign compared to other cases
where the FCP device is in failed status.
Examples:
$ lszfcp -He
0.0.194a host3 linkdown
$ lszfcp -HeV
/sys/devices/css0/0.0.0004/0.0.194a linkdown
/sys/class/fc_host/host3
/sys/class/scsi_host/host3
Signed-off-by: Steffen Maier <maier@linux.ibm.com>
Reviewed-by: Benjamin Block <bblock@linux.ibm.com>
Reviewed-by: Fedor Loshakov <loshakov@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The DFI memory chunk manager cannot handle PT_LOAD segments of size 0.
This can lead to a NULL pointer access in mem_chunk_find() in case
zgetdump is given an invalid VMCORE ELF file as input which contains
only zero-sized ELF PT_LOAD segments. Instead of crashing, show an error
message and terminate gracefully.
The TELA test dump_with_zero_sized_segments.sh can reproduce this bug.
Signed-off-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Zipl.conf is collected via /etc/*.conf in CONFIGFILES but BLS snippets
do not appear in /etc/zipl.conf.
Complements v2.5.0 commit d280e5b1fa ("zipl: Add BootLoaderSpec support")
Signed-off-by: Steffen Maier <maier@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Some libraries depend on other libraries, so split the libraries
into two groups: base libraries that do not depend on any others, and
the remaining libraries, that may depend on the base libraries.
Ensure that the base libraries are built first, before starting to
build the remaining libraries. The tools are only built once the base
libraries and the remaining libraries have been built.
This fixes a possible build problem with libseckey when parallel build
is used. The libseckey library is used by libekmfweb and the zkey KMIP
plugin (zkey-kmip). With parallel build both are built in parallel,
and thus both trigger the build of libseckey. This can lead to the
situation that libseckey is built twice at the same time, which can lead
to build failures (corrupted archive, etc).
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
overlay.o was being recompiled during the install step because
it depended on the target check-dep-fuse which is phony and,
therefore, always outdated. The solution is to create an empty file
for the target check-dep-fuse after its successful completion. This
prevents make from rebuilding overlay.o during installation.
Closes: https://github.com/ibm-s390-linux/s390-tools/pull/118
Fixes: 5a7d2a58c8 ("hsavmcore: Fix fuse dependency checking")
Signed-off-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Suggested-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Use LONG_BIT provided by C standard in <limits.h>.
Fixes the following compile errors with buildroot:
lshwc.c: In function ‘parse_cpulist’:
lshwc.c:295:15: error: ‘__BITS_PER_LONG’ undeclared (first use in this function)
295 | no_a = i % __BITS_PER_LONG;
| ^~~~~~~~~~~~~~~
Fixes: 27a562da0a ("cpumf/lshwc: Program to extract complete counter sets")
Signed-off-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Reviewed-by: Thomas Richter <tmricht@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Use standard 32- and 64-bit C types.
Fixes the following compile errors with buildroot:
In file included from lshwc.c:41:
lshwc.h:61:2: error: unknown type name ‘__u64’
61 | __u64 version; /* Version of interface */
| ^~~~~
lshwc.h:62:2: error: unknown type name ‘__u64’
62 | __u64 data_bytes; /* # of bytes required */
| ^~~~~
lshwc.h:63:2: error: unknown type name ‘__u64’
63 | __u64 cpumask_len; /* Length of CPU mask in bytes */
| ^~~~~
lshwc.h:64:2: error: unknown type name ‘__u64’
64 | __u64 *cpumask; /* Pointer to CPU mask */
| ^~~~~
lshwc.h:65:2: error: unknown type name ‘__u64’
65 | __u64 counter_sets; /* Bit mask of counter set to get */
| ^~~~~
lshwc.h:69:2: error: unknown type name ‘__u32’
69 | __u32 set; /* Counter set number */
| ^~~~~
Fixes: 27a562da0a ("cpumf/lshwc: Program to extract complete counter sets")
Signed-off-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Reviewed-by: Thomas Richter <tmricht@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
KMIP values of type BYTE-STRING are represented as hex values when XML
or JSON encoding is used. Do not drop any leading zero bytes, if the
value has them.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
util_path_sysfs() allocates memory for the created path which must be
freed by the user.
Fixes: 8023a72b11 ("libdasd: Provide function to read ese sysfs attribute")
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
List (find) and import a key that exists in a KMIP server into the zkey
repository. Retrieve the key attributes of a key stored in a KMIP server,
and extract the zkey properties from it.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
When a key is removed from the zkey repository, it is usually not removed
from the KMIP server. Optionally, the state of a KMIP key can be changed
when it is removed by zkey.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Change the attributes of a key at the KMIP server when the properties
of a key are changed in zkey.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Allow to generate a new AES key at the KMIP server, and retrieved it.
Keys are always retrieved in wrapped format, wrapped by the public RSA
wrapping key used by the KMIP plugin. The KMIP plugin can then unwrap
the retrieved key with its secure private RSA key, and can then import
the retrieved AES key into the zkey repository as secure key. That way,
the retrieved AES key is never in clear, once it leaves the KMIP server.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
When the master keys of the configured APQNs are changed, the secure
identity key as well as the secure wrapping key must be re-enciphered.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Keys retrieved from a KMIP server are wrapped with an RSA key. The
RSA wrapping key is a secure key generated by the KMIP plugin. The
public RSA key is registered at the KMIP server, and the KMIP server
can then wrap the keys with it. The KMIP plugin can unwrap the retrieved
key with the private RSA key and import it as secure key into the zkey
repository.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Configure a connection to a KMIP server, establish trust between
server and client, query the KMIP server and verify if it supports
the required KMIP operations. Also, the profile to be used with this
KMIP server is tried to matched. If not specified in the profile,
the KMIP protocol version to be used is discovered.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
KMIP server profiles (not to be confused with profiles defined by
the KMIP standard) define how the KMIP plugin talks to the KMIP
server. Profiles can be used to configure certain KMIP usages for
certain KMIP servers.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Lines with '#' as first character are treated as comments, and are
skipped. Empty lines are also skipped.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
For the client certificate to authenticate with the KMIP server,
a certificate signing request (CSR) or self signed certificate can be
generated. The generated CSR or certificate is signed with the secure
identity key of the KMIP plugin.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Authentication with KMIP servers is based on TLS client authentication.
To establish trust between zkey and the KMIP server, a client certificate
must be registered with the KMIP server before a client can communicate
with it.
The signature key of the client's certificate is a secure key created by
zkey. It can either be an RSA or an ECC key, using either CCA or EP11
type crypto adapters configured with the KMIP plugin.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The KMIP plugin supports CCA and EP11 APQNs, but only it can only be
configured with one type. Once configured with one type of APQN, it accepts
only APQNs of the same type.
It supports key types matching to the APQn type it is configured with.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Add support to integrate the external key management systems based
on the KMIP protocol (KMIP: OASIS Key Management Interoperability
Protocol) into zkey by providing a zkey KMS plugin for KMIP. The
plugin communicates with KMIP servers using libkmipclient over a
TLS or HTTPS connection.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Some functions are likely to be used by multiple plugins. Move them
into zkey common code (plugin-utils.c), this module is then linked
into the plugins.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
KMS plugins that support multiple key types need to know which
key type to produce with the kms_import_key() function. Extend
the plugin API to allow a plugin to provide a kms_import_key2()
function, that accepts the key type as additional parameter.
Existing plugins do not need to be changed, as the old function
kms_import_key() still exists, and is still used when the plugin
does not provide a kms_import_key2() function.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
libkmipclient is a shared library that provides an KMIP client to
communicate with an KMIP server. KMIP stands for Key Management
Interoperability Protocol, and is an extensible communication protocol
that defines message formats for the manipulation of cryptographic
keys on a key management server.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The libseckey is a secure key library to perform secure key operations
with OpenSSL. It provides a framework to create OpenSSL PKEYs with a
secure key attached. Such a PKEY contains the public key parts in clear,
but the private key as secure key blob. Only the private key operations
are actually performed with the secure key, public key operations are
performed in software by OpenSSL. It supports CCA and EP11 secure
keys for RSA and ECC crypto operations.
Because many PKEY method related functions are deprecated since OpenSSL
3.0, two versions of the OpenSSL secure key support are needed. One (using
a PKEY method override) for OpenSSL 1.1.1, and another one (using an own
OpenSSL provider) for OpenSSL 3.0 and later. The desired implementation is
selected automatically at compile time, using OpenSSL version defines. The
interface of both implementations is the same, so a user does not need to
care which one is used.
Reviewed-by: Juergen Christ <jchrist@linux.ibm.com>
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The new user-defined function allows to check for C headers in
make's conditional statements.
Example:
ifeq ($(call check_header_prereq,"systemd/sd-daemon.h"),yes)
$(warning "systemd support enabled")
else
$(warning "systemd support disabled")
endif
Signed-off-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Acked-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The callback function used for CURLOPT_SSL_CTX_FUNCTION requires
that OpenSSL is used as SSL backend.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Add the genprotimg flags `--(enable|disable)-pckmo` flag to enable/disable the
support for PCKMO-encrypt-DEA/TDEA/AES/ECC-key functions.
Acked-by: Viktor Mihajlovski <mihajlov@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Allow the PCKMO-encrypt-DEA/TDEA/AES/ECC-key functions to be used in a protected
virtualization guest by default.
Acked-by: Viktor Mihajlovski <mihajlov@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The new name reflects that it's a plaintext control flag. While at it, use a
left shift operation to calculate the value.
Acked-by: Viktor Mihajlovski <mihajlov@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The HSA size, which limits the address space in kdump case, is not constant
and depends on the underlying architecture.
Signed-off-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The util_arch module is supposed to provide general information about
the underlying architecture of the machine in use.
Signed-off-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
... to avoid vulnerabilities that could occur if set-user-ID or
set-group-ID programs accidentally trusted the environment.
zkey is usually NOT a set-user-ID or set-group-ID program, but its
safer to use secure_getenv() anyway.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The only user of util_proc_mnt_get_entry() so far was util_path_sysfs().
With the simplified version there is no user left. Remove
util_proc_mnt_get_entry() and related code.
Reviewed-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Using util_path_sysfs always leaves 5 bytes of memory unfreed as the
value for the sysfs mount point is stored in a static variable to avoid
multiple queries of /proc/mount.
$ valgrind ./util_path_example sysfs
==3629315== Memcheck, a memory error detector
==3629315== Copyright (C) 2002-2017, and GNU GPL'd, by Julian Seward et al.
==3629315== Using Valgrind-3.15.0 and LibVEX; rerun with -h for copyright info
==3629315== Command: ./util_path_example sysfs
==3629315==
Path for cpu: "/sys/devices/system/cpu"
Path for memory: "/sys/devices/system/memory"
==3629315==
==3629315== HEAP SUMMARY:
==3629315== in use at exit: 5 bytes in 1 blocks
==3629315== total heap usage: 22 allocs, 21 frees, 18,435 bytes allocated
==3629315==
==3629315== LEAK SUMMARY:
==3629315== definitely lost: 0 bytes in 0 blocks
==3629315== indirectly lost: 0 bytes in 0 blocks
==3629315== possibly lost: 0 bytes in 0 blocks
==3629315== still reachable: 5 bytes in 1 blocks
==3629315== suppressed: 0 bytes in 0 blocks
==3629315== Rerun with --leak-check=full to see details of leaked memory
==3629315==
==3629315== For lists of detected and suppressed errors, rerun with: -s
==3629315== ERROR SUMMARY: 0 errors from 0 contexts (suppressed: 0 from 0)
As per the Kernel rules for accessing sysfs information [1], searching
for the sysfs mount point is a waste of time and systems that don't have
sysfs mounted at /sys are considered broken.
With those things in mind, util_path_sysfs() and especially
sys_mount_point() can be simplified. sys_mount_point() will always
return '/sys' unless the environment variable SYSFS_ROOT is set.
With SYSFS_ROOT still being present, special container setups or test
case scenarios are still possible but might need to be modified if they
previously relied on util_path_sysfs() automatically finding the correct
sysfs mount point.
To make things more secure against malicious strings in SYSFS_ROOT,
secure_getenv() is being used and the ordering of creating the formatted
path string in util_path_sysfs() is changed slightly.
Furthermore, the static variable is removed as no complicated query of
the /proc fs is required anymore. Memory for the sysfs mount point value
is properly freed now at the end of util_path_sysfs().
[1] https://www.kernel.org/doc/html/latest/admin-guide/sysfs-rules.html
Reviewed-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
A compile with sparse (make C=1) shows a couple of warnings:
like:
chzcrypt.c:36:3: warning: symbol 'l' was not declared.
Should it be static?
lszcrypt.c: In function 'show_device':
lszcrypt.c:556:9: warning: 'card' may be used uninitialized
[-Wmaybe-uninitialized]
Fix those warnings.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Jan Hoeppner <hoeppner@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
A compile with sparse (make C=1) shows the following warnings:
util_rec.c:211:6: warning: symbol 'rec_print_wide' was not declared.
Should it be static?
util_rec.c:383:6: warning: symbol 'rec_print_csv_hdr' was not declared.
Should it be static?
util_rec.c:404:6: warning: symbol 'rec_print_csv' was not declared.
Should it be static?
These functions are only used internally from function util_rec_print_hdr(),
declare them as static.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Jan Hoeppner <hoeppner@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
A compile with sparse (make C=1) shows the following warnings:
util_opt.c:42:19: warning: symbol 'util_opt_l' was not declared.
Should it be static?
util_prg.c:28:19: warning: symbol 'util_prg_l' was not declared.
Should it be static?
util_opt_l and util_prg_l are not used anywhere, and also not declared in
any header file. Looks like they are superfluous, remove them.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Jan Hoeppner <hoeppner@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
hsavmcore is designed to make the dump process with kdump more efficient.
With hsavmcore, the HSA memory that contains a part of the production
kernel's memory can be released early in the process. Depending on the size
of the production kernel's memory, writing the dump to persistent storage
can be time consuming and prevent the HSA memory from being reused
by other LPARs.
Signed-off-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Reviewed-by: Philipp Rudo <prudo@linux.ibm.com>
Acked-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The CCA Key Translate2 verb needs a pre-built AES CIPHER key token skeleton
with XPRTCPAC set in the output buffer, to produce an AES CIPHER key
that can be exported to CAPCF.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Harald Freudenberger <freude@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Build:
$ make -C libutil/util_log_example
* Every time a -V option is passed, the verbosity level increases and extra
messages are enabled.
Test:
$ ./libutil/util_log_example
# No output
$ ./libutil/util_log_example -V
ERROR: This is an ERROR message
$ ./libutil/util_log_example -VV
ERROR: This is an ERROR message
WARN: This is a WARN message
$ ./libutil/util_log_example -VVV
ERROR: This is an ERROR message
WARN: This is a WARN message
INFO: This is an INFO message
$ ./libutil/util_log_example -VVVV
ERROR: This is an ERROR message
WARN: This is a WARN message
INFO: This is an INFO message
DEBUG: This is a DEBUG message
$ ./libutil/util_log_example -VVVVV
ERROR: This is an ERROR message
WARN: This is a WARN message
INFO: This is an INFO message
DEBUG: This is a DEBUG message
TRACE: This is a TRACE message
Signed-off-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Reviewed-by: Jan Hoeppner <hoeppner@linux.ibm.com>
Reviewed-by: Philipp Rudo <prudo@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The goal of util_log is to provide a facility for a multi-level message
logging on stderr. This allows to selectively enable/disable log messages
via a log level which can be adjusted at runtime.
Signed-off-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Reviewed-by: Jan Hoeppner <hoeppner@linux.ibm.com>
Reviewed-by: Philipp Rudo <prudo@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The tmp buffer is one byte too short missing space for the final \0 byte
leading to out of bound access.
Fix by increasing the buffer by one.
Reported-by: Niklas Schnelle <schnelle@linux.ibm.com>
Signed-off-by: Stefan Haberland <sth@linux.ibm.com>
Reviewed-by: Niklas Schnelle <schnelle@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Add transparent codepage conversion feature to zdsfs.
Add options to specify that codepage conversion should be done using
default codepages from 'CP1047' to 'UTF-8' or using user defined codepage
tables.
Also add a new config file allowing the user to specify codepage conversion
options on a per dataset basis.
When a dataset is opened and codepage conversion settings match this
dataset an iconv handle is created and the conversion itself is performed
by the lzds_dshandle_read() function.
Signed-off-by: Stefan Haberland <sth@linux.ibm.com>
Reviewed-by: Niklas Schnelle <schnelle@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Add codepage conversion capabilities to libzds.
Whenever a dataset is read and an appropriate iconv handle is set for the
dataset the conversion is automatically performed.
Signed-off-by: Stefan Haberland <sth@linux.ibm.com>
Reviewed-by: Niklas Schnelle <schnelle@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Replace function linux_error() by err/warn family.
Delete function linux_error() which is not used anymore.
Also fix some checkpatch warnings regarding comparison to zero.
Signed-off-by: Thomas Richter <tmricht@linux.ibm.com>
Acked-by: Sumanth Korikkar <sumanthk@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Simplify function read_sfb(). Convert it to type void
and return only when no errors occurred.
On error print error message and exit instead of return.
Signed-off-by: Thomas Richter <tmricht@linux.ibm.com>
Acked-by: Sumanth Korikkar <sumanthk@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Program reads complete counter sets from any CPU by opening
device /dev/hwctr which is available with linux version 5.12.
The counter sets and CPUs can be specified on the command line.
Signed-off-by: Thomas Richter <tmricht@linux.ibm.com>
Reviewed-by: Sumanth Korikkar <sumanthk@linux.ibm.com>
Reviewed-by: Jan Hoeppner <hoeppner@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Use function util_opt_print_parse_error() instead of fprintf to stderr.
Signed-off-by: Thomas Richter <tmricht@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Simplify comparison against 0 or NULL and fix a checkpatch.pl
warning.
Signed-off-by: Thomas Richter <tmricht@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Using "chzdev -e" to configurate a device persistently, the
corresponding udev rule is also created, which will trigger a uevent
that sets the device online as soon as the group device is created.
If 'znetconf -r/R' is first used to remove such a configured device
(which won't remove the corresponding udev rule) and then
'znetconf -a/A' afterwards on the same device, either the error
"Failed to make <device> online" or "Failed to configure layer2=1"
will occur.
For the first error, the udev queue might not have been fully processed
and hence the check whether a device is online may fail due to that
race. Call 'udevadm settle' to ensure a fully processed queue before
checking whether a device is online.
The second error occurs, because configure_ccwgroupdev_option() does
not check whether the device is online. Add the check and set the
device offline if necessary. Also, log any details for debugging
purposes.
Signed-off-by: Wenjia Zhang <wenjia@linux.ibm.com>
Reviewed-by: Alexandra Winter <wintera@linux.ibm.com>
Reviewed-by: Jan Hoeppner <hoeppner@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Add virsh commands for KVM debug data collection and rework the domain
data collection and step numbering. Update the man page accordingly.
[hoeppner@linux.ibm.com: Reword commit message]
Signed-off-by: Joern Siglen <siglen@de.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Performance evaluation showed that using the mq-deadline scheduler for DASD
devices leads to a significantly higher CPU consumption compared to using
none scheduler while having the same amount of throughput.
Setting none scheduler as default in the dasd udev rule.
Signed-off-by: Stefan Haberland <sth@linux.ibm.com>
Reviewed-by: Jan Hoeppner <hoeppner@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
When the compiler flags are overridden, the build of zkey may fail with:
kms.c:44:2: error: #error KMS_PLUGIN_LOCATION must be defined
44 | #error KMS_PLUGIN_LOCATION must be defined
| ^~~~~
The Makefile uses CFLAGS variable for defining the KMS_PLUGIN_LOCATION,
but it should rather use ALL_CFLAGS.
Also use ALL_CPPFLAGS for defining HAVE_LUKS2_SUPPORT.
Fixes: https://github.com/ibm-s390-linux/s390-tools/issues/108
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Jan Hoeppner <hoeppner@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
For maximum performance the MTU of an HSCI interface was set to the value
of the MTU of its HiperSockets interface. However, the MTU of a
HiperSockets interface can be very large, and when the data packets are
not sent over the HiperSocket but over the corresponding ethernet
interface (which usually has a smaller MTU size) then it can happen that
the large packets are silently dropped. One example would be communication
from an HSCI in one CEC to another HSCI in another CEC via Ethernet.
To solve the problem, the MTU setting in this tool is removed, and the
default MTU value is used. Thus, the minimum value of the MTUs of the both
converged interfaces is used as the MTU of the HSCI interface.
Fixes: 0566a492ae ("s390-tools: add hsci tool")
Signed-off-by: Wenjia Zhang <wenjia@linux.ibm.com>
Reviewed-by: Alexandra Winter <wintera@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Since crash 7.2.9 commit
f1f43bf355
in support of kernel v5.9 commit 0990d836cecb
("s390/debug: debug feature version 3"),
the symbolic caller function name is left aligned instead of right
aligned, so now we alternatively have to remove whitespace between
function name and offset.
Otherwise, zfcpdbf output contains wrong warnings about ambiguous payload
records with wrong values for reqid and area, as well as incorrectly
decoded trace records with wrong content values and potential error
messages on not defined record id, and finally a potential list of
occurrences of unknown tags which should empty:
Loading trace records ...(this might take a while)
Warning: Ambiguous PAYload records. reqid:>>>wrong<<< area:V^D^@fcp_
Warning: Ambiguous PAYload records. reqid:>>>wrong<<< area:W^D^@fsf_
Warning: Ambiguous PAYload records. reqid:>>>wrong<<< area:i^B^@san_
...
Timestamp : ...
Area : SAN
Subarea : 00
Level : 1
Exception : -
CPU ID : 0001
Caller : <zfcp_dbf_san_in_els
Record ID : 0
Tag : 6^B^Cfcie
Request ID : >>>wrong<<<
Destination ID : >>>wrong<<<
SAN record id=0 not defined.
Timestamp : ...
Area : SAN
Subarea : 00
Level : 1
Exception : -
CPU ID : 0002
Caller : <zfcp_dbf_san_in_els
Record ID : 0
Tag : 6^B^Cfcie
Request ID : >>>wrong<<<
Destination ID : >>>wrong<<<
SAN record id=0 not defined.
...
occurrences of unknown tags:
...
Signed-off-by: Steffen Maier <maier@linux.ibm.com>
Reviewed-by: Benjamin Block <bblock@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
For the stage2 of zipl's boot loaders only 3 heap pages are available
[0x6000, 0x6000 + 0x3000]. Therefore, stage2 code needs to be very careful
when and for how long it allocates a heap page.
The heap OOM problem in stage2 was hidden until the commit 252be376
("zipl/boot: fix potential heap overflow in stage2"). Before this commit,
stage2 assumed that heap is 4 pages large which is apparently very wrong
but get_zeroed_page() still allowed allocating an extra 4th page by
overriding the memory segment following the heap area of stage2 (stage3
parameter area).
Try to avoid allocating a heap page and keeping it allocated over a long
period of time in the DASD dumpers. Free a heap page as soon as possible
if not required anymore.
And be extra careful with printf() because it always tries to allocate
a free heap page.
Fixes: 252be376 ("zipl/boot: fix potential heap overflow in stage2")
Signed-off-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Reviewed-by: Philipp Rudo <prudo@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
RFC 7517 requires that the x and y coordinates of a ECC JSON Web Key
(JWK) are specified in its full size of a coordinate for the curve used.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Deleting an HSCI interface, the connected HiperSockets interface's name
and the connected Ethernet interface's name are extracted from "ip link
show". Currently the extracted names are directly used in "bridge -d link
show dev ifname" for further checking. If "iflink" and "ifindex" of an
interface are not matched, ip commands will print @ifXX appended to the
real interface's name. Thus, it will be failed if the interface's name
with the ending @ifXX is used in "bridge -d link show dev ifname" for
further checking.
To solve the problem, the ending @ifXX must be removed before the
interface name is used further.
Signed-off-by: Wenjia Zhang <wenjia@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
In the current code, after the function check_pnetids() and the function
verify_precon() are called, $? from each function is used twice
successively. It is used for the first time in the condition of the IF
statement, while for the second time as return code of the current
function. In bash, $? can be used to get the return code, but only for
the first time directly after the previous function is called.
Afterwards, $? will be reset to "0". Thus, the right return code can not
be get, if $? is used second time.
To solve the problem, using $? for the second time should be avoided.
Signed-off-by: Wenjia Zhang <wenjia@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Install libasan first, e.g. on Fedora 32:
dnf install -y libasan libasan-static.
To compile with address sanitizer, pass ASAN=1 to make.
AdressSanitizer helps to catch various memory bugs for which C/C++ is
infamous.
Signed-off-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Reviewed-by: Philipp Rudo <prudo@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
This fixes the following compiler errors when ASAN is enabled:
CC cmsfs-fuse/cmsfs-fuse.o
cmsfs-fuse.c: Assembler messages:
cmsfs-fuse.c:310: Error: operand out of range (0xffffffffffffff00 is not between 0x0000000000000000 and 0x0000000000000fff)
cmsfs-fuse.c:310: Error: operand out of range (0xffffffffffffff00 is not between 0x0000000000000000 and 0x0000000000000fff)
cmsfs-fuse.c:310: Error: operand out of range (0xffffffffffffff00 is not between 0x0000000000000000 and 0x0000000000000fff)
cmsfs-fuse.c:310: Error: operand out of range (0xffffffffffffff00 is not between 0x0000000000000000 and 0x0000000000000fff)
cmsfs-fuse.c:310: Error: operand out of range (0xffffffffffffff00 is not between 0x0000000000000000 and 0x0000000000000fff)
cmsfs-fuse.c:310: Error: operand out of range (0xffffffffffffff00 is not between 0x0000000000000000 and 0x0000000000000fff)
cmsfs-fuse.c:302: Error: operand out of range (0xfffffffffffffda0 is not between 0x0000000000000000 and 0x0000000000000fff)
cmsfs-fuse.c:302: Error: operand out of range (0xfffffffffffffda0 is not between 0x0000000000000000 and 0x0000000000000fff)
cmsfs-fuse.c:302: Error: operand out of range (0xfffffffffffffda0 is not between 0x0000000000000000 and 0x0000000000000fff)
cmsfs-fuse.c:302: Error: operand out of range (0xfffffffffffffda0 is not between 0x0000000000000000 and 0x0000000000000fff)
cmsfs-fuse.c:302: Error: operand out of range (0xfffffffffffffda0 is not between 0x0000000000000000 and 0x0000000000000fff)
Signed-off-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Reviewed-by: Philipp Rudo <prudo@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
When keys are generated concurrently in EKMF Web from multiple clients,
and the key labels use a sequence number tag, then the assignment logic
of the sequence number may cause a duplicate sequence number to be used,
because another key might have already been generated with the same
sequence number, since the next-to-use sequence number has been retrieved
from EKMF Web. This results in a HTTP response code of 409 and a -EEXIST
return code from ekmf_generate_key().
Instead of getting the last used sequence number from EKMFWeb, tell
EKMFWeb to automatically use the next available sequence number when
generating a key. When the sequence number label tag value is 'next'
then EKMFWeb will automatically assign the next available sequence number
to the label tag and increment the sequence number in an atomic way.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
If a memory chunk is added to mem_phys as well as mem_virt
in dfi_mem_chunk_add_vol() then an illegal memory access might occur
when accessing mem_chunk->data e.g. in dfi_elf_mem_chunk_read_fn()
because the data block pointed to by the data field is now being referenced
by two memory chunks, one in mem_phys and one in mem_virt. If it happens
that the memory chunk from mem_virt is freed in mem_unmap() then
the memory chunk in mem_phys still points to the common data block
which has been already freed. This leads to all sort of bad behavior
in dfi_elf_mem_chunk_read_fn() and other places where mem_chunk->data
might be accessed.
Fixes the following bug:
zgetdump: Unexpected end of file for "dump.all.elf"
And this was found by AddressSanitizer:
=================================================================
==81170==ERROR: AddressSanitizer: heap-use-after-free on address 0x602000000570 at pc 0x00000101ac10 bp 0x03ffd897e250 sp 0x03ffd897e248
READ of size 8 at 0x602000000570 thread T0
#0 0x101ac0f in dfi_elf_mem_chunk_read_fn s390-tools/zdump/dfi_elf.c:27
#1 0x100d8a5 in mem_read s390-tools/zdump/dfi.c:339
#2 0x100d8a5 in dfi_mem_phys_read s390-tools/zdump/dfi.c:616
#3 0x100d8a5 in mem_chunk_map_read_fn s390-tools/zdump/dfi.c:353
#4 0x100fd29 in mem_read s390-tools/zdump/dfi.c:339
#5 0x100fd29 in dfi_mem_read s390-tools/zdump/dfi.c:608
#6 0x1018e89 in os_info_get s390-tools/zdump/dfi_vmcoreinfo.c:65
#7 0x1018e89 in dfi_vmcoreinfo_init s390-tools/zdump/dfi_vmcoreinfo.c:86
#8 0x10175b3 in dfi_init s390-tools/zdump/dfi.c:1215
#9 0x1006e71 in do_stdout s390-tools/zdump/zgetdump.c:161
#10 0x1006e71 in main s390-tools/zdump/zgetdump.c:180
#11 0x3ffb07abb89 in __libc_start_main (/lib64/libc.so.6+0x2bb89)
#12 0x1007e8d (s390-tools/zdump/zgetdump+0x1007e8d)
0x602000000570 is located 0 bytes inside of 8-byte region [0x602000000570,0x602000000578)
freed by thread T0 here:
#0 0x3ffb0bc961b in free (/lib64/libasan.so.6+0xc961b)
#1 0x100d2d9 in mem_unmap s390-tools/zdump/dfi.c:1050
previously allocated by thread T0 here:
#0 0x3ffb0bc9aa9 in calloc (/lib64/libasan.so.6+0xc9aa9)
#1 0x100a271 in zg_alloc s390-tools/zdump/zg.c:93
SUMMARY: AddressSanitizer: heap-use-after-free s390-tools/zdump/dfi_elf.c:27 in dfi_elf_mem_chunk_read_fn
Shadow bytes around the buggy address:
0x100c0400000050: fa fa 00 fa fa fa 00 fa fa fa 00 fa fa fa 00 fa
0x100c0400000060: fa fa 00 fa fa fa 00 fa fa fa 00 fa fa fa 00 fa
0x100c0400000070: fa fa 00 fa fa fa 00 fa fa fa 00 fa fa fa 00 fa
0x100c0400000080: fa fa 00 fa fa fa 00 fa fa fa 00 fa fa fa 00 fa
0x100c0400000090: fa fa 00 fa fa fa 00 fa fa fa 00 fa fa fa 00 fa
=>0x100c04000000a0: fa fa 00 fa fa fa 00 fa fa fa 00 fa fa fa[fd]fa
0x100c04000000b0: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa
0x100c04000000c0: fa fa fd fa fa fa fd fa fa fa fd fa fa fa 04 fa
0x100c04000000d0: fa fa 00 fa fa fa 00 fa fa fa 00 fa fa fa 00 fa
0x100c04000000e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x100c04000000f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
Shadow gap: cc
==81170==ABORTING
Signed-off-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Reviewed-by: Philipp Rudo <prudo@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Verify the given ELF header before adding any memory chunks otherwise
a memory chunk might be added even if the given ELF header is invalid.
Signed-off-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Reviewed-by: Philipp Rudo <prudo@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Some Linux distributions always include a copy of all persistent device
configuration data when updating the initial RAM-disk. This makes
chzdev's persistent device configuration changes ineffective because
device configuration directives applied in the RAM-disk take precedence
over those stored in the root filesystem.
This patch introduces a new build-time switch which allows distributions
to specify that whenever there is a persistent device configuration
change, the RAM-disk is updated automatically.
This feature can be enabled by adding 'ZDEV_ALWAYS_UPDATE_INITRD=1' as
a zdev build option. Where, by default ZDEV_ALWAYS_UPDATE_INITRD is 0.
Co-developed-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Signed-off-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Signed-off-by: Vineeth Vijayan <vneethv@linux.ibm.com>
Reviewed-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
After a master key change, it can happen that the AF_ALG setkey
operation returns EINVAL, although the key is valid. This is a
temporary situation and the operation will succeed, once the firmware
has completed some internal processing related with the master key
change. Delay 1 second and retry up to 10 times.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
If fdasd is used right after dasdfmt, it may fail with the following
error due to udev still processing events for the device:
```
fdasd error: IOCTL error: Error while rereading partition table.
```
Call dasd_reread_partition_table() with an increased retry value to
circumvent this issue.
Closes: https://github.com/ibm-s390-tools/s390-tools/pull/103
Signed-off-by: Nikita Dubrovskii <nikita@linux.ibm.com>
[hoeppner@linux.ibm.com: Reword commit message]
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Extend zkey to allow to store a (dummy) LUKS2 passphrase together with a
secure key, for use with LUKS2 volumes. That way, when the repository is
backed up, or archived, also the passphrases of the associated LUKS2
volumes are backed up, or archived, and thus can not be forgotten.
This passphrase is then used in generated commands to format and open
the LUKS2 volumes.
Because of the use of secure keys to encrypt the volumes, the LUKS2
passphrase is of no or less relevance for security. It is therefore OK to
store the passphrase in clear text in the key repository, and also use
them in /etc/crypttab. Therefore, the passphrase could actually be a
trivial passphrase, or a dummy passphrase.
Note: Such a dummy passphrase is NOT considered a secret that needs to
be protected. If for a certain usage the passphrase is of relevance for
security, then the zkey dummy passphrase option must not be used to store
the passphrase.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Juergen Christ <jchrist@linux.ibm.com>
Reviewed-by: Harald Freudenberger <freude@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
gcc's -Werror switch also enables -Werror=inline which leads to a compilation
failure due to inline warnings caused by GLIB macros. To fix it, disable
the conversion of inline warnings into errors.
In file included from buildroot/qemu-s390x/host/bin/../s390x-buildroot-linux-gnu/sysroot/usr/lib/glib-2.0/include/glibconfig.h:9,
from buildroot/qemu-s390x/host/bin/../s390x-buildroot-linux-gnu/sysroot/usr/include/glib-2.0/glib/gtypes.h:32,
from buildroot/qemu-s390x/host/bin/../s390x-buildroot-linux-gnu/sysroot/usr/include/glib-2.0/glib/galloca.h:32,
from buildroot/qemu-s390x/host/bin/../s390x-buildroot-linux-gnu/sysroot/usr/include/glib-2.0/glib.h:30,
from pv/pv_hdr.c:10:
buildroot/qemu-s390x/build/s390-tools-2.15.1/genprotimg/src/utils/buffer.h: In function ‘pv_hdr_new’:
buildroot/qemu-s390x/host/bin/../s390x-buildroot-linux-gnu/sysroot/usr/include/glib-2.0/glib/gmacros.h:1028:49: error: inlining failed in call to ‘glib_autoptr_clear_Buffer’: call is unlikely and code size would grow [-Werror=inline]
1028 | #define _GLIB_AUTOPTR_CLEAR_FUNC_NAME(TypeName) glib_autoptr_clear_##TypeName
| ^~~~~~~~~~~~~~~~~~~
Signed-off-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Reviewed-by: Bjoern Walk <bwalk@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Current heap size in stage2 is three pages long [0x6000-0x9000] but
get_zeroed_page() assumes it is one page more which might lead to
a heap overflow which will corrupt data located at 0x9000 (stage3
parameters). Calculate the heap size of a stage at run-time
by using the symbols provided by linker.
Furthermore, validate the given address in free_page() to stop illegal
memory accesses.
Signed-off-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Reviewed-by: Philipp Rudo <prudo@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Prevent access to freed memory still pointed to by entry.
entry still points into load_page that has been released with free_page.
Signed-off-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
When some of the key properties are skipped due to null_values_only
being true or false, then the resulting EKMF tag list might be built
incorrectly.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
To remove a KMS property function kms_set_key_properties() can be
called with the property value set to NULL. Do not assert for non-NULL
property values.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
`-Winline` can cause problems with the cleanup functions defined by
glib. Therefore let's remove the cflag for now.
DEBUG: /usr/include/glib-2.0/glib/gmacros.h:1031:43: error: inlining failed in call to 'glib_autoptr_cleanup_STACK_OF_X509_CRL.isra.0': call is unlikely and \
code size would grow [-Werror=inline]
DEBUG: 1031 | #define _GLIB_AUTOPTR_FUNC_NAME(TypeName) glib_autoptr_cleanup_##TypeName
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
This should be no problem (if OpenSSL works correctly), because
`crls_download_cb` is only called out of the verification context of
OpenSSL. It's used to look up a CRL and therefore
X509_STORE_CTX_get_current_cert should always return a certificate
since X509_STORE_CTX_get_current_cert returns NULL only if an error
has occurred during the verification (see
https://www.openssl.org/docs/man1.1.0/man3/X509_STORE_CTX_get_current_cert.html).
Fixes: 074de1e14e ("genprotimg: add host-key document verification support")
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
2020-12-15 11:10:50 +01:00
777 changed files with 111010 additions and 14845 deletions
log_alert "Changing the re-IPL device failed. The current re-IPL settings might be inconsistent. Check and correct the settings (see the README.md of chreipl-fcp-mpath) to make sure that the current re-IPL device is valid."
return 14
fi
firmware_unlock_exclusive
if [ "${sdev_busid}" != "${ipl_busid}" ] \
|| [ "${sdev_wwpn}" != "${ipl_wwpn}" ] \
|| [ "${sdev_lun}" != "${ipl_lun}" ]; then
log_note "Changed re-IPL path to: ${sdev_busid}:${sdev_wwpn}:${sdev_lun}."
fi
# Try to update the information in the ID file if we have gotten the
if '@DEBUG@'; then hexdump -vC "${ID_FILE}" 1>&2; fi
fi
return 0
}
declare -g SDEV=""
if [[ "${DM_UUID}" == mpath-* ]]; then
# Assume Multipath Device Mapper Device;
# e.g.: DEVPATH = /devices/virtual/block/dm-0
for sdev in /sys/"${DEVPATH}"/slaves/sd*/device; do
if sdev_test_path_state "${sdev}"; then
SDEV="${sdev}"
break
fi
done
# No path of the multipath-device that represents the IPL volume is
# online.
if [ "${SDEV}" = "" ]; then
log_crit "The re-IPL device cannot be changed because no operational path to the re-IPL volume remains. The next re-IPL might fail unless you re-attach or enable at least one valid path to the re-IPL volume."
@@ -15,13 +15,13 @@ dasdfmt \- formatting of DASD (ECKD) disk drives.
.SHDESCRIPTION
\fBdasdfmt\fR formats a DASD (ECKD) disk drive to prepare it
for usage with Linux for S/390.
for usage with Linux for S/390.
The \fIdevice\fR is the node of the device (e.g. '/dev/dasda').
Any device node created by udev for kernel 2.6 can be used
Any device node created by udev for kernel 2.6 can be used
(e.g. '/dev/dasd/0.0.b100/disc').
.br
\fBWARNING\fR: Careless usage of \fBdasdfmt\fR can result in
\fBWARNING\fR: Careless usage of \fBdasdfmt\fR can result in
\fBLOSS OF DATA\fR.
.SHOPTIONS
@@ -31,7 +31,7 @@ Print usage and exit.
.TP
\fB-t\fR or \fB--test\fR
Disables any modification of the disk drive.
Disables any modification of the disk drive.
.br
\fBdasdfmt\fR just prints
out, what it \fBwould\fR do.
@@ -41,7 +41,7 @@ out, what it \fBwould\fR do.
Increases verbosity.
.TP
\fB-y\fR
\fB-y\fR
Start formatting without further user-confirmation.
.TP
@@ -59,7 +59,7 @@ Omit the writing of a disk label after formatting.
.br
This makes only sense for the 'ldl' disk layout.
.br
The '-L' option has to be specified after the '-d ldl' option.
The '-L' option has to be specified after the '-d ldl' option.
.br
e.g. dasdfmt -d ldl -L /dev/...
@@ -84,13 +84,13 @@ Formats the device with compatible disk layout or linux disk layout.
\fIlayout\fR is either \fIcdl\fR for the compatible disk layout
(default) or \fIldl\fR for the linux disk layout.
.br
Compatible disk layout means a special handling of the
first two tracks of the volume. This enables other S/390 or zSeries
Compatible disk layout means a special handling of the
first two tracks of the volume. This enables other S/390 or zSeries
operating systems to access this device (e.g. for backup purposes).
.TP
\fB-p\fR or \fB--progressbar\fR
Print a progress bar while formatting.
Print a progress bar while formatting.
Do not use this option if you are using a 3270 console,
running in background or redirecting the output to a file.
@@ -118,12 +118,17 @@ Specify the \fImode\fR to be used to format the device. Valid modes are:
.IPfull
Format the entire disk with the specified blocksize. (default)
.IPquick
Format the first two tracks and write label and partition information. Only use
this option if you are sure that the target DASD already contains a regular
Format the first two tracks and write label and partition information. Use this
option only if you are sure that the target DASD already contains a regular
format with the specified blocksize. A blocksize can optionally be specified
using \fB-b\fR (\fB--blocksize\fR).
.br
For thin-provisioned DASD ESE volumes this is the default mode.
For thin-provisioned DASD ESE volumes, quick is the default mode. A full space
release then precedes the formatting step. If this space release fails, dasdfmt
falls back to a full-format mode. Formatting stops if the space release fails
and quick mode was specified explicitly using \fB-M\fR. Specify the
\fB--no-discard\fR option to omit the space release.
.IPexpand
Format all unformatted tracks at the end of the target DASD. This mode assumes
that tracks at the beginning of the DASD volume have already been correctly
@@ -159,30 +164,30 @@ and always be a power of two. The recommended blocksize is 4096 bytes.
.TP
\fB-l\fR\fIvolser\fR or \fB--label\fR=\fIvolser\fR
Specify the volume serial number or volume identifier to be written
to disk after formatting. If no label is specified, a sensible default
is used. \fIvolser\fR is interpreted as ASCII string and is automatically
Specify the volume serial number or volume identifier to be written
to disk after formatting. If no label is specified, a sensible default
is used. \fIvolser\fR is interpreted as ASCII string and is automatically
converted to uppercase and then to EBCDIC.
.br
e.g. -l LNX001 or --label=DASD01
.br
The \fIvolser\fR identifies by serial number the volume. A volume serial
The \fIvolser\fR identifies by serial number the volume. A volume serial
number is 1 through 6 alphanumeric or one of the following special
characters: $, #, @, %. Enclose a serial number that contains special
characters in apostrophes. If the number is shorter than six
characters: $, #, @, %. Enclose a serial number that contains special
characters in apostrophes. If the number is shorter than six
characters, it is padded with trailing blanks.
.br
.br
Do notcodea volume serial number as SCRTCH, PRIVAT, orLnnnnn(L with
five numbers); these areusedin OS/390 messages toaskthe operator to
mount avolume.Donotcodea volume serial number as MIGRAT, which is
used bythe OS/390 Hierarchical Storage Manager DFSMShsm for migrated
Do not code a volumeserialnumber as SCRTCH,PRIVAT, or Lnnnnn (L with
fivenumbers);these are used in OS/390messages to ask the operator to
mount a volume. Do not code a volumeserialnumber as MIGRAT,which is
used by the OS/390HierarchicalStorageManagerDFSMShsm for migrated
data sets.
.br
NOTE: Try to avoid using special characters in the volume serial. This may cause problems accessing a disk by volser.
NOTE: Try to avoid using special characters in the volume serial. This may cause problems accessing a disk by volser.
.br
In case you really have to use special characters, make sure you are using quotes. In addition there is a special handling for the '$' sign. Please specify it using '\\$' if necessary.
.br
@@ -192,9 +197,8 @@ e.g. -l 'a@b\\$c#' to get A@B$C#
.TP
\fB-k\fR or \fB--keep_volser\fR
Keeps the Volume Serial Number, when writing the Volume Label. This is
useful, if the Serial Number has been written with a VM Tool and should not
be overwritten.
Keeps the Volume Serial Number when writing the Volume Label. This is useful if
the volume already has a Serial Number that should not be overwritten.
_("The '--x-scf' option cannot be used with the '--(enable|disable)-extension-secret-required' flags.\nUse 'genprotimg --help' for more information"));
Some files were not shown because too many files have changed in this diff
Show More
Reference in New Issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
